@sleep2agi/commhub-server 0.9.0-preview.12 → 0.9.0-preview.121

package/src/create-node-validate.ts

@@ -8,6 +8,8 @@
 // payload (RFC §4.6).
 
 import { isReservedEnvKey } from "./shared/reserved-env.js";
+import { checkNodeName } from "./shared/node-name.js";
+import { CODEX_CONFIG_ONLY_FLAG_KEYS, validateCodexConfigFlag } from "./codex-config-flags.js";
 
 export class ValidationError extends Error {
   constructor(public code: string, public detail?: Record<string, unknown>) {
@@ -17,10 +19,49 @@ export class ValidationError extends Error {
 }
 
 // §4.2.2 — structural enums.
-export const RUNTIMES = ["claude-agent-sdk", "codex-sdk", "grok-build-acp"] as const;
+// #1298 —— daemon 远程创建允许的 runtime。2026-08-28 从 3 个放开到 7 个。
+//
+// 放开之前挡着的问题是「daemon 建出来的是**无人值守**的后台进程,而三个共存 runtime
+// 的本质是人和 agent 共用一个 TUI 会话 —— 建出来给谁用?」
+//
+// Vincent 2026-08-28 定,理由是**兜底排错**:
+//   「某个节点突然不动了,人可以进去看。在 daemon 还没那么靠谱的情况下,
+//     这非常重要 —— 至少可以跟 Codex 和 Claude Code 对话。」
+// 🔴 关键在于 **attach 是「建好之后」的动作,不是「建的时候」的前提**。
+//
+// 支撑读数(2026-08-28 实测舰队):`通信牛` 跑 codex-app-server(共存 runtime),
+// **764 次成功完成任务**,当天仍在跑 —— 比两个普通 runtime 的节点(61 次 / 3 次)
+// 都多一个量级。⇒ 任务链路不需要人坐在屏幕前。
+//
+// 🔴 这七个名字与 `agent-network/src/normalize-runtime.ts` 的 `RuntimeName` 一致。
+//    那边是 CLI 侧的全集;两边分叉过一次(daemon 侧的 VALID_RUNTIMES 早就是 7 个,
+//    只有这里还是 3 个,而记录此事的 #1298 正文写的是「三道闸都关着」——
+//    **一份快照式的盘点,只在写下的那一刻是真的**)。
+export const RUNTIMES = [
+  "claude-agent-sdk",
+  "claude-code-cli",
+  "codex-sdk",
+  "codex-app-server",
+  "grok-build-acp",
+  "grok-build-cli",
+  "opencode-cli",
+] as const;
 export type Runtime = typeof RUNTIMES[number];
 
-export const FLAG_KEYS = ["permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout"] as const;
+// #584 —— `copresence` 是**建节点时**的开关,不是 agent 的运行参数:为 true 时 daemon 把它写成子节点
+// config 的 `codexCopresence: true`,之后一条 `anet node start` 就起共享 TUI(app 向导的「Codex（TUI 共存）」)。
+// 🔴 故意放在 flags 里而不是 node_spec 顶层:老 hub 的 zod 会静默丢弃未知顶层字段、老 daemon 也静默忽略
+//    —— 那正是 #584 的形状(用户选了共存,拿到无头节点,没有任何报错)。flags 的未知键在老 hub(这份
+//    FLAG_KEYS)和老 daemon(buildAnetArgsDaemon)都**拒绝**,新 app 撞到老组件得到的是一条报错。
+export const FLAG_KEYS = [
+  "permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout",
+  "copresence", "opencodeGeneration", "opencodeUnsafeTools",
+  "approvalPolicy", "sandboxMode", "skipGitRepoCheck", "copresenceFullAccess", "modelReasoningEffort",
+] as const;
+
+/** #584 —— 只有这些 runtime 认 `flags.copresence`。目前只有 codex-app-server 的共存靠 config 字段
+ *  (`codexCopresence`)决定;grok-build-cli / opencode-cli 各有自己的字段,接进来之前一律拒,不静默吞。 */
+export const COPRESENCE_FLAG_RUNTIMES = ["codex-app-server"] as const;
 export type FlagKey = typeof FLAG_KEYS[number];
 
 export const PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"] as const;
@@ -31,29 +72,82 @@ export const MAX_ENV_VALUE_BYTES = 16 * 1024;
 const ENV_KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
 
 // §4.2.2 name + model.
-const NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
-const MODEL_RE = /^[a-zA-Z0-9._:\-]+$/;
+// Board #652 — the name rule lives in ./shared/node-name.ts (byte-identical copy in
+// agent-node/src/shared/, drift-tested). It used to be /^[a-z][a-z0-9_-]{0,63}$/ here.
+// OpenCode 共存的模型带 provider 前缀(`opencode/mimo-v2.5-free`,agent-node parseModelRef 按第一个 `/` 切),
+// 桌面向导 0.2.61 起就发这种形状 —— 允许**恰好一个**斜杠分隔的两段;每段仍是原字符集,且不能是纯点(`..`/`.`)。
+const MODEL_SEGMENT = "[a-zA-Z0-9._:\\-]+";
+const MODEL_RE = new RegExp(`^${MODEL_SEGMENT}(?:/${MODEL_SEGMENT})?$`);
+const MODEL_DOT_ONLY_SEGMENT = /(^|\/)\.+(\/|$)/;
 
-export function validateName(s: unknown): asserts s is string {
-  if (typeof s !== "string" || !NAME_RE.test(s)) {
-    throw new ValidationError("node_name_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
+/** Board #652 — returns the normalized (trimmed) name the caller must store and forward. */
+export function validateName(s: unknown): string {
+  const r = checkNodeName(s);
+  if (!r.ok) {
+    throw new ValidationError("node_name_invalid", {
+      value: typeof s === "string" ? s.slice(0, 80) : typeof s,
+      reason: r.error,
+      ...(r.char !== undefined ? { char: r.char } : {}),
+      message: r.message,
+    });
   }
+  return r.name;
 }
 
 export function validateRuntime(s: unknown): asserts s is Runtime {
   if (typeof s !== "string" || !(RUNTIMES as readonly string[]).includes(s)) {
-    throw new ValidationError("runtime_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
+    // 🔴 原来只回一个 `runtime_invalid` + 用户传进来的那个值 —— **不说允许哪些,
+    //    也不说还有没有别的路**。2026-08-28 实测:从 Dashboard 建一个
+    //    `codex-app-server` 节点,用户拿到的就是
+    //      {"ok":false,"error":"runtime_invalid","value":"codex-app-server"}
+    //    而目标机器的 daemon 日志里一行都没有(请求根本没到)。
+    //    用户无从知道:①哪些是允许的 ②这个名字是不是打错了 ③有没有别的办法。
+    //
+    // `allowed` 直接由 RUNTIMES 展开,不是手写的第二份清单 ——
+    // 🔴 手写一份会漂移,而漂移之后报错会**理直气壮地告诉用户一组错的名字**。
+    throw new ValidationError("runtime_invalid", {
+      value: typeof s === "string" ? s.slice(0, 80) : typeof s,
+      allowed: [...RUNTIMES],
+      // 这句提示的前提是查过的:`agent-network/src/normalize-runtime.ts` 的
+      // `RuntimeName` / `SUPPORTED_RUNTIME_NAMES` 是 7 个,包含此处不放行的那几个,
+      // 所以「在目标机器上直接建」确实是一条真实存在的路,不是安慰话。
+      hint: "daemon 远程创建目前只放行以上 runtime；其余 runtime 可以在目标机器上直接 `anet node create --runtime <name>` 创建。",
+    });
   }
 }
 
-export function validateModel(s: unknown): asserts s is string {
-  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s)) {
+export function validateModel(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
+  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s) || MODEL_DOT_ONLY_SEGMENT.test(s)) {
     throw new ValidationError("model_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
   }
 }
 
+/**
+ * #605 —— `flags.timeout` 的单位是**毫秒**:agent-node 就是这么读的(cli.ts currentClaudeTimeoutMs /
+ * currentCodexTimeoutMs → util/timeout.ts resolveTimeoutMs、runtime/opencode-timeout.ts,默认 300000)。
+ * 这里曾按「秒」收 1..86400:填 600 想要 10 分钟的人拿到 0.6 秒、每个任务都超时;真正的毫秒值被拒。
+ *
+ * 范围与 update_node_config(config-apply-validate.ts)/ agent-node config-apply 同一把尺子:
+ * 0(不设上限)或 TIMEOUT_MS_MIN..TIMEOUT_MS_MAX。1..999 拒绝 —— 旧客户端按秒发的小值分辨不出意图,
+ * 不偷偷乘 1000,但也不再让任何人悄悄拿到一个亚秒超时。
+ */
+export const TIMEOUT_MS_MIN = 1000;
+export const TIMEOUT_MS_MAX = 3_600_000;
+export const TIMEOUT_MS_REASON =
+  `timeout is in milliseconds: 0 (no limit) or an integer ${TIMEOUT_MS_MIN}..${TIMEOUT_MS_MAX} (e.g. 600000 = 10 min)`;
+export function isValidTimeoutMs(v: unknown): v is number {
+  return typeof v === "number" && Number.isInteger(v) && (v === 0 || (v >= TIMEOUT_MS_MIN && v <= TIMEOUT_MS_MAX));
+}
+
 export function validateFlagValue(k: string, v: unknown): void {
   switch (k) {
+    case "opencodeGeneration":
+      if (v !== "v1" && v !== "v2") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be v1 or v2" });
+      return;
+    case "opencodeUnsafeTools":
+      if (typeof v !== "boolean") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be boolean" });
+      return;
     case "permissionMode":
       if (typeof v !== "string" || !(PERMISSION_MODES as readonly string[]).includes(v)) {
         throw new ValidationError("flag_value_invalid", { field: k, reason: "must be one of default/acceptEdits/plan/bypassPermissions" });
@@ -73,15 +167,79 @@ export function validateFlagValue(k: string, v: unknown): void {
       }
       return;
     case "timeout":
-      if (!Number.isInteger(v) || (v as number) < 1 || (v as number) > 86400) {
-        throw new ValidationError("flag_value_invalid", { field: k, reason: "must be integer 1..86400" });
+      if (!isValidTimeoutMs(v)) {
+        throw new ValidationError("flag_value_invalid", { field: k, reason: TIMEOUT_MS_REASON });
       }
       return;
+    case "copresence":
+      if (typeof v !== "boolean") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be boolean" });
+      return;
     default:
+      if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) {
+        const fail = validateCodexConfigFlag(k, v, null);
+        if (fail) throw new ValidationError("flag_value_invalid", { field: k, reason: fail.reason });
+        return;
+      }
       throw new ValidationError("flag_key_unknown", { field: k });
   }
 }
 
+/** #584 —— 逐键校验之外的跨字段一条:`copresence` 只对 COPRESENCE_FLAG_RUNTIMES 有意义。
+ *  在别的 runtime 上收下它而什么都不做,就是又一个「选了共存、拿到无头」。 */
+export function validateFlagsForRuntime(runtime: string, flags: Record<string, unknown> | undefined | null): void {
+  if (!flags) return;
+  // Strict flags envelope: old Hub/daemon reject these keys rather than dropping
+  // unknown node_spec fields. Opt-in must be explicit on this create request.
+  for (const field of ["opencodeGeneration", "opencodeUnsafeTools"]) {
+    if (!Object.prototype.hasOwnProperty.call(flags, field)) continue;
+    validateFlagValue(field, flags[field]);
+    if (runtime !== "opencode-cli") throw new ValidationError("flag_not_applicable_to_runtime", { field, runtime, applicable: ["opencode-cli"] });
+  }
+  if (Object.prototype.hasOwnProperty.call(flags, "opencodeUnsafeTools") && flags.opencodeGeneration !== "v2") {
+    throw new ValidationError("opencode_unsafe_requires_v2", { reason: "opencodeUnsafeTools requires explicit opencodeGeneration=v2" });
+  }
+  if (flags.opencodeGeneration === "v2" && flags.opencodeUnsafeTools !== true) {
+    throw new ValidationError("opencode_v2_requires_unsafe_opt_in", { reason: "V2 preview enables every local tool; trusted tasks only. Explicit opencodeUnsafeTools=true required." });
+  }
+  if (Object.prototype.hasOwnProperty.call(flags, "copresence") && !(COPRESENCE_FLAG_RUNTIMES as readonly string[]).includes(runtime)) {
+    throw new ValidationError("flag_not_applicable_to_runtime", {
+      field: "copresence", runtime, applicable: [...COPRESENCE_FLAG_RUNTIMES],
+    });
+  }
+  for (const [k, v] of Object.entries(flags)) {
+    if (!CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) continue;
+    const fail = validateCodexConfigFlag(k, v, runtime);
+    if (fail) throw new ValidationError("flag_value_invalid", { field: k, reason: fail.reason });
+  }
+}
+
+/**
+ * V2 co-presence start requires OpenCode's own `provider/model`.
+ * Call only after the unsafe-opt-in check: a missing opt-in stays
+ * `opencode_v2_requires_unsafe_opt_in`. This API does not take an anet
+ * provider preset or a vault key (#2565 owns presets).
+ */
+export function validateOpenCodeV2ProviderModel(
+  runtime: string,
+  model: unknown,
+  flags: Record<string, unknown> | undefined | null,
+): void {
+  if (runtime !== "opencode-cli" || !flags || typeof flags !== "object") return;
+  if (flags.opencodeGeneration !== "v2" || flags.opencodeUnsafeTools !== true) return;
+  const native = typeof model === "string"
+    && model.length > 0
+    && model.length <= 100
+    && MODEL_RE.test(model)
+    && !MODEL_DOT_ONLY_SEGMENT.test(model)
+    && model.includes("/")
+    && model.indexOf("/") === model.lastIndexOf("/");
+  if (!native) {
+    throw new ValidationError("opencode_v2_requires_provider_model", {
+      reason: "OpenCode V2 uses the installed OpenCode provider/model (exactly one slash, for example provider/model). This API does not take an anet provider preset.",
+    });
+  }
+}
+
 // §4.4.7 — env_refs 7-step gate. networkSecretsGet is injected so
 // callers can supply either a real DB lookup (hub) or a fixture (tests).
 // The 6th step also reports the resolved value size; we return the
@@ -144,7 +302,7 @@ export function validateEnvRefs(
   return out;
 }
 
-// §4.4.7 — safe serializer for .env.local. Dotenv-quoted with escape
+// §4.4.7 — safe serializer for the node secrets.env file. Dotenv-quoted with escape
 // for backslash / double-quote / newline / carriage-return so that a
 // value containing `\n"evil=KEY2"` cannot pollute the next line.
 export function serializeEnvLocal(env: Record<string, string>): string {
@@ -158,6 +316,40 @@ export function serializeEnvLocal(env: Record<string, string>): string {
   }).join("\n") + "\n";
 }
 
+// app「新建节点」工作目录 —— hub 只判**形状**(daemon 才知道那台机器的 $HOME、系统目录、
+// 目录里住没住别的节点,那几条在 agent-node/src/runtime/child-workdir.ts)。
+// 这里挡的是「根本不像一条路径」的输入,让它在派发前就失败,而不是占一个请求行再被 daemon 拒。
+export const MAX_WORKDIR_LEN = 1024;
+export function validateWorkdir(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
+  if (typeof s !== "string") throw new ValidationError("workdir_invalid", { reason: "must be string" });
+  const v = s.trim();
+  if (v.length === 0 || v.length > MAX_WORKDIR_LEN) {
+    throw new ValidationError("workdir_invalid", { reason: `length 1..${MAX_WORKDIR_LEN}` });
+  }
+  if (/[\u0000-\u001f\u007f]/.test(v)) throw new ValidationError("workdir_invalid", { reason: "control character" });
+  const shapeOk = v.startsWith("/") || v === "~" || v.startsWith("~/") || /^[A-Za-z]:[\\/]/.test(v);
+  if (!shapeOk) {
+    throw new ValidationError("workdir_invalid", { reason: "must be absolute (/…, ~/…, or C:\\…)", value: v.slice(0, 80) });
+  }
+}
+
+/** daemon 自报的默认工作目录根(`daemon_capabilities.default_workdir_root`),消毒后返回;
+ *  没报 / 形状不对 = null。**非 null 即表示该 daemon 认 `node_spec.workdir`** ——
+ *  create_node 的「老 daemon 不收 workdir」门和 /api/host-supervisors 的透出共用这一个判据。 */
+export function daemonDefaultWorkdirRoot(configSnapshot: unknown): string | null {
+  try {
+    const snap = typeof configSnapshot === "string" ? JSON.parse(configSnapshot) : configSnapshot;
+    const v = (snap as any)?.daemon_capabilities?.default_workdir_root;
+    if (typeof v !== "string" || v.length === 0 || v.length > MAX_WORKDIR_LEN) return null;
+    if (/[\u0000-\u001f\u007f]/.test(v)) return null;
+    if (!(v.startsWith("/") || /^[A-Za-z]:[\\/]/.test(v))) return null;
+    return v;
+  } catch {
+    return null;
+  }
+}
+
 // §4.2.5 — channels fail-closed in P1.
 export function validateChannelsP1(channels: unknown): void {
   if (channels === undefined || channels === null) return;
@@ -173,7 +365,7 @@ export function validateChannelsP1(channels: unknown): void {
 export interface NodeSpec {
   name: string;
   runtime: Runtime;
-  model: string;
+  model?: string | null;
   flags?: Record<string, unknown>;
   channels?: unknown;
 }
@@ -187,20 +379,30 @@ function kebab(k: string): string {
 // shell, no string concat). Each value has already passed type/enum
 // validation, so String() coercion is safe.
 export function buildAnetArgs(spec: NodeSpec): string[] {
+  for (const field of ["opencodeGeneration", "opencodeUnsafeTools"]) {
+    if (Object.prototype.hasOwnProperty.call(spec, field)) throw new ValidationError("flag_location_invalid", { field, reason: "use node_spec.flags" });
+  }
   validateName(spec.name);
   validateRuntime(spec.runtime);
   validateModel(spec.model);
   validateChannelsP1(spec.channels);
 
-  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime, "--model", spec.model];
+  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime];
+  if (spec.model) args.push("--model", spec.model);
   if (spec.flags && typeof spec.flags === "object") {
     for (const [k, v] of Object.entries(spec.flags)) {
       if (!(FLAG_KEYS as readonly string[]).includes(k)) {
         throw new ValidationError("flag_key_unknown", { field: k });
       }
       validateFlagValue(k, v);
+      // `anet node create --copresence` 是布尔开关,不吃值。
+      if (k === "copresence") { if (v === true) args.push("--copresence"); continue; }
+      if (k === "opencodeUnsafeTools") { if (v === true) args.push("--opencode-unsafe-tools"); continue; }
+      if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) continue;
       args.push(`--${kebab(k)}`, String(v));
     }
+    validateFlagsForRuntime(spec.runtime, spec.flags);
   }
+  validateOpenCodeV2ProviderModel(spec.runtime, spec.model, spec.flags);
   return args;
 }

package/src/create-node-workdir.test.ts

@@ -0,0 +1,289 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import "./require-explicit-test-db.js";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+import { daemonDefaultWorkdirRoot, validateWorkdir, ValidationError } from "./create-node-validate.js";
+import { addNetworkMember, login, register } from "./auth.js";
+
+// app「新建节点」工作目录 —— hub 这一层管三件事:
+//   ① node_spec.workdir 的**形状**(绝对 / ~/… / C:\…),派发前就拒
+//   ② daemon 没自报 default_workdir_root(= 老 daemon,会静默忽略 workdir)⇒ 拒,不派
+//   ③ 请求行存下 workdir,get_create_request 原样交给 daemon;不带就**不出现**这个键
+// 以及 /api/host-supervisors 只给 admin/owner 透出默认根(它是那台机器的家目录路径)。
+
+const NET = "net_workdir_gate";
+const USER_ID = "u_workdir_admin";
+const DAEMON_ID = "node_workdir_daemon";
+const DAEMON_ALIAS = "workdir-daemon";
+const DAEMON_TOK = "tok_workdir_daemon";
+const ROOT = "/home/user";
+
+interface ToolHandler { (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>; }
+interface Reply { ok?: boolean; error?: string; request_id?: string; node_spec?: any; [k: string]: unknown; }
+
+function cleanup() {
+  for (const t of ["node_create_requests", "audit_log", "nodes", "sessions", "api_tokens", "network_members"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER_ID]); } catch {}
+}
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed(caps: Record<string, unknown>) {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'user', datetime('now'))`, [USER_ID]);
+  db.run(`INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET, USER_ID]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'admin', datetime('now'))`, [USER_ID, NET]);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, config_snapshot, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, ?4, 'host-x', datetime('now'), datetime('now'), 'active')`,
+    [DAEMON_ID, DAEMON_ALIAS, NET, JSON.stringify({ role: "host_supervisor", daemon_capabilities: { runtimes_supported: ["claude-agent-sdk"], ...caps } })],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [DAEMON_TOK, USER_ID, NET, `node:${DAEMON_ALIAS}`, `hash_${DAEMON_TOK}`],
+  );
+}
+
+function tools(callerTokenId: string | null = null): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const out: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, d: string, schema: any, handler: ToolHandler) => { out[name] = handler; return origTool(name, d, schema, handler); };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, cfg: any, handler: ToolHandler) => { out[name] = handler; return origRegisterTool(name, cfg, handler); };
+  }
+  registerTools(server, undefined, NET, USER_ID, null, true, callerTokenId);
+  return out;
+}
+
+async function call(h: ToolHandler, args: any): Promise<Reply> {
+  return JSON.parse((await h(args)).content[0].text) as Reply;
+}
+
+const baseSpec = { name: "wd-child", runtime: "claude-agent-sdk", model: "claude-sonnet-4-5", flags: {} };
+
+function rowCount(): number {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_create_requests WHERE daemon_node_id = ?1", DAEMON_ID)?.n ?? -1;
+}
+
+describe("validateWorkdir — shape only", () => {
+  const ok = ["/home/user/proj", "/srv/x", "~", "~/proj", "C:\\Users\\alice\\proj", "D:/work", "  /padded  "];
+  for (const v of ok) test(`accepts ${JSON.stringify(v)}`, () => { expect(() => validateWorkdir(v)).not.toThrow(); });
+  test("accepts undefined / null (field omitted)", () => {
+    expect(() => validateWorkdir(undefined)).not.toThrow();
+    expect(() => validateWorkdir(null)).not.toThrow();
+  });
+  const bad: unknown[] = ["", "   ", "proj", "./proj", "../x", "~alice/x", "C:proj", "/a\nb", "/a\u0000b", "x".repeat(10) + "/", "/" + "a".repeat(1024), 42, {}];
+  for (const v of bad) {
+    test(`rejects ${JSON.stringify(v)?.slice(0, 40)}`, () => {
+      let code = "";
+      try { validateWorkdir(v); } catch (e) { code = (e as ValidationError).code; }
+      expect(code).toBe("workdir_invalid");
+    });
+  }
+});
+
+describe("daemonDefaultWorkdirRoot — sanitize the self-report", () => {
+  const snap = (v: unknown) => JSON.stringify({ daemon_capabilities: { default_workdir_root: v } });
+  test("absolute posix root passes through", () => { expect(daemonDefaultWorkdirRoot(snap(ROOT))).toBe(ROOT); });
+  test("windows root passes through", () => { expect(daemonDefaultWorkdirRoot(snap("C:\\Users\\alice"))).toBe("C:\\Users\\alice"); });
+  test("object snapshot (not string) also accepted", () => {
+    expect(daemonDefaultWorkdirRoot({ daemon_capabilities: { default_workdir_root: ROOT } })).toBe(ROOT);
+  });
+  for (const v of [undefined, null, "", "relative", "~/x", 7, "/a\nb", "/" + "a".repeat(1100)]) {
+    test(`not reported / malformed ${JSON.stringify(v)?.slice(0, 30)} → null`, () => {
+      expect(daemonDefaultWorkdirRoot(snap(v))).toBeNull();
+    });
+  }
+  test("null / garbage snapshot → null", () => {
+    expect(daemonDefaultWorkdirRoot(null)).toBeNull();
+    expect(daemonDefaultWorkdirRoot("{not json")).toBeNull();
+  });
+});
+
+describe("create_node + workdir", () => {
+  test("#829 V2 flags survive Hub storage and daemon pull", async () => {
+    seed({ runtimes_supported: ["opencode-cli"] });
+    const flags = { opencodeGeneration: "v2", opencodeUnsafeTools: true, timeout: 600000 };
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", model: "stub/model", flags } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ flags_json: string }>("SELECT flags_json FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(JSON.parse(row!.flags_json)).toEqual(flags);
+    const pulled = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(pulled.ok).toBe(true);
+    expect(pulled.node_spec.flags).toEqual(flags);
+  });
+
+  test("#829 V2 without native provider/model rejected before request or child token mint", async () => {
+    seed({ runtimes_supported: ["opencode-cli"] });
+    const tokenCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM api_tokens WHERE network_id = ?1", NET)!.n;
+    const before = tokenCount();
+    const flags = { opencodeGeneration: "v2", opencodeUnsafeTools: true };
+    const missing = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", flags } });
+    expect(missing.error).toBe("opencode_v2_requires_provider_model");
+    const bare = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", model: "opencode", flags } });
+    expect(bare.error).toBe("opencode_v2_requires_provider_model");
+    expect(rowCount()).toBe(0);
+    expect(tokenCount()).toBe(before);
+  });
+
+  test("#829 missing opt-in rejected before request or child token mint", async () => {
+    seed({ runtimes_supported: ["opencode-cli"] });
+    const tokenCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM api_tokens WHERE network_id = ?1", NET)!.n;
+    const before = tokenCount();
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", flags: { opencodeGeneration: "v2" } } });
+    expect(r.error).toBe("opencode_v2_requires_unsafe_opt_in");
+    expect(rowCount()).toBe(0);
+    expect(tokenCount()).toBe(before);
+  });
+  test("🔴 old daemon (no default_workdir_root) + workdir → workdir_not_supported_by_daemon, NO row", async () => {
+    seed({});
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: `${ROOT}/wd-child` } });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("workdir_not_supported_by_daemon");
+    expect(rowCount()).toBe(0);
+  });
+
+  test("old daemon WITHOUT workdir still dispatches (no regression for existing callers)", async () => {
+    seed({});
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: baseSpec });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBeNull();
+  });
+
+  test("bad shape rejected before dispatch → workdir_invalid, NO row", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: "relative/dir" } });
+    expect(r.error).toBe("workdir_invalid");
+    expect(rowCount()).toBe(0);
+  });
+
+  test("new daemon + workdir → row stores it and get_create_request hands it to the daemon", async () => {
+    seed({ default_workdir_root: ROOT });
+    const wd = `${ROOT}/wd-child`;
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: wd } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBe(wd);
+    const g = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect(g.node_spec.workdir).toBe(wd);
+    expect(g.node_spec.name).toBe(baseSpec.name);
+  });
+
+  test("workdir is trimmed before storage", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: `  ~/wd-child  ` } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBe("~/wd-child");
+  });
+
+  test("new daemon WITHOUT workdir → get_create_request node_spec has NO workdir key (daemon keeps legacy layout)", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: baseSpec });
+    expect(r.ok).toBe(true);
+    const g = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect("workdir" in g.node_spec).toBe(false);
+  });
+
+  test("audit detail records the requested workdir", async () => {
+    seed({ default_workdir_root: ROOT });
+    const wd = `${ROOT}/wd-child`;
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: wd } });
+    const a = db.get<{ detail: string }>(
+      "SELECT detail FROM audit_log WHERE target_id = ?1 AND action = 'create_node_dispatch_attempted'", r.request_id,
+    );
+    expect(JSON.parse(a?.detail || "{}").workdir).toBe(wd);
+  });
+
+  test("list_host_supervisors (MCP) surfaces default_workdir_root for admin", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().list_host_supervisors, {});
+    const d = (r as any).daemons.find((x: any) => x.daemon_node_id === DAEMON_ID);
+    expect(d.default_workdir_root).toBe(ROOT);
+  });
+
+  test("list_host_supervisors (MCP) omits the key for an old daemon", async () => {
+    seed({});
+    const r = await call(tools().list_host_supervisors, {});
+    const d = (r as any).daemons.find((x: any) => x.daemon_node_id === DAEMON_ID);
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+});
+
+// ── REST /api/host-supervisors: admin sees the root, member does not ──────────
+let BASE = "";
+let server: any = null;
+let ownerTok = "", memberTok = "", restNet = "", ownerId = "";
+describe("/api/host-supervisors — default_workdir_root visibility", () => {
+  beforeAll(async () => {
+    process.env.HOST = "127.0.0.1";
+    const sfx = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+    const pw = "BootstrapPw123Aa!";
+    const s = register(`wd_seed_${sfx}`, pw, undefined, "seed");
+    if (!s.ok) throw new Error("seed failed");
+    db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`wd_seed_${sfx}`]);
+    const o = register(`wd_owner_${sfx}`, pw, undefined, "seed");
+    if (!o.ok || !o.token) throw new Error("owner register failed");
+    ownerTok = o.token; restNet = o.network_id ?? "";
+    ownerId = login(`wd_owner_${sfx}`, pw).user!.user_id;
+    const m = register(`wd_member_${sfx}`, pw, undefined, "seed");
+    if (!m.ok || !m.token) throw new Error("member register failed");
+    memberTok = m.token;
+    const memberId = login(`wd_member_${sfx}`, pw).user!.user_id;
+    // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+    const add = addNetworkMember(restNet, memberId, "member", undefined, { agentAccess: "all" });
+    if (!add.ok) throw new Error("add member failed: " + add.error);
+    const { bootServer } = await import("./server.js");
+    server = bootServer({ port: 0, hostname: "127.0.0.1" });
+    BASE = `http://127.0.0.1:${server.port}`;
+    for (const [alias, caps] of [["wd-new", { default_workdir_root: ROOT }], ["wd-old", {}]] as const) {
+      db.run(
+        `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, runtime, model, config_path, channels, server, hostname, network_id, config_revision, config_snapshot)
+         VALUES (?1, ?2, ?2, 'claude-agent-sdk', 'm', '/tmp/cfg.json', '[]', 'h', 'h', ?3, 0, ?4)`,
+        [`wd_n_${alias}`, alias, restNet, JSON.stringify({ role: "host_supervisor", daemon_capabilities: caps })],
+      );
+      db.run(
+        `INSERT OR REPLACE INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, 'network')`,
+        [`wd_t_${alias}`, `hash_wd_${alias}`, ownerId, restNet, `node:${alias}`],
+      );
+    }
+  });
+  afterAll(() => {
+    try { server?.stop?.(true); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [restNet]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1 AND name LIKE 'node:%'", [restNet]); } catch {}
+  });
+
+  async function list(tok: string): Promise<any[]> {
+    const res = await fetch(`${BASE}/api/host-supervisors?network_id=${encodeURIComponent(restNet)}`, { headers: { Authorization: `Bearer ${tok}` } });
+    const b = await res.json();
+    if (!b.ok) throw new Error("list failed: " + JSON.stringify(b));
+    return b.daemons;
+  }
+
+  test("owner sees default_workdir_root on the new daemon", async () => {
+    const d = (await list(ownerTok)).find(x => x.alias === "wd-new");
+    expect(d?.default_workdir_root).toBe(ROOT);
+  });
+  test("old daemon row has NO default_workdir_root key (app hides the row)", async () => {
+    const d = (await list(ownerTok)).find(x => x.alias === "wd-old");
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+  test("🔴 member does NOT see the host's home path", async () => {
+    const rows = await list(memberTok);
+    const d = rows.find(x => x.alias === "wd-new");
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+});