@sleep2agi/commhub-server 0.9.0-preview.120 → 0.9.0-preview.121

package/src/create-node-validate.ts

@@ -9,6 +9,7 @@
 
 import { isReservedEnvKey } from "./shared/reserved-env.js";
 import { checkNodeName } from "./shared/node-name.js";
+import { CODEX_CONFIG_ONLY_FLAG_KEYS, validateCodexConfigFlag } from "./codex-config-flags.js";
 
 export class ValidationError extends Error {
   constructor(public code: string, public detail?: Record<string, unknown>) {
@@ -52,7 +53,11 @@ export type Runtime = typeof RUNTIMES[number];
 // 🔴 故意放在 flags 里而不是 node_spec 顶层:老 hub 的 zod 会静默丢弃未知顶层字段、老 daemon 也静默忽略
 //    —— 那正是 #584 的形状(用户选了共存,拿到无头节点,没有任何报错)。flags 的未知键在老 hub(这份
 //    FLAG_KEYS)和老 daemon(buildAnetArgsDaemon)都**拒绝**,新 app 撞到老组件得到的是一条报错。
-export const FLAG_KEYS = ["permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout", "copresence", "opencodeGeneration", "opencodeUnsafeTools"] as const;
+export const FLAG_KEYS = [
+  "permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout",
+  "copresence", "opencodeGeneration", "opencodeUnsafeTools",
+  "approvalPolicy", "sandboxMode", "skipGitRepoCheck", "copresenceFullAccess", "modelReasoningEffort",
+] as const;
 
 /** #584 —— 只有这些 runtime 认 `flags.copresence`。目前只有 codex-app-server 的共存靠 config 字段
  *  (`codexCopresence`)决定;grok-build-cli / opencode-cli 各有自己的字段,接进来之前一律拒,不静默吞。 */
@@ -170,6 +175,11 @@ export function validateFlagValue(k: string, v: unknown): void {
       if (typeof v !== "boolean") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be boolean" });
       return;
     default:
+      if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) {
+        const fail = validateCodexConfigFlag(k, v, null);
+        if (fail) throw new ValidationError("flag_value_invalid", { field: k, reason: fail.reason });
+        return;
+      }
       throw new ValidationError("flag_key_unknown", { field: k });
   }
 }
@@ -196,6 +206,38 @@ export function validateFlagsForRuntime(runtime: string, flags: Record<string, u
       field: "copresence", runtime, applicable: [...COPRESENCE_FLAG_RUNTIMES],
     });
   }
+  for (const [k, v] of Object.entries(flags)) {
+    if (!CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) continue;
+    const fail = validateCodexConfigFlag(k, v, runtime);
+    if (fail) throw new ValidationError("flag_value_invalid", { field: k, reason: fail.reason });
+  }
+}
+
+/**
+ * V2 co-presence start requires OpenCode's own `provider/model`.
+ * Call only after the unsafe-opt-in check: a missing opt-in stays
+ * `opencode_v2_requires_unsafe_opt_in`. This API does not take an anet
+ * provider preset or a vault key (#2565 owns presets).
+ */
+export function validateOpenCodeV2ProviderModel(
+  runtime: string,
+  model: unknown,
+  flags: Record<string, unknown> | undefined | null,
+): void {
+  if (runtime !== "opencode-cli" || !flags || typeof flags !== "object") return;
+  if (flags.opencodeGeneration !== "v2" || flags.opencodeUnsafeTools !== true) return;
+  const native = typeof model === "string"
+    && model.length > 0
+    && model.length <= 100
+    && MODEL_RE.test(model)
+    && !MODEL_DOT_ONLY_SEGMENT.test(model)
+    && model.includes("/")
+    && model.indexOf("/") === model.lastIndexOf("/");
+  if (!native) {
+    throw new ValidationError("opencode_v2_requires_provider_model", {
+      reason: "OpenCode V2 uses the installed OpenCode provider/model (exactly one slash, for example provider/model). This API does not take an anet provider preset.",
+    });
+  }
 }
 
 // §4.4.7 — env_refs 7-step gate. networkSecretsGet is injected so
@@ -356,9 +398,11 @@ export function buildAnetArgs(spec: NodeSpec): string[] {
       // `anet node create --copresence` 是布尔开关,不吃值。
       if (k === "copresence") { if (v === true) args.push("--copresence"); continue; }
       if (k === "opencodeUnsafeTools") { if (v === true) args.push("--opencode-unsafe-tools"); continue; }
+      if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) continue;
       args.push(`--${kebab(k)}`, String(v));
     }
     validateFlagsForRuntime(spec.runtime, spec.flags);
   }
+  validateOpenCodeV2ProviderModel(spec.runtime, spec.model, spec.flags);
   return args;
 }

package/src/create-node-workdir.test.ts

@@ -119,6 +119,19 @@ describe("create_node + workdir", () => {
     expect(pulled.node_spec.flags).toEqual(flags);
   });
 
+  test("#829 V2 without native provider/model rejected before request or child token mint", async () => {
+    seed({ runtimes_supported: ["opencode-cli"] });
+    const tokenCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM api_tokens WHERE network_id = ?1", NET)!.n;
+    const before = tokenCount();
+    const flags = { opencodeGeneration: "v2", opencodeUnsafeTools: true };
+    const missing = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", flags } });
+    expect(missing.error).toBe("opencode_v2_requires_provider_model");
+    const bare = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", model: "opencode", flags } });
+    expect(bare.error).toBe("opencode_v2_requires_provider_model");
+    expect(rowCount()).toBe(0);
+    expect(tokenCount()).toBe(before);
+  });
+
   test("#829 missing opt-in rejected before request or child token mint", async () => {
     seed({ runtimes_supported: ["opencode-cli"] });
     const tokenCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM api_tokens WHERE network_id = ?1", NET)!.n;

package/src/daemon-provider-snapshots.test.ts

@@ -0,0 +1,256 @@
+import "./require-explicit-test-db";
+import { afterAll, beforeEach, expect, test } from "bun:test";
+import { readFileSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash } from 'node:crypto';
+import { db } from "./db";
+import { registerTools } from "./tools";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { reconcileProviderSnapshots, readLocalProviderSnapshot } from "../../agent-node/src/runtime/daemon-provider-snapshot";
+import { DaemonProviderStore } from "../../agent-network/src/daemon-provider-store";
+import { register, createNetworkTokenForNode } from "./auth";
+
+const net = "net_dps906", user = "u_dps906", node = "node_dps906", token = "token_dps906", alias = "daemon906";
+const root = mkdtempSync(join(tmpdir(), "dps906-"));
+function cleanup() {
+  db.run('DELETE FROM daemon_provider_applications WHERE request_id IN (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1)', [net]);
+  db.run('DELETE FROM daemon_provider_writes WHERE request_id IN (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1)', [net]);
+  db.run('DELETE FROM node_daemon_bindings WHERE network_id=?1', [net]);
+  for (const t of ["daemon_provider_snapshots", "nodes", "api_tokens", "network_members"]) db.run(`DELETE FROM ${t} WHERE network_id=?1`, [net]);
+  db.run("DELETE FROM networks WHERE network_id=?1", [net]);
+  db.run("DELETE FROM users WHERE user_id=?1", [user]);
+}
+beforeEach(() => {
+  cleanup();
+  db.run("INSERT INTO users (user_id,username,password_hash,role) VALUES (?1,?1,'x','user')", [user]);
+  db.run("INSERT INTO networks (network_id,network_name,owner_id) VALUES (?1,?1,?2)", [net, user]);
+  db.run("INSERT INTO network_members (user_id,network_id,role) VALUES (?1,?2,'owner')", [user, net]);
+  db.run("INSERT INTO nodes (node_id,node_name,alias,network_id,config_snapshot) VALUES (?1,?2,?2,?3,?4)", [node, alias, net, JSON.stringify({ role: "host_supervisor" })]);
+  db.run("INSERT INTO api_tokens (token_id,user_id,network_id,scope,name,token_hash) VALUES (?1,?2,?3,'network',?4,?5)", [token, user, net, `node:${alias}`, `hash_${token}`]);
+});
+afterAll(() => { cleanup(); rmSync(root, { recursive: true, force: true }); });
+function client(kind = "human", network = net) {
+  const handlers: Record<string, any> = {};
+  // Capture the actual registerTools handlers, including production guards.
+  const server = new McpServer({ name: "test906", version: "0" }) as any;
+  const tool = server.tool.bind(server), register = server.registerTool.bind(server);
+  server.tool = (name: string, description: any, schema: any, handler: any) => { handlers[name] = handler; return tool(name, description, schema, handler); };
+  server.registerTool = (name: string, config: any, handler: any) => { handlers[name] = handler; return register(name, config, handler); };
+  registerTools(server, undefined, kind === "daemon" ? network : null, kind === "anonymous" ? null : user,
+    alias, kind === "daemon", kind === "daemon" ? token : null);
+  return async (name: string, args: any = {}) => JSON.parse((await handlers[name](args)).content[0].text);
+}
+const snapshot = () => ({ network_id: net, daemon_node_id: node, revision: 0, source: "daemon", providers: [] });
+const request = () => client()("daemon_provider_snapshot", { action: "refresh", network_id: net, id: node });
+
+test('application transport: scoped intent, capability gate, exact public receipt and changed binding refusal', async () => {
+  const human = client(), daemon = client('daemon');
+  const child = 'node_apply906';
+  db.run("INSERT INTO nodes (node_id,node_name,alias,network_id,runtime) VALUES (?1,'child906','child906',?2,'codex-app-server')", [child, net]);
+  db.run("INSERT INTO node_daemon_bindings (request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES ('binding_apply906',?1,?2,?3,?4,?5,'active',1,1)", [net, child, node, root, user]);
+  const selection = { node_id: child, node_revision: 'a'.repeat(64), provider_id: 'custom', auth_id: 'work', model: 'model-a', confirm_restart: true };
+  const args = { action: 'apply', id: node, network_id: net, revision: 1, provider: selection };
+  expect((await human('daemon_provider_snapshot', { ...args, provider: { ...selection, key: 'TEST-ONLY-key' } })).error).toBe('invalid_application');
+  expect((await human('daemon_provider_snapshot', { ...args, provider: { ...selection, node_id: node } })).error).toBe('application_target_not_bound');
+  expect((await daemon('daemon_provider_snapshot', args)).ok).toBe(false);
+  const r = await human('daemon_provider_snapshot', args);
+  expect(r.ok).toBe(true); expect(r.request_id).toMatch(/^dpa_/);
+  expect((await daemon('pull_daemon_provider_snapshots', { accept_writes: true })).requests).toEqual([]);
+  const dispatch = await daemon('pull_daemon_provider_snapshots', { accept_applications: true });
+  expect(dispatch.requests[0]).toMatchObject({ request_id: r.request_id, operation: 'apply', alias: 'child906', expected_revision: 1, selection });
+  const receipt = { status: 'applied', request_id: r.request_id, node_id: child, provider_id: 'custom', auth_id: 'work', model: 'model-a',
+    runtime_provider: 'anet_' + createHash('sha256').update(JSON.stringify(['custom', 'work'])).digest('hex').slice(0, 20), node_revision: 'c'.repeat(64), provider_revision: 1, verification: 'runtime_confirmed', applied_at: Date.now() };
+  // This is a protocol fixture, NOT evidence a runtime has switched.
+  for (const bad of [{ ...receipt, model: 'wrong' }, { ...receipt, key: 'TEST-ONLY-key' }, { ...receipt, provider_revision: 2 }, { ...receipt, runtime_provider: 'anet_' + 'b'.repeat(20) }]) {
+    expect((await daemon('ack_daemon_provider_snapshot', { request_id: r.request_id, application: bad })).error).toBe('invalid_application_receipt');
+  }
+  expect((await daemon('ack_daemon_provider_snapshot', { request_id: r.request_id, snapshot: snapshot() })).ok).toBe(false);
+  expect((await daemon('ack_daemon_provider_snapshot', { request_id: r.request_id, application: receipt })).status).toBe('succeeded');
+  await daemon('ack_daemon_provider_snapshot', { request_id: r.request_id, failed: true });
+  const read = await human('daemon_provider_snapshot', { action: 'read', id: r.request_id, network_id: net });
+  expect(read.status).toBe('succeeded'); expect(read.application).toEqual(receipt); expect(read.snapshot).toBeNull();
+  expect(db.get('SELECT * FROM daemon_provider_applications WHERE request_id=?1', r.request_id)).toBeNull();
+  const stale = await human('daemon_provider_snapshot', args);
+  db.run("UPDATE node_daemon_bindings SET daemon_node_id='other' WHERE request_id='binding_apply906'");
+  expect((await daemon('pull_daemon_provider_snapshots', { accept_applications: true })).requests).toEqual([]);
+  expect((await human('daemon_provider_snapshot', { action: 'read', id: stale.request_id, network_id: net })).error).toBe('application_target_not_bound');
+});
+
+test('write core chain: encrypted Hub request → target daemon CLI → durable replay → public readback', async () => {
+  process.env.ANET_HUB_SECRET_VAULT_KEY = '42'.repeat(32); // isolated fixture only
+  const work = mkdtempSync(join(root, 'write-'));
+  const dir = join(work, '.anet/nodes', alias); mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, 'config.json'), JSON.stringify({ role: 'host_supervisor', network_id: net, node_id: node }), { mode: 0o600 });
+  const key = 'TEST-ONLY-private-write-key';
+  const provider = { id: 'deepseek', label: 'DeepSeek', enabled: true, runtimes: [{ runtime: 'codex-tui', auth: [
+    { id: 'work', kind: 'api_key', models: ['model-a'], baseUrl: 'https://api.example.test/v1', key },
+  ] }] };
+  const human = client(), daemon = client('daemon');
+  const r = await human('daemon_provider_snapshot', { action: 'put', id: node, network_id: net, revision: 0, provider });
+  expect(r.ok).toBe(true); expect(JSON.stringify(r)).not.toContain(key);
+  const encrypted = db.get<any>('SELECT * FROM daemon_provider_writes WHERE request_id=?1', r.request_id);
+  expect(Buffer.from(encrypted.ciphertext).toString()).not.toContain(key);
+  expect((await daemon('pull_daemon_provider_snapshots')).requests).toEqual([]); // old/insecure readers receive no key
+  expect((await client('daemon', 'other')('pull_daemon_provider_snapshots', { accept_writes: true })).ok).toBe(false);
+  let drop = true;
+  const deps = { workDir: work, alias, networkId: net, daemonId: node, serverUrl: 'https://hub.example.test', warn: () => {},
+    callCommHub: async (name: string, args: any) => {
+      if (name === 'ack_daemon_provider_snapshot' && drop) { drop = false; throw Error('lost acknowledgement'); }
+      return daemon(name, args);
+    } };
+  await reconcileProviderSnapshots(deps);
+  expect(new DaemonProviderStore(dir).list().revision).toBe(1);
+  await reconcileProviderSnapshots(deps); // same request must not write revision 2 or lose success
+  const read = await human('daemon_provider_snapshot', { action: 'read', id: r.request_id, network_id: net });
+  expect(read.status).toBe('succeeded'); expect(read.snapshot.revision).toBe(1);
+  expect(read.snapshot.providers[0].runtimes[0].auth[0].models).toEqual(['model-a']);
+  expect(JSON.stringify(read)).not.toContain(key);
+  expect(db.get('SELECT * FROM daemon_provider_writes WHERE request_id=?1', r.request_id)).toBeNull();
+  const conflict = await human('daemon_provider_snapshot', { action: 'put', id: node, network_id: net, revision: 0, provider: { ...provider, label: 'must not overwrite' } });
+  await reconcileProviderSnapshots(deps);
+  expect((await human('daemon_provider_snapshot', { action: 'read', id: conflict.request_id, network_id: net })).status).toBe('failed');
+  expect(new DaemonProviderStore(dir).list().providers[0].label).toBe('DeepSeek');
+  db.run("UPDATE network_members SET role='member' WHERE user_id=?1 AND network_id=?2", [user, net]);
+  expect((await human('daemon_provider_snapshot', { action: 'put', id: node, network_id: net, revision: 1, provider })).error).toBe('provider_admin_required');
+});
+
+test("human authorization precedes dispatch; unknown, nodes and non-admins cannot request", async () => {
+  expect((await client("anonymous")("daemon_provider_snapshot", { action: "refresh", network_id: net, id: node })).error).toBe("user_token_required");
+  expect((await client("daemon")("daemon_provider_snapshot", { action: "refresh", network_id: net, id: node })).ok).toBe(false);
+  db.run("UPDATE network_members SET role='member' WHERE user_id=?1 AND network_id=?2", [user, net]);
+  expect((await request()).error).toBe("provider_admin_required");
+  expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM daemon_provider_snapshots WHERE network_id=?1", net)?.n).toBe(0);
+});
+test("normal nodes cannot impersonate a daemon; revoked token cannot pull or ack", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("UPDATE nodes SET config_snapshot='{}' WHERE node_id=?1", [node]);
+  expect((await client("daemon")("pull_daemon_provider_snapshots")).error).toBe("caller_not_a_daemon");
+  db.run("UPDATE nodes SET config_snapshot=?1 WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor" }), node]);
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id=?1", [token]);
+  expect((await client("daemon")("pull_daemon_provider_snapshots")).ok).toBe(false);
+  expect((await client("daemon")("ack_daemon_provider_snapshot", { request_id: r.request_id, snapshot: snapshot() })).ok).toBe(false);
+});
+test("request/pull/ack/read lifecycle; duplicate click and ack cannot rewrite receipt", async () => {
+  const r = await request(); expect((await request()).request_id).toBe(r.request_id);
+  const human = client(), daemon = client("daemon");
+  expect((await human("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net })).snapshot).toBeNull();
+  expect((await daemon("pull_daemon_provider_snapshots")).requests[0].request_id).toBe(r.request_id);
+  expect((await daemon("ack_daemon_provider_snapshot", { request_id: r.request_id, snapshot: snapshot() })).status).toBe("succeeded");
+  await daemon("ack_daemon_provider_snapshot", { request_id: r.request_id, failed: true });
+  const read = await human("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net });
+  expect(read.status).toBe("succeeded"); expect(read.snapshot).toEqual(snapshot()); expect(read.observed_at).toBeGreaterThan(0);
+  expect((await daemon("pull_daemon_provider_snapshots")).requests).toEqual([]);
+});
+test("network and daemon mismatch cannot read or acknowledge another scope", async () => {
+  const r = await request();
+  expect((await client()("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: "foreign" })).ok).toBe(false);
+  expect((await client("daemon", "foreign")("pull_daemon_provider_snapshots")).ok).toBe(false);
+  const d = client("daemon");
+  expect((await d("ack_daemon_provider_snapshot", { request_id: r.request_id, snapshot: { ...snapshot(), daemon_node_id: "other" } })).error).toBe("invalid_provider_snapshot");
+  db.run("UPDATE daemon_provider_snapshots SET daemon_node_id='other' WHERE request_id=?1", [r.request_id]);
+  expect((await d("ack_daemon_provider_snapshot", { request_id: r.request_id, snapshot: snapshot() })).error).toBe("request_not_found");
+});
+test("timeout is explicit; late daemon reply cannot overwrite it", async () => {
+  const r = await request();
+  db.run("UPDATE daemon_provider_snapshots SET expires_at=?1 WHERE request_id=?2", [Date.now() - 1, r.request_id]);
+  expect((await client("daemon")("ack_daemon_provider_snapshot", { request_id: r.request_id, snapshot: snapshot() })).status).toBe("expired");
+  expect((await client()("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net })).snapshot).toBeNull();
+});
+test("secret fields / misleading verification are rejected, never saved in Hub DB", async () => {
+  const r = await request(); const secret = "TEST-ONLY-key-never-in-hub";
+  const auth = { id: "work", kind: "api_key", models: ["model-a"], baseUrl: "https://api.example.test/v1", credential_present: true, verification: "not_checked", application: "not_applied" };
+  const nested = (change: object) => ({ ...snapshot(), providers: [{ id: "deepseek", label: "DeepSeek", enabled: true, runtimes: [{ runtime: "codex-tui", auth: [{ ...auth, ...change }] }] }] });
+  for (const bad of [{ ...snapshot(), key: secret }, { ...snapshot(), source: "hub" }, { ...snapshot(), revision: -1 },
+    nested({ key: secret }), nested({ verification: "verified" }), nested({ application: "applied" }), nested({ baseUrl: `https://user:${secret}@api.example.test/v1` })]) {
+    const reply = await client("daemon")("ack_daemon_provider_snapshot", { request_id: r.request_id, snapshot: bad });
+    expect(reply.error).toBe("invalid_provider_snapshot"); expect(JSON.stringify(reply)).not.toContain(secret);
+  }
+  expect(db.get<{ snapshot_json: string | null }>("SELECT snapshot_json FROM daemon_provider_snapshots WHERE request_id=?1", r.request_id)?.snapshot_json).toBeNull();
+});
+test("mirrored contract cannot drift", () => {
+  expect(readFileSync(new URL("./shared/daemon-provider-snapshot.ts", import.meta.url), "utf8"))
+    .toBe(readFileSync(new URL("../../agent-node/src/shared/daemon-provider-snapshot.ts", import.meta.url), "utf8"));
+});
+test("daemon reconnection executes actual pinned CLI against private store and acks redacted data", async () => {
+  const dir = join(root, ".anet/nodes", alias); mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, "config.json"), JSON.stringify({ role: "host_supervisor", network_id: net, node_id: node }), { mode: 0o600 });
+  const key = "TEST-ONLY-private-906";
+  new DaemonProviderStore(dir).upsert({ id: "deepseek", label: "DeepSeek", enabled: true, runtimes: [{ runtime: "codex-tui", auth: [{ id: "work", kind: "api_key", models: ["model-a"], baseUrl: "https://api.example.test/v1", key }] }] }, 0);
+  const deps = { workDir: root, alias, networkId: net, daemonId: node, callCommHub: client("daemon"), warn: () => { throw Error("unexpected_warning"); } };
+  // Atomic local read must pass before the Hub/daemon round trip.
+  expect((await readLocalProviderSnapshot(deps) as any).revision).toBe(1);
+  const r = await request();
+  await Promise.all([reconcileProviderSnapshots(deps), reconcileProviderSnapshots(deps)]);
+  const read = await client()("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net });
+  expect(read.status).toBe("succeeded"); expect(read.snapshot.providers[0].runtimes[0].auth[0].credential_present).toBe(true);
+  expect(JSON.stringify(read)).not.toContain(key); expect(read.snapshot.providers[0].runtimes[0].auth[0].verification).toBe("not_checked");
+});
+test("daemon raw errors are replaced with fixed failure receipt", async () => {
+  const r = await request();
+  await reconcileProviderSnapshots({ workDir: root, alias, networkId: net, daemonId: node, callCommHub: client("daemon"), warn: () => {},
+    readSnapshot: async () => { throw Error("TEST-ONLY-sensitive-error"); } });
+  const read = await client()("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net });
+  expect(read.status).toBe("failed"); expect(read.error).toBe("provider_snapshot_unavailable"); expect(JSON.stringify(read)).not.toContain("TEST-ONLY-sensitive-error");
+});
+test("lost acknowledgement retries on reconnect, without swallowing a new doorbell", async () => {
+  const r = await request(); const real = client("daemon"); let loseAck = true, reads = 0;
+  const deps = { workDir: root, alias, networkId: net, daemonId: node, warn: () => {},
+    readSnapshot: async () => { reads++; return snapshot(); },
+    callCommHub: async (name: string, args: any) => {
+      if (name === "ack_daemon_provider_snapshot" && loseAck) { loseAck = false; throw Error("TEST-ONLY-transport-down"); }
+      return real(name, args);
+    } };
+  await reconcileProviderSnapshots(deps);
+  expect((await client()("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net })).status).toBe("pending");
+  await reconcileProviderSnapshots(deps);
+  expect((await client()("daemon_provider_snapshot", { action: "read", id: r.request_id, network_id: net })).status).toBe("succeeded");
+  expect(reads).toBe(2);
+});
+test("real HTTP authentication -> daemon handler -> pinned CLI -> scoped public receipt", async () => {
+  process.env.COMMHUB_UPLOADS_DIR = join(root, "uploads");
+  const owner = register("provider906_http", "TestOnly-Provider906-Password!1");
+  expect(owner.ok).toBe(true);
+  const netId = owner.network_id!, nodeId = "node_dps_http", daemonAlias = "daemon-http";
+  const issued = createNetworkTokenForNode(owner.user!.user_id, netId, daemonAlias, nodeId);
+  expect(issued.ok).toBe(true);
+  db.run("UPDATE nodes SET config_snapshot=?1 WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor" }), nodeId]);
+  const dir = join(root, ".anet/nodes", daemonAlias); mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, "config.json"), JSON.stringify({ role: "host_supervisor", network_id: netId, node_id: nodeId }), { mode: 0o600 });
+  for (const child of ['bound', 'neighbour']) {
+    const childId = `n_scan_${child}`;
+    db.run('INSERT INTO nodes (node_id,node_name,alias,network_id,runtime) VALUES (?1,?2,?2,?3,\'codex-app-server\')', [childId, child, netId]);
+    db.run('INSERT INTO node_daemon_bindings (request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES (?1,?2,?3,?4,?5,?6,\'active\',1,1)',
+      [`binding_scan_${child}`, netId, childId, child === 'bound' ? nodeId : 'another-daemon', root, owner.user!.user_id]);
+    const home = join(root, '.anet/nodes', child, 'codex-home'); mkdirSync(home, { recursive: true, mode: 0o700 });
+    writeFileSync(join(home, '../config.json'), JSON.stringify({ node_id: childId, alias: child, runtime: 'codex-app-server', network_id: netId }), { mode: 0o600 });
+    writeFileSync(join(home, 'config.toml'), 'model_provider = "deepseek"\nmodel = "fixture-model"\n[model_providers.deepseek]\nenv_key = "TEST_API_KEY"\n', { mode: 0o600 });
+  }
+  const hub = (await import("./server")).bootServer({ port: 0, hostname: "127.0.0.1" });
+  const url = `http://127.0.0.1:${hub.port}/mcp`;
+  const rpc = (credential: string) => async (name: string, args: any) => {
+    const response = await fetch(url, { method: "POST", headers: { Authorization: `Bearer ${credential}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }) });
+    expect(response.status).toBe(200);
+    const raw = await response.text(); const line = raw.split("\n").filter(x => x.startsWith("data:")).at(-1);
+    const message = JSON.parse(line ? line.slice(5) : raw);
+    expect(message.error).toBeUndefined();
+    return JSON.parse(message.result.content[0].text);
+  };
+  try {
+    const human = rpc(owner.token!), daemon = rpc(issued.token!);
+    const refresh = await human("daemon_provider_snapshot", { action: "refresh", id: nodeId, network_id: netId });
+    expect(refresh.status).toBe("pending");
+    expect((await human("pull_daemon_provider_snapshots", {})).ok).toBe(false);
+    expect((await daemon("daemon_provider_snapshot", { action: "refresh", id: nodeId, network_id: netId })).ok).toBe(false);
+    await reconcileProviderSnapshots({ workDir: root, alias: daemonAlias, networkId: netId, daemonId: nodeId, callCommHub: daemon,
+      warn: () => { throw Error("unexpected_HTTP_readback_failure"); } });
+    const read = await human("daemon_provider_snapshot", { action: "read", id: refresh.request_id, network_id: netId });
+    expect(read.status).toBe("succeeded"); expect(read.snapshot).toMatchObject({ network_id: netId, daemon_node_id: nodeId, revision: 0, source: "daemon", providers: [], codex_inventory: { scope: 'hub_bound_nodes' } });
+    expect(read.snapshot.codex_inventory.rows).toHaveLength(1);
+    expect(read.snapshot.codex_inventory.rows[0]).toMatchObject({ node_id: 'n_scan_bound', configured_provider: 'deepseek', configured_model: 'fixture-model', credential_status: 'unknown' });
+    const foreign = await human('daemon_provider_snapshot', { action: 'refresh', id: nodeId, network_id: netId });
+    const bad = structuredClone(read.snapshot); bad.codex_inventory.rows[0].node_id = 'n_scan_neighbour';
+    expect((await daemon('ack_daemon_provider_snapshot', { request_id: foreign.request_id, snapshot: bad })).ok).toBe(false);
+  } finally { hub.stop(true); }
+});

package/src/daemon-provider-snapshots.ts

@@ -0,0 +1,226 @@
+// #906: human-requested readback of ONE daemon's private Provider metadata.
+// Hub registry is not a fallback. No credential values enter this protocol.
+import { createHash, randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from 'node:util';
+import { db } from "./db";
+import { getUserNetworkRole } from "./auth";
+import { validateDaemonProviderSnapshot } from "./shared/daemon-provider-snapshot";
+import { encryptSecret, decryptSecret, VaultError } from './vault';
+import { buildControllableMap } from './node-lifecycle-controllable';
+import { validProviderApplicationSelection, validProviderApplicationReceipt, type ProviderApplicationSelection } from './shared/provider-application';
+
+export function providerScanTargets(networkId: string, daemonId: string) {
+  const ownership = buildControllableMap(
+    db.all<{ request_id: string; daemon_node_id: string }>('SELECT request_id,daemon_node_id FROM node_create_requests WHERE network_id=?1', networkId),
+    db.all<{ node_id: string; daemon_node_id: string }>('SELECT node_id,daemon_node_id FROM node_daemon_bindings WHERE network_id=?1 AND status=\'active\'', networkId));
+  const targets = db.all<{ node_id: string; alias: string }>('SELECT node_id,alias FROM nodes WHERE network_id=?1 ORDER BY node_id', networkId)
+    .filter(n => ownership.get(n.node_id) === daemonId && typeof n.alias === 'string');
+  if (targets.length > 200) throw Error('inventory_limit'); // no silent incomplete denominator
+  return targets;
+}
+
+type Human = { userId?: string | null; isNode: boolean; networkId: string | null };
+type Daemon = { ok: false; error: string } | { ok: true; networkId: string; daemonNodeId: string; daemonAlias: string };
+type Row = { request_id: string; network_id: string; daemon_node_id: string; status: string;
+  created_at: number; expires_at: number; observed_at: number | null; snapshot_json: string | null; error: string | null };
+const denied = (error: string) => ({ ok: false as const, error });
+function authorize(h: Human) {
+  if (h.isNode || !h.userId) return denied("user_token_required");
+  if (!h.networkId || !["owner", "admin"].includes(getUserNetworkRole(h.userId, h.networkId) || "")) return denied("provider_admin_required");
+  return null;
+}
+function daemonExists(networkId: string, nodeId: string): boolean {
+  const node = db.get<{ config_snapshot: string }>(
+    `SELECT n.config_snapshot FROM nodes n WHERE n.node_id=?1 AND n.network_id=?2
+      AND EXISTS (SELECT 1 FROM api_tokens t WHERE t.network_id=n.network_id
+        AND t.name='node:' || n.alias AND t.revoked_at IS NULL
+        AND (t.expires_at IS NULL OR t.expires_at > datetime('now')))`, nodeId, networkId);
+  try { return JSON.parse(node?.config_snapshot || "{}").role === "host_supervisor"; } catch { return false; }
+}
+function expire(networkId: string, daemonId?: string) {
+  db.run(`UPDATE daemon_provider_snapshots SET status='expired', error='request_expired'
+    WHERE network_id=?1 AND status='pending' AND expires_at <= ?2
+    AND (?3 IS NULL OR daemon_node_id=?3)`, [networkId, Date.now(), daemonId ?? null]);
+  db.run(`DELETE FROM daemon_provider_writes WHERE request_id IN
+    (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
+  db.run(`DELETE FROM daemon_provider_applications WHERE request_id IN
+    (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
+  db.run(`DELETE FROM daemon_provider_snapshots WHERE network_id=?1 AND expires_at < ?2`, [networkId, Date.now() - 7 * 86400_000]);
+}
+/** Validate the complete public projection before encrypting the private input. */
+function validateWrite(provider: any, networkId: string, daemonId: string) {
+  if (Buffer.byteLength(JSON.stringify(provider) || '') > 64 * 1024) throw new Error('invalid_provider');
+  const publicProvider = { ...provider, runtimes: provider?.runtimes?.map((r: any) => ({ ...r,
+    auth: r.auth?.map((a: any) => {
+      const { key, ...rest } = a;
+      if (a.kind === 'chatgpt' && key !== undefined) throw new Error('invalid_provider');
+      if (key !== undefined && (typeof key !== 'string' || !key || key.length > 8192 || /[\s\x00-\x1f\x7f]/.test(key))) throw new Error('invalid_provider');
+      // Only CLI write fields may be supplied; public-state flags are not writable.
+      if (Object.keys(a).some(k => !['id','kind','models','baseUrl','key'].includes(k))) throw new Error('invalid_provider');
+      return { ...rest, credential_present: a.kind === 'api_key', verification: 'not_checked', application: 'not_applied' };
+    }),
+  })) };
+  validateDaemonProviderSnapshot({ network_id: networkId, daemon_node_id: daemonId, source: 'daemon', revision: 0, providers: [publicProvider] }, networkId, daemonId);
+  return publicProvider;
+}
+export function requestProviderWrite(h: Human, daemonId: string, expectedRevision: number, provider: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0 || expectedRevision >= Number.MAX_SAFE_INTEGER) return denied('invalid_revision');
+  try { validateWrite(provider, h.networkId!, daemonId); } catch { return denied('invalid_provider'); }
+  expire(h.networkId!, daemonId);
+  if (db.get('SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status=\'pending\'', h.networkId!, daemonId)) return denied('provider_snapshot_busy');
+  try {
+    const enc = encryptSecret(JSON.stringify({ network_id: h.networkId, daemon_node_id: daemonId, provider }));
+    const requestId = `dps_${randomUUID()}`, now = Date.now();
+    db.transaction(() => {
+      db.run(`INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+        VALUES (?1,?2,?3,?4,'pending',?5,?6)`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+      db.run(`INSERT INTO daemon_provider_writes (request_id,expected_revision,ciphertext,iv,tag) VALUES (?1,?2,?3,?4,?5)`,
+        [requestId, expectedRevision, enc.ciphertext, enc.iv, enc.tag]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 120_000 };
+  } catch (error) { return denied(error instanceof VaultError ? error.code : 'provider_write_unavailable'); }
+}
+function privateWrite(requestId: string, networkId: string, daemonId: string) {
+  const row = db.get<{ expected_revision: number; ciphertext: any; iv: any; tag: any }>('SELECT * FROM daemon_provider_writes WHERE request_id=?1', requestId);
+  if (!row) return null;
+  const payload = JSON.parse(decryptSecret({ ciphertext: Buffer.from(row.ciphertext), iv: Buffer.from(row.iv), tag: Buffer.from(row.tag) }));
+  if (payload.network_id !== networkId || payload.daemon_node_id !== daemonId) throw new Error('scope_mismatch');
+  validateWrite(payload.provider, networkId, daemonId);
+  return { expected_revision: row.expected_revision, provider: payload.provider };
+}
+function applicationIntent(requestId: string) {
+  const row = db.get<{ expected_revision: number; selection_json: string }>('SELECT * FROM daemon_provider_applications WHERE request_id=?1', requestId);
+  if (!row) return null;
+  const selection = JSON.parse(row.selection_json);
+  if (!validProviderApplicationSelection(selection)) throw Error('invalid_application');
+  return { expected_revision: row.expected_revision, selection };
+}
+function boundApplicationTarget(networkId: string, daemonId: string, selection: ProviderApplicationSelection) {
+  return selection.node_id !== daemonId && providerScanTargets(networkId, daemonId).find(n => n.node_id === selection.node_id);
+}
+export function requestProviderApplication(h: Human, daemonId: string, revision: number, selection: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!Number.isSafeInteger(revision) || revision < 0) return denied('invalid_revision');
+  if (!validProviderApplicationSelection(selection)) return denied('invalid_application');
+  try {
+    if (!boundApplicationTarget(h.networkId!, daemonId, selection)) return denied('application_target_not_bound');
+    expire(h.networkId!, daemonId);
+    const requestId = `dpa_${randomUUID()}`, now = Date.now();
+    db.transaction(() => {
+      db.run(`INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+        VALUES (?1,?2,?3,?4,'pending',?5,?6)`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 600_000]);
+      db.run('INSERT INTO daemon_provider_applications (request_id,expected_revision,selection_json) VALUES (?1,?2,?3)',
+        [requestId, revision, JSON.stringify(selection)]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 600_000 };
+  } catch { return denied('provider_application_unavailable'); }
+}
+export function requestProviderSnapshot(h: Human, daemonId: string) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied("daemon_not_found");
+  expire(h.networkId!, daemonId);
+  // Repeated refresh clicks share the pending request; pending never means ready.
+  const pending = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending' ORDER BY created_at DESC LIMIT 1`, h.networkId!, daemonId);
+  if (pending) return { ok: true as const, request_id: pending.request_id, status: "pending", expires_at: pending.expires_at };
+  const requestId = `dps_${randomUUID()}`, now = Date.now();
+  db.run(`INSERT INTO daemon_provider_snapshots
+    (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+    VALUES (?1,?2,?3,?4,'pending',?5,?6) ON CONFLICT DO NOTHING`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+  const accepted = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending'`, h.networkId!, daemonId);
+  if (!accepted) return denied("provider_snapshot_busy");
+  return { ok: true as const, request_id: accepted.request_id, status: "pending", expires_at: accepted.expires_at };
+}
+export function getProviderSnapshot(h: Human, requestId: string) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  expire(h.networkId!);
+  const row = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE request_id=?1 AND network_id=?2`, requestId, h.networkId!);
+  if (!row) return denied("request_not_found");
+  return { ok: true, request_id: row.request_id, daemon_node_id: row.daemon_node_id, status: row.status,
+    expires_at: row.expires_at, observed_at: row.observed_at, error: row.error,
+    snapshot: !row.request_id.startsWith('dpa_') && row.snapshot_json ? JSON.parse(row.snapshot_json) : null,
+    ...(row.request_id.startsWith('dpa_') ? { application: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}) };
+}
+export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApplications = false) {
+  if (!d.ok) return denied("caller_not_a_daemon");
+  if (!daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
+  expire(d.networkId, d.daemonNodeId);
+  const requests = db.all<{ request_id: string; expires_at: number }>(`SELECT request_id,expires_at FROM daemon_provider_snapshots
+    WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending' ORDER BY created_at LIMIT 20`, d.networkId, d.daemonNodeId);
+  try { return { ok: true, requests: requests.flatMap<Record<string, unknown>>(r => {
+    if (r.request_id.startsWith('dpa_')) {
+      if (!acceptApplications) return []; // old daemons must not consume applications as scans
+      const application = applicationIntent(r.request_id);
+      const target = application && boundApplicationTarget(d.networkId, d.daemonNodeId, application.selection);
+      if (!target) {
+        db.run("UPDATE daemon_provider_snapshots SET status='failed',error='application_target_not_bound',observed_at=?1 WHERE request_id=?2 AND status='pending'", [Date.now(), r.request_id]);
+        db.run('DELETE FROM daemon_provider_applications WHERE request_id=?1', [r.request_id]);
+        return [];
+      }
+      return [{ ...r, operation: 'apply', ...application!, alias: target.alias }];
+    }
+    if (!acceptWrites && db.get('SELECT request_id FROM daemon_provider_writes WHERE request_id=?1', r.request_id)) return [];
+    const write = privateWrite(r.request_id, d.networkId, d.daemonNodeId);
+    return [write ? { ...r, operation: 'put', ...write } : { ...r, scan_targets: providerScanTargets(d.networkId, d.daemonNodeId) }];
+  }) }; } catch { return denied('provider_write_unavailable'); }
+}
+export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unknown, failed = false, appliedRevision?: number, application?: unknown) {
+  if (!d.ok || !daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
+  expire(d.networkId, d.daemonNodeId);
+  const row = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE request_id=?1 AND network_id=?2 AND daemon_node_id=?3`, requestId, d.networkId, d.daemonNodeId);
+  if (!row) return denied("request_not_found");
+  // First accepted receipt wins; reconnect replay cannot rewrite prior evidence.
+  if (row.status !== "pending") return { ok: row.status === "succeeded" || row.status === "failed", status: row.status };
+  if (requestId.startsWith('dpa_')) {
+    if (snapshot !== undefined || appliedRevision !== undefined || (failed && application !== undefined)) return denied('invalid_application_receipt');
+    if (!failed) {
+      try {
+        const intent = applicationIntent(requestId);
+        if (!intent || !boundApplicationTarget(d.networkId, d.daemonNodeId, intent.selection)
+          || !validProviderApplicationReceipt(application, requestId, intent.expected_revision, intent.selection)
+          || (application as any).runtime_provider !== `anet_${createHash('sha256').update(JSON.stringify([intent.selection.provider_id, intent.selection.auth_id])).digest('hex').slice(0, 20)}`
+          || (application as any).applied_at < row.created_at - 30_000) return denied('invalid_application_receipt');
+      } catch { return denied('invalid_application_receipt'); }
+    }
+    db.run(`UPDATE daemon_provider_snapshots SET status=?1,snapshot_json=?2,error=?3,observed_at=?4
+      WHERE request_id=?5 AND status='pending'`, [failed ? 'failed' : 'succeeded', failed ? null : JSON.stringify(application),
+      failed ? 'provider_application_unavailable' : null, Date.now(), requestId]);
+    db.run('DELETE FROM daemon_provider_applications WHERE request_id=?1', [requestId]);
+    return { ok: true, status: failed ? 'failed' : 'succeeded' };
+  }
+  if (application !== undefined) return denied('invalid_application_receipt');
+  let safe: unknown = null;
+  if (failed && snapshot !== undefined) return denied("invalid_provider_snapshot");
+  if (!failed) {
+    try { safe = validateDaemonProviderSnapshot(snapshot, d.networkId, d.daemonNodeId); }
+    catch { return denied("invalid_provider_snapshot"); }
+    if ((safe as any).codex_inventory) {
+      try {
+        const targets = new Map(providerScanTargets(d.networkId, d.daemonNodeId).map(n => [n.node_id, n.alias]));
+        const rows = (safe as any).codex_inventory.rows;
+        if (rows.length !== targets.size || rows.some((r: any) => targets.get(r.node_id) !== r.alias)) return denied('invalid_provider_snapshot');
+      } catch { return denied('invalid_provider_snapshot'); }
+    }
+    try {
+      const write = privateWrite(requestId, d.networkId, d.daemonNodeId);
+      if (write) {
+        const actual = safe as any;
+        if (appliedRevision !== write.expected_revision + 1 || actual.revision !== appliedRevision) return denied('provider_write_unconfirmed');
+        const expected = validateWrite(write.provider, d.networkId, d.daemonNodeId);
+        const saved = actual.providers.find((p: any) => p.id === expected.id);
+        // CLI canonicalizes label and endpoint. No credential is compared or returned here.
+        expected.label = expected.label.trim();
+        for (const r of expected.runtimes) for (const a of r.auth) if (a.baseUrl) a.baseUrl = new URL(a.baseUrl).toString().replace(/\/$/, '');
+        if (!isDeepStrictEqual(saved, expected)) return denied('provider_write_unconfirmed');
+      }
+    } catch { return denied('provider_write_unconfirmed'); }
+  }
+  db.run(`UPDATE daemon_provider_snapshots SET status=?1, snapshot_json=?2, error=?3, observed_at=?4
+    WHERE request_id=?5 AND status='pending'`, [failed ? "failed" : "succeeded", safe ? JSON.stringify(safe) : null,
+    failed ? "provider_snapshot_unavailable" : null, Date.now(), requestId]);
+  const accepted = db.get<Row>("SELECT * FROM daemon_provider_snapshots WHERE request_id=?1", requestId);
+  db.run('DELETE FROM daemon_provider_writes WHERE request_id=?1', [requestId]);
+  return { ok: true, status: accepted!.status };
+}