@sleep2agi/commhub-server 0.9.0-preview.120 → 0.9.0-preview.121

package/src/db.ts

@@ -320,6 +320,15 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
 `);
 
+// Human profile avatar. Additive for existing databases; old binaries ignore it.
+try {
+  db.exec("ALTER TABLE users ADD COLUMN avatar_url TEXT");
+} catch (e: any) {
+  // Both supported adapters report a duplicate column on the next startup.
+  // Do not send SQLite PRAGMA to PostgreSQL or swallow other migration errors.
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
 // #261 P0-2 (2026-06-28): must_change_password flag. Added via ALTER
 // (not in the CREATE block above) so it's a no-op on fresh DBs that
 // already get the column via the CREATE path's full definition AND a
@@ -519,6 +528,28 @@ try {
 }
 
 // `node_config_updates` — pending + history. One row per dashboard write.
+// #906: redacted daemon-owned inventory requests, never credential material.
+db.exec(`CREATE TABLE IF NOT EXISTS daemon_provider_snapshots (
+  request_id TEXT PRIMARY KEY, network_id TEXT NOT NULL, daemon_node_id TEXT NOT NULL,
+  requested_by TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'pending',
+  created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, observed_at INTEGER,
+  snapshot_json TEXT, error TEXT
+)`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_daemon_provider_pending
+  ON daemon_provider_snapshots(network_id, daemon_node_id, status)`);
+db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_daemon_provider_inflight
+  ON daemon_provider_snapshots(network_id, daemon_node_id) WHERE status='pending'`);
+// One encrypted mutation payload per request; public receipt remains secret-free.
+db.exec(`CREATE TABLE IF NOT EXISTS daemon_provider_writes (
+  request_id TEXT PRIMARY KEY, expected_revision INTEGER NOT NULL,
+  ciphertext BLOB NOT NULL, iv BLOB NOT NULL, tag BLOB NOT NULL
+)`);
+// Application intent is credential-free; secrets stay in the daemon's store.
+db.exec(`CREATE TABLE IF NOT EXISTS daemon_provider_applications (
+  request_id TEXT PRIMARY KEY, expected_revision INTEGER NOT NULL,
+  selection_json TEXT NOT NULL
+)`);
+
 // At most one row per node may be in a non-terminal state at a time
 // (single-flight enforced at the tool layer; this table just stores).
 //

package/src/member-presence-http.test.ts

@@ -3,7 +3,7 @@
 // GET /api/networks/:id/humans 给每个人加 online / last_seen_at(判据 = 此刻有没有活着的用户流
 // /events/users/me);用户流上推 member_presence。两个方向都测:
 //   看得到:普通成员、受限成员、viewer;连上 → online=true,断开 → online=false + last_seen_at。
-//   看不到:非成员 403;节点令牌拿到的仍是原来三个身份字段;别的网络的人收不到推送;自己收不到自己的。
+//   看不到:非成员 403;节点令牌只拿身份字段(含头像),无在线状态;别的网络的人收不到推送;自己收不到自己的。
 
 import { describe, expect, test, beforeAll, afterAll } from "bun:test";
 import { mkdtempSync, rmSync } from "fs";
@@ -125,7 +125,8 @@ describe("GET /api/networks/:id/humans — online / last_seen_at", () => {
   test("never connected since hub start → online=false, last_seen_at=null (unknown, not 'long ago')", async () => {
     const r = await get(users.pres_alpha.token, `/api/networks/${NET}/humans`);
     expect(r.status).toBe(200);
-    expect(Object.keys(r.body.humans[0]).sort()).toEqual(["display_name", "last_seen_at", "online", "user_id", "username"]);
+    expect(Object.keys(r.body.humans[0]).sort()).toEqual(["avatar_url", "display_name", "last_seen_at", "online", "user_id", "username"]);
+    expect(r.body.humans.every((h: any) => h.avatar_url === null)).toBe(true);
     const beta = r.body.humans.find((h: any) => h.user_id === users.pres_beta.userId);
     expect(beta.online).toBe(false);
     expect(beta.last_seen_at).toBeNull();
@@ -181,11 +182,14 @@ describe("who must NOT see presence", () => {
     expect(r.body.humans).toBeUndefined();
   });
 
-  test("node token → same three identity fields as before, no online / last_seen_at", async () => {
+  test("node token → identity fields including avatar, no online / last_seen_at", async () => {
     const beta = await openUserStream(users.pres_beta.token, NET);
     const r = await get(nodeToken, `/api/networks/${NET}/humans`);
     expect(r.status).toBe(200);
-    for (const h of r.body.humans) expect(Object.keys(h).sort()).toEqual(["display_name", "user_id", "username"]);
+    for (const h of r.body.humans) {
+      expect(Object.keys(h).sort()).toEqual(["avatar_url", "display_name", "user_id", "username"]);
+      expect(h.avatar_url).toBeNull();
+    }
     // 节点令牌也不能订阅用户流(既有行为,这里钉住:不能借它收 member_presence)。
     expect((await fetch(`${BASE}/events/users/me?network_id=${NET}`, { headers: auth(nodeToken) })).status).toBe(403);
     beta.close();

package/src/node-lifecycle-read-http.test.ts

@@ -60,8 +60,20 @@ test("public errors redact free text for granted viewers on every projection", a
       "bin: ENOENT: /private/fixture/bin/anet on fixture-host",
       "adopt_unknown_secret", "adopt_start_timeout: /private/fixture", "", "adopt_start_timeout", null,
       "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed",
+      "adopt_codex_external_start_unproven", "adopt_codex_launch_failed", "adopt_codex_launch_timeout",
+      "adopt_codex_port_unproven", "adopt_codex_start_superseded", "adopt_codex_binding_generation_unproven",
+      "adopt_codex_start_evidence_missing", "adopt_codex_start_evidence_changed",
+      "adopt_codex_session_conflict", "adopt_codex_port_unavailable", "adopt_codex_stage_still_running",
+      "adopt_codex_identity_unproven",
+      "TUI session mismatch", "opencode_launch_health:TUI session mismatch", "opencode_tui_session_mismatch",
     ]) {
-      const expected = error === null || ["adopt_start_timeout", "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed"].includes(error) ? error : "lifecycle_error";
+      const publicCodes = ["adopt_start_timeout", "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed", "opencode_tui_session_mismatch",
+        "adopt_codex_external_start_unproven", "adopt_codex_launch_failed", "adopt_codex_launch_timeout",
+        "adopt_codex_port_unproven", "adopt_codex_start_superseded", "adopt_codex_binding_generation_unproven",
+        "adopt_codex_start_evidence_missing", "adopt_codex_start_evidence_changed",
+        "adopt_codex_session_conflict", "adopt_codex_port_unavailable", "adopt_codex_stage_still_running",
+        "adopt_codex_identity_unproven"];
+      const expected = error === null || publicCodes.includes(error) ? error : "lifecycle_error";
       for (const [kind, table, request] of [
         ["adopt", "node_daemon_bindings", "adopt_read_active"],
         ["start", "node_start_requests", "start_read_failed"],

package/src/node-lifecycle-read.ts

@@ -7,6 +7,11 @@ const publicLifecycleErrors = new Set([
   "codex_fork_confirmation_invalid", "codex_fork_recovery_unsupported", "codex_fork_cli_unsupported",
   "codex_fork_result_invalid", "codex_fork_outcome_unknown",
   "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed",
+  "adopt_codex_external_start_unproven", "adopt_codex_launch_failed", "adopt_codex_launch_timeout",
+  "adopt_codex_port_unproven", "adopt_codex_start_superseded", "adopt_codex_binding_generation_unproven",
+  "adopt_codex_start_evidence_missing", "adopt_codex_start_evidence_changed",
+  "adopt_codex_session_conflict", "adopt_codex_port_unavailable", "adopt_codex_stage_still_running",
+  "adopt_codex_identity_unproven",
   "adopt_active_binding_required", "adopt_binding_unavailable",
   "adopt_binding_revoked_during_start", "adopt_explicit_private_socket_required",
   "adopt_start_evidence_missing", "adopt_stop_evidence_missing",
@@ -27,6 +32,7 @@ const publicLifecycleErrors = new Set([
   "adopt_tmux_socket_mismatch", "adopt_pane_invalid", "adopt_pane_unverified",
   "adopt_pane_process_mismatch", "adopt_socket_directory_unsafe", "adopt_socket_unsafe",
   "adopt_pid_changed", "adopt_pid_invalid", "adopt_pidfile_unsafe",
+  "opencode_tui_session_mismatch",
   "adopt_proc_invalid", "adopt_proc_unreadable", "adopt_platform_unsupported",
   "adopt_registry_conflict", "adopt_registry_entry_invalid", "adopt_registry_invalid",
   "adopt_registry_unsafe", "adopt_config_env_invalid", "adopt_env_file_invalid",

package/src/node-permissions.ts

@@ -246,6 +246,8 @@ export function streamVerdict(id: NodeIdentity, target: AgentRef | "network"): V
 // ── MCP:每个工具归一类(test 钉住「每个注册的工具都归了类」,新工具忘了归类会红) ──
 export type ToolClass = "always" | "read" | "dispatch" | "broadcast" | "requirements" | "schedule" | "node_write" | "human_only";
 export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
+  daemon_provider_snapshot: "human_only",
+  pull_daemon_provider_snapshots: "always", ack_daemon_provider_snapshot: "always",
   // 回复 / 上报 / 自己的收件箱 / 生命周期协议(节点自己的请求)—— 任何模式都能做
   report_status: "always", report_completion: "always", get_inbox: "always", ack_inbox: "always",
   mark_tasks_runtime_submitted: "always", mark_tasks_consumed: "always", send_reply: "always", send_peer_reply: "always", send_ack: "always",

package/src/report-status-host-schema.test.ts

@@ -149,6 +149,30 @@ describe("#1545 create_capability_observed_ms_ago —— schema 必须收得宽"
  * 注释会烂。这组测试的作用**不是禁止改 strict**(两种都各有其位),而是:谁改了,
  * 谁就会在这里撞红,从而**被迫连注释一起改**。所以断言写成「和注释里那张表一致」,
  * 而不是「必须是某个值」。 */
+describe("adoption_candidates ingest does not reject the heartbeat or keep secrets", () => {
+  const caps = () => schemas.report_status.config_snapshot;
+  const base = { flags: {}, config_update_capable: false, peer_reply_inbox_capable: true };
+
+  test("a clean row is kept, a bad sibling is dropped, and token keys are stripped", () => {
+    const parsed = caps().parse({ ...base, daemon_capabilities: { adopt_capable: true, adoption_candidates: [
+      { node_id: "n_ok", alias: "演示", workdir: "/tmp/proj", runtime: "claude-agent-sdk", launch_hint: "stopped", token: "ntok_supersecret" },
+      { node_id: "n_bad", alias: "x", workdir: "relative", launch_hint: "stopped" },
+      { node_id: "n_hint", alias: "y", workdir: "/tmp/y", launch_hint: "nope" },
+    ] } });
+    expect(parsed.daemon_capabilities.adoption_candidates.filter(Boolean)).toEqual([
+      { node_id: "n_ok", alias: "演示", workdir: "/tmp/proj", runtime: "claude-agent-sdk", launch_hint: "stopped" },
+    ]);
+    expect(JSON.stringify(parsed)).not.toContain("ntok_supersecret");
+  });
+
+  test("a non-array does not reject report_status and does not keep the payload", () => {
+    const parsed = caps().parse({ ...base, daemon_capabilities: { adopt_capable: true, adoption_candidates: { token: "ntok_supersecret" } } });
+    expect(parsed.daemon_capabilities.adoption_candidates).toBeUndefined();
+    expect(JSON.stringify(parsed)).not.toContain("ntok_supersecret");
+    expect(parsed.daemon_capabilities.adopt_capable).toBe(true);
+  });
+});
+
 describe("#1545 report_status 子对象的 strict 分布(注释里那张表的可执行副本)", () => {
   const rs = () => schemas.report_status;
   const UNKNOWN = { __hub_does_not_know_this_key__: 1 };

package/src/runtime-readiness.ts

@@ -40,6 +40,9 @@ export interface RuntimeReadinessOut {
   auth?: string;
   network?: string;
   shared_login_count?: number;
+  /** Copied only for runtime key `opencode-cli`. */
+  generation?: "v1" | "v2";
+  accepted?: boolean;
 }
 
 const ENUMS: Record<string, readonly string[]> = {
@@ -76,6 +79,10 @@ export function sanitizeRuntimeReadiness(raw: unknown): Record<string, RuntimeRe
         && e.shared_login_count >= 0 && e.shared_login_count <= 100_000) {
       entry.shared_login_count = e.shared_login_count;
     }
+    if (rt === "opencode-cli" && (e.generation === "v1" || e.generation === "v2")) {
+      entry.generation = e.generation;
+      if (typeof e.accepted === "boolean") entry.accepted = e.accepted;
+    }
     out[rt] = entry;
     n++;
   }

package/src/server.ts

@@ -32,6 +32,7 @@ import { expireStaleOpenTasks } from "./task-stale-open.js";
 import { flagOrphanTasks } from "./task-orphan.js";
 import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, addAgentTimelineScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { lifecycleProjections, lifecycleRequestResponse } from "./node-lifecycle-read.js";
+import { listAdoptionCandidates, snapshotReportsAdoptionDiscovery } from "./adoption-candidates.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
 import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
 import { groupMemberSeesFile, groupUnreadFor, listGroupMessages, listGroupThreads, markGroupRead, memberGroup, sendGroupMessage } from "./group-messages.js";
@@ -1455,6 +1456,30 @@ return Bun.serve({
       return withCors(req, Response.json({ ok: true, user: resolved.user, networks, current_network: resolved.networkId, credential }));
     }
 
+    // Separate route: older Hubs must return unsupported, not silently ignore
+    // avatar_url in their existing profile PUT and pretend that it was saved.
+    if (url.pathname === "/api/auth/me/avatar" && req.method === "PUT") {
+      const token = req.headers.get("Authorization")?.replace("Bearer ", "");
+      if (!token) return withCors(req, Response.json({ ok: false, error: "token required" }, { status: 401 }));
+      const resolved = resolveToken(token);
+      if (!resolved) return withCors(req, Response.json({ ok: false, error: "invalid token", ...(tokenRejection(token) ?? {}) }, { status: 401 }));
+      if (isNodeCredential(resolved)) return userTokenRequired(req);
+      let body: unknown;
+      try { body = await req.json(); } catch {
+        return withCors(req, Response.json({ ok: false, error: "invalid_json" }, { status: 400 }));
+      }
+      if (!body || typeof body !== "object" || Array.isArray(body)
+          || !Object.hasOwn(body, "avatar_url")
+          || Object.keys(body).some((key) => key !== "avatar_url")) {
+        return withCors(req, Response.json({ ok: false, error: "invalid_avatar_body", reason: "expected only avatar_url (string or null)" }, { status: 400 }));
+      }
+      const avatar = validateAvatarUrl((body as { avatar_url: unknown }).avatar_url);
+      if (!avatar.ok) return withCors(req, Response.json({ ok: false, error: "invalid_avatar_url", reason: avatar.reason }, { status: 400 }));
+      // No supplied target ID/alias; user identity comes exclusively from auth.
+      db.run("UPDATE users SET avatar_url = ?1, updated_at = datetime('now') WHERE user_id = ?2", [avatar.value, resolved.user.user_id]);
+      return withCors(req, Response.json({ ok: true, user_id: resolved.user.user_id, avatar_url: avatar.value }));
+    }
+
     if (url.pathname === "/api/auth/me" && req.method === "PUT") {
       const token = req.headers.get("Authorization")?.replace("Bearer ", "");
       if (!token) return withCors(req, Response.json({ ok: false, error: "token required" }, { status: 401 }));
@@ -1473,7 +1498,7 @@ return Bun.serve({
           db.run(`UPDATE users SET ${updates.join(", ")} WHERE user_id = ?${params.length}`, params);
         }
         // Re-fetch
-        const user = db.get<any>("SELECT user_id, username, display_name, email, role FROM users WHERE user_id = ?1", resolved.user.user_id);
+        const user = db.get<any>("SELECT user_id, username, display_name, avatar_url, email, role FROM users WHERE user_id = ?1", resolved.user.user_id);
         return withCors(req, Response.json({ ok: true, user }));
       } catch (e: any) {
         return withCors(req, Response.json({ ok: false, error: e.message }, { status: 400 }));
@@ -2567,6 +2592,11 @@ return Bun.serve({
       if (!lifecycleUser) return withCors(req, Response.json({ ok: false, error: "user_token_required" }, { status: 403 }));
       return withCors(req, lifecycleRequestResponse(url, restScope));
     }
+    // Board #654: read-only hand-started adoption candidates. Not a binding.
+    if (url.pathname === "/api/adoption-candidates" && req.method === "GET") {
+      if (!lifecycleUser || !restAuth?.userId) return withCors(req, Response.json({ ok: false, error: "user_token_required" }, { status: 403 }));
+      return withCors(req, Response.json(listAdoptionCandidates(restScope, { userId: restAuth.userId, isAdmin })));
+    }
 
     const sideActor = resolveSideThreadActor(req, resolveRequestAuth(req, { allowQueryToken: false }), isAdmin);
     const nodeCommandActor = sideActor?.kind === "node" && sideActor.boundNodeId && sideActor.boundNetworkId
@@ -4589,6 +4619,7 @@ return Bun.serve({
           // upgraded past preview.55.
           let snapCanCreate: boolean | undefined;
           let snapAdoptCapable: boolean | undefined;
+          let snapAdoptionDiscovery = false;
           let snapBlockedReason: string | undefined;
           // #1545 —— 见 report_status schema 里 create_capability_observed_ms_ago 的注释:
           // 上报侧**故意收得宽**(无 int/min/max,免得一个诊断字段能让整份 report 被拒),
@@ -4603,6 +4634,7 @@ return Bun.serve({
               snapRole = typeof parsed?.role === "string" ? parsed.role : null;
               const caps = parsed?.daemon_capabilities;
               if (typeof caps?.adopt_capable === "boolean") snapAdoptCapable = caps.adopt_capable;
+              if (snapshotReportsAdoptionDiscovery(parsed)) snapAdoptionDiscovery = true;
               if (caps && typeof caps.can_create_nodes === "boolean") {
                 snapCanCreate = caps.can_create_nodes;
               }
@@ -4620,10 +4652,11 @@ return Bun.serve({
             } catch { /* malformed */ }
           }
           return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason,
-            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness, adoptCapable: snapAdoptCapable };
+            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness, adoptCapable: snapAdoptCapable,
+            adoptionDiscovery: snapAdoptionDiscovery };
         })
         .filter(({ role }) => role === "host_supervisor")
-        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness, adoptCapable }) => {
+        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness, adoptCapable, adoptionDiscovery }) => {
           let online = false;
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
@@ -4667,7 +4700,10 @@ return Bun.serve({
             // Do not reveal even the new capability for a node the user cannot read.
             const visibleParams: any[] = [r.node_id];
             const visibleSql = addAgentNetworkScope("SELECT node_id FROM nodes WHERE node_id=?1", visibleParams, restScope, { alias: "alias", nodeId: "node_id" });
-            if (db.get(visibleSql, ...visibleParams)) out.adopt_capable = adoptCapable;
+            if (db.get(visibleSql, ...visibleParams)) {
+              out.adopt_capable = adoptCapable;
+              if (adoptionDiscovery) out.adoption_discovery = true;
+            }
           }
           // #1353 Fix ② — only emit the two capability keys when the
           // daemon actually reported them. Undefined vs. false is a

package/src/shared/codex-inventory.ts

@@ -0,0 +1,34 @@
+// #906 key-free existing Codex inventory. Identical public contract in each package.
+export function validCodexInventory(v: any): boolean {
+  const fields = (o: any, allowed: string[]) => o && typeof o === 'object' && !Array.isArray(o)
+    && Object.keys(o).every(k => allowed.includes(k));
+  const id = (s: any) => typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(s);
+  const nullable = (s: any) => s === null || id(s);
+  if (!fields(v, ['observed_at', 'scope', 'rows', 'installation']) || !Number.isSafeInteger(v.observed_at) || v.observed_at <= 0
+    || v.scope !== 'hub_bound_nodes' || !Array.isArray(v.rows) || v.rows.length > 200
+    || new Set(v.rows.map((r: any) => r?.node_id)).size !== v.rows.length) return false;
+  if (v.installation !== undefined && (!fields(v.installation, ['status', 'version'])
+    || !['found', 'missing', 'unknown'].includes(v.installation.status)
+    || !(v.installation.version === null || (typeof v.installation.version === 'string' && /^\d+\.\d+\.\d+(?:[-+.][0-9A-Za-z.-]+)?$/.test(v.installation.version) && v.installation.version.length <= 64)))) return false;
+  for (const r of v.rows) {
+    if (!r || !id(r.node_id) || typeof r.alias !== 'string' || !/^[\p{L}\p{N}][\p{L}\p{N}_.-]{0,99}$/u.test(r.alias)) return false;
+    if (['unavailable', 'not_codex'].includes(r.status)) {
+      if (!fields(r, ['node_id', 'alias', 'status'])) return false;
+      continue;
+    }
+    if (r.status !== 'observed' || !fields(r, ['node_id', 'alias', 'status', 'runtime', 'home_ref', 'home_source',
+      'config_status', 'configured_provider', 'configured_model', 'provider_ids', 'auth_kind', 'credential_status',
+      'account_fingerprint', 'verification', 'effective_state', 'node_configured_model', 'config_revision'])) return false;
+    if (r.config_revision !== undefined && r.config_revision !== null && (typeof r.config_revision !== 'string' || !/^[a-f0-9]{64}$/.test(r.config_revision))) return false;
+    if (!nullable(r.runtime) || !/^[a-f0-9]{16}$/.test(r.home_ref)
+      || !['host_default', 'config.codexHome', 'node-codex-home', 'config.env'].includes(r.home_source)
+      || !['read', 'missing', 'unreadable'].includes(r.config_status) || !nullable(r.configured_provider)
+      || !nullable(r.configured_model) || !nullable(r.node_configured_model)
+      || !Array.isArray(r.provider_ids) || r.provider_ids.length > 101 || !r.provider_ids.every(id)
+      || !['unknown', 'chatgpt', 'api_key'].includes(r.auth_kind)
+      || !['unknown', 'present', 'unreadable'].includes(r.credential_status)
+      || !(r.account_fingerprint === null || /^[a-f0-9]{16}$/.test(r.account_fingerprint))
+      || r.verification !== 'not_checked' || r.effective_state !== 'not_checked') return false;
+  }
+  return true;
+}

package/src/shared/daemon-provider-snapshot.ts

@@ -0,0 +1,49 @@
+// #906 public Provider snapshot contract. Mirrored across separately published
+// server/agent-node packages; drift is tested. No secret-shaped extension fields.
+import { validCodexInventory } from './codex-inventory.js';
+export function validateDaemonProviderSnapshot(value: unknown, networkId: string, daemonId: string): unknown {
+  const fail = (): never => { throw new Error("invalid_provider_snapshot"); };
+  const obj = (v: any, fields: string[]) => {
+    if (!v || typeof v !== "object" || Array.isArray(v) || Object.keys(v).some(k => !fields.includes(k))) fail();
+    return v;
+  };
+  const id = (v: unknown) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(v);
+  const unique = (xs: any[], key: string) => { if (new Set(xs.map(x => x[key])).size !== xs.length) fail(); };
+  const arr = (v: any, max: number, empty = false): any[] => {
+    if (!Array.isArray(v) || (!empty && !v.length) || v.length > max) fail();
+    return v;
+  };
+  const s = obj(value, ["network_id", "daemon_node_id", "revision", "source", "providers", "codex_inventory"]);
+  if (s.codex_inventory !== undefined && !validCodexInventory(s.codex_inventory)) fail();
+  if (s.network_id !== networkId || s.daemon_node_id !== daemonId || s.source !== "daemon"
+    || !Number.isSafeInteger(s.revision) || s.revision < 0) fail();
+  const providers = arr(s.providers, 100, true);
+  unique(providers, "id");
+  for (const p of providers) {
+    obj(p, ["id", "label", "enabled", "runtimes"]);
+    if (!id(p.id) || typeof p.label !== "string" || !p.label.trim() || p.label.length > 100
+      || /[\x00-\x1f\x7f]/.test(p.label) || typeof p.enabled !== "boolean") fail();
+    const runtimes = arr(p.runtimes, 8); unique(runtimes, "runtime");
+    for (const r of runtimes) {
+      obj(r, ["runtime", "auth"]); if (r.runtime !== "codex-tui") fail();
+      const auths = arr(r.auth, 32); unique(auths, "id");
+      for (const a of auths) {
+        obj(a, ["id", "kind", "models", "baseUrl", "credential_present", "verification", "application"]);
+        if (!id(a.id) || a.verification !== "not_checked" || a.application !== "not_applied") fail();
+        const models = arr(a.models, 200);
+        if (new Set(models).size !== models.length || models.some(m => typeof m !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(m))) fail();
+        if (a.kind === "chatgpt") {
+          if (p.id !== "openai" || a.baseUrl !== undefined || a.credential_present !== false) fail();
+        } else if (a.kind === "api_key") {
+          if (a.credential_present !== true || typeof a.baseUrl !== "string" || a.baseUrl.length > 2048) fail();
+          let u: URL; try { u = new URL(a.baseUrl); } catch { return fail(); }
+          if (u.protocol !== "https:" || u.username || u.password || u.search || u.hash) fail();
+        } else fail();
+      }
+    }
+  }
+  // JSON roundtrip detaches the validated object from mutable caller references.
+  const encoded = JSON.stringify(s);
+  if (new TextEncoder().encode(encoded).byteLength > 1024 * 1024) fail();
+  return JSON.parse(encoded);
+}

package/src/shared/provider-application.ts

@@ -0,0 +1,24 @@
+// #906 public application protocol. No paths, endpoints or credentials.
+export type ProviderApplicationSelection = {
+  node_id: string; node_revision: string; provider_id: string; auth_id: string;
+  model: string; confirm_restart: true;
+};
+const fields = (v: any, names: string[]) => v && typeof v === 'object' && !Array.isArray(v)
+  && Object.keys(v).length === names.length && Object.keys(v).every(k => names.includes(k));
+const id = (v: any) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(v);
+const hash = (v: any) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+export function validProviderApplicationSelection(v: any): v is ProviderApplicationSelection {
+  return fields(v, ['node_id', 'node_revision', 'provider_id', 'auth_id', 'model', 'confirm_restart'])
+    && id(v.node_id) && hash(v.node_revision) && id(v.provider_id) && id(v.auth_id) && id(v.model)
+    && v.confirm_restart === true;
+}
+export function validProviderApplicationReceipt(v: any, requestId: string, revision: number,
+  selection: ProviderApplicationSelection): boolean {
+  return fields(v, ['status', 'request_id', 'node_id', 'provider_id', 'auth_id', 'model', 'runtime_provider',
+    'node_revision', 'provider_revision', 'verification', 'applied_at'])
+    && v.status === 'applied' && v.request_id === requestId && v.node_id === selection.node_id
+    && v.provider_id === selection.provider_id && v.auth_id === selection.auth_id && v.model === selection.model
+    && typeof v.runtime_provider === 'string' && /^anet_[a-f0-9]{20}$/.test(v.runtime_provider)
+    && hash(v.node_revision) && v.provider_revision === revision && v.verification === 'runtime_confirmed'
+    && Number.isSafeInteger(v.applied_at) && v.applied_at > 0 && v.applied_at <= Date.now() + 30_000;
+}

package/src/tool-audience-http.test.ts

@@ -197,7 +197,19 @@ describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // user 58 / 56,950 B → 57,163 B (+213). start_node adds 213 B, report_status 169 B;
   // hidden pull/ack schemas account for the remaining 948 B. Keep strict receipt validation
   // and unchanged audiences; budget only this measured addition (~130/520 B node/all margin).
-  const CEILINGS = { node: 62_500, user: 57_500, all: 79_500 } as const;
+  // Board #654 adds report_status adoption_candidates (node-only schema, no new tool).
+  // Same tree, field removed → restored: all 87 / 79,078 B → 79,591 B (+513);
+  // node 61 / 62,433 B → 62,946 B (+513); user 58 / 57,228 B unchanged
+  // (report_status is not on the user list). Budget only this measured addition
+  // (~154/509 B node/all margin).
+  // #906 registers daemon_provider_snapshot (user) plus pull/ack (protocol; omitted
+  // from the default node and user lists). Measured on this tree after the
+  // description trims already in the change: all 90 / 80,307 B; node 61 / 62,556 B;
+  // user 59 / 57,372 B. Node stays under 63,100 (544 B) and user under 57,500 (128 B).
+  // `all` is 207 B over 80,100. The two protocol descriptions are 179 B together, so
+  // shortening them cannot pay for their schemas. Raise only `all` to 80,800
+  // (493 B margin, same order as the previous all margin).
+  const CEILINGS = { node: 63_100, user: 57_500, all: 80_800 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -23,6 +23,8 @@ import { NODE_TOOL_CLASS, nodeIdentity, nodePermissionsFlag, broadcastVerdict, h
 export type ToolAudience = "both" | "node" | "protocol" | "user";
 
 export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
+  daemon_provider_snapshot: "user",
+  pull_daemon_provider_snapshots: "protocol", ack_daemon_provider_snapshot: "protocol",
   request_adopt_node: "user", unadopt_node: "user",
   get_adopt_request: "protocol", ack_adopt_request: "protocol",
   // ── 节点:用户令牌一律 network_token_required ──

package/src/tools.ts

@@ -1,6 +1,8 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { requestProviderSnapshot, requestProviderWrite, requestProviderApplication, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
+import { adoptionCandidatesReportSchema } from "./adoption-candidates.js";
 import { forkRecoveryRequestSchema, forkRecoveryResultSchema, publicForkResult } from "./codex-fork-contract.js";
 import { lockNodeAlias } from "./node-token-ownership.js";
 import { clearNodeFromAgentTeams, agentTeamWhoami } from "./agent-teams.js";
@@ -39,6 +41,7 @@ import {
   FLAG_KEYS,
   validateFlagValue,
   validateFlagsForRuntime,
+  validateOpenCodeV2ProviderModel,
   ValidationError,
 } from "./create-node-validate.js";
 import {
@@ -843,6 +846,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         daemon_capabilities: z.object({
           codex_fork_recovery: z.object({ protocol: z.literal(1), cli_supported: z.boolean() }).optional().catch(undefined),
           adopt_capable: z.boolean().optional(),
+          adoption_candidates: adoptionCandidatesReportSchema,
           runtimes_supported: z.array(z.string().max(64)).max(16).optional(),
           allowed_secret_keys: z.array(z.string().max(64)).max(64).optional(),
           max_concurrent_children: z.number().int().min(1).max(1000).optional(),
@@ -3196,7 +3200,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     callerNetworkId: string | null,
   ): { row: any | null; sec1Ok: boolean } => {
     const row = db.get<any>(
-      "SELECT node_id, alias, network_id, config_revision, config_snapshot FROM nodes WHERE node_id = ?1",
+      "SELECT node_id, alias, network_id, runtime, config_revision, config_snapshot FROM nodes WHERE node_id = ?1",
       nodeId,
     );
     if (!row) return { row: null, sec1Ok: false };
@@ -3326,7 +3330,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         };
       }
 
-      const validationFail = validatePatch(model, flags, channels);
+      const validationFail = validatePatch(model, flags, channels, node.runtime);
       if (validationFail) {
         return {
           content: [{
@@ -4113,6 +4117,34 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const resolveCallerDaemonTokenBound = () =>
     _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
 
+  const providerHuman = (net?: string) => ({ userId: enforceUserId, isNode: callerTokenIsNetwork, networkId: getNetworkId(net) });
+  const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
+  server.tool(
+    "daemon_provider_snapshot", "Admin Provider config. refresh/put/apply: id=daemon; read: id=request. put: revision/provider; apply: revision/provider={node_id,node_revision,provider_id,auth_id,model,confirm_restart:true}.",
+    { action: z.enum(["refresh", "read", "put", "apply"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional() },
+    async ({ action, id, network_id, revision, provider }) => {
+      const human = providerHuman(network_id);
+      if (action === "read") return providerReply(getProviderSnapshot(human, id));
+      const daemon_node_id = id;
+      const result = action === 'apply' ? requestProviderApplication(human, daemon_node_id, revision!, provider)
+        : action === 'put' ? requestProviderWrite(human, daemon_node_id, revision!, provider) : requestProviderSnapshot(human, daemon_node_id);
+      if (result.ok) {
+        const target = db.get<{ alias: string }>("SELECT alias FROM nodes WHERE node_id=?1 AND network_id=?2", daemon_node_id, human.networkId!);
+        if (target) pushEvent(target.alias, { type: "daemon_provider_snapshot", request_id: result.request_id }, human.networkId!);
+      }
+      return providerReply(result);
+    },
+  );
+  server.tool(
+    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/apply capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional() },
+    async ({ accept_writes, accept_applications }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications)),
+  );
+  server.tool(
+    "ack_daemon_provider_snapshot", "Target daemon acknowledges redacted Provider configuration readback; fixed failure code only.",
+    { request_id: z.string().min(1).max(200), snapshot: z.unknown().optional(), failed: z.boolean().optional(), applied_revision: z.number().int().min(0).optional(), application: z.unknown().optional() },
+    async ({ request_id, snapshot, failed, applied_revision, application }) => providerReply(ackProviderSnapshot(resolveCallerDaemonTokenBound(), request_id, snapshot, failed, applied_revision, application)),
+  );
+
   // Helper — map a ValidationError thrown from create-node-validate
   // into the MCP-tool-call JSON reply shape.
   const validationFailReply = (e: unknown) => {
@@ -4132,7 +4164,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // join on api_tokens.revoked_at.
   server.tool(
     "list_host_supervisors",
-    "List host_supervisor daemon nodes in the caller's network (online status + runtimes_supported + allowed_secret_keys + telemetry; member-脱敏). RFC-026 §9.2.1.",
+    "List network daemons: status, runtimes, secret-key allowlist and telemetry (member-redacted).",
     {
       network_id: z.string().max(200).optional(),
     },
@@ -4268,7 +4300,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // row (metadata only — no env_blob in SQL), pushEvent doorbell.
   server.tool(
     "create_node",
-    "Create a node on a host-daemon and start it. Daemon forks `anet node create + start` on the target machine; child reports back to hub. RFC-026.",
+    "Create/start a node on the target daemon; the child reports back to Hub.",
     {
       daemon_node_id: z.string().min(1).max(200),
       node_spec: z.object({
@@ -4438,6 +4470,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           validateFlagValue(k, v);
         }
         validateFlagsForRuntime(node_spec.runtime, node_spec.flags);
+        validateOpenCodeV2ProviderModel(node_spec.runtime, node_spec.model, node_spec.flags);
       } catch (e) {
         return validationFailReply(e);
       }
@@ -4582,7 +4615,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // any still-pending requests bound to its own daemon token.
   server.tool(
     "list_my_pending_create_requests",
-    "Daemon lists pending create-node requests bound to itself for SSE reconnect compensation. RFC-026/#1362.",
+    "Daemon pulls its pending creates after reconnect.",
     {},
     async () => {
       const callerDaemon = resolveCallerDaemonTokenBound();
@@ -4614,7 +4647,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // 只返回绑定到本 daemon + 本网络的 pending 行。
   server.tool(
     "list_my_pending_lifecycle_requests",
-    "Daemon lists pending stop/delete/start requests bound to itself for SSE reconnect compensation. Mirrors list_my_pending_create_requests (#1394/#1448).",
+    "Daemon pulls its pending stop/delete/start requests after reconnect.",
     {},
     async () => {
       const callerDaemon = resolveCallerDaemonTokenBound();
@@ -5178,7 +5211,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "stop_node",
-    "Stop the agent-node child process; keep config dir intact. Reversible via restart_node. RFC-027 §2.2. daemon_node_id is auto-resolved from child_node_id when omitted (looked up in node_create_requests).",
+    "Stop child, preserving config. Restart via restart_node. Omitted daemon_node_id resolves from child's create request.",
     {
       ...NODE_ID_ALIAS_FIELDS,
       // PR2 prereq: dashboard rarely knows daemon_node_id directly.
@@ -5407,7 +5440,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // consumer of its own, so restart_node's self-doorbell cannot revive it.
   server.tool(
     "start_node",
-    "Start a stopped child through its host supervisor daemon. daemon_node_id is auto-resolved from the original create request.",
+    "Start stopped child; omitted daemon_node_id resolves from its create request.",
     {
       ...NODE_ID_ALIAS_FIELDS,
       daemon_node_id: z.string().min(1).max(200).regex(/^node_[a-z0-9_-]+$/).optional(),
@@ -5629,7 +5662,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // token + network.
   server.tool(
     "list_my_children",
-    "Daemon pulls the alias + node_id list of children it spawned (for childrenMap rebuild after restart). RFC-027 PR1.1.",
+    "Daemon lists child alias/node_id pairs to rebuild its map.",
     {},
     async () => {
       const callerDaemon = resolveCallerDaemonTokenBound(); // board #674: token-bound snapshot, not a lease
@@ -5675,7 +5708,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const adoptionReply = (result: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(result) }] });
   server.tool(
     "request_adopt_node",
-    "Human owner/admin requests adoption. Only the target capable daemon may activate the binding after local verification; no process is signalled.",
+    "Owner/admin requests adoption; target daemon verifies locally before binding. No signals.",
     { node_id: z.string().min(1).max(200), daemon_node_id: z.string().min(1).max(200), workdir: z.string().min(1).max(4096) },
     async args => adoptionReply(requestAdopt(adoptionHuman(), args)),
   );
@@ -5984,7 +6017,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // §2.3.3 — list_providers (viewer+; never returns secret VALUES).
   server.tool(
     "list_providers",
-    "List providers + models in the caller's network. Never returns secret VALUES. RFC-028.",
+    "List network Provider/model registry, never secrets. Not daemon inventory.",
     { network_id: z.string().max(200).optional() },
     async ({ network_id: clientNetId }) => {
       const effectiveNetId = getNetworkId(clientNetId);
@@ -6011,7 +6044,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // §2.3.5 — probe_provider_model (admin+; dispatches to daemon).
   server.tool(
     "probe_provider_model",
-    "Dispatch a connectivity probe to a daemon. Mints ephemeral secret blob; daemon pulls via get_probe_request. Admin+. RFC-028.",
+    "Admin+ dispatches daemon probe; ephemeral secret pulled via get_probe_request.",
     {
       provider_id: z.string().min(1).max(200),
       model_name: z.string().min(1).max(100),
@@ -6077,7 +6110,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // §2.3.6 — get_probe_results (viewer+; matrix renderer source).
   server.tool(
     "get_probe_results",
-    "Query probe history (optionally filtered by provider/model/daemon). Used by dashboard reachability matrix. RFC-028.",
+    "Query probe history filtered by provider/model/daemon.",
     {
       provider_id: z.string().max(200).optional(),
       model_name: z.string().max(100).optional(),
@@ -6105,7 +6138,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // §2.3.7 daemon-facing — get_probe_request.
   server.tool(
     "get_probe_request",
-    "Daemon pulls a pending probe request (called when SSE probe_provider doorbell arrives). RFC-028.",
+    "Daemon pulls pending probe on SSE probe_provider.",
     { probe_id: z.string().min(1).max(200) },
     async ({ probe_id }) => {
       const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });