@sleep2agi/commhub-server 0.9.0-preview.121 → 0.9.0-preview.122

package/src/daemon-provider-snapshots.test.ts

@@ -4,6 +4,10 @@ import { readFileSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from "nod
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createHash } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { CodexManagedLogin } from '../../agent-node/src/runtime/codex-managed-login';
+import { DaemonCodexLogins } from '../../agent-node/src/runtime/daemon-codex-logins';
+import { executeProviderLogin, closeProviderLogins } from '../../agent-node/src/runtime/daemon-provider-login';
 import { db } from "./db";
 import { registerTools } from "./tools";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -14,6 +18,7 @@ import { register, createNetworkTokenForNode } from "./auth";
 const net = "net_dps906", user = "u_dps906", node = "node_dps906", token = "token_dps906", alias = "daemon906";
 const root = mkdtempSync(join(tmpdir(), "dps906-"));
 function cleanup() {
+  db.run('DELETE FROM daemon_provider_logins WHERE request_id IN (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1)', [net]);
   db.run('DELETE FROM daemon_provider_applications WHERE request_id IN (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1)', [net]);
   db.run('DELETE FROM daemon_provider_writes WHERE request_id IN (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1)', [net]);
   db.run('DELETE FROM node_daemon_bindings WHERE network_id=?1', [net]);
@@ -44,6 +49,90 @@ function client(kind = "human", network = net) {
 const snapshot = () => ({ network_id: net, daemon_node_id: node, revision: 0, source: "daemon", providers: [] });
 const request = () => client()("daemon_provider_snapshot", { action: "refresh", network_id: net, id: node });
 
+test('saved ChatGPT account binding traverses Hub and compiled daemon CLI without credentials', async () => {
+  process.env.ANET_HUB_SECRET_VAULT_KEY = '42'.repeat(32);
+  const work = mkdtempSync(join(root, 'bind-')), dir = join(work, '.anet/nodes', alias);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, 'config.json'), JSON.stringify({ role: 'host_supervisor', network_id: net, node_id: node }), { mode: 0o600 });
+  const prepared = new DaemonProviderStore(dir).prepareLoginDirectory();
+  const home = join(prepared.root, 'login-fixture'); mkdirSync(home, { mode: 0o700 });
+  const account = '11111111-1111-4111-8111-111111111111';
+  writeFileSync(join(home, 'anet-account.json'), JSON.stringify({ version: 1, network_id: net, daemon_node_id: node, account_id: account }), { mode: 0o600 });
+  writeFileSync(join(home, 'auth.json'), JSON.stringify({ auth_mode: 'chatgpt', tokens: { access_token: 'TEST-ONLY-access', refresh_token: 'TEST-ONLY-refresh' } }), { mode: 0o600 });
+  const provider = { id: 'openai', label: 'OpenAI', enabled: true, runtimes: [{ runtime: 'codex-tui', auth: [
+    { id: 'work', kind: 'chatgpt', account_id: account, models: ['model-fixture'] },
+  ] }] };
+  const human = client(), daemon = client('daemon');
+  const r = await human('daemon_provider_snapshot', { action: 'put', id: node, network_id: net, revision: 0, provider });
+  expect(r.ok).toBe(true);
+  await reconcileProviderSnapshots({ workDir: work, alias, networkId: net, daemonId: node, serverUrl: 'https://hub.example.test', warn: () => {}, callCommHub: daemon });
+  const read = await human('daemon_provider_snapshot', { action: 'read', id: r.request_id, network_id: net });
+  expect(read.status).toBe('succeeded');
+  expect(read.snapshot.providers[0].runtimes[0].auth[0]).toMatchObject({ account_id: account, credential_present: true, verification: 'not_checked', application: 'not_applied' });
+  expect(JSON.stringify(read)).not.toContain('TEST-ONLY-access');
+  expect(JSON.stringify(read)).not.toContain('TEST-ONLY-refresh');
+  expect(JSON.stringify(read)).not.toContain(home);
+});
+
+test('managed login: admin intent → capable target daemon → session manager → bounded public receipt', async () => {
+  const work = mkdtempSync(join(root, 'login-'));
+  const dir = join(work, '.anet/nodes', alias); mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, 'config.json'), JSON.stringify({ role: 'host_supervisor', network_id: net, node_id: node }), { mode: 0o600 });
+  const prepared = new DaemonProviderStore(dir).prepareLoginDirectory();
+  const session = 'b86c3ca5-5022-434d-bc9f-aa1c82ecf419';
+  class Rpc extends EventEmitter {
+    account: unknown = null;
+    async request<R>(method: string): Promise<R> {
+      return (method === 'account/read' ? { account: this.account } : { type: 'chatgptDeviceCode', loginId: session,
+        verificationUrl: 'https://auth.openai.com/codex/device', userCode: 'TEST-ONLY' }) as R;
+    }
+    async close() {}
+  }
+  const rpc = new Rpc(); let home = '';
+  const logins = new DaemonCodexLogins(prepared.root, { network_id: net, daemon_node_id: node }, async () => {
+    home = mkdtempSync(join(prepared.root, 'login-'));
+    const login = new CodexManagedLogin(rpc);
+    return { home, login, discard: async () => { await login.close(); rmSync(home, { recursive: true, force: true }); } };
+  });
+  const human = client(), daemon = client('daemon');
+  const deps = { workDir: work, alias, networkId: net, daemonId: node, serverUrl: 'https://hub.example.test', warn: () => {},
+    callCommHub: daemon, login: (intent: any) => executeProviderLogin(logins, intent) };
+  const command = (intent: any) => human('daemon_provider_snapshot', { action: 'login', id: node, network_id: net, provider: intent });
+  const read = (id: string) => human('daemon_provider_snapshot', { action: 'read', id, network_id: net });
+  try {
+    expect((await daemon('daemon_provider_snapshot', { action: 'login', id: node, provider: { action: 'start', session_id: session } })).ok).toBe(false);
+    expect((await command({ action: 'start', session_id: session, token: 'TEST-ONLY' })).ok).toBe(false);
+    const start = await command({ action: 'start', session_id: session });
+    expect(start.ok).toBe(true);
+    expect((await daemon('pull_daemon_provider_snapshots', { accept_writes: true, accept_applications: true })).requests).toEqual([]);
+    expect((await client('daemon', 'other')('pull_daemon_provider_snapshots', { accept_logins: true })).ok).toBe(false);
+    expect((await daemon('ack_daemon_provider_snapshot', { request_id: start.request_id, login: { request_id: session, status: 'authenticated', token: 'TEST-ONLY' } })).ok).toBe(false);
+    await reconcileProviderSnapshots(deps);
+    const challenge = await read(start.request_id);
+    expect(challenge.status).toBe('succeeded');
+    expect(challenge.login.status).toBe('awaiting_user');
+    expect(challenge.snapshot).toBeNull();
+    writeFileSync(join(home, 'auth.json'), '{"TEST_ONLY":"SECRET"}', { mode: 0o600 });
+    rpc.account = { type: 'chatgpt', email: 'PRIVATE', token: 'SECRET' };
+    rpc.emit('account/login/completed', { loginId: session, success: true });
+    await Promise.resolve();
+    const save = await command({ action: 'save', session_id: session, label: 'Work' });
+    await reconcileProviderSnapshots(deps);
+    expect((await read(save.request_id)).login.account_id).toBeString();
+    const list = await command({ action: 'accounts' });
+    // Listing uses the actual daemon handler and compiled pinned CLI bootstrap,
+    // not the injected OAuth fixture. It does not start a login or run inference.
+    await reconcileProviderSnapshots({ ...deps, login: undefined });
+    const result = await read(list.request_id);
+    expect(result.login.accounts).toHaveLength(1);
+    expect(result.login.accounts[0].auth_state).toBe('not_checked');
+    expect(JSON.stringify(result)).not.toMatch(/SECRET|PRIVATE|auth.json/);
+    db.run('UPDATE daemon_provider_snapshots SET expires_at=?1 WHERE request_id=?2', [Date.now() - 1, start.request_id]);
+    expect((await read(start.request_id)).login).toBeNull();
+    expect(db.get<any>('SELECT snapshot_json FROM daemon_provider_snapshots WHERE request_id=?1', start.request_id).snapshot_json).toBeNull();
+  } finally { await logins.close(); await closeProviderLogins(); }
+});
+
 test('application transport: scoped intent, capability gate, exact public receipt and changed binding refusal', async () => {
   const human = client(), daemon = client('daemon');
   const child = 'node_apply906';
@@ -71,6 +160,20 @@ test('application transport: scoped intent, capability gate, exact public receip
   const read = await human('daemon_provider_snapshot', { action: 'read', id: r.request_id, network_id: net });
   expect(read.status).toBe('succeeded'); expect(read.application).toEqual(receipt); expect(read.snapshot).toBeNull();
   expect(db.get('SELECT * FROM daemon_provider_applications WHERE request_id=?1', r.request_id)).toBeNull();
+  const accountId = 'aaaaaaaa-1111-4111-8111-111111111111';
+  const officialSelection = { ...selection, provider_id: 'openai', auth_id: 'work-login', account_id: accountId };
+  const official = await human('daemon_provider_snapshot', { ...args, provider: officialSelection });
+  expect(official.ok).toBe(true);
+  const officialDispatch = await daemon('pull_daemon_provider_snapshots', { accept_applications: true });
+  expect(officialDispatch.requests[0].selection).toEqual(officialSelection);
+  const officialReceipt = { ...receipt, request_id: official.request_id, provider_id: 'openai', auth_id: 'work-login',
+    account_id: accountId, runtime_provider: 'openai', applied_at: Date.now() };
+  for (const wrong of [{ ...officialReceipt, account_id: 'bbbbbbbb-1111-4111-8111-111111111111' },
+    { ...officialReceipt, account_id: undefined }, { ...officialReceipt, runtime_provider: receipt.runtime_provider }]) {
+    expect((await daemon('ack_daemon_provider_snapshot', { request_id: official.request_id, application: wrong })).error).toBe('invalid_application_receipt');
+  }
+  expect((await daemon('ack_daemon_provider_snapshot', { request_id: official.request_id, application: officialReceipt })).status).toBe('succeeded');
+  expect((await human('daemon_provider_snapshot', { action: 'read', id: official.request_id, network_id: net })).application).toEqual(officialReceipt);
   const stale = await human('daemon_provider_snapshot', args);
   db.run("UPDATE node_daemon_bindings SET daemon_node_id='other' WHERE request_id='binding_apply906'");
   expect((await daemon('pull_daemon_provider_snapshots', { accept_applications: true })).requests).toEqual([]);

package/src/daemon-provider-snapshots.ts

@@ -8,6 +8,7 @@ import { validateDaemonProviderSnapshot } from "./shared/daemon-provider-snapsho
 import { encryptSecret, decryptSecret, VaultError } from './vault';
 import { buildControllableMap } from './node-lifecycle-controllable';
 import { validProviderApplicationSelection, validProviderApplicationReceipt, type ProviderApplicationSelection } from './shared/provider-application';
+import { validLoginIntent, validLoginReceipt } from './shared/daemon-provider-login';
 
 export function providerScanTargets(networkId: string, daemonId: string) {
   const ownership = buildControllableMap(
@@ -38,6 +39,9 @@ function daemonExists(networkId: string, nodeId: string): boolean {
   try { return JSON.parse(node?.config_snapshot || "{}").role === "host_supervisor"; } catch { return false; }
 }
 function expire(networkId: string, daemonId?: string) {
+  // Device-code instructions are short-lived; do not leave them in audit history.
+  db.run(`UPDATE daemon_provider_snapshots SET status='expired', snapshot_json=NULL, error='request_expired'
+    WHERE network_id=?1 AND request_id LIKE 'dpl_%' AND expires_at <= ?2`, [networkId, Date.now()]);
   db.run(`UPDATE daemon_provider_snapshots SET status='expired', error='request_expired'
     WHERE network_id=?1 AND status='pending' AND expires_at <= ?2
     AND (?3 IS NULL OR daemon_node_id=?3)`, [networkId, Date.now(), daemonId ?? null]);
@@ -45,6 +49,8 @@ function expire(networkId: string, daemonId?: string) {
     (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
   db.run(`DELETE FROM daemon_provider_applications WHERE request_id IN
     (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
+  db.run(`DELETE FROM daemon_provider_logins WHERE request_id IN
+    (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
   db.run(`DELETE FROM daemon_provider_snapshots WHERE network_id=?1 AND expires_at < ?2`, [networkId, Date.now() - 7 * 86400_000]);
 }
 /** Validate the complete public projection before encrypting the private input. */
@@ -56,8 +62,10 @@ function validateWrite(provider: any, networkId: string, daemonId: string) {
       if (a.kind === 'chatgpt' && key !== undefined) throw new Error('invalid_provider');
       if (key !== undefined && (typeof key !== 'string' || !key || key.length > 8192 || /[\s\x00-\x1f\x7f]/.test(key))) throw new Error('invalid_provider');
       // Only CLI write fields may be supplied; public-state flags are not writable.
-      if (Object.keys(a).some(k => !['id','kind','models','baseUrl','key'].includes(k))) throw new Error('invalid_provider');
-      return { ...rest, credential_present: a.kind === 'api_key', verification: 'not_checked', application: 'not_applied' };
+      if (Object.keys(a).some(k => !['id','kind','models','baseUrl','key','account_id'].includes(k))) throw new Error('invalid_provider');
+      // A bound login write must be confirmed present by its owning daemon;
+      // this projection is the expected receipt, not an independent Hub claim.
+      return { ...rest, credential_present: a.kind === 'api_key' || (a.kind === 'chatgpt' && a.account_id !== undefined), verification: 'not_checked', application: 'not_applied' };
     }),
   })) };
   validateDaemonProviderSnapshot({ network_id: networkId, daemon_node_id: daemonId, source: 'daemon', revision: 0, providers: [publicProvider] }, networkId, daemonId);
@@ -133,6 +141,21 @@ export function requestProviderSnapshot(h: Human, daemonId: string) {
   if (!accepted) return denied("provider_snapshot_busy");
   return { ok: true as const, request_id: accepted.request_id, status: "pending", expires_at: accepted.expires_at };
 }
+export function requestProviderLogin(h: Human, daemonId: string, intent: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!validLoginIntent(intent)) return denied('invalid_login_intent');
+  expire(h.networkId!, daemonId);
+  const requestId = `dpl_${randomUUID()}`, now = Date.now();
+  try {
+    db.transaction(() => {
+      db.run(`INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+        VALUES (?1,?2,?3,?4,'pending',?5,?6)`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+      db.run('INSERT INTO daemon_provider_logins (request_id,intent_json) VALUES (?1,?2)', [requestId, JSON.stringify(intent)]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 120_000 };
+  } catch { return denied('provider_snapshot_busy'); }
+}
 export function getProviderSnapshot(h: Human, requestId: string) {
   const refusal = authorize(h); if (refusal) return refusal;
   expire(h.networkId!);
@@ -140,16 +163,24 @@ export function getProviderSnapshot(h: Human, requestId: string) {
   if (!row) return denied("request_not_found");
   return { ok: true, request_id: row.request_id, daemon_node_id: row.daemon_node_id, status: row.status,
     expires_at: row.expires_at, observed_at: row.observed_at, error: row.error,
-    snapshot: !row.request_id.startsWith('dpa_') && row.snapshot_json ? JSON.parse(row.snapshot_json) : null,
+    snapshot: !/^dp[al]_/.test(row.request_id) && row.snapshot_json ? JSON.parse(row.snapshot_json) : null,
+    ...(row.request_id.startsWith('dpl_') ? { login: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}),
     ...(row.request_id.startsWith('dpa_') ? { application: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}) };
 }
-export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApplications = false) {
+export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApplications = false, acceptLogins = false) {
   if (!d.ok) return denied("caller_not_a_daemon");
   if (!daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
   expire(d.networkId, d.daemonNodeId);
   const requests = db.all<{ request_id: string; expires_at: number }>(`SELECT request_id,expires_at FROM daemon_provider_snapshots
     WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending' ORDER BY created_at LIMIT 20`, d.networkId, d.daemonNodeId);
   try { return { ok: true, requests: requests.flatMap<Record<string, unknown>>(r => {
+    if (r.request_id.startsWith('dpl_')) {
+      if (!acceptLogins) return [];
+      const row = db.get<{ intent_json: string }>('SELECT intent_json FROM daemon_provider_logins WHERE request_id=?1', r.request_id);
+      const intent = row && JSON.parse(row.intent_json);
+      if (!validLoginIntent(intent)) throw Error('invalid_login_intent');
+      return [{ ...r, operation: 'login', intent }];
+    }
     if (r.request_id.startsWith('dpa_')) {
       if (!acceptApplications) return []; // old daemons must not consume applications as scans
       const application = applicationIntent(r.request_id);
@@ -166,13 +197,25 @@ export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApp
     return [write ? { ...r, operation: 'put', ...write } : { ...r, scan_targets: providerScanTargets(d.networkId, d.daemonNodeId) }];
   }) }; } catch { return denied('provider_write_unavailable'); }
 }
-export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unknown, failed = false, appliedRevision?: number, application?: unknown) {
+export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unknown, failed = false, appliedRevision?: number, application?: unknown, login?: unknown) {
   if (!d.ok || !daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
   expire(d.networkId, d.daemonNodeId);
   const row = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE request_id=?1 AND network_id=?2 AND daemon_node_id=?3`, requestId, d.networkId, d.daemonNodeId);
   if (!row) return denied("request_not_found");
   // First accepted receipt wins; reconnect replay cannot rewrite prior evidence.
   if (row.status !== "pending") return { ok: row.status === "succeeded" || row.status === "failed", status: row.status };
+  if (requestId.startsWith('dpl_')) {
+    if (snapshot !== undefined || application !== undefined || appliedRevision !== undefined || (failed && login !== undefined)) return denied('invalid_login_receipt');
+    const intentRow = db.get<{ intent_json: string }>('SELECT intent_json FROM daemon_provider_logins WHERE request_id=?1', requestId);
+    const intent = intentRow && JSON.parse(intentRow.intent_json);
+    if (!failed && (!validLoginIntent(intent) || !validLoginReceipt(login, intent, d.networkId, d.daemonNodeId))) return denied('invalid_login_receipt');
+    db.run(`UPDATE daemon_provider_snapshots SET status=?1,snapshot_json=?2,error=?3,observed_at=?4
+      WHERE request_id=?5 AND status='pending'`, [failed ? 'failed' : 'succeeded', failed ? null : JSON.stringify(login),
+      failed ? 'provider_login_unavailable' : null, Date.now(), requestId]);
+    db.run('DELETE FROM daemon_provider_logins WHERE request_id=?1', [requestId]);
+    return { ok: true, status: failed ? 'failed' : 'succeeded' };
+  }
+  if (login !== undefined) return denied('invalid_login_receipt');
   if (requestId.startsWith('dpa_')) {
     if (snapshot !== undefined || appliedRevision !== undefined || (failed && application !== undefined)) return denied('invalid_application_receipt');
     if (!failed) {
@@ -180,7 +223,7 @@ export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unk
         const intent = applicationIntent(requestId);
         if (!intent || !boundApplicationTarget(d.networkId, d.daemonNodeId, intent.selection)
           || !validProviderApplicationReceipt(application, requestId, intent.expected_revision, intent.selection)
-          || (application as any).runtime_provider !== `anet_${createHash('sha256').update(JSON.stringify([intent.selection.provider_id, intent.selection.auth_id])).digest('hex').slice(0, 20)}`
+          || (application as any).runtime_provider !== (intent.selection.account_id ? 'openai' : `anet_${createHash('sha256').update(JSON.stringify([intent.selection.provider_id, intent.selection.auth_id])).digest('hex').slice(0, 20)}`)
           || (application as any).applied_at < row.created_at - 30_000) return denied('invalid_application_receipt');
       } catch { return denied('invalid_application_receipt'); }
     }

package/src/daemon-token-owner-http.test.ts

@@ -215,7 +215,9 @@ test("all production token issuers explicitly mark the rollout epoch", () => {
       expect(match[1]).toContain("node_identity_epoch"); count++;
     }
   }
-  expect(count).toBe(9);
+  // Hub #938: clone_node mints a child ntok_ with node_identity_epoch=2,
+  // the same column create_node already writes. 9 issuers → 10.
+  expect(count).toBe(10);
   expect(readFileSync(`${root}/agent-network/bin/cli.ts`, "utf8")).toContain("'admin-reset', 'user', 1)");
 });
 

package/src/db.ts

@@ -550,6 +550,11 @@ db.exec(`CREATE TABLE IF NOT EXISTS daemon_provider_applications (
   selection_json TEXT NOT NULL
 )`);
 
+// Login commands contain only intent. OAuth tokens never enter Hub storage.
+db.exec(`CREATE TABLE IF NOT EXISTS daemon_provider_logins (
+  request_id TEXT PRIMARY KEY, intent_json TEXT NOT NULL
+)`);
+
 // At most one row per node may be in a non-terminal state at a time
 // (single-flight enforced at the tool layer; this table just stores).
 //
@@ -810,6 +815,15 @@ try {
   if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
 }
 
+// Hub #938 — clone_node reuses this table (same token mint, sweeper, and
+// register finalize) but must not be replayed as a blank create_node.
+// NULL/empty = ordinary create. Non-empty JSON = clone directives.
+try {
+  db.exec(`ALTER TABLE node_create_requests ADD COLUMN clone_json TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
 // #1493 — 把 user_inbox.network_id 升到 **schema 级 NOT NULL**(belt-and-suspenders,
 // 叠在 send_desktop_message 的代码级三闸之上:canWrite / `!effectiveNetId` return /
 // getUserNetworkRole,tools.ts)。「不产生 network_id=NULL 孤儿」现是代码级保证 + #1492

package/src/mcp-context-cost-http.test.ts

@@ -26,7 +26,9 @@ if (!activeDbPath) throw new Error("mcp-context-cost requires COMMHUB_DB (or COM
  * 加工具或加说明超过它,就在这里改数字并在 PR 里说为什么。
  */
 // Board #625: two human adoption tools; measured 58 tools / 56,615 B.
-const TOOLS_LIST_MAX_BYTES = 57_500;
+// Hub #938 clone_node is audience both, so this user-token list grows.
+// Measured with #906's tools plus clone_node: 60 tools / 58,169 B. Ceiling keeps ~431 B.
+const TOOLS_LIST_MAX_BYTES = 58_600;
 /** 单个工具(名字 + 描述 + 输入 schema)的上限;最大的是 report_status(节点心跳,~8.4 KB 的遥测结构)。 */
 const TOOL_MAX_BYTES = 9_000;
 /** 单条工具描述的上限(说明写进参数的 describe,或者拆短)。 */

package/src/node-permissions.ts

@@ -275,7 +275,7 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   schedule_create: "schedule", schedule_update: "schedule", schedule_cancel: "schedule", schedule_run_now: "schedule",
   schedule_batch_interval: "schedule",
   // 写节点 / 技能 / 探测:只读、受限不行;正常由 RFC-036 等既有规则管
-  update_node_config: "node_write", write_node_rules_file: "node_write", restart_node: "node_write", create_node: "node_write",
+  update_node_config: "node_write", write_node_rules_file: "node_write", restart_node: "node_write", create_node: "node_write", clone_node: "node_write",
   stop_node: "node_write", delete_node: "node_write", start_node: "node_write", submit_skill: "node_write", probe_provider_model: "node_write",
   // 只有人能做
   upsert_network_secret: "human_only", upsert_provider: "human_only", update_provider: "human_only",

package/src/shared/daemon-provider-login.ts

@@ -0,0 +1,31 @@
+// #906 managed login transport: only explicit actions and secret-free projections.
+export type LoginIntent = { action: 'start' | 'read' | 'cancel' | 'save' | 'accounts'; session_id?: string; label?: string };
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const object = (v: any) => v && typeof v === 'object' && !Array.isArray(v);
+const keys = (v: any, names: string[]) => Object.keys(v).every(k => names.includes(k));
+export function validLoginIntent(v: any): v is LoginIntent {
+  return object(v) && keys(v, ['action','session_id','label'])
+    && ['start','read','cancel','save','accounts'].includes(v.action)
+    && (v.action === 'accounts' ? v.session_id === undefined : typeof v.session_id === 'string' && uuid.test(v.session_id))
+    && (v.action === 'save' ? typeof v.label === 'string' && !!v.label.trim() && v.label.length <= 100 && !/[\x00-\x1f\x7f]/.test(v.label) : v.label === undefined);
+}
+export function validLoginReceipt(v: any, intent: LoginIntent, network: string, daemon: string): boolean {
+  if (!object(v)) return false;
+  if (intent.action === 'accounts') return keys(v, ['accounts']) && Array.isArray(v.accounts) && v.accounts.length <= 100
+    && v.accounts.every((a: any) => object(a) && keys(a, ['version','network_id','daemon_node_id','account_id','label','created_at','auth_state'])
+      && a.version === 1 && a.network_id === network && a.daemon_node_id === daemon
+      && typeof a.account_id === 'string' && uuid.test(a.account_id)
+      && typeof a.label === 'string' && a.label.length <= 100
+      && Number.isSafeInteger(a.created_at) && a.auth_state === 'not_checked');
+  if (!keys(v, ['request_id','status','error','challenge','account_id']) || v.request_id !== intent.session_id
+    || !['idle','starting','awaiting_user','verifying','authenticated','cancelled','failed'].includes(v.status)) return false;
+  if (v.error !== undefined && !['login_start_failed','login_rejected','account_read_failed','login_process_exited','login_expired'].includes(v.error)) return false;
+  if (v.account_id !== undefined && (v.status !== 'authenticated' || typeof v.account_id !== 'string' || !uuid.test(v.account_id))) return false;
+  if (intent.action === 'cancel' && v.status !== 'cancelled') return false;
+  if (intent.action === 'save' && (v.status !== 'authenticated' || !v.account_id)) return false;
+  if (v.status === 'awaiting_user') return object(v.challenge) && keys(v.challenge, ['loginId','verificationUrl','userCode'])
+    && typeof v.challenge.loginId === 'string' && uuid.test(v.challenge.loginId)
+    && v.challenge.verificationUrl === 'https://auth.openai.com/codex/device'
+    && typeof v.challenge.userCode === 'string' && /^[A-Z0-9-]{4,32}$/i.test(v.challenge.userCode);
+  return v.challenge === undefined;
+}

package/src/shared/daemon-provider-snapshot.ts

@@ -28,13 +28,16 @@ export function validateDaemonProviderSnapshot(value: unknown, networkId: string
       obj(r, ["runtime", "auth"]); if (r.runtime !== "codex-tui") fail();
       const auths = arr(r.auth, 32); unique(auths, "id");
       for (const a of auths) {
-        obj(a, ["id", "kind", "models", "baseUrl", "credential_present", "verification", "application"]);
+        obj(a, ["id", "kind", "models", "baseUrl", "account_id", "credential_present", "verification", "application"]);
         if (!id(a.id) || a.verification !== "not_checked" || a.application !== "not_applied") fail();
         const models = arr(a.models, 200);
         if (new Set(models).size !== models.length || models.some(m => typeof m !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(m))) fail();
         if (a.kind === "chatgpt") {
-          if (p.id !== "openai" || a.baseUrl !== undefined || a.credential_present !== false) fail();
+          if (p.id !== "openai" || a.baseUrl !== undefined || typeof a.credential_present !== 'boolean') fail();
+          if (a.account_id !== undefined && (typeof a.account_id !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(a.account_id))) fail();
+          if (a.credential_present && !a.account_id) fail();
         } else if (a.kind === "api_key") {
+          if (a.account_id !== undefined) fail();
           if (a.credential_present !== true || typeof a.baseUrl !== "string" || a.baseUrl.length > 2048) fail();
           let u: URL; try { u = new URL(a.baseUrl); } catch { return fail(); }
           if (u.protocol !== "https:" || u.username || u.password || u.search || u.hash) fail();

package/src/shared/provider-application.ts

@@ -2,23 +2,28 @@
 export type ProviderApplicationSelection = {
   node_id: string; node_revision: string; provider_id: string; auth_id: string;
   model: string; confirm_restart: true;
+  account_id?: string;
 };
 const fields = (v: any, names: string[]) => v && typeof v === 'object' && !Array.isArray(v)
   && Object.keys(v).length === names.length && Object.keys(v).every(k => names.includes(k));
 const id = (v: any) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(v);
 const hash = (v: any) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const account = (v: any) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(v);
 export function validProviderApplicationSelection(v: any): v is ProviderApplicationSelection {
-  return fields(v, ['node_id', 'node_revision', 'provider_id', 'auth_id', 'model', 'confirm_restart'])
+  return fields(v, ['node_id', 'node_revision', 'provider_id', 'auth_id', 'model', 'confirm_restart',
+    ...(v?.account_id !== undefined ? ['account_id'] : [])])
+    && (v.account_id === undefined || (v.provider_id === 'openai' && account(v.account_id)))
     && id(v.node_id) && hash(v.node_revision) && id(v.provider_id) && id(v.auth_id) && id(v.model)
     && v.confirm_restart === true;
 }
 export function validProviderApplicationReceipt(v: any, requestId: string, revision: number,
   selection: ProviderApplicationSelection): boolean {
   return fields(v, ['status', 'request_id', 'node_id', 'provider_id', 'auth_id', 'model', 'runtime_provider',
-    'node_revision', 'provider_revision', 'verification', 'applied_at'])
+    'node_revision', 'provider_revision', 'verification', 'applied_at', ...(selection.account_id ? ['account_id'] : [])])
     && v.status === 'applied' && v.request_id === requestId && v.node_id === selection.node_id
     && v.provider_id === selection.provider_id && v.auth_id === selection.auth_id && v.model === selection.model
-    && typeof v.runtime_provider === 'string' && /^anet_[a-f0-9]{20}$/.test(v.runtime_provider)
+    && (selection.account_id ? v.runtime_provider === 'openai' && v.account_id === selection.account_id
+      : typeof v.runtime_provider === 'string' && /^anet_[a-f0-9]{20}$/.test(v.runtime_provider))
     && hash(v.node_revision) && v.provider_revision === revision && v.verification === 'runtime_confirmed'
     && Number.isSafeInteger(v.applied_at) && v.applied_at > 0 && v.applied_at <= Date.now() + 30_000;
 }

package/src/tool-audience-http.test.ts

@@ -163,7 +163,7 @@ describe("what each caller sees", () => {
 
   test("node modes: readonly / restricted drop broadcast + node writes + human-only; enforce drops human-only for normal nodes", async () => {
     const ro = new Set((await listTools(T.node_readonly)).names);
-    for (const n of ["broadcast", "update_node_config", "create_node", "upsert_provider"]) expect([n, ro.has(n)]).toEqual([n, false]);
+    for (const n of ["broadcast", "update_node_config", "create_node", "clone_node", "upsert_provider"]) expect([n, ro.has(n)]).toEqual([n, false]);
     for (const n of ["send_task", "requirements_update", "report_status", "get_all_status"]) expect([n, ro.has(n)]).toEqual([n, true]); // 看参数才拒的照列
     expect(new Set((await listTools(T.node_normal)).names).has("upsert_provider")).toBe(true); // log 模式:调得通,照列
     process.env.COMMHUB_NODE_PERMISSIONS = "enforce";
@@ -202,14 +202,15 @@ describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // node 61 / 62,433 B → 62,946 B (+513); user 58 / 57,228 B unchanged
   // (report_status is not on the user list). Budget only this measured addition
   // (~154/509 B node/all margin).
-  // #906 registers daemon_provider_snapshot (user) plus pull/ack (protocol; omitted
-  // from the default node and user lists). Measured on this tree after the
-  // description trims already in the change: all 90 / 80,307 B; node 61 / 62,556 B;
-  // user 59 / 57,372 B. Node stays under 63,100 (544 B) and user under 57,500 (128 B).
-  // `all` is 207 B over 80,100. The two protocol descriptions are 179 B together, so
-  // shortening them cannot pay for their schemas. Raise only `all` to 80,800
-  // (493 B margin, same order as the previous all margin).
-  const CEILINGS = { node: 63_100, user: 57_500, all: 80_800 } as const;
+  // #906 registers daemon_provider_snapshot (user) plus pull/ack (protocol).
+  // Measured there: all 90 / 80,307 B; node 61 / 62,556 B; user 59 / 57,372 B,
+  // ceilings 80,800 / 63,100 / 57,500.
+  // Hub #938 adds clone_node (audience both, so it lands on the node list and
+  // the user list) plus optional expect_clone on get_create_request (protocol,
+  // so only the full list). Measured on this combined tree:
+  // all 91 / 81,228 B; node 62 / 63,281 B; user 60 / 58,169 B.
+  // Ceilings keep about 400 B of margin and nothing else.
+  const CEILINGS = { node: 63_700, user: 58_600, all: 81_700 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -53,7 +53,7 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   send_desktop_message: "both", broadcast: "both", get_completions: "both",
   update_node_config: "both", read_node_rules_file: "both", write_node_rules_file: "both",
   list_node_skills: "both", read_node_skill: "both", get_rules_file_result: "both",
-  restart_node: "both", list_host_supervisors: "both", create_node: "both", stop_node: "both", delete_node: "both", start_node: "both",
+  restart_node: "both", list_host_supervisors: "both", create_node: "both", clone_node: "both", stop_node: "both", delete_node: "both", start_node: "both",
   upsert_network_secret: "both", list_network_secrets: "both", upsert_provider: "both", update_provider: "both",
   list_providers: "both", probe_provider_model: "both", get_probe_results: "both",
   requirements_list: "both", requirements_people: "both", requirements_get: "both", requirements_create: "both",