@sleep2agi/commhub-server 0.9.0-preview.121 → 0.9.0-preview.123

package/src/shared/daemon-provider-login.ts

@@ -0,0 +1,31 @@
+// #906 managed login transport: only explicit actions and secret-free projections.
+export type LoginIntent = { action: 'start' | 'read' | 'cancel' | 'save' | 'accounts'; session_id?: string; label?: string };
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const object = (v: any) => v && typeof v === 'object' && !Array.isArray(v);
+const keys = (v: any, names: string[]) => Object.keys(v).every(k => names.includes(k));
+export function validLoginIntent(v: any): v is LoginIntent {
+  return object(v) && keys(v, ['action','session_id','label'])
+    && ['start','read','cancel','save','accounts'].includes(v.action)
+    && (v.action === 'accounts' ? v.session_id === undefined : typeof v.session_id === 'string' && uuid.test(v.session_id))
+    && (v.action === 'save' ? typeof v.label === 'string' && !!v.label.trim() && v.label.length <= 100 && !/[\x00-\x1f\x7f]/.test(v.label) : v.label === undefined);
+}
+export function validLoginReceipt(v: any, intent: LoginIntent, network: string, daemon: string): boolean {
+  if (!object(v)) return false;
+  if (intent.action === 'accounts') return keys(v, ['accounts']) && Array.isArray(v.accounts) && v.accounts.length <= 100
+    && v.accounts.every((a: any) => object(a) && keys(a, ['version','network_id','daemon_node_id','account_id','label','created_at','auth_state'])
+      && a.version === 1 && a.network_id === network && a.daemon_node_id === daemon
+      && typeof a.account_id === 'string' && uuid.test(a.account_id)
+      && typeof a.label === 'string' && a.label.length <= 100
+      && Number.isSafeInteger(a.created_at) && a.auth_state === 'not_checked');
+  if (!keys(v, ['request_id','status','error','challenge','account_id']) || v.request_id !== intent.session_id
+    || !['idle','starting','awaiting_user','verifying','authenticated','cancelled','failed'].includes(v.status)) return false;
+  if (v.error !== undefined && !['login_start_failed','login_rejected','account_read_failed','login_process_exited','login_expired'].includes(v.error)) return false;
+  if (v.account_id !== undefined && (v.status !== 'authenticated' || typeof v.account_id !== 'string' || !uuid.test(v.account_id))) return false;
+  if (intent.action === 'cancel' && v.status !== 'cancelled') return false;
+  if (intent.action === 'save' && (v.status !== 'authenticated' || !v.account_id)) return false;
+  if (v.status === 'awaiting_user') return object(v.challenge) && keys(v.challenge, ['loginId','verificationUrl','userCode'])
+    && typeof v.challenge.loginId === 'string' && uuid.test(v.challenge.loginId)
+    && v.challenge.verificationUrl === 'https://auth.openai.com/codex/device'
+    && typeof v.challenge.userCode === 'string' && /^[A-Z0-9-]{4,32}$/i.test(v.challenge.userCode);
+  return v.challenge === undefined;
+}

package/src/shared/daemon-provider-snapshot.ts

@@ -28,13 +28,16 @@ export function validateDaemonProviderSnapshot(value: unknown, networkId: string
       obj(r, ["runtime", "auth"]); if (r.runtime !== "codex-tui") fail();
       const auths = arr(r.auth, 32); unique(auths, "id");
       for (const a of auths) {
-        obj(a, ["id", "kind", "models", "baseUrl", "credential_present", "verification", "application"]);
+        obj(a, ["id", "kind", "models", "baseUrl", "account_id", "credential_present", "verification", "application"]);
         if (!id(a.id) || a.verification !== "not_checked" || a.application !== "not_applied") fail();
         const models = arr(a.models, 200);
         if (new Set(models).size !== models.length || models.some(m => typeof m !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(m))) fail();
         if (a.kind === "chatgpt") {
-          if (p.id !== "openai" || a.baseUrl !== undefined || a.credential_present !== false) fail();
+          if (p.id !== "openai" || a.baseUrl !== undefined || typeof a.credential_present !== 'boolean') fail();
+          if (a.account_id !== undefined && (typeof a.account_id !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(a.account_id))) fail();
+          if (a.credential_present && !a.account_id) fail();
         } else if (a.kind === "api_key") {
+          if (a.account_id !== undefined) fail();
           if (a.credential_present !== true || typeof a.baseUrl !== "string" || a.baseUrl.length > 2048) fail();
           let u: URL; try { u = new URL(a.baseUrl); } catch { return fail(); }
           if (u.protocol !== "https:" || u.username || u.password || u.search || u.hash) fail();

package/src/shared/provider-application.ts

@@ -2,23 +2,28 @@
 export type ProviderApplicationSelection = {
   node_id: string; node_revision: string; provider_id: string; auth_id: string;
   model: string; confirm_restart: true;
+  account_id?: string;
 };
 const fields = (v: any, names: string[]) => v && typeof v === 'object' && !Array.isArray(v)
   && Object.keys(v).length === names.length && Object.keys(v).every(k => names.includes(k));
 const id = (v: any) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(v);
 const hash = (v: any) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const account = (v: any) => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(v);
 export function validProviderApplicationSelection(v: any): v is ProviderApplicationSelection {
-  return fields(v, ['node_id', 'node_revision', 'provider_id', 'auth_id', 'model', 'confirm_restart'])
+  return fields(v, ['node_id', 'node_revision', 'provider_id', 'auth_id', 'model', 'confirm_restart',
+    ...(v?.account_id !== undefined ? ['account_id'] : [])])
+    && (v.account_id === undefined || (v.provider_id === 'openai' && account(v.account_id)))
     && id(v.node_id) && hash(v.node_revision) && id(v.provider_id) && id(v.auth_id) && id(v.model)
     && v.confirm_restart === true;
 }
 export function validProviderApplicationReceipt(v: any, requestId: string, revision: number,
   selection: ProviderApplicationSelection): boolean {
   return fields(v, ['status', 'request_id', 'node_id', 'provider_id', 'auth_id', 'model', 'runtime_provider',
-    'node_revision', 'provider_revision', 'verification', 'applied_at'])
+    'node_revision', 'provider_revision', 'verification', 'applied_at', ...(selection.account_id ? ['account_id'] : [])])
     && v.status === 'applied' && v.request_id === requestId && v.node_id === selection.node_id
     && v.provider_id === selection.provider_id && v.auth_id === selection.auth_id && v.model === selection.model
-    && typeof v.runtime_provider === 'string' && /^anet_[a-f0-9]{20}$/.test(v.runtime_provider)
+    && (selection.account_id ? v.runtime_provider === 'openai' && v.account_id === selection.account_id
+      : typeof v.runtime_provider === 'string' && /^anet_[a-f0-9]{20}$/.test(v.runtime_provider))
     && hash(v.node_revision) && v.provider_revision === revision && v.verification === 'runtime_confirmed'
     && Number.isSafeInteger(v.applied_at) && v.applied_at > 0 && v.applied_at <= Date.now() + 30_000;
 }

package/src/stop-delete-node.test.ts

@@ -419,6 +419,46 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect(JSON.parse(audits[0].detail).backup_path).toBe("/home/u/.anet/deleted/1719647200000-sd-child-a");
   });
 
+  // Daemon-mediated delete used to drop only the nodes row. The child's sessions
+  // row stayed behind as "offline", so /api/status — and every client list built
+  // on it — kept showing the deleted node forever (desktop: the node stays put
+  // under 「删除请求已提交」). REST DELETE /api/nodes/:id already drops both.
+  test("daemon ack 'stopped' on delete branch → the child's session row is gone too", async () => {
+    setupAlphaNetwork();
+    db.run(
+      "INSERT INTO sessions (resume_id, alias, node_id, network_id, status) VALUES (?1, ?2, ?3, ?4, 'idle')",
+      ["resume-sd-child-a", CHILD_A_ALIAS, CHILD_A_ID, NET_A],
+    );
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    const left = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM sessions WHERE node_id = ?1", CHILD_A_ID);
+    expect(Number(left?.n ?? 0)).toBe(0);
+  });
+
+  test("delete finalize drops the session by node_id, sparing a same-alias rebuilt node", async () => {
+    setupAlphaNetwork();
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    // Before the ack lands, a new node takes the same alias and registers.
+    const REBUILT_ID = "node_sd_child_a_rebuilt";
+    db.run(
+      "INSERT INTO sessions (resume_id, alias, node_id, network_id, status) VALUES (?1, ?2, ?3, ?4, 'idle')",
+      ["resume-sd-child-a-rebuilt", CHILD_A_ALIAS, REBUILT_ID, NET_A],
+    );
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    const rebuilt = db.get<{ status: string }>("SELECT status FROM sessions WHERE node_id = ?1", REBUILT_ID);
+    expect(rebuilt?.status).toBe("idle");
+  });
+
   // #1448 finding-4 — stop/delete 必须校验 daemon 是 child 的权威创建者(镜像 start)。
   // 改前只校验 daemon 存在+同网 → 同网调用方传错 daemon_node_id,门铃路由到错 daemon。
   // f3 合入后错 daemon 会 sweep 空 + ack stopped → hub 假收敛 stopped 而 child 仍在跑。

package/src/tool-audience-http.test.ts

@@ -163,7 +163,7 @@ describe("what each caller sees", () => {
 
   test("node modes: readonly / restricted drop broadcast + node writes + human-only; enforce drops human-only for normal nodes", async () => {
     const ro = new Set((await listTools(T.node_readonly)).names);
-    for (const n of ["broadcast", "update_node_config", "create_node", "upsert_provider"]) expect([n, ro.has(n)]).toEqual([n, false]);
+    for (const n of ["broadcast", "update_node_config", "create_node", "clone_node", "upsert_provider"]) expect([n, ro.has(n)]).toEqual([n, false]);
     for (const n of ["send_task", "requirements_update", "report_status", "get_all_status"]) expect([n, ro.has(n)]).toEqual([n, true]); // 看参数才拒的照列
     expect(new Set((await listTools(T.node_normal)).names).has("upsert_provider")).toBe(true); // log 模式:调得通,照列
     process.env.COMMHUB_NODE_PERMISSIONS = "enforce";
@@ -202,14 +202,12 @@ describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // node 61 / 62,433 B → 62,946 B (+513); user 58 / 57,228 B unchanged
   // (report_status is not on the user list). Budget only this measured addition
   // (~154/509 B node/all margin).
-  // #906 registers daemon_provider_snapshot (user) plus pull/ack (protocol; omitted
-  // from the default node and user lists). Measured on this tree after the
-  // description trims already in the change: all 90 / 80,307 B; node 61 / 62,556 B;
-  // user 59 / 57,372 B. Node stays under 63,100 (544 B) and user under 57,500 (128 B).
-  // `all` is 207 B over 80,100. The two protocol descriptions are 179 B together, so
-  // shortening them cannot pay for their schemas. Raise only `all` to 80,800
-  // (493 B margin, same order as the previous all margin).
-  const CEILINGS = { node: 63_100, user: 57_500, all: 80_800 } as const;
+  // #906 plus Hub #938 clone_node (all 91 / 81,228 B; node 62 / 63,281 B;
+  // user 60 / 58,169 B). OpenCode V2 catalog adds 2 user tools and 2 protocol
+  // tools. Measured on this combined tree: all 95 / 85,069 B; node 62 / 63,281 B
+  // unchanged (protocol tools stay off the node list); user 62 / 59,409 B.
+  // Ceilings keep about 400 B and nothing else.
+  const CEILINGS = { node: 63_700, user: 59_810, all: 85_500 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -41,8 +41,10 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   get_stop_request: "protocol", ack_stop_request: "protocol",
   get_start_request: "protocol", ack_start_request: "protocol",
   get_probe_request: "protocol", ack_probe_request: "protocol",
+  get_opencode_catalog_request: "protocol", ack_opencode_catalog: "protocol",
   // ── 人:节点令牌一律 user_token_required(项目管理)/ node_token_cannot_browse_files / node_token_cannot_read_logs ──
   projects_create: "user", projects_update: "user",
+  read_opencode_catalog: "user", get_opencode_catalog: "user",
   list_node_files: "user", read_node_file: "user", tail_node_logs: "user",
   // ── 两边都能调 ──
   submit_skill: "both", list_skills: "both", get_skill: "both", review_skill: "both",
@@ -53,7 +55,7 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   send_desktop_message: "both", broadcast: "both", get_completions: "both",
   update_node_config: "both", read_node_rules_file: "both", write_node_rules_file: "both",
   list_node_skills: "both", read_node_skill: "both", get_rules_file_result: "both",
-  restart_node: "both", list_host_supervisors: "both", create_node: "both", stop_node: "both", delete_node: "both", start_node: "both",
+  restart_node: "both", list_host_supervisors: "both", create_node: "both", clone_node: "both", stop_node: "both", delete_node: "both", start_node: "both",
   upsert_network_secret: "both", list_network_secrets: "both", upsert_provider: "both", update_provider: "both",
   list_providers: "both", probe_provider_model: "both", get_probe_results: "both",
   requirements_list: "both", requirements_people: "both", requirements_get: "both", requirements_create: "both",

package/src/tools.ts

@@ -1,5 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { requestProviderSnapshot, requestProviderWrite, requestProviderApplication, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
+import { requestProviderSnapshot, requestProviderWrite, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { adoptionCandidatesReportSchema } from "./adoption-candidates.js";
@@ -55,6 +55,7 @@ import {
   auditCreateNodeStrict,
   resolveCallerDaemonTokenBound as _resolveCallerDaemonTokenBound,
 } from "./create-node.js";
+import { decideClone, factsFromRows, parseWorkdirPolicy } from "./clone-node.js";
 import {
   vaultUpsert, vaultGet, vaultListKeys, vaultDelete,
   VaultError,
@@ -72,6 +73,13 @@ import {
   startPendingProbeGcTimer,
   startProbeSweeperTimer,
 } from "./probe.js";
+import {
+  ackOpenCodeCatalog,
+  getOpenCodeCatalogResult,
+  opencodeCatalogAckSchema,
+  queueOpenCodeCatalogRead,
+  takeOpenCodeCatalogRequest,
+} from "./opencode-v2-catalog.js";
 import { canonicalAliasExists, cleanupRenamedAliasSession, resolveCanonicalAlias } from "./rename.js";
 import {
   ALLOWED_FLAGS,
@@ -4120,13 +4128,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const providerHuman = (net?: string) => ({ userId: enforceUserId, isNode: callerTokenIsNetwork, networkId: getNetworkId(net) });
   const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
   server.tool(
-    "daemon_provider_snapshot", "Admin Provider config. refresh/put/apply: id=daemon; read: id=request. put: revision/provider; apply: revision/provider={node_id,node_revision,provider_id,auth_id,model,confirm_restart:true}.",
-    { action: z.enum(["refresh", "read", "put", "apply"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional() },
-    async ({ action, id, network_id, revision, provider }) => {
+    "daemon_provider_snapshot", "Admin Provider: refresh/put/apply/login use daemon id; read uses request id. put: revision+provider; apply: revision+node selection; login: provider={action:start|read|cancel|save|accounts,session_id?,label?}. No login tokens.",
+    { action: z.enum(["refresh", "read", "put", "apply", "login"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
+    async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);
-      if (action === "read") return providerReply(getProviderSnapshot(human, id));
+      if (action === "read") return providerReply(getProviderSnapshot(human, id, include_discovery));
       const daemon_node_id = id;
-      const result = action === 'apply' ? requestProviderApplication(human, daemon_node_id, revision!, provider)
+      const result = action === 'login' ? requestProviderLogin(human, daemon_node_id, provider)
+        : action === 'apply' ? requestProviderApplication(human, daemon_node_id, revision!, provider)
         : action === 'put' ? requestProviderWrite(human, daemon_node_id, revision!, provider) : requestProviderSnapshot(human, daemon_node_id);
       if (result.ok) {
         const target = db.get<{ alias: string }>("SELECT alias FROM nodes WHERE node_id=?1 AND network_id=?2", daemon_node_id, human.networkId!);
@@ -4136,13 +4145,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
   server.tool(
-    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/apply capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional() },
-    async ({ accept_writes, accept_applications }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications)),
+    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional() },
+    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications, accept_logins, accept_local_discovery)),
   );
   server.tool(
     "ack_daemon_provider_snapshot", "Target daemon acknowledges redacted Provider configuration readback; fixed failure code only.",
-    { request_id: z.string().min(1).max(200), snapshot: z.unknown().optional(), failed: z.boolean().optional(), applied_revision: z.number().int().min(0).optional(), application: z.unknown().optional() },
-    async ({ request_id, snapshot, failed, applied_revision, application }) => providerReply(ackProviderSnapshot(resolveCallerDaemonTokenBound(), request_id, snapshot, failed, applied_revision, application)),
+    { request_id: z.string().min(1).max(200), snapshot: z.unknown().optional(), failed: z.boolean().optional(), applied_revision: z.number().int().min(0).optional(), application: z.unknown().optional(), login: z.unknown().optional() },
+    async ({ request_id, snapshot, failed, applied_revision, application, login }) => providerReply(ackProviderSnapshot(resolveCallerDaemonTokenBound(), request_id, snapshot, failed, applied_revision, application, login)),
   );
 
   // Helper — map a ValidationError thrown from create-node-validate
@@ -4610,6 +4619,156 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // Hub #938 — clone a child that already lives on a daemon into a new
+  // node on THAT daemon. New alias, new ntok_. Session copy is done by
+  // the daemon from the source config on disk; this tool only records
+  // the policy and the runtime's session capability (see clone-node.ts).
+  server.tool(
+    "clone_node",
+    "Clone a daemon child into a new node on the same daemon. New name and new token. copy_session defaults to true. workdir_policy new_empty (default) or share_source. Hub #938.",
+    {
+      source_node_id: z.string().min(1).max(200),
+      name: z.string().min(1).max(256),
+      copy_session: z.boolean().optional(),
+      workdir_policy: z.enum(["new_empty", "share_source"]).optional(),
+      daemon_node_id: z.string().min(1).max(200).optional(),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ source_node_id, name, copy_session, workdir_policy, daemon_node_id, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      const callerRole = enforceUserId && effectiveNetId
+        ? getUserNetworkRole(enforceUserId, effectiveNetId)
+        : null;
+      if (callerRole !== "admin" && callerRole !== "owner") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "insufficient_role_for_create_node", required_role: "admin", caller_role: callerRole }) }] };
+      }
+      const { row: source, sec1Ok } = resolveTargetNode(source_node_id, effectiveNetId);
+      if (!source) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_not_found", node_id: source_node_id }) }] };
+      }
+      if (!sec1Ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_node" }) }] };
+      }
+      const createRow = db.get<{ daemon_node_id: string; runtime: string; model: string | null; flags_json: string; child_name: string }>(
+        `SELECT daemon_node_id, runtime, model, flags_json, child_name
+           FROM node_create_requests
+          WHERE child_node_id = ?1 AND network_id = ?2 AND status = 'succeeded'
+          ORDER BY created_at DESC LIMIT 1`,
+        source_node_id, source.network_id || effectiveNetId || "default",
+      );
+      const net = source.network_id || effectiveNetId || "default";
+      const nameRows = db.all<{ alias: string | null; node_name: string | null }>(
+        `SELECT alias, node_name FROM nodes WHERE network_id = ?1`,
+        net,
+      );
+      const existingNames = nameRows.flatMap((r) => [r.alias, r.node_name].filter((x): x is string => !!x));
+      const owning = createRow?.daemon_node_id ?? "";
+      const inflight = owning
+        ? db.all<{ child_name: string }>(
+          `SELECT child_name FROM node_create_requests WHERE daemon_node_id = ?1 AND status IN ('pending', 'delivered')`,
+          owning,
+        ).map((r) => r.child_name)
+        : [];
+      let policy: ReturnType<typeof parseWorkdirPolicy>;
+      try { policy = parseWorkdirPolicy(workdir_policy); }
+      catch (e) { return validationFailReply(e); }
+      const facts = factsFromRows({
+        node: source,
+        createRow: createRow ?? null,
+        existingNames,
+        inflightNames: inflight,
+      });
+      let decision;
+      try {
+        decision = decideClone(facts, {
+          newName: name,
+          copySession: copy_session !== false,
+          workdirPolicy: policy,
+          requestedDaemonId: daemon_node_id ?? null,
+        });
+      } catch (e) {
+        return validationFailReply(e);
+      }
+      if (!decision.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: decision.error, ...decision.detail }) }] };
+      }
+      const { row: daemon, sec1Ok: daemonOk } = resolveTargetNode(decision.daemonNodeId, effectiveNetId);
+      if (!daemon || !daemonOk) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "daemon_not_found", daemon_node_id: decision.daemonNodeId }) }] };
+      }
+      if (!enforceUserId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "auth_required" }) }] };
+      }
+      const childToken = generateNetworkToken();
+      const childTokenId = generateId("tok");
+      const requestId = newRequestId();
+      const networkIdForChild = daemon.network_id || net;
+      const cloneMeta = {
+        source_node_id,
+        source_alias: facts.alias,
+        copy_session: decision.copySession,
+        workdir_policy: decision.workdirPolicy,
+        channels: decision.channels,
+      };
+      db.run(
+        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 2)`,
+        [childTokenId, hashToken(childToken), enforceUserId, networkIdForChild, `node:${decision.name}`, "network", "child", requestId],
+      );
+      putPendingEnvBlob({
+        request_id: requestId,
+        daemon_node_id: decision.daemonNodeId,
+        env_blob: {},
+        child_token: childToken,
+        child_token_id: childTokenId,
+      });
+      db.run(
+        `INSERT INTO node_create_requests
+           (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token, clone_json)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, '[]', 'pending', ?8, ?9, ?10, ?11)`,
+        [
+          requestId, decision.daemonNodeId, decision.name, networkIdForChild,
+          decision.runtime, decision.model, JSON.stringify(decision.flags),
+          childTokenId, Date.now(), callerTokenId || "unknown", JSON.stringify(cloneMeta),
+        ],
+      );
+      pushEvent(daemon.alias, { type: "clone_node", request_id: requestId }, networkIdForChild);
+      auditCreateNode({
+        action: "clone_node_dispatch_attempted",
+        user_id: enforceUserId,
+        network_id: networkIdForChild,
+        target_id: requestId,
+        detail: {
+          daemon_node_id: decision.daemonNodeId,
+          source_node_id,
+          child_name: decision.name,
+          runtime: decision.runtime,
+          copy_session: decision.copySession,
+          workdir_policy: decision.workdirPolicy,
+          session_mode: decision.sessionContract.mode,
+        },
+      });
+      return {
+        content: [{ type: "text" as const, text: JSON.stringify({
+          ok: true,
+          request_id: requestId,
+          daemon_node_id: decision.daemonNodeId,
+          child_name: decision.name,
+          copy_session: decision.copySession,
+          workdir_policy: decision.workdirPolicy,
+          session_contract: decision.sessionContract,
+          contract: {
+            token: "new ntok_ minted for the clone; the source token is not copied",
+            workdir: decision.workdirPolicy === "new_empty"
+              ? "new empty directory under the source workdir's parent (or <daemon cwd>/clone-work when the source has no project workdir)"
+              : "share the source workdir (explicit)",
+            session: decision.sessionContract.detail,
+          },
+        }) }],
+      };
+    },
+  );
+
   // #1362 — daemon-side compensation for missed SSE doorbells. pushEvent is
   // intentionally best-effort; after a daemon connects or reconnects, it pulls
   // any still-pending requests bound to its own daemon token.
@@ -4628,10 +4787,29 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           WHERE daemon_node_id = ?1
             AND network_id = ?2
             AND status = 'pending'
+            AND COALESCE(clone_json, '') = ''
+          ORDER BY created_at ASC`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      // Hub #938 — clone rows stay out of `requests` so an older daemon
+      // that replays every pending create does not spawn a blank node.
+      const clone_requests = db.all<{ request_id: string; child_name: string; created_at: number }>(
+        `SELECT request_id, child_name, created_at
+           FROM node_create_requests
+          WHERE daemon_node_id = ?1
+            AND network_id = ?2
+            AND status = 'pending'
+            AND COALESCE(clone_json, '') != ''
           ORDER BY created_at ASC`,
         callerDaemon.daemonNodeId, callerDaemon.networkId,
       );
-      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, count: rows.length, requests: rows }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        count: rows.length,
+        requests: rows,
+        clone_count: clone_requests.length,
+        clone_requests,
+      }) }] };
     },
   );
 
@@ -4699,21 +4877,30 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // isn't a host_supervisor, reject.
   server.tool(
     "get_create_request",
-    "Daemon pulls a pending create-node request (called when SSE create_node doorbell arrives). RFC-026.",
+    "Daemon pulls a pending create-node request (called when SSE create_node doorbell arrives). RFC-026. expect_clone pulls a clone_node row.",
     {
       request_id: z.string().min(1).max(200),
+      expect_clone: z.boolean().optional(),
     },
-    async ({ request_id }) => {
+    async ({ request_id, expect_clone }) => {
       const callerDaemon = resolveCallerDaemonTokenBound();
       if (!callerDaemon.ok) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
       }
 
-      const row = db.get<{ request_id: string; daemon_node_id: string; status: string; child_token_id: string | null; network_id: string }>(
-        `SELECT request_id, daemon_node_id, status, child_token_id, network_id FROM node_create_requests WHERE request_id = ?1`,
+      const row = db.get<{ request_id: string; daemon_node_id: string; status: string; child_token_id: string | null; network_id: string; clone_json: string | null }>(
+        `SELECT request_id, daemon_node_id, status, child_token_id, network_id, clone_json FROM node_create_requests WHERE request_id = ?1`,
         request_id,
       );
       if (!row) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found" }) }] };
+      const isClone = typeof row.clone_json === "string" && row.clone_json.trim().length > 0;
+      // Do not consume the env blob or flip status when the wrong handler asks.
+      if (isClone && expect_clone !== true) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "clone_request" }) }] };
+      }
+      if (!isClone && expect_clone === true) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "not_a_clone" }) }] };
+      }
       // §4.1.4 — strict daemon binding by token-derived node_id.
       if (row.daemon_node_id !== callerDaemon.daemonNodeId) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "not_your_request" }) }] };
@@ -4763,6 +4950,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           },
           child_token: blob.child_token,
           env_blob: blob.env_blob,
+          ...(isClone ? { clone: JSON.parse(row.clone_json as string) } : {}),
         }) }],
       };
     },
@@ -5400,6 +5588,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
               );
             }
             db.run(`DELETE FROM nodes WHERE node_id = ?1`, [row.child_node_id]);
+            // Same as REST DELETE /api/nodes/:id: without this the sessions row
+            // stays "offline" and /api/status lists the deleted node forever.
+            // By node_id, not alias — a same-alias rebuild keeps its session.
+            db.run(`DELETE FROM sessions WHERE node_id = ?1`, [row.child_node_id]);
             clearNodeFromAgentTeams(row.child_node_id); // #764
             auditCreateNodeStrict({
               action: "delete_node_completed",
@@ -5425,7 +5617,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // 🔴 关键的是最后那半句「据此做了什么」。#1286 里 hub 的代码路径经核对是
       // 正确的,缺的正是「它到底走没走那条分支」—— 只说「收到了 ack」回答不了。
       const did = status === "stopped" && row.action === "delete"
-        ? "revoked ntok + DELETE FROM nodes"
+        ? "revoked ntok + DELETE FROM nodes + sessions"
         : status === "stopped" && row.action === "stop"
         ? "lifecycle_state=stopped"
         : status === "stop_failed"
@@ -6199,6 +6391,80 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // OpenCode V2 catalog. Human tokens queue; the owning daemon pulls scope
+  // only and acks a whitelist snapshot. pending is stored authorization, not
+  // a snapshot and not proof the doorbell was received.
+  server.registerTool(
+    "read_opencode_catalog",
+    {
+      description: "Queue a native OpenCode V2 catalog read for one owned child. ok with status pending means authorized and stored in memory, not a snapshot and not proof a daemon received the doorbell. Does not start a server. url, authorization, directory, settings, headers, and body are rejected.",
+      inputSchema: z.object({
+        daemon_node_id: z.string().min(1).max(200),
+        node_id: z.string().min(1).max(200),
+        network_id: z.string().max(200).optional(),
+      }).strict() as any,
+    },
+    async (args: { daemon_node_id: string; node_id: string; network_id?: string }) => {
+      const networkId = getNetworkId(args.network_id);
+      const queued = queueOpenCodeCatalogRead({
+        callerUserId: enforceUserId ?? null,
+        callerIsNode: callerTokenIsNetwork,
+        networkId,
+        daemonNodeId: args.daemon_node_id,
+        nodeId: args.node_id,
+      });
+      if (!queued.ok) return { content: [{ type: "text" as const, text: JSON.stringify(queued) }] };
+      pushEvent(queued.daemon_alias, { type: "opencode_catalog", request_id: queued.request_id }, queued.network_id);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status: "pending", request_id: queued.request_id }) }] };
+    },
+  );
+
+  server.registerTool(
+    "get_opencode_catalog",
+    {
+      description: "Poll one queued OpenCode V2 catalog read. status pending is not a snapshot. Only status ready returns a whitelist snapshot, still completeness unknown and invocationVerified false.",
+      inputSchema: z.object({
+        request_id: z.string().min(1).max(200),
+        network_id: z.string().max(200).optional(),
+      }).strict() as any,
+    },
+    async (args: { request_id: string; network_id?: string }) => {
+      const result = getOpenCodeCatalogResult({
+        callerUserId: enforceUserId ?? null,
+        callerIsNode: callerTokenIsNetwork,
+        networkId: getNetworkId(args.network_id),
+        requestId: args.request_id,
+      });
+      return { content: [{ type: "text" as const, text: JSON.stringify(result) }] };
+    },
+  );
+
+  server.registerTool(
+    "get_opencode_catalog_request",
+    {
+      description: "Daemon pulls one authorized OpenCode V2 catalog read. Scope only: no URL, authorization, settings, headers, or body.",
+      inputSchema: z.object({ request_id: z.string().min(1).max(200) }).strict() as any,
+    },
+    async (args: { request_id: string }) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify(takeOpenCodeCatalogRequest(args.request_id, callerDaemon.daemonNodeId)) }] };
+    },
+  );
+
+  server.registerTool(
+    "ack_opencode_catalog",
+    {
+      description: "Daemon stores a whitelist OpenCode V2 catalog snapshot or a closed error code. Extra fields are rejected. A stored failure is status failed, not a transport error.",
+      inputSchema: opencodeCatalogAckSchema as any,
+    },
+    async (args: unknown) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify(ackOpenCodeCatalog(callerDaemon.daemonNodeId, args)) }] };
+    },
+  );
+
   // ── 需求池 / 任务看板(Agent 读写任务,例如把 GitHub issue 同步成任务) ──
   // 全部走 REST 同一个处理函数(requirements.ts handleRequirementsRequest):权限、校验、谁做的记录只有一份。
   // 节点令牌只在它绑定的网络里读 / 建 / 改 / 勾子任务 / upsert / 读项目;删除和管理项目只给人。