@sleep2agi/commhub-server 0.9.0-preview.122 → 0.9.0-preview.123

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.122",
+  "version": "0.9.0-preview.123",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/daemon-provider-snapshots.test.ts

@@ -1,6 +1,6 @@
 import "./require-explicit-test-db";
 import { afterAll, beforeEach, expect, test } from "bun:test";
-import { readFileSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { readFileSync, mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createHash } from 'node:crypto';
@@ -320,15 +320,17 @@ test("real HTTP authentication -> daemon handler -> pinned CLI -> scoped public
   db.run("UPDATE nodes SET config_snapshot=?1 WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor" }), nodeId]);
   const dir = join(root, ".anet/nodes", daemonAlias); mkdirSync(dir, { recursive: true, mode: 0o700 });
   writeFileSync(join(dir, "config.json"), JSON.stringify({ role: "host_supervisor", network_id: netId, node_id: nodeId }), { mode: 0o600 });
-  for (const child of ['bound', 'neighbour']) {
+  for (const child of ['bound', 'neighbour', 'manual']) {
     const childId = `n_scan_${child}`;
     db.run('INSERT INTO nodes (node_id,node_name,alias,network_id,runtime) VALUES (?1,?2,?2,?3,\'codex-app-server\')', [childId, child, netId]);
-    db.run('INSERT INTO node_daemon_bindings (request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES (?1,?2,?3,?4,?5,?6,\'active\',1,1)',
+    if (child !== 'manual') db.run('INSERT INTO node_daemon_bindings (request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES (?1,?2,?3,?4,?5,?6,\'active\',1,1)',
       [`binding_scan_${child}`, netId, childId, child === 'bound' ? nodeId : 'another-daemon', root, owner.user!.user_id]);
     const home = join(root, '.anet/nodes', child, 'codex-home'); mkdirSync(home, { recursive: true, mode: 0o700 });
     writeFileSync(join(home, '../config.json'), JSON.stringify({ node_id: childId, alias: child, runtime: 'codex-app-server', network_id: netId }), { mode: 0o600 });
     writeFileSync(join(home, 'config.toml'), 'model_provider = "deepseek"\nmodel = "fixture-model"\n[model_providers.deepseek]\nenv_key = "TEST_API_KEY"\n', { mode: 0o600 });
   }
+  chmodSync(join(root, '.anet'), 0o700);
+  chmodSync(join(root, '.anet/nodes'), 0o775);
   const hub = (await import("./server")).bootServer({ port: 0, hostname: "127.0.0.1" });
   const url = `http://127.0.0.1:${hub.port}/mcp`;
   const rpc = (credential: string) => async (name: string, args: any) => {
@@ -352,6 +354,15 @@ test("real HTTP authentication -> daemon handler -> pinned CLI -> scoped public
     expect(read.status).toBe("succeeded"); expect(read.snapshot).toMatchObject({ network_id: netId, daemon_node_id: nodeId, revision: 0, source: "daemon", providers: [], codex_inventory: { scope: 'hub_bound_nodes' } });
     expect(read.snapshot.codex_inventory.rows).toHaveLength(1);
     expect(read.snapshot.codex_inventory.rows[0]).toMatchObject({ node_id: 'n_scan_bound', configured_provider: 'deepseek', configured_model: 'fixture-model', credential_status: 'unknown' });
+    expect(read.snapshot.codex_inventory.local_discovery).toBeUndefined(); // old client projection
+    const discovered = await human('daemon_provider_snapshot', { action: 'read', id: refresh.request_id, network_id: netId, include_discovery: true });
+    expect(discovered.snapshot.codex_inventory.local_discovery).toMatchObject({ status: 'observed', rows: [
+      { node_id: 'n_scan_manual', alias: 'manual', configured_model: 'fixture-model', config_revision: null },
+    ] });
+    expect(discovered.snapshot.codex_inventory.local_discovery.rows).toHaveLength(1); // other daemon filtered
+    const deniedApply = await human('daemon_provider_snapshot', { action: 'apply', id: nodeId, network_id: netId, revision: 0,
+      provider: { node_id: 'n_scan_manual', node_revision: 'a'.repeat(64), provider_id: 'deepseek', auth_id: 'key', model: 'fixture-model', confirm_restart: true } });
+    expect(deniedApply).toMatchObject({ ok: false, error: 'application_target_not_bound' });
     const foreign = await human('daemon_provider_snapshot', { action: 'refresh', id: nodeId, network_id: netId });
     const bad = structuredClone(read.snapshot); bad.codex_inventory.rows[0].node_id = 'n_scan_neighbour';
     expect((await daemon('ack_daemon_provider_snapshot', { request_id: foreign.request_id, snapshot: bad })).ok).toBe(false);

package/src/daemon-provider-snapshots.ts

@@ -156,18 +156,21 @@ export function requestProviderLogin(h: Human, daemonId: string, intent: unknown
     return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 120_000 };
   } catch { return denied('provider_snapshot_busy'); }
 }
-export function getProviderSnapshot(h: Human, requestId: string) {
+export function getProviderSnapshot(h: Human, requestId: string, includeDiscovery = false) {
   const refusal = authorize(h); if (refusal) return refusal;
   expire(h.networkId!);
   const row = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE request_id=?1 AND network_id=?2`, requestId, h.networkId!);
   if (!row) return denied("request_not_found");
+  const snapshot = !/^dp[al]_/.test(row.request_id) && row.snapshot_json ? JSON.parse(row.snapshot_json) : null;
+  // Old clients validate an exact contract. Their default projection stays unchanged.
+  if (!includeDiscovery && snapshot?.codex_inventory) delete snapshot.codex_inventory.local_discovery;
   return { ok: true, request_id: row.request_id, daemon_node_id: row.daemon_node_id, status: row.status,
     expires_at: row.expires_at, observed_at: row.observed_at, error: row.error,
-    snapshot: !/^dp[al]_/.test(row.request_id) && row.snapshot_json ? JSON.parse(row.snapshot_json) : null,
+    snapshot,
     ...(row.request_id.startsWith('dpl_') ? { login: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}),
     ...(row.request_id.startsWith('dpa_') ? { application: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}) };
 }
-export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApplications = false, acceptLogins = false) {
+export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApplications = false, acceptLogins = false, acceptDiscovery = false) {
   if (!d.ok) return denied("caller_not_a_daemon");
   if (!daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
   expire(d.networkId, d.daemonNodeId);
@@ -194,7 +197,7 @@ export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApp
     }
     if (!acceptWrites && db.get('SELECT request_id FROM daemon_provider_writes WHERE request_id=?1', r.request_id)) return [];
     const write = privateWrite(r.request_id, d.networkId, d.daemonNodeId);
-    return [write ? { ...r, operation: 'put', ...write } : { ...r, scan_targets: providerScanTargets(d.networkId, d.daemonNodeId) }];
+    return [write ? { ...r, operation: 'put', ...write } : { ...r, scan_targets: providerScanTargets(d.networkId, d.daemonNodeId), ...(acceptDiscovery ? { discover_local: true } : {}) }];
   }) }; } catch { return denied('provider_write_unavailable'); }
 }
 export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unknown, failed = false, appliedRevision?: number, application?: unknown, login?: unknown) {
@@ -244,6 +247,16 @@ export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unk
         const targets = new Map(providerScanTargets(d.networkId, d.daemonNodeId).map(n => [n.node_id, n.alias]));
         const rows = (safe as any).codex_inventory.rows;
         if (rows.length !== targets.size || rows.some((r: any) => targets.get(r.node_id) !== r.alias)) return denied('invalid_provider_snapshot');
+        const local = (safe as any).codex_inventory.local_discovery;
+        if (local) {
+          const registered = new Map(db.all<{ node_id: string; alias: string }>('SELECT node_id,alias FROM nodes WHERE network_id=?1', d.networkId).map(n => [n.node_id, n.alias]));
+          const ownership = buildControllableMap(
+            db.all<{ request_id: string; daemon_node_id: string }>('SELECT request_id,daemon_node_id FROM node_create_requests WHERE network_id=?1', d.networkId),
+            db.all<{ node_id: string; daemon_node_id: string }>("SELECT node_id,daemon_node_id FROM node_daemon_bindings WHERE network_id=?1 AND status='active'", d.networkId));
+          // Filesystem discovery is not control authority. Other-daemon and
+          // unregistered identities cannot enter this network's public receipt.
+          local.rows = local.rows.filter((r: any) => registered.get(r.node_id) === r.alias && !ownership.has(r.node_id));
+        }
       } catch { return denied('invalid_provider_snapshot'); }
     }
     try {

package/src/daemon-token-owner-http.test.ts

@@ -80,7 +80,8 @@ test("name-only issuance checks existing ownership atomically", async () => {
 });
 
 // Every daemon-facing handler must fail at the shared identity boundary,
-// not incidentally at request lookup or argument validation.
+// not incidentally at request lookup or argument validation. The resolver
+// mutation expects all 15 of these cases to go red together.
 const endpoints: [string, Record<string, unknown>][] = [
   ["list_my_pending_create_requests", {}], ["list_my_pending_lifecycle_requests", {}],
   ["get_create_request", { request_id: "cr_fixture_absent" }],
@@ -92,6 +93,8 @@ const endpoints: [string, Record<string, unknown>][] = [
   ["list_my_children", {}], ["get_adopt_request", {}], ["ack_adopt_request", { status: "adopted" }],
   ["get_probe_request", { probe_id: "probe_fixture_absent" }],
   ["ack_probe_request", { probe_id: "probe_fixture_absent", status: "ok", latency_ms: 1 }],
+  ["get_opencode_catalog_request", { request_id: "cat_fixture_absent" }],
+  ["ack_opencode_catalog", { request_id: "cat_fixture_absent", error: "unavailable" }],
 ];
 for (const [name, arguments_] of endpoints) {
   test(`daemon identity boundary: ${name}`, async () => {

package/src/mcp-context-cost-http.test.ts

@@ -26,9 +26,10 @@ if (!activeDbPath) throw new Error("mcp-context-cost requires COMMHUB_DB (or COM
  * 加工具或加说明超过它,就在这里改数字并在 PR 里说为什么。
  */
 // Board #625: two human adoption tools; measured 58 tools / 56,615 B.
-// Hub #938 clone_node is audience both, so this user-token list grows.
-// Measured with #906's tools plus clone_node: 60 tools / 58,169 B. Ceiling keeps ~431 B.
-const TOOLS_LIST_MAX_BYTES = 58_600;
+// Hub #938 clone_node is audience both (60 tools / 58,169 B). OpenCode V2
+// catalog adds read_opencode_catalog and get_opencode_catalog on that user
+// list. Measured together: 62 tools / 59,409 B. Ceiling keeps ~401 B.
+const TOOLS_LIST_MAX_BYTES = 59_810;
 /** 单个工具(名字 + 描述 + 输入 schema)的上限;最大的是 report_status(节点心跳,~8.4 KB 的遥测结构)。 */
 const TOOL_MAX_BYTES = 9_000;
 /** 单条工具描述的上限(说明写进参数的 describe,或者拆短)。 */

package/src/node-permissions.ts

@@ -254,6 +254,7 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   get_config_update: "always", ack_config_update: "always", get_rules_file_request: "always", ack_rules_file_request: "always", get_rules_file_result: "always",
   get_create_request: "always", ack_create_request: "always", get_stop_request: "always", ack_stop_request: "always",
   get_start_request: "always", ack_start_request: "always", get_probe_request: "always", ack_probe_request: "always",
+  get_opencode_catalog_request: "always", ack_opencode_catalog: "always",
   list_my_pending_create_requests: "always", list_my_pending_lifecycle_requests: "always", list_my_children: "always",
   request_adopt_node: "human_only", unadopt_node: "human_only",
   get_adopt_request: "always", ack_adopt_request: "always",
@@ -280,4 +281,5 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   // 只有人能做
   upsert_network_secret: "human_only", upsert_provider: "human_only", update_provider: "human_only",
   projects_create: "human_only", projects_update: "human_only", review_skill: "human_only",
+  read_opencode_catalog: "human_only", get_opencode_catalog: "human_only",
 };

package/src/opencode-v2-catalog.test.ts

@@ -0,0 +1,268 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import "./require-explicit-test-db.js";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import {
+  ackOpenCodeCatalog,
+  expireOpenCodeCatalogForTest,
+  getOpenCodeCatalogResult,
+  queueOpenCodeCatalogRead,
+  resetOpenCodeCatalogForTest,
+  takeOpenCodeCatalogRequest,
+} from "./opencode-v2-catalog.js";
+import { readOwnedOpenCodeV2Catalog } from "../../agent-node/src/runtime/opencode-v2-catalog-daemon.ts";
+import { readOpenCodeV2CatalogEndpoint, writeOpenCodeV2CatalogEndpoint } from "../../agent-node/src/runtime/opencode-v2-catalog-endpoint.ts";
+
+const NET = "net_oc_catalog";
+const OTHER = "net_oc_catalog_other";
+const USER = "u_oc_catalog";
+const VIEWER = "u_oc_catalog_viewer";
+const OUTSIDER = "u_oc_catalog_out";
+const DAEMON = "node_oc_daemon";
+const DAEMON_ALIAS = "oc-daemon";
+const DAEMON_TOK = "tok_oc_daemon";
+const V2_REQ = "cr_ocv2child";
+const V2 = "node_ocv2child";
+const V1 = "node_ocv1child";
+const UNSAFE = "node_ocunsafechild";
+const NULLDIR = "node_ocnullchild";
+const PROJECT = resolve(mkdtempSync(join(tmpdir(), "oc-hub-proj-")));
+
+function cleanup() {
+  resetOpenCodeCatalogForTest();
+  for (const net of [NET, OTHER]) {
+    for (const table of ["node_create_requests", "audit_log", "nodes", "sessions", "api_tokens", "network_members"]) {
+      try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [net]); } catch {}
+    }
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [net]); } catch {}
+  }
+  for (const user of [USER, VIEWER, OUTSIDER]) {
+    try { db.run("DELETE FROM users WHERE user_id = ?1", [user]); } catch {}
+  }
+}
+beforeEach(cleanup);
+afterAll(() => { cleanup(); rmSync(PROJECT, { recursive: true, force: true }); });
+
+function userRow(id: string) {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'user', datetime('now'))`, [id]);
+}
+function member(id: string, net: string, role: string) {
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, ?3, datetime('now'))`, [id, net, role]);
+}
+function node(id: string, alias: string, snapshot: unknown) {
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, config_snapshot, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, ?4, 'host-x', datetime('now'), datetime('now'), 'active')`,
+    [id, alias, NET, JSON.stringify(snapshot)],
+  );
+}
+function created(requestId: string, nodeId: string, flags: unknown, workdir: string | null) {
+  node(nodeId, nodeId, {});
+  db.run(
+    `INSERT INTO node_create_requests
+      (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, created_at, created_by_token, workdir)
+     VALUES (?1, ?2, ?3, ?4, 'opencode-cli', 'fixture/fixture-model', ?5, '[]', 'succeeded', ?6, 'tok', ?7)`,
+    [requestId, DAEMON, nodeId, NET, JSON.stringify(flags), Date.now(), workdir],
+  );
+}
+
+function seed() {
+  userRow(USER); userRow(VIEWER); userRow(OUTSIDER);
+  db.run(`INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET, USER]);
+  db.run(`INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [OTHER, OUTSIDER]);
+  member(USER, NET, "admin");
+  member(VIEWER, NET, "viewer");
+  member(OUTSIDER, OTHER, "admin");
+  node(DAEMON, DAEMON_ALIAS, { role: "host_supervisor" });
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [DAEMON_TOK, USER, NET, `node:${DAEMON_ALIAS}`, `hash_${DAEMON_TOK}`],
+  );
+  created(V2_REQ, V2, { opencodeGeneration: "v2", opencodeUnsafeTools: true }, PROJECT);
+  created("cr_ocv1child", V1, { opencodeGeneration: "v1" }, PROJECT);
+  created("cr_ocunsafechild", UNSAFE, { opencodeGeneration: "v2", opencodeUnsafeTools: false }, PROJECT);
+  created("cr_ocnullchild", NULLDIR, { opencodeGeneration: "v2", opencodeUnsafeTools: true }, null);
+}
+
+function queue(userId: string, nodeId: string, networkId: string | null = NET, callerIsNode = false) {
+  return queueOpenCodeCatalogRead({ callerUserId: userId, callerIsNode, networkId, daemonNodeId: DAEMON, nodeId });
+}
+
+function handlers(userId: string, isNode: boolean, tokenId: string | null) {
+  const server = new McpServer({ name: "oc-catalog-test", version: "0" }) as any;
+  const out: Record<string, (args: any) => Promise<{ content: Array<{ text: string }> }>> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, d: string, schema: any, handler: any) => { out[name] = handler; return origTool(name, d, schema, handler); };
+  const origRegister = server.registerTool.bind(server);
+  server.registerTool = (name: string, cfg: any, handler: any) => { out[name] = handler; return origRegister(name, cfg, handler); };
+  registerTools(server, undefined, NET, userId, isNode ? DAEMON_ALIAS : null, isNode, tokenId);
+  return { out, server };
+}
+async function call(handler: (args: any) => Promise<{ content: Array<{ text: string }> }>, args: any) {
+  return JSON.parse((await handler(args)).content[0]!.text);
+}
+
+function snapshot(directory = PROJECT, overrides: Record<string, unknown> = {}) {
+  return {
+    scope: { networkId: NET, daemonId: DAEMON, directory },
+    source: "opencode-v2-api",
+    state: "snapshot",
+    invocationVerified: false,
+    completeness: "unknown",
+    observedAt: "2026-10-11T00:00:00.000Z",
+    providers: [{ id: "custom", activation: "enabled" }],
+    models: [{ providerId: "custom", id: "nested/model" }],
+    defaultModel: { providerId: "custom", id: "nested/model" },
+    ...overrides,
+  };
+}
+
+describe("hub authorizes an owned OpenCode V2 catalog read", () => {
+  test("member queues, daemon reads the owned loopback, ready snapshot stays unverified", async () => {
+    seed();
+    const user = handlers(USER, false, null);
+    const queued = await call(user.out.read_opencode_catalog!, { daemon_node_id: DAEMON, node_id: V2 });
+    expect(queued).toEqual({ ok: true, status: "pending", request_id: queued.request_id });
+    expect(JSON.stringify(queued)).not.toContain("daemon_alias");
+    const strict = await (user.server as any)._registeredTools.read_opencode_catalog.inputSchema.safeParseAsync({
+      daemon_node_id: DAEMON, node_id: V2, settings: { apiKey: "sk-FAKE" }, headers: {}, body: {},
+    });
+    expect(strict.success).toBe(false);
+
+    expect(takeOpenCodeCatalogRequest(queued.request_id, "node_other")).toEqual({ ok: false, error: "catalog_request_unavailable" });
+    const daemon = handlers(USER, true, DAEMON_TOK);
+    const pulled = await call(daemon.out.get_opencode_catalog_request!, { request_id: queued.request_id });
+    expect(pulled.ok).toBe(true);
+    expect(pulled.directory).toBe(PROJECT);
+    for (const key of ["url", "authorization", "settings", "headers", "body"]) expect(pulled[key]).toBeUndefined();
+
+    let requests = 0;
+    const server = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch(req) {
+      requests++;
+      const url = new URL(req.url);
+      const row = url.pathname === "/api/provider"
+        ? [{ id: "custom", activation: "enabled", settings: { apiKey: "sk-FAKE" } }]
+        : [{ providerID: "custom", id: "nested/model", headers: { Authorization: "sk-FAKE" } }];
+      return Response.json({ location: { directory: PROJECT }, data: url.pathname === "/api/model/default" ? row[0] : row });
+    } });
+    const nodeDir = mkdtempSync(join(tmpdir(), "oc-hub-node-"));
+    try {
+      writeOpenCodeV2CatalogEndpoint(nodeDir, { url: `http://127.0.0.1:${server.port}`, authorization: "Basic fake", directory: PROJECT });
+      const read = await readOwnedOpenCodeV2Catalog({
+        networkId: NET, daemonId: DAEMON, authorizedDirectory: pulled.directory,
+        ownedProjectDirectory: PROJECT, endpoint: readOpenCodeV2CatalogEndpoint(nodeDir),
+      });
+      expect(read.ok).toBe(true);
+      if (!read.ok) return;
+      const acked = await call(daemon.out.ack_opencode_catalog!, { request_id: queued.request_id, snapshot: read.snapshot });
+      expect(acked).toEqual({ ok: true, status: "ready" });
+      const got = await call(user.out.get_opencode_catalog!, { request_id: queued.request_id });
+      expect(got.status).toBe("ready");
+      expect(got.snapshot.invocationVerified).toBe(false);
+      expect(got.snapshot.completeness).toBe("unknown");
+      expect(JSON.stringify(got.snapshot)).not.toContain("sk-FAKE");
+      expect(requests).toBe(3);
+    } finally {
+      server.stop(true);
+      rmSync(nodeDir, { recursive: true, force: true });
+    }
+  });
+
+  test("viewer may queue; outsider, node token, and non-v2 children may not", () => {
+    seed();
+    expect(queue(VIEWER, V2).ok).toBe(true);
+    expect(queue(OUTSIDER, V2, NET)).toEqual({ ok: false, error: "access_denied" });
+    expect(queue(OUTSIDER, V2, OTHER)).toEqual({ ok: false, error: "daemon_not_found" });
+    expect(queue(USER, V2, NET, true)).toEqual({ ok: false, error: "user_token_required" });
+    expect(queue(USER, V1)).toEqual({ ok: false, error: "not_opencode_v2" });
+    expect(queue(USER, UNSAFE)).toEqual({ ok: false, error: "not_opencode_v2" });
+    expect(queue(USER, "node_missing")).toEqual({ ok: false, error: "node_not_found" });
+  });
+
+  test("pending is not a snapshot; expiry, bad acks, and a missing endpoint stay closed", async () => {
+    seed();
+    const queued = queue(USER, V2);
+    expect(queued.ok).toBe(true);
+    if (!queued.ok) return;
+    expect(getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: queued.request_id })).toEqual({
+      ok: true, status: "pending", request_id: queued.request_id,
+    });
+    const pulled = takeOpenCodeCatalogRequest(queued.request_id, DAEMON);
+    expect(pulled.ok).toBe(true);
+
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot(), settings: { apiKey: "sk-FAKE" } })).toEqual({ ok: false, error: "invalid_ack" });
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot(PROJECT, { invocationVerified: true }) })).toEqual({ ok: false, error: "invalid_ack" });
+    expect(getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: queued.request_id }).status).toBe("pending");
+
+    const wrongDir = ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot("/tmp/other-project") });
+    expect(wrongDir).toEqual({ ok: true, status: "failed", error: "invalid_response" });
+    expect(getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: queued.request_id })).toMatchObject({
+      ok: false, status: "failed", error: "invalid_response",
+    });
+
+    const again = queue(USER, V2);
+    expect(again.ok).toBe(true);
+    if (!again.ok) return;
+    takeOpenCodeCatalogRequest(again.request_id, DAEMON);
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: again.request_id, error: "unavailable" })).toEqual({ ok: true, status: "failed", error: "unavailable" });
+    expect(getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: again.request_id })).toMatchObject({
+      ok: false, status: "failed", error: "unavailable",
+    });
+
+    const waiting = queue(USER, NULLDIR);
+    expect(waiting.ok).toBe(true);
+    if (!waiting.ok) return;
+    expireOpenCodeCatalogForTest(waiting.request_id);
+    expect(getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: waiting.request_id })).toMatchObject({
+      ok: false, status: "expired", error: "unavailable",
+    });
+  });
+
+  test("acks a Windows absolute directory without Hub path.resolve", () => {
+    seed();
+    db.run(`UPDATE node_create_requests SET workdir = ?1 WHERE request_id = ?2`, ["C:\\project", V2_REQ]);
+    const queued = queue(USER, V2);
+    expect(queued.ok).toBe(true);
+    if (!queued.ok) return;
+    takeOpenCodeCatalogRequest(queued.request_id, DAEMON);
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot("project") })).toEqual({ ok: false, error: "invalid_ack" });
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot("C:relative") })).toEqual({ ok: false, error: "invalid_ack" });
+    expect(getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: queued.request_id }).status).toBe("pending");
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot("C:/project") })).toEqual({ ok: true, status: "ready" });
+    const got = getOpenCodeCatalogResult({ callerUserId: USER, callerIsNode: false, networkId: NET, requestId: queued.request_id });
+    expect(got.ok).toBe(true);
+    if (!got.ok || got.status !== "ready") return;
+    expect(got.snapshot.scope.directory).toBe("C:/project");
+
+    const other = queue(USER, V2);
+    expect(other.ok).toBe(true);
+    if (!other.ok) return;
+    takeOpenCodeCatalogRequest(other.request_id, DAEMON);
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: other.request_id, snapshot: snapshot("D:\\other") })).toEqual({
+      ok: true, status: "failed", error: "invalid_response",
+    });
+  });
+
+  test("a tilde workdir matches a native absolute report, and lexical .. collapses", () => {
+    seed();
+    db.run(`UPDATE node_create_requests SET workdir = ?1 WHERE request_id = ?2`, ["~/project", V2_REQ]);
+    const queued = queue(USER, V2);
+    expect(queued.ok).toBe(true);
+    if (!queued.ok) return;
+    takeOpenCodeCatalogRequest(queued.request_id, DAEMON);
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: queued.request_id, snapshot: snapshot("/home/user/project") })).toEqual({ ok: true, status: "ready" });
+
+    db.run(`UPDATE node_create_requests SET workdir = ?1 WHERE request_id = ?2`, ["/tmp/foo/../bar", V2_REQ]);
+    const lexical = queue(USER, V2);
+    expect(lexical.ok).toBe(true);
+    if (!lexical.ok) return;
+    takeOpenCodeCatalogRequest(lexical.request_id, DAEMON);
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: lexical.request_id, snapshot: snapshot("/tmp/foo/../bar") })).toEqual({ ok: false, error: "invalid_ack" });
+    expect(ackOpenCodeCatalog(DAEMON, { request_id: lexical.request_id, snapshot: snapshot("/tmp/bar") })).toEqual({ ok: true, status: "ready" });
+  });
+});

package/src/opencode-v2-catalog.ts

@@ -0,0 +1,352 @@
+// Hub authorization for a native OpenCode V2 catalog read.
+//
+// The caller names a daemon and a child node. Identity, generation, and the
+// project directory come from Hub rows. The queued payload has no URL,
+// authorization, settings, headers, or body. The daemon reads its own
+// already-running loopback and acks a whitelist snapshot.
+//
+// `status: "pending"` means the read was authorized and stored. It does not
+// mean a daemon received the doorbell or produced a snapshot. Only
+// `status: "ready"` is a snapshot, and that snapshot stays completeness
+// unknown / invocation unverified.
+
+import { posix, win32 } from "node:path";
+import { z } from "zod/v4";
+import { db, uuidv4 } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+
+const TTL_MS = 60_000;
+const MAX_PENDING = 100;
+const SECRET = /^(sk-|gh[pousr]_|github_pat_|xox[baprs]-|AKIA|AIza|ya29\.|glpat-)/i;
+
+export const CATALOG_ERROR_CODES = [
+  "invalid_target", "unauthorized", "unavailable", "invalid_response", "scope_mismatch", "too_large",
+] as const;
+export type CatalogErrorCode = (typeof CATALOG_ERROR_CODES)[number];
+
+const identifier = z.string().min(1).max(512).refine(value => !/[\s\u0000-\u001f\u007f]/.test(value) && !SECRET.test(value));
+const CONTROL = /[\u0000-\u001f\u007f]/;
+const WINDOWS_DRIVE = /^[A-Za-z]:[\\/]/;
+
+/** Absolute in the path's own format. Hub `path.resolve` is not used: on a
+ * POSIX Hub it treats `C:\project` as a relative path under the process cwd. */
+function windowsStrictAbsolute(value: string): boolean {
+  if (!WINDOWS_DRIVE.test(value)) return false;
+  const parts = value.slice(2).split(/[\\/]/);
+  if (parts[0] !== "" || parts.length < 2) return false;
+  return parts.slice(1).every(part => part !== "" && part !== "." && part !== "..");
+}
+
+export function strictNativeAbsoluteDirectory(value: string): boolean {
+  if (value.length < 1 || value.length > 1024 || CONTROL.test(value)) return false;
+  if (WINDOWS_DRIVE.test(value)) return windowsStrictAbsolute(value);
+  if (value.startsWith("/")) return posix.resolve(value) === value;
+  return false;
+}
+
+function tildeWorkdir(value: string): boolean {
+  const trimmed = value.trim();
+  return trimmed === "~" || trimmed.startsWith("~/") || trimmed.startsWith("~\\");
+}
+
+/** Compare a stored create workdir with the directory the daemon reported.
+ * Windows keys ignore slash style and case. POSIX keys are lexical (`..` and
+ * a trailing slash collapse) and are not realpath'd — Hub does not see the
+ * daemon disk. A `~` / `~/…` workdir has no Hub-side home to expand; a
+ * native-absolute report is accepted because the daemon already refused the
+ * read unless that path is the endpoint it owns. A compromised daemon can
+ * name another absolute path for a tilde row, same as a null workdir. */
+export function catalogDirectoriesMatch(stored: string, reported: string): boolean {
+  if (!strictNativeAbsoluteDirectory(reported)) return false;
+  const storedTrim = stored.trim();
+  if (tildeWorkdir(storedTrim)) return true;
+  const storedWindows = WINDOWS_DRIVE.test(storedTrim);
+  const reportedWindows = WINDOWS_DRIVE.test(reported);
+  if (storedWindows !== reportedWindows) return false;
+  if (storedWindows) {
+    const left = win32.resolve(storedTrim);
+    const right = win32.resolve(reported);
+    return /^[A-Za-z]:\\/.test(left) && left.toLowerCase() === right.toLowerCase();
+  }
+  if (storedTrim.startsWith("/") && reported.startsWith("/")) return posix.resolve(storedTrim) === posix.resolve(reported);
+  return false;
+}
+
+const directoryText = z.string().min(1).max(1024).refine(strictNativeAbsoluteDirectory);
+
+export const opencodeCatalogSnapshotSchema = z.object({
+  scope: z.object({
+    networkId: z.string().min(1).max(200),
+    daemonId: z.string().min(1).max(200),
+    directory: directoryText,
+  }).strict(),
+  source: z.literal("opencode-v2-api"),
+  state: z.literal("snapshot"),
+  invocationVerified: z.literal(false),
+  completeness: z.literal("unknown"),
+  observedAt: z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/),
+  providers: z.array(z.object({
+    id: identifier,
+    activation: z.enum(["auto", "enabled", "disabled"]),
+  }).strict()).max(20_000),
+  models: z.array(z.object({
+    providerId: identifier,
+    id: identifier,
+  }).strict()).max(20_000),
+  defaultModel: z.object({ providerId: identifier, id: identifier }).strict().nullable(),
+}).strict();
+
+export type OpenCodeCatalogSnapshotWire = z.infer<typeof opencodeCatalogSnapshotSchema>;
+
+export const opencodeCatalogAckSchema = z.object({
+  request_id: z.string().min(1).max(200),
+  error: z.enum(CATALOG_ERROR_CODES).optional(),
+  snapshot: opencodeCatalogSnapshotSchema.optional(),
+}).strict();
+
+interface PendingCatalogRead {
+  requestId: string;
+  daemonNodeId: string;
+  daemonAlias: string;
+  networkId: string;
+  nodeId: string;
+  alias: string;
+  directory: string | null;
+  expiresAt: number;
+  taken: boolean;
+}
+
+export interface StoredCatalogRead {
+  requestId: string;
+  networkId: string;
+  daemonNodeId: string;
+  nodeId: string;
+  status: "pending" | "ready" | "failed" | "expired";
+  error?: CatalogErrorCode;
+  snapshot?: OpenCodeCatalogSnapshotWire;
+  expiresAt: number;
+}
+
+const pending = new Map<string, PendingCatalogRead>();
+const stored = new Map<string, StoredCatalogRead>();
+
+export function resetOpenCodeCatalogForTest(): void {
+  pending.clear();
+  stored.clear();
+}
+
+export function expireOpenCodeCatalogForTest(requestId: string): void {
+  // Just past the read deadline, still inside the retention window. Setting
+  // the deadline to 0 would also drop the stored row and look like not_found.
+  const expiredAt = Date.now() - 1;
+  const row = pending.get(requestId);
+  if (row) row.expiresAt = expiredAt;
+  const result = stored.get(requestId);
+  if (result) result.expiresAt = expiredAt;
+}
+
+function childNodeId(requestId: string): string | null {
+  return requestId.startsWith("cr_") ? `node_${requestId.slice(3)}` : null;
+}
+
+function supervisorRole(snapshot: string | null): boolean {
+  if (!snapshot) return false;
+  try {
+    const parsed = JSON.parse(snapshot) as { role?: unknown };
+    return parsed.role === "host_supervisor";
+  } catch {
+    return false;
+  }
+}
+
+function v2Flags(flagsJson: string): boolean {
+  try {
+    const flags = JSON.parse(flagsJson) as { opencodeGeneration?: unknown; opencodeUnsafeTools?: unknown };
+    return flags.opencodeGeneration === "v2" && flags.opencodeUnsafeTools === true;
+  } catch {
+    return false;
+  }
+}
+
+export interface QueueCatalogInput {
+  callerUserId: string | null;
+  callerIsNode: boolean;
+  networkId: string | null;
+  daemonNodeId: string;
+  nodeId: string;
+}
+
+function evictExpired(now = Date.now()): void {
+  for (const [id, row] of pending) {
+    if (now > row.expiresAt) pending.delete(id);
+  }
+  for (const [id, row] of stored) {
+    if (row.status === "pending" && now > row.expiresAt) row.status = "expired";
+    if (now > row.expiresAt + TTL_MS) stored.delete(id);
+  }
+}
+
+export function queueOpenCodeCatalogRead(input: QueueCatalogInput):
+  | { ok: true; request_id: string; status: "pending"; daemon_alias: string; network_id: string }
+  | { ok: false; error: string } {
+  evictExpired();
+  if (input.callerIsNode) return { ok: false, error: "user_token_required" };
+  if (!input.callerUserId) return { ok: false, error: "auth_required" };
+  if (!input.networkId) return { ok: false, error: "network_id_required" };
+  const role = getUserNetworkRole(input.callerUserId, input.networkId);
+  if (!role) return { ok: false, error: "access_denied" };
+  if (pending.size >= MAX_PENDING) return { ok: false, error: "catalog_busy" };
+
+  const daemon = db.get<{ node_id: string; alias: string; config_snapshot: string | null }>(
+    `SELECT node_id, alias, config_snapshot FROM nodes WHERE node_id = ?1 AND network_id = ?2`,
+    input.daemonNodeId, input.networkId,
+  );
+  if (!daemon) return { ok: false, error: "daemon_not_found" };
+  if (!supervisorRole(daemon.config_snapshot)) return { ok: false, error: "daemon_not_supervisor" };
+
+  const child = db.get<{ node_id: string }>(
+    `SELECT node_id FROM nodes WHERE node_id = ?1 AND network_id = ?2`,
+    input.nodeId, input.networkId,
+  );
+  if (!child) return { ok: false, error: "node_not_found" };
+
+  const creates = db.all<{
+    request_id: string; daemon_node_id: string; child_name: string; runtime: string;
+    flags_json: string; workdir: string | null; status: string;
+  }>(
+    `SELECT request_id, daemon_node_id, child_name, runtime, flags_json, workdir, status
+       FROM node_create_requests
+      WHERE network_id = ?1 AND daemon_node_id = ?2 AND status IN ('succeeded', 'delivered')`,
+    input.networkId, input.daemonNodeId,
+  );
+  const owned = creates.filter(row => childNodeId(row.request_id) === input.nodeId && row.daemon_node_id === input.daemonNodeId);
+  if (owned.length !== 1) return { ok: false, error: "node_not_found" };
+  const row = owned[0]!;
+  if (row.runtime !== "opencode-cli" || !v2Flags(row.flags_json)) return { ok: false, error: "not_opencode_v2" };
+
+  const requestId = `cat_${uuidv4()}`;
+  const directory = typeof row.workdir === "string" && row.workdir.length > 0 ? row.workdir : null;
+  const record: PendingCatalogRead = {
+    requestId,
+    daemonNodeId: daemon.node_id,
+    daemonAlias: daemon.alias,
+    networkId: input.networkId,
+    nodeId: input.nodeId,
+    alias: row.child_name,
+    directory,
+    expiresAt: Date.now() + TTL_MS,
+    taken: false,
+  };
+  pending.set(requestId, record);
+  stored.set(requestId, {
+    requestId,
+    networkId: input.networkId,
+    daemonNodeId: daemon.node_id,
+    nodeId: input.nodeId,
+    status: "pending",
+    expiresAt: record.expiresAt,
+  });
+  return { ok: true, request_id: requestId, status: "pending", daemon_alias: daemon.alias, network_id: input.networkId };
+}
+
+export function takeOpenCodeCatalogRequest(requestId: string, daemonNodeId: string):
+  | { ok: true; request_id: string; node_id: string; alias: string; directory: string | null; scope: { networkId: string; daemonId: string } }
+  | { ok: false; error: "catalog_request_unavailable" } {
+  const row = pending.get(requestId);
+  if (!row || row.daemonNodeId !== daemonNodeId || row.taken) return { ok: false, error: "catalog_request_unavailable" };
+  if (Date.now() > row.expiresAt) {
+    row.taken = true;
+    const result = stored.get(requestId);
+    if (result && result.status === "pending") result.status = "expired";
+    return { ok: false, error: "catalog_request_unavailable" };
+  }
+  row.taken = true;
+  return {
+    ok: true,
+    request_id: row.requestId,
+    node_id: row.nodeId,
+    alias: row.alias,
+    directory: row.directory,
+    scope: { networkId: row.networkId, daemonId: row.daemonNodeId },
+  };
+}
+
+function consistent(snapshot: OpenCodeCatalogSnapshotWire): boolean {
+  const providers = new Set<string>();
+  for (const row of snapshot.providers) {
+    if (providers.has(row.id)) return false;
+    providers.add(row.id);
+  }
+  const models = new Set<string>();
+  for (const row of snapshot.models) {
+    if (!providers.has(row.providerId)) return false;
+    const key = JSON.stringify([row.providerId, row.id]);
+    if (models.has(key)) return false;
+    models.add(key);
+  }
+  if (snapshot.defaultModel && !models.has(JSON.stringify([snapshot.defaultModel.providerId, snapshot.defaultModel.id]))) return false;
+  return Buffer.byteLength(JSON.stringify(snapshot), "utf8") <= 2 * 1024 * 1024;
+}
+
+export function ackOpenCodeCatalog(daemonNodeId: string, body: unknown):
+  | { ok: true; status: "ready" | "failed"; error?: CatalogErrorCode }
+  | { ok: false; error: "catalog_request_unavailable" | "invalid_ack" } {
+  const parsed = opencodeCatalogAckSchema.safeParse(body);
+  if (!parsed.success) return { ok: false, error: "invalid_ack" };
+  const ack = parsed.data;
+  const hasSnapshot = ack.snapshot !== undefined;
+  const hasError = ack.error !== undefined;
+  if (hasSnapshot === hasError) return { ok: false, error: "invalid_ack" };
+  const row = pending.get(ack.request_id);
+  const result = stored.get(ack.request_id);
+  if (!row || !result || row.daemonNodeId !== daemonNodeId || !row.taken) {
+    return { ok: false, error: "catalog_request_unavailable" };
+  }
+  if (Date.now() > row.expiresAt || result.status !== "pending") {
+    if (result.status === "pending") result.status = "expired";
+    return { ok: false, error: "catalog_request_unavailable" };
+  }
+  if (ack.error) {
+    result.status = "failed";
+    result.error = ack.error;
+    return { ok: true, status: "failed", error: ack.error };
+  }
+  const snapshot = ack.snapshot!;
+  // A stored workdir must match. A null workdir (legacy create) has no
+  // hub-side path to compare; the daemon binds that read to the project
+  // directory it already owns. Hub does not see that filesystem.
+  const directoryOk = row.directory ? catalogDirectoriesMatch(row.directory, snapshot.scope.directory) : true;
+  if (snapshot.scope.networkId !== row.networkId || snapshot.scope.daemonId !== row.daemonNodeId || !directoryOk || !consistent(snapshot)) {
+    result.status = "failed";
+    result.error = "invalid_response";
+    return { ok: true, status: "failed", error: "invalid_response" };
+  }
+  result.status = "ready";
+  result.snapshot = snapshot;
+  return { ok: true, status: "ready" };
+}
+
+export function getOpenCodeCatalogResult(input: {
+  callerUserId: string | null;
+  callerIsNode: boolean;
+  networkId: string | null;
+  requestId: string;
+}):
+  | { ok: true; status: "pending"; request_id: string }
+  | { ok: true; status: "ready"; request_id: string; snapshot: OpenCodeCatalogSnapshotWire }
+  | { ok: false; status?: "failed" | "expired"; error: string; request_id?: string } {
+  if (input.callerIsNode) return { ok: false, error: "user_token_required" };
+  if (!input.callerUserId) return { ok: false, error: "auth_required" };
+  if (!input.networkId) return { ok: false, error: "network_id_required" };
+  if (!getUserNetworkRole(input.callerUserId, input.networkId)) return { ok: false, error: "access_denied" };
+  evictExpired();
+  const result = stored.get(input.requestId);
+  if (!result || result.networkId !== input.networkId) return { ok: false, error: "not_found" };
+  if (result.status === "pending" && Date.now() > result.expiresAt) result.status = "expired";
+  if (result.status === "pending") return { ok: true, status: "pending", request_id: result.requestId };
+  if (result.status === "ready" && result.snapshot) {
+    return { ok: true, status: "ready", request_id: result.requestId, snapshot: result.snapshot };
+  }
+  if (result.status === "expired") return { ok: false, status: "expired", error: "unavailable", request_id: result.requestId };
+  return { ok: false, status: "failed", error: result.error || "unavailable", request_id: result.requestId };
+}

package/src/shared/codex-inventory.ts

@@ -4,12 +4,19 @@ export function validCodexInventory(v: any): boolean {
     && Object.keys(o).every(k => allowed.includes(k));
   const id = (s: any) => typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(s);
   const nullable = (s: any) => s === null || id(s);
-  if (!fields(v, ['observed_at', 'scope', 'rows', 'installation']) || !Number.isSafeInteger(v.observed_at) || v.observed_at <= 0
+  if (!fields(v, ['observed_at', 'scope', 'rows', 'installation', 'local_discovery']) || !Number.isSafeInteger(v.observed_at) || v.observed_at <= 0
     || v.scope !== 'hub_bound_nodes' || !Array.isArray(v.rows) || v.rows.length > 200
     || new Set(v.rows.map((r: any) => r?.node_id)).size !== v.rows.length) return false;
   if (v.installation !== undefined && (!fields(v.installation, ['status', 'version'])
     || !['found', 'missing', 'unknown'].includes(v.installation.status)
     || !(v.installation.version === null || (typeof v.installation.version === 'string' && /^\d+\.\d+\.\d+(?:[-+.][0-9A-Za-z.-]+)?$/.test(v.installation.version) && v.installation.version.length <= 64)))) return false;
+  if (v.local_discovery !== undefined) {
+    const local = v.local_discovery;
+    if (!fields(local, ['status', 'rows']) || !['observed', 'unavailable', 'limit'].includes(local.status)
+      || !Array.isArray(local.rows) || (local.status !== 'observed' && local.rows.length !== 0)
+      || !validCodexInventory({ observed_at: v.observed_at, scope: v.scope, rows: local.rows })
+      || local.rows.some((r: any) => r.status !== 'observed' || r.config_revision !== null || v.rows.some((b: any) => b.node_id === r.node_id))) return false;
+  }
   for (const r of v.rows) {
     if (!r || !id(r.node_id) || typeof r.alias !== 'string' || !/^[\p{L}\p{N}][\p{L}\p{N}_.-]{0,99}$/u.test(r.alias)) return false;
     if (['unavailable', 'not_codex'].includes(r.status)) {

package/src/stop-delete-node.test.ts

@@ -419,6 +419,46 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect(JSON.parse(audits[0].detail).backup_path).toBe("/home/u/.anet/deleted/1719647200000-sd-child-a");
   });
 
+  // Daemon-mediated delete used to drop only the nodes row. The child's sessions
+  // row stayed behind as "offline", so /api/status — and every client list built
+  // on it — kept showing the deleted node forever (desktop: the node stays put
+  // under 「删除请求已提交」). REST DELETE /api/nodes/:id already drops both.
+  test("daemon ack 'stopped' on delete branch → the child's session row is gone too", async () => {
+    setupAlphaNetwork();
+    db.run(
+      "INSERT INTO sessions (resume_id, alias, node_id, network_id, status) VALUES (?1, ?2, ?3, ?4, 'idle')",
+      ["resume-sd-child-a", CHILD_A_ALIAS, CHILD_A_ID, NET_A],
+    );
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    const left = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM sessions WHERE node_id = ?1", CHILD_A_ID);
+    expect(Number(left?.n ?? 0)).toBe(0);
+  });
+
+  test("delete finalize drops the session by node_id, sparing a same-alias rebuilt node", async () => {
+    setupAlphaNetwork();
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    // Before the ack lands, a new node takes the same alias and registers.
+    const REBUILT_ID = "node_sd_child_a_rebuilt";
+    db.run(
+      "INSERT INTO sessions (resume_id, alias, node_id, network_id, status) VALUES (?1, ?2, ?3, ?4, 'idle')",
+      ["resume-sd-child-a-rebuilt", CHILD_A_ALIAS, REBUILT_ID, NET_A],
+    );
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    const rebuilt = db.get<{ status: string }>("SELECT status FROM sessions WHERE node_id = ?1", REBUILT_ID);
+    expect(rebuilt?.status).toBe("idle");
+  });
+
   // #1448 finding-4 — stop/delete 必须校验 daemon 是 child 的权威创建者(镜像 start)。
   // 改前只校验 daemon 存在+同网 → 同网调用方传错 daemon_node_id,门铃路由到错 daemon。
   // f3 合入后错 daemon 会 sweep 空 + ack stopped → hub 假收敛 stopped 而 child 仍在跑。

package/src/tool-audience-http.test.ts

@@ -202,15 +202,12 @@ describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // node 61 / 62,433 B → 62,946 B (+513); user 58 / 57,228 B unchanged
   // (report_status is not on the user list). Budget only this measured addition
   // (~154/509 B node/all margin).
-  // #906 registers daemon_provider_snapshot (user) plus pull/ack (protocol).
-  // Measured there: all 90 / 80,307 B; node 61 / 62,556 B; user 59 / 57,372 B,
-  // ceilings 80,800 / 63,100 / 57,500.
-  // Hub #938 adds clone_node (audience both, so it lands on the node list and
-  // the user list) plus optional expect_clone on get_create_request (protocol,
-  // so only the full list). Measured on this combined tree:
-  // all 91 / 81,228 B; node 62 / 63,281 B; user 60 / 58,169 B.
-  // Ceilings keep about 400 B of margin and nothing else.
-  const CEILINGS = { node: 63_700, user: 58_600, all: 81_700 } as const;
+  // #906 plus Hub #938 clone_node (all 91 / 81,228 B; node 62 / 63,281 B;
+  // user 60 / 58,169 B). OpenCode V2 catalog adds 2 user tools and 2 protocol
+  // tools. Measured on this combined tree: all 95 / 85,069 B; node 62 / 63,281 B
+  // unchanged (protocol tools stay off the node list); user 62 / 59,409 B.
+  // Ceilings keep about 400 B and nothing else.
+  const CEILINGS = { node: 63_700, user: 59_810, all: 85_500 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -41,8 +41,10 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   get_stop_request: "protocol", ack_stop_request: "protocol",
   get_start_request: "protocol", ack_start_request: "protocol",
   get_probe_request: "protocol", ack_probe_request: "protocol",
+  get_opencode_catalog_request: "protocol", ack_opencode_catalog: "protocol",
   // ── 人:节点令牌一律 user_token_required(项目管理)/ node_token_cannot_browse_files / node_token_cannot_read_logs ──
   projects_create: "user", projects_update: "user",
+  read_opencode_catalog: "user", get_opencode_catalog: "user",
   list_node_files: "user", read_node_file: "user", tail_node_logs: "user",
   // ── 两边都能调 ──
   submit_skill: "both", list_skills: "both", get_skill: "both", review_skill: "both",

package/src/tools.ts

@@ -73,6 +73,13 @@ import {
   startPendingProbeGcTimer,
   startProbeSweeperTimer,
 } from "./probe.js";
+import {
+  ackOpenCodeCatalog,
+  getOpenCodeCatalogResult,
+  opencodeCatalogAckSchema,
+  queueOpenCodeCatalogRead,
+  takeOpenCodeCatalogRequest,
+} from "./opencode-v2-catalog.js";
 import { canonicalAliasExists, cleanupRenamedAliasSession, resolveCanonicalAlias } from "./rename.js";
 import {
   ALLOWED_FLAGS,
@@ -4122,10 +4129,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
   server.tool(
     "daemon_provider_snapshot", "Admin Provider: refresh/put/apply/login use daemon id; read uses request id. put: revision+provider; apply: revision+node selection; login: provider={action:start|read|cancel|save|accounts,session_id?,label?}. No login tokens.",
-    { action: z.enum(["refresh", "read", "put", "apply", "login"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional() },
-    async ({ action, id, network_id, revision, provider }) => {
+    { action: z.enum(["refresh", "read", "put", "apply", "login"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
+    async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);
-      if (action === "read") return providerReply(getProviderSnapshot(human, id));
+      if (action === "read") return providerReply(getProviderSnapshot(human, id, include_discovery));
       const daemon_node_id = id;
       const result = action === 'login' ? requestProviderLogin(human, daemon_node_id, provider)
         : action === 'apply' ? requestProviderApplication(human, daemon_node_id, revision!, provider)
@@ -4138,8 +4145,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
   server.tool(
-    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional() },
-    async ({ accept_writes, accept_applications, accept_logins }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications, accept_logins)),
+    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional() },
+    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications, accept_logins, accept_local_discovery)),
   );
   server.tool(
     "ack_daemon_provider_snapshot", "Target daemon acknowledges redacted Provider configuration readback; fixed failure code only.",
@@ -5581,6 +5588,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
               );
             }
             db.run(`DELETE FROM nodes WHERE node_id = ?1`, [row.child_node_id]);
+            // Same as REST DELETE /api/nodes/:id: without this the sessions row
+            // stays "offline" and /api/status lists the deleted node forever.
+            // By node_id, not alias — a same-alias rebuild keeps its session.
+            db.run(`DELETE FROM sessions WHERE node_id = ?1`, [row.child_node_id]);
             clearNodeFromAgentTeams(row.child_node_id); // #764
             auditCreateNodeStrict({
               action: "delete_node_completed",
@@ -5606,7 +5617,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // 🔴 关键的是最后那半句「据此做了什么」。#1286 里 hub 的代码路径经核对是
       // 正确的,缺的正是「它到底走没走那条分支」—— 只说「收到了 ack」回答不了。
       const did = status === "stopped" && row.action === "delete"
-        ? "revoked ntok + DELETE FROM nodes"
+        ? "revoked ntok + DELETE FROM nodes + sessions"
         : status === "stopped" && row.action === "stop"
         ? "lifecycle_state=stopped"
         : status === "stop_failed"
@@ -6380,6 +6391,80 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // OpenCode V2 catalog. Human tokens queue; the owning daemon pulls scope
+  // only and acks a whitelist snapshot. pending is stored authorization, not
+  // a snapshot and not proof the doorbell was received.
+  server.registerTool(
+    "read_opencode_catalog",
+    {
+      description: "Queue a native OpenCode V2 catalog read for one owned child. ok with status pending means authorized and stored in memory, not a snapshot and not proof a daemon received the doorbell. Does not start a server. url, authorization, directory, settings, headers, and body are rejected.",
+      inputSchema: z.object({
+        daemon_node_id: z.string().min(1).max(200),
+        node_id: z.string().min(1).max(200),
+        network_id: z.string().max(200).optional(),
+      }).strict() as any,
+    },
+    async (args: { daemon_node_id: string; node_id: string; network_id?: string }) => {
+      const networkId = getNetworkId(args.network_id);
+      const queued = queueOpenCodeCatalogRead({
+        callerUserId: enforceUserId ?? null,
+        callerIsNode: callerTokenIsNetwork,
+        networkId,
+        daemonNodeId: args.daemon_node_id,
+        nodeId: args.node_id,
+      });
+      if (!queued.ok) return { content: [{ type: "text" as const, text: JSON.stringify(queued) }] };
+      pushEvent(queued.daemon_alias, { type: "opencode_catalog", request_id: queued.request_id }, queued.network_id);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status: "pending", request_id: queued.request_id }) }] };
+    },
+  );
+
+  server.registerTool(
+    "get_opencode_catalog",
+    {
+      description: "Poll one queued OpenCode V2 catalog read. status pending is not a snapshot. Only status ready returns a whitelist snapshot, still completeness unknown and invocationVerified false.",
+      inputSchema: z.object({
+        request_id: z.string().min(1).max(200),
+        network_id: z.string().max(200).optional(),
+      }).strict() as any,
+    },
+    async (args: { request_id: string; network_id?: string }) => {
+      const result = getOpenCodeCatalogResult({
+        callerUserId: enforceUserId ?? null,
+        callerIsNode: callerTokenIsNetwork,
+        networkId: getNetworkId(args.network_id),
+        requestId: args.request_id,
+      });
+      return { content: [{ type: "text" as const, text: JSON.stringify(result) }] };
+    },
+  );
+
+  server.registerTool(
+    "get_opencode_catalog_request",
+    {
+      description: "Daemon pulls one authorized OpenCode V2 catalog read. Scope only: no URL, authorization, settings, headers, or body.",
+      inputSchema: z.object({ request_id: z.string().min(1).max(200) }).strict() as any,
+    },
+    async (args: { request_id: string }) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify(takeOpenCodeCatalogRequest(args.request_id, callerDaemon.daemonNodeId)) }] };
+    },
+  );
+
+  server.registerTool(
+    "ack_opencode_catalog",
+    {
+      description: "Daemon stores a whitelist OpenCode V2 catalog snapshot or a closed error code. Extra fields are rejected. A stored failure is status failed, not a transport error.",
+      inputSchema: opencodeCatalogAckSchema as any,
+    },
+    async (args: unknown) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify(ackOpenCodeCatalog(callerDaemon.daemonNodeId, args)) }] };
+    },
+  );
+
   // ── 需求池 / 任务看板(Agent 读写任务,例如把 GitHub issue 同步成任务) ──
   // 全部走 REST 同一个处理函数(requirements.ts handleRequirementsRequest):权限、校验、谁做的记录只有一份。
   // 节点令牌只在它绑定的网络里读 / 建 / 改 / 勾子任务 / upsert / 读项目;删除和管理项目只给人。