@sleep2agi/commhub-server 0.9.0-preview.122 → 0.9.0-preview.124

package/src/stop-delete-node.test.ts

@@ -419,6 +419,46 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect(JSON.parse(audits[0].detail).backup_path).toBe("/home/u/.anet/deleted/1719647200000-sd-child-a");
   });
 
+  // Daemon-mediated delete used to drop only the nodes row. The child's sessions
+  // row stayed behind as "offline", so /api/status — and every client list built
+  // on it — kept showing the deleted node forever (desktop: the node stays put
+  // under 「删除请求已提交」). REST DELETE /api/nodes/:id already drops both.
+  test("daemon ack 'stopped' on delete branch → the child's session row is gone too", async () => {
+    setupAlphaNetwork();
+    db.run(
+      "INSERT INTO sessions (resume_id, alias, node_id, network_id, status) VALUES (?1, ?2, ?3, ?4, 'idle')",
+      ["resume-sd-child-a", CHILD_A_ALIAS, CHILD_A_ID, NET_A],
+    );
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    const left = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM sessions WHERE node_id = ?1", CHILD_A_ID);
+    expect(Number(left?.n ?? 0)).toBe(0);
+  });
+
+  test("delete finalize drops the session by node_id, sparing a same-alias rebuilt node", async () => {
+    setupAlphaNetwork();
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    // Before the ack lands, a new node takes the same alias and registers.
+    const REBUILT_ID = "node_sd_child_a_rebuilt";
+    db.run(
+      "INSERT INTO sessions (resume_id, alias, node_id, network_id, status) VALUES (?1, ?2, ?3, ?4, 'idle')",
+      ["resume-sd-child-a-rebuilt", CHILD_A_ALIAS, REBUILT_ID, NET_A],
+    );
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    const rebuilt = db.get<{ status: string }>("SELECT status FROM sessions WHERE node_id = ?1", REBUILT_ID);
+    expect(rebuilt?.status).toBe("idle");
+  });
+
   // #1448 finding-4 — stop/delete 必须校验 daemon 是 child 的权威创建者(镜像 start)。
   // 改前只校验 daemon 存在+同网 → 同网调用方传错 daemon_node_id,门铃路由到错 daemon。
   // f3 合入后错 daemon 会 sweep 空 + ack stopped → hub 假收敛 stopped 而 child 仍在跑。

package/src/tool-audience-http.test.ts

@@ -202,15 +202,12 @@ describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // node 61 / 62,433 B → 62,946 B (+513); user 58 / 57,228 B unchanged
   // (report_status is not on the user list). Budget only this measured addition
   // (~154/509 B node/all margin).
-  // #906 registers daemon_provider_snapshot (user) plus pull/ack (protocol).
-  // Measured there: all 90 / 80,307 B; node 61 / 62,556 B; user 59 / 57,372 B,
-  // ceilings 80,800 / 63,100 / 57,500.
-  // Hub #938 adds clone_node (audience both, so it lands on the node list and
-  // the user list) plus optional expect_clone on get_create_request (protocol,
-  // so only the full list). Measured on this combined tree:
-  // all 91 / 81,228 B; node 62 / 63,281 B; user 60 / 58,169 B.
-  // Ceilings keep about 400 B of margin and nothing else.
-  const CEILINGS = { node: 63_700, user: 58_600, all: 81_700 } as const;
+  // #906 plus Hub #938 clone_node (all 91 / 81,228 B; node 62 / 63,281 B;
+  // user 60 / 58,169 B). OpenCode V2 catalog adds 2 user tools and 2 protocol
+  // tools. Measured on this combined tree: all 95 / 85,069 B; node 62 / 63,281 B
+  // unchanged (protocol tools stay off the node list); user 62 / 59,409 B.
+  // Ceilings keep about 400 B and nothing else.
+  const CEILINGS = { node: 63_700, user: 59_810, all: 85_500 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -41,8 +41,10 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   get_stop_request: "protocol", ack_stop_request: "protocol",
   get_start_request: "protocol", ack_start_request: "protocol",
   get_probe_request: "protocol", ack_probe_request: "protocol",
+  get_opencode_catalog_request: "protocol", ack_opencode_catalog: "protocol",
   // ── 人:节点令牌一律 user_token_required(项目管理)/ node_token_cannot_browse_files / node_token_cannot_read_logs ──
   projects_create: "user", projects_update: "user",
+  read_opencode_catalog: "user", get_opencode_catalog: "user",
   list_node_files: "user", read_node_file: "user", tail_node_logs: "user",
   // ── 两边都能调 ──
   submit_skill: "both", list_skills: "both", get_skill: "both", review_skill: "both",

package/src/tools.ts

@@ -1,5 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { requestProviderSnapshot, requestProviderWrite, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
+import { requestProviderSnapshot, requestProviderWrite, requestProviderCollection, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
+import { readHubProviders, putHubProvider, bindHubProvider } from './hub-provider-config.js';
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { adoptionCandidatesReportSchema } from "./adoption-candidates.js";
@@ -73,6 +74,13 @@ import {
   startPendingProbeGcTimer,
   startProbeSweeperTimer,
 } from "./probe.js";
+import {
+  ackOpenCodeCatalog,
+  getOpenCodeCatalogResult,
+  opencodeCatalogAckSchema,
+  queueOpenCodeCatalogRead,
+  takeOpenCodeCatalogRequest,
+} from "./opencode-v2-catalog.js";
 import { canonicalAliasExists, cleanupRenamedAliasSession, resolveCanonicalAlias } from "./rename.js";
 import {
   ALLOWED_FLAGS,
@@ -4121,13 +4129,25 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const providerHuman = (net?: string) => ({ userId: enforceUserId, isNode: callerTokenIsNetwork, networkId: getNetworkId(net) });
   const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
   server.tool(
-    "daemon_provider_snapshot", "Admin Provider: refresh/put/apply/login use daemon id; read uses request id. put: revision+provider; apply: revision+node selection; login: provider={action:start|read|cancel|save|accounts,session_id?,label?}. No login tokens.",
-    { action: z.enum(["refresh", "read", "put", "apply", "login"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional() },
-    async ({ action, id, network_id, revision, provider }) => {
+    "daemon_provider_snapshot", "Provider: daemon refresh/put/collect/apply/login; read=request id. login provider={action:start|read|cancel|save|accounts,session_id?,label?}. hub_read=catalog; hub_put=owner config; hub_bind=id+revision,provider={daemon_node_id,daemon_revision,confirm:true}. No login tokens.",
+    { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
+    async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);
-      if (action === "read") return providerReply(getProviderSnapshot(human, id));
+      if (action === 'hub_read') return providerReply(readHubProviders(human));
+      if (action === 'hub_put') return providerReply(putHubProvider(human, revision!, provider));
+      if (action === 'hub_bind') {
+        const selection = provider as { daemon_node_id?: string; daemon_revision?: number; confirm?: boolean } | undefined;
+        const result = bindHubProvider(human, { id, revision: revision!, daemon_node_id: selection?.daemon_node_id!, daemon_revision: selection?.daemon_revision!, confirm: selection?.confirm! });
+        if (result.ok && 'request_id' in result) {
+          const target = db.get<{ alias: string }>('SELECT alias FROM nodes WHERE node_id=?1 AND network_id=?2', selection?.daemon_node_id!, human.networkId!);
+          if (target) pushEvent(target.alias, { type: 'daemon_provider_snapshot', request_id: result.request_id }, human.networkId!);
+        }
+        return providerReply(result);
+      }
+      if (action === "read") return providerReply(getProviderSnapshot(human, id, include_discovery));
       const daemon_node_id = id;
       const result = action === 'login' ? requestProviderLogin(human, daemon_node_id, provider)
+        : action === 'collect' ? requestProviderCollection(human, daemon_node_id, revision!, provider)
         : action === 'apply' ? requestProviderApplication(human, daemon_node_id, revision!, provider)
         : action === 'put' ? requestProviderWrite(human, daemon_node_id, revision!, provider) : requestProviderSnapshot(human, daemon_node_id);
       if (result.ok) {
@@ -4138,8 +4158,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
   server.tool(
-    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional() },
-    async ({ accept_writes, accept_applications, accept_logins }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications, accept_logins)),
+    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/collect/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional(), accept_collections: z.boolean().optional() },
+    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections)),
   );
   server.tool(
     "ack_daemon_provider_snapshot", "Target daemon acknowledges redacted Provider configuration readback; fixed failure code only.",
@@ -5581,6 +5601,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
               );
             }
             db.run(`DELETE FROM nodes WHERE node_id = ?1`, [row.child_node_id]);
+            // Same as REST DELETE /api/nodes/:id: without this the sessions row
+            // stays "offline" and /api/status lists the deleted node forever.
+            // By node_id, not alias — a same-alias rebuild keeps its session.
+            db.run(`DELETE FROM sessions WHERE node_id = ?1`, [row.child_node_id]);
             clearNodeFromAgentTeams(row.child_node_id); // #764
             auditCreateNodeStrict({
               action: "delete_node_completed",
@@ -5606,7 +5630,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // 🔴 关键的是最后那半句「据此做了什么」。#1286 里 hub 的代码路径经核对是
       // 正确的,缺的正是「它到底走没走那条分支」—— 只说「收到了 ack」回答不了。
       const did = status === "stopped" && row.action === "delete"
-        ? "revoked ntok + DELETE FROM nodes"
+        ? "revoked ntok + DELETE FROM nodes + sessions"
         : status === "stopped" && row.action === "stop"
         ? "lifecycle_state=stopped"
         : status === "stop_failed"
@@ -6380,6 +6404,80 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // OpenCode V2 catalog. Human tokens queue; the owning daemon pulls scope
+  // only and acks a whitelist snapshot. pending is stored authorization, not
+  // a snapshot and not proof the doorbell was received.
+  server.registerTool(
+    "read_opencode_catalog",
+    {
+      description: "Queue a native OpenCode V2 catalog read for one owned child. ok with status pending means authorized and stored in memory, not a snapshot and not proof a daemon received the doorbell. Does not start a server. url, authorization, directory, settings, headers, and body are rejected.",
+      inputSchema: z.object({
+        daemon_node_id: z.string().min(1).max(200),
+        node_id: z.string().min(1).max(200),
+        network_id: z.string().max(200).optional(),
+      }).strict() as any,
+    },
+    async (args: { daemon_node_id: string; node_id: string; network_id?: string }) => {
+      const networkId = getNetworkId(args.network_id);
+      const queued = queueOpenCodeCatalogRead({
+        callerUserId: enforceUserId ?? null,
+        callerIsNode: callerTokenIsNetwork,
+        networkId,
+        daemonNodeId: args.daemon_node_id,
+        nodeId: args.node_id,
+      });
+      if (!queued.ok) return { content: [{ type: "text" as const, text: JSON.stringify(queued) }] };
+      pushEvent(queued.daemon_alias, { type: "opencode_catalog", request_id: queued.request_id }, queued.network_id);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status: "pending", request_id: queued.request_id }) }] };
+    },
+  );
+
+  server.registerTool(
+    "get_opencode_catalog",
+    {
+      description: "Poll one queued OpenCode V2 catalog read. status pending is not a snapshot. Only status ready returns a whitelist snapshot, still completeness unknown and invocationVerified false.",
+      inputSchema: z.object({
+        request_id: z.string().min(1).max(200),
+        network_id: z.string().max(200).optional(),
+      }).strict() as any,
+    },
+    async (args: { request_id: string; network_id?: string }) => {
+      const result = getOpenCodeCatalogResult({
+        callerUserId: enforceUserId ?? null,
+        callerIsNode: callerTokenIsNetwork,
+        networkId: getNetworkId(args.network_id),
+        requestId: args.request_id,
+      });
+      return { content: [{ type: "text" as const, text: JSON.stringify(result) }] };
+    },
+  );
+
+  server.registerTool(
+    "get_opencode_catalog_request",
+    {
+      description: "Daemon pulls one authorized OpenCode V2 catalog read. Scope only: no URL, authorization, settings, headers, or body.",
+      inputSchema: z.object({ request_id: z.string().min(1).max(200) }).strict() as any,
+    },
+    async (args: { request_id: string }) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify(takeOpenCodeCatalogRequest(args.request_id, callerDaemon.daemonNodeId)) }] };
+    },
+  );
+
+  server.registerTool(
+    "ack_opencode_catalog",
+    {
+      description: "Daemon stores a whitelist OpenCode V2 catalog snapshot or a closed error code. Extra fields are rejected. A stored failure is status failed, not a transport error.",
+      inputSchema: opencodeCatalogAckSchema as any,
+    },
+    async (args: unknown) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify(ackOpenCodeCatalog(callerDaemon.daemonNodeId, args)) }] };
+    },
+  );
+
   // ── 需求池 / 任务看板(Agent 读写任务,例如把 GitHub issue 同步成任务) ──
   // 全部走 REST 同一个处理函数(requirements.ts handleRequirementsRequest):权限、校验、谁做的记录只有一份。
   // 节点令牌只在它绑定的网络里读 / 建 / 改 / 勾子任务 / upsert / 读项目;删除和管理项目只给人。