@sleep2agi/commhub-server 0.9.0-preview.124 → 0.9.0-preview.125

package/bin/commhub.ts

@@ -119,6 +119,13 @@ for (let i = 0; i < args.length; i++) {
     console.log(HELP);
     process.exit(0);
   } else if (arg === "--version" || arg === "-v") {
+    // Set by bin/anet-bin.ts before this file is imported. A compiled binary
+    // has no package.json beside import.meta.url (/$bunfs). npm leaves it unset.
+    const embedded = process.env.ANET_EMBEDDED_COMMHUB_VERSION?.trim() ?? "";
+    if (/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(embedded)) {
+      console.log(embedded);
+      process.exit(0);
+    }
     const pkg = (await import("../package.json", { with: { type: "json" } })).default as { version: string };
     console.log(pkg.version);
     process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.124",
+  "version": "0.9.0-preview.125",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/hub-provider-config.test.ts

@@ -5,8 +5,10 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { db } from './db';
 import { registerTools } from './tools';
+import { vaultGet } from './vault';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { reconcileProviderSnapshots } from '../../agent-node/src/runtime/daemon-provider-snapshot';
+import { DaemonProviderStore } from '../../agent-network/src/daemon-provider-store';
 const net = 'net_hub907', user = 'u_hub907', daemonId = 'n_hub907', alias = 'daemon907', token = 'tok_hub907';
 const root = mkdtempSync(join(tmpdir(), 'hub907-')), key = 'TEST-ONLY-shared-provider-key';
 function cleanup() {
@@ -37,6 +39,41 @@ function client(kind = 'human') {
 const provider = () => ({ id: 'shared', label: 'Shared model', enabled: true, protocol: 'openai-responses', baseUrl: 'https://provider.example/v1', models: ['fixture-model'], key });
 const save = (human: ReturnType<typeof client>, value = provider(), revision = 0) => human('daemon_provider_snapshot', { action: 'hub_put', id: value.id, network_id: net, revision, provider: value });
 const bind = (human: ReturnType<typeof client>, target = daemonId, revision = 1) => human('daemon_provider_snapshot', { action: 'hub_bind', network_id: net, id: 'shared', revision, provider: { daemon_node_id: target, daemon_revision: 0, confirm: true } });
+test('existing names-only vault key → Provider reference → actual daemon store, without re-entering key', async () => {
+  const human = client(), daemon = client('daemon');
+  expect(await human('upsert_network_secret', { network_id: net, key: 'SHARED_API_KEY', value: key })).toMatchObject({ ok: true });
+  const { key: ignored, ...config } = provider();
+  const saved = await save(human, { ...config, secretKeyRef: 'SHARED_API_KEY' } as any);
+  expect(saved.provider).toMatchObject({ secret_key_ref: 'SHARED_API_KEY', credential_present: true });
+  expect(db.get<any>('SELECT secret_key_ref FROM hub_provider_configs WHERE network_id=?1', net).secret_key_ref).toBe('SHARED_API_KEY');
+  const legacy = await human('daemon_provider_snapshot', { action: 'hub_read', id: 'hub', network_id: net });
+  expect(legacy.providers[0].secret_key_ref).toBeUndefined(); // older strict client shape unchanged
+  const modern = await human('daemon_provider_snapshot', { action: 'hub_read', id: 'hub', network_id: net, provider: { include_secret_refs: true } });
+  expect(modern.secret_reference_supported).toBe(true); expect(modern.providers[0].secret_key_ref).toBe('SHARED_API_KEY');
+  expect(JSON.stringify([saved, legacy, modern])).not.toContain(key);
+  const queued = await bind(human); expect(queued.ok).toBe(true);
+  await reconcileProviderSnapshots({ workDir: root, alias, networkId: net, daemonId, serverUrl: 'https://hub907.example.test', callCommHub: daemon, warn: message => console.warn(message) });
+  const receipt = await human('daemon_provider_snapshot', { action: 'read', id: queued.request_id, network_id: net });
+  expect(receipt.status).toBe('succeeded'); expect(receipt.snapshot.providers[0].runtimes[0].auth[0].credential_present).toBe(true);
+  const store = new DaemonProviderStore(join(root, '.anet/nodes', alias));
+  await store.withApiKey({ revision: receipt.snapshot.revision, providerId: queued.provider_reference.daemon_provider_id, authId: 'hub_key', model: 'fixture-model' }, async profile => {
+    expect(profile.key).toBe(key); expect(profile.baseUrl).toBe(config.baseUrl);
+  }); // synthetic local callback only; no model/vendor request
+  expect(JSON.stringify(receipt)).not.toContain(key);
+  // Switching back to Provider-owned plaintext never changes the reusable named key.
+  await save(human, { ...provider(), key: 'TEST-ONLY-provider-specific' }, 1);
+  expect(vaultGet(net, 'SHARED_API_KEY')).toBe(key);
+  expect(db.get<any>('SELECT secret_key_ref FROM hub_provider_configs WHERE network_id=?1', net).secret_key_ref).not.toBe('SHARED_API_KEY');
+});
+test('missing or ambiguous references do not save; explicit ref replacement updates the stored reference', async () => {
+  const human = client(); const { key: ignored, ...config } = provider();
+  expect(await save(human, { ...config, secretKeyRef: 'MISSING_KEY' } as any)).toMatchObject({ ok: false, error: 'provider_secret_reference_missing' });
+  expect(await save(human, { ...provider(), secretKeyRef: 'SHARED_API_KEY' } as any)).toMatchObject({ ok: false, error: 'invalid_provider_secret_reference' });
+  await save(human);
+  await human('upsert_network_secret', { network_id: net, key: 'SECOND_API_KEY', value: 'TEST-ONLY-second-key' });
+  expect((await save(human, { ...config, secretKeyRef: 'SECOND_API_KEY' } as any, 1)).provider.secret_key_ref).toBe('SECOND_API_KEY');
+  expect(db.get<any>('SELECT secret_key_ref FROM hub_provider_configs WHERE network_id=?1', net).secret_key_ref).toBe('SECOND_API_KEY');
+});
 test('actual Hub tool atomically saves encrypted Provider; metadata read and conflict never echo key', async () => {
   const human = client(); const result = await save(human); expect(result.ok).toBe(true);
   expect(result.provider).toMatchObject({ id: 'shared', revision: 1, source: 'hub', credential_present: true, compatible_runtimes: ['codex-tui'] });

package/src/hub-provider-config.ts

@@ -16,7 +16,7 @@ function auth(h: Human, write: boolean, owner = false) {
 }
 function validConfig(value: any): value is Config {
   if (!value || typeof value !== 'object' || Array.isArray(value)
-    || Object.keys(value).some(k => !['id', 'label', 'enabled', 'protocol', 'baseUrl', 'models', 'key'].includes(k))
+    || Object.keys(value).some(k => !['id', 'label', 'enabled', 'protocol', 'baseUrl', 'models', 'key', 'secretKeyRef'].includes(k))
     || !idValid(value.id) || typeof value.label !== 'string' || !value.label.trim() || value.label.length > 100
     || /[\x00-\x1f\x7f]/.test(value.label) || typeof value.enabled !== 'boolean'
     || !['openai-responses', 'openai-chat-completions', 'anthropic-messages'].includes(value.protocol)
@@ -31,36 +31,43 @@ type Row = { revision: number; config_json: string; secret_key_ref: string; upda
 function row(networkId: string, id: string) {
   return db.get<Row>('SELECT revision,config_json,secret_key_ref,updated_at FROM hub_provider_configs WHERE network_id=?1 AND provider_id=?2', networkId, id);
 }
-function publicRow(networkId: string, stored: Row) {
+function publicRow(networkId: string, stored: Row, exposeRef = false) {
   const config = JSON.parse(stored.config_json) as Config;
-  return { ...config, revision: stored.revision, updated_at: stored.updated_at, source: 'hub',
+  return { ...config, ...(exposeRef ? { secret_key_ref: stored.secret_key_ref } : {}), revision: stored.revision, updated_at: stored.updated_at, source: 'hub',
     credential_present: vaultListKeys(networkId).includes(stored.secret_key_ref), verification: 'not_checked',
     compatible_runtimes: config.protocol === 'openai-responses' ? ['codex-tui'] : [] };
 }
-export function readHubProviders(h: Human) {
+export function readHubProviders(h: Human, exposeRefs = false) {
   const refusal = auth(h, false); if (refusal) return refusal;
   const rows = db.all<Row>('SELECT revision,config_json,secret_key_ref,updated_at FROM hub_provider_configs WHERE network_id=?1 ORDER BY provider_id', h.networkId!);
-  return { ok: true as const, network_id: h.networkId!, source: 'hub' as const, providers: rows.map(r => publicRow(h.networkId!, r)) };
+  return { ok: true as const, network_id: h.networkId!, source: 'hub' as const,
+    ...(exposeRefs ? { secret_reference_supported: true } : {}), providers: rows.map(r => publicRow(h.networkId!, r, exposeRefs)) };
 }
 export function putHubProvider(h: Human, revision: number, input: unknown) {
   // This operation stores/rotates a shared secret: same OWNER boundary as vault writes.
   const refusal = auth(h, true, true); if (refusal) return refusal;
   if (!Number.isSafeInteger(revision) || revision < 0 || revision >= Number.MAX_SAFE_INTEGER) return denied('invalid_revision');
   if (!validConfig(input)) return denied('invalid_hub_provider');
-  const value = input as Config & { key?: string };
+  const value = input as Config & { key?: string; secretKeyRef?: string };
   if (value.key !== undefined && (typeof value.key !== 'string' || !value.key || value.key.length > 8192 || /[\s\x00-\x1f\x7f]/.test(value.key))) return denied('invalid_provider_key');
+  if (value.secretKeyRef !== undefined && (typeof value.secretKeyRef !== 'string' || !/^[A-Z][A-Z0-9_]{0,63}$/.test(value.secretKeyRef)
+    || value.key !== undefined)) return denied('invalid_provider_secret_reference');
+  if (value.secretKeyRef && !vaultListKeys(h.networkId!).includes(value.secretKeyRef)) return denied('provider_secret_reference_missing');
   const old = row(h.networkId!, value.id);
   if ((old?.revision ?? 0) !== revision) return denied('hub_provider_revision_conflict');
   const previous = old ? JSON.parse(old.config_json) as Config : null;
-  if (!value.key && (!old || previous?.baseUrl !== value.baseUrl || previous?.protocol !== value.protocol)) return denied('provider_key_required');
-  const ref = old?.secret_key_ref ?? `HUB_PROVIDER_${createHash('sha256').update(JSON.stringify([h.networkId, value.id])).digest('hex').slice(0, 32).toUpperCase()}`;
-  const { key, ...config } = value;
+  if (!value.key && !value.secretKeyRef && (!old || previous?.baseUrl !== value.baseUrl || previous?.protocol !== value.protocol)) return denied('provider_key_required');
+  // A new plaintext key belongs to this Provider. Never overwrite a separately
+  // named shared key merely because the previous config referenced it.
+  const privateRef = `HUB_PROVIDER_${createHash('sha256').update(JSON.stringify([h.networkId, value.id])).digest('hex').slice(0, 32).toUpperCase()}`;
+  const ref = value.secretKeyRef ?? (value.key ? privateRef : old!.secret_key_ref);
+  const { key, secretKeyRef, ...config } = value;
   try {
     db.transaction(() => {
       if ((row(h.networkId!, value.id)?.revision ?? 0) !== revision) throw new Error('hub_provider_revision_conflict');
       if (key) vaultUpsert(h.networkId!, ref, key);
       db.run(`INSERT INTO hub_provider_configs(network_id,provider_id,revision,config_json,secret_key_ref,updated_at) VALUES(?1,?2,?3,?4,?5,?6)
-        ON CONFLICT(network_id,provider_id) DO UPDATE SET revision=excluded.revision,config_json=excluded.config_json,updated_at=excluded.updated_at`,
+        ON CONFLICT(network_id,provider_id) DO UPDATE SET revision=excluded.revision,config_json=excluded.config_json,secret_key_ref=excluded.secret_key_ref,updated_at=excluded.updated_at`,
         [h.networkId!, value.id, revision + 1, JSON.stringify(config), ref, Date.now()]);
       // Cancel still-pending dispatches when the source is edited/rotated/disabled.
       // Already installed copies are NOT remotely revoked by this change.
@@ -69,7 +76,7 @@ export function putHubProvider(h: Human, revision: number, input: unknown) {
       db.run(`DELETE FROM daemon_provider_writes WHERE request_id IN (SELECT b.request_id FROM hub_provider_bindings b
         JOIN daemon_provider_snapshots s ON s.request_id=b.request_id WHERE b.network_id=?1 AND b.provider_id=?2 AND s.status!='pending')`, [h.networkId!, value.id]);
     });
-    return { ok: true as const, network_id: h.networkId!, provider: publicRow(h.networkId!, row(h.networkId!, value.id)!) };
+    return { ok: true as const, network_id: h.networkId!, provider: publicRow(h.networkId!, row(h.networkId!, value.id)!, secretKeyRef !== undefined) };
   } catch (error) { return denied(error instanceof VaultError ? error.code : 'hub_provider_save_failed'); }
 }
 export function bindHubProvider(h: Human, input: { id: string; revision: number; daemon_node_id: string; daemon_revision: number; confirm: boolean }) {

package/src/server.ts

@@ -134,7 +134,11 @@ if (AUTH_TOKEN) {
 const MCP_LABEL_MAX_BYTES = 1024 * 1024;
 
 // Read version from package.json so banners and /health stay in sync.
+// ANET_EMBEDDED_COMMHUB_VERSION is set only by the standalone anet binary
+// (bin/anet-bin.ts). npm/bunx leaves it unset and keeps the disk read.
 const SERVER_VERSION = (() => {
+  const embedded = process.env.ANET_EMBEDDED_COMMHUB_VERSION?.trim() ?? "";
+  if (/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(embedded)) return embedded;
   try {
     const url = new URL("../package.json", import.meta.url);
     return JSON.parse(require("fs").readFileSync(url, "utf8")).version || "?";

package/src/tools.ts

@@ -4133,7 +4133,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
     async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);
-      if (action === 'hub_read') return providerReply(readHubProviders(human));
+      if (action === 'hub_read') return providerReply(readHubProviders(human, (provider as any)?.include_secret_refs === true));
       if (action === 'hub_put') return providerReply(putHubProvider(human, revision!, provider));
       if (action === 'hub_bind') {
         const selection = provider as { daemon_node_id?: string; daemon_revision?: number; confirm?: boolean } | undefined;