@sleep2agi/commhub-server 0.9.0-preview.126 → 0.9.0-preview.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.126",
+  "version": "0.9.0-preview.127",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/hub-provider-config.test.ts

@@ -7,7 +7,7 @@ import { db } from './db';
 import { registerTools } from './tools';
 import { vaultGet } from './vault';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { reconcileProviderSnapshots } from '../../agent-node/src/runtime/daemon-provider-snapshot';
+import { reconcileProviderSnapshots, secureProviderTransport } from '../../agent-node/src/runtime/daemon-provider-snapshot';
 import { DaemonProviderStore } from '../../agent-network/src/daemon-provider-store';
 const net = 'net_hub907', user = 'u_hub907', daemonId = 'n_hub907', alias = 'daemon907', token = 'tok_hub907';
 const root = mkdtempSync(join(tmpdir(), 'hub907-')), key = 'TEST-ONLY-shared-provider-key';
@@ -39,6 +39,29 @@ function client(kind = 'human') {
 const provider = () => ({ id: 'shared', label: 'Shared model', enabled: true, protocol: 'openai-responses', baseUrl: 'https://provider.example/v1', models: ['fixture-model'], key });
 const save = (human: ReturnType<typeof client>, value = provider(), revision = 0) => human('daemon_provider_snapshot', { action: 'hub_put', id: value.id, network_id: net, revision, provider: value });
 const bind = (human: ReturnType<typeof client>, target = daemonId, revision = 1) => human('daemon_provider_snapshot', { action: 'hub_bind', network_id: net, id: 'shared', revision, provider: { daemon_node_id: target, daemon_revision: 0, confirm: true } });
+test('HTTP Hub and API endpoint support save, explicit bind and exact private-store readback', async () => {
+  expect(secureProviderTransport('http://hub907.example.test')).toBe(true);
+  expect(secureProviderTransport('ftp://hub907.example.test')).toBe(false);
+  expect(secureProviderTransport('http://user:password@hub907.example.test')).toBe(false);
+  const human = client(), daemon = client('daemon');
+  const config = { ...provider(), baseUrl: 'http://provider.example/v1' };
+  const saved = await save(human, config); expect(saved.ok).toBe(true);
+  expect(saved.provider.baseUrl).toBe(config.baseUrl);
+  const queued = await bind(human); expect(queued.ok).toBe(true);
+  await reconcileProviderSnapshots({ workDir: root, alias, networkId: net, daemonId,
+    serverUrl: 'http://hub907.example.test', callCommHub: daemon, warn: message => console.warn(message) });
+  const receipt = await human('daemon_provider_snapshot', { action: 'read', id: queued.request_id, network_id: net });
+  expect(receipt.status).toBe('succeeded');
+  expect(receipt.snapshot.providers[0].runtimes[0].auth[0].baseUrl).toBe(config.baseUrl);
+  expect(JSON.stringify([saved, queued, receipt])).not.toContain(key);
+  const store = new DaemonProviderStore(join(root, '.anet/nodes', alias));
+  await store.withApiKey({ revision: 1, providerId: queued.provider_reference.daemon_provider_id, authId: 'hub_key', model: 'fixture-model' }, async actual => {
+    expect(actual.baseUrl).toBe(config.baseUrl); expect(actual.key).toBe(key);
+  }); // Exact synthetic key in local callback, no external model request.
+  for (const baseUrl of ['ftp://provider.example/v1', 'http://user:pass@provider.example/v1', 'http://provider.example/v1?key=secret']) {
+    expect(await save(human, { ...provider(), id: 'invalid', baseUrl })).toMatchObject({ ok: false, error: 'invalid_hub_provider' });
+  }
+});
 test('existing names-only vault key → Provider reference → actual daemon store, without re-entering key', async () => {
   const human = client(), daemon = client('daemon');
   expect(await human('upsert_network_secret', { network_id: net, key: 'SHARED_API_KEY', value: key })).toMatchObject({ ok: true });

package/src/hub-provider-config.ts

@@ -24,7 +24,7 @@ function validConfig(value: any): value is Config {
     || !Array.isArray(value.models) || !value.models.length || value.models.length > 200
     || new Set(value.models).size !== value.models.length
     || value.models.some((m: unknown) => typeof m !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/.test(m))) return false;
-  try { const u = new URL(value.baseUrl); return u.protocol === 'https:' && !u.username && !u.password && !u.search && !u.hash; }
+  try { const u = new URL(value.baseUrl); return ['https:', 'http:'].includes(u.protocol) && !u.username && !u.password && !u.search && !u.hash; }
   catch { return false; }
 }
 type Row = { revision: number; config_json: string; secret_key_ref: string; updated_at: number };

package/src/scoped-secrets.ts

@@ -0,0 +1,80 @@
+// Short-lived management lane, not task/message text and not a secret archive.
+import { randomUUID } from 'node:crypto';
+import { db } from './db';
+import { getUserNetworkRole } from './auth';
+import { providerScanTargets } from './daemon-provider-snapshots';
+import { validScopedSecretKey } from './shared/scoped-secret-contract';
+type Human = { userId?: string | null; isNode: boolean; networkId: string | null };
+type Daemon = { ok: false; error: string } | { ok: true; networkId: string; daemonNodeId: string; daemonAlias: string };
+type Request = { request_id: string; network_id: string; daemon_node_id: string; node_id: string | null;
+  action: 'list' | 'put' | 'delete'; key?: string; value?: string; revision?: number;
+  status: 'pending' | 'succeeded' | 'failed' | 'expired'; expires_at: number; snapshot?: any; error?: string };
+const requests = new Map<string, Request>();
+const denied = (error: string) => ({ ok: false as const, error });
+function authorize(h: Human) {
+  return h.isNode || !h.userId ? denied('user_token_required') : !h.networkId
+    || !['owner','admin'].includes(getUserNetworkRole(h.userId, h.networkId) ?? '') ? denied('secret_admin_required') : null;
+}
+function daemonSupported(network: string, daemon: string) {
+  const row = db.get<{ config_snapshot: string }>('SELECT config_snapshot FROM nodes WHERE network_id=?1 AND node_id=?2', network, daemon);
+  try { const s = JSON.parse(row?.config_snapshot ?? '{}'); return s.role === 'host_supervisor' && s.scoped_secrets_capable === true; } catch { return false; }
+}
+function expire() {
+  for (const [id,r] of requests) {
+    if (r.expires_at < Date.now() && r.status === 'pending') { r.status = 'expired'; delete r.value; }
+    if (r.expires_at + 600_000 < Date.now()) requests.delete(id);
+  }
+}
+const timer = setInterval(expire, 10_000); timer.unref();
+export function requestScopedSecrets(h: Human, daemon: string, node: string | null, action: Request['action'], key?: string, value?: string, revision?: number) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonSupported(h.networkId!, daemon)) return denied('scoped_secrets_upgrade_required');
+  if (node !== null && !providerScanTargets(h.networkId!, daemon).some(t => t.node_id === node)) return denied('secret_target_not_bound');
+  if (action !== 'list' && (!validScopedSecretKey(key)
+    || !Number.isSafeInteger(revision) || revision! < 0 || (action === 'put' && (typeof value !== 'string' || !value || Buffer.byteLength(value) > 8192 || value.includes('\0'))))) return denied('invalid_secret_input');
+  expire();
+  if ([...requests.values()].some(r => r.network_id === h.networkId && r.daemon_node_id === daemon && r.status === 'pending')) return denied('secret_store_busy');
+  if (requests.size >= 1000) return denied('secret_queue_busy');
+  const r: Request = { request_id: `dsk_${randomUUID()}`, network_id: h.networkId!, daemon_node_id: daemon,
+    node_id: node, action, ...(action === 'list' ? {} : { key, revision, ...(action === 'put' ? { value } : {}) }),
+    expires_at: Date.now() + 120_000, status: 'pending' };
+  requests.set(r.request_id, r);
+  return { ok: true as const, request_id: r.request_id, status: r.status, expires_at: r.expires_at };
+}
+export function getScopedSecrets(h: Human, id: string) {
+  const refusal = authorize(h); if (refusal) return refusal; expire();
+  const r = requests.get(id);
+  if (!r || r.network_id !== h.networkId) return denied('request_not_found');
+  return { ok: true as const, request_id: id, daemon_node_id: r.daemon_node_id, node_id: r.node_id,
+    status: r.status, ...(r.snapshot ? { snapshot: r.snapshot } : {}), ...(r.error ? { error: r.error } : {}) };
+}
+export function pullScopedSecrets(d: Daemon) {
+  if (!d.ok || !daemonSupported(d.networkId, d.daemonNodeId)) return denied('caller_not_a_daemon'); expire();
+  const targets = providerScanTargets(d.networkId, d.daemonNodeId);
+  return { ok: true, requests: [...requests.values()].filter(r => r.network_id === d.networkId && r.daemon_node_id === d.daemonNodeId && r.status === 'pending')
+    .flatMap(r => {
+      if (r.node_id !== null && !targets.some(t => t.node_id === r.node_id)) { r.status = 'failed'; r.error = 'secret_target_not_bound'; delete r.value; return []; }
+      const { status, snapshot, error, ...input } = r;
+      return [{ ...input, targets }];
+    }) };
+}
+export function ackScopedSecrets(d: Daemon, id: string, snapshot: any, failed = false) {
+  if (!d.ok || !daemonSupported(d.networkId, d.daemonNodeId)) return denied('caller_not_a_daemon'); expire();
+  const r = requests.get(id);
+  if (!r || r.network_id !== d.networkId || r.daemon_node_id !== d.daemonNodeId) return denied('request_not_found');
+  if (r.status !== 'pending') return { ok: r.status === 'succeeded' || r.status === 'failed', status: r.status };
+  if (!failed) {
+    if (!snapshot || Object.keys(snapshot).some(k => !['network_id','daemon_node_id','node_id','revision','activation','keys'].includes(k))
+      || snapshot.network_id !== r.network_id || snapshot.daemon_node_id !== r.daemon_node_id || snapshot.node_id !== r.node_id
+      || !Number.isSafeInteger(snapshot.revision) || snapshot.revision < 0 || snapshot.activation !== 'next_start'
+      || !Array.isArray(snapshot.keys) || snapshot.keys.length > 256 || new Set(snapshot.keys.map((x:any)=>x.key)).size !== snapshot.keys.length
+      || snapshot.keys.some((x:any) => !x || Object.keys(x).some(k=>!['key','source'].includes(k)) || !validScopedSecretKey(x.key)
+        || !['daemon','node'].includes(x.source) || (r.node_id === null && x.source !== 'daemon'))
+      || (r.action !== 'list' && snapshot.revision !== r.revision! + 1)
+      || (r.action === 'put' && !snapshot.keys.some((x:any)=>x.key === r.key && x.source === (r.node_id ? 'node' : 'daemon')))) return denied('invalid_secret_receipt');
+    if (r.node_id !== null && !providerScanTargets(r.network_id,r.daemon_node_id).some(t=>t.node_id === r.node_id)) return denied('secret_target_not_bound');
+    r.snapshot = snapshot;
+  }
+  r.status = failed ? 'failed' : 'succeeded'; if (failed) r.error = 'secret_operation_unavailable'; delete r.value;
+  return { ok: true, status: r.status };
+}

package/src/shared/daemon-provider-snapshot.ts

@@ -40,7 +40,7 @@ export function validateDaemonProviderSnapshot(value: unknown, networkId: string
           if (a.account_id !== undefined) fail();
           if (a.credential_present !== true || typeof a.baseUrl !== "string" || a.baseUrl.length > 2048) fail();
           let u: URL; try { u = new URL(a.baseUrl); } catch { return fail(); }
-          if (u.protocol !== "https:" || u.username || u.password || u.search || u.hash) fail();
+          if (!["https:", "http:"].includes(u.protocol) || u.username || u.password || u.search || u.hash) fail();
         } else fail();
       }
     }

package/src/shared/scoped-secret-contract.ts

@@ -0,0 +1,5 @@
+import { isReservedEnvKey } from './reserved-env';
+export const validScopedSecretKey = (key: unknown): key is string => typeof key === 'string'
+  && /^[A-Z_][A-Z0-9_]{0,127}$/.test(key) && !isReservedEnvKey(key)
+  && !['CODEX_HOME','CLAUDE_CONFIG_DIR','XDG_CONFIG_HOME','XDG_DATA_HOME','TMUX','TMUX_PANE','TEMP','TMP'].includes(key)
+  && !['COMMHUB_','ANET_','CLAUDE_CODE_'].some(p => key.startsWith(p));

package/src/tools.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestProviderSnapshot, requestProviderWrite, requestProviderCollection, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
 import { readHubProviders, putHubProvider, bindHubProvider } from './hub-provider-config.js';
+import { requestScopedSecrets, getScopedSecrets, pullScopedSecrets, ackScopedSecrets } from './scoped-secrets.js';
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { adoptionCandidatesReportSchema } from "./adoption-candidates.js";
@@ -841,6 +842,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         // discovery (#337 extracts this field). "host_supervisor" =
         // anet daemon. Default-stripping zod would drop this otherwise.
         role: z.string().max(64).optional().nullable(),
+        scoped_secrets_capable: z.boolean().optional(),
         // RFC-026 §9.3 / #338 PR3 — daemon self-declare nested under
         // `daemon_capabilities` (canonical shape per existing hub reads
         // at tools.ts:2010/2075 — PR1/PR2 placed these top-level, hub
@@ -4129,10 +4131,22 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const providerHuman = (net?: string) => ({ userId: enforceUserId, isNode: callerTokenIsNetwork, networkId: getNetworkId(net) });
   const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
   server.tool(
-    "daemon_provider_snapshot", "Provider: daemon refresh/put/collect/apply/login; read=request id. login provider={action:start|read|cancel|save|accounts,session_id?,label?}. hub_read=catalog; hub_put=owner config; hub_bind=id+revision,provider={daemon_node_id,daemon_revision,confirm:true}. No login tokens.",
-    { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
+    "daemon_provider_snapshot", "Daemon Provider actions; read=id. Login provider={action,session_id?,label?}, no tokens. hub_*=owner catalog/distribute. secret_*=env persistence, provider={node_id?,key?,value?}; next full start.",
+    { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind", "secret_list", "secret_put", "secret_delete", "secret_read"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
     async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);
+      // Separate scoped-secret contract using the existing management lane.
+      // No additional tools in model context; ordinary Provider actions unchanged.
+      if (action === 'secret_read') return providerReply(getScopedSecrets(human, id));
+      if (action === 'secret_list' || action === 'secret_put' || action === 'secret_delete') {
+        const input = provider as { node_id?: string | null; key?: string; value?: string } | undefined;
+        const result = requestScopedSecrets(human, id, input?.node_id ?? null, action === 'secret_list' ? 'list' : action === 'secret_put' ? 'put' : 'delete', input?.key, input?.value, revision);
+        if (result.ok) {
+          const target = db.get<{ alias: string }>('SELECT alias FROM nodes WHERE node_id=?1 AND network_id=?2', id, human.networkId!);
+          if (target) pushEvent(target.alias, { type: 'scoped_secrets', request_id: result.request_id }, human.networkId!);
+        }
+        return providerReply(result);
+      }
       if (action === 'hub_read') return providerReply(readHubProviders(human, (provider as any)?.include_secret_refs === true));
       if (action === 'hub_put') return providerReply(putHubProvider(human, revision!, provider));
       if (action === 'hub_bind') {
@@ -4158,13 +4172,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
   server.tool(
-    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/collect/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional(), accept_collections: z.boolean().optional() },
-    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections }) => providerReply(pullProviderSnapshots(resolveCallerDaemonTokenBound(), accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections)),
+    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/collect/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional(), accept_collections: z.boolean().optional(), accept_secrets: z.boolean().optional() },
+    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections, accept_secrets }) => {
+      const caller = resolveCallerDaemonTokenBound();
+      const result = pullProviderSnapshots(caller, accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections);
+      return providerReply(result.ok && accept_secrets ? { ...result, secret_requests: pullScopedSecrets(caller) } : result);
+    },
   );
   server.tool(
     "ack_daemon_provider_snapshot", "Target daemon acknowledges redacted Provider configuration readback; fixed failure code only.",
     { request_id: z.string().min(1).max(200), snapshot: z.unknown().optional(), failed: z.boolean().optional(), applied_revision: z.number().int().min(0).optional(), application: z.unknown().optional(), login: z.unknown().optional() },
-    async ({ request_id, snapshot, failed, applied_revision, application, login }) => providerReply(ackProviderSnapshot(resolveCallerDaemonTokenBound(), request_id, snapshot, failed, applied_revision, application, login)),
+    async ({ request_id, snapshot, failed, applied_revision, application, login }) => providerReply(request_id.startsWith('dsk_')
+      ? ackScopedSecrets(resolveCallerDaemonTokenBound(), request_id, snapshot, failed)
+      : ackProviderSnapshot(resolveCallerDaemonTokenBound(), request_id, snapshot, failed, applied_revision, application, login)),
   );
 
   // Helper — map a ValidationError thrown from create-node-validate