@sleep2agi/commhub-server 0.9.0-preview.127 → 0.9.0-preview.129

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.127",
+  "version": "0.9.0-preview.129",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/inbox-caller.ts

@@ -0,0 +1,49 @@
+import { db } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { resolveNodeCaller } from "./create-node.js";
+import { resolveCanonicalAlias } from "./rename.js";
+
+type InboxCaller = {
+  tokenId?: string | null;
+  userId?: string | null;
+  networkId?: string | null;
+  nodeToken: boolean;
+  identityRejected: boolean;
+};
+
+/** Inbox reads and ACKs act as the recipient, not as a dispatch target. */
+export function resolveInboxCaller(alias: string, caller: InboxCaller):
+  { ok: true; alias: string } | { ok: false; error: string } {
+  const denied = { ok: false as const, error: "inbox_identity_mismatch" };
+  if (caller.identityRejected) return denied;
+  const requested = alias.trim();
+  if (caller.nodeToken) {
+    const node = resolveNodeCaller(caller.tokenId);
+    if (node.ok) {
+      if (node.networkId !== caller.networkId) return denied;
+      const canonical = resolveCanonicalAlias(node.networkId, requested).alias;
+      return canonical === node.alias ? { ok: true, alias: node.alias } : denied;
+    }
+    // Registration tokens are network-scoped human tokens, not node tokens.
+    // Missing/foreign/ambiguous node identities never fall back to the issuer.
+    if (node.reason !== "not_a_node_token" || !caller.tokenId) return denied;
+    const token = db.get<{ name: string | null }>(
+      "SELECT name FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL", caller.tokenId,
+    );
+    if (!token || token.name?.startsWith("node:")) return denied;
+  }
+  // Preserve open-development and legacy global-token mode.
+  if (!caller.userId) return { ok: true, alias: requested };
+  const user = db.get<{ username: string }>("SELECT username FROM users WHERE user_id = ?1", caller.userId);
+  if (user?.username === requested) return { ok: true, alias: requested };
+  if (!caller.networkId) return { ok: false, error: "network_id_required" };
+  const role = getUserNetworkRole(caller.userId, caller.networkId);
+  if (!role) return denied;
+  const canonical = resolveCanonicalAlias(caller.networkId, requested).alias;
+  if (role === "owner" || role === "admin") return { ok: true, alias: canonical };
+  const owned = db.get<{ node_id: string }>(
+    "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2 AND owner_user_id = ?3 LIMIT 1",
+    canonical, caller.networkId, caller.userId,
+  );
+  return owned ? { ok: true, alias: canonical } : denied;
+}

package/src/mcp-write-network-resolution.test.ts

@@ -259,6 +259,9 @@ describe("utok multi-network", () => {
 
   test("ack_inbox threads explicit network_id", async () => {
     const { tools } = buildHandlers({ userId: U_MULTI });
+    // This tests network selection with an authorized recipient. Acting as
+    // another owner's recipient is covered by the HTTP identity suite.
+    db.run("UPDATE nodes SET owner_user_id = ?1 WHERE alias = ?2 AND network_id = ?3", [U_MULTI, A1, NET_A]);
     const ib = makeInbox(A1, "x517 g2 ack_inbox");
     const r = await call(tools["ack_inbox"], { alias: A1, message_id: ib, network_id: NET_A });
     expect(r.ok).toBe(true);

package/src/node-caller-identity-http.test.ts

@@ -269,6 +269,73 @@ async function mcpSend(token: string, task: string, from: string | undefined) {
   return tool(token, "send_task", args);
 }
 
+test("inbox recipient: bound identity wins over the token name", async () => {
+  const id = `inbox-bound-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'own inbox', ?3)", [id, otherAlias, NET]);
+  const read = await tool(otherTok.token, "get_inbox", { alias: otherAlias });
+  expect(read.ok).toBe(true);
+  expect(read.messages.some((row: any) => row.id === id)).toBe(true);
+  expect((await tool(otherTok.token, "ack_inbox", { alias: otherAlias, message_id: id })).ok).toBe(true);
+  expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", id)?.acked).toBe(1);
+});
+
+test("inbox recipient: another node and invalid node identities cannot read or ACK", async () => {
+  const id = `inbox-denied-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'private inbox', ?3)", [id, victimAlias, NET]);
+  for (const caller of [otherTok, squatter, boundMissing]) {
+    const read = await tool(caller.token, "get_inbox", { alias: victimAlias });
+    expect(read.ok).toBe(false);
+    expect(read.error).toBe("inbox_identity_mismatch");
+    expect(read.messages).toBeUndefined();
+    const ack = await tool(caller.token, "ack_inbox", { alias: victimAlias, message_id: id });
+    expect(ack.ok).toBe(false);
+    expect(ack.error).toBe("inbox_identity_mismatch");
+    expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", id)?.acked).toBe(0);
+  }
+  expect((await tool(victimTok.token, "ack_inbox", { alias: victimAlias, message_id: id })).ok).toBe(true);
+});
+
+test("inbox recipient: same alias stays inside the token network", async () => {
+  const home = `inbox-net-home-${stamp}`, foreign = `inbox-net-foreign-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'home', ?3)", [home, sharedAlias, NET2]);
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'foreign', ?3)", [foreign, sharedAlias, NET]);
+  const read = await tool(sharedHome.token, "get_inbox", { alias: sharedAlias, network_id: NET });
+  expect(read.ok).toBe(true);
+  expect(read.messages.some((row: any) => row.id === home)).toBe(true);
+  expect(read.messages.some((row: any) => row.id === foreign)).toBe(false);
+  expect((await tool(sharedHome.token, "ack_inbox", { alias: sharedAlias, message_id: foreign, network_id: NET })).ok).toBe(false);
+  expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", foreign)?.acked).toBe(0);
+});
+
+test("inbox recipient: legacy ownerless identity and authorized human access remain", async () => {
+  const id = `inbox-legacy-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'legacy', ?3)", [id, ownerlessAlias, NET]);
+  expect((await tool(ownerlessTok.token, "get_inbox", { alias: ownerlessAlias })).ok).toBe(true);
+  expect((await tool(ownerToken, "get_inbox", { alias: ownerlessAlias, network_id: NET })).ok).toBe(true);
+  expect((await tool(ownerToken, "ack_inbox", { alias: ownerlessAlias, message_id: id, network_id: NET })).ok).toBe(true);
+});
+
+test("inbox recipient: a full-access member cannot act as another owner's node", async () => {
+  const member = register(`inboxmem${stamp}`, "InboxMember123!", undefined, "seed");
+  expect(member.ok).toBe(true);
+  expect(addNetworkMember(NET, member.user!.user_id, "member", ownerId).ok).toBe(true);
+  db.run("UPDATE network_members SET agent_access = 'all' WHERE user_id = ?1 AND network_id = ?2", [member.user!.user_id, NET]);
+  const id = `inbox-member-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'private', ?3)", [id, victimAlias, NET]);
+  for (const name of ["get_inbox", "ack_inbox"]) {
+    const args: Record<string, unknown> = { alias: victimAlias, network_id: NET };
+    if (name === "ack_inbox") args.message_id = id;
+    const result = await tool(member.token!, name, args);
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe("inbox_identity_mismatch");
+  }
+  expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", id)?.acked).toBe(0);
+  const own = `inbox-member-own-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'own', ?3)", [own, member.user!.username, NET]);
+  expect((await tool(member.token!, "get_inbox", { alias: member.user!.username, network_id: NET })).ok).toBe(true);
+  expect((await tool(member.token!, "ack_inbox", { alias: member.user!.username, message_id: own, network_id: NET })).ok).toBe(true);
+});
+
 test("caller identity boundary: mcp send omits from_session", async () => {
   const task = `boundary omit ${stamp}`;
   const sent = await mcpSend(squatter.token, task, undefined);

package/src/scoped-secrets.ts

@@ -6,7 +6,7 @@ import { providerScanTargets } from './daemon-provider-snapshots';
 import { validScopedSecretKey } from './shared/scoped-secret-contract';
 type Human = { userId?: string | null; isNode: boolean; networkId: string | null };
 type Daemon = { ok: false; error: string } | { ok: true; networkId: string; daemonNodeId: string; daemonAlias: string };
-type Request = { request_id: string; network_id: string; daemon_node_id: string; node_id: string | null;
+type Request = { request_id: string; network_id: string; daemon_node_id: string | null; node_id: string | null;
   action: 'list' | 'put' | 'delete'; key?: string; value?: string; revision?: number;
   status: 'pending' | 'succeeded' | 'failed' | 'expired'; expires_at: number; snapshot?: any; error?: string };
 const requests = new Map<string, Request>();
@@ -26,6 +26,50 @@ function expire() {
   }
 }
 const timer = setInterval(expire, 10_000); timer.unref();
+function nodeSupported(network: string, node: string) {
+  const row = db.get<{ config_snapshot: string }>('SELECT config_snapshot FROM nodes WHERE network_id=?1 AND node_id=?2', network, node);
+  try { return JSON.parse(row?.config_snapshot ?? '{}').node_secrets_capable === true; } catch { return false; }
+}
+// Independent node lane: no supervisor lookup, binding, or Daemon credential.
+export function requestNodeSecrets(h: Human, node: string, action: Request['action'], key?: string, value?: string, revision?: number) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!nodeSupported(h.networkId!, node)) return denied('node_secrets_upgrade_required');
+  if (action !== 'list' && (!validScopedSecretKey(key) || !Number.isSafeInteger(revision) || revision! < 0
+    || (action === 'put' && (typeof value !== 'string' || !value || Buffer.byteLength(value) > 8192 || value.includes('\0'))))) return denied('invalid_secret_input');
+  expire();
+  if ([...requests.values()].some(r => r.network_id === h.networkId && r.daemon_node_id === null && r.node_id === node && r.status === 'pending')) return denied('secret_store_busy');
+  if (requests.size >= 1000) return denied('secret_queue_busy');
+  const r: Request = { request_id: `nsk_${randomUUID()}`, network_id: h.networkId!, daemon_node_id: null,
+    node_id: node, action, ...(action === 'list' ? {} : { key, revision, ...(action === 'put' ? { value } : {}) }),
+    expires_at: Date.now() + 120_000, status: 'pending' };
+  requests.set(r.request_id, r);
+  return { ok: true as const, request_id: r.request_id, status: r.status, expires_at: r.expires_at };
+}
+export function pullNodeSecrets(d: Daemon) {
+  if (!d.ok || !nodeSupported(d.networkId, d.daemonNodeId)) return denied('caller_not_a_secret_node');
+  expire();
+  return { ok: true, requests: [...requests.values()].filter(r => r.network_id === d.networkId && r.daemon_node_id === null
+    && r.node_id === d.daemonNodeId && r.status === 'pending').map(({ status, snapshot, error, ...input }) => input) };
+}
+export function ackNodeSecrets(d: Daemon, id: string, snapshot: any, failed = false) {
+  if (!d.ok || !nodeSupported(d.networkId, d.daemonNodeId)) return denied('caller_not_a_secret_node');
+  expire(); const r = requests.get(id);
+  if (!r || r.network_id !== d.networkId || r.daemon_node_id !== null || r.node_id !== d.daemonNodeId) return denied('request_not_found');
+  if (r.status !== 'pending') return { ok: r.status === 'succeeded' || r.status === 'failed', status: r.status };
+  if (!failed) {
+    if (!snapshot || Object.keys(snapshot).some(k => !['network_id','daemon_node_id','node_id','revision','activation','keys'].includes(k))
+      || snapshot.network_id !== r.network_id || snapshot.daemon_node_id !== null || snapshot.node_id !== r.node_id
+      || !Number.isSafeInteger(snapshot.revision) || snapshot.revision < 0 || snapshot.activation !== 'next_start'
+      || !Array.isArray(snapshot.keys) || snapshot.keys.length > 128 || new Set(snapshot.keys.map((x:any)=>x?.key)).size !== snapshot.keys.length
+      || snapshot.keys.some((x:any)=>!x || Object.keys(x).some(k=>!['key','source'].includes(k)) || !validScopedSecretKey(x.key) || x.source !== 'node')
+      || (r.action !== 'list' && snapshot.revision !== r.revision! + 1)
+      || (r.action === 'put' && !snapshot.keys.some((x:any)=>x.key === r.key))
+      || (r.action === 'delete' && snapshot.keys.some((x:any)=>x.key === r.key))) return denied('invalid_secret_receipt');
+    r.snapshot = snapshot;
+  }
+  r.status = failed ? 'failed' : 'succeeded'; if (failed) r.error = 'secret_operation_unavailable'; delete r.value;
+  return { ok: true, status: r.status };
+}
 export function requestScopedSecrets(h: Human, daemon: string, node: string | null, action: Request['action'], key?: string, value?: string, revision?: number) {
   const refusal = authorize(h); if (refusal) return refusal;
   if (!daemonSupported(h.networkId!, daemon)) return denied('scoped_secrets_upgrade_required');

package/src/tools.ts

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestProviderSnapshot, requestProviderWrite, requestProviderCollection, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
 import { readHubProviders, putHubProvider, bindHubProvider } from './hub-provider-config.js';
-import { requestScopedSecrets, getScopedSecrets, pullScopedSecrets, ackScopedSecrets } from './scoped-secrets.js';
+import { requestScopedSecrets, getScopedSecrets, pullScopedSecrets, ackScopedSecrets, requestNodeSecrets, pullNodeSecrets, ackNodeSecrets } from './scoped-secrets.js';
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { adoptionCandidatesReportSchema } from "./adoption-candidates.js";
@@ -22,6 +22,7 @@ import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetwork
 import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
+import { resolveInboxCaller } from "./inbox-caller.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
 import { addAgentNetworkScope, addAgentTimelineScope, addNetworkScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { canMessageAgent, restrictedNetworkIds, RESTRICTED_MEMBER_TOOLS, type AgentRef } from "./agent-access.js";
@@ -843,6 +844,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         // anet daemon. Default-stripping zod would drop this otherwise.
         role: z.string().max(64).optional().nullable(),
         scoped_secrets_capable: z.boolean().optional(),
+        // Preserve the runtime's independent-key capability through MCP input
+        // parsing; unknown z.object fields are otherwise silently stripped.
+        node_secrets_capable: z.boolean().optional(),
         // RFC-026 §9.3 / #338 PR3 — daemon self-declare nested under
         // `daemon_capabilities` (canonical shape per existing hub reads
         // at tools.ts:2010/2075 — PR1/PR2 placed these top-level, hub
@@ -1418,13 +1422,18 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "get_inbox",
-    "Get pending commands for your session.",
+    "Read your inbox.",
     {
-      alias: z.string().min(1).max(200).describe("Session alias"),
+      alias: z.string().min(1).max(200).describe("Alias"),
       limit: z.number().min(1).max(100).optional().default(10),
+      network_id: z.string().max(200).optional(),
     },
-    async ({ alias, limit }) => {
-      const readScope = resolveReadScope(null);
+    async ({ alias, limit, network_id: netId }) => {
+      const effectiveNetId = getNetworkId(netId);
+      const recipient = resolveInboxCaller(alias, { tokenId: callerTokenId, userId: enforceUserId, networkId: effectiveNetId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected });
+      if (!recipient.ok) return { content: [{ type: "text" as const, text: JSON.stringify(recipient) }] };
+      alias = recipient.alias;
+      const readScope = resolveReadScope(effectiveNetId);
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
       const countParams: any[] = [alias];
       let countSql = "SELECT COUNT(*) as cnt FROM inbox WHERE session_name = ?1 AND acked = 0";
@@ -1454,9 +1463,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "ack_inbox",
-    "Acknowledge receipt of a command.",
+    "ACK your inbox.",
     {
-      alias: z.string().min(1).max(200).describe("Session alias"),
+      alias: z.string().min(1).max(200).describe("Alias"),
       message_id: z.string().min(1).max(200),
       response: z.string().max(10000).optional(),
       network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
@@ -1464,6 +1473,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     async ({ alias, message_id, response, network_id: netId }) => {
       const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
+      const recipient = resolveInboxCaller(alias, { tokenId: callerTokenId, userId: enforceUserId, networkId: effectiveNetId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected });
+      if (!recipient.ok) return { content: [{ type: "text" as const, text: JSON.stringify(recipient) }] };
+      alias = recipient.alias;
       console.log(`[${ts()}] ${alias} → ack_inbox: ${message_id.slice(0, 8)}`);
       // New task consumers ACK by the logical tasks.task_id exposed by
       // get_inbox. Keep exact inbox.id support for legacy consumers and for
@@ -4131,13 +4143,22 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const providerHuman = (net?: string) => ({ userId: enforceUserId, isNode: callerTokenIsNetwork, networkId: getNetworkId(net) });
   const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
   server.tool(
-    "daemon_provider_snapshot", "Daemon Provider actions; read=id. Login provider={action,session_id?,label?}, no tokens. hub_*=owner catalog/distribute. secret_*=env persistence, provider={node_id?,key?,value?}; next full start.",
-    { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind", "secret_list", "secret_put", "secret_delete", "secret_read"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
+    "daemon_provider_snapshot", "Providers, no tokens; hub_*=owner catalog+bind; secret_*=Daemon env; node_secret_*=node env; provider={node_id?,key?,value?}; next full start.",
+    { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind", "secret_list", "secret_put", "secret_delete", "secret_read", "node_secret_list", "node_secret_put", "node_secret_delete"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
     async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);
       // Separate scoped-secret contract using the existing management lane.
       // No additional tools in model context; ordinary Provider actions unchanged.
       if (action === 'secret_read') return providerReply(getScopedSecrets(human, id));
+      if (action === 'node_secret_list' || action === 'node_secret_put' || action === 'node_secret_delete') {
+        const input = provider as { key?: string; value?: string } | undefined;
+        const result = requestNodeSecrets(human, id, action === 'node_secret_list' ? 'list' : action === 'node_secret_put' ? 'put' : 'delete', input?.key, input?.value, revision);
+        if (result.ok) {
+          const target = db.get<{ alias: string }>('SELECT alias FROM nodes WHERE node_id=?1 AND network_id=?2', id, human.networkId!);
+          if (target) pushEvent(target.alias, { type: 'node_secrets', request_id: result.request_id }, human.networkId!);
+        }
+        return providerReply(result);
+      }
       if (action === 'secret_list' || action === 'secret_put' || action === 'secret_delete') {
         const input = provider as { node_id?: string | null; key?: string; value?: string } | undefined;
         const result = requestScopedSecrets(human, id, input?.node_id ?? null, action === 'secret_list' ? 'list' : action === 'secret_put' ? 'put' : 'delete', input?.key, input?.value, revision);
@@ -4172,9 +4193,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
   server.tool(
-    "pull_daemon_provider_snapshots", "Daemon Provider work; advertise only implemented secure write/collect/apply/login capabilities.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional(), accept_collections: z.boolean().optional(), accept_secrets: z.boolean().optional() },
-    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections, accept_secrets }) => {
+    "pull_daemon_provider_snapshots", "Provider/secret work; opt into implemented capabilities only.", { accept_writes: z.boolean().optional(), accept_applications: z.boolean().optional(), accept_logins: z.boolean().optional(), accept_local_discovery: z.boolean().optional(), accept_collections: z.boolean().optional(), accept_secrets: z.boolean().optional(), accept_node_secrets: z.boolean().optional() },
+    async ({ accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections, accept_secrets, accept_node_secrets }) => {
       const caller = resolveCallerDaemonTokenBound();
+      if (accept_node_secrets) return providerReply(pullNodeSecrets(caller));
       const result = pullProviderSnapshots(caller, accept_writes, accept_applications, accept_logins, accept_local_discovery, accept_collections);
       return providerReply(result.ok && accept_secrets ? { ...result, secret_requests: pullScopedSecrets(caller) } : result);
     },
@@ -4182,7 +4204,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   server.tool(
     "ack_daemon_provider_snapshot", "Target daemon acknowledges redacted Provider configuration readback; fixed failure code only.",
     { request_id: z.string().min(1).max(200), snapshot: z.unknown().optional(), failed: z.boolean().optional(), applied_revision: z.number().int().min(0).optional(), application: z.unknown().optional(), login: z.unknown().optional() },
-    async ({ request_id, snapshot, failed, applied_revision, application, login }) => providerReply(request_id.startsWith('dsk_')
+    async ({ request_id, snapshot, failed, applied_revision, application, login }) => providerReply(request_id.startsWith('nsk_')
+      ? ackNodeSecrets(resolveCallerDaemonTokenBound(), request_id, snapshot, failed)
+      : request_id.startsWith('dsk_')
       ? ackScopedSecrets(resolveCallerDaemonTokenBound(), request_id, snapshot, failed)
       : ackProviderSnapshot(resolveCallerDaemonTokenBound(), request_id, snapshot, failed, applied_revision, application, login)),
   );