@sleep2agi/commhub-server 0.9.0-preview.128 → 0.9.0-preview.129

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.128",
+  "version": "0.9.0-preview.129",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/inbox-caller.ts

@@ -0,0 +1,49 @@
+import { db } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { resolveNodeCaller } from "./create-node.js";
+import { resolveCanonicalAlias } from "./rename.js";
+
+type InboxCaller = {
+  tokenId?: string | null;
+  userId?: string | null;
+  networkId?: string | null;
+  nodeToken: boolean;
+  identityRejected: boolean;
+};
+
+/** Inbox reads and ACKs act as the recipient, not as a dispatch target. */
+export function resolveInboxCaller(alias: string, caller: InboxCaller):
+  { ok: true; alias: string } | { ok: false; error: string } {
+  const denied = { ok: false as const, error: "inbox_identity_mismatch" };
+  if (caller.identityRejected) return denied;
+  const requested = alias.trim();
+  if (caller.nodeToken) {
+    const node = resolveNodeCaller(caller.tokenId);
+    if (node.ok) {
+      if (node.networkId !== caller.networkId) return denied;
+      const canonical = resolveCanonicalAlias(node.networkId, requested).alias;
+      return canonical === node.alias ? { ok: true, alias: node.alias } : denied;
+    }
+    // Registration tokens are network-scoped human tokens, not node tokens.
+    // Missing/foreign/ambiguous node identities never fall back to the issuer.
+    if (node.reason !== "not_a_node_token" || !caller.tokenId) return denied;
+    const token = db.get<{ name: string | null }>(
+      "SELECT name FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL", caller.tokenId,
+    );
+    if (!token || token.name?.startsWith("node:")) return denied;
+  }
+  // Preserve open-development and legacy global-token mode.
+  if (!caller.userId) return { ok: true, alias: requested };
+  const user = db.get<{ username: string }>("SELECT username FROM users WHERE user_id = ?1", caller.userId);
+  if (user?.username === requested) return { ok: true, alias: requested };
+  if (!caller.networkId) return { ok: false, error: "network_id_required" };
+  const role = getUserNetworkRole(caller.userId, caller.networkId);
+  if (!role) return denied;
+  const canonical = resolveCanonicalAlias(caller.networkId, requested).alias;
+  if (role === "owner" || role === "admin") return { ok: true, alias: canonical };
+  const owned = db.get<{ node_id: string }>(
+    "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2 AND owner_user_id = ?3 LIMIT 1",
+    canonical, caller.networkId, caller.userId,
+  );
+  return owned ? { ok: true, alias: canonical } : denied;
+}

package/src/mcp-write-network-resolution.test.ts

@@ -259,6 +259,9 @@ describe("utok multi-network", () => {
 
   test("ack_inbox threads explicit network_id", async () => {
     const { tools } = buildHandlers({ userId: U_MULTI });
+    // This tests network selection with an authorized recipient. Acting as
+    // another owner's recipient is covered by the HTTP identity suite.
+    db.run("UPDATE nodes SET owner_user_id = ?1 WHERE alias = ?2 AND network_id = ?3", [U_MULTI, A1, NET_A]);
     const ib = makeInbox(A1, "x517 g2 ack_inbox");
     const r = await call(tools["ack_inbox"], { alias: A1, message_id: ib, network_id: NET_A });
     expect(r.ok).toBe(true);

package/src/node-caller-identity-http.test.ts

@@ -269,6 +269,73 @@ async function mcpSend(token: string, task: string, from: string | undefined) {
   return tool(token, "send_task", args);
 }
 
+test("inbox recipient: bound identity wins over the token name", async () => {
+  const id = `inbox-bound-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'own inbox', ?3)", [id, otherAlias, NET]);
+  const read = await tool(otherTok.token, "get_inbox", { alias: otherAlias });
+  expect(read.ok).toBe(true);
+  expect(read.messages.some((row: any) => row.id === id)).toBe(true);
+  expect((await tool(otherTok.token, "ack_inbox", { alias: otherAlias, message_id: id })).ok).toBe(true);
+  expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", id)?.acked).toBe(1);
+});
+
+test("inbox recipient: another node and invalid node identities cannot read or ACK", async () => {
+  const id = `inbox-denied-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'private inbox', ?3)", [id, victimAlias, NET]);
+  for (const caller of [otherTok, squatter, boundMissing]) {
+    const read = await tool(caller.token, "get_inbox", { alias: victimAlias });
+    expect(read.ok).toBe(false);
+    expect(read.error).toBe("inbox_identity_mismatch");
+    expect(read.messages).toBeUndefined();
+    const ack = await tool(caller.token, "ack_inbox", { alias: victimAlias, message_id: id });
+    expect(ack.ok).toBe(false);
+    expect(ack.error).toBe("inbox_identity_mismatch");
+    expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", id)?.acked).toBe(0);
+  }
+  expect((await tool(victimTok.token, "ack_inbox", { alias: victimAlias, message_id: id })).ok).toBe(true);
+});
+
+test("inbox recipient: same alias stays inside the token network", async () => {
+  const home = `inbox-net-home-${stamp}`, foreign = `inbox-net-foreign-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'home', ?3)", [home, sharedAlias, NET2]);
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'foreign', ?3)", [foreign, sharedAlias, NET]);
+  const read = await tool(sharedHome.token, "get_inbox", { alias: sharedAlias, network_id: NET });
+  expect(read.ok).toBe(true);
+  expect(read.messages.some((row: any) => row.id === home)).toBe(true);
+  expect(read.messages.some((row: any) => row.id === foreign)).toBe(false);
+  expect((await tool(sharedHome.token, "ack_inbox", { alias: sharedAlias, message_id: foreign, network_id: NET })).ok).toBe(false);
+  expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", foreign)?.acked).toBe(0);
+});
+
+test("inbox recipient: legacy ownerless identity and authorized human access remain", async () => {
+  const id = `inbox-legacy-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'legacy', ?3)", [id, ownerlessAlias, NET]);
+  expect((await tool(ownerlessTok.token, "get_inbox", { alias: ownerlessAlias })).ok).toBe(true);
+  expect((await tool(ownerToken, "get_inbox", { alias: ownerlessAlias, network_id: NET })).ok).toBe(true);
+  expect((await tool(ownerToken, "ack_inbox", { alias: ownerlessAlias, message_id: id, network_id: NET })).ok).toBe(true);
+});
+
+test("inbox recipient: a full-access member cannot act as another owner's node", async () => {
+  const member = register(`inboxmem${stamp}`, "InboxMember123!", undefined, "seed");
+  expect(member.ok).toBe(true);
+  expect(addNetworkMember(NET, member.user!.user_id, "member", ownerId).ok).toBe(true);
+  db.run("UPDATE network_members SET agent_access = 'all' WHERE user_id = ?1 AND network_id = ?2", [member.user!.user_id, NET]);
+  const id = `inbox-member-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'private', ?3)", [id, victimAlias, NET]);
+  for (const name of ["get_inbox", "ack_inbox"]) {
+    const args: Record<string, unknown> = { alias: victimAlias, network_id: NET };
+    if (name === "ack_inbox") args.message_id = id;
+    const result = await tool(member.token!, name, args);
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe("inbox_identity_mismatch");
+  }
+  expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", id)?.acked).toBe(0);
+  const own = `inbox-member-own-${stamp}`;
+  db.run("INSERT INTO inbox (id, session_name, type, content, network_id) VALUES (?1, ?2, 'message', 'own', ?3)", [own, member.user!.username, NET]);
+  expect((await tool(member.token!, "get_inbox", { alias: member.user!.username, network_id: NET })).ok).toBe(true);
+  expect((await tool(member.token!, "ack_inbox", { alias: member.user!.username, message_id: own, network_id: NET })).ok).toBe(true);
+});
+
 test("caller identity boundary: mcp send omits from_session", async () => {
   const task = `boundary omit ${stamp}`;
   const sent = await mcpSend(squatter.token, task, undefined);

package/src/tools.ts

@@ -22,6 +22,7 @@ import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetwork
 import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
+import { resolveInboxCaller } from "./inbox-caller.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
 import { addAgentNetworkScope, addAgentTimelineScope, addNetworkScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { canMessageAgent, restrictedNetworkIds, RESTRICTED_MEMBER_TOOLS, type AgentRef } from "./agent-access.js";
@@ -843,6 +844,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         // anet daemon. Default-stripping zod would drop this otherwise.
         role: z.string().max(64).optional().nullable(),
         scoped_secrets_capable: z.boolean().optional(),
+        // Preserve the runtime's independent-key capability through MCP input
+        // parsing; unknown z.object fields are otherwise silently stripped.
+        node_secrets_capable: z.boolean().optional(),
         // RFC-026 §9.3 / #338 PR3 — daemon self-declare nested under
         // `daemon_capabilities` (canonical shape per existing hub reads
         // at tools.ts:2010/2075 — PR1/PR2 placed these top-level, hub
@@ -1418,13 +1422,18 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "get_inbox",
-    "Get pending commands for your session.",
+    "Read your inbox.",
     {
-      alias: z.string().min(1).max(200).describe("Session alias"),
+      alias: z.string().min(1).max(200).describe("Alias"),
       limit: z.number().min(1).max(100).optional().default(10),
+      network_id: z.string().max(200).optional(),
     },
-    async ({ alias, limit }) => {
-      const readScope = resolveReadScope(null);
+    async ({ alias, limit, network_id: netId }) => {
+      const effectiveNetId = getNetworkId(netId);
+      const recipient = resolveInboxCaller(alias, { tokenId: callerTokenId, userId: enforceUserId, networkId: effectiveNetId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected });
+      if (!recipient.ok) return { content: [{ type: "text" as const, text: JSON.stringify(recipient) }] };
+      alias = recipient.alias;
+      const readScope = resolveReadScope(effectiveNetId);
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
       const countParams: any[] = [alias];
       let countSql = "SELECT COUNT(*) as cnt FROM inbox WHERE session_name = ?1 AND acked = 0";
@@ -1454,9 +1463,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "ack_inbox",
-    "Acknowledge receipt of a command.",
+    "ACK your inbox.",
     {
-      alias: z.string().min(1).max(200).describe("Session alias"),
+      alias: z.string().min(1).max(200).describe("Alias"),
       message_id: z.string().min(1).max(200),
       response: z.string().max(10000).optional(),
       network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
@@ -1464,6 +1473,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     async ({ alias, message_id, response, network_id: netId }) => {
       const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
+      const recipient = resolveInboxCaller(alias, { tokenId: callerTokenId, userId: enforceUserId, networkId: effectiveNetId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected });
+      if (!recipient.ok) return { content: [{ type: "text" as const, text: JSON.stringify(recipient) }] };
+      alias = recipient.alias;
       console.log(`[${ts()}] ${alias} → ack_inbox: ${message_id.slice(0, 8)}`);
       // New task consumers ACK by the logical tasks.task_id exposed by
       // get_inbox. Keep exact inbox.id support for legacy consumers and for
@@ -4131,7 +4143,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const providerHuman = (net?: string) => ({ userId: enforceUserId, isNode: callerTokenIsNetwork, networkId: getNetworkId(net) });
   const providerReply = (value: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(value) }] });
   server.tool(
-    "daemon_provider_snapshot", "Provider read/write/login (no tokens). hub_*=owner catalog/distribute. secret_*=Daemon env; node_secret_*=node env. provider={node_id?,key?,value?}; next full start.",
+    "daemon_provider_snapshot", "Providers, no tokens; hub_*=owner catalog+bind; secret_*=Daemon env; node_secret_*=node env; provider={node_id?,key?,value?}; next full start.",
     { action: z.enum(["refresh", "read", "put", "collect", "apply", "login", "hub_read", "hub_put", "hub_bind", "secret_list", "secret_put", "secret_delete", "secret_read", "node_secret_list", "node_secret_put", "node_secret_delete"]), id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), revision: z.number().int().min(0).optional(), provider: z.unknown().optional(), include_discovery: z.boolean().optional() },
     async ({ action, id, network_id, revision, provider, include_discovery }) => {
       const human = providerHuman(network_id);