@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.130

package/src/api-host-supervisors-runtime-readiness.test.ts

@@ -0,0 +1,195 @@
+// #622 —— daemon 逐 runtime 自检(runtime_readiness)从 report_status 一路走到
+// /api/host-supervisors。三件事:
+//   1. report_status 的 zod 形状收得宽:坏的 runtime_readiness 只丢它自己,
+//      绝不拒掉整份 report(否则一台 daemon 发了个奇怪的诊断字段就在 hub 上失联);
+//   2. 新字段会被**保留**(daemon_capabilities 不是 strict,schema 里没声明的键会被
+//      静默剥掉 —— 不加 schema 就永远到不了 REST);
+//   3. REST 只在 daemon 报了时输出,旧 daemon 的行里**没有**这个键;
+//      can_create_nodes 语义不变。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { register, login } from "./auth.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
+
+function captureToolSchemas(): Record<string, any> {
+  const mcp = new McpServer({ name: "schema-probe", version: "0" }) as any;
+  const schemas: Record<string, any> = {};
+  const origTool = mcp.tool.bind(mcp);
+  mcp.tool = (name: string, desc: string, schema: any, handler: any) => {
+    schemas[name] = schema;
+    return origTool(name, desc, schema, handler);
+  };
+  registerTools(mcp, undefined, null, null, null, false, "tok_schema_probe");
+  return schemas;
+}
+const schemas = captureToolSchemas();
+const snapSchema = () => schemas.report_status.config_snapshot;
+const base = { flags: {}, config_update_capable: false, peer_reply_inbox_capable: true };
+
+const READY = {
+  ok: true, state: "ready", reason: "可以创建", version: "2.1.290",
+  checked_at: "2026-10-06T03:00:00.000Z", cli: "found", auth: "present", network: "reachable",
+};
+const MISSING = {
+  ok: false, state: "missing_cli", reason: "新节点的 PATH 上找不到可用的 grok 命令", checked_at: "2026-10-06T03:00:00.000Z",
+  cli: "missing", auth: "present", network: "skipped",
+};
+
+describe("#622 report_status schema —— runtime_readiness", () => {
+  test("合法值透传(没被 daemon_capabilities 的非 strict 剥掉)", () => {
+    const parsed = snapSchema().parse({ ...base, daemon_capabilities: {
+      can_create_nodes: true,
+      runtime_readiness: { "claude-code-cli": READY, "grok-build-acp": MISSING, "codex-sdk": { ...READY, shared_login_count: 27 } },
+    } });
+    expect(parsed.daemon_capabilities.runtime_readiness["claude-code-cli"].state).toBe("ready");
+    expect(parsed.daemon_capabilities.runtime_readiness["grok-build-acp"].state).toBe("missing_cli");
+    expect(parsed.daemon_capabilities.runtime_readiness["codex-sdk"].shared_login_count).toBe(27);
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+  });
+
+  test("🔴 坏形状绝不拒整份 report —— 只丢这一格", () => {
+    for (const bad of [
+      "string", 42, null, [], { x: "notobj" },
+      Object.fromEntries(Array.from({ length: 40 }, (_, i) => [`rt${i}`, READY])),
+    ]) {
+      const parsed = snapSchema().parse({ ...base, daemon_capabilities: { can_create_nodes: true, runtime_readiness: bad } });
+      expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+      expect(parsed.daemon_capabilities.runtime_readiness).toBeUndefined();
+    }
+  });
+
+  test("单个字段坏:schema 不拒整份;读取侧消毒把它兜成 unknown", () => {
+    const parsed = snapSchema().parse({ ...base, daemon_capabilities: {
+      can_create_nodes: true,
+      runtime_readiness: { a: { ok: "yes", state: 7, reason: "x".repeat(5000), shared_login_count: -3 } },
+    } });
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+    const a = sanitizeRuntimeReadiness(parsed.daemon_capabilities.runtime_readiness)!.a;
+    expect(a.ok).toBe(false);
+    expect(a.state).toBe("unknown");
+    expect(a.reason.length).toBe(600);
+    expect(a.shared_login_count).toBeUndefined();
+  });
+
+  test("总字节超 16 KB:整格丢掉(异常 daemon 不能往库里塞大对象)", () => {
+    const big = { a: { ...READY, reason: "x".repeat(20_000) } };
+    const parsed = snapSchema().parse({ ...base, daemon_capabilities: { can_create_nodes: true, runtime_readiness: big } });
+    expect(parsed.daemon_capabilities.runtime_readiness).toBeUndefined();
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+  });
+});
+
+describe("#622 sanitizeRuntimeReadiness(读取侧)", () => {
+  test("不认识的 state → unknown;ok 只有 ready 时才可能为真", () => {
+    const s = sanitizeRuntimeReadiness({
+      a: { ok: true, state: "something_new", reason: "r" },
+      b: { ok: true, state: "no_network", reason: "r" },
+    })!;
+    expect(s.a.state).toBe("unknown");
+    expect(s.a.ok).toBe(false);
+    expect(s.b.ok).toBe(false);
+  });
+  test("没报 / 空 → undefined(调用方据此不输出键)", () => {
+    expect(sanitizeRuntimeReadiness(undefined)).toBeUndefined();
+    expect(sanitizeRuntimeReadiness({})).toBeUndefined();
+    expect(sanitizeRuntimeReadiness([])).toBeUndefined();
+  });
+  test("未知枚举值的 cli/auth/network 被丢掉", () => {
+    const s = sanitizeRuntimeReadiness({ a: { ...READY, cli: "/home/x/bin/claude", network: "maybe" } })!;
+    expect(s.a.cli).toBeUndefined();
+    expect(s.a.network).toBeUndefined();
+    expect(s.a.auth).toBe("present");
+  });
+  test("generation and accepted stay only on opencode-cli", () => {
+    const s = sanitizeRuntimeReadiness({
+      "opencode-cli": { ...READY, state: "unknown", ok: false, generation: "v2", accepted: false },
+      "claude-code-cli": { ...READY, generation: "v2", accepted: true },
+    })!;
+    expect(s["opencode-cli"].generation).toBe("v2");
+    expect(s["opencode-cli"].accepted).toBe(false);
+    expect(s["claude-code-cli"].generation).toBeUndefined();
+    expect(s["claude-code-cli"].accepted).toBeUndefined();
+    const lone = sanitizeRuntimeReadiness({ "opencode-cli": { ...READY, accepted: true, generation: "nope" } })!;
+    expect(lone["opencode-cli"].generation).toBeUndefined();
+    expect(lone["opencode-cli"].accepted).toBeUndefined();
+  });
+});
+
+let BASE = "";
+let server: any = null;
+let userToken = "";
+let userNetworkId = "";
+let userId = "";
+
+beforeAll(async () => {
+  process.env.HOST = "127.0.0.1";
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const password = "BootstrapPw123Aa!";
+  const seed = register(`rr_seed_${suffix}`, password, undefined, "seed");
+  if (!seed.ok) throw new Error("seed failed");
+  db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`rr_seed_${suffix}`]);
+  const u = register(`rr_u_${suffix}`, password, undefined, "seed");
+  if (!u.ok || !u.token) throw new Error("user register failed");
+  userToken = u.token;
+  userNetworkId = u.network_id ?? "";
+  userId = login(`rr_u_${suffix}`, password).user!.user_id;
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+  await new Promise((r) => setTimeout(r, 100));
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+});
+
+function seedDaemon(alias: string, snapshot: object): void {
+  db.run(
+    `INSERT OR REPLACE INTO nodes (
+       node_id, node_name, alias, runtime, model, config_path,
+       channels, server, hostname, network_id, config_revision, config_snapshot
+     ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
+    [`rr_n_${alias}`, alias, alias, "claude-agent-sdk", null, "/tmp/cfg.json", "[]", "test-host", "test-host",
+     userNetworkId, 0, JSON.stringify(snapshot)],
+  );
+  db.run(
+    `INSERT OR REPLACE INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope)
+     VALUES (?1, ?2, ?3, ?4, ?5, ?6)`,
+    [`rr_t_${alias}`, `hash_rr_${alias}`, userId, userNetworkId, `node:${alias}`, "network"],
+  );
+}
+
+async function listDaemons(): Promise<any[]> {
+  const res = await fetch(`${BASE}/api/host-supervisors`, { headers: { Authorization: `Bearer ${userToken}` } });
+  const body = await res.json();
+  if (!body.ok) throw new Error("list failed: " + JSON.stringify(body));
+  return body.daemons;
+}
+
+describe("#622 /api/host-supervisors 输出 runtime_readiness", () => {
+  test("新 daemon:逐 runtime 透传;can_create_nodes 不受影响", async () => {
+    db.run("DELETE FROM nodes WHERE network_id = ?1", [userNetworkId]);
+    seedDaemon("rr-new", { role: "host_supervisor", daemon_capabilities: {
+      runtimes_supported: ["claude-code-cli", "grok-build-acp"],
+      can_create_nodes: true,
+      runtime_readiness: { "claude-code-cli": READY, "grok-build-acp": MISSING },
+    } });
+    const d = (await listDaemons()).find((x) => x.alias === "rr-new");
+    expect(d.can_create_nodes).toBe(true);
+    expect(d.runtime_readiness["claude-code-cli"]).toEqual(READY);
+    expect(d.runtime_readiness["grok-build-acp"].state).toBe("missing_cli");
+    expect(d.runtime_readiness["grok-build-acp"].ok).toBe(false);
+  });
+
+  test("🔴 旧 daemon(不报):响应里没有这个键 —— 不是 {}、不是 null", async () => {
+    db.run("DELETE FROM nodes WHERE network_id = ?1", [userNetworkId]);
+    seedDaemon("rr-old", { role: "host_supervisor", daemon_capabilities: { runtimes_supported: ["claude-agent-sdk"], can_create_nodes: true } });
+    const d = (await listDaemons()).find((x) => x.alias === "rr-old");
+    expect(d.can_create_nodes).toBe(true);
+    expect("runtime_readiness" in d).toBe(false);
+  });
+});

package/src/api-nodes-shape.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 import { db } from "./db.js";
+import { parseStoredTags } from "./node-attrs-validate.js";
 
 // Regression test for SELECT * fragility on GET /api/nodes.
 //
@@ -41,7 +42,12 @@ function mapRow(r: Record<string, unknown>): Record<string, unknown> {
     catch { /* malformed */ }
   }
   const { config_snapshot, ...rest } = r;
-  return { ...rest, role };
+  return {
+    ...rest,
+    tags: parseStoredTags(r.tags),
+    attrs_revision: Number(r.attrs_revision ?? 0),
+    role,
+  };
 }
 
 describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", () => {
@@ -66,7 +72,7 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
       `SELECT node_id, node_name, alias, runtime, model,
               config_path, channels, server, hostname,
               network_id, created_at, updated_at,
-              config_snapshot
+              config_snapshot, display_name, team, tags, attrs_revision
        FROM nodes WHERE node_id = ?1`,
       TEST_NODE,
     );
@@ -85,11 +91,17 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
     expect(row).not.toHaveProperty("config_snapshot");
     // role is EXTRACTED from config_snapshot JSON, not the raw blob
     expect(row.role).toBe("host_supervisor");
-    // Belt: full key set is exactly the 13 contract fields
+    // Belt: the key set is exactly the dashboard-facing contract.
+    // NOTE: this file MIRRORS the handler's SQL rather than calling it, so
+    // it can drift — it already lagged behind `lifecycle_state` /
+    // `avatar_url`, which the handler selects but this mirror does not.
+    // Treat a diff here as "re-read the handler", not as proof of the wire
+    // shape; node-attrs.test.ts asserts the real HTTP response.
     expect(Object.keys(row).sort()).toEqual([
-      "alias", "channels", "config_path", "created_at", "hostname",
-      "model", "network_id", "node_id", "node_name", "role", "runtime",
-      "server", "updated_at",
+      "alias", "attrs_revision", "channels", "config_path", "created_at",
+      "display_name", "hostname", "model", "network_id", "node_id",
+      "node_name", "role", "runtime", "server", "tags", "team",
+      "updated_at",
     ]);
   });
 
@@ -102,7 +114,8 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
     );
     let row = mapRow(db.get<Record<string, unknown>>(
       `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
-              server, hostname, network_id, created_at, updated_at, config_snapshot
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
        FROM nodes WHERE node_id = ?1`,
       TEST_NODE,
     )!);
@@ -113,7 +126,8 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
     db.run(`UPDATE nodes SET config_snapshot = ?1 WHERE node_id = ?2`, ["not-json{", TEST_NODE]);
     row = mapRow(db.get<Record<string, unknown>>(
       `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
-              server, hostname, network_id, created_at, updated_at, config_snapshot
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
        FROM nodes WHERE node_id = ?1`,
       TEST_NODE,
     )!);
@@ -124,7 +138,8 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
            [JSON.stringify({ model: "x", flags: {} }), TEST_NODE]);
     row = mapRow(db.get<Record<string, unknown>>(
       `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
-              server, hostname, network_id, created_at, updated_at, config_snapshot
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
        FROM nodes WHERE node_id = ?1`,
       TEST_NODE,
     )!);
@@ -141,7 +156,8 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
     );
     const rows = db.all<Record<string, unknown>>(
       `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
-              server, hostname, network_id, created_at, updated_at, config_snapshot
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
        FROM nodes WHERE network_id = ?1`,
       TEST_NETWORK,
     ).map(mapRow);

package/src/auth-password-change-cli-tokens-http.test.ts

@@ -0,0 +1,294 @@
+// #711 改密码只让浏览器 / app 的登录会话下线,命令行和脚本令牌默认保留。
+//
+// main 上 POST /api/auth/password 跑的是 `DELETE FROM api_tokens WHERE user_id = ? AND network_id IS NULL
+// AND token_id != ?` —— 每台机器上 `anet login` 拿到的令牌、POST /api/auth/tokens 建的具名脚本令牌,
+// 跟浏览器会话一起被删光。安全复审定的形状:默认不变,保留是显式选项。这里每条都钉住:
+//   · 默认(旧 app、dashboard 代理不带字段):撤销全部不绑网络的令牌 —— 客户端自报的 cli 也活不下来;
+//   · keep_cli_tokens=true(anet passwd 默认带):只撤其他 kind='login' 会话,保留的 cli 令牌列在响应里、不含令牌值;
+//   · 当前会话(换发后的新令牌)永远可用,而且沿用当前令牌的种类;
+//   · 节点 / 网络令牌永远不动;
+//   · 启动迁移按 client_label / scope 回填存量令牌的 kind(夹具库,跑两遍幂等)。
+// SQLite 由 test798 自动收进;PostgreSQL 由 tests/test2123-hub-postgres-ladder 的 run_pg_tests_rc 跑同一个文件。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { spawnSync } from "child_process";
+import { register, createNetworkTokenForNode, createToken, changePassword } from "./auth.js";
+import { db, hashToken } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-pwchange-kind-"));
+let BASE = "";
+let hub: any = null;
+const PW = "PwChangeKindPassw0rd!";
+const PW2 = "PwChangeKindPassw0rd!2";
+const CLI_LABEL = "anet 2.5.0 · test-box · login";
+
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+const works = async (token: string) => (await call(token, "GET", "/api/auth/me")).status === 200;
+const kindOf = (token: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_hash = ?1", hashToken(token))?.kind ?? null;
+
+type Fleet = {
+  user: string; userId: string; net: string;
+  app: string; appB: string; regToken: string;
+  cliByLabel: string; cliByKind: string; apiToken: string;
+  nodeToken: string; netToken: string;
+};
+
+let seq = 0;
+async function fleet(): Promise<Fleet> {
+  const user = `pwk_${Date.now()}_${++seq}`;
+  const reg = register(user, PW);
+  expect(reg.ok).toBe(true);
+  const login = async (extra: Record<string, unknown>) => {
+    const r = await call("", "POST", "/api/auth/login", { username: user, password: PW, ...extra });
+    expect(r.status).toBe(200);
+    return r.body.token as string;
+  };
+  const node = createNetworkTokenForNode(reg.user!.user_id, reg.network_id!, "pwk-node", `node_pwk_${seq}`);
+  expect(node.ok).toBe(true);
+  const api = createToken(reg.user!.user_id, "ci-script");
+  expect(api.ok).toBe(true);
+  const netTok = createToken(reg.user!.user_id, "net-script", reg.network_id!);
+  expect(netTok.ok).toBe(true);
+  return {
+    user, userId: reg.user!.user_id, net: reg.network_id!,
+    regToken: reg.token!,
+    app: await login({ client_label: "Desktop app" }),
+    appB: await login({}),
+    cliByLabel: await login({ client_label: CLI_LABEL }),
+    cliByKind: await login({ client_kind: "cli" }),
+    apiToken: api.token!,
+    nodeToken: node.token!,
+    netToken: netTok.token!,
+  };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  process.env.COMMHUB_LOGIN_IP_MAX = "1000";
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("new tokens are classified at issue time", () => {
+  test("browser/app logins are 'login'; anet-labelled, client_kind=cli and named API tokens are 'cli'; node tokens unclassified", async () => {
+    const f = await fleet();
+    expect(kindOf(f.regToken)).toBe("login");
+    expect(kindOf(f.app)).toBe("login");
+    expect(kindOf(f.appB)).toBe("login");
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.nodeToken)).toBe(null);
+    expect(kindOf(f.netToken)).toBe(null);
+  });
+});
+
+// 响应里出现任何令牌值都算泄漏:换发给调用方的那一条(body.token)除外,它本来就要交给调用方。
+function assertNoTokenValues(body: any, f: Fleet) {
+  const { token: _rotated, ...rest } = body;
+  const text = JSON.stringify(rest);
+  for (const t of [f.regToken, f.app, f.appB, f.cliByLabel, f.cliByKind, f.apiToken, f.nodeToken, f.netToken]) {
+    expect(text.includes(t)).toBe(false);
+  }
+  expect(/\b(utok|atok|ntok)_[A-Za-z0-9]{8,}/.test(text)).toBe(false);
+  expect(text.includes("token_hash")).toBe(false);
+}
+
+describe("POST /api/auth/password (default: old apps, dashboard proxy — no field)", () => {
+  test("every other non-network token is revoked (pre-#711 behaviour); node tokens and the rotated current session survive", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+    expect(r.body.revoked_login).toBe(2); // reg + appB
+    expect(r.body.revoked_cli).toBe(3);   // cliByLabel + cliByKind + apiToken
+    expect(r.body.revoked).toBe(5);
+    expect(r.body.kept_cli_tokens).toBeUndefined();
+    for (const t of [f.regToken, f.appB, f.cliByLabel, f.cliByKind, f.apiToken]) expect(await works(t)).toBe(false);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("login");
+    expect(await works(f.app)).toBe(false);
+  });
+
+  test("a client-declared cli token (client_kind / anet label) does NOT survive a default password change", async () => {
+    const f = await fleet();
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.cliByLabel)).toBe(false);
+  });
+
+  test("a non-boolean keep_cli_tokens is not an opt-in; the removed revoke_cli_tokens field does nothing", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: "true", revoke_cli_tokens: false });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_cli).toBe(3);
+    expect(await works(f.cliByLabel)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+});
+
+describe("POST /api/auth/password with keep_cli_tokens=true (anet passwd)", () => {
+  test("only other login sessions are revoked; CLI/script tokens are kept and listed without token values", async () => {
+    const f = await fleet();
+    const r = await call(f.cliByLabel, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: true });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_login).toBe(3); // reg + app + appB
+    expect(r.body.revoked_cli).toBe(0);
+    expect(r.body.revoked).toBe(3);
+    for (const t of [f.regToken, f.app, f.appB]) expect(await works(t)).toBe(false);
+    expect(await works(f.cliByKind)).toBe(true);
+    expect(await works(f.apiToken)).toBe(true);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    // 当前会话:换发的新令牌可用,沿用 cli
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("cli");
+    // 保留清单:不含当前这条(它已被换掉),只含另外两条 cli;字段齐全、无令牌值
+    const kept = r.body.kept_cli_tokens as any[];
+    const idOf = (t: string) => db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(t)).token_id;
+    expect(kept.map((k) => k.token_id).sort()).toEqual([idOf(f.cliByKind), idOf(f.apiToken)].sort());
+    for (const k of kept) {
+      expect(Object.keys(k).sort()).toEqual(["client_label", "created_at", "last_used_at", "name", "token_id"]);
+      expect(k.token_id).toMatch(/^tok_[0-9a-f]{12}$/);
+    }
+    expect(kept.find((k) => k.token_id === idOf(f.apiToken)).name).toBe("ci-script");
+    assertNoTokenValues(r.body, f);
+    // 可以逐条撤销
+    expect((await call(r.body.token, "DELETE", `/api/auth/tokens/${idOf(f.apiToken)}`)).status).toBe(200);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  test("default response carries no token values either", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    assertNoTokenValues(r.body, f);
+  });
+});
+
+describe("changePassword() keeps the current token row in both modes", () => {
+  test("no opts at all = default: CLI tokens revoked, current kept", async () => {
+    const f = await fleet();
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur);
+    expect(r.ok).toBe(true);
+    expect(r.revoked_cli).toBe(3);
+    expect(r.kept_cli_tokens).toBeUndefined();
+    expect(await works(f.app)).toBe(true);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  for (const keepCliTokens of [false, true]) {
+    test(`keepCliTokens=${keepCliTokens}: current login token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.app)).toBe(true);
+      expect(await works(f.appB)).toBe(false);
+      expect(await works(f.cliByLabel)).toBe(keepCliTokens);
+      expect(await works(f.nodeToken)).toBe(true);
+    });
+    test(`keepCliTokens=${keepCliTokens}: current CLI token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.cliByKind)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.cliByKind)).toBe(true);
+      expect(await works(f.app)).toBe(false);
+      expect(await works(f.apiToken)).toBe(keepCliTokens);
+    });
+  }
+});
+
+describe("startup migration backfills api_tokens.kind on a fixture DB", () => {
+  // 把 kind 列拿掉 = 回到 #711 之前的表结构;塞存量行;再起一个进程加载 db.ts(= Hub 启动迁移)。
+  function bootMigration() {
+    const r = spawnSync(process.execPath, ["-e", `await import(${JSON.stringify(join(import.meta.dir, "db.ts"))}); process.exit(0);`], {
+      cwd: join(import.meta.dir, ".."),
+      env: { ...process.env, NODE_ENV: "test" },
+      encoding: "utf8",
+      timeout: 60_000,
+    });
+    if (r.status !== 0) console.log(String(r.stderr || "").slice(-2000));
+    return r.status;
+  }
+
+  test("anet-labelled and named API tokens → cli, everything else → login, node tokens untouched; idempotent", async () => {
+    const f = await fleet();
+    db.exec("ALTER TABLE api_tokens DROP COLUMN kind");
+    const ins = (id: string, net: string | null, scope: string, label: string | null) =>
+      db.run(
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, 'fixture', ?5, ?6, 1)",
+        [id, hashToken(`fixture-${id}`), f.userId, net, scope, label],
+      );
+    const id = (s: string) => `tok_fx_${seq}_${s}`;
+    ins(id("cli_label"), null, "user", "anet 2.4.0 · old-box · login");
+    ins(id("cli_demo"), null, "user", "anet dev · unknown-host · demo sci-team");
+    ins(id("browser"), null, "user", "Chrome on macOS");
+    ins(id("nolabel"), null, "user", null);
+    ins(id("lookalike"), null, "user", "planet-anet dashboard");
+    ins(id("upper"), null, "user", "ANET 2.4.0 · box · login");
+    ins(id("padded"), null, "user", "  anet 2.4.0 · box · login");
+    ins(id("named"), null, "full", null);
+    ins(id("node"), f.net, "network", null);
+    ins(id("netfull"), f.net, "full", null);
+
+    expect(bootMigration()).toBe(0);
+    const k = (s: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_id = ?1", id(s))?.kind ?? null;
+    expect(k("cli_label")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe("login");
+    expect(k("nolabel")).toBe("login");
+    expect(k("lookalike")).toBe("login");
+    expect(k("upper")).toBe("login");   // 区分大小写:SQLite 的 LIKE 会把它当 cli,PG 不会 —— 两边必须一致
+    expect(k("padded")).toBe("cli");    // 与运行时一样先 trim
+    expect(k("named")).toBe("cli");
+    expect(k("node")).toBe(null);
+    expect(k("netfull")).toBe(null);
+    // fleet() 的 live 令牌也被回填(列重建后原值丢了,按同一规则算回来)
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.app)).toBe("login");
+
+    // 幂等:已有值不被改写(手动改成 login 的 anet 行保持 login),再跑一次结果不变
+    db.run("UPDATE api_tokens SET kind = 'login' WHERE token_id = ?1", [id("cli_label")]);
+    expect(bootMigration()).toBe(0);
+    expect(k("cli_label")).toBe("login");
+    expect(k("named")).toBe("cli");
+    expect(k("browser")).toBe("login");
+
+    // 迁移后的库上,keep_cli_tokens 保留回填成 cli 的存量令牌
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens: true });
+    expect(r.ok).toBe(true);
+    expect(k("named")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe(null); // 被撤销(行已删除)
+    expect(k("node")).toBe(null);
+    expect(Number(db.get<any>("SELECT COUNT(*) AS n FROM api_tokens WHERE token_id = ?1", id("node")).n)).toBe(1);
+  }, 120_000);
+});