@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.130

package/src/daemon-provider-snapshots.ts

@@ -0,0 +1,327 @@
+// #906: human-requested readback of ONE daemon's private Provider metadata.
+// Hub registry is not a fallback. No credential values enter this protocol.
+import { createHash, randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from 'node:util';
+import { db } from "./db";
+import { getUserNetworkRole } from "./auth";
+import { validateDaemonProviderSnapshot } from "./shared/daemon-provider-snapshot";
+import { encryptSecret, decryptSecret, VaultError } from './vault';
+import { buildControllableMap } from './node-lifecycle-controllable';
+import { validProviderApplicationSelection, validProviderApplicationReceipt, type ProviderApplicationSelection } from './shared/provider-application';
+import { validLoginIntent, validLoginReceipt } from './shared/daemon-provider-login';
+import { validProviderCollection, type ProviderCollection } from './shared/provider-collection';
+
+export function providerScanTargets(networkId: string, daemonId: string) {
+  const ownership = buildControllableMap(
+    db.all<{ request_id: string; daemon_node_id: string }>('SELECT request_id,daemon_node_id FROM node_create_requests WHERE network_id=?1', networkId),
+    db.all<{ node_id: string; daemon_node_id: string }>('SELECT node_id,daemon_node_id FROM node_daemon_bindings WHERE network_id=?1 AND status=\'active\'', networkId));
+  const targets = db.all<{ node_id: string; alias: string }>('SELECT node_id,alias FROM nodes WHERE network_id=?1 ORDER BY node_id', networkId)
+    .filter(n => ownership.get(n.node_id) === daemonId && typeof n.alias === 'string');
+  if (targets.length > 200) throw Error('inventory_limit'); // no silent incomplete denominator
+  return targets;
+}
+
+type Human = { userId?: string | null; isNode: boolean; networkId: string | null };
+type Daemon = { ok: false; error: string } | { ok: true; networkId: string; daemonNodeId: string; daemonAlias: string };
+type Row = { request_id: string; network_id: string; daemon_node_id: string; status: string;
+  created_at: number; expires_at: number; observed_at: number | null; snapshot_json: string | null; error: string | null };
+const denied = (error: string) => ({ ok: false as const, error });
+function authorize(h: Human) {
+  if (h.isNode || !h.userId) return denied("user_token_required");
+  if (!h.networkId || !["owner", "admin"].includes(getUserNetworkRole(h.userId, h.networkId) || "")) return denied("provider_admin_required");
+  return null;
+}
+function daemonExists(networkId: string, nodeId: string): boolean {
+  const node = db.get<{ config_snapshot: string }>(
+    `SELECT n.config_snapshot FROM nodes n WHERE n.node_id=?1 AND n.network_id=?2
+      AND EXISTS (SELECT 1 FROM api_tokens t WHERE t.network_id=n.network_id
+        AND t.name='node:' || n.alias AND t.revoked_at IS NULL
+        AND (t.expires_at IS NULL OR t.expires_at > datetime('now')))`, nodeId, networkId);
+  try { return JSON.parse(node?.config_snapshot || "{}").role === "host_supervisor"; } catch { return false; }
+}
+function expire(networkId: string, daemonId?: string) {
+  // Device-code instructions are short-lived; do not leave them in audit history.
+  db.run(`UPDATE daemon_provider_snapshots SET status='expired', snapshot_json=NULL, error='request_expired'
+    WHERE network_id=?1 AND request_id LIKE 'dpl_%' AND expires_at <= ?2`, [networkId, Date.now()]);
+  db.run(`UPDATE daemon_provider_snapshots SET status='expired', error='request_expired'
+    WHERE network_id=?1 AND status='pending' AND expires_at <= ?2
+    AND (?3 IS NULL OR daemon_node_id=?3)`, [networkId, Date.now(), daemonId ?? null]);
+  db.run(`DELETE FROM daemon_provider_writes WHERE request_id IN
+    (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
+  db.run(`DELETE FROM daemon_provider_applications WHERE request_id IN
+    (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
+  db.run(`DELETE FROM daemon_provider_logins WHERE request_id IN
+    (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND status!='pending')`, [networkId]);
+  db.run(`DELETE FROM daemon_provider_snapshots WHERE network_id=?1 AND expires_at < ?2`, [networkId, Date.now() - 7 * 86400_000]);
+}
+/** Validate the complete public projection before encrypting the private input. */
+function validateWrite(provider: any, networkId: string, daemonId: string) {
+  if (Buffer.byteLength(JSON.stringify(provider) || '') > 64 * 1024) throw new Error('invalid_provider');
+  const publicProvider = { ...provider, runtimes: provider?.runtimes?.map((r: any) => ({ ...r,
+    auth: r.auth?.map((a: any) => {
+      const { key, ...rest } = a;
+      if (a.kind === 'chatgpt' && key !== undefined) throw new Error('invalid_provider');
+      if (key !== undefined && (typeof key !== 'string' || !key || key.length > 8192 || /[\s\x00-\x1f\x7f]/.test(key))) throw new Error('invalid_provider');
+      // Only CLI write fields may be supplied; public-state flags are not writable.
+      if (Object.keys(a).some(k => !['id','kind','models','baseUrl','key','account_id'].includes(k))) throw new Error('invalid_provider');
+      // A bound login write must be confirmed present by its owning daemon;
+      // this projection is the expected receipt, not an independent Hub claim.
+      return { ...rest, credential_present: a.kind === 'api_key' || (a.kind === 'chatgpt' && a.account_id !== undefined), verification: 'not_checked', application: 'not_applied' };
+    }),
+  })) };
+  validateDaemonProviderSnapshot({ network_id: networkId, daemon_node_id: daemonId, source: 'daemon', revision: 0, providers: [publicProvider] }, networkId, daemonId);
+  return publicProvider;
+}
+export function requestProviderWrite(h: Human, daemonId: string, expectedRevision: number, provider: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0 || expectedRevision >= Number.MAX_SAFE_INTEGER) return denied('invalid_revision');
+  try { validateWrite(provider, h.networkId!, daemonId); } catch { return denied('invalid_provider'); }
+  expire(h.networkId!, daemonId);
+  if (db.get('SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status=\'pending\'', h.networkId!, daemonId)) return denied('provider_snapshot_busy');
+  try {
+    const enc = encryptSecret(JSON.stringify({ network_id: h.networkId, daemon_node_id: daemonId, provider }));
+    const requestId = `dps_${randomUUID()}`, now = Date.now();
+    db.transaction(() => {
+      db.run(`INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+        VALUES (?1,?2,?3,?4,'pending',?5,?6)`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+      db.run(`INSERT INTO daemon_provider_writes (request_id,expected_revision,ciphertext,iv,tag) VALUES (?1,?2,?3,?4,?5)`,
+        [requestId, expectedRevision, enc.ciphertext, enc.iv, enc.tag]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 120_000 };
+  } catch (error) { return denied(error instanceof VaultError ? error.code : 'provider_write_unavailable'); }
+}
+function privateWrite(requestId: string, networkId: string, daemonId: string) {
+  const row = db.get<{ expected_revision: number; ciphertext: any; iv: any; tag: any }>('SELECT * FROM daemon_provider_writes WHERE request_id=?1', requestId);
+  if (!row) return null;
+  const payload = JSON.parse(decryptSecret({ ciphertext: Buffer.from(row.ciphertext), iv: Buffer.from(row.iv), tag: Buffer.from(row.tag) }));
+  if (payload.network_id !== networkId || payload.daemon_node_id !== daemonId) throw new Error('scope_mismatch');
+  if (payload.operation === 'collect') {
+    if (!validProviderCollection(payload.selection)) throw Error('invalid_provider_collection');
+    return { expected_revision: row.expected_revision, operation: 'collect' as const, selection: payload.selection };
+  }
+  validateWrite(payload.provider, networkId, daemonId);
+  return { expected_revision: row.expected_revision, operation: 'put' as const, provider: payload.provider };
+}
+function boundCollectionTarget(networkId: string, daemonId: string, selection: ProviderCollection) {
+  return selection.node_id !== daemonId && providerScanTargets(networkId, daemonId)
+    .some(n => n.node_id === selection.node_id && n.alias === selection.alias);
+}
+export function requestProviderCollection(h: Human, daemonId: string, revision: number, selection: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!Number.isSafeInteger(revision) || revision < 0 || revision >= Number.MAX_SAFE_INTEGER) return denied('invalid_revision');
+  if (!validProviderCollection(selection)) return denied('invalid_provider_collection');
+  try {
+    if (!boundCollectionTarget(h.networkId!, daemonId, selection)) return denied('collection_target_not_bound');
+    expire(h.networkId!, daemonId);
+    if (db.get("SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending'", h.networkId!, daemonId)) return denied('provider_snapshot_busy');
+    // Reuse the short-lived write queue, but no credential is supplied to Hub.
+    const enc = encryptSecret(JSON.stringify({ network_id: h.networkId, daemon_node_id: daemonId, operation: 'collect', selection }));
+    const requestId = `dps_${randomUUID()}`, now = Date.now();
+    db.transaction(() => {
+      db.run("INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at) VALUES (?1,?2,?3,?4,'pending',?5,?6)",
+        [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+      db.run('INSERT INTO daemon_provider_writes (request_id,expected_revision,ciphertext,iv,tag) VALUES (?1,?2,?3,?4,?5)',
+        [requestId, revision, enc.ciphertext, enc.iv, enc.tag]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 120_000 };
+  } catch (error) { return denied(error instanceof VaultError ? error.code : 'provider_collection_unavailable'); }
+}
+function applicationIntent(requestId: string) {
+  const row = db.get<{ expected_revision: number; selection_json: string }>('SELECT * FROM daemon_provider_applications WHERE request_id=?1', requestId);
+  if (!row) return null;
+  const selection = JSON.parse(row.selection_json);
+  if (!validProviderApplicationSelection(selection)) throw Error('invalid_application');
+  return { expected_revision: row.expected_revision, selection };
+}
+function boundApplicationTarget(networkId: string, daemonId: string, selection: ProviderApplicationSelection) {
+  return selection.node_id !== daemonId && providerScanTargets(networkId, daemonId).find(n => n.node_id === selection.node_id);
+}
+export function requestProviderApplication(h: Human, daemonId: string, revision: number, selection: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!Number.isSafeInteger(revision) || revision < 0) return denied('invalid_revision');
+  if (!validProviderApplicationSelection(selection)) return denied('invalid_application');
+  try {
+    if (!boundApplicationTarget(h.networkId!, daemonId, selection)) return denied('application_target_not_bound');
+    expire(h.networkId!, daemonId);
+    const requestId = `dpa_${randomUUID()}`, now = Date.now();
+    db.transaction(() => {
+      db.run(`INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+        VALUES (?1,?2,?3,?4,'pending',?5,?6)`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 600_000]);
+      db.run('INSERT INTO daemon_provider_applications (request_id,expected_revision,selection_json) VALUES (?1,?2,?3)',
+        [requestId, revision, JSON.stringify(selection)]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 600_000 };
+  } catch { return denied('provider_application_unavailable'); }
+}
+export function requestProviderSnapshot(h: Human, daemonId: string) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied("daemon_not_found");
+  expire(h.networkId!, daemonId);
+  // Repeated refresh clicks share the pending request; pending never means ready.
+  const pending = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending' ORDER BY created_at DESC LIMIT 1`, h.networkId!, daemonId);
+  if (pending) return { ok: true as const, request_id: pending.request_id, status: "pending", expires_at: pending.expires_at };
+  const requestId = `dps_${randomUUID()}`, now = Date.now();
+  db.run(`INSERT INTO daemon_provider_snapshots
+    (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+    VALUES (?1,?2,?3,?4,'pending',?5,?6) ON CONFLICT DO NOTHING`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+  const accepted = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending'`, h.networkId!, daemonId);
+  if (!accepted) return denied("provider_snapshot_busy");
+  return { ok: true as const, request_id: accepted.request_id, status: "pending", expires_at: accepted.expires_at };
+}
+export function requestProviderLogin(h: Human, daemonId: string, intent: unknown) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  if (!daemonExists(h.networkId!, daemonId)) return denied('daemon_not_found');
+  if (!validLoginIntent(intent)) return denied('invalid_login_intent');
+  expire(h.networkId!, daemonId);
+  const requestId = `dpl_${randomUUID()}`, now = Date.now();
+  try {
+    db.transaction(() => {
+      db.run(`INSERT INTO daemon_provider_snapshots (request_id,network_id,daemon_node_id,requested_by,status,created_at,expires_at)
+        VALUES (?1,?2,?3,?4,'pending',?5,?6)`, [requestId, h.networkId!, daemonId, h.userId!, now, now + 120_000]);
+      db.run('INSERT INTO daemon_provider_logins (request_id,intent_json) VALUES (?1,?2)', [requestId, JSON.stringify(intent)]);
+    });
+    return { ok: true as const, request_id: requestId, status: 'pending', expires_at: now + 120_000 };
+  } catch { return denied('provider_snapshot_busy'); }
+}
+export function getProviderSnapshot(h: Human, requestId: string, includeDiscovery = false) {
+  const refusal = authorize(h); if (refusal) return refusal;
+  expire(h.networkId!);
+  const row = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE request_id=?1 AND network_id=?2`, requestId, h.networkId!);
+  if (!row) return denied("request_not_found");
+  const snapshot = !/^dp[al]_/.test(row.request_id) && row.snapshot_json ? JSON.parse(row.snapshot_json) : null;
+  // Old clients validate an exact contract. Their default projection stays unchanged.
+  if (!includeDiscovery && snapshot?.codex_inventory) delete snapshot.codex_inventory.local_discovery;
+  return { ok: true, request_id: row.request_id, daemon_node_id: row.daemon_node_id, status: row.status,
+    expires_at: row.expires_at, observed_at: row.observed_at, error: row.error,
+    snapshot,
+    ...(row.request_id.startsWith('dpl_') ? { login: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}),
+    ...(row.request_id.startsWith('dpa_') ? { application: row.snapshot_json ? JSON.parse(row.snapshot_json) : null } : {}) };
+}
+export function pullProviderSnapshots(d: Daemon, acceptWrites = false, acceptApplications = false, acceptLogins = false, acceptDiscovery = false, acceptCollections = false) {
+  if (!d.ok) return denied("caller_not_a_daemon");
+  if (!daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
+  expire(d.networkId, d.daemonNodeId);
+  const requests = db.all<{ request_id: string; expires_at: number }>(`SELECT request_id,expires_at FROM daemon_provider_snapshots
+    WHERE network_id=?1 AND daemon_node_id=?2 AND status='pending' ORDER BY created_at LIMIT 20`, d.networkId, d.daemonNodeId);
+  try { return { ok: true, requests: requests.flatMap<Record<string, unknown>>(r => {
+    if (r.request_id.startsWith('dpl_')) {
+      if (!acceptLogins) return [];
+      const row = db.get<{ intent_json: string }>('SELECT intent_json FROM daemon_provider_logins WHERE request_id=?1', r.request_id);
+      const intent = row && JSON.parse(row.intent_json);
+      if (!validLoginIntent(intent)) throw Error('invalid_login_intent');
+      return [{ ...r, operation: 'login', intent }];
+    }
+    if (r.request_id.startsWith('dpa_')) {
+      if (!acceptApplications) return []; // old daemons must not consume applications as scans
+      const application = applicationIntent(r.request_id);
+      const target = application && boundApplicationTarget(d.networkId, d.daemonNodeId, application.selection);
+      if (!target) {
+        db.run("UPDATE daemon_provider_snapshots SET status='failed',error='application_target_not_bound',observed_at=?1 WHERE request_id=?2 AND status='pending'", [Date.now(), r.request_id]);
+        db.run('DELETE FROM daemon_provider_applications WHERE request_id=?1', [r.request_id]);
+        return [];
+      }
+      return [{ ...r, operation: 'apply', ...application!, alias: target.alias }];
+    }
+    const write = privateWrite(r.request_id, d.networkId, d.daemonNodeId);
+    if (write?.operation === 'collect') {
+      if (!acceptCollections) return []; // old write-capable daemons cannot consume collection as put/scan
+      if (!boundCollectionTarget(d.networkId, d.daemonNodeId, write.selection)) {
+        db.run("UPDATE daemon_provider_snapshots SET status='failed',error='collection_target_not_bound',observed_at=?1 WHERE request_id=?2 AND status='pending'", [Date.now(), r.request_id]);
+        db.run('DELETE FROM daemon_provider_writes WHERE request_id=?1', [r.request_id]);
+        return [];
+      }
+    } else if (write && !acceptWrites) return [];
+    return [write ? { ...r, ...write } : { ...r, scan_targets: providerScanTargets(d.networkId, d.daemonNodeId), ...(acceptDiscovery ? { discover_local: true } : {}) }];
+  }) }; } catch { return denied('provider_write_unavailable'); }
+}
+export function ackProviderSnapshot(d: Daemon, requestId: string, snapshot?: unknown, failed = false, appliedRevision?: number, application?: unknown, login?: unknown) {
+  if (!d.ok || !daemonExists(d.networkId, d.daemonNodeId)) return denied("caller_not_a_daemon");
+  expire(d.networkId, d.daemonNodeId);
+  const row = db.get<Row>(`SELECT * FROM daemon_provider_snapshots WHERE request_id=?1 AND network_id=?2 AND daemon_node_id=?3`, requestId, d.networkId, d.daemonNodeId);
+  if (!row) return denied("request_not_found");
+  // First accepted receipt wins; reconnect replay cannot rewrite prior evidence.
+  if (row.status !== "pending") return { ok: row.status === "succeeded" || row.status === "failed", status: row.status };
+  if (requestId.startsWith('dpl_')) {
+    if (snapshot !== undefined || application !== undefined || appliedRevision !== undefined || (failed && login !== undefined)) return denied('invalid_login_receipt');
+    const intentRow = db.get<{ intent_json: string }>('SELECT intent_json FROM daemon_provider_logins WHERE request_id=?1', requestId);
+    const intent = intentRow && JSON.parse(intentRow.intent_json);
+    if (!failed && (!validLoginIntent(intent) || !validLoginReceipt(login, intent, d.networkId, d.daemonNodeId))) return denied('invalid_login_receipt');
+    db.run(`UPDATE daemon_provider_snapshots SET status=?1,snapshot_json=?2,error=?3,observed_at=?4
+      WHERE request_id=?5 AND status='pending'`, [failed ? 'failed' : 'succeeded', failed ? null : JSON.stringify(login),
+      failed ? 'provider_login_unavailable' : null, Date.now(), requestId]);
+    db.run('DELETE FROM daemon_provider_logins WHERE request_id=?1', [requestId]);
+    return { ok: true, status: failed ? 'failed' : 'succeeded' };
+  }
+  if (login !== undefined) return denied('invalid_login_receipt');
+  if (requestId.startsWith('dpa_')) {
+    if (snapshot !== undefined || appliedRevision !== undefined || (failed && application !== undefined)) return denied('invalid_application_receipt');
+    if (!failed) {
+      try {
+        const intent = applicationIntent(requestId);
+        if (!intent || !boundApplicationTarget(d.networkId, d.daemonNodeId, intent.selection)
+          || !validProviderApplicationReceipt(application, requestId, intent.expected_revision, intent.selection)
+          || (application as any).runtime_provider !== (intent.selection.account_id ? 'openai' : `anet_${createHash('sha256').update(JSON.stringify([intent.selection.provider_id, intent.selection.auth_id])).digest('hex').slice(0, 20)}`)
+          || (application as any).applied_at < row.created_at - 30_000) return denied('invalid_application_receipt');
+      } catch { return denied('invalid_application_receipt'); }
+    }
+    db.run(`UPDATE daemon_provider_snapshots SET status=?1,snapshot_json=?2,error=?3,observed_at=?4
+      WHERE request_id=?5 AND status='pending'`, [failed ? 'failed' : 'succeeded', failed ? null : JSON.stringify(application),
+      failed ? 'provider_application_unavailable' : null, Date.now(), requestId]);
+    db.run('DELETE FROM daemon_provider_applications WHERE request_id=?1', [requestId]);
+    return { ok: true, status: failed ? 'failed' : 'succeeded' };
+  }
+  if (application !== undefined) return denied('invalid_application_receipt');
+  let safe: unknown = null;
+  if (failed && snapshot !== undefined) return denied("invalid_provider_snapshot");
+  if (!failed) {
+    try { safe = validateDaemonProviderSnapshot(snapshot, d.networkId, d.daemonNodeId); }
+    catch { return denied("invalid_provider_snapshot"); }
+    if ((safe as any).codex_inventory) {
+      try {
+        const targets = new Map(providerScanTargets(d.networkId, d.daemonNodeId).map(n => [n.node_id, n.alias]));
+        const rows = (safe as any).codex_inventory.rows;
+        if (rows.length !== targets.size || rows.some((r: any) => targets.get(r.node_id) !== r.alias)) return denied('invalid_provider_snapshot');
+        const local = (safe as any).codex_inventory.local_discovery;
+        if (local) {
+          const registered = new Map(db.all<{ node_id: string; alias: string }>('SELECT node_id,alias FROM nodes WHERE network_id=?1', d.networkId).map(n => [n.node_id, n.alias]));
+          const ownership = buildControllableMap(
+            db.all<{ request_id: string; daemon_node_id: string }>('SELECT request_id,daemon_node_id FROM node_create_requests WHERE network_id=?1', d.networkId),
+            db.all<{ node_id: string; daemon_node_id: string }>("SELECT node_id,daemon_node_id FROM node_daemon_bindings WHERE network_id=?1 AND status='active'", d.networkId));
+          // Filesystem discovery is not control authority. Other-daemon and
+          // unregistered identities cannot enter this network's public receipt.
+          local.rows = local.rows.filter((r: any) => registered.get(r.node_id) === r.alias && !ownership.has(r.node_id));
+        }
+      } catch { return denied('invalid_provider_snapshot'); }
+    }
+    try {
+      const write = privateWrite(requestId, d.networkId, d.daemonNodeId);
+      if (write) {
+        const actual = safe as any;
+        if (appliedRevision !== write.expected_revision + 1 || actual.revision !== appliedRevision) return denied('provider_write_unconfirmed');
+        if (write.operation === 'collect') {
+          if (!boundCollectionTarget(d.networkId, d.daemonNodeId, write.selection)) return denied('collection_target_not_bound');
+          const saved = actual.providers.find((p: any) => p.id === write.selection.provider_id);
+          const auth = saved?.runtimes.find((r: any) => r.runtime === 'codex-tui')?.auth.find((a: any) => a.id === write.selection.auth_id);
+          if (saved?.label !== write.selection.label.trim() || auth?.kind !== 'api_key' || auth.credential_present !== true
+            || auth.models.length !== 1 || auth.verification !== 'not_checked' || auth.application !== 'not_applied') return denied('provider_write_unconfirmed');
+        } else {
+        const expected = validateWrite(write.provider, d.networkId, d.daemonNodeId);
+        const saved = actual.providers.find((p: any) => p.id === expected.id);
+        // CLI canonicalizes label and endpoint. No credential is compared or returned here.
+        expected.label = expected.label.trim();
+        for (const r of expected.runtimes) for (const a of r.auth) if (a.baseUrl) a.baseUrl = new URL(a.baseUrl).toString().replace(/\/$/, '');
+        if (!isDeepStrictEqual(saved, expected)) return denied('provider_write_unconfirmed');
+        }
+      }
+    } catch { return denied('provider_write_unconfirmed'); }
+  }
+  db.run(`UPDATE daemon_provider_snapshots SET status=?1, snapshot_json=?2, error=?3, observed_at=?4
+    WHERE request_id=?5 AND status='pending'`, [failed ? "failed" : "succeeded", safe ? JSON.stringify(safe) : null,
+    failed ? "provider_snapshot_unavailable" : null, Date.now(), requestId]);
+  const accepted = db.get<Row>("SELECT * FROM daemon_provider_snapshots WHERE request_id=?1", requestId);
+  db.run('DELETE FROM daemon_provider_writes WHERE request_id=?1', [requestId]);
+  return { ok: true, status: accepted!.status };
+}

package/src/daemon-token-owner-http.test.ts

@@ -0,0 +1,236 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { nodeTokenReissueError } from "../../agent-network/src/cli-errors";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync("/tmp/owner678-")}/hub.db`;
+let db: any, hub: ReturnType<typeof Bun.serve>, base: string;
+let owner: any, member: any, outsider: any, legacy: string, mismatched: string, bound: string;
+let wrongBound: string, ownerless: string, revoked: string, crossNetwork: string, requestId: string;
+const daemon = "n_owner_fixture_daemon", child = "n_owner_fixture_child";
+
+async function call(token: string, name: string, args: Record<string, unknown> = {}) {
+  const response = await fetch(`${base}/mcp`, {
+    method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  expect(response.status).toBe(200);
+  const raw = await response.text(), lines = raw.split("\n").filter(line => line.startsWith("data:"));
+  const message = JSON.parse(lines.length ? lines.at(-1)!.slice(5) : raw);
+  expect(message.error).toBeUndefined();
+  return JSON.parse(message.result.content[0].text);
+}
+async function mint(token: string, network: string, name: string, nodeId?: string) {
+  const response = await fetch(`${base}/api/auth/node-token`, { method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ network_id: network, node_name: name, ...(nodeId ? { node_id: nodeId } : {}) }),
+  });
+  return { status: response.status, body: await response.json() as any };
+}
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const { generateNetworkToken, hashToken } = await import("./db.js");
+  owner = register("owner678", "Fixture-Strong1!");
+  member = register("member678", "Fixture-Strong1!");
+  outsider = register("outside678", "Fixture-Strong1!");
+  db.run("UPDATE users SET role='user' WHERE user_id IN (?1,?2)", [member.user.user_id, outsider.user.user_id]);
+  db.run("INSERT INTO network_members(network_id,user_id,role) VALUES(?1,?2,'member')", [owner.network_id, member.user.user_id]);
+  for (const id of [daemon, child, "n_ownerless_fixture"]) {
+    db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state)
+      VALUES(?1,?1,?1,?2,?3,'fixture-host',?4,'active')`, [id, owner.network_id,
+      id === "n_ownerless_fixture" ? null : owner.user.user_id,
+      JSON.stringify(id === daemon ? { role: "host_supervisor", daemon_capabilities: { adopt_capable: true } } : {})]);
+  }
+  db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status,last_seen_at) VALUES(?1,?1,?1,?2,'idle',datetime('now'))", [daemon, owner.network_id]);
+  function credential(label: string, user: string, node: string | null = null, alias = daemon, network = owner.network_id) {
+    const token = generateNetworkToken();
+    db.run(`INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash,bound_node_id)
+      VALUES(?1,?2,?3,'network',?4,?5,?6)`, [label, user, network, `node:${alias}`, hashToken(token), node]);
+    return token;
+  }
+  legacy = credential("owner678_legacy", owner.user.user_id);
+  mismatched = credential("owner678_mismatch", member.user.user_id);
+  bound = credential("owner678_bound", member.user.user_id, daemon);
+  wrongBound = credential("owner678_wrong_bound", member.user.user_id, "n_absent_bound");
+  ownerless = credential("owner678_ownerless", member.user.user_id, null, "n_ownerless_fixture");
+  db.run("UPDATE api_tokens SET node_identity_epoch=1 WHERE token_id='owner678_ownerless'");
+  revoked = credential("owner678_revoked", owner.user.user_id);
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id='owner678_revoked'");
+  crossNetwork = credential("owner678_cross", outsider.user.user_id, daemon, daemon, outsider.network_id);
+  const { bootServer } = await import("./server.js");
+  hub = bootServer({ port: 0, hostname: "127.0.0.1" }); base = `http://127.0.0.1:${hub.port}`;
+  const request = await call(owner.token, "request_adopt_node", { node_id: child, daemon_node_id: daemon, workdir: "/fixture/project" });
+  expect(request.ok).toBe(true); requestId = request.request_id;
+}, 60000);
+afterAll(() => hub?.stop(true));
+
+test("name-only issuance checks existing ownership atomically", async () => {
+  const count = () => db.get("SELECT COUNT(*) AS n FROM api_tokens").n;
+  const before = count();
+  expect(await mint(member.token, owner.network_id, daemon)).toEqual({ status: 400, body: { ok: false, error: "node_owner_mismatch" } });
+  expect(await mint(owner.token, owner.network_id, "n_ownerless_fixture")).toEqual({ status: 400, body: { ok: false, error: "node_owner_mismatch" } });
+  expect(count()).toBe(before);
+  // Legacy owner refresh and a new node name remain supported.
+  const refresh = await mint(owner.token, owner.network_id, daemon);
+  expect(refresh.status).toBe(200);
+  expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+  expect((await mint(member.token, owner.network_id, "fresh678")).status).toBe(200);
+  expect((await mint(member.token, owner.network_id, daemon, daemon)).body.error).toBe("node_owner_mismatch");
+});
+
+// Every daemon-facing handler must fail at the shared identity boundary,
+// not incidentally at request lookup or argument validation. The resolver
+// mutation expects all 15 of these cases to go red together.
+const endpoints: [string, Record<string, unknown>][] = [
+  ["list_my_pending_create_requests", {}], ["list_my_pending_lifecycle_requests", {}],
+  ["get_create_request", { request_id: "cr_fixture_absent" }],
+  ["ack_create_request", { request_id: "cr_fixture_absent", status: "started" }],
+  ["get_stop_request", { request_id: "sr_fixture_absent" }],
+  ["ack_stop_request", { request_id: "sr_fixture_absent", status: "stopped" }],
+  ["get_start_request", { request_id: "start_fixture_absent" }],
+  ["ack_start_request", { request_id: "start_fixture_absent", status: "started" }],
+  ["list_my_children", {}], ["get_adopt_request", {}], ["ack_adopt_request", { status: "adopted" }],
+  ["get_probe_request", { probe_id: "probe_fixture_absent" }],
+  ["ack_probe_request", { probe_id: "probe_fixture_absent", status: "ok", latency_ms: 1 }],
+  ["get_opencode_catalog_request", { request_id: "cat_fixture_absent" }],
+  ["ack_opencode_catalog", { request_id: "cat_fixture_absent", error: "unavailable" }],
+];
+for (const [name, arguments_] of endpoints) {
+  test(`daemon identity boundary: ${name}`, async () => {
+    const args = name.includes("adopt_request") ? { ...arguments_, request_id: requestId } : arguments_;
+    for (const token of [mismatched, wrongBound, ownerless, owner.token, member.token]) {
+      expect(await call(token, name, args)).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+    }
+    expect(db.get("SELECT status FROM node_daemon_bindings WHERE request_id=?1", requestId).status).toBe("pending");
+  });
+}
+
+test("legacy owner and exact bound identity remain supported", async () => {
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id='owner678_legacy'").bound_node_id).toBeNull();
+  for (const token of [legacy, bound]) {
+    expect((await call(token, "list_my_children")).ok).toBe(true);
+    expect((await call(token, "list_my_pending_create_requests")).ok).toBe(true);
+    expect((await call(token, "list_my_pending_lifecycle_requests")).ok).toBe(true);
+    expect((await call(token, "get_adopt_request", { request_id: requestId })).ok).toBe(true);
+  }
+  // An explicit binding does not bypass the network or revocation boundaries.
+  expect(await call(crossNetwork, "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  const denied = await fetch(`${base}/mcp`, { method: "POST", headers: { Authorization: `Bearer ${revoked}` } });
+  expect(denied.status).toBe(401);
+  expect(await call(legacy, "ack_adopt_request", { request_id: requestId, status: "adopted" })).toMatchObject({ ok: true, status: "active" });
+  expect((await call(legacy, "list_my_children")).children).toContainEqual({ child_node_id: child, alias: child, lifecycle_state: "active", managed: "adopted", binding_request_id: requestId });
+  const stop = await call(owner.token, "stop_node", { node_id: child, network_id: owner.network_id });
+  expect(stop.ok).toBe(true);
+  expect((await call(legacy, "get_stop_request", { request_id: stop.request_id })).ok).toBe(true);
+  expect((await call(legacy, "ack_stop_request", { request_id: stop.request_id, status: "stopped" })).ok).toBe(true);
+  const start = await call(owner.token, "start_node", { node_id: child, network_id: owner.network_id });
+  expect(start.ok).toBe(true);
+  expect((await call(legacy, "get_start_request", { request_id: start.request_id })).ok).toBe(true);
+  expect(await call(legacy, "ack_start_request", { request_id: start.request_id, status: "started", child_pid: 4321 })).toMatchObject({ ok: true, status: "started" });
+});
+
+test("ownerless legacy daemon remains supported without rewriting its owner", async () => {
+  db.run("UPDATE api_tokens SET node_identity_epoch=0 WHERE token_id='owner678_ownerless'");
+  try {
+    expect((await call(ownerless, "list_my_children")).ok).toBe(true);
+    const refresh = await mint(member.token, owner.network_id, "n_ownerless_fixture");
+    expect(refresh.status).toBe(200);
+    expect(refresh.body.node_id).toBe("n_ownerless_fixture");
+    expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+    const withId = await mint(member.token, owner.network_id, "n_ownerless_fixture", "n_ownerless_fixture");
+    expect(withId.status).toBe(200);
+    expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id='n_ownerless_fixture'").owner_user_id).toBeNull();
+    expect((await mint(owner.token, owner.network_id, "n_ownerless_fixture")).status).toBe(400);
+  } finally { db.run("UPDATE api_tokens SET node_identity_epoch=1 WHERE token_id='owner678_ownerless'"); }
+});
+
+test("new name-only registration binds once and its holder can refresh with either shape", async () => {
+  const first = await mint(member.token, owner.network_id, "refresh_fixture");
+  expect(first.status).toBe(200);
+  expect(db.get("SELECT node_identity_epoch FROM api_tokens WHERE token_id=?1", first.body.token_id).node_identity_epoch).toBe(2);
+  const result = await call(first.body.token, "report_status", {
+    resume_id: "refresh-fixture-session", alias: "refresh_fixture", status: "idle", node_id: "n_refresh_fixture",
+  });
+  expect(result.ok).toBe(true);
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id=?1", first.body.token_id).bound_node_id).toBe("n_refresh_fixture");
+  expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id='n_refresh_fixture'").owner_user_id).toBeNull();
+  for (const id of [undefined, "n_refresh_fixture"]) {
+    const refresh = await mint(member.token, owner.network_id, "refresh_fixture", id);
+    expect(refresh.status).toBe(200);
+    expect(refresh.body.node_id).toBe("n_refresh_fixture");
+    expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+  }
+  expect((await mint(owner.token, owner.network_id, "refresh_fixture")).status).toBe(400);
+});
+
+test("fresh ID cannot mint another node alias", async () => {
+  const before = db.get("SELECT COUNT(*) AS n FROM api_tokens").n;
+  expect((await mint(member.token, owner.network_id, daemon, "n_fresh_impostor")).status).toBe(400);
+  expect(db.get("SELECT node_id FROM nodes WHERE node_id='n_fresh_impostor'")).toBeNull();
+  expect(db.get("SELECT COUNT(*) AS n FROM api_tokens").n).toBe(before);
+  expect((await call(legacy, "list_my_children")).ok).toBe(true);
+});
+
+test("duplicate legacy aliases use bound IDs and an unbound token follows its owner", async () => {
+  // Historical duplicate rows: the member's row was inserted first. Neither
+  // lookup order nor alias can redirect an exact-bound token. An unbound
+  // token resolves to the row its issuer owns.
+  const { hashToken, generateNetworkToken } = await import("./db.js");
+  const tokens: string[] = [];
+  for (const [id, user] of [["n_duplicate_first", member.user.user_id], ["n_duplicate_owner", owner.user.user_id]]) {
+    db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id) VALUES(?1,'duplicate_fixture','duplicate_fixture',?2,?3)", [id, owner.network_id, user]);
+    const token = generateNetworkToken(); tokens.push(token);
+    db.run("INSERT INTO api_tokens(token_id,token_hash,user_id,network_id,name,scope,bound_node_id) VALUES(?1,?2,?3,?4,'node:duplicate_fixture','network',?1)", [id, hashToken(token), user, owner.network_id]);
+    db.run("INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES(?1,?2,?1,?1,'/fixture',?3,'pending',1,1)", [id, owner.network_id, user]);
+  }
+  for (let i = 0; i < tokens.length; i++) {
+    const result = await call(tokens[i], "list_my_children");
+    expect(result.ok).toBe(true);
+    const ownId = i === 0 ? "n_duplicate_first" : "n_duplicate_owner";
+    expect((await call(tokens[i], "get_adopt_request", { request_id: ownId })).ok).toBe(true);
+    expect((await call(tokens[i], "get_adopt_request", { request_id: i === 0 ? "n_duplicate_owner" : "n_duplicate_first" })).ok).toBe(false);
+  }
+  db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_owner'");
+  expect((await call(tokens[1], "list_my_children")).ok).toBe(true);
+  expect((await call(tokens[1], "get_adopt_request", { request_id: "n_duplicate_owner" })).ok).toBe(true);
+  expect((await call(tokens[1], "get_adopt_request", { request_id: "n_duplicate_first" })).ok).toBe(false);
+  db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_first'");
+  expect((await call(tokens[0], "list_my_children")).ok).toBe(true);
+  expect((await call(tokens[0], "get_adopt_request", { request_id: "n_duplicate_first" })).ok).toBe(true);
+  expect((await call(tokens[0], "get_adopt_request", { request_id: "n_duplicate_owner" })).ok).toBe(false);
+  expect((await mint(owner.token, owner.network_id, "duplicate_fixture", "n_third_duplicate")).status).toBe(400);
+});
+
+test("all production token issuers explicitly mark the rollout epoch", () => {
+  const root = `${import.meta.dir}/../..`;
+  function sources(dir: string): string[] {
+    return readdirSync(dir, { withFileTypes: true }).flatMap(entry => {
+      const path = `${dir}/${entry.name}`;
+      return entry.isDirectory() ? sources(path) : entry.name.endsWith(".ts") && !entry.name.endsWith(".test.ts") ? [path] : [];
+    });
+  }
+  const sourceFiles = ["server/src", "agent-network/src", "agent-network/bin", "agent-node/src"].flatMap(dir => sources(`${root}/${dir}`));
+  let count = 0;
+  for (const file of sourceFiles) {
+    const source = readFileSync(file, "utf8");
+    for (const match of source.matchAll(/INSERT\s+INTO\s+api_tokens\s*\(([^)]+)\)/gi)) {
+      expect(match[1]).toContain("node_identity_epoch"); count++;
+    }
+  }
+  // Hub #938: clone_node mints a child ntok_ with node_identity_epoch=2,
+  // the same column create_node already writes. 9 issuers → 10.
+  expect(count).toBe(10);
+  expect(readFileSync(`${root}/agent-network/bin/cli.ts`, "utf8")).toContain("'admin-reset', 'user', 1)");
+});
+
+test("revoked ownerless credential cannot be reclaimed by doctor and gives actionable guidance", async () => {
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE name='node:n_ownerless_fixture'");
+  const result = await mint(member.token, owner.network_id, "n_ownerless_fixture");
+  expect(result.status).toBe(400);
+  expect(result.body.error).toBe("node_owner_mismatch");
+  expect(nodeTokenReissueError(result.body)).toContain("这个节点没有归属，请联系管理员认领（#682）");
+  expect(nodeTokenReissueError({ error: "node_owner_unclaimed" })).toContain("请联系管理员认领（#682）");
+  expect(nodeTokenReissueError({ error: "network_not_found" })).toBe("network_not_found");
+  expect(readFileSync(`${import.meta.dir}/../../agent-network/bin/cli.ts`, "utf8")).toContain("body ? nodeTokenReissueError(body) : r.status");
+});