@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.131

package/src/desktop-message.test.ts

@@ -0,0 +1,368 @@
+// Desktop user push contract.
+//
+// Pins the new user-keyed SSE path and send_desktop_message MCP tool:
+// - user streams are keyed by networkId:userId, never alias
+// - ntok callers cannot cross network by supplying a foreign to_user_id/network_id
+// - target ambiguity/miss is fail-closed before audit/push
+
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import {
+  __resetSSEClientsForTest,
+  createUserEventStream,
+  pushUserEvent,
+} from "./push.js";
+
+const NET_A = "net_desktop_a";
+const NET_B = "net_desktop_b";
+const NODE_USER = "u_desktop_node_owner";
+const SENDER_USER = "u_desktop_sender";
+const TARGET_A = "u_desktop_target_a";
+const TARGET_B = "u_desktop_target_b";
+const TARGET_BOTH = "u_desktop_target_both";
+const ALL_USERS = [NODE_USER, SENDER_USER, TARGET_A, TARGET_B, TARGET_BOTH];
+
+type ToolHandler = (args: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup() {
+  try { db.run("DELETE FROM audit_log WHERE action = 'send_desktop_message' OR network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  for (const u of ALL_USERS) {
+    try { db.run("DELETE FROM users WHERE user_id = ?1", [u]); } catch {}
+  }
+}
+
+function seed() {
+  for (const u of ALL_USERS) {
+    db.run(
+      `INSERT INTO users (user_id, username, password_hash, role, created_at)
+       VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+      [u, `${u}_name`],
+    );
+  }
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_A, SENDER_USER]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_B, TARGET_B]);
+  const member = (userId: string, networkId: string, role: string) =>
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, ?3, datetime('now'))`, [userId, networkId, role]);
+  member(NODE_USER, NET_A, "member");
+  member(SENDER_USER, NET_A, "owner");
+  member(TARGET_A, NET_A, "member");
+  member(TARGET_B, NET_B, "member");
+  member(TARGET_BOTH, NET_A, "member");
+  member(TARGET_BOTH, NET_B, "member");
+}
+
+beforeEach(() => { cleanup(); seed(); });
+afterEach(() => { __resetSSEClientsForTest(); });
+afterAll(cleanup);
+
+function buildHandlers(opts: { netId?: string | null; userId?: string | null; alias?: string | null; isNetwork?: boolean }) {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, schema: any, handler: ToolHandler) => {
+    tools[name] = handler;
+    return origTool(name, _desc, schema, handler);
+  };
+  registerTools(
+    server,
+    undefined,
+    opts.netId ?? null,
+    opts.userId ?? null,
+    opts.alias ?? opts.userId ?? null,
+    opts.isNetwork ?? false,
+    "tok_desktop_test",
+  );
+  return tools;
+}
+
+async function call(handler: ToolHandler, args: any): Promise<Record<string, any>> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0].text);
+}
+
+async function readFrame(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  timeoutMs = 2_000,
+): Promise<Record<string, any>> {
+  const decoder = new TextDecoder();
+  let buf = "";
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const result = await Promise.race([
+      reader.read(),
+      new Promise<never>((_, rej) =>
+        setTimeout(() => rej(new Error(`no SSE frame within ${timeoutMs}ms`)), deadline - Date.now()),
+      ),
+    ]);
+    if (result.done) throw new Error("SSE stream ended unexpectedly");
+    buf += decoder.decode(result.value, { stream: true });
+    const sep = buf.indexOf("\n\n");
+    if (sep === -1) continue;
+    const rawFrame = buf.slice(0, sep);
+    buf = buf.slice(sep + 2);
+    const dataLine = rawFrame.split("\n").find((l) => l.startsWith("data: "));
+    if (!dataLine) continue;
+    return JSON.parse(dataLine.slice(6));
+  }
+  throw new Error(`no SSE frame within ${timeoutMs}ms`);
+}
+
+function auditCount() {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM audit_log WHERE action = 'send_desktop_message'")?.n ?? 0;
+}
+
+describe("send_desktop_message", () => {
+  test("ntok caller can push to a user in the same bound network", async () => {
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      message: "desktop hello",
+      severity: "success",
+    });
+
+    expect(result.ok).toBe(true);
+    expect(result.message_id).toStartWith("dm_");
+    expect(auditCount()).toBe(1);
+    const evt = await readFrame(reader);
+    expect(evt.type).toBe("desktop_message");
+    expect(evt.message_id).toBe(result.message_id);
+    expect(evt.message).toBe("desktop hello");
+    expect(evt.from).toBe("node-a");
+    expect(evt.network_id).toBe(NET_A);
+    expect(evt.user_id).toBe(TARGET_A);
+    expect(evt.scope).toBe("user");
+    await reader.cancel();
+  });
+
+  test("utok caller can push with explicit network_id to a member user", async () => {
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ userId: SENDER_USER, alias: "sender-user" });
+    const result = await call(tools.send_desktop_message, {
+      to_username: `${TARGET_A}_name`,
+      network_id: NET_A,
+      title: "Heads up",
+      message: "from user token",
+    });
+
+    expect(result.ok).toBe(true);
+    const evt = await readFrame(reader);
+    expect(evt.title).toBe("Heads up");
+    expect(evt.message).toBe("from user token");
+    expect(evt.network_id).toBe(NET_A);
+    await reader.cancel();
+  });
+
+  test("ntok caller cannot cross network with foreign network_id and to_user_id; no audit or push happens first", async () => {
+    const stream = createUserEventStream(NET_B, TARGET_B);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_B,
+      network_id: NET_B,
+      message: "must not cross",
+    });
+
+    expect(result).toEqual({ ok: false, error: "desktop_target_not_in_network", network_id: NET_A });
+    expect(auditCount()).toBe(0);
+
+    pushUserEvent(NET_B, TARGET_B, { type: "desktop_message", message_id: "marker_after_denied" });
+    expect((await readFrame(reader)).message_id).toBe("marker_after_denied");
+    await reader.cancel();
+  });
+
+  test("missing target is fail-closed before audit", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, { message: "nobody" });
+    expect(result).toEqual({
+      ok: false,
+      error: "desktop_target_required",
+      message: "to_user_id or to_username is required",
+    });
+    expect(auditCount()).toBe(0);
+  });
+
+  test("conflicting to_user_id and to_username is fail-closed before audit", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      to_username: `${TARGET_BOTH}_name`,
+      message: "conflict",
+    });
+    expect(result).toEqual({
+      ok: false,
+      error: "desktop_target_mismatch",
+      to_user_id: TARGET_A,
+      to_username: `${TARGET_BOTH}_name`,
+    });
+    expect(auditCount()).toBe(0);
+  });
+
+  test("unknown target is fail-closed before audit", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_username: "not_a_real_user",
+      message: "lost",
+    });
+    expect(result).toEqual({ ok: false, error: "desktop_target_not_found", field: "to_username" });
+    expect(auditCount()).toBe(0);
+  });
+});
+
+// #1459 —— 返回值必须反映真实投递态。
+//
+// send_desktop_message 是 fire-and-forget：只 INSERT audit_log（不写 inbox），
+// 再 pushUserEvent 扇出；而 pushUserEvent 在没有订阅者时静默 return。
+// 用户 dashboard 离线/重连时消息永久丢（无 DB 行 ⇒ 无从 reconcile，
+// /api/messages 只 SELECT ... FROM inbox），而调用方拿到的是 ok:true。
+//
+// 本 PR 只做「让丢失可见」这一半：不碰 schema，返回值说实话。
+// 持久化 + 重连补投（让丢失不发生）是另一条，方向已定为按 user_id 寻址的新表。
+describe("#1459 send_desktop_message 返回值反映真实投递态", () => {
+  test("🔴 无活跃订阅者 ⇒ delivered:false + 可判读的 reason，而不是笼统 ok:true", async () => {
+    // 故意不建 SSE 流：这正是用户 dashboard 关着的情形
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const before = auditCount();
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      message: "nobody is listening",
+      severity: "info",
+    });
+
+    // ok 仍为 true：调用被接受、审计已落库 —— 这一格没变
+    expect(result.ok).toBe(true);
+    expect(result.message_id).toStartWith("dm_");
+    expect(auditCount()).toBe(before + 1);
+
+    // 新增的那一格：投递态
+    expect(result.delivered).toBe(false);
+    expect(result.reason).toBe("no_live_subscriber");
+  });
+
+  test("有活跃订阅者 ⇒ delivered:true 且不带 reason", async () => {
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      message: "someone is listening",
+      severity: "info",
+    });
+
+    expect(result.delivered).toBe(true);
+    expect(result.reason).toBeUndefined();
+    // 前提断言：这一条真的送到了订阅者手上，否则 delivered:true 就是空话
+    const evt = await readFrame(reader);
+    expect(evt.message).toBe("someone is listening");
+    await reader.cancel();
+  });
+
+  test("🔴 两种情形必须给出不同读数 —— 防止判据退化成恒真", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const offline = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "off", severity: "info" });
+
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+    const online = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "on", severity: "info" });
+    await reader.cancel();
+
+    expect(offline.delivered).not.toBe(online.delivered);
+  });
+});
+
+// #1459 ① P2 —— 写入持久化。
+describe("#1459 ① P2 send_desktop_message 持久化", () => {
+  const rowsFor = (mid: string) =>
+    db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n ?? 0;
+
+  test("🔴 发一条消息 ⇒ user_inbox 落一行，字段与事件一致", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A, message: "persist me", severity: "warning", title: "T", kind: "agent_message",
+    });
+    expect(r.ok).toBe(true);
+    expect(r.persisted).toBe(true);
+    const row = db.get<any>("SELECT * FROM user_inbox WHERE message_id = ?1", r.message_id);
+    expect(row).toBeTruthy();
+    expect(row.user_id).toBe(TARGET_A);
+    expect(row.content).toBe("persist me");
+    expect(row.severity).toBe("warning");
+    expect(row.title).toBe("T");
+    expect(row.from_session).toBe("node-a");
+    expect(row.network_id).toBe(NET_A);
+    expect(row.acked).toBe(0);
+  });
+
+  test("🔴 没有活订阅者时也要落库 —— 「丢了」变成「待补投」的那一格", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "offline body" });
+    expect(r.delivered).toBe(false);
+    expect(r.reason).toBe("no_live_subscriber");
+    expect(r.persisted).toBe(true);
+    expect(rowsFor(r.message_id)).toBe(1);
+  });
+
+  test("🔴 zod 默认值不可依赖：直接调 handler 不传 kind/severity 也必须落库", async () => {
+    // 测试与未来的内部调用方绕过 MCP 的 zod .default()，拿到的是 undefined。
+    // 列上虽有 DEFAULT，但显式传 NULL 会覆盖它 —— 所以写入侧要自己兜。
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "no kind given" });
+    expect(rowsFor(r.message_id)).toBe(1);
+    const row = db.get<any>("SELECT kind, severity FROM user_inbox WHERE message_id = ?1", r.message_id);
+    expect(row.kind).toBe("agent_message");
+    expect(row.severity).toBe("info");
+  });
+
+  test("audit_log 与 user_inbox 同生共死（同一事务，条数一致）", async () => {
+    const before = auditCount();
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "paired" });
+    expect(auditCount()).toBe(before + 1);
+    expect(rowsFor(r.message_id)).toBe(1);
+  });
+});
+
+// #1459 ① P2 —— 幂等写法的选择本身要被钉住。
+//
+// 🔴 实现时踩到的：最初用 `INSERT OR IGNORE`，它对「重投同一 message_id」是对的，
+//    但**连 NOT NULL 违规也一起吞掉** —— kind 为 undefined 时整行被静默丢弃，
+//    而工具照样返回 persisted:true。**一条消息凭空消失且报告成功**，正是本
+//    issue 要消灭的那个形状。改成 ON CONFLICT(message_id) DO NOTHING：
+//    只赦免主键冲突，别的约束照常抛。
+describe("#1459 ① P2 幂等写法：赦免重复，但不吞约束错误", () => {
+  const stmt = `INSERT INTO user_inbox
+      (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json)
+    VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+    ON CONFLICT(message_id) DO NOTHING`;
+
+  test("重复的 message_id ⇒ 不抛错、也不产生第二行", () => {
+    const mid = `dm_dup_${Date.now()}`;
+    const ins = () => db.run(stmt, [mid, NET_A, TARGET_A, "node-a", "info", null, "body", "info", null]);
+    ins();
+    expect(() => ins()).not.toThrow();
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n).toBe(1);
+  });
+
+  test("🔴 NOT NULL 违规必须抛出来 —— 不能像 OR IGNORE 那样静默丢行", () => {
+    const mid = `dm_bad_${Date.now()}`;
+    expect(() =>
+      db.run(stmt, [mid, NET_A, TARGET_A, "node-a", null, null, "body", "info", null]),
+    ).toThrow();
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n).toBe(0);
+  });
+});

package/src/dm-file-scope-http.test.ts

@@ -0,0 +1,178 @@
+// 人与人私信的文件只给私信里的人看(owner 2026-09-30「给人好像发不了图片」的后续)。
+//
+// 规则:文件上传时带 `?purpose=dm`(App 私信输入框这么传)= 它第一次用途就是私信 → 私信文件(index scope=dm)。
+// 私信文件只有上传者、带着它的私信的收发双方、管理员能下载;同网络的其他成员和节点令牌(Agent)都 404
+// (与其它拒绝同一个形状,不泄露文件存在)。不带 purpose 上传的文件 —— 例如先在 agent 会话里发过 —— 永远不会
+// 变成私信文件,之后转进私信也照旧全网成员可见。私信文件只能由看得见它的人再转发。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, addNetworkMember } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-dm-file-scope-"));
+const PW = "DmFileScopePassw0rd!";
+let BASE = "";
+let hub: any = null;
+let NET = "";
+type U = { token: string; id: string };
+let admin: U, alice: U, bob: U, carol: U, dave: U;
+let adminNtok = "";
+
+const auth = (t: string) => ({ Authorization: `Bearer ${t}` });
+async function upload(token: string, body: string, query: string) {
+  const form = new FormData();
+  form.append("file", new Blob([new TextEncoder().encode(body)], { type: "image/png" }), "shot.png");
+  const res = await fetch(`${BASE}/api/upload?network_id=${NET}${query}`, { method: "POST", body: form, headers: auth(token) });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+async function uploadId(token: string, body: string, query = "") {
+  const r = await upload(token, body, query);
+  expect(r.status).toBe(200);
+  return r.body.file_id as string;
+}
+async function dm(from: U, to: U, fileId: string, message = "") {
+  const res = await fetch(`${BASE}/api/dm`, {
+    method: "POST",
+    headers: { ...auth(from.token), "Content-Type": "application/json" },
+    body: JSON.stringify({ network_id: NET, to_user_id: to.id, message, attachments: [{ type: "file", file_id: fileId, name: "shot.png", mime: "image/png" }] }),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+const fileStatus = async (token: string, fileId: string, method = "GET") =>
+  (await fetch(`${BASE}/api/files/${fileId}`, { method, headers: auth(token) })).status;
+const entry = (fileId: string) => JSON.parse(readFileSync(join(DIR, "uploads", ".index", `${fileId}.json`), "utf8"));
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const stamp = Date.now();
+  const a = register(`dmfs_admin_${stamp}`, PW);
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [a.user!.user_id]);
+  admin = { token: a.token!, id: a.user!.user_id };
+  adminNtok = a.network_token!;
+  NET = a.network_id!;
+  // alice / bob / carol see every agent (agent_access=all) — the members for whom a network-scoped file was readable
+  // before, i.e. where the gap was. dave is a restricted member (only granted agents).
+  const mk = (name: string, agentAccess: "all" | "granted"): U => {
+    const r = register(`${name}_${stamp}`, PW);
+    expect(addNetworkMember(NET, r.user!.user_id, "member", admin.id, { agentAccess }).ok).toBe(true);
+    return { token: r.token!, id: r.user!.user_id };
+  };
+  alice = mk("dmfs_alice", "all"); bob = mk("dmfs_bob", "all"); carol = mk("dmfs_carol", "all"); dave = mk("dmfs_dave", "granted");
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("upload ?purpose=dm", () => {
+  test("marks the index entry; absent purpose writes no scope key (old shape)", async () => {
+    expect(entry(await uploadId(alice.token, "p1", "&purpose=dm")).scope).toBe("dm");
+    expect("scope" in entry(await uploadId(alice.token, "p2"))).toBe(false);
+  });
+  test("an unknown purpose is refused, not silently treated as network scope", async () => {
+    const r = await upload(alice.token, "p3", "&purpose=DM");
+    expect(r.status).toBe(400);
+    expect(r.body.error).toBe("bad_purpose");
+  });
+});
+
+describe("a DM file is readable only by the people in the DM", () => {
+  test("alice → bob: alice and bob read it; carol (same network, not in the DM) and agents get 404; admin reads", async () => {
+    const fid = await uploadId(alice.token, "alice-to-bob", "&purpose=dm");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect(await fileStatus(alice.token, fid)).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+    expect(await fileStatus(carol.token, fid, "HEAD")).toBe(404);
+    expect(await fileStatus(adminNtok, fid)).toBe(404);
+    expect(await fileStatus(admin.token, fid)).toBe(200);
+  });
+  test("bob → alice (other direction): same rule", async () => {
+    const fid = await uploadId(bob.token, "bob-to-alice", "&purpose=dm");
+    expect((await dm(bob, alice, fid)).status).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(200);
+    expect(await fileStatus(alice.token, fid)).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+  });
+  test("a restricted member in the DM reads it both ways; out of it, not", async () => {
+    const toDave = await uploadId(alice.token, "alice-to-dave", "&purpose=dm");
+    expect((await dm(alice, dave, toDave)).status).toBe(200);
+    expect(await fileStatus(dave.token, toDave)).toBe(200);
+    const fromDave = await uploadId(dave.token, "dave-to-alice", "&purpose=dm");
+    expect((await dm(dave, alice, fromDave)).status).toBe(200);
+    expect(await fileStatus(alice.token, fromDave)).toBe(200);
+    expect(await fileStatus(bob.token, fromDave)).toBe(404);
+    const other = await uploadId(alice.token, "alice-to-bob-2", "&purpose=dm");
+    await dm(alice, bob, other);
+    expect(await fileStatus(dave.token, other)).toBe(404);
+  });
+  test("before it is sent, only the uploader reads it", async () => {
+    const fid = await uploadId(alice.token, "draft", "&purpose=dm");
+    expect(await fileStatus(alice.token, fid)).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(404);
+  });
+  test("the DM thread still returns the attachment to both sides", async () => {
+    const fid = await uploadId(alice.token, "thread", "&purpose=dm");
+    await dm(alice, bob, fid, "看图");
+    const t = await (await fetch(`${BASE}/api/dm?network_id=${NET}&with=${alice.id}`, { headers: auth(bob.token) })).json() as any;
+    expect(JSON.parse(t.messages[0].meta_json).attachments[0].file_id).toBe(fid);
+  });
+});
+
+describe("nobody unlocks a DM file by putting its id into their own DM", () => {
+  test("carol DMs alice's DM file to bob → 403, and she still can't read it", async () => {
+    const fid = await uploadId(alice.token, "secret", "&purpose=dm");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    const r = await dm(carol, bob, fid);
+    expect(r.status).toBe(403);
+    expect(r.body.error).toBe("attachment_not_accessible");
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+  });
+  test("bob (who received it) may forward it to carol, and then carol reads it", async () => {
+    const fid = await uploadId(alice.token, "forwardable", "&purpose=dm");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect((await dm(bob, carol, fid)).status).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+  });
+});
+
+describe("files whose first use was not a DM keep their scope", () => {
+  test("uploaded in an agent chat, then forwarded into a DM → still readable by every member", async () => {
+    const fid = await uploadId(alice.token, "agent-chat-first");
+    // first use: an agent task (what ChatScreen does: upload without purpose, send_task with the file id)
+    db.run(
+      `INSERT INTO tasks (task_id, from_name, to_name, status, content, network_id, meta_json) VALUES (?1, ?2, 'dmfs-agent', 'delivered', 'see image', ?3, ?4)`,
+      [`t_dmfs_${Date.now()}`, "dmfs_alice", NET, JSON.stringify({ attachments: [{ type: "file", file_id: fid }] })],
+    );
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect("scope" in entry(fid)).toBe(false);
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(200);
+    expect(await fileStatus(adminNtok, fid)).toBe(200);
+  });
+  test("an old app's DM upload (no purpose) behaves exactly as before", async () => {
+    const fid = await uploadId(alice.token, "old-app");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+  });
+});
+
+describe("index entry integrity", () => {
+  test("a hand-edited unknown scope makes the entry invalid (404), never network-wide", async () => {
+    const fid = await uploadId(alice.token, "tamper", "&purpose=dm");
+    const path = join(DIR, "uploads", ".index", `${fid}.json`);
+    writeFileSync(path, JSON.stringify({ ...entry(fid), scope: "public" }));
+    expect(await fileStatus(alice.token, fid)).toBe(404);
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+  });
+});

package/src/ext-token-shared.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildStoragePath,
+  pathForExistingBlob,
+  validateIndexEntry,
+} from "./uploads.js";
+
+const fileId = "0123456789abcdef0123456789abcdef";
+const dateBucket = "2026-08-09";
+const uploadsRoot = "/srv/uploads";
+
+const malicious = [
+  "../x",
+  "/abs/x",
+  ".png/../../y",
+  ".p ng",
+  ".p\0ng",
+  ".\\..\\x",
+  "." + "a".repeat(17),
+  ".tar.gz",
+];
+
+const legal = ["", ".png", ".PNG", ".mp4", "." + "a".repeat(16)];
+
+describe("#527 shared extension-token invariant", () => {
+  test("new-upload path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => buildStoragePath(fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(buildStoragePath(fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("existing-blob path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("stored-index gate rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+    for (const ext of legal) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(true);
+    }
+  });
+
+  test("all three boundaries fail closed on non-string runtime values", () => {
+    for (const ext of [undefined, null, 7, {}, []]) {
+      expect(() => buildStoragePath(fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+  });
+});