@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.131

package/src/node-create-request-status-http.test.ts

@@ -0,0 +1,105 @@
+// 桌面向导要看得到 daemon 回的失败原因:GET /api/node-create-requests?request_id=…
+// 承重:① 只在调用者的网络作用域里能读到(别的网络 → 404,与不存在同形);② 无用户上下文 401;③ 缺参 400;
+// ④ 回的是 daemon ack 写进去的 status/error 原文。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-create-request-status-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let aToken = "", bToken = "", aNet = "", bNet = "";
+const MASTER_TOKEN = "legacy-master-token-for-test";
+
+const get = async (path: string, token: string) => {
+  const r = await fetch(`${base}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+
+beforeAll(async () => {
+  process.env.COMMHUB_AUTH_TOKEN ||= MASTER_TOKEN;
+  const { db } = await import("./db.js");
+  const { register } = await import("./auth.js");
+  const stamp = Date.now();
+  const admin = register(`cr_admin_${stamp}`, "CrAdmin-Strong-1!");
+  expect(admin.ok).toBe(true);
+  const a = register(`cr_a_${stamp}`, "CrA-Strong-1!");
+  const b = register(`cr_b_${stamp}`, "CrB-Strong-1!");
+  expect(a.ok && b.ok).toBe(true);
+  aToken = a.token!; bToken = b.token!; aNet = a.network_id!; bNet = b.network_id!;
+  const uid = (name: string) => db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", name)!.user_id;
+  for (const id of [uid(`cr_a_${stamp}`), uid(`cr_b_${stamp}`)]) {
+    expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", id)?.role).toBe("user");
+  }
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token, acked_at, error)
+     VALUES ('cr_a_failed', 'node_daemon_a', 'vansin-go', ?1, 'opencode-cli', NULL, '{}', '[]', 'failed', NULL, ?2, 'tok', ?2,
+             'opencode-cli package entrypoint verification currently requires Linux')`,
+    [aNet, Date.now()],
+  );
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token)
+     VALUES ('cr_b_pending', 'node_daemon_b', 'other', ?1, 'codex-app-server', NULL, '{}', '[]', 'pending', NULL, ?2, 'tok')`,
+    [bNet, Date.now()],
+  );
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/node-create-requests?request_id=", () => {
+  test("A reads her own failed request with the daemon's error verbatim", async () => {
+    const { status, body } = await get("/api/node-create-requests?request_id=cr_a_failed", aToken);
+    expect(status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.request).toMatchObject({
+      request_id: "cr_a_failed", child_name: "vansin-go", runtime: "opencode-cli", status: "failed",
+      error: "opencode-cli package entrypoint verification currently requires Linux",
+    });
+  });
+  test("🔴 B cannot read A's request — 404, same shape as nonexistent", async () => {
+    const other = await get("/api/node-create-requests?request_id=cr_a_failed", bToken);
+    const missing = await get("/api/node-create-requests?request_id=cr_nope", bToken);
+    expect(other.status).toBe(404);
+    expect(missing.status).toBe(404);
+    expect(other.body).toEqual(missing.body);
+  });
+  test("pending request reads as pending with no error", async () => {
+    const { body } = await get("/api/node-create-requests?request_id=cr_b_pending", bToken);
+    expect(body.request.status).toBe("pending");
+    expect(body.request.error).toBeNull();
+    expect(body.request.child_node_id).toBeNull();
+    expect(body.request.launch_verified_at).toBeNull();
+  });
+  test("registration timestamp is not launch proof; explicit proof and identity round-trip", async () => {
+    const { db } = await import('./db.js');
+    db.run(`UPDATE node_create_requests SET status='succeeded', child_node_id='node_verified', acked_at=1234 WHERE request_id='cr_b_pending'`);
+    const registered = await get('/api/node-create-requests?request_id=cr_b_pending', bToken);
+    expect(registered.body.request.acked_at).toBe(1234);
+    expect(registered.body.request.launch_verified_at).toBeNull();
+    db.run(`UPDATE node_create_requests SET launch_verified_at=5678 WHERE request_id='cr_b_pending'`);
+    const verified = await get('/api/node-create-requests?request_id=cr_b_pending', bToken);
+    expect(verified.body.request).toMatchObject({ child_node_id: 'node_verified', launch_verified_at: 5678 });
+    expect((await get('/api/node-create-requests?request_id=cr_b_pending', aToken)).status).toBe(404);
+  });
+  test("missing request_id → 400", async () => {
+    const { status, body } = await get("/api/node-create-requests", aToken);
+    expect(status).toBe(400);
+    expect(body.error).toBe("request_id_required");
+  });
+  test("legacy master token (no user context) → 401", async () => {
+    const { status, body } = await get("/api/node-create-requests?request_id=cr_a_failed", MASTER_TOKEN);
+    expect(status).toBe(401);
+    expect(body.error).toBe("auth_required");
+  });
+});

package/src/node-daemon-bindings.test.ts

@@ -0,0 +1,132 @@
+import { beforeEach, afterAll, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { buildControllableMap } from "./node-lifecycle-controllable.js";
+
+const NET = "net_adoption_test", USER = "u_adoption_test", CHILD = "n_adoption_child", DAEMON = "node_adoption_daemon";
+function cleanup() {
+  for (const table of ["node_daemon_bindings", "node_stop_requests", "node_start_requests", "node_create_requests", "audit_log", "sessions", "nodes", "api_tokens", "network_members", "networks"])
+    db.run(`DELETE FROM ${table} WHERE network_id=?1`, [NET]);
+  db.run("DELETE FROM users WHERE user_id=?1", [USER]);
+}
+beforeEach(() => {
+  cleanup();
+  db.run("INSERT INTO users(user_id,username,password_hash,role) VALUES(?1,?1,'x','user')", [USER]);
+  db.run("INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,?1,?2)", [NET, USER]);
+  db.run("INSERT INTO network_members(user_id,network_id,role) VALUES(?1,?2,'owner')", [USER, NET]);
+  for (const [id, alias, snap] of [[DAEMON, "adoption-daemon", { role: "host_supervisor", daemon_capabilities: { adopt_capable: true } }], [CHILD, "adoption-child", {}]] as const) {
+    db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state) VALUES(?1,?2,?2,?3,?4,'test-host',?5,'active')`, [id, alias, NET, USER, JSON.stringify(snap)]);
+  }
+  db.run("INSERT INTO sessions(resume_id,session_id,alias,network_id,status,last_seen_at) VALUES('adoption-session','adoption-session','adoption-daemon',?1,'idle',datetime('now'))", [NET]);
+  db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES('adoption-token',?1,?2,'network','node:adoption-daemon','adoption-hash')", [USER, NET]);
+});
+afterAll(cleanup);
+function handlers(kind: "user" | "daemon" | "stranger" = "user") {
+  const server = new McpServer({ name: "adoption-test", version: "0" }) as any;
+  const out: any = {}, original = server.tool.bind(server);
+  server.tool = (name: string, desc: string, schema: any, handler: any) => { out[name] = handler; return original(name, desc, schema, handler); };
+  registerTools(server, undefined, kind === "daemon" ? NET : null, kind === "user" ? USER : null, null, kind === "daemon", kind === "daemon" ? "adoption-token" : null);
+  return out;
+}
+const call = async (handler: any, args: any = {}) => JSON.parse((await handler(args)).content[0].text);
+const request = () => call(handlers().request_adopt_node, { node_id: CHILD, daemon_node_id: DAEMON, workdir: "/workspace/project" });
+async function adopt() {
+  const r = await request(); expect(r.ok).toBe(true);
+  expect(await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).toMatchObject({ ok: true, status: "active" });
+  return r.request_id;
+}
+
+test("unbound node_ cannot use an explicitly supplied daemon (witnessed red on main)", async () => {
+  db.run("UPDATE nodes SET node_id='node_unbound_child' WHERE node_id=?1", [CHILD]);
+  expect(await call(handlers().stop_node, { child_node_id: "node_unbound_child", daemon_node_id: DAEMON, network_id: NET })).toMatchObject({ ok: false, error: "daemon_not_resolvable" });
+  expect(db.all("SELECT * FROM node_stop_requests WHERE network_id=?1", NET)).toHaveLength(0);
+});
+test("two-phase binding, daemon-bound pull, controllable map, adopted delete refused", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  expect(await call(handlers().stop_node, { child_node_id: CHILD, daemon_node_id: DAEMON, network_id: NET })).toMatchObject({ ok: false });
+  expect(await call(handlers("daemon").get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: true, node_id: CHILD, alias: "adoption-child", workdir: "/workspace/project" });
+  expect(await call(handlers().get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: false });
+  expect(await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).toMatchObject({ ok: true });
+  expect((await call(handlers("daemon").list_my_children)).children).toContainEqual({ child_node_id: CHILD, alias: "adoption-child", lifecycle_state: "active", managed: "adopted", binding_request_id: r.request_id });
+  expect(buildControllableMap([], [{ node_id: CHILD, daemon_node_id: DAEMON }]).get(CHILD)).toBe(DAEMON);
+  expect(await call(handlers().delete_node, { child_node_id: CHILD, confirm_alias: "adoption-child", network_id: NET })).toMatchObject({ ok: false, error: "adopted_node_delete_unsupported" });
+  expect(db.get<any>("SELECT lifecycle_state FROM nodes WHERE node_id=?1", CHILD).lifecycle_state).toBe("active");
+});
+test("adopted stop/start complete through existing protocol; revocation removes authority", async () => {
+  await adopt(); const u = handlers(), d = handlers("daemon");
+  const stop = await call(u.stop_node, { child_node_id: CHILD, network_id: NET }); expect(stop.ok).toBe(true);
+  expect((await call(d.get_stop_request, { request_id: stop.request_id })).ok).toBe(true);
+  expect((await call(d.ack_stop_request, { request_id: stop.request_id, status: "stopped" })).ok).toBe(true);
+  expect((await call(d.list_my_children)).children[0].lifecycle_state).toBe("stopped");
+  const start = await call(u.start_node, { child_node_id: CHILD, network_id: NET }); expect(start.ok).toBe(true);
+  expect((await call(d.get_start_request, { request_id: start.request_id })).ok).toBe(true);
+  expect((await call(d.ack_start_request, { request_id: start.request_id, status: "started", child_pid: 4321 })).ok).toBe(true);
+  expect((await call(u.unadopt_node, { node_id: CHILD })).ok).toBe(true);
+  expect((await call(d.list_my_children)).children).toHaveLength(0);
+  expect((await call(u.stop_node, { child_node_id: CHILD, daemon_node_id: DAEMON, network_id: NET })).ok).toBe(false);
+});
+test("pending cancellation cannot be resurrected; duplicate pending refuses", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  expect((await request()).error).toBe("node_already_managed");
+  expect((await call(handlers().unadopt_node, { node_id: CHILD })).ok).toBe(true);
+  expect((await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("request_not_pending");
+});
+test("human-only and owner/admin fail closed; admin exception audited", async () => {
+  const args = { node_id: CHILD, daemon_node_id: DAEMON, workdir: "/workspace/project" };
+  expect((await call(handlers("daemon").request_adopt_node, args)).ok).toBe(false);
+  expect((await call(handlers("stranger").request_adopt_node, args)).ok).toBe(false);
+  db.run("UPDATE network_members SET role='member' WHERE network_id=?1", [NET]);
+  db.run("UPDATE nodes SET owner_user_id=NULL WHERE node_id=?1", [CHILD]);
+  expect((await request()).error).toBe("adopt_forbidden");
+  db.run("UPDATE network_members SET role='owner' WHERE network_id=?1", [NET]);
+  expect((await request()).ok).toBe(true);
+  expect(db.get("SELECT action FROM audit_log WHERE action='adopt_by_admin' AND network_id=?1", NET)).not.toBeNull();
+});
+test("viewer owner cannot request; membership loss before ack cannot activate", async () => {
+  db.run("UPDATE network_members SET role='viewer' WHERE network_id=?1", [NET]);
+  expect((await request()).error).toBe("adopt_forbidden");
+  db.run("UPDATE network_members SET role='owner' WHERE network_id=?1", [NET]);
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("DELETE FROM network_members WHERE network_id=?1", [NET]);
+  expect((await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("adopt_forbidden");
+});
+test("wrong daemon cannot pull/ack; refusal releases reservation; in-flight unadopt is refused", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("UPDATE node_daemon_bindings SET daemon_node_id='other-daemon' WHERE request_id=?1", [r.request_id]);
+  const d = handlers("daemon");
+  expect((await call(d.get_adopt_request, { request_id: r.request_id })).error).toBe("request_not_found");
+  expect((await call(d.ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("request_not_found");
+  db.run("UPDATE node_daemon_bindings SET daemon_node_id=?1 WHERE request_id=?2", [DAEMON, r.request_id]);
+  expect((await call(d.ack_adopt_request, { request_id: r.request_id, status: "refused", error: "adopt_roots_not_configured" })).status).toBe("refused");
+  await adopt();
+  expect((await call(handlers().stop_node, { child_node_id: CHILD, network_id: NET })).ok).toBe(true);
+  expect((await call(handlers().unadopt_node, { node_id: CHILD })).error).toBe("node_lifecycle_in_flight");
+});
+test("old daemon, hostname mismatch, stale heartbeat and cross-network daemon rejected", async () => {
+  db.run("UPDATE nodes SET config_snapshot='null' WHERE node_id=?1", [DAEMON]);
+  expect((await request()).error).toBe("daemon_not_adopt_capable");
+  db.run("UPDATE nodes SET config_snapshot='{}' WHERE node_id=?1", [DAEMON]);
+  expect((await request()).error).toBe("daemon_not_adopt_capable");
+  db.run("UPDATE nodes SET config_snapshot=?1,hostname='different' WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor", daemon_capabilities: { adopt_capable: true } }), DAEMON]);
+  expect((await request()).error).toBe("hostname_mismatch");
+  db.run("UPDATE nodes SET hostname='test-host' WHERE node_id=?1", [DAEMON]);
+  db.run("UPDATE sessions SET last_seen_at='2000-01-01 00:00:00' WHERE network_id=?1", [NET]);
+  expect((await request()).error).toBe("daemon_offline");
+  expect((await call(handlers().request_adopt_node, { node_id: CHILD, daemon_node_id: "other_network_daemon", workdir: "/workspace/project" })).error).toBe("daemon_not_found");
+});
+test("network boundaries apply to both human request and daemon pull/ack", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("UPDATE node_daemon_bindings SET network_id='net_other_adoption_test' WHERE request_id=?1", [r.request_id]);
+  try {
+    const d = handlers("daemon");
+    expect((await call(d.get_adopt_request, { request_id: r.request_id })).error).toBe("request_not_found");
+    expect((await call(d.ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("request_not_found");
+  } finally { db.run("UPDATE node_daemon_bindings SET network_id=?1 WHERE request_id=?2", [NET, r.request_id]); }
+  db.run("UPDATE nodes SET network_id='net_other_adoption_test' WHERE node_id=?1", [DAEMON]);
+  try { expect((await request()).error).toBe("daemon_not_found"); }
+  finally { db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2", [NET, DAEMON]); }
+  db.run("UPDATE nodes SET network_id='net_other_adoption_test' WHERE node_id=?1", [CHILD]);
+  try { expect((await request()).error).toBe("adopt_forbidden"); }
+  finally { db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2", [NET, CHILD]); }
+});

package/src/node-daemon-bindings.ts

@@ -0,0 +1,130 @@
+import { db, uuidv4 } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { pushEvent } from "./push.js";
+import { canRestWriteNetwork } from "./network-scope.js";
+import { parseDbTimestampMs } from "./db-timestamp.js";
+
+type Node = { node_id: string; alias: string; network_id: string; owner_user_id: string | null; hostname: string | null; config_snapshot: string | null };
+type Binding = { request_id: string; network_id: string; node_id: string; daemon_node_id: string; workdir: string; requested_by: string; status: string; error: string | null };
+type Human = { userId?: string | null; networkId?: string | null; isNode: boolean; canWrite: (networkId: string) => boolean };
+type Daemon = { ok: true; daemonNodeId: string; networkId: string } | { ok: false; error: string };
+const fail = (error: string) => ({ ok: false as const, error });
+const snapshot = (node: Node) => {
+  try { const value = JSON.parse(node.config_snapshot || "{}"); return value && typeof value === "object" && !Array.isArray(value) ? value : {}; }
+  catch { return {}; }
+};
+
+export function createdDaemon(nodeId: string): string | null {
+  if (!nodeId.startsWith("node_")) return null;
+  return db.get<{ daemon_node_id: string }>("SELECT daemon_node_id FROM node_create_requests WHERE request_id=?1", `cr_${nodeId.slice(5)}`)?.daemon_node_id ?? null;
+}
+export function activeBinding(nodeId: string): Binding | null {
+  return db.get<Binding>("SELECT * FROM node_daemon_bindings WHERE node_id=?1 AND status='active'", nodeId);
+}
+export function resolveManagedDaemon(nodeId: string): string | null {
+  return createdDaemon(nodeId) ?? activeBinding(nodeId)?.daemon_node_id ?? null;
+}
+function humanNode(ctx: Human, nodeId: string): Node | null {
+  if (ctx.isNode || !ctx.userId) return null;
+  const node = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", nodeId);
+  if (!node || (ctx.networkId && ctx.networkId !== node.network_id) || !ctx.canWrite(node.network_id)) return null;
+  const role = getUserNetworkRole(ctx.userId, node.network_id);
+  return node.owner_user_id === ctx.userId || role === "owner" || role === "admin" ? node : null;
+}
+function audit(binding: Binding, action: string, actor: string) {
+  db.run(`INSERT INTO audit_log(user_id,action,target_type,target_id,detail,network_id)
+    VALUES(?1,?2,'node_daemon_binding',?3,?4,?5)`,
+  [actor, action, binding.request_id, JSON.stringify({ node_id: binding.node_id, daemon_node_id: binding.daemon_node_id }), binding.network_id]);
+}
+function daemonReady(daemon: Node | null, node: Node): string | null {
+  if (!daemon || daemon.network_id !== node.network_id) return "daemon_not_found";
+  const snap = snapshot(daemon);
+  if (snap.role !== "host_supervisor" || snap.daemon_capabilities?.adopt_capable !== true) return "daemon_not_adopt_capable";
+  if (!node.hostname || daemon.hostname !== node.hostname) return "hostname_mismatch";
+  const session = db.get<{ last_seen_at: string }>(`SELECT last_seen_at FROM sessions WHERE alias=?1 AND network_id=?2`, daemon.alias, daemon.network_id);
+  const seen = parseDbTimestampMs(session?.last_seen_at ?? "");
+  if (!Number.isFinite(seen) || Date.now() - seen > 300_000) return "daemon_offline";
+  const token = db.get(`SELECT token_id FROM api_tokens WHERE name=?1 AND network_id=?2 AND revoked_at IS NULL`, `node:${daemon.alias}`, daemon.network_id);
+  return token ? null : "daemon_offline";
+}
+
+export function requestAdopt(ctx: Human, args: { node_id: string; daemon_node_id: string; workdir: string }) {
+  if (ctx.isNode || !ctx.userId) return fail("user_token_required");
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const node = humanNode(ctx, args.node_id);
+  if (!node) return fail("adopt_forbidden");
+  if (snapshot(node).role === "host_supervisor") return fail("cannot_adopt_daemon");
+  if (createdDaemon(node.node_id)) return fail("node_already_managed");
+  if (!args.workdir.trim() || /[\x00-\x1f]/.test(args.workdir)) return fail("invalid_workdir");
+  const daemon = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", args.daemon_node_id);
+  const refused = daemonReady(daemon, node);
+  if (refused) return fail(refused);
+  const now = Date.now();
+  const binding: Binding = { ...args, request_id: `adopt_${uuidv4()}`, network_id: node.network_id, requested_by: ctx.userId, status: "pending", error: null };
+  const inserted = db.transaction(() => {
+    const result = db.run(`INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at)
+      VALUES(?1,?2,?3,?4,?5,?6,'pending',?7,?7) ON CONFLICT DO NOTHING`,
+    [binding.request_id, binding.network_id, node.node_id, args.daemon_node_id, args.workdir, ctx.userId, now]);
+    if (!result.changes) return false;
+    audit(binding, node.owner_user_id === ctx.userId ? "adopt_requested" : "adopt_by_admin", ctx.userId!);
+    return true;
+  });
+  if (!inserted) return fail("node_already_managed");
+  pushEvent(daemon!.alias, { type: "adopt_node", request_id: binding.request_id }, node.network_id);
+  return { ok: true, request_id: binding.request_id, status: "pending" };
+}
+
+function daemonBinding(caller: Daemon, requestId: string): Binding | null {
+  if (!caller.ok) return null;
+  return db.get<Binding>(`SELECT * FROM node_daemon_bindings WHERE request_id=?1 AND daemon_node_id=?2 AND network_id=?3`, requestId, caller.daemonNodeId, caller.networkId);
+}
+export function getAdopt(caller: Daemon, requestId: string) {
+  if (!caller.ok) return fail(caller.error);
+  const binding = daemonBinding(caller, requestId);
+  if (!binding) return fail("request_not_found");
+  if (binding.status !== "pending") return fail("request_not_pending");
+  const node = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1 AND network_id=?2", binding.node_id, binding.network_id);
+  if (!node) return fail("node_not_found");
+  return { ok: true, ...binding, alias: node.alias };
+}
+export function ackAdopt(caller: Daemon, args: { request_id: string; status: "adopted" | "refused"; error?: string }) {
+  if (!caller.ok) return fail(caller.error);
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const binding = daemonBinding(caller, args.request_id);
+  if (!binding) return fail("request_not_found");
+  return db.transaction(() => {
+    // Ownership/membership can change while local verification is in flight.
+    if (args.status === "adopted") {
+      const requester: Human = { userId: binding.requested_by, networkId: binding.network_id, isNode: false,
+        canWrite: networkId => canRestWriteNetwork({ userId: binding.requested_by, networkId: null }, networkId, false) };
+      const node = humanNode(requester, binding.node_id);
+      if (!node || createdDaemon(binding.node_id)) return fail("adopt_forbidden");
+      const refusal = daemonReady(db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", binding.daemon_node_id), node);
+      if (refusal) return fail(refusal);
+    }
+    const changed = db.run(`UPDATE node_daemon_bindings SET status=?1,error=?2,updated_at=?3 WHERE request_id=?4 AND status='pending'`,
+      [args.status === "adopted" ? "active" : "refused", args.error ?? null, Date.now(), args.request_id]);
+    if (!changed.changes) return fail("request_not_pending");
+    audit(binding, `adopt_${args.status}`, caller.daemonNodeId);
+    return { ok: true, status: args.status === "adopted" ? "active" : "refused" };
+  });
+}
+export function unadopt(ctx: Human, nodeId: string) {
+  if (ctx.isNode || !ctx.userId) return fail("user_token_required");
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const node = humanNode(ctx, nodeId);
+  if (!node) return fail("adopt_forbidden");
+  const binding = db.get<Binding>("SELECT * FROM node_daemon_bindings WHERE node_id=?1 AND status IN ('pending','active')", nodeId);
+  if (!binding) return fail("binding_not_found");
+  // Do not reassign authority while a daemon may already be executing a lifecycle command.
+  for (const table of ["node_stop_requests", "node_start_requests"]) {
+    if (db.get(`SELECT request_id FROM ${table} WHERE child_node_id=?1 AND network_id=?2 AND status IN ('pending','delivered')`, nodeId, node.network_id)) return fail("node_lifecycle_in_flight");
+  }
+  db.transaction(() => {
+    db.run("UPDATE node_daemon_bindings SET status='revoked',updated_at=?1 WHERE request_id=?2", [Date.now(), binding.request_id]);
+    audit(binding, "unadopted", ctx.userId!);
+  });
+  const daemon = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1 AND network_id=?2", binding.daemon_node_id, node.network_id);
+  if (daemon) pushEvent(daemon.alias, { type: "unadopt_node", node_id: nodeId, request_id: binding.request_id }, node.network_id);
+  return { ok: true, status: "revoked" };
+}