@sleep2agi/commhub-server 0.9.0-preview.130 → 0.9.0-preview.131

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.130",
+  "version": "0.9.0-preview.131",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -1271,7 +1271,7 @@ try { db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_from_node ON tasks(from_node
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_to_node ON tasks(to_node_id)"); } catch {}
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_inbox_node ON inbox(node_id)"); } catch {}
 
-function backfillMessageNodeIds() {
+export function backfillMessageNodeIds() {
   let inboxDirect = 0;
   let inboxRenamed = 0;
   let tasksToDirect = 0;
@@ -1391,6 +1391,7 @@ function backfillMessageNodeIds() {
         LIMIT 1
       )
       WHERE from_node_id IS NULL
+        AND NOT EXISTS (SELECT 1 FROM users u WHERE u.username = tasks.from_name)
         AND EXISTS (
           SELECT 1 FROM sessions s
           WHERE s.node_id IS NOT NULL
@@ -1416,6 +1417,7 @@ function backfillMessageNodeIds() {
         LIMIT 1
       )
       WHERE from_node_id IS NULL
+        AND NOT EXISTS (SELECT 1 FROM users u WHERE u.username = tasks.from_name)
         AND EXISTS (
           SELECT 1 FROM rename_txn r
           JOIN sessions s

package/src/rest-identity.test.ts

@@ -52,10 +52,11 @@ describe("REST from_session identity binding", () => {
   });
 
   // The Dashboard posts as its logged-in user; this path must not change.
-  test("user token keeps the previous behaviour", () => {
+  test("user token explicitly naming the authenticated username is accepted", () => {
     expect(resolveRestFromSession({
       token: UTOK,
       tokenName: "dashboard",
+      authenticatedUsername: "admin",
       requestedFrom: "admin",
     })).toEqual({ ok: true, fromSession: "admin" });
   });

package/src/rest-identity.ts

@@ -50,6 +50,22 @@ export function nodeAliasForToken(token: string, tokenName: string | null | unde
   return alias || null;
 }
 
+/** Human dispatches use the authenticated username; node credentials represent nodes. */
+export function resolveUserTaskFromSession(username: string | null | undefined, requestedFrom: unknown): RestIdentityResult {
+  const fromSession = username?.trim() || "api";
+  const requested = typeof requestedFrom === "string" ? requestedFrom.trim() : "";
+  if (requested && requested !== fromSession) {
+    return {
+      ok: false,
+      error: "from_session_identity_mismatch",
+      message: "user token task sender must match the authenticated username",
+      tokenAlias: fromSession,
+      requestedFromSession: requested,
+    };
+  }
+  return { ok: true, fromSession };
+}
+
 export function resolveRestFromSession(input: RestIdentityInput): RestIdentityResult {
   const requested = typeof input.requestedFrom === "string" ? input.requestedFrom.trim() : "";
   let alias: string | null;
@@ -96,16 +112,14 @@ export function resolveRestFromSession(input: RestIdentityInput): RestIdentityRe
     return { ok: true, fromSession: "api" };
   }
 
-  // A user-token client normally does not need to repeat its identity in every
-  // request. Prefer an explicit, backwards-compatible claim when present;
-  // otherwise attribute the task to the authenticated username. Falling back
-  // to the transport label `api` is reserved for legacy auth contexts where
-  // the server genuinely has no user identity.
+  // Authenticated human callers are always represented by their username.
+  // Keep the unscoped development / legacy transport path separate.
   if (!alias) {
     const authenticatedUsername = typeof input.authenticatedUsername === "string"
       ? input.authenticatedUsername.trim()
       : "";
-    return { ok: true, fromSession: requested || authenticatedUsername || "api" };
+    if (authenticatedUsername) return resolveUserTaskFromSession(authenticatedUsername, input.requestedFrom);
+    return { ok: true, fromSession: requested || "api" };
   }
 
   // Node token claiming somebody else — refuse rather than silently rewrite,

package/src/server.ts

@@ -3672,9 +3672,7 @@ return Bun.serve({
       // TUI*) as that node. Same table, same token, one transport hardened and
       // its sibling not.
       //
-      // User tokens keep the previous behaviour: the Dashboard legitimately
-      // posts as its logged-in user, and tightening that is a separate change
-      // with its own compatibility surface.
+      // Human dispatches use the authenticated username on both transports.
       // The decision itself lives in rest-identity.ts as a pure function so the
       // shipped path and the tested path are the same code.
       const identity = resolveRestFromSession({
@@ -3695,7 +3693,9 @@ return Bun.serve({
       }
       const fromSession = identity.fromSession;
       const ttlSeconds = (body as any).ttl_seconds || 3600;
-      const fromNodeId = resolveRestNodeIdForAlias(fromSession, taskNetId);
+      const fromNodeId = restAuth && !requestToken(req).startsWith("ntok_")
+        ? null
+        : resolveRestNodeIdForAlias(fromSession, taskNetId);
       const targetNodeId = target.session?.node_id ?? null;
       const actualTo = restActualTo(target, taskNetId);
       // #221 — fold top-level `attachments` into `meta.attachments` so

package/src/task-auth-origin-http.test.ts

@@ -9,6 +9,7 @@ const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-auth-origin-http-"));
 let server: any;
 let base = "";
 let userToken = "";
+let userName = "";
 let nodeToken = "";
 let networkId = "";
 const TARGET = `auth-origin-http-target-${process.pid}`;
@@ -22,6 +23,7 @@ const TARGET_RESUME_ID = `resume_auth_origin_target_${process.pid}`;
 beforeAll(async () => {
   process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
   const username = `auth_origin_${Date.now()}`;
+  userName = username;
   const registered = register(username, "AuthOriginTest123!", undefined, "seed");
   expect(registered.ok).toBe(true);
   userToken = registered.token!;
@@ -80,7 +82,7 @@ async function postTask(token: string, from: string, marker: string) {
 
 describe("POST /api/task server-authenticated origin", () => {
   test("user token stamps user even when the client supplied another fact", async () => {
-    const meta = await postTask(userToken, "dashboard-user", "origin-user");
+    const meta = await postTask(userToken, userName, "origin-user");
     expect(meta.auth_origin).toBe("user");
   });
 

package/src/task-network-resolution-http.test.ts

@@ -87,7 +87,6 @@ async function post(principal: Principal, marker: string, networkId?: string) {
     headers: { Authorization: `Bearer ${principal.token}`, "Content-Type": "application/json" },
     body: JSON.stringify({
       alias: principal.target,
-      from: "api",
       task: marker,
       priority: "high",
       ...(networkId ? { network_id: networkId } : {}),

package/src/task-sender-http.test.ts

@@ -0,0 +1,143 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { addNetworkMember, createNetworkTokenForNode, createToken, register } from "./auth.js";
+import { backfillMessageNodeIds, db } from "./db.js";
+
+if (!process.env.COMMHUB_DB && !process.env.COMMHUB_TEST_PG_URL) throw new Error("isolated database required");
+const stamp = `${process.pid}_${Date.now()}`;
+type Caller = { label: string; token: string; username: string; userId: string };
+type Transport = "rest" | "mcp";
+let server: any, base: string, net: string, foreignNet: string;
+let owner: Caller, member: Caller, admin: Caller, viewer: Caller;
+let callers: Caller[] = [];
+let nodeToken: string;
+const target = `sender-target-${stamp}`;
+const memberNode = `sender-owned-${stamp}`;
+const targetId = `n_sender_target_${stamp}`;
+const memberNodeId = `n_sender_owned_${stamp}`;
+const collisionId = `n_sender_collision_${stamp}`;
+let markerSeq = 0;
+
+function user(label: string): Caller & { networkId: string } {
+  const username = `sender_${label}_${stamp}`;
+  const r = register(username, "SenderFixturePass123!", undefined, "seed");
+  if (!r.ok || !r.user || !r.token || !r.network_id) throw new Error("fixture registration failed");
+  return { label, token: r.token, username, userId: r.user.user_id, networkId: r.network_id };
+}
+
+function node(alias: string, id: string, ownerId: string, status = "idle") {
+  const r = createNetworkTokenForNode(ownerId, net, alias, id);
+  if (!r.ok || !r.token) throw new Error("fixture node registration failed");
+  db.run(`INSERT INTO sessions (resume_id, alias, node_id, network_id, status, last_seen_at)
+    VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'))`, [`resume_${id}`, alias, id, net, status]);
+  return r.token;
+}
+
+beforeAll(async () => {
+  const first = user("owner"); owner = first; net = first.networkId;
+  const second = user("member"); member = second; foreignNet = second.networkId;
+  admin = user("admin"); viewer = user("viewer");
+  db.run("UPDATE users SET role = 'user' WHERE user_id IN (?1, ?2, ?3)", [owner.userId, member.userId, viewer.userId]);
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [admin.userId]);
+  for (const [c, role] of [[member, "member"], [admin, "admin"], [viewer, "viewer"]] as const) {
+    expect(addNetworkMember(net, c.userId, role, owner.userId, { agentAccess: "all" }).ok).toBe(true);
+  }
+  node(target, targetId, owner.userId);
+  nodeToken = node(memberNode, memberNodeId, member.userId);
+  // Legacy rows may predate the current username reservation on node creation.
+  db.run(`INSERT INTO nodes (node_id, alias, node_name, network_id, owner_user_id)
+    VALUES (?1, ?2, ?2, ?3, ?4)`, [collisionId, member.username, net, owner.userId]);
+  db.run(`INSERT INTO sessions (resume_id, alias, node_id, network_id, status, last_seen_at)
+    VALUES (?1, ?2, ?3, ?4, 'blocked', datetime('now'))`, [`resume_${collisionId}`, member.username, collisionId, net]);
+  db.run(`INSERT INTO tasks (task_id, from_name, to_name, to_node_id, network_id, status, content)
+    VALUES (?1, 'hub', ?2, ?3, ?4, 'delivered', 'fixture pending')`, [`parent_${stamp}`, member.username, collisionId, net]);
+  const plain = createToken(member.userId, "sender-cli");
+  const scoped = createToken(member.userId, "sender-scoped", net);
+  const named = createToken(member.userId, `node:${memberNode}`, net);
+  expect([plain.ok, scoped.ok, named.ok]).toEqual([true, true, true]);
+  callers = [owner, member, admin,
+    { ...member, label: "atok-cli", token: plain.token! },
+    { ...member, label: "atok-network", token: scoped.token! },
+    { ...member, label: "atok-named", token: named.token! }];
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => { server?.stop(true); });
+
+async function dispatch(transport: Transport, token: string, requested?: string, networkId = net) {
+  const marker = `sender-case-${stamp}-${++markerSeq}`;
+  const args: Record<string, unknown> = { alias: target, task: marker, network_id: networkId, meta: { source: "sender-fixture" } };
+  if (requested !== undefined) args[transport === "rest" ? "from" : "from_session"] = requested;
+  const res = await fetch(`${base}${transport === "rest" ? "/api/task" : "/mcp"}`, {
+    method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify(transport === "rest" ? args : {
+      jsonrpc: "2.0", id: markerSeq, method: "tools/call", params: { name: "send_task", arguments: args },
+    }),
+  });
+  const text = await res.text();
+  const data = text.split("\n").filter(s => s.startsWith("data:"));
+  const payload = JSON.parse(data.length ? data.at(-1)!.slice(5).trim() : text);
+  const body = transport === "rest" ? payload : JSON.parse(payload.result.content[0].text);
+  const task = db.get<{ from_name: string; from_node_id: string | null; parent_task_id: string | null; meta_json: string }>(
+    "SELECT from_name, from_node_id, parent_task_id, meta_json FROM tasks WHERE content = ?1", marker);
+  const inbox = db.get<{ n: number | string }>("SELECT COUNT(*) AS n FROM inbox WHERE content = ?1", marker);
+  return { status: res.status, body, task, inboxCount: Number(inbox?.n ?? 0) };
+}
+
+for (const transport of ["rest", "mcp"] as const) {
+  for (const label of ["owner", "member", "admin", "atok-cli", "atok-network", "atok-named"]) {
+    test(`authenticated sender: ${transport} ${label} uses its username`, async () => {
+      const c = callers.find(c => c.label === label)!;
+      for (const from of [undefined, `  ${c.username}  `, ""]) {
+        const r = await dispatch(transport, c.token, from);
+        expect(r.body.task_id ?? r.body.message_id).toBeTruthy();
+        expect(r.task).toMatchObject({ from_name: c.username, from_node_id: null, parent_task_id: null });
+        expect(JSON.parse(r.task!.meta_json).auth_origin).toBe("user");
+        expect(r.inboxCount).toBe(1);
+      }
+    });
+    test(`authenticated sender: ${transport} ${label} rejects another identity without writes`, async () => {
+      const c = callers.find(c => c.label === label)!;
+      for (const from of [memberNode, "hub", "api", `other-${stamp}`]) {
+        const r = await dispatch(transport, c.token, from);
+        if (transport === "rest") expect(r.status).toBe(403);
+        expect(r.body).toMatchObject({ ok: false, error: "from_session_identity_mismatch" });
+        expect(r.task).toBeNull();
+        expect(r.inboxCount).toBe(0);
+      }
+    });
+  }
+  test(`authenticated sender: ${transport} node token retains node attribution`, async () => {
+    const r = await dispatch(transport, nodeToken, memberNode);
+    expect(r.body.task_id ?? r.body.message_id).toBeTruthy();
+    expect(r.task).toMatchObject({ from_name: memberNode, from_node_id: memberNodeId });
+    expect(JSON.parse(r.task!.meta_json).auth_origin).toBe("node");
+  });
+  test(`authenticated sender: ${transport} keeps viewer and network permissions`, async () => {
+    for (const [token, network] of [[viewer.token, net], [owner.token, foreignNet]]) {
+      const r = await dispatch(transport, token, undefined, network);
+      expect(r.body.ok).not.toBe(true);
+      expect(r.task).toBeNull();
+      expect(r.inboxCount).toBe(0);
+    }
+  });
+  test(`authenticated sender: ${transport} does not change a same-named node's state`, async () => {
+    const r = await dispatch(transport, member.token);
+    expect(r.task?.from_node_id).toBeNull();
+    expect(r.task?.parent_task_id).toBeNull();
+    expect(db.get<{ status: string }>("SELECT status FROM sessions WHERE node_id = ?1", collisionId)?.status).toBe("blocked");
+  });
+  test(`authenticated sender: ${transport} preserves human attribution during backfill`, async () => {
+    await dispatch(transport, member.token);
+    backfillMessageNodeIds();
+    expect(db.all<{ from_node_id: string | null }>(
+      "SELECT from_node_id FROM tasks WHERE from_name = ?1", member.username).every(t => t.from_node_id === null)).toBe(true);
+    const legacyId = `legacy_sender_${transport}_${stamp}`;
+    db.run(`INSERT INTO tasks (task_id, from_name, to_name, network_id, content)
+      VALUES (?1, ?2, ?3, ?4, 'legacy fixture')`, [legacyId, memberNode, target, net]);
+    backfillMessageNodeIds();
+    expect(db.get<{ from_node_id: string | null }>("SELECT from_node_id FROM tasks WHERE task_id = ?1", legacyId)?.from_node_id).toBe(memberNodeId);
+  });
+}

package/src/tools.ts

@@ -23,6 +23,7 @@ import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js"
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { resolveInboxCaller } from "./inbox-caller.js";
+import { resolveUserTaskFromSession } from "./rest-identity.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
 import { addAgentNetworkScope, addAgentTimelineScope, addNetworkScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { canMessageAgent, restrictedNetworkIds, RESTRICTED_MEMBER_TOOLS, type AgentRef } from "./agent-access.js";
@@ -1829,7 +1830,17 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       meta: z.any().optional().describe("Optional structured task metadata, e.g. { attachments: [{ type, path, url, mime, name, size }] }."),
       force: z.boolean().optional().describe("dispatch even if the target is degraded (user tokens only)"),
     },
-    async ({ alias, task, priority, context, from_session: _fromIn, ttl_seconds, network_id: netId, parent_task_id: parentIn, meta, force }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+    async ({ alias, task, priority, context, from_session: _fromIn, ttl_seconds, network_id: netId, parent_task_id: parentIn, meta, force }) => {
+      const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch;
+      const humanSender = !callerTokenIsNetwork && !!enforceUserId;
+      const userIdentity = humanSender ? resolveUserTaskFromSession(callerAlias, _fromIn) : null;
+      if (userIdentity && !userIdentity.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({
+          ok: false, error: userIdentity.error, message: userIdentity.message,
+          token_alias: userIdentity.tokenAlias, requested_from_session: userIdentity.requestedFromSession,
+        }) }] };
+      }
+      const from_session = userIdentity?.ok ? userIdentity.fromSession : defaultFrom(_fromIn);
       const effectiveNetId = getNetworkId(netId);
       const authOrigin: TaskAuthOrigin = callerTokenIsNetwork
         ? "node"
@@ -1865,7 +1876,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // network A dispatch and chain-reply into the wrong tenant. The
       // explicit-parent path is verified below in F2.
       let parentTaskId: string | null = parentIn ?? null;
-      if (!parentTaskId && from_session && from_session !== "hub" && from_session !== "api") {
+      if (!humanSender && !parentTaskId && from_session && from_session !== "hub" && from_session !== "api") {
         try {
           const recentParams: any[] = [from_session];
           let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered')"; // board668-parent-delivered-only
@@ -1996,7 +2007,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
 
       console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: ${task.slice(0, 60)}${priority === "high" ? " [HIGH]" : ""}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
-      const fromNodeId = resolveNodeIdForAlias(from_session, effectiveNetId);
+      const fromNodeId = humanSender ? null : resolveNodeIdForAlias(from_session, effectiveNetId);
       const targetNodeId = target.session?.node_id ?? null;
       const resolvedActualTo = actualTo(target, effectiveNetId);
       // #500 step 2 — what is already queued on the target, read BEFORE this task is written (advice only, never blocks).
@@ -2021,7 +2032,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         touchSql = addScope(touchSql, touchParams, effectiveNetId);
         db.run(touchSql, touchParams);
         // #1548 —— 能派活的发送方不可能真的 blocked;此处出 blocked → idle。
-        releaseBlockedSession(from_session, effectiveNetId);
+        if (!humanSender) releaseBlockedSession(from_session, effectiveNetId);
       });
       logTaskEvent(id, null, "delivered", from_session, parentTaskId ? `→ ${targetAlias} (parent=${parentTaskId.slice(0,8)})` : `→ ${targetAlias}`);
       // Only stamp the dedup index after the inbox/tasks transaction