@sleep2agi/commhub-server 0.9.0-preview.134 → 0.9.0-preview.135

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.134",
+  "version": "0.9.0-preview.135",
   "description": "CommHub Server \u2014 AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -245,6 +245,7 @@ db.exec(`
     started_at        TEXT,
     runtime_submitted_at TEXT,
     consumed_at       TEXT,
+    last_activity_at  TEXT,
     thread_id         TEXT,
     turn_id           TEXT,
     completed_at      TEXT,
@@ -1557,6 +1558,8 @@ try { db.exec("ALTER TABLE tasks ADD COLUMN meta_json TEXT"); } catch {}
 // started_at (legacy report_status/content matching). Old binaries ignore them.
 try { db.exec("ALTER TABLE tasks ADD COLUMN runtime_submitted_at TEXT"); } catch {}
 try { db.exec("ALTER TABLE tasks ADD COLUMN consumed_at TEXT"); } catch {}
+// #1113: exact original-turn activity. NULL keeps the old execution-clock fallback.
+try { db.exec("ALTER TABLE tasks ADD COLUMN last_activity_at TEXT"); } catch {}
 // Exact vendor-runtime boundary for SideThread-capable clients. These values
 // are written only by the token-bound target node after attributable runtime
 // evidence; the Hub never derives them from task text or caller input.

package/src/node-caller-identity-http.test.ts

@@ -28,6 +28,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { addNetworkMember, createNetworkTokenForNode, register } from "./auth.js";
 import { db, generateNetworkToken, hashToken } from "./db.js";
+import { createTaskRuntimeEvidenceReporter, taskActivityPayload } from "../../agent-node/src/task-runtime-evidence";
 
 const dir = mkdtempSync(join(tmpdir(), "anet-caller-identity-"));
 const activeDbPath = process.env.COMMHUB_DB ?? (process.env.COMMHUB_TEST_PG_URL ? "postgres" : undefined);
@@ -984,3 +985,99 @@ test("duplicate ownerless row keeps an unbound epoch 0 token online", async () =
   first.abort();
   second.abort();
 }, 15_000);
+
+
+const leaseAlias = `leasebase${stamp}`, leaseId = `n_leasebase_${stamp}`;
+let leaseTok: Tok;
+beforeAll(() => { seedNode(leaseId,leaseAlias,NET,ownerId);seedSession(leaseId,leaseAlias,NET);leaseTok=mint(ownerId,NET,leaseAlias,2,leaseId); });
+
+function activityTask(nodeId: string, alias: string, network = NET) {
+  const id = `task_activity_${crypto.randomUUID()}`;
+  db.run("INSERT INTO tasks (task_id, from_name, to_node_id, to_name, status, content, network_id) VALUES (?1, 'scheduler', ?2, ?3, 'running', 'activity fixture', ?4)", [id, nodeId, alias, network]);
+  return { task_id: id, thread_id: `thread_${id}`, turn_id: `turn_${id}` };
+}
+const activitySnap = (id: string) => db.get<any>("SELECT status, consumed_at, runtime_submitted_at, started_at, thread_id, turn_id, last_activity_at FROM tasks WHERE task_id = ?1", id);
+async function consumeActivityTask(context: {task_id: string; thread_id: string; turn_id: string}) {
+  expect((await tool(leaseTok.token, "mark_tasks_consumed", { task_ids: [context.task_id], task_contexts: [context] })).ok).toBe(true);
+}
+const renewActivity = (token: string, contexts: Array<{task_id: string; thread_id: string; turn_id: string}>) => tool(token, "mark_tasks_consumed", { task_ids: contexts.map(c => c.task_id), task_contexts: contexts, activity_only: true });
+
+test("activity lease: exact task renewal changes only the activity clock; duplicate consumption does not renew", async () => {
+  const c = activityTask(leaseId, leaseAlias); await consumeActivityTask(c);
+  db.run("UPDATE tasks SET last_activity_at = datetime('now', '-2 hours') WHERE task_id = ?1", [c.task_id]);
+  const before = activitySnap(c.task_id);
+  expect((await tool(leaseTok.token, "mark_tasks_consumed", { task_ids: [c.task_id], task_contexts: [c] })).ok).toBe(true);
+  expect(activitySnap(c.task_id)).toEqual(before);
+  const out = await renewActivity(leaseTok.token, [c]); expect(out.ok).toBe(true);
+  const after = activitySnap(c.task_id);
+  expect(after.last_activity_at).not.toBe(before.last_activity_at);
+  expect({...after, last_activity_at: before.last_activity_at}).toEqual(before);
+  expect(out.tasks[0].last_activity_at).toBe(after.last_activity_at);
+});
+
+test("activity lease: bound node wins over a same-name session and cannot renew the other node", async () => {
+  const alias = `leasebound${stamp}`, mine = `n_leasebound_${stamp}`, other = `n_leaseother_${stamp}`;
+  seedNode(mine, alias, NET, ownerId); seedSession(mine, alias, NET);
+  const tok = mint(ownerId, NET, leaseAlias, 2, mine), own = activityTask(mine, alias);
+  expect((await tool(tok.token, "mark_tasks_consumed", {task_ids: [own.task_id], task_contexts: [own]})).ok).toBe(true);
+  seedNode(other, alias, NET, ownerId); db.run("UPDATE sessions SET node_id=?1 WHERE alias=?2 AND network_id=?3",[other,alias,NET]);
+  expect((await renewActivity(tok.token, [own])).ok).toBe(true);
+  const foreign = activityTask(other, alias);
+  db.run("UPDATE tasks SET consumed_at=datetime('now'),thread_id=?1,turn_id=?2 WHERE task_id=?3", [foreign.thread_id,foreign.turn_id,foreign.task_id]);
+  expect((await renewActivity(tok.token,[foreign])).error).toBe("task_not_owned");
+  expect(activitySnap(foreign.task_id).last_activity_at).toBeNull();
+});
+
+for (const shape of ["wrong thread", "wrong turn", "foreign node", "foreign network", "legacy null node", "not consumed", "missing context", "user token"] as const) {
+  test(`activity lease: rejects ${shape} without changing the task`, async () => {
+    const c = activityTask(leaseId, leaseAlias); if(shape !== "not consumed") await consumeActivityTask(c);
+    if(shape === "foreign node") db.run("UPDATE tasks SET to_node_id=?1 WHERE task_id=?2", [otherId,c.task_id]);
+    if(shape === "foreign network") db.run("UPDATE tasks SET network_id=?1 WHERE task_id=?2", [NET2,c.task_id]);
+    if(shape === "legacy null node") db.run("UPDATE tasks SET to_node_id=NULL WHERE task_id=?1",[c.task_id]);
+    const before=activitySnap(c.task_id); const context={...c};
+    if(shape === "wrong thread") context.thread_id="sibling_thread";
+    if(shape === "wrong turn") context.turn_id="sibling_turn";
+    const out=await tool(shape === "user token" ? ownerToken : leaseTok.token,"mark_tasks_consumed",{task_ids:[c.task_id],task_contexts:shape === "missing context" ? [] : [context],activity_only:true});
+    expect(out.ok).toBe(false); expect(activitySnap(c.task_id)).toEqual(before);
+  });
+}
+for(const status of ["replied","failed","cancelled","expired"]){
+  test(`activity lease: ${status} terminal never receives activity or reopens`,async()=>{
+    const c=activityTask(leaseId,leaseAlias);await consumeActivityTask(c);db.run("UPDATE tasks SET status=?1 WHERE task_id=?2",[status,c.task_id]);const before=activitySnap(c.task_id);
+    expect((await renewActivity(leaseTok.token,[c])).error).toBe("task_activity_terminal");expect(activitySnap(c.task_id)).toEqual(before);
+  });
+}
+test("activity lease: conflicting batch is rejected with zero partial writes",async()=>{
+  const first=activityTask(leaseId,leaseAlias),second=activityTask(leaseId,leaseAlias);await consumeActivityTask(first);await consumeActivityTask(second);
+  const before=activitySnap(first.task_id),before2=activitySnap(second.task_id);
+  expect((await renewActivity(leaseTok.token,[first,{...second,turn_id:"old_turn"}])).ok).toBe(false);
+  expect(activitySnap(first.task_id)).toEqual(before);expect(activitySnap(second.task_id)).toEqual(before2);
+});
+
+test("activity lease: injected second-write failure rolls back the first write on the real backend",async()=>{
+ const first=activityTask(leaseId,leaseAlias),second=activityTask(leaseId,leaseAlias);await consumeActivityTask(first);await consumeActivityTask(second);
+ const trigger=`activity_fail_${stamp}`,fn=`activity_fn_${stamp}`;
+ if(db.dialect === "postgres")db.exec(`CREATE FUNCTION ${fn}() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN IF NEW.task_id='${second.task_id}' THEN RAISE EXCEPTION 'test1113_injected_activity_failure'; END IF; RETURN NEW; END; $$; CREATE TRIGGER ${trigger} BEFORE UPDATE OF last_activity_at ON tasks FOR EACH ROW EXECUTE FUNCTION ${fn}()`);
+ else db.exec(`CREATE TRIGGER ${trigger} BEFORE UPDATE OF last_activity_at ON tasks WHEN NEW.task_id='${second.task_id}' BEGIN SELECT RAISE(ABORT,'test1113_injected_activity_failure'); END`);
+ const before=activitySnap(first.task_id),before2=activitySnap(second.task_id);let failed=false;
+ try{await renewActivity(leaseTok.token,[first,second]);}catch(e){failed=String(e).includes("test1113_injected_activity_failure");}
+ finally{if(db.dialect === "postgres")db.exec(`DROP TRIGGER ${trigger} ON tasks; DROP FUNCTION ${fn}()`);else db.exec(`DROP TRIGGER ${trigger}`);}
+ expect(failed).toBe(true);expect(activitySnap(first.task_id)).toEqual(before);expect(activitySnap(second.task_id)).toEqual(before2);
+});
+test("activity lease: revoked credential cannot report activity",async()=>{
+ const tok=mint(ownerId,NET,leaseAlias,2,leaseId),c=activityTask(leaseId,leaseAlias);await consumeActivityTask(c);const before=activitySnap(c.task_id);
+ db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id=?1",[tok.tokenId]);
+ const response=await fetch(`${base}/mcp`,{method:"POST",headers:{Authorization:`Bearer ${tok.token}`,"Content-Type":"application/json",Accept:"application/json, text/event-stream"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"tools/call",params:{name:"mark_tasks_consumed",arguments:{task_ids:[c.task_id],task_contexts:[c],activity_only:true}}})});
+ expect(response.status).toBe(401);expect(activitySnap(c.task_id)).toEqual(before);
+});
+
+test("activity lease: real runtime reporter payload traverses authenticated HTTP into the exact task clock",async()=>{
+ const c=activityTask(leaseId,leaseAlias);let clock=0;const errors:string[]=[];
+ const reporter=createTaskRuntimeEvidenceReporter({taskId:c.task_id,now:()=>clock,
+  report:(_level,id,context)=>tool(leaseTok.token,"mark_tasks_consumed",{task_ids:[id],task_contexts:[{task_id:id,thread_id:context!.threadId,turn_id:context!.turnId}]}),
+  reportActivity:(id,context)=>tool(leaseTok.token,"mark_tasks_consumed",taskActivityPayload(id,context)),debug:message=>errors.push(message)});
+ reporter.consumed({threadId:c.thread_id,turnId:c.turn_id});await until(()=>!!activitySnap(c.task_id).consumed_at,"consumption stamped");
+ const before=activitySnap(c.task_id);clock=30_000;reporter.activity({taskId:"other_task",threadId:c.thread_id,turnId:c.turn_id});await new Promise(resolve=>setTimeout(resolve,5));expect(activitySnap(c.task_id)).toEqual(before);
+ reporter.activity({taskId:c.task_id,threadId:c.thread_id,turnId:c.turn_id});await until(()=>!!activitySnap(c.task_id).last_activity_at,"runtime activity stamped");
+ expect(errors).toEqual([]);expect(activitySnap(c.task_id).consumed_at).toBe(before.consumed_at);expect(activitySnap(c.task_id).status).toBe("running");
+});

package/src/scheduled-stuck-http.test.ts

@@ -286,3 +286,27 @@ describe("#1112 execution clock", () => {
     expect(blockerTimedOut({ created_at: "2026-10-13 01:00:00", consumed_at: "2026-10-13 02:00:00" }, schedule, now)).toBe(true);
   });
 });
+
+
+describe("#1113 activity idle clock",()=>{
+ test("fresh exact-task activity protects a long consumed turn, silent activity still expires",()=>{
+  const s=seedSchedule(),first=fire(s),now=new Date(),at=(m:number)=>new Date(now.getTime()-m*60_000).toISOString();
+  db.run("UPDATE tasks SET status='running',created_at=?1,consumed_at=?2,last_activity_at=?3 WHERE task_id=?4",[at(180),at(120),at(1),first.taskId]);
+  expect(fire(s,now).status).toBe("skipped");expect(taskRow(first.taskId!).status).toBe("running");
+  db.run("UPDATE tasks SET last_activity_at=?1 WHERE task_id=?2",[at(61),first.taskId]);expect(fire(s,now).status).toBe("delivered");
+  expect(runRow(first.runId).error_message).toContain("since last_activity_at");
+ });
+ test("fresh activity cannot evade the absolute total cap",()=>{
+  const s=seedSchedule(),first=fire(s),now=new Date(),at=(m:number)=>new Date(now.getTime()-m*60_000).toISOString();
+  db.run("UPDATE tasks SET status='running',created_at=?1,consumed_at=?2,last_activity_at=?3 WHERE task_id=?4",[at(1441),at(1440),at(1),first.taskId]);
+  expect(fire(s,now).status).toBe("delivered");expect(runRow(first.runId).error_message).toContain("total cap");
+ });
+ test("activity without consumption, before consumption or in the future never renews",()=>{
+  const now=new Date("2026-10-13T04:00:00Z"),schedule=JSON.stringify({type:"interval",every_seconds:60});
+  for(const row of [
+   {created_at:"2026-10-13 01:00:00",last_activity_at:"2026-10-13 03:59:00"},
+   {created_at:"2026-10-13 01:00:00",consumed_at:"2026-10-13 02:00:00",last_activity_at:"2026-10-13 01:59:00"},
+   {created_at:"2026-10-13 01:00:00",consumed_at:"2026-10-13 02:00:00",last_activity_at:"2026-10-13 04:01:00"},
+  ])expect(blockerTimedOut(row,schedule,now)).toBe(true);
+ });
+});

package/src/scheduled-stuck.ts

@@ -59,6 +59,7 @@ export function stuckTimeoutMs(scheduleJson: string): number {
 export type StuckBlockerClock = {
   created_at: string;
   consumed_at?: string | null;
+  last_activity_at?: string | null;
   started_at?: string | null;
 };
 
@@ -77,6 +78,12 @@ export function blockerTimeoutClock(blocker: StuckBlockerClock, scheduleJson: st
     if (!value) continue;
     const at = parseDbTimestampMs(value);
     if (Number.isFinite(at) && at <= nowMs && (!Number.isFinite(created) || at >= created)) {
+      if (source === "consumed_at" && blocker.last_activity_at) {
+        const activity = parseDbTimestampMs(blocker.last_activity_at);
+        if (Number.isFinite(activity) && activity >= at && activity <= nowMs) {
+          return { ageMs: nowMs - activity, limitMs: stuckTimeoutMs(scheduleJson), source: "last_activity_at" };
+        }
+      }
       return { ageMs: nowMs - at, limitMs: stuckTimeoutMs(scheduleJson), source };
     }
   }
@@ -153,7 +160,7 @@ export function stuckNoticeText(n: StuckNotice): { title: string; text: string }
     return {
       title: "定时任务被卡住",
       text: `定时任务「${n.scheduleName}」被上一次的执行卡住了:任务 ${n.taskId} 于 ${started} 派给节点 ${n.alias},到现在还没有完成,之后的 ${n.skips} 次执行都被跳过。\n\n`
-        + `从实际开始执行起超过 ${fmtDuration(n.timeoutMs)} 后会被自动按超时结束;尚未开始的任务从派发起计时,所有执行仍受总时限保护。下一次照常派发。等不及可以在任务列表里取消这条任务。`,
+        + `距上次任务活动或实际开始执行超过 ${fmtDuration(n.timeoutMs)} 后会被自动按超时结束;尚未开始的任务从派发起计时,所有执行仍受总时限保护。下一次照常派发。等不及可以在任务列表里取消这条任务。`,
     };
   }
   return {

package/src/scheduled-tasks.ts

@@ -412,8 +412,8 @@ export function dispatchScheduledOccurrence(row: ScheduledRow, scheduledFor: str
       // received:节点那边有没有把这条任务取走过(inbox 行被 ack,或任务已进 acked/running)。
       // 跳过记录带上它,客户端才分得清「节点还没收到」和「节点在处理」—— 前者是投递故障,
       // 后者才是真的上一次还没做完。
-      const findOpen = () => db.get<{ task_id: string; received: number; created_at: string; consumed_at: string | null; started_at: string | null; status: string }>(
-        `SELECT r.task_id, t.created_at, t.consumed_at, t.started_at, t.status,
+      const findOpen = () => db.get<{ task_id: string; received: number; created_at: string; consumed_at: string | null; started_at: string | null; last_activity_at: string | null; status: string }>(
+        `SELECT r.task_id, t.created_at, t.consumed_at, t.started_at, t.last_activity_at, t.status,
                 CASE WHEN t.status IN ('acked', 'running')
                        OR EXISTS (SELECT 1 FROM inbox i WHERE (i.task_id = r.task_id OR i.id = r.task_id) AND i.acked = 1)
                      THEN 1 ELSE 0 END AS received

package/src/task-activity.ts

@@ -0,0 +1,60 @@
+import { db } from "./db.js";
+import { resolveNodeCaller } from "./create-node.js";
+
+type Context = { task_id: string; thread_id: string; turn_id: string };
+
+/** Renew only an already-consumed, exact original turn. No alias/content/heartbeat inference. */
+export function markTaskActivity(input: {
+  tokenId: string | null | undefined;
+  networkId: string | null | undefined;
+  nodeToken: boolean;
+  identityRejected: boolean;
+  taskIds: string[];
+  contexts: Context[];
+}) {
+  const deny = (error: string, task_id?: string) => ({ ok: false as const, error, ...(task_id ? { task_id } : {}) });
+  if (!input.nodeToken || !input.networkId || input.identityRejected) return deny("node_token_required");
+  if (db.transactionalFeaturesRefusal !== null) return deny("task_runtime_evidence_backend_unsupported");
+  if (new Set(input.taskIds).size !== input.taskIds.length) return deny("duplicate_task_id");
+  const contexts = new Map(input.contexts.map((c) => [c.task_id, c]));
+  if (contexts.size !== input.contexts.length) return deny("duplicate_task_context");
+  const foreign = input.contexts.find((c) => !input.taskIds.includes(c.task_id));
+  if (foreign) return deny("task_context_not_requested", foreign.task_id);
+  const missing = input.taskIds.find((id) => !contexts.has(id));
+  if (missing) return deny("task_activity_context_required", missing);
+
+  return db.transaction(() => {
+    // Resolve inside the transaction: renamed sessions and same-name rows cannot substitute for the token.
+    const caller = resolveNodeCaller(input.tokenId);
+    if (!caller.ok || caller.kind !== "node" || caller.networkId !== input.networkId) return deny("node_token_required");
+    const placeholders = input.taskIds.map((_, i) => `?${i + 2}`).join(", ");
+    const rows = db.all<{ task_id: string; to_node_id: string | null; status: string; consumed_at: string | null; thread_id: string | null; turn_id: string | null }>(
+      `SELECT task_id, to_node_id, status, consumed_at, thread_id, turn_id FROM tasks
+       WHERE network_id = ?1 AND task_id IN (${placeholders})`, input.networkId, ...input.taskIds,
+    );
+    const byId = new Map(rows.map((row) => [row.task_id, row]));
+    for (const id of input.taskIds) {
+      const row = byId.get(id);
+      if (!row || row.to_node_id !== caller.nodeId) return deny("task_not_owned", id);
+      if (!["created", "delivered", "acked", "running"].includes(row.status)) return deny("task_activity_terminal", id);
+      if (!row.consumed_at || !row.thread_id || !row.turn_id) return deny("task_activity_not_consumed", id);
+      const context = contexts.get(id)!;
+      if (row.thread_id !== context.thread_id || row.turn_id !== context.turn_id) return deny("task_runtime_context_conflict", id);
+    }
+    for (const id of input.taskIds) {
+      const context = contexts.get(id)!;
+      const changed = db.run(
+        `UPDATE tasks SET last_activity_at = datetime('now')
+         WHERE task_id = ?1 AND network_id = ?2 AND to_node_id = ?3
+           AND thread_id = ?4 AND turn_id = ?5 AND consumed_at IS NOT NULL
+           AND status IN ('created', 'delivered', 'acked', 'running')`,
+        [id, input.networkId, caller.nodeId, context.thread_id, context.turn_id],
+      );
+      if (changed.changes !== 1) throw new Error(`task_activity_write_race:${id}`);
+    }
+    return { ok: true as const, tasks: db.all<{ task_id: string; last_activity_at: string }>(
+      `SELECT task_id, last_activity_at FROM tasks WHERE network_id = ?1 AND task_id IN (${placeholders})`,
+      input.networkId, ...input.taskIds,
+    ) };
+  });
+}

package/src/tools.ts

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { markTaskActivity } from "./task-activity.js";
 import { requestProviderSnapshot, requestProviderWrite, requestProviderCollection, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
 import { readHubProviders, putHubProvider, bindHubProvider } from './hub-provider-config.js';
 import { requestScopedSecrets, getScopedSecrets, pullScopedSecrets, ackScopedSecrets, requestNodeSecrets, pullNodeSecrets, ackNodeSecrets } from './scoped-secrets.js';
@@ -1696,9 +1697,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "mark_tasks_consumed",
-    "Internal agent-node signal: exact tasks produced attributable turn-start/activity evidence in this token-bound node's runtime.",
-    taskRuntimeEvidenceSchema,
-    async ({ task_ids, task_contexts }) => markTaskRuntimeEvidence(task_ids, "consumed", task_contexts),
+    "Internal token-bound task consumption; activity_only reports original-turn activity.",
+    { ...taskRuntimeEvidenceSchema, activity_only: z.boolean().optional() },
+    async ({ task_ids, task_contexts, activity_only }) => activity_only
+      ? { content: [{ type: "text" as const, text: JSON.stringify(markTaskActivity({ tokenId: callerTokenId, networkId: enforceNetworkId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected, taskIds: task_ids, contexts: task_contexts ?? [] })) }] }
+      : markTaskRuntimeEvidence(task_ids, "consumed", task_contexts),
   );
 
   // ═══════════════════════════════════════════