@sleep2agi/commhub-server 0.9.0-preview.136 → 0.9.0-preview.138

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.136",
+  "version": "0.9.0-preview.138",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/create-node.ts

@@ -237,7 +237,8 @@ export type NodeCallerResolution =
   | { ok: true; kind: "unregistered"; alias: string; networkId: string }
   | { ok: false; reason: "not_a_node_token" | "bound_node_missing" | "ambiguous" | "not_owner" };
 
-type NodeCallerRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
+export type NodeCallerRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
+export type NodeCallerToken = { name: string; network_id: string | null; user_id: string | null; bound_node_id: string | null; node_identity_epoch: number };
 
 // nodes has no unique (network, alias). An unbound token that hits several
 // rows is not rejected outright: the row owned by the token's issuer wins;
@@ -246,18 +247,12 @@ type NodeCallerRow = { node_id: string; alias: string; network_id: string; owner
 function disambiguateUnboundAlias(
   rows: NodeCallerRow[],
   userId: string | null,
-  alias: string,
-  networkId: string,
+  recentNodeId: string | null,
 ): NodeCallerRow | undefined {
   const owned = userId ? rows.filter((row) => row.owner_user_id === userId) : [];
   if (owned.length === 1) return owned[0]; // board679-unbound-dup
   const pool = owned.length > 1 ? owned : rows;
-  const recent = db.get<{ node_id: string | null }>(
-    `SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND node_id IS NOT NULL ORDER BY updated_at DESC LIMIT 1`,
-    alias,
-    networkId,
-  );
-  const hit = recent?.node_id ? pool.filter((row) => row.node_id === recent.node_id) : [];
+  const hit = recentNodeId ? pool.filter((row) => row.node_id === recentNodeId) : [];
   return hit.length === 1 ? hit[0] : undefined;
 }
 
@@ -268,7 +263,7 @@ function disambiguateUnboundAlias(
 // do not get a second exception.
 export function resolveNodeCaller(tokenId: string | null | undefined): NodeCallerResolution {
   if (!tokenId) return { ok: false, reason: "not_a_node_token" };
-  const tokRow = db.get<{ name: string; network_id: string | null; user_id: string | null; bound_node_id: string | null; node_identity_epoch: number }>(
+  const tokRow = db.get<NodeCallerToken>(
     `SELECT name, network_id, user_id, bound_node_id, node_identity_epoch FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL`,
     tokenId,
   );
@@ -280,10 +275,26 @@ export function resolveNodeCaller(tokenId: string | null | undefined): NodeCalle
   const rows = tokRow.bound_node_id
     ? db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE node_id = ?1 AND network_id = ?2`, tokRow.bound_node_id, tokRow.network_id)
     : db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE alias = ?1 AND network_id = ?2`, tokenAlias, tokRow.network_id);
+  const recent = !tokRow.bound_node_id && rows.length > 1
+    ? db.get<{ node_id: string | null }>(
+      `SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND node_id IS NOT NULL ORDER BY updated_at DESC LIMIT 1`,
+      tokenAlias, tokRow.network_id,
+    ) : null;
+  return resolveNodeCallerFromRows(tokRow, rows, recent?.node_id ?? null);
+}
+
+/** Shared identity contract for individual callers and scoped, batched list reads. */
+export function resolveNodeCallerFromRows(
+  tokRow: NodeCallerToken, rows: NodeCallerRow[], recentNodeId: string | null,
+): NodeCallerResolution {
+  if (!tokRow.name?.startsWith("node:") || !tokRow.network_id) {
+    return { ok: false, reason: "not_a_node_token" };
+  }
+  const tokenAlias = tokRow.name.slice(5);
   const nodeRow = rows.length === 1
     ? rows[0]
     : (!tokRow.bound_node_id && rows.length > 1
-      ? disambiguateUnboundAlias(rows, tokRow.user_id, tokenAlias, tokRow.network_id)
+      ? disambiguateUnboundAlias(rows, tokRow.user_id, recentNodeId)
       : undefined);
   // board679-bound-row-missing: a bound token with no row is refused. Do not look up by name.
   if (tokRow.bound_node_id && !nodeRow) return { ok: false, reason: "bound_node_missing" };

package/src/host-supervisor-identity-http.test.ts

@@ -0,0 +1,136 @@
+import { afterAll, beforeAll, beforeEach, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { register } from "./auth.js";
+import { registerTools } from "./tools.js";
+import { hostSupervisorIdentityRows } from "./host-supervisor-identity.js";
+
+if (!process.env.COMMHUB_DB && !process.env.COMMHUB_TEST_PG_URL) throw Error("explicit fixture DB required");
+let net: string, foreign: string, user: string, token: string, hub: any, base: string;
+let sequence = 0;
+const next = () => `n_lhs1109_${++sequence}`;
+beforeAll(async () => {
+  const auth = register(`lhs1109_${Date.now()}`, "FixturePassword1109!", undefined, "fixture");
+  if (!auth.ok || !auth.token || !auth.user || !auth.network_id) throw Error("fixture registration failed");
+  user = auth.user.user_id; token = auth.token; net = auth.network_id;
+  foreign = `net_foreign_lhs1109_${Date.now()}`;
+  db.run("INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,'foreign',?2)", [foreign, user]);
+  process.env.HOST = "127.0.0.1";
+  const { bootServer } = await import("./server.js");
+  hub = await bootServer({ port: 0 }); base = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+beforeEach(() => {
+  db.run("DELETE FROM api_tokens WHERE name LIKE 'node:lhs1109_%'");
+  db.run("DELETE FROM sessions WHERE alias LIKE 'lhs1109_%'");
+  db.run("DELETE FROM nodes WHERE alias LIKE 'lhs1109_%'");
+});
+afterAll(() => hub?.stop(true));
+
+function node(alias: string, network = net, owner: string | null = user) {
+  const id = next();
+  db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,config_snapshot)
+    VALUES(?1,?2,?2,?3,?4,'{"role":"host_supervisor"}')`, [id, `lhs1109_${alias}`, network, owner]);
+  return id;
+}
+function credential(id: string, opts: { bound?: string | null; name?: string; issuer?: string; epoch?: number; network?: string; scope?: string; expired?: boolean; revoked?: boolean } = {}) {
+  const n = db.get<any>("SELECT alias, network_id FROM nodes WHERE node_id=?1", id)!;
+  const tid = `tok_lhs1109_${++sequence}`;
+  db.run(`INSERT INTO api_tokens(token_id,token_hash,user_id,network_id,scope,name,bound_node_id,node_identity_epoch,expires_at,revoked_at)
+    VALUES(?1,?2,?3,?4,?5,?6,?7,?8,?9,?10)`, [tid, `hash_${tid}`, opts.issuer ?? user,
+    opts.network ?? n.network_id, opts.scope ?? "network", `node:${opts.name ?? n.alias}`,
+    opts.bound === undefined ? id : opts.bound, opts.epoch ?? 2,
+    opts.expired ? "2000-01-01 00:00:00" : null, opts.revoked ? "2000-01-01 00:00:00" : null]);
+  return tid;
+}
+function heartbeat(id: string, opts: { bound?: string | null; network?: string | null; alias?: string; age?: number } = {}) {
+  const n = db.get<any>("SELECT alias,network_id FROM nodes WHERE node_id=?1", id)!;
+  db.run(`INSERT INTO sessions(resume_id,alias,network_id,node_id,last_seen_at,status,cpu_cores,mem_total_gb,ip)
+    VALUES(?1,?2,?3,?4,?5,'idle',8,16,'10.1.1.1')`, [`s_lhs1109_${++sequence}`, opts.alias ?? n.alias,
+    opts.network === undefined ? n.network_id : opts.network, opts.bound === undefined ? id : opts.bound,
+    new Date(Date.now() - (opts.age ?? 0)).toISOString()]);
+}
+async function list(entry: "MCP" | "REST") {
+  if (entry === "REST") {
+    const r = await fetch(`${base}/api/host-supervisors?network_id=${net}`, { headers: { Authorization: `Bearer ${token}` } });
+    expect(r.status).toBe(200); return (await r.json() as any).daemons as any[];
+  }
+  const server = new McpServer({ name: "fixture", version: "0" }) as any;
+  let handler: any;
+  const original = server.tool.bind(server);
+  server.tool = (name: string, desc: string, schema: any, fn: any) => {
+    if (name === "list_host_supervisors") handler = fn;
+    return original(name, desc, schema, fn);
+  };
+  registerTools(server, undefined, null, user, null, false, null);
+  const result = await handler({ network_id: net });
+  const parsed = JSON.parse(result.content[0].text); expect(parsed.ok).toBe(true); return parsed.daemons as any[];
+}
+for (const entry of ["MCP", "REST"] as const) {
+  test(`${entry}: bound credentials survive stale token names and rotations dedupe`, async () => {
+    const id = node("renamed"); credential(id, { name: "lhs1109_oldname" }); credential(id); heartbeat(id);
+    const rows = await list(entry); expect(rows.length).toBe(1);
+    expect(rows[0]).toMatchObject({ daemon_node_id: id, online: true });
+    expect(JSON.stringify(rows)).not.toContain("hash_");
+  });
+  test(`${entry}: same-name foreign binding and missing bound node cannot authenticate daemon`, async () => {
+    const id = node("victim"), other = node("victim", foreign);
+    credential(id, { bound: other }); credential(id, { bound: "n_lhs1109_missing" }); heartbeat(id);
+    expect(await list(entry)).toEqual([]);
+  });
+  test(`${entry}: legacy owner and epoch-zero ownerless keep compatibility; squatter and new ownerless rejected`, async () => {
+    const good = node("owned"), old = node("old", net, null), squatter = node("squatter"), recent = node("recent", net, null);
+    credential(good, { bound: null }); credential(old, { bound: null, epoch: 0 });
+    credential(squatter, { bound: null, issuer: "u_foreign_fixture" }); credential(recent, { bound: null, epoch: 1 });
+    const ids = (await list(entry)).map(r => r.daemon_node_id).sort(); expect(ids).toEqual([good, old].sort());
+  });
+  test(`${entry}: same-alias sibling heartbeat cannot make stopped daemon online`, async () => {
+    const stopped = node("duplicate"), live = node("duplicate"); credential(stopped); credential(live); heartbeat(live);
+    const rows = await list(entry);
+    expect(rows.find(r => r.daemon_node_id === stopped)).toMatchObject({ online: false, last_seen_at: null });
+    expect(rows.find(r => r.daemon_node_id === live)).toMatchObject({ online: true });
+  });
+  test(`${entry}: null-ID heartbeat requires unique alias in its network`, async () => {
+    const unique = node("unique"), a = node("ambiguous"), b = node("ambiguous");
+    for (const id of [unique,a,b]) credential(id);
+    heartbeat(unique, { bound: null }); heartbeat(a, { bound: null });
+    const rows = await list(entry);
+    expect(rows.find(r => r.daemon_node_id === unique).online).toBe(true);
+    expect(rows.filter(r => r.daemon_node_id !== unique).map(r => r.online)).toEqual([false,false]);
+  });
+  test(`${entry}: null-network legacy heartbeat is accepted only for globally unique aliases`, async () => {
+    const unique = node("globalunique"), shared = node("globalshared"); node("globalshared", foreign);
+    credential(unique); credential(shared);
+    heartbeat(unique, { bound: null, network: null }); heartbeat(shared, { bound: null, network: null });
+    const rows = await list(entry);
+    expect(rows.find(r => r.daemon_node_id === unique).online).toBe(true);
+    expect(rows.find(r => r.daemon_node_id === shared).online).toBe(false);
+  });
+  test(`${entry}: bound heartbeat ignores stale alias but refuses wrong network and stale timestamps`, async () => {
+    const renamed = node("newalias"), wrong = node("wrongnet"), stale = node("stale");
+    for (const id of [renamed,wrong,stale]) credential(id);
+    heartbeat(renamed, { alias: "lhs1109_stalealias" }); heartbeat(wrong, { network: foreign }); heartbeat(stale, { age: 360_000 });
+    const rows = await list(entry);
+    expect(rows.find(r => r.daemon_node_id === renamed).online).toBe(true);
+    expect(rows.filter(r => r.daemon_node_id !== renamed).map(r => r.online)).toEqual([false,false]);
+  });
+  test(`${entry}: unbound duplicate-owner disambiguation uses authoritative recent session`, async () => {
+    const a = node("unboundduplicate"), b = node("unboundduplicate"); credential(a, { bound: null }); heartbeat(b);
+    const rows = await list(entry); expect(rows.length).toBe(1); expect(rows[0]).toMatchObject({ daemon_node_id: b, online: true });
+  });
+  test(`${entry}: deleted, revoked, expired and wrong-scope credentials excluded`, async () => {
+    for (const [label,opts] of [["expired",{ expired:true }],["revoked",{ revoked:true }],["scope",{ scope:"full" }],["deleted",{}]] as const) {
+      const id = node(label), tid = credential(id, opts); heartbeat(id);
+      if (label === "deleted") db.run("DELETE FROM api_tokens WHERE token_id=?1", [tid]);
+    }
+    expect(await list(entry)).toEqual([]);
+  });
+}
+test("batched list performs three reads for many daemons and multiple scoped networks", () => {
+  for (let i=0;i<30;i++) { const id=node(`fleet${i}`, i%2 ? net : foreign); credential(id); heartbeat(id); }
+  const original = db.all.bind(db); let reads=0;
+  db.all = ((sql: string, ...params: any[]) => { reads++; return original(sql, ...params); }) as any;
+  try {
+    const rows = hostSupervisorIdentityRows("SELECT * FROM nodes WHERE network_id=?1 OR network_id=?2", [net,foreign]);
+    expect(rows.length).toBe(30); expect(reads).toBe(3);
+  } finally { db.all = original; }
+});

package/src/host-supervisor-identity.ts

@@ -0,0 +1,92 @@
+import { db } from "./db.js";
+import { resolveNodeCallerFromRows, type NodeCallerRow, type NodeCallerToken } from "./create-node.js";
+import { parseDbTimestampMs } from "./db-timestamp.js";
+
+type NodeRow = NodeCallerRow & Record<string, any>;
+type SessionRow = {
+  node_id: string | null; alias: string; network_id: string | null;
+  last_seen_at: string | null; status: string | null;
+  cpu_cores: number | null; mem_total_gb: number | null; ip: string | null;
+  legacy_alias_count: number;
+};
+const key = (network: string, alias: string) => JSON.stringify([network, alias]);
+const push = <T>(map: Map<string, T[]>, id: string, value: T) => {
+  const list = map.get(id) ?? []; list.push(value); map.set(id, list);
+};
+
+/** The caller supplies a scoped nodes query, never an unchecked network id.
+ * Three SQL reads regardless of fleet size; no token secrets are selected.
+ * All node roles participate in legacy alias disambiguation.
+ */
+export function hostSupervisorIdentityRows(scopedNodesSql: string, params: any[]): NodeRow[] {
+  const nodes = db.all<NodeRow>(scopedNodesSql, ...params);
+  if (!nodes.length) return [];
+  const tokens = db.all<NodeCallerToken>(`
+    SELECT t.name, t.network_id, t.user_id, t.bound_node_id, t.node_identity_epoch
+    FROM api_tokens t
+    WHERE t.network_id IN (SELECT scoped.network_id FROM (${scopedNodesSql}) scoped)
+      AND t.scope='network' AND t.revoked_at IS NULL
+      AND (t.expires_at IS NULL OR t.expires_at > datetime('now'))
+      AND t.name LIKE 'node:%'
+  `, ...params);
+  const sessions = db.all<SessionRow>(`
+    SELECT s.node_id, s.alias, s.network_id, s.last_seen_at, s.status,
+           s.cpu_cores, s.mem_total_gb, s.ip,
+           CASE WHEN s.network_id IS NULL AND s.node_id IS NULL THEN
+             (SELECT COUNT(*) FROM nodes n WHERE n.alias=s.alias)
+           ELSE 0 END AS legacy_alias_count
+    FROM sessions s
+    WHERE s.network_id IN (SELECT scoped.network_id FROM (${scopedNodesSql}) scoped)
+       OR (s.network_id IS NULL AND (
+         s.alias IN (SELECT scoped.alias FROM (${scopedNodesSql}) scoped)
+         OR s.node_id IN (SELECT scoped.node_id FROM (${scopedNodesSql}) scoped)))
+    ORDER BY s.updated_at DESC
+  `, ...params);
+  const byId = new Map(nodes.map(n => [n.node_id, n]));
+  const byAlias = new Map<string, NodeRow[]>();
+  const byGlobalAlias = new Map<string, NodeRow[]>();
+  for (const n of nodes) {
+    push(byAlias, key(n.network_id, n.alias), n);
+    push(byGlobalAlias, n.alias, n);
+  }
+  const recent = new Map<string, string>();
+  for (const s of sessions) {
+    if (!s.network_id || !s.node_id) continue;
+    const id = key(s.network_id, s.alias);
+    if (!recent.has(id)) recent.set(id, s.node_id);
+  }
+  const credentialed = new Set<string>();
+  for (const t of tokens) {
+    if (!t.network_id) continue;
+    const bound = t.bound_node_id ? byId.get(t.bound_node_id) : null;
+    const rows = t.bound_node_id
+      ? (bound?.network_id === t.network_id ? [bound] : [])
+      : byAlias.get(key(t.network_id, t.name.slice(5))) ?? [];
+    const caller = resolveNodeCallerFromRows(t, rows, recent.get(key(t.network_id, t.name.slice(5))) ?? null);
+    if (caller.ok && caller.kind === "node") credentialed.add(caller.nodeId);
+  }
+  const heartbeat = new Map<string, SessionRow>();
+  for (const s of sessions) {
+    let node: NodeRow | undefined;
+    if (s.node_id) {
+      node = byId.get(s.node_id);
+      if (s.network_id !== null && node?.network_id !== s.network_id) continue;
+    } else if (s.network_id) {
+      const matches = byAlias.get(key(s.network_id, s.alias)) ?? [];
+      if (matches.length === 1) node = matches[0];
+    } else if (Number(s.legacy_alias_count) === 1) {
+      node = byGlobalAlias.get(s.alias)?.[0];
+    }
+    if (!node || !s.last_seen_at || !Number.isFinite(parseDbTimestampMs(s.last_seen_at))) continue;
+    const previous = heartbeat.get(node.node_id);
+    if (!previous || parseDbTimestampMs(s.last_seen_at) > parseDbTimestampMs(previous.last_seen_at!)) {
+      heartbeat.set(node.node_id, s);
+    }
+  }
+  return nodes.filter(n => credentialed.has(n.node_id)).map(n => {
+    const s = heartbeat.get(n.node_id);
+    return { ...n, session_last_seen: s?.last_seen_at ?? null, session_status: s?.status ?? null,
+      session_cpu_cores: s?.cpu_cores ?? null, session_mem_total_gb: s?.mem_total_gb ?? null,
+      session_ip: s?.ip ?? null };
+  });
+}

package/src/list-host-supervisors.test.ts

@@ -40,6 +40,7 @@ function cleanup() {
   try { db.run("DELETE FROM users WHERE user_id LIKE 'u_lhs_%'"); } catch {}
 }
 
+// Each case starts empty; plain INSERT keeps these fixtures portable to PostgreSQL.
 beforeEach(cleanup);
 afterAll(cleanup);
 
@@ -52,7 +53,7 @@ function seedUser(user_id: string) {
 }
 function seedNetwork(net_id: string, owner_id = "u_lhs_owner") {
   db.run(
-    `INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at)
+    `INSERT INTO networks (network_id, network_name, owner_id, created_at)
      VALUES (?1, ?2, ?3, datetime('now'))`,
     [net_id, net_id, owner_id],
   );
@@ -81,7 +82,7 @@ function seedDaemon(opts: {
     allowed_secret_keys: opts.secrets ?? [],
   });
   db.run(
-    `INSERT OR REPLACE INTO nodes (
+    `INSERT INTO nodes (
       node_id, node_name, alias, network_id,
       runtimes_supported, allowed_secret_keys,
       config_snapshot, hostname,
@@ -95,14 +96,14 @@ function seedDaemon(opts: {
   if (opts.sessionAgeMs !== undefined) {
     const ts = new Date(Date.now() - opts.sessionAgeMs).toISOString().replace("T", " ").replace(/\..+/, "");
     db.run(
-      `INSERT OR REPLACE INTO sessions (resume_id, alias, network_id, last_seen_at, status, cpu_cores, mem_total_gb, ip)
+      `INSERT INTO sessions (resume_id, alias, network_id, last_seen_at, status, cpu_cores, mem_total_gb, ip)
        VALUES (?1, ?2, ?3, ?4, 'idle', 8, 16, '10.0.0.5')`,
       [`s_${node_id}`, opts.alias, opts.network_id, ts],
     );
   }
   if (opts.mintToken !== false && !opts.tokenDeleted) {
     db.run(
-      `INSERT OR REPLACE INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+      `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
        VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, ?6)`,
       [`tok_${node_id}`, `u_seed_${node_id}`, opts.network_id, `node:${opts.alias}`,
        `hash_${node_id}`,

package/src/requirements-stats-http.test.ts

@@ -286,3 +286,72 @@ describe("GET /api/requirements/stats", () => {
     expect(r.body.requirement).toBeUndefined();
   });
 });
+
+describe("tag_status current snapshot #1091", () => {
+  let project = "";
+  test("current unarchived four states, distinct memberships and separate null bucket", async () => {
+    const p = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name: "tag-status" });
+    expect(p.status).toBe(201); project = p.body.project.id;
+    const seed = (name: string, extra: Record<string, unknown>) => card(admin.token, name, { project_id: project, ...extra });
+    await seed("tag-pool", { tags: ["a", "b", "a"] });
+    await seed("tag-done", { tags: ["a", "b"], column: "done" });
+    await seed("tag-doing", { tags: ["b"], column: "doing" });
+    await seed("tag-abandoned", { column: "abandoned" });
+    await seed("tag-literal", { tags: ["无标签"] });
+    const invalid = await seed("tag-invalid-legacy", { column: "done" });
+    db.run("UPDATE requirements SET tags_json='invalid legacy json' WHERE requirement_id=?1", [invalid.id]);
+    await seed("tag-visible", { tags: ["visible"], column: "doing", owner: { kind: "user", id: alice.id } });
+    await seed("tag-secret", { tags: ["secret"], column: "done" });
+    const archived = await seed("tag-archived", { tags: ["archived-only"], column: "doing" });
+    expect((await send(admin.token, "PATCH", `/api/requirements/${archived.id}?network_id=${NET}`, { archived: true })).status).toBe(200);
+    const r = await stats(admin.token, `&project_id=${project}`);
+    expect(r.status).toBe(200);
+    expect(r.body.tag_status).toMatchObject({ basis: "current", complete: true, includes_archived: false, project_filter: project, total: 8 });
+    const buckets = new Map(r.body.tag_status.by_tag.map((x: any) => [x.tag, x]));
+    expect(buckets.get("a")).toEqual({ tag: "a", pool: 1, doing: 0, done: 1, abandoned: 0, total: 2 });
+    expect(buckets.get("b")).toEqual({ tag: "b", pool: 1, doing: 1, done: 1, abandoned: 0, total: 3 });
+    expect(buckets.get(null)).toEqual({ tag: null, pool: 0, doing: 0, done: 1, abandoned: 1, total: 2 });
+    expect(buckets.get("无标签")).toMatchObject({ pool: 1, total: 1 });
+    expect(buckets.has("archived-only")).toBe(false);
+    expect(r.body.tag_status.by_tag[0].tag).toBe("b");
+    expect(r.body.tag_status.by_tag.reduce((sum: number, x: any) => sum + x.total, 0)).toBe(10);
+  });
+  test("snapshot ignores time range; completion totals still follow it", async () => {
+    const future = new Date(Date.now() + 86_400_000).toISOString();
+    const r = await stats(admin.token, `&project_id=${project}&from=${encodeURIComponent(future)}&to=${encodeURIComponent(new Date(Date.now()+2*86_400_000).toISOString())}`);
+    expect(r.body.totals.done).toBe(0); expect(r.body.tag_status.total).toBe(8);
+    expect(r.body.tag_status.by_tag.find((x: any) => x.tag === "a").done).toBe(1);
+  });
+  test("same visibility scope hides inaccessible tags and project results", async () => {
+    const r = await stats(alice.token, `&project_id=${project}`);
+    expect(r.status).toBe(200); expect(r.body.tag_status.total).toBe(1);
+    expect(r.body.tag_status.by_tag).toEqual([{ tag: "visible", pool: 0, doing: 1, done: 0, abandoned: 0, total: 1 }]);
+    expect(r.text).not.toContain('"secret"'); expect(r.text).not.toContain('"archived-only"');
+    const empty = await stats(alice.token, `&project_id=${PROJ}`);
+    expect(empty.body.tag_status.total).toBe(0); expect(empty.body.tag_status.by_tag).toEqual([]);
+  });
+  test("project none, unknown project and invalid project query", async () => {
+    const r = await stats(admin.token, "&project_id=none");
+    expect(r.body.tag_status.project_filter).toBe("none");
+    expect(r.body.tag_status.by_tag.every((x: any) => x.tag === null)).toBe(true);
+    expect((await stats(admin.token, "&project_id=proj_missing")).body.tag_status).toMatchObject({ total: 0, by_tag: [] });
+    expect((await stats(admin.token, `&project_id=${"x".repeat(201)}`)).body.error).toBe("invalid_project_id");
+    const list = await send(admin.token, "GET", `/api/requirements?network_id=${NET}`);
+    expect(list.body.capabilities).toContain("tag_status_snapshot");
+  });
+  test("all visible rows counted beyond client 500 limit; another network excluded", async () => {
+    const p = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name: "large-tag-status" });
+    expect(p.status).toBe(201); const large = p.body.project.id;
+    const other = `net_tag_foreign_${Date.now()}`;
+    db.run("INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,'foreign',?2)", [other,admin.id]);
+    db.transaction(() => {
+      for (let i=0;i<502;i++) db.run(`INSERT INTO requirements(requirement_id,network_id,title,column_name,tags_json,project_id,archived,created_at,updated_at)
+        VALUES(?1,?2,'bulk','pool','["bulk"]',?3,0,datetime('now'),datetime('now'))`, [`req_tag_bulk_${large}_${i}`,i===501?other:NET,large]);
+    });
+    const r = await stats(admin.token, `&project_id=${large}&recent=0`);
+    expect(r.status).toBe(200); expect(r.body.tag_status.total).toBe(501);
+    expect(r.body.tag_status.by_tag).toEqual([{ tag: "bulk", pool: 501, doing: 0, done: 0, abandoned: 0, total: 501 }]);
+    const denied = await send(alice.token,"GET",`/api/requirements/stats?network_id=${other}`);
+    expect([403,404]).toContain(denied.status);
+  });
+});

package/src/requirements-stats.ts

@@ -2,6 +2,7 @@
 // 这里只按时间范围 / 时区分桶、按项目 / 完成者计数。放在 JS 里而不是 SQL:按 IANA 时区切「哪一天」在
 // SQLite 和 PostgreSQL 上写法不同,而一个网络的卡片数是几百到几千,整表轻量列读一次就够。
 import { isoInstant } from "./requirements-migrate.js";
+import { storedTags } from "./requirement-tags.js";
 
 export const STATS_DEFAULT_DAYS = 30;
 export const STATS_MAX_DAYS = 371; // 53 周:够画一整年的贡献热力图
@@ -21,9 +22,10 @@ export type StatsRow = {
   completed_at: string | null;
   completed_at_approx: number | null;
   completed_by_json: string | null;
+  tags_json?: string | null;
 };
 
-export type StatsQuery = { fromMs: number | null; toMs: number; tz: string; days: number; recent: number };
+export type StatsQuery = { fromMs: number | null; toMs: number; tz: string; days: number; recent: number; projectId?: string | null };
 type Ref = { kind: "user" | "node"; id: string };
 
 /** 解析 from / to / tz / days。不合法 → 错误码(400)。to 缺省 = 现在;from 缺省 = 不设下限(全部)。 */
@@ -48,7 +50,10 @@ export function parseStatsQuery(q: URLSearchParams, nowMs: number): StatsQuery |
   const recentRaw = q.get("recent");
   const recent = recentRaw === null || recentRaw === "" ? STATS_DEFAULT_RECENT : Number(recentRaw);
   if (!Number.isInteger(recent) || recent < 0 || recent > STATS_MAX_RECENT) return { error: "invalid_recent" };
-  return { fromMs: from, toMs, tz, days, recent };
+  const project = q.get("project_id");
+  if (project && (project.length > 200 || /[\u0000-\u001f\u007f]/u.test(project))) return { error: "invalid_project_id" };
+  return { fromMs: from, toMs, tz, days, recent,
+    ...(project ? { projectId: project === "none" ? null : project } : {}) };
 }
 
 function validTimeZone(tz: string): boolean {
@@ -86,6 +91,7 @@ const parseRef = (json: string | null): Ref | null => {
  * 但归到 unattributed,不出现在 by_completer 里 —— 不给他留「那个节点做了几张」的探测口。
  */
 export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId: string) => boolean) | null) {
+  if (q.projectId !== undefined) rows = rows.filter(row => row.project_id === q.projectId);
   const inRange = (ms: number | null) => ms !== null && ms <= q.toMs && (q.fromMs === null || ms >= q.fromMs);
   const days = dayRange(localDate(q.toMs, q.tz), q.days);
   const firstDay = days[0];
@@ -97,8 +103,21 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
   const byProject = new Map<string | null, number>();
   const byCompleter = new Map<string, { ref: Ref; n: number; spark: Map<string, number> }>();
   const recent: { row: StatsRow; ms: number; by: Ref | null }[] = [];
+  const byTag = new Map<string | null, { tag: string | null; pool: number; doing: number; done: number; abandoned: number; total: number }>();
+  let snapshotTotal = 0;
 
   for (const row of rows) {
+    if (!row.archived && ["pool", "doing", "done", "abandoned"].includes(row.column_name)) {
+      snapshotTotal++;
+      const tags: (string | null)[] = storedTags(row.tags_json ?? null);
+      if (!tags.length) tags.push(null);
+      for (const tag of tags) {
+        let bucket = byTag.get(tag);
+        if (!bucket) byTag.set(tag, bucket = { tag, pool: 0, doing: 0, done: 0, abandoned: 0, total: 0 });
+        bucket[row.column_name as "pool" | "doing" | "done" | "abandoned"]++;
+        bucket.total++;
+      }
+    }
     // 当前还开着的卡(不看时间范围;归档的不算「进行中」)。
     if (!row.archived && row.column_name === "doing") doing++;
     if (!row.archived && row.column_name === "pool") pool++;
@@ -133,6 +152,15 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
 
   const spark = days.slice(-STATS_SPARK_DAYS);
   return {
+    tag_status: {
+      basis: "current", complete: true, includes_archived: false,
+      project_filter: q.projectId === undefined ? null : q.projectId ?? "none",
+      total: snapshotTotal,
+      // Membership counts: a multi-tag card counts once in each distinct tag.
+      by_tag: [...byTag.values()].sort((a, b) =>
+        (b.pool + b.doing) - (a.pool + a.doing) || b.total - a.total ||
+        String(a.tag ?? "\uffff").localeCompare(String(b.tag ?? "\uffff"))),
+    },
     range: { from: q.fromMs === null ? null : new Date(q.fromMs).toISOString(), to: new Date(q.toMs).toISOString(), tz: q.tz },
     totals: {
       done,

package/src/requirements.ts

@@ -770,7 +770,7 @@ function ifNoneMatchHits(header: string | null, etag: string): boolean {
 // list_summary:GET 认 view=summary(不带描述正文与子任务条目,见 toSummary);changes:GET 认 changes=1 + updated_since
 // (改过的卡含归档的,加上 deleted 墓碑与 server_time,见 listChanges)。
 // events:GET /api/requirements/events —— 字段级的改动流水(谁、何时、旧值 → 新值,requirement-events.ts)。
-export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
+export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_status_snapshot", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
 
 // ── 子需求 ──
 // parent_id:同一网络里的另一张卡;不能成环;最多 5 层(顶层是第 1 层)。删父卡 = 子卡保留、parent_id 置空。
@@ -1584,7 +1584,7 @@ async function handleRequirementsRequestInner(ctx: RequirementsRequestContext):
     if ("error" in sq) return jsonError(sq.error, 400);
     const statsParams: unknown[] = [networkId];
     const statsSql = addTaskVisibilityScope(
-      "SELECT requirement_id, seq, title, project_id, column_name, archived, created_at, completed_at, completed_at_approx, completed_by_json FROM requirements WHERE network_id = ?1",
+      "SELECT requirement_id, seq, title, project_id, column_name, archived, created_at, completed_at, completed_at_approx, completed_by_json, tags_json FROM requirements WHERE network_id = ?1",
       statsParams, taskCaller(ctx),
     );
     const rows = db.all<StatsRow>(statsSql, ...statsParams);

package/src/server.ts

@@ -1,3 +1,4 @@
+import { hostSupervisorIdentityRows } from "./host-supervisor-identity.js";
 import { buildServeErrorResponse } from "./serve-error.js";
 import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
 import { markGzipReusable, maybeGzipResponse, trimLightTask } from "./http-gzip";
@@ -4574,31 +4575,10 @@ return Bun.serve({
         isPrivileged = true;
       }
 
-      // EXISTS subquery handles BOTH revoked_at SET and DELETEd token
-      // rows (revokeToken DELETEs the row in production — PR2 v1
-      // SHOULD-FIX per 通信龙 audit). EXISTS naturally dedupes daemons
-      // with rotated tokens.
-      const sqlRows = db.all<Record<string, any>>(`
-        SELECT
-          n.node_id, n.alias, n.hostname, n.network_id,
+      const sqlRows = hostSupervisorIdentityRows(`SELECT n.node_id, n.alias, n.hostname, n.network_id, n.owner_user_id,
           n.runtimes_supported, n.allowed_secret_keys,
-          n.created_at, n.updated_at,
-          s.last_seen_at AS session_last_seen,
-          s.cpu_cores AS session_cpu_cores,
-          s.mem_total_gb AS session_mem_total_gb,
-          s.ip AS session_ip,
-          n.config_snapshot
-        FROM nodes n
-        LEFT JOIN sessions s ON s.alias = n.alias AND (s.network_id = n.network_id OR s.network_id IS NULL)
-        WHERE n.network_id = ?1
-          AND EXISTS (
-            SELECT 1 FROM api_tokens t
-            WHERE t.network_id = n.network_id
-              AND t.name = 'node:' || n.alias
-              AND t.revoked_at IS NULL
-          )
-        ORDER BY n.updated_at DESC
-      `, effectiveNetId);
+          n.created_at, n.updated_at, n.config_snapshot
+        FROM nodes n WHERE n.network_id = ?1 ORDER BY n.updated_at DESC`, [effectiveNetId]);
 
       const nowMs = Date.now();
       // 心跳周期是 3 分钟（agent-node/src/cli.ts 的 report_status 定时器），

package/src/tools.ts

@@ -1,3 +1,4 @@
+import { hostSupervisorIdentityRows } from "./host-supervisor-identity.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { markTaskActivity } from "./task-activity.js";
 import { requestProviderSnapshot, requestProviderWrite, requestProviderCollection, requestProviderApplication, requestProviderLogin, getProviderSnapshot, pullProviderSnapshots, ackProviderSnapshot } from "./daemon-provider-snapshots.js";
@@ -4277,35 +4278,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // (already gate-locked by enforceNetworkId path of resolveReadScope).
       const isPrivileged = callerRole === "admin" || callerRole === "owner" || (!enforceUserId);
 
-      // Pull candidate daemons. Active-token EXISTS subquery handles BOTH
-      // revoked daemon ntoks (revoked_at set) AND DELETEd token rows
-      // (the standard revokeToken path deletes the row, not flagging
-      // revoked_at — PR2 v1 SHOULD-FIX per 通信龙 audit). EXISTS naturally
-      // dedupes if a daemon ever had multiple tokens (e.g. rotation; nit ⚪).
-      let sql = `
-        SELECT
-          n.node_id, n.alias, n.hostname, n.network_id,
+      // Scope first; batch immutable credential + heartbeat identity for both list entry points.
+      let sql = `SELECT n.node_id, n.alias, n.hostname, n.network_id, n.owner_user_id,
           n.runtimes_supported, n.allowed_secret_keys,
-          n.created_at, n.updated_at,
-          s.last_seen_at AS session_last_seen,
-          s.status AS session_status,
-          s.cpu_cores AS session_cpu_cores,
-          s.mem_total_gb AS session_mem_total_gb,
-          s.ip AS session_ip,
-          n.config_snapshot
-        FROM nodes n
-        LEFT JOIN sessions s ON s.alias = n.alias AND (s.network_id = n.network_id OR s.network_id IS NULL)
-        WHERE EXISTS (
-          SELECT 1 FROM api_tokens t
-          WHERE t.network_id = n.network_id
-            AND t.name = 'node:' || n.alias
-            AND t.revoked_at IS NULL
-        )
-      `;
+          n.created_at, n.updated_at, n.config_snapshot FROM nodes n WHERE 1=1`;
       const sqlParams: any[] = [];
       sql = addReadScope(sql, sqlParams, readScope, "n.network_id");
       sql += ` ORDER BY n.updated_at DESC`;
-      const rows = db.all<Record<string, any>>(sql, ...sqlParams);
+      const rows = hostSupervisorIdentityRows(sql, sqlParams);
 
       // Filter to role=host_supervisor (read from config_snapshot;
       // schema-promoted columns runtimes_supported/allowed_secret_keys