@sleep2agi/commhub-server 0.9.0-preview.137 → 0.9.0-preview.138

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.137",
+  "version": "0.9.0-preview.138",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/requirements-stats-http.test.ts

@@ -286,3 +286,72 @@ describe("GET /api/requirements/stats", () => {
     expect(r.body.requirement).toBeUndefined();
   });
 });
+
+describe("tag_status current snapshot #1091", () => {
+  let project = "";
+  test("current unarchived four states, distinct memberships and separate null bucket", async () => {
+    const p = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name: "tag-status" });
+    expect(p.status).toBe(201); project = p.body.project.id;
+    const seed = (name: string, extra: Record<string, unknown>) => card(admin.token, name, { project_id: project, ...extra });
+    await seed("tag-pool", { tags: ["a", "b", "a"] });
+    await seed("tag-done", { tags: ["a", "b"], column: "done" });
+    await seed("tag-doing", { tags: ["b"], column: "doing" });
+    await seed("tag-abandoned", { column: "abandoned" });
+    await seed("tag-literal", { tags: ["无标签"] });
+    const invalid = await seed("tag-invalid-legacy", { column: "done" });
+    db.run("UPDATE requirements SET tags_json='invalid legacy json' WHERE requirement_id=?1", [invalid.id]);
+    await seed("tag-visible", { tags: ["visible"], column: "doing", owner: { kind: "user", id: alice.id } });
+    await seed("tag-secret", { tags: ["secret"], column: "done" });
+    const archived = await seed("tag-archived", { tags: ["archived-only"], column: "doing" });
+    expect((await send(admin.token, "PATCH", `/api/requirements/${archived.id}?network_id=${NET}`, { archived: true })).status).toBe(200);
+    const r = await stats(admin.token, `&project_id=${project}`);
+    expect(r.status).toBe(200);
+    expect(r.body.tag_status).toMatchObject({ basis: "current", complete: true, includes_archived: false, project_filter: project, total: 8 });
+    const buckets = new Map(r.body.tag_status.by_tag.map((x: any) => [x.tag, x]));
+    expect(buckets.get("a")).toEqual({ tag: "a", pool: 1, doing: 0, done: 1, abandoned: 0, total: 2 });
+    expect(buckets.get("b")).toEqual({ tag: "b", pool: 1, doing: 1, done: 1, abandoned: 0, total: 3 });
+    expect(buckets.get(null)).toEqual({ tag: null, pool: 0, doing: 0, done: 1, abandoned: 1, total: 2 });
+    expect(buckets.get("无标签")).toMatchObject({ pool: 1, total: 1 });
+    expect(buckets.has("archived-only")).toBe(false);
+    expect(r.body.tag_status.by_tag[0].tag).toBe("b");
+    expect(r.body.tag_status.by_tag.reduce((sum: number, x: any) => sum + x.total, 0)).toBe(10);
+  });
+  test("snapshot ignores time range; completion totals still follow it", async () => {
+    const future = new Date(Date.now() + 86_400_000).toISOString();
+    const r = await stats(admin.token, `&project_id=${project}&from=${encodeURIComponent(future)}&to=${encodeURIComponent(new Date(Date.now()+2*86_400_000).toISOString())}`);
+    expect(r.body.totals.done).toBe(0); expect(r.body.tag_status.total).toBe(8);
+    expect(r.body.tag_status.by_tag.find((x: any) => x.tag === "a").done).toBe(1);
+  });
+  test("same visibility scope hides inaccessible tags and project results", async () => {
+    const r = await stats(alice.token, `&project_id=${project}`);
+    expect(r.status).toBe(200); expect(r.body.tag_status.total).toBe(1);
+    expect(r.body.tag_status.by_tag).toEqual([{ tag: "visible", pool: 0, doing: 1, done: 0, abandoned: 0, total: 1 }]);
+    expect(r.text).not.toContain('"secret"'); expect(r.text).not.toContain('"archived-only"');
+    const empty = await stats(alice.token, `&project_id=${PROJ}`);
+    expect(empty.body.tag_status.total).toBe(0); expect(empty.body.tag_status.by_tag).toEqual([]);
+  });
+  test("project none, unknown project and invalid project query", async () => {
+    const r = await stats(admin.token, "&project_id=none");
+    expect(r.body.tag_status.project_filter).toBe("none");
+    expect(r.body.tag_status.by_tag.every((x: any) => x.tag === null)).toBe(true);
+    expect((await stats(admin.token, "&project_id=proj_missing")).body.tag_status).toMatchObject({ total: 0, by_tag: [] });
+    expect((await stats(admin.token, `&project_id=${"x".repeat(201)}`)).body.error).toBe("invalid_project_id");
+    const list = await send(admin.token, "GET", `/api/requirements?network_id=${NET}`);
+    expect(list.body.capabilities).toContain("tag_status_snapshot");
+  });
+  test("all visible rows counted beyond client 500 limit; another network excluded", async () => {
+    const p = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name: "large-tag-status" });
+    expect(p.status).toBe(201); const large = p.body.project.id;
+    const other = `net_tag_foreign_${Date.now()}`;
+    db.run("INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,'foreign',?2)", [other,admin.id]);
+    db.transaction(() => {
+      for (let i=0;i<502;i++) db.run(`INSERT INTO requirements(requirement_id,network_id,title,column_name,tags_json,project_id,archived,created_at,updated_at)
+        VALUES(?1,?2,'bulk','pool','["bulk"]',?3,0,datetime('now'),datetime('now'))`, [`req_tag_bulk_${large}_${i}`,i===501?other:NET,large]);
+    });
+    const r = await stats(admin.token, `&project_id=${large}&recent=0`);
+    expect(r.status).toBe(200); expect(r.body.tag_status.total).toBe(501);
+    expect(r.body.tag_status.by_tag).toEqual([{ tag: "bulk", pool: 501, doing: 0, done: 0, abandoned: 0, total: 501 }]);
+    const denied = await send(alice.token,"GET",`/api/requirements/stats?network_id=${other}`);
+    expect([403,404]).toContain(denied.status);
+  });
+});

package/src/requirements-stats.ts

@@ -2,6 +2,7 @@
 // 这里只按时间范围 / 时区分桶、按项目 / 完成者计数。放在 JS 里而不是 SQL:按 IANA 时区切「哪一天」在
 // SQLite 和 PostgreSQL 上写法不同,而一个网络的卡片数是几百到几千,整表轻量列读一次就够。
 import { isoInstant } from "./requirements-migrate.js";
+import { storedTags } from "./requirement-tags.js";
 
 export const STATS_DEFAULT_DAYS = 30;
 export const STATS_MAX_DAYS = 371; // 53 周:够画一整年的贡献热力图
@@ -21,9 +22,10 @@ export type StatsRow = {
   completed_at: string | null;
   completed_at_approx: number | null;
   completed_by_json: string | null;
+  tags_json?: string | null;
 };
 
-export type StatsQuery = { fromMs: number | null; toMs: number; tz: string; days: number; recent: number };
+export type StatsQuery = { fromMs: number | null; toMs: number; tz: string; days: number; recent: number; projectId?: string | null };
 type Ref = { kind: "user" | "node"; id: string };
 
 /** 解析 from / to / tz / days。不合法 → 错误码(400)。to 缺省 = 现在;from 缺省 = 不设下限(全部)。 */
@@ -48,7 +50,10 @@ export function parseStatsQuery(q: URLSearchParams, nowMs: number): StatsQuery |
   const recentRaw = q.get("recent");
   const recent = recentRaw === null || recentRaw === "" ? STATS_DEFAULT_RECENT : Number(recentRaw);
   if (!Number.isInteger(recent) || recent < 0 || recent > STATS_MAX_RECENT) return { error: "invalid_recent" };
-  return { fromMs: from, toMs, tz, days, recent };
+  const project = q.get("project_id");
+  if (project && (project.length > 200 || /[\u0000-\u001f\u007f]/u.test(project))) return { error: "invalid_project_id" };
+  return { fromMs: from, toMs, tz, days, recent,
+    ...(project ? { projectId: project === "none" ? null : project } : {}) };
 }
 
 function validTimeZone(tz: string): boolean {
@@ -86,6 +91,7 @@ const parseRef = (json: string | null): Ref | null => {
  * 但归到 unattributed,不出现在 by_completer 里 —— 不给他留「那个节点做了几张」的探测口。
  */
 export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId: string) => boolean) | null) {
+  if (q.projectId !== undefined) rows = rows.filter(row => row.project_id === q.projectId);
   const inRange = (ms: number | null) => ms !== null && ms <= q.toMs && (q.fromMs === null || ms >= q.fromMs);
   const days = dayRange(localDate(q.toMs, q.tz), q.days);
   const firstDay = days[0];
@@ -97,8 +103,21 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
   const byProject = new Map<string | null, number>();
   const byCompleter = new Map<string, { ref: Ref; n: number; spark: Map<string, number> }>();
   const recent: { row: StatsRow; ms: number; by: Ref | null }[] = [];
+  const byTag = new Map<string | null, { tag: string | null; pool: number; doing: number; done: number; abandoned: number; total: number }>();
+  let snapshotTotal = 0;
 
   for (const row of rows) {
+    if (!row.archived && ["pool", "doing", "done", "abandoned"].includes(row.column_name)) {
+      snapshotTotal++;
+      const tags: (string | null)[] = storedTags(row.tags_json ?? null);
+      if (!tags.length) tags.push(null);
+      for (const tag of tags) {
+        let bucket = byTag.get(tag);
+        if (!bucket) byTag.set(tag, bucket = { tag, pool: 0, doing: 0, done: 0, abandoned: 0, total: 0 });
+        bucket[row.column_name as "pool" | "doing" | "done" | "abandoned"]++;
+        bucket.total++;
+      }
+    }
     // 当前还开着的卡(不看时间范围;归档的不算「进行中」)。
     if (!row.archived && row.column_name === "doing") doing++;
     if (!row.archived && row.column_name === "pool") pool++;
@@ -133,6 +152,15 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
 
   const spark = days.slice(-STATS_SPARK_DAYS);
   return {
+    tag_status: {
+      basis: "current", complete: true, includes_archived: false,
+      project_filter: q.projectId === undefined ? null : q.projectId ?? "none",
+      total: snapshotTotal,
+      // Membership counts: a multi-tag card counts once in each distinct tag.
+      by_tag: [...byTag.values()].sort((a, b) =>
+        (b.pool + b.doing) - (a.pool + a.doing) || b.total - a.total ||
+        String(a.tag ?? "\uffff").localeCompare(String(b.tag ?? "\uffff"))),
+    },
     range: { from: q.fromMs === null ? null : new Date(q.fromMs).toISOString(), to: new Date(q.toMs).toISOString(), tz: q.tz },
     totals: {
       done,

package/src/requirements.ts

@@ -770,7 +770,7 @@ function ifNoneMatchHits(header: string | null, etag: string): boolean {
 // list_summary:GET 认 view=summary(不带描述正文与子任务条目,见 toSummary);changes:GET 认 changes=1 + updated_since
 // (改过的卡含归档的,加上 deleted 墓碑与 server_time,见 listChanges)。
 // events:GET /api/requirements/events —— 字段级的改动流水(谁、何时、旧值 → 新值,requirement-events.ts)。
-export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
+export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_status_snapshot", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
 
 // ── 子需求 ──
 // parent_id:同一网络里的另一张卡;不能成环;最多 5 层(顶层是第 1 层)。删父卡 = 子卡保留、parent_id 置空。
@@ -1584,7 +1584,7 @@ async function handleRequirementsRequestInner(ctx: RequirementsRequestContext):
     if ("error" in sq) return jsonError(sq.error, 400);
     const statsParams: unknown[] = [networkId];
     const statsSql = addTaskVisibilityScope(
-      "SELECT requirement_id, seq, title, project_id, column_name, archived, created_at, completed_at, completed_at_approx, completed_by_json FROM requirements WHERE network_id = ?1",
+      "SELECT requirement_id, seq, title, project_id, column_name, archived, created_at, completed_at, completed_at_approx, completed_by_json, tags_json FROM requirements WHERE network_id = ?1",
       statsParams, taskCaller(ctx),
     );
     const rows = db.all<StatsRow>(statsSql, ...statsParams);