@sleep2agi/commhub-server 0.9.0-preview.137 → 0.9.0-preview.139

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.137",
+  "version": "0.9.0-preview.139",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -2228,7 +2228,7 @@ export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus
 // RFC-039 F3: queries break created_at ties with SQLite's implicit rowid
 // (insertion order). PostgreSQL has none, so give these tables a real one.
 if (db.dialect === "postgres") {
-  for (const table of ["nodes", "user_inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
+  for (const table of ["nodes", "user_inbox", "inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
 }
 
 // Board #625: common SQLite/PostgreSQL DDL. Adoption records authority, not processes.

package/src/human-inbox.ts

@@ -0,0 +1,42 @@
+import { db } from "./db.js";
+
+/** Metadata only: the body of an ordinary blocked task is never fetched by this scan. */
+export function isAuthenticatedHumanInboxRow(row: { type: string; meta_json: unknown }): boolean {
+  if (row.type !== "task" && row.type !== "broadcast") return false;
+  let parsed: unknown;
+  try { parsed = typeof row.meta_json === "string" ? JSON.parse(row.meta_json) : null; }
+  catch { return false; }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+  const meta = parsed as Record<string, unknown>;
+  return meta.auth_origin === "user" && meta.source === "dashboard-chat"
+    && typeof meta.client_request_id === "string" && /^dreq_[a-f0-9]{32}$/.test(meta.client_request_id);
+}
+
+/** Caller supplies the already-authorized recipient/network WHERE clause. Both DB dialects
+ * support this scalar keyset; no JSON SQL extension, OFFSET, or arbitrary depth cutoff. */
+export function selectHumanInboxIds(whereSql: string, params: unknown[], limit: number) {
+  const ids: string[] = [];
+  let cursor: { priority_rank: number; created_at: string; fifo_id: number } | undefined;
+  let examined = 0;
+  const rank = "CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END";
+  while (ids.length < limit) {
+    const pageParams = [...params];
+    let sql = `SELECT id, type, meta_json, created_at, rowid AS fifo_id, ${rank} AS priority_rank ${whereSql}`;
+    if (cursor) {
+      const n = pageParams.length + 1;
+      sql += ` AND (${rank}, created_at, rowid) > (?${n}, ?${n + 1}, ?${n + 2})`;
+      pageParams.push(cursor.priority_rank, cursor.created_at, cursor.fifo_id);
+    }
+    sql += ` ORDER BY ${rank}, created_at, rowid LIMIT 256`;
+    const page = db.all<{ id: string; type: string; meta_json: unknown; priority_rank: number; created_at: string; fifo_id: number }>(sql, ...pageParams);
+    if (!page.length) break;
+    for (const row of page) {
+      examined++;
+      if (isAuthenticatedHumanInboxRow(row)) ids.push(row.id);
+      if (ids.length === limit) break;
+    }
+    cursor = page[page.length - 1];
+    if (page.length < 256) break;
+  }
+  return { ids, examined };
+}

package/src/requirements-stats-http.test.ts

@@ -286,3 +286,72 @@ describe("GET /api/requirements/stats", () => {
     expect(r.body.requirement).toBeUndefined();
   });
 });
+
+describe("tag_status current snapshot #1091", () => {
+  let project = "";
+  test("current unarchived four states, distinct memberships and separate null bucket", async () => {
+    const p = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name: "tag-status" });
+    expect(p.status).toBe(201); project = p.body.project.id;
+    const seed = (name: string, extra: Record<string, unknown>) => card(admin.token, name, { project_id: project, ...extra });
+    await seed("tag-pool", { tags: ["a", "b", "a"] });
+    await seed("tag-done", { tags: ["a", "b"], column: "done" });
+    await seed("tag-doing", { tags: ["b"], column: "doing" });
+    await seed("tag-abandoned", { column: "abandoned" });
+    await seed("tag-literal", { tags: ["无标签"] });
+    const invalid = await seed("tag-invalid-legacy", { column: "done" });
+    db.run("UPDATE requirements SET tags_json='invalid legacy json' WHERE requirement_id=?1", [invalid.id]);
+    await seed("tag-visible", { tags: ["visible"], column: "doing", owner: { kind: "user", id: alice.id } });
+    await seed("tag-secret", { tags: ["secret"], column: "done" });
+    const archived = await seed("tag-archived", { tags: ["archived-only"], column: "doing" });
+    expect((await send(admin.token, "PATCH", `/api/requirements/${archived.id}?network_id=${NET}`, { archived: true })).status).toBe(200);
+    const r = await stats(admin.token, `&project_id=${project}`);
+    expect(r.status).toBe(200);
+    expect(r.body.tag_status).toMatchObject({ basis: "current", complete: true, includes_archived: false, project_filter: project, total: 8 });
+    const buckets = new Map(r.body.tag_status.by_tag.map((x: any) => [x.tag, x]));
+    expect(buckets.get("a")).toEqual({ tag: "a", pool: 1, doing: 0, done: 1, abandoned: 0, total: 2 });
+    expect(buckets.get("b")).toEqual({ tag: "b", pool: 1, doing: 1, done: 1, abandoned: 0, total: 3 });
+    expect(buckets.get(null)).toEqual({ tag: null, pool: 0, doing: 0, done: 1, abandoned: 1, total: 2 });
+    expect(buckets.get("无标签")).toMatchObject({ pool: 1, total: 1 });
+    expect(buckets.has("archived-only")).toBe(false);
+    expect(r.body.tag_status.by_tag[0].tag).toBe("b");
+    expect(r.body.tag_status.by_tag.reduce((sum: number, x: any) => sum + x.total, 0)).toBe(10);
+  });
+  test("snapshot ignores time range; completion totals still follow it", async () => {
+    const future = new Date(Date.now() + 86_400_000).toISOString();
+    const r = await stats(admin.token, `&project_id=${project}&from=${encodeURIComponent(future)}&to=${encodeURIComponent(new Date(Date.now()+2*86_400_000).toISOString())}`);
+    expect(r.body.totals.done).toBe(0); expect(r.body.tag_status.total).toBe(8);
+    expect(r.body.tag_status.by_tag.find((x: any) => x.tag === "a").done).toBe(1);
+  });
+  test("same visibility scope hides inaccessible tags and project results", async () => {
+    const r = await stats(alice.token, `&project_id=${project}`);
+    expect(r.status).toBe(200); expect(r.body.tag_status.total).toBe(1);
+    expect(r.body.tag_status.by_tag).toEqual([{ tag: "visible", pool: 0, doing: 1, done: 0, abandoned: 0, total: 1 }]);
+    expect(r.text).not.toContain('"secret"'); expect(r.text).not.toContain('"archived-only"');
+    const empty = await stats(alice.token, `&project_id=${PROJ}`);
+    expect(empty.body.tag_status.total).toBe(0); expect(empty.body.tag_status.by_tag).toEqual([]);
+  });
+  test("project none, unknown project and invalid project query", async () => {
+    const r = await stats(admin.token, "&project_id=none");
+    expect(r.body.tag_status.project_filter).toBe("none");
+    expect(r.body.tag_status.by_tag.every((x: any) => x.tag === null)).toBe(true);
+    expect((await stats(admin.token, "&project_id=proj_missing")).body.tag_status).toMatchObject({ total: 0, by_tag: [] });
+    expect((await stats(admin.token, `&project_id=${"x".repeat(201)}`)).body.error).toBe("invalid_project_id");
+    const list = await send(admin.token, "GET", `/api/requirements?network_id=${NET}`);
+    expect(list.body.capabilities).toContain("tag_status_snapshot");
+  });
+  test("all visible rows counted beyond client 500 limit; another network excluded", async () => {
+    const p = await send(admin.token, "POST", "/api/requirements/projects", { network_id: NET, name: "large-tag-status" });
+    expect(p.status).toBe(201); const large = p.body.project.id;
+    const other = `net_tag_foreign_${Date.now()}`;
+    db.run("INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,'foreign',?2)", [other,admin.id]);
+    db.transaction(() => {
+      for (let i=0;i<502;i++) db.run(`INSERT INTO requirements(requirement_id,network_id,title,column_name,tags_json,project_id,archived,created_at,updated_at)
+        VALUES(?1,?2,'bulk','pool','["bulk"]',?3,0,datetime('now'),datetime('now'))`, [`req_tag_bulk_${large}_${i}`,i===501?other:NET,large]);
+    });
+    const r = await stats(admin.token, `&project_id=${large}&recent=0`);
+    expect(r.status).toBe(200); expect(r.body.tag_status.total).toBe(501);
+    expect(r.body.tag_status.by_tag).toEqual([{ tag: "bulk", pool: 501, doing: 0, done: 0, abandoned: 0, total: 501 }]);
+    const denied = await send(alice.token,"GET",`/api/requirements/stats?network_id=${other}`);
+    expect([403,404]).toContain(denied.status);
+  });
+});

package/src/requirements-stats.ts

@@ -2,6 +2,7 @@
 // 这里只按时间范围 / 时区分桶、按项目 / 完成者计数。放在 JS 里而不是 SQL:按 IANA 时区切「哪一天」在
 // SQLite 和 PostgreSQL 上写法不同,而一个网络的卡片数是几百到几千,整表轻量列读一次就够。
 import { isoInstant } from "./requirements-migrate.js";
+import { storedTags } from "./requirement-tags.js";
 
 export const STATS_DEFAULT_DAYS = 30;
 export const STATS_MAX_DAYS = 371; // 53 周:够画一整年的贡献热力图
@@ -21,9 +22,10 @@ export type StatsRow = {
   completed_at: string | null;
   completed_at_approx: number | null;
   completed_by_json: string | null;
+  tags_json?: string | null;
 };
 
-export type StatsQuery = { fromMs: number | null; toMs: number; tz: string; days: number; recent: number };
+export type StatsQuery = { fromMs: number | null; toMs: number; tz: string; days: number; recent: number; projectId?: string | null };
 type Ref = { kind: "user" | "node"; id: string };
 
 /** 解析 from / to / tz / days。不合法 → 错误码(400)。to 缺省 = 现在;from 缺省 = 不设下限(全部)。 */
@@ -48,7 +50,10 @@ export function parseStatsQuery(q: URLSearchParams, nowMs: number): StatsQuery |
   const recentRaw = q.get("recent");
   const recent = recentRaw === null || recentRaw === "" ? STATS_DEFAULT_RECENT : Number(recentRaw);
   if (!Number.isInteger(recent) || recent < 0 || recent > STATS_MAX_RECENT) return { error: "invalid_recent" };
-  return { fromMs: from, toMs, tz, days, recent };
+  const project = q.get("project_id");
+  if (project && (project.length > 200 || /[\u0000-\u001f\u007f]/u.test(project))) return { error: "invalid_project_id" };
+  return { fromMs: from, toMs, tz, days, recent,
+    ...(project ? { projectId: project === "none" ? null : project } : {}) };
 }
 
 function validTimeZone(tz: string): boolean {
@@ -86,6 +91,7 @@ const parseRef = (json: string | null): Ref | null => {
  * 但归到 unattributed,不出现在 by_completer 里 —— 不给他留「那个节点做了几张」的探测口。
  */
 export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId: string) => boolean) | null) {
+  if (q.projectId !== undefined) rows = rows.filter(row => row.project_id === q.projectId);
   const inRange = (ms: number | null) => ms !== null && ms <= q.toMs && (q.fromMs === null || ms >= q.fromMs);
   const days = dayRange(localDate(q.toMs, q.tz), q.days);
   const firstDay = days[0];
@@ -97,8 +103,21 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
   const byProject = new Map<string | null, number>();
   const byCompleter = new Map<string, { ref: Ref; n: number; spark: Map<string, number> }>();
   const recent: { row: StatsRow; ms: number; by: Ref | null }[] = [];
+  const byTag = new Map<string | null, { tag: string | null; pool: number; doing: number; done: number; abandoned: number; total: number }>();
+  let snapshotTotal = 0;
 
   for (const row of rows) {
+    if (!row.archived && ["pool", "doing", "done", "abandoned"].includes(row.column_name)) {
+      snapshotTotal++;
+      const tags: (string | null)[] = storedTags(row.tags_json ?? null);
+      if (!tags.length) tags.push(null);
+      for (const tag of tags) {
+        let bucket = byTag.get(tag);
+        if (!bucket) byTag.set(tag, bucket = { tag, pool: 0, doing: 0, done: 0, abandoned: 0, total: 0 });
+        bucket[row.column_name as "pool" | "doing" | "done" | "abandoned"]++;
+        bucket.total++;
+      }
+    }
     // 当前还开着的卡(不看时间范围;归档的不算「进行中」)。
     if (!row.archived && row.column_name === "doing") doing++;
     if (!row.archived && row.column_name === "pool") pool++;
@@ -133,6 +152,15 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
 
   const spark = days.slice(-STATS_SPARK_DAYS);
   return {
+    tag_status: {
+      basis: "current", complete: true, includes_archived: false,
+      project_filter: q.projectId === undefined ? null : q.projectId ?? "none",
+      total: snapshotTotal,
+      // Membership counts: a multi-tag card counts once in each distinct tag.
+      by_tag: [...byTag.values()].sort((a, b) =>
+        (b.pool + b.doing) - (a.pool + a.doing) || b.total - a.total ||
+        String(a.tag ?? "\uffff").localeCompare(String(b.tag ?? "\uffff"))),
+    },
     range: { from: q.fromMs === null ? null : new Date(q.fromMs).toISOString(), to: new Date(q.toMs).toISOString(), tz: q.tz },
     totals: {
       done,

package/src/requirements.ts

@@ -770,7 +770,7 @@ function ifNoneMatchHits(header: string | null, etag: string): boolean {
 // list_summary:GET 认 view=summary(不带描述正文与子任务条目,见 toSummary);changes:GET 认 changes=1 + updated_since
 // (改过的卡含归档的,加上 deleted 墓碑与 server_time,见 listChanges)。
 // events:GET /api/requirements/events —— 字段级的改动流水(谁、何时、旧值 → 新值,requirement-events.ts)。
-export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
+export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_status_snapshot", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
 
 // ── 子需求 ──
 // parent_id:同一网络里的另一张卡;不能成环;最多 5 层(顶层是第 1 层)。删父卡 = 子卡保留、parent_id 置空。
@@ -1584,7 +1584,7 @@ async function handleRequirementsRequestInner(ctx: RequirementsRequestContext):
     if ("error" in sq) return jsonError(sq.error, 400);
     const statsParams: unknown[] = [networkId];
     const statsSql = addTaskVisibilityScope(
-      "SELECT requirement_id, seq, title, project_id, column_name, archived, created_at, completed_at, completed_at_approx, completed_by_json FROM requirements WHERE network_id = ?1",
+      "SELECT requirement_id, seq, title, project_id, column_name, archived, created_at, completed_at, completed_at_approx, completed_by_json, tags_json FROM requirements WHERE network_id = ?1",
       statsParams, taskCaller(ctx),
     );
     const rows = db.all<StatsRow>(statsSql, ...statsParams);

package/src/tools.ts

@@ -1,3 +1,4 @@
+import { selectHumanInboxIds } from "./human-inbox.js";
 import { hostSupervisorIdentityRows } from "./host-supervisor-identity.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { markTaskActivity } from "./task-activity.js";
@@ -1427,13 +1428,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "get_inbox",
-    "Read your inbox.",
+    "Read inbox.",
     {
-      alias: z.string().min(1).max(200).describe("Alias"),
+      alias: z.string().min(1).max(200),
       limit: z.number().min(1).max(100).optional().default(10),
       network_id: z.string().max(200).optional(),
+      human_first: z.boolean().optional(),
     },
-    async ({ alias, limit, network_id: netId }) => {
+    async ({ alias, limit, network_id: netId, human_first }) => {
       const effectiveNetId = getNetworkId(netId);
       const recipient = resolveInboxCaller(alias, { tokenId: callerTokenId, userId: enforceUserId, networkId: effectiveNetId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected });
       if (!recipient.ok) return { content: [{ type: "text" as const, text: JSON.stringify(recipient) }] };
@@ -1445,13 +1447,20 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       countSql = addReadScope(countSql, countParams, readScope);
       const rows0 = db.get<{ cnt: number }>(countSql, ...countParams);
       console.log(`[${ts()}] ${alias} → get_inbox: ${rows0?.cnt ?? 0} pending messages`);
+      const scanParams: any[] = [alias];
+      const scanWhere = addReadScope("FROM inbox WHERE session_name = ?1 AND acked = 0", scanParams, readScope);
+      const human = human_first ? selectHumanInboxIds(scanWhere, scanParams, limit) : undefined;
       const rowsParams: any[] = [alias];
       let rowsSql = `SELECT id, type, priority, content, context, from_session, created_at, network_id, meta_json,
          CASE WHEN EXISTS(SELECT 1 FROM task_late_replies lr WHERE lr.inbox_id=inbox.id) THEN 1 ELSE 0 END AS late,
          CASE WHEN type = 'task' THEN COALESCE(task_id, id) ELSE task_id END AS task_id
          FROM inbox WHERE session_name = ?1 AND acked = 0`;
       rowsSql = addReadScope(rowsSql, rowsParams, readScope);
-      rowsSql += ` ORDER BY CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at
+      if (human?.ids.length) {
+        const placeholders = human.ids.map((id) => { rowsParams.push(id); return `?${rowsParams.length}`; });
+        rowsSql += ` ORDER BY CASE WHEN id IN (${placeholders.join(",")}) THEN 0 ELSE 1 END,`;
+      } else rowsSql += " ORDER BY";
+      rowsSql += ` CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at, rowid
          LIMIT ?${rowsParams.length + 1}`;
       rowsParams.push(limit);
       const rows = db.all(rowsSql, ...rowsParams).map((row: any) => {
@@ -1461,7 +1470,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       });
 
       return {
-        content: [{ type: "text" as const, text: JSON.stringify({ ok: true, messages: rows }) }],
+        content: [{ type: "text" as const, text: JSON.stringify({ ok: true, messages: rows, ...(human ? { human_inbox: { version: 1, mode: "metadata-keyset", examined: human.examined } } : {}) }) }],
       };
     }
   );