@sleep2agi/commhub-server 0.9.0-preview.138 → 0.9.0-preview.139

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.138",
+  "version": "0.9.0-preview.139",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -2228,7 +2228,7 @@ export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus
 // RFC-039 F3: queries break created_at ties with SQLite's implicit rowid
 // (insertion order). PostgreSQL has none, so give these tables a real one.
 if (db.dialect === "postgres") {
-  for (const table of ["nodes", "user_inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
+  for (const table of ["nodes", "user_inbox", "inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
 }
 
 // Board #625: common SQLite/PostgreSQL DDL. Adoption records authority, not processes.

package/src/human-inbox.ts

@@ -0,0 +1,42 @@
+import { db } from "./db.js";
+
+/** Metadata only: the body of an ordinary blocked task is never fetched by this scan. */
+export function isAuthenticatedHumanInboxRow(row: { type: string; meta_json: unknown }): boolean {
+  if (row.type !== "task" && row.type !== "broadcast") return false;
+  let parsed: unknown;
+  try { parsed = typeof row.meta_json === "string" ? JSON.parse(row.meta_json) : null; }
+  catch { return false; }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+  const meta = parsed as Record<string, unknown>;
+  return meta.auth_origin === "user" && meta.source === "dashboard-chat"
+    && typeof meta.client_request_id === "string" && /^dreq_[a-f0-9]{32}$/.test(meta.client_request_id);
+}
+
+/** Caller supplies the already-authorized recipient/network WHERE clause. Both DB dialects
+ * support this scalar keyset; no JSON SQL extension, OFFSET, or arbitrary depth cutoff. */
+export function selectHumanInboxIds(whereSql: string, params: unknown[], limit: number) {
+  const ids: string[] = [];
+  let cursor: { priority_rank: number; created_at: string; fifo_id: number } | undefined;
+  let examined = 0;
+  const rank = "CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END";
+  while (ids.length < limit) {
+    const pageParams = [...params];
+    let sql = `SELECT id, type, meta_json, created_at, rowid AS fifo_id, ${rank} AS priority_rank ${whereSql}`;
+    if (cursor) {
+      const n = pageParams.length + 1;
+      sql += ` AND (${rank}, created_at, rowid) > (?${n}, ?${n + 1}, ?${n + 2})`;
+      pageParams.push(cursor.priority_rank, cursor.created_at, cursor.fifo_id);
+    }
+    sql += ` ORDER BY ${rank}, created_at, rowid LIMIT 256`;
+    const page = db.all<{ id: string; type: string; meta_json: unknown; priority_rank: number; created_at: string; fifo_id: number }>(sql, ...pageParams);
+    if (!page.length) break;
+    for (const row of page) {
+      examined++;
+      if (isAuthenticatedHumanInboxRow(row)) ids.push(row.id);
+      if (ids.length === limit) break;
+    }
+    cursor = page[page.length - 1];
+    if (page.length < 256) break;
+  }
+  return { ids, examined };
+}

package/src/tools.ts

@@ -1,3 +1,4 @@
+import { selectHumanInboxIds } from "./human-inbox.js";
 import { hostSupervisorIdentityRows } from "./host-supervisor-identity.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { markTaskActivity } from "./task-activity.js";
@@ -1427,13 +1428,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "get_inbox",
-    "Read your inbox.",
+    "Read inbox.",
     {
-      alias: z.string().min(1).max(200).describe("Alias"),
+      alias: z.string().min(1).max(200),
       limit: z.number().min(1).max(100).optional().default(10),
       network_id: z.string().max(200).optional(),
+      human_first: z.boolean().optional(),
     },
-    async ({ alias, limit, network_id: netId }) => {
+    async ({ alias, limit, network_id: netId, human_first }) => {
       const effectiveNetId = getNetworkId(netId);
       const recipient = resolveInboxCaller(alias, { tokenId: callerTokenId, userId: enforceUserId, networkId: effectiveNetId, nodeToken: callerTokenIsNetwork, identityRejected: callerIdentityRejected });
       if (!recipient.ok) return { content: [{ type: "text" as const, text: JSON.stringify(recipient) }] };
@@ -1445,13 +1447,20 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       countSql = addReadScope(countSql, countParams, readScope);
       const rows0 = db.get<{ cnt: number }>(countSql, ...countParams);
       console.log(`[${ts()}] ${alias} → get_inbox: ${rows0?.cnt ?? 0} pending messages`);
+      const scanParams: any[] = [alias];
+      const scanWhere = addReadScope("FROM inbox WHERE session_name = ?1 AND acked = 0", scanParams, readScope);
+      const human = human_first ? selectHumanInboxIds(scanWhere, scanParams, limit) : undefined;
       const rowsParams: any[] = [alias];
       let rowsSql = `SELECT id, type, priority, content, context, from_session, created_at, network_id, meta_json,
          CASE WHEN EXISTS(SELECT 1 FROM task_late_replies lr WHERE lr.inbox_id=inbox.id) THEN 1 ELSE 0 END AS late,
          CASE WHEN type = 'task' THEN COALESCE(task_id, id) ELSE task_id END AS task_id
          FROM inbox WHERE session_name = ?1 AND acked = 0`;
       rowsSql = addReadScope(rowsSql, rowsParams, readScope);
-      rowsSql += ` ORDER BY CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at
+      if (human?.ids.length) {
+        const placeholders = human.ids.map((id) => { rowsParams.push(id); return `?${rowsParams.length}`; });
+        rowsSql += ` ORDER BY CASE WHEN id IN (${placeholders.join(",")}) THEN 0 ELSE 1 END,`;
+      } else rowsSql += " ORDER BY";
+      rowsSql += ` CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at, rowid
          LIMIT ?${rowsParams.length + 1}`;
       rowsParams.push(limit);
       const rows = db.all(rowsSql, ...rowsParams).map((row: any) => {
@@ -1461,7 +1470,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       });
 
       return {
-        content: [{ type: "text" as const, text: JSON.stringify({ ok: true, messages: rows }) }],
+        content: [{ type: "text" as const, text: JSON.stringify({ ok: true, messages: rows, ...(human ? { human_inbox: { version: 1, mode: "metadata-keyset", examined: human.examined } } : {}) }) }],
       };
     }
   );