@sleep2agi/commhub-server 0.9.0-preview.139 → 0.9.0-preview.140

package/src/create-node-validate.ts

@@ -56,7 +56,7 @@ export type Runtime = typeof RUNTIMES[number];
 //    FLAG_KEYS)和老 daemon(buildAnetArgsDaemon)都**拒绝**,新 app 撞到老组件得到的是一条报错。
 export const FLAG_KEYS = [
   "permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout",
-  "copresence", "opencodeGeneration", "opencodeUnsafeTools",
+  "copresence", "opencodeGeneration", "opencodeUnsafeTools", "opencodeNewServer",
   "approvalPolicy", "sandboxMode", "skipGitRepoCheck", "copresenceFullAccess", "modelReasoningEffort",
   "daemonProvider",
 ] as const;
@@ -151,6 +151,7 @@ export function validateFlagValue(k: string, v: unknown): void {
       if (v !== "v1" && v !== "v2") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be v1 or v2" });
       return;
     case "opencodeUnsafeTools":
+    case "opencodeNewServer":
       if (typeof v !== "boolean") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be boolean" });
       return;
     case "permissionMode":
@@ -198,7 +199,7 @@ export function validateFlagsForRuntime(runtime: string, flags: Record<string, u
   }
   // Strict flags envelope: old Hub/daemon reject these keys rather than dropping
   // unknown node_spec fields. Opt-in must be explicit on this create request.
-  for (const field of ["opencodeGeneration", "opencodeUnsafeTools"]) {
+  for (const field of ["opencodeGeneration", "opencodeUnsafeTools", "opencodeNewServer"]) {
     if (!Object.prototype.hasOwnProperty.call(flags, field)) continue;
     validateFlagValue(field, flags[field]);
     if (runtime !== "opencode-cli") throw new ValidationError("flag_not_applicable_to_runtime", { field, runtime, applicable: ["opencode-cli"] });
@@ -209,6 +210,9 @@ export function validateFlagsForRuntime(runtime: string, flags: Record<string, u
   if (flags.opencodeGeneration === "v2" && flags.opencodeUnsafeTools !== true) {
     throw new ValidationError("opencode_v2_requires_unsafe_opt_in", { reason: "V2 preview enables every local tool; trusted tasks only. Explicit opencodeUnsafeTools=true required." });
   }
+  if (Object.prototype.hasOwnProperty.call(flags, "opencodeNewServer") && flags.opencodeGeneration !== "v2") {
+    throw new ValidationError("opencode_new_server_requires_v2", { reason: "opencodeNewServer requires explicit opencodeGeneration=v2" });
+  }
   if (Object.prototype.hasOwnProperty.call(flags, "copresence") && !(COPRESENCE_FLAG_RUNTIMES as readonly string[]).includes(runtime)) {
     throw new ValidationError("flag_not_applicable_to_runtime", {
       field: "copresence", runtime, applicable: [...COPRESENCE_FLAG_RUNTIMES],
@@ -408,6 +412,7 @@ export function buildAnetArgs(spec: NodeSpec): string[] {
       // `anet node create --copresence` 是布尔开关,不吃值。
       if (k === "copresence") { if (v === true) args.push("--copresence"); continue; }
       if (k === "opencodeUnsafeTools") { if (v === true) args.push("--opencode-unsafe-tools"); continue; }
+      if (k === "opencodeNewServer") { if (v === true) args.push("--opencode-new-server"); continue; }
       if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k) || k === 'daemonProvider') continue;
       args.push(`--${kebab(k)}`, String(v));
     }

package/src/db.ts

@@ -1,3 +1,4 @@
+import { refreshScheduledBackoff } from "./scheduled-backoff.js";
 import { createAdapter, type DbAdapter } from "./db-adapter"; import { withStatementHook } from "./status-read-cache"; // #431 写 sessions 的语句让 /api/status 缓存失效
 
 export const db: DbAdapter = withStatementHook(createAdapter());
@@ -1710,6 +1711,21 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_scheduled_runs_network
     ON scheduled_task_runs(network_id, created_at DESC);
 `);
+// #1278 — opt-in state. Existing schedules remain disabled.
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN no_change_backoff INTEGER NOT NULL DEFAULT 0"); } catch {}
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN backoff_streak INTEGER NOT NULL DEFAULT 0"); } catch {}
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN backoff_effective_seconds INTEGER"); } catch {}
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN backoff_last_run_id TEXT"); } catch {}
+try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN backoff_excluded INTEGER NOT NULL DEFAULT 0"); } catch {}
+// #1279 — opt-in requirement event policy/cursor; old plans stay disabled.
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN requirement_wake_json TEXT"); } catch {}
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN requirement_wake_cursor INTEGER NOT NULL DEFAULT 0"); } catch {}
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN requirement_wake_last_event_id INTEGER"); } catch {}
+// #1274 — explicit successful-work signal and dispatch revision, separate
+// from lifecycle. NULL is unknown for legacy runs; rollback ignores columns.
+try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN work_outcome TEXT"); } catch {}
+try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN schedule_revision INTEGER"); } catch {}
+try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN work_outcome_node_id TEXT"); } catch {}
 try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN misfire_policy TEXT NOT NULL DEFAULT 'catch_up_once'"); } catch {}
 // Skipped runs (overlap_policy=skip) name the open task that blocked them and
 // whether the node had ever picked it up: not_received | in_progress.
@@ -2027,6 +2043,72 @@ export function chainReplyToParent(
   maxDepth = 5,
   callerNetId?: string | null,
 ): ChainReplyResult {
+  // Node-TMAI#4 (E/F): bind the ORIGIN of the result once, up front.
+  //
+  // The walk below climbs from the child towards the root, so the loop
+  // variable is the CURRENT HOP's child and it changes on every iteration.
+  // That is hop identity, not result identity. Conflating the two was the
+  // defect this key used to carry: keying the de-dup index on the loop
+  // variable let a descendant's upward notice burn an intermediate task's
+  // key, so that task's own later completion looked like a "replay" and was
+  // silently dropped (grandparent <- parent <- leaf, then the parent
+  // finishes for real => 0 notices). Three notions are now kept apart:
+  //
+  //   * originChildId / originAlias / originReply — the ONE task whose
+  //     result this call carries; fixed for the whole walk.
+  //   * originStamp — the DELIVERY of that result (its terminal
+  //     transition), kept only as a human-readable audit value.
+  //   * attemptKey — the ATTEMPT that produced the result: the inbox
+  //     transport row that queued it. See the block below for why the
+  //     delivery stamp alone is not usable as the key.
+  //   * hopKind — "completion" (the origin's own result reaching its
+  //     direct parent) vs "descendant" (a forwarded notice at a higher
+  //     ancestor). The two can never share a de-dup slot.
+  const origin = db.get<{
+    to_name: string;
+    completed_at: string | null;
+    delivered_at: string | null;
+    started_at: string | null;
+  }>(
+    "SELECT to_name, completed_at, delivered_at, started_at FROM tasks WHERE task_id = ?1",
+    childTaskId
+  );
+  const originChildId = childTaskId;
+  const originAlias = origin?.to_name ?? childTaskId.slice(0, 8);
+  const originStamp = (origin?.completed_at ?? origin?.delivered_at ?? origin?.started_at ?? "n/a")
+    .replace(/[^0-9A-Za-z]/g, "-");
+  const originReply = replyText;
+
+  // Node-TMAI#4 (F, round 3): the de-dup key must identify the ATTEMPT, and
+  // no delivery timestamp can do that. `completed_at` / `delivered_at` are
+  // written with `datetime('now')` — second granularity — so two legitimate
+  // attempts of one task_id (the second one created by `retry_task`) can
+  // complete inside the same second and carry an identical stamp. The later
+  // result then looked like a replay of the earlier one and was swallowed.
+  //
+  // A retry or a reassign queues a fresh inbox transport row for the same
+  // task_id, inside the same transaction as the task reset: `retry_task`
+  // first runs `UPDATE tasks SET status='delivered', result=NULL,
+  // completed_at=NULL, ...` and only then `INSERT INTO inbox` with a new id;
+  // `reassign_task` acks the old row, updates the task, then inserts the new
+  // one. db.ts #520 keeps transport-row identity separate from logical task
+  // identity for precisely this reason ("runtime evidence/replies survive
+  // those redeliveries"). This candidate therefore takes the newest
+  // transport row of the task as its attempt identity: it changes on every
+  // retry/reassign and survives a re-delivery of the same attempt, and it
+  // needs no schema change.
+  //
+  // That is the identity source THIS CANDIDATE adopts; it is not a verified
+  // account of every asynchronous late-reply or retention path, and those
+  // are out of scope here. A row that was never dispatched (synthetic or
+  // imported) has no transport row and falls back to its delivery stamp,
+  // which preserves the old behaviour for those.
+  const dispatch = db.get<{ transport_id: string | null }>(
+    "SELECT id AS transport_id FROM inbox WHERE task_id = ?1 ORDER BY rowid DESC LIMIT 1",
+    childTaskId
+  );
+  const attemptKey = dispatch?.transport_id ?? `undispatched-${originStamp}`;
+
   let currentChildId: string | null = childTaskId;
   let currentReply = replyText;
   let depth = 0;
@@ -2040,6 +2122,9 @@ export function chainReplyToParent(
 
   while (currentChildId && depth < maxDepth) {
     depth++;
+    // Narrow the loop cursor once. It is the walk position for this hop and
+    // nothing else; the result's origin is pinned outside the loop above.
+    const hopChildId: string = currentChildId;
     type ChildRow = { parent_task_id: string | null; to_name: string; from_name: string; content: string };
     type ParentRow = { task_id: string; from_name: string; to_name: string; status: string; result: string | null; network_id: string | null; parent_task_id: string | null };
     const child: ChildRow | null = db.get<ChildRow>(
@@ -2065,28 +2150,63 @@ export function chainReplyToParent(
       }
     }
 
+    // The origin's own result reaching its direct parent is the "executor
+    // completion" notice; anything higher up is a "descendant notice"
+    // forwarded on the origin's behalf. They are different events and must
+    // never occupy the same de-dup slot.
+    const hopKind = depth === 1 ? "completion" : "descendant";
     const childAlias = child.to_name;
     const marker = `\n\n[via ${childAlias} 子任务结果]\n${currentReply}`;
     const newResult = parent.result ? parent.result + marker : `[via ${childAlias} 子任务结果]\n${currentReply}`;
 
+    // Node-TMAI#4 (E/F): one ATTEMPT of a child result may be recorded
+    // against a parent at most once. The key binds the ORIGIN of the result
+    // (not the loop variable), the attempt (its inbox transport row), the
+    // parent and the hop kind. A replayed reply therefore cannot fan out
+    // into a second audit row and a second notice, while a fresh attempt of
+    // the same task (a legal retry) still gets through.
+    const recordKey = `auto-chain:${hopKind}:${parent.task_id}:${originChildId}:${attemptKey}`;
+    let recorded = false;
+
     db.transaction(() => {
-      // Bump parent status to replied if still open. The task transition and
-      // its scheduler-run mirror share this transaction, so a crash cannot
-      // leave one terminal while the other remains delivered.
+      const already = db.get<{ c: number }>(
+        "SELECT COUNT(*) AS c FROM task_events WHERE task_id = ?1 AND event_key = ?2",
+        [parent.task_id, recordKey]
+      );
+      if ((already?.c ?? 0) > 0) return;
+
+      // An OPEN parent is completed by the chain: this is the #690 contract —
+      // a scheduled/dispatched parent whose executor answered through a child
+      // must reach a terminal state, and its scheduler-run mirror follows it
+      // in the same transaction.
       if (parent.status === "delivered" || parent.status === "acked" || parent.status === "running" || parent.status === "created") {
         db.run(
           "UPDATE tasks SET status = ?1, result = ?2, completed_at = datetime('now') WHERE task_id = ?3",
           [replyStatus, newResult.slice(0, 8000), parent.task_id]
         );
         syncScheduledRunForTask(parent.task_id, parent.network_id);
-        logTaskEvent(parent.task_id, parent.status, replyStatus, "auto-chain", `from ${childAlias}`);
+        logTaskEvent(
+          parent.task_id, parent.status, replyStatus, "auto-chain",
+          `from ${childAlias}; origin ${originChildId.slice(0, 8)}, attempt=${attemptKey}`,
+          recordKey,
+        );
       } else {
-        db.run(
-          "UPDATE tasks SET result = ?1, completed_at = datetime('now') WHERE task_id = ?2",
-          [newResult.slice(0, 8000), parent.task_id]
+        // A TERMINAL parent is never rewritten. It used to have its `result`
+        // appended and its `completed_at` moved forward long after it had
+        // finished (observed: 22 minutes later), so an answer given to the
+        // parent could silently become part of somebody else's result. The
+        // child result is still recorded — as an audit row plus a notice to
+        // the parent's author — but the parent row stays byte-identical.
+        logTaskEvent(
+          parent.task_id, parent.status, parent.status, "auto-chain-append",
+          `from ${childAlias}; origin ${originChildId.slice(0, 8)}, attempt=${attemptKey}; terminal parent left untouched`,
+          recordKey,
         );
-        logTaskEvent(parent.task_id, parent.status, parent.status, "auto-chain-append", `from ${childAlias}`);
       }
+      // The audit row for this (parent, child) link now exists. Only a call
+      // that actually recorded one may unlock the caller's SSE push; a
+      // deduped replay returns early above and leaves this false.
+      recorded = true;
 
       if (parent.from_name && parent.from_name !== "hub" && parent.from_name !== "api") {
         try {
@@ -2098,20 +2218,22 @@ export function chainReplyToParent(
           db.run(
             `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id)
              VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7)`,
-            [notifyId, parent.from_name, notifyNode?.node_id ?? null, `[${childAlias} 子任务完成]\n${currentReply.slice(0, 4000)}`, parent.to_name, parent.task_id, parent.network_id ?? null]
+            [notifyId, parent.from_name, notifyNode?.node_id ?? null, `[${childAlias} ${hopKind === "descendant" ? "后代结果转呈" : "子任务完成"}]\n${originReply.slice(0, 4000)}`, parent.to_name, parent.task_id, parent.network_id ?? null]
           );
         } catch {}
       }
     });
 
-    // This iteration actually wrote a parent row (and possibly an
-    // inbox notification). Record that so the caller can gate its
-    // SSE push on a real chain.
-    chained = true;
+    // An audit row (and possibly an inbox notification) was recorded for
+    // this parent-child link. The caller gates its SSE push on this.
+    if (recorded) chained = true;
 
-    // Recurse up the chain.
-    currentChildId = parent.task_id;
+    // Recurse up the chain. Only the HOP cursor advances: the origin and
+    // its delivery stay pinned, so no hop can absorb another's identity
+    // and each notice carries the origin reply once instead of nesting
+    // every ancestor's copy of it.
     currentReply = newResult;
+    currentChildId = parent.task_id;
   }
   return { chained };
 }
@@ -2153,6 +2275,10 @@ type ScheduledTaskBinding = { run_id: string; schedule_id: string };
  * the history reflects the current retry rather than the first failed attempt.
  */
 export function syncScheduledRunForTask(taskId: string, expectedNetworkId?: string | null): { matched: boolean; status?: string } {
+  return db.transaction(() => syncScheduledRunForTaskInTransaction(taskId, expectedNetworkId));
+}
+
+function syncScheduledRunForTaskInTransaction(taskId: string, expectedNetworkId?: string | null): { matched: boolean; status?: string } {
   const task = db.get<ScheduledTaskLifecycleRow>(
     `SELECT task_id, network_id, status, completed_at
        FROM tasks
@@ -2181,18 +2307,23 @@ export function syncScheduledRunForTask(taskId: string, expectedNetworkId?: stri
           SET status = ?1,
               error_code = ?2,
               error_message = NULL,
+              work_outcome = CASE WHEN ?1 = 'replied' THEN work_outcome ELSE NULL END,
+              work_outcome_node_id = CASE WHEN ?1 = 'replied' THEN work_outcome_node_id ELSE NULL END,
               completed_at = COALESCE(?3, datetime('now'))
         WHERE run_id = ?4 AND task_id = ?5 AND network_id = ?6 AND schedule_id = ?7`,
       [task.status, errorCode, task.completed_at, binding.run_id, task.task_id, task.network_id, binding.schedule_id],
     );
-    if (updated.changes === 1) fireScheduledRunTerminalHook(binding.schedule_id, task.status);
+    if (updated.changes === 1) {
+      refreshScheduledBackoff(binding.schedule_id, task.network_id!);
+      fireScheduledRunTerminalHook(binding.schedule_id, task.status);
+    }
     return { matched: updated.changes === 1, status: task.status };
   }
 
   if (task.status === "delivered") {
     const updated = db.run(
       `UPDATE scheduled_task_runs
-          SET status = 'delivered', error_code = NULL, error_message = NULL, completed_at = NULL
+          SET status = 'delivered', error_code = NULL, error_message = NULL, completed_at = NULL, work_outcome = NULL, work_outcome_node_id = NULL, backoff_excluded = 1
         WHERE run_id = ?1 AND task_id = ?2 AND network_id = ?3 AND schedule_id = ?4`,
       [binding.run_id, task.task_id, task.network_id, binding.schedule_id],
     );
@@ -2215,12 +2346,12 @@ function taskEventTypeForStatus(toStatus: string): string {
   }
 }
 
-export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus: string, actor: string, detail?: string) {
+export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus: string, actor: string, detail?: string, eventKey?: string) {
   try {
     db.run(
-      `INSERT INTO task_events (task_id, from_status, to_status, event_type, actor, detail, network_id)
-       VALUES (?1, ?2, ?3, ?4, ?5, ?6, (SELECT network_id FROM tasks WHERE task_id = ?1))`,
-      [taskId, fromStatus, toStatus, taskEventTypeForStatus(toStatus), actor, detail ?? null]
+      `INSERT INTO task_events (task_id, from_status, to_status, event_type, event_key, actor, detail, network_id)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, (SELECT network_id FROM tasks WHERE task_id = ?1))`,
+      [taskId, fromStatus, toStatus, taskEventTypeForStatus(toStatus), eventKey ?? null, actor, detail ?? null]
     );
   } catch {}
 }
@@ -2250,3 +2381,41 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_ndb_daemon_network
     ON node_daemon_bindings(daemon_node_id,network_id,status);
 `);
+
+// #1198 — OS account the node process runs as. Appended at the end of this file
+// on purpose: docs/test846 pin line anchors in db.ts, and an in-place insertion
+// would drift every anchor below it.
+try { db.exec("ALTER TABLE sessions ADD COLUMN os_user TEXT"); } catch {}
+
+// #1474 — env key NAMES the node reports having (JSON array of strings, never
+// values). Appended after os_user for the same reason: doc/test anchors pin
+// line numbers in this file, so new migrations go at EOF, never in the middle.
+try { db.exec("ALTER TABLE sessions ADD COLUMN secret_keys TEXT"); } catch {}
+
+// #1510 — how the node reaches the hub (loopback / https / plain), reported by
+// the node itself. Appended at EOF like the other post-1.0 columns so the doc
+// and test846 line anchors below it never drift.
+try { db.exec("ALTER TABLE sessions ADD COLUMN env_transport TEXT"); } catch {}
+
+// #1510 — hourly count of secret writes that a transport gate WOULD have refused
+// (nodes reporting a plain-HTTP hub link). Log-only until an operator decides.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS env_transport_would_refuse (
+    network_id TEXT NOT NULL,
+    node_id    TEXT NOT NULL,
+    route      TEXT NOT NULL,
+    hour       TEXT NOT NULL,
+    hits       INTEGER NOT NULL DEFAULT 0,
+    sample     TEXT,
+    PRIMARY KEY (network_id, node_id, route, hour)
+  );
+`);
+
+// 组织架构：Agent（节点）**显式**归属部门。
+//
+// 在这条之前，「某个部门有几个 Agent」只能由「负责人（人）在哪个部门」推出来
+// （`/api/networks/:net/departments/:dept/nodes`）。所以没有负责人、或者负责人不在部门树里的
+// Agent 只能落进「未归属」——2026-10-19 现网就是 328 个 Agent 全在未归属里，
+// 而部门 0 个 Agent。这一列让 Agent 可以被直接放进部门，和人的归属互不覆盖：
+// 显式值优先，没有显式值时仍按负责人的部门推断。
+try { db.exec("ALTER TABLE nodes ADD COLUMN department_id TEXT"); } catch {}

package/src/departments.ts

@@ -248,6 +248,22 @@ export function setMemberDepartment(networkId: string, userId: string, departmen
   return { ok: true, user_id: userId, department_id: dept as string | null };
 }
 
+/** Agent(节点)显式归属部门。`null` / "" = 清掉,回到「按负责人的部门推断」。 */
+export function setAgentDepartment(
+  networkId: string,
+  nodeId: string,
+  departmentId: unknown,
+): Ok<{ node_id: string; department_id: string | null }> | Fail {
+  const node = db.get<{ node_id: string }>("SELECT node_id FROM nodes WHERE network_id = ?1 AND node_id = ?2", networkId, nodeId);
+  if (!node) return fail(404, "node_not_found");
+  const dept = departmentId === null || departmentId === "" ? null : departmentId;
+  if (dept !== null && (typeof dept !== "string" || !one(networkId, dept))) return fail(400, "department_not_found");
+  db.run("UPDATE nodes SET department_id = ?3, updated_at = datetime('now') WHERE network_id = ?1 AND node_id = ?2", [networkId, nodeId, dept]);
+  // 部门群(RFC-042)按成员归属同步:Agent 不是群成员,这里只保证不把群带歪。
+  syncDepartmentGroups(networkId);
+  return { ok: true, node_id: nodeId, department_id: dept as string | null };
+}
+
 /** 网络删掉时一起清(和项目授权同一时机调用)。 */
 export function deleteDepartmentsForNetwork(networkId: string): void {
   db.run("DELETE FROM network_departments WHERE network_id = ?1", [networkId]);

package/src/env-transport-gate-http.test.ts

@@ -0,0 +1,146 @@
+// #1510 — the secret-transport gate, shipped as log-only first.
+//
+// The load-bearing property is symmetric: with the gate in log mode a write to a
+// `plain` node MUST still succeed (nobody's workflow breaks on upgrade) but MUST
+// leave a hit behind, and with `enforce` the same write MUST be refused. A
+// half-implemented gate that logs but also refuses would break every plain-HTTP
+// node on the next deploy; one that refuses but never logs leaves nothing to
+// decide with.
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-transport-gate-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let net = "", ownerId = "", ownerToken = "";
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+const PLAIN = "n_gate_plain";
+const TLS = "n_gate_tls";
+
+const post = async (path: string, token: string, body: unknown) => {
+  const r = await fetch(`${base}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return { status: r.status, body: await r.json() as any };
+};
+const get = async (path: string, token: string) => {
+  const r = await fetch(`${base}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+
+beforeAll(async () => {
+  const { db } = await import("./db.js");
+  const { register } = await import("./auth.js");
+  const stamp = Date.now();
+  const owner = register(`gate_owner_${stamp}`, "GateOwner-Strong-1!");
+  expect(owner.ok).toBe(true);
+  ownerToken = owner.token!;
+  net = owner.network_id!;
+  ownerId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `gate_owner_${stamp}`)!.user_id;
+
+  const seed = (nodeId: string, transport: string) => db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, lifecycle_state, config_snapshot)
+     VALUES (?1, ?1, ?1, ?2, 'active', ?3)`,
+    [nodeId, net, JSON.stringify({ node_secrets_capable: true })],
+  );
+  seed(PLAIN, "plain");
+  seed(TLS, "https");
+  // The transport is reported on the session row (that is where report_status
+  // writes it).
+  const session = (nodeId: string, transport: string) => db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, env_transport, updated_at, last_seen_at)
+     VALUES (?1, ?1, 'idle', ?1, ?2, ?3, datetime('now'), datetime('now'))`,
+    [nodeId, net, transport],
+  );
+  session(PLAIN, "plain");
+  session(TLS, "https");
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+beforeEach(async () => {
+  // The lane allows one pending request per node; drain whatever the previous
+  // case left so the next one starts clean.
+  const { pullNodeSecrets, ackNodeSecrets } = await import("./scoped-secrets.js");
+  for (const nodeId of [PLAIN, TLS]) {
+    const daemon = { ok: true as const, networkId: net, daemonNodeId: nodeId, daemonAlias: nodeId };
+    const pulled = pullNodeSecrets(daemon) as any;
+    for (const r of (pulled?.requests ?? [])) ackNodeSecrets(daemon, r.request_id, null, true);
+  }
+  process.env.ANET_SECRET_TRANSPORT_GATE = "log";
+});
+
+describe("log mode (default)", () => {
+  test("a put to a plain node still succeeds AND leaves a hit", async () => {
+    const r = await post(`/api/nodes/${PLAIN}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "A_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true); // not refused: that is the whole point of log mode
+
+    const log = await get(`/api/networks/${net}/env-transport-log`, ownerToken);
+    expect(log.status).toBe(200);
+    expect(log.body.total).toBe(1);
+    expect(log.body.rows[0]).toMatchObject({ node_id: PLAIN, route: "node_secret_put", hits: 1 });
+  });
+
+  test("a put to a TLS node leaves no hit", async () => {
+    const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    const r = await post(`/api/nodes/${TLS}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "B_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    const after = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    expect(after).toBe(before);
+  });
+
+  test("list is not observed (it carries no secret)", async () => {
+    const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    await post(`/api/nodes/${PLAIN}/secrets?network_id=${net}`, ownerToken, { action: "list" });
+    const after = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    expect(after).toBe(before);
+  });
+});
+
+describe("enforce mode", () => {
+  test("the same put is refused, and nothing is queued", async () => {
+    process.env.ANET_SECRET_TRANSPORT_GATE = "enforce";
+    const r = await post(`/api/nodes/${PLAIN}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "C_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(400);
+    expect(r.body.error).toBe("secret_transport_plain");
+  });
+
+  test("a TLS node is unaffected", async () => {
+    process.env.ANET_SECRET_TRANSPORT_GATE = "enforce";
+    const r = await post(`/api/nodes/${TLS}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "D_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+  });
+});
+
+describe("off mode", () => {
+  test("records nothing at all", async () => {
+    process.env.ANET_SECRET_TRANSPORT_GATE = "off";
+    const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    const r = await post(`/api/nodes/${PLAIN}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "E_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    const after = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    expect(after).toBe(before);
+  });
+});
+
+describe("the log endpoint is owner/admin only", () => {
+  test("an unrelated user gets 403", async () => {
+    const { register } = await import("./auth.js");
+    const other = register(`gate_other_${Date.now()}`, "GateOther-Strong-1!");
+    const r = await get(`/api/networks/${net}/env-transport-log`, other.token!);
+    expect(r.status).toBe(403);
+  });
+});

package/src/env-transport-gate.ts

@@ -0,0 +1,74 @@
+// #1510 (log-only) — record the secret writes that a future transport gate would
+// have refused, without refusing any of them.
+//
+// Why log-only first: refusing makes an existing workflow fail on upgrade, and
+// the nodes that talk plain HTTP today are exactly the ones we cannot see from
+// the Hub. This table answers "how many writes would have been blocked, on which
+// node" *before* anyone decides to turn the gate on — the same rollout shape as
+// #519's stale-open sweep and #525's human_only log mode.
+//
+// Hourly aggregation, like node_permission_log: a chatty node must not turn this
+// into one row per write.
+import { db } from "./db.js";
+import { getEnvTransportMode } from "./env-transport-policy.js";
+
+const HOURS_RETAINED = 30 * 24;
+const MAX_ROWS = 20_000;
+
+function hourOf(now = new Date()): string {
+  return now.toISOString().slice(0, 13);
+}
+
+/** Record one would-refuse hit. Never throws: logging must not break a write. */
+export function noteEnvTransportWouldRefuse(networkId: string, nodeId: string, route: string, sample?: string): void {
+  try {
+    const now = new Date();
+    if (Math.random() < 0.02) {
+      db.run("DELETE FROM env_transport_would_refuse WHERE hour < ?1",
+        [hourOf(new Date(now.getTime() - HOURS_RETAINED * 86_400_000))]);
+    }
+    const count = Number(db.get<{ n: number | string }>("SELECT COUNT(*) AS n FROM env_transport_would_refuse")?.n ?? 0);
+    const hour = hourOf(now);
+    const s = sample ? sample.slice(0, 120) : null;
+    if (count >= MAX_ROWS) {
+      db.run(
+        "UPDATE env_transport_would_refuse SET hits = hits + 1, sample = COALESCE(sample, ?5) WHERE network_id = ?1 AND node_id = ?2 AND route = ?3 AND hour = ?4",
+        [networkId, nodeId, route, hour, s],
+      );
+      return;
+    }
+    db.run(
+      `INSERT INTO env_transport_would_refuse (network_id, node_id, route, hour, hits, sample) VALUES (?1, ?2, ?3, ?4, 1, ?5)
+       ON CONFLICT(network_id, node_id, route, hour) DO UPDATE SET hits = env_transport_would_refuse.hits + 1`,
+      [networkId, nodeId, route, hour, s],
+    );
+  } catch (e) {
+    console.error(`[env-transport] would-refuse log failed: ${(e as Error).message}`);
+  }
+}
+
+/** Where a secret write is aimed: the node's own row, or a daemon's. Returns the
+ *  transport the node last reported, or null when it is unknown. */
+export function transportOf(networkId: string, nodeId: string): string | null {
+  const row = db.get<{ env_transport: string | null }>(
+    "SELECT env_transport FROM sessions WHERE network_id = ?1 AND (node_id = ?2 OR alias = ?2) ORDER BY updated_at DESC LIMIT 1",
+    [networkId, nodeId],
+  );
+  return row?.env_transport ?? null;
+}
+
+/** Called from the write lanes. Logs when the current policy would refuse. */
+export function observeSecretWrite(networkId: string, nodeId: string, route: string): void {
+  if (getEnvTransportMode() !== "log") return;
+  const transport = transportOf(networkId, nodeId);
+  if (transport !== "plain") return;
+  noteEnvTransportWouldRefuse(networkId, nodeId, route, `transport=${transport}`);
+}
+
+export function readEnvTransportLog(networkId: string, sinceHour: string) {
+  return db.all<{ node_id: string; route: string; hour: string; hits: number | string; sample: string | null }>(
+    `SELECT node_id, route, hour, hits, sample FROM env_transport_would_refuse
+      WHERE network_id = ?1 AND hour >= ?2 ORDER BY hour DESC, node_id, route`,
+    [networkId, sinceHour],
+  ).map(r => ({ ...r, hits: Number(r.hits) }));
+}

package/src/env-transport-policy.ts

@@ -0,0 +1,21 @@
+// #1510 — the switch for the secret-transport gate.
+//
+//   (unset) / "log" — record what a gate WOULD refuse; refuse nothing.
+//   "enforce"       — refuse secret writes to nodes that report `plain`.
+//   "off"           — do nothing at all (no recording either).
+//
+// Reading the env on every call (like the stale-open sweep) means an operator can
+// change the mode without a code change and tests can flip it per case.
+export type EnvTransportMode = "off" | "log" | "enforce";
+
+export function getEnvTransportMode(env: Record<string, string | undefined> = process.env): EnvTransportMode {
+  const raw = (env.ANET_SECRET_TRANSPORT_GATE ?? "").trim().toLowerCase();
+  if (raw === "off") return "off";
+  if (raw === "enforce") return "enforce";
+  return "log";
+}
+
+/** True when a write to a node reporting `plain` must be refused. */
+export function refusesPlainTransport(transport: string | null, env: Record<string, string | undefined> = process.env): boolean {
+  return getEnvTransportMode(env) === "enforce" && transport === "plain";
+}

package/src/host-supervisor-identity-http.test.ts

@@ -100,10 +100,26 @@ for (const entry of ["MCP", "REST"] as const) {
   test(`${entry}: null-network legacy heartbeat is accepted only for globally unique aliases`, async () => {
     const unique = node("globalunique"), shared = node("globalshared"); node("globalshared", foreign);
     credential(unique); credential(shared);
-    heartbeat(unique, { bound: null, network: null }); heartbeat(shared, { bound: null, network: null });
-    const rows = await list(entry);
-    expect(rows.find(r => r.daemon_node_id === unique).online).toBe(true);
-    expect(rows.find(r => r.daemon_node_id === shared).online).toBe(false);
+    // Fresh sessions is NOT NULL. Exercise the historical nullable shape in
+    // an actual temporary SQL table, without changing the production schema
+    // or mocking returned rows. Only the heartbeat read uses this table;
+    // the production node/token/scoped SQL and both HTTP/MCP paths stay real.
+    db.exec("CREATE TEMP TABLE lhs1109_legacy_sessions AS SELECT * FROM sessions WHERE 0=1");
+    for (const id of [unique, shared]) {
+      const n = db.get<any>("SELECT alias FROM nodes WHERE node_id=?1", id)!;
+      db.run(`INSERT INTO lhs1109_legacy_sessions(resume_id,alias,network_id,node_id,last_seen_at,updated_at,status)
+        VALUES(?1,?2,NULL,NULL,?3,?3,'idle')`, [`s_lhs1109_${++sequence}`, n.alias, new Date().toISOString()]);
+    }
+    const original = db.all.bind(db);
+    db.all = ((sql: string, ...params: any[]) => original(sql.replace("FROM sessions s", "FROM lhs1109_legacy_sessions s"), ...params)) as any;
+    try {
+      const rows = await list(entry);
+      expect(rows.find(r => r.daemon_node_id === unique).online).toBe(true);
+      expect(rows.find(r => r.daemon_node_id === shared).online).toBe(false);
+    } finally {
+      db.all = original;
+      db.exec("DROP TABLE lhs1109_legacy_sessions");
+    }
   });
   test(`${entry}: bound heartbeat ignores stale alias but refuses wrong network and stale timestamps`, async () => {
     const renamed = node("newalias"), wrong = node("wrongnet"), stale = node("stale");