@sleep2agi/commhub-server 0.9.0-preview.14 → 0.9.0-preview.140

package/src/hub-provider-config.test.ts

@@ -0,0 +1,139 @@
+import './require-explicit-test-db';
+import { afterAll, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { db } from './db';
+import { registerTools } from './tools';
+import { vaultGet } from './vault';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { reconcileProviderSnapshots, secureProviderTransport } from '../../agent-node/src/runtime/daemon-provider-snapshot';
+import { DaemonProviderStore } from '../../agent-network/src/daemon-provider-store';
+const net = 'net_hub907', user = 'u_hub907', daemonId = 'n_hub907', alias = 'daemon907', token = 'tok_hub907';
+const root = mkdtempSync(join(tmpdir(), 'hub907-')), key = 'TEST-ONLY-shared-provider-key';
+function cleanup() {
+  for (const t of ['daemon_provider_writes', 'daemon_provider_applications', 'daemon_provider_logins']) db.run(`DELETE FROM ${t} WHERE request_id IN (SELECT request_id FROM daemon_provider_snapshots WHERE network_id=?1)`, [net]);
+  for (const t of ['hub_provider_bindings', 'hub_provider_configs', 'network_secrets', 'daemon_provider_snapshots', 'nodes', 'api_tokens', 'network_members']) db.run(`DELETE FROM ${t} WHERE network_id=?1`, [net]);
+  db.run('DELETE FROM networks WHERE network_id=?1', [net]); db.run('DELETE FROM users WHERE user_id=?1', [user]);
+}
+beforeEach(() => {
+  cleanup(); rmSync(join(root, '.anet'), { recursive: true, force: true });
+  process.env.ANET_HUB_SECRET_VAULT_KEY = '42'.repeat(32);
+  db.run("INSERT INTO users(user_id,username,password_hash,role) VALUES(?1,?1,'x','user')", [user]);
+  db.run('INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,?1,?2)', [net, user]);
+  db.run("INSERT INTO network_members(user_id,network_id,role) VALUES(?1,?2,'owner')", [user, net]);
+  db.run('INSERT INTO nodes(node_id,node_name,alias,network_id,config_snapshot) VALUES(?1,?2,?2,?3,?4)', [daemonId, alias, net, JSON.stringify({ role: 'host_supervisor' })]);
+  db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES(?1,?2,?3,'network',?4,?5)", [token, user, net, `node:${alias}`, `hash_${token}`]);
+  const dir = join(root, '.anet/nodes', alias); mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, 'config.json'), JSON.stringify({ role: 'host_supervisor', node_id: daemonId, network_id: net }), { mode: 0o600 });
+});
+afterAll(() => { cleanup(); rmSync(root, { recursive: true, force: true }); });
+function client(kind = 'human') {
+  const handlers: Record<string, any> = {}, server = new McpServer({ name: 'test907', version: '0' }) as any;
+  const tool = server.tool.bind(server), register = server.registerTool.bind(server);
+  server.tool = (name: string, desc: any, shape: any, handler: any) => { handlers[name] = handler; return tool(name, desc, shape, handler); };
+  server.registerTool = (name: string, config: any, handler: any) => { handlers[name] = handler; return register(name, config, handler); };
+  registerTools(server, undefined, kind === 'daemon' ? net : null, kind === 'anonymous' ? null : user, alias, kind === 'daemon', kind === 'daemon' ? token : null);
+  return async (name: string, args: any = {}) => JSON.parse((await handlers[name](args)).content[0].text);
+}
+const provider = () => ({ id: 'shared', label: 'Shared model', enabled: true, protocol: 'openai-responses', baseUrl: 'https://provider.example/v1', models: ['fixture-model'], key });
+const save = (human: ReturnType<typeof client>, value = provider(), revision = 0) => human('daemon_provider_snapshot', { action: 'hub_put', id: value.id, network_id: net, revision, provider: value });
+const bind = (human: ReturnType<typeof client>, target = daemonId, revision = 1) => human('daemon_provider_snapshot', { action: 'hub_bind', network_id: net, id: 'shared', revision, provider: { daemon_node_id: target, daemon_revision: 0, confirm: true } });
+test('HTTP Hub and API endpoint support save, explicit bind and exact private-store readback', async () => {
+  expect(secureProviderTransport('http://hub907.example.test')).toBe(true);
+  expect(secureProviderTransport('ftp://hub907.example.test')).toBe(false);
+  expect(secureProviderTransport('http://user:password@hub907.example.test')).toBe(false);
+  const human = client(), daemon = client('daemon');
+  const config = { ...provider(), baseUrl: 'http://provider.example/v1' };
+  const saved = await save(human, config); expect(saved.ok).toBe(true);
+  expect(saved.provider.baseUrl).toBe(config.baseUrl);
+  const queued = await bind(human); expect(queued.ok).toBe(true);
+  await reconcileProviderSnapshots({ workDir: root, alias, networkId: net, daemonId,
+    serverUrl: 'http://hub907.example.test', callCommHub: daemon, warn: message => console.warn(message) });
+  const receipt = await human('daemon_provider_snapshot', { action: 'read', id: queued.request_id, network_id: net });
+  expect(receipt.status).toBe('succeeded');
+  expect(receipt.snapshot.providers[0].runtimes[0].auth[0].baseUrl).toBe(config.baseUrl);
+  expect(JSON.stringify([saved, queued, receipt])).not.toContain(key);
+  const store = new DaemonProviderStore(join(root, '.anet/nodes', alias));
+  await store.withApiKey({ revision: 1, providerId: queued.provider_reference.daemon_provider_id, authId: 'hub_key', model: 'fixture-model' }, async actual => {
+    expect(actual.baseUrl).toBe(config.baseUrl); expect(actual.key).toBe(key);
+  }); // Exact synthetic key in local callback, no external model request.
+  for (const baseUrl of ['ftp://provider.example/v1', 'http://user:pass@provider.example/v1', 'http://provider.example/v1?key=secret']) {
+    expect(await save(human, { ...provider(), id: 'invalid', baseUrl })).toMatchObject({ ok: false, error: 'invalid_hub_provider' });
+  }
+});
+test('existing names-only vault key → Provider reference → actual daemon store, without re-entering key', async () => {
+  const human = client(), daemon = client('daemon');
+  expect(await human('upsert_network_secret', { network_id: net, key: 'SHARED_API_KEY', value: key })).toMatchObject({ ok: true });
+  const { key: ignored, ...config } = provider();
+  const saved = await save(human, { ...config, secretKeyRef: 'SHARED_API_KEY' } as any);
+  expect(saved.provider).toMatchObject({ secret_key_ref: 'SHARED_API_KEY', credential_present: true });
+  expect(db.get<any>('SELECT secret_key_ref FROM hub_provider_configs WHERE network_id=?1', net).secret_key_ref).toBe('SHARED_API_KEY');
+  const legacy = await human('daemon_provider_snapshot', { action: 'hub_read', id: 'hub', network_id: net });
+  expect(legacy.providers[0].secret_key_ref).toBeUndefined(); // older strict client shape unchanged
+  const modern = await human('daemon_provider_snapshot', { action: 'hub_read', id: 'hub', network_id: net, provider: { include_secret_refs: true } });
+  expect(modern.secret_reference_supported).toBe(true); expect(modern.providers[0].secret_key_ref).toBe('SHARED_API_KEY');
+  expect(JSON.stringify([saved, legacy, modern])).not.toContain(key);
+  const queued = await bind(human); expect(queued.ok).toBe(true);
+  await reconcileProviderSnapshots({ workDir: root, alias, networkId: net, daemonId, serverUrl: 'https://hub907.example.test', callCommHub: daemon, warn: message => console.warn(message) });
+  const receipt = await human('daemon_provider_snapshot', { action: 'read', id: queued.request_id, network_id: net });
+  expect(receipt.status).toBe('succeeded'); expect(receipt.snapshot.providers[0].runtimes[0].auth[0].credential_present).toBe(true);
+  const store = new DaemonProviderStore(join(root, '.anet/nodes', alias));
+  await store.withApiKey({ revision: receipt.snapshot.revision, providerId: queued.provider_reference.daemon_provider_id, authId: 'hub_key', model: 'fixture-model' }, async profile => {
+    expect(profile.key).toBe(key); expect(profile.baseUrl).toBe(config.baseUrl);
+  }); // synthetic local callback only; no model/vendor request
+  expect(JSON.stringify(receipt)).not.toContain(key);
+  // Switching back to Provider-owned plaintext never changes the reusable named key.
+  await save(human, { ...provider(), key: 'TEST-ONLY-provider-specific' }, 1);
+  expect(vaultGet(net, 'SHARED_API_KEY')).toBe(key);
+  expect(db.get<any>('SELECT secret_key_ref FROM hub_provider_configs WHERE network_id=?1', net).secret_key_ref).not.toBe('SHARED_API_KEY');
+});
+test('missing or ambiguous references do not save; explicit ref replacement updates the stored reference', async () => {
+  const human = client(); const { key: ignored, ...config } = provider();
+  expect(await save(human, { ...config, secretKeyRef: 'MISSING_KEY' } as any)).toMatchObject({ ok: false, error: 'provider_secret_reference_missing' });
+  expect(await save(human, { ...provider(), secretKeyRef: 'SHARED_API_KEY' } as any)).toMatchObject({ ok: false, error: 'invalid_provider_secret_reference' });
+  await save(human);
+  await human('upsert_network_secret', { network_id: net, key: 'SECOND_API_KEY', value: 'TEST-ONLY-second-key' });
+  expect((await save(human, { ...config, secretKeyRef: 'SECOND_API_KEY' } as any, 1)).provider.secret_key_ref).toBe('SECOND_API_KEY');
+  expect(db.get<any>('SELECT secret_key_ref FROM hub_provider_configs WHERE network_id=?1', net).secret_key_ref).toBe('SECOND_API_KEY');
+});
+test('actual Hub tool atomically saves encrypted Provider; metadata read and conflict never echo key', async () => {
+  const human = client(); const result = await save(human); expect(result.ok).toBe(true);
+  expect(result.provider).toMatchObject({ id: 'shared', revision: 1, source: 'hub', credential_present: true, compatible_runtimes: ['codex-tui'] });
+  const read = await human('daemon_provider_snapshot', { action: 'hub_read', id: 'hub', network_id: net }); expect(read.providers).toHaveLength(1);
+  expect(JSON.stringify([result, read])).not.toContain(key);
+  expect(await save(human)).toMatchObject({ ok: false, error: 'hub_provider_revision_conflict' });
+  const secret = db.get<any>('SELECT ciphertext FROM network_secrets WHERE network_id=?1', net);
+  expect(Buffer.from(secret.ciphertext).toString()).not.toContain(key);
+});
+test('Hub → actual daemon queue → pinned CLI store → redacted receipt, not runtime application', async () => {
+  const human = client(), daemon = client('daemon'); await save(human);
+  const queued = await bind(human); expect(queued.ok).toBe(true); expect(queued.status).toBe('pending');
+  expect(JSON.stringify(queued)).not.toContain(key);
+  await reconcileProviderSnapshots({ workDir: root, alias, networkId: net, daemonId, serverUrl: 'https://hub907.example.test', callCommHub: daemon, warn: message => console.warn(message) });
+  const read = await human('daemon_provider_snapshot', { action: 'read', id: queued.request_id, network_id: net });
+  expect(read.status).toBe('succeeded'); expect(read.snapshot.revision).toBe(1);
+  expect(read.snapshot.providers[0]).toMatchObject({ id: queued.provider_reference.daemon_provider_id, label: 'Hub · Shared model' });
+  expect(read.snapshot.providers[0].runtimes[0].auth[0]).toMatchObject({ id: 'hub_key', models: ['fixture-model'], application: 'not_applied', verification: 'not_checked' });
+  expect(JSON.stringify(read)).not.toContain(key);
+});
+test('scope/role boundaries: no node or anonymous writes, no viewer distribution or foreign daemon', async () => {
+  expect(await save(client('daemon'))).toMatchObject({ ok: false, error: 'user_token_required' });
+  expect(await save(client('anonymous'))).toMatchObject({ ok: false, error: 'user_token_required' });
+  const human = client(); await save(human);
+  expect(await human('daemon_provider_snapshot', { action: 'hub_read', id: 'hub', network_id: 'foreign' })).toMatchObject({ ok: false, error: 'provider_access_denied' });
+  expect(await bind(human, 'foreign')).toMatchObject({ ok: false, error: 'daemon_not_found' });
+  db.run("UPDATE network_members SET role='viewer' WHERE network_id=?1 AND user_id=?2", [net, user]);
+  expect(await bind(human)).toMatchObject({ ok: false, error: 'provider_access_denied' });
+  expect(await save(human)).toMatchObject({ ok: false, error: 'provider_owner_required' });
+});
+test('protocol mismatch never queues Codex; editing source cancels pending distribution, not installed copies', async () => {
+  const human = client(); await save(human, { ...provider(), protocol: 'openai-chat-completions' });
+  expect(await bind(human)).toMatchObject({ ok: false, error: 'runtime_protocol_not_supported' });
+  await save(human, provider(), 1);
+  const queued = await bind(human, daemonId, 2);
+  expect(queued.ok).toBe(true); await save(human, { ...provider(), enabled: false }, 2);
+  const read = await human('daemon_provider_snapshot', { action: 'read', id: queued.request_id, network_id: net });
+  expect(read).toMatchObject({ status: 'failed', error: 'hub_provider_source_changed' });
+  expect(db.get('SELECT request_id FROM daemon_provider_writes WHERE request_id=?1', queued.request_id)).toBeNull();
+});

package/src/hub-provider-config.ts

@@ -0,0 +1,105 @@
+// #907: real network-scoped catalog + explicit dispatch; not a Provider proxy.
+import { createHash } from 'node:crypto';
+import { db } from './db';
+import { getUserNetworkRole } from './auth';
+import { vaultUpsert, vaultGet, vaultListKeys, VaultError } from './vault';
+import { requestProviderWrite } from './daemon-provider-snapshots';
+type Human = { userId?: string | null; isNode: boolean; networkId: string | null };
+type Config = { id: string; label: string; enabled: boolean; protocol: 'openai-responses' | 'openai-chat-completions' | 'anthropic-messages'; baseUrl: string; models: string[] };
+const denied = (error: string) => ({ ok: false as const, error });
+const idValid = (id: unknown) => typeof id === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(id);
+function auth(h: Human, write: boolean, owner = false) {
+  if (h.isNode || !h.userId || !h.networkId) return denied('user_token_required');
+  const role = getUserNetworkRole(h.userId, h.networkId);
+  if (!role || (owner && role !== 'owner') || (write && !['owner', 'admin'].includes(role))) return denied(owner ? 'provider_owner_required' : 'provider_access_denied');
+  return null;
+}
+function validConfig(value: any): value is Config {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).some(k => !['id', 'label', 'enabled', 'protocol', 'baseUrl', 'models', 'key', 'secretKeyRef'].includes(k))
+    || !idValid(value.id) || typeof value.label !== 'string' || !value.label.trim() || value.label.length > 100
+    || /[\x00-\x1f\x7f]/.test(value.label) || typeof value.enabled !== 'boolean'
+    || !['openai-responses', 'openai-chat-completions', 'anthropic-messages'].includes(value.protocol)
+    || typeof value.baseUrl !== 'string' || value.baseUrl.length > 2048
+    || !Array.isArray(value.models) || !value.models.length || value.models.length > 200
+    || new Set(value.models).size !== value.models.length
+    || value.models.some((m: unknown) => typeof m !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/.test(m))) return false;
+  try { const u = new URL(value.baseUrl); return ['https:', 'http:'].includes(u.protocol) && !u.username && !u.password && !u.search && !u.hash; }
+  catch { return false; }
+}
+type Row = { revision: number; config_json: string; secret_key_ref: string; updated_at: number };
+function row(networkId: string, id: string) {
+  return db.get<Row>('SELECT revision,config_json,secret_key_ref,updated_at FROM hub_provider_configs WHERE network_id=?1 AND provider_id=?2', networkId, id);
+}
+function publicRow(networkId: string, stored: Row, exposeRef = false) {
+  const config = JSON.parse(stored.config_json) as Config;
+  return { ...config, ...(exposeRef ? { secret_key_ref: stored.secret_key_ref } : {}), revision: stored.revision, updated_at: stored.updated_at, source: 'hub',
+    credential_present: vaultListKeys(networkId).includes(stored.secret_key_ref), verification: 'not_checked',
+    compatible_runtimes: config.protocol === 'openai-responses' ? ['codex-tui'] : [] };
+}
+export function readHubProviders(h: Human, exposeRefs = false) {
+  const refusal = auth(h, false); if (refusal) return refusal;
+  const rows = db.all<Row>('SELECT revision,config_json,secret_key_ref,updated_at FROM hub_provider_configs WHERE network_id=?1 ORDER BY provider_id', h.networkId!);
+  return { ok: true as const, network_id: h.networkId!, source: 'hub' as const,
+    ...(exposeRefs ? { secret_reference_supported: true } : {}), providers: rows.map(r => publicRow(h.networkId!, r, exposeRefs)) };
+}
+export function putHubProvider(h: Human, revision: number, input: unknown) {
+  // This operation stores/rotates a shared secret: same OWNER boundary as vault writes.
+  const refusal = auth(h, true, true); if (refusal) return refusal;
+  if (!Number.isSafeInteger(revision) || revision < 0 || revision >= Number.MAX_SAFE_INTEGER) return denied('invalid_revision');
+  if (!validConfig(input)) return denied('invalid_hub_provider');
+  const value = input as Config & { key?: string; secretKeyRef?: string };
+  if (value.key !== undefined && (typeof value.key !== 'string' || !value.key || value.key.length > 8192 || /[\s\x00-\x1f\x7f]/.test(value.key))) return denied('invalid_provider_key');
+  if (value.secretKeyRef !== undefined && (typeof value.secretKeyRef !== 'string' || !/^[A-Z][A-Z0-9_]{0,63}$/.test(value.secretKeyRef)
+    || value.key !== undefined)) return denied('invalid_provider_secret_reference');
+  if (value.secretKeyRef && !vaultListKeys(h.networkId!).includes(value.secretKeyRef)) return denied('provider_secret_reference_missing');
+  const old = row(h.networkId!, value.id);
+  if ((old?.revision ?? 0) !== revision) return denied('hub_provider_revision_conflict');
+  const previous = old ? JSON.parse(old.config_json) as Config : null;
+  if (!value.key && !value.secretKeyRef && (!old || previous?.baseUrl !== value.baseUrl || previous?.protocol !== value.protocol)) return denied('provider_key_required');
+  // A new plaintext key belongs to this Provider. Never overwrite a separately
+  // named shared key merely because the previous config referenced it.
+  const privateRef = `HUB_PROVIDER_${createHash('sha256').update(JSON.stringify([h.networkId, value.id])).digest('hex').slice(0, 32).toUpperCase()}`;
+  const ref = value.secretKeyRef ?? (value.key ? privateRef : old!.secret_key_ref);
+  const { key, secretKeyRef, ...config } = value;
+  try {
+    db.transaction(() => {
+      if ((row(h.networkId!, value.id)?.revision ?? 0) !== revision) throw new Error('hub_provider_revision_conflict');
+      if (key) vaultUpsert(h.networkId!, ref, key);
+      db.run(`INSERT INTO hub_provider_configs(network_id,provider_id,revision,config_json,secret_key_ref,updated_at) VALUES(?1,?2,?3,?4,?5,?6)
+        ON CONFLICT(network_id,provider_id) DO UPDATE SET revision=excluded.revision,config_json=excluded.config_json,secret_key_ref=excluded.secret_key_ref,updated_at=excluded.updated_at`,
+        [h.networkId!, value.id, revision + 1, JSON.stringify(config), ref, Date.now()]);
+      // Cancel still-pending dispatches when the source is edited/rotated/disabled.
+      // Already installed copies are NOT remotely revoked by this change.
+      db.run(`UPDATE daemon_provider_snapshots SET status='failed',error='hub_provider_source_changed'
+        WHERE status='pending' AND request_id IN (SELECT request_id FROM hub_provider_bindings WHERE network_id=?1 AND provider_id=?2)`, [h.networkId!, value.id]);
+      db.run(`DELETE FROM daemon_provider_writes WHERE request_id IN (SELECT b.request_id FROM hub_provider_bindings b
+        JOIN daemon_provider_snapshots s ON s.request_id=b.request_id WHERE b.network_id=?1 AND b.provider_id=?2 AND s.status!='pending')`, [h.networkId!, value.id]);
+    });
+    return { ok: true as const, network_id: h.networkId!, provider: publicRow(h.networkId!, row(h.networkId!, value.id)!, secretKeyRef !== undefined) };
+  } catch (error) { return denied(error instanceof VaultError ? error.code : 'hub_provider_save_failed'); }
+}
+export function bindHubProvider(h: Human, input: { id: string; revision: number; daemon_node_id: string; daemon_revision: number; confirm: boolean }) {
+  const refusal = auth(h, true); if (refusal) return refusal;
+  if (!input || !idValid(input.id) || input.confirm !== true || !Number.isSafeInteger(input.revision)
+    || !Number.isSafeInteger(input.daemon_revision) || input.daemon_revision < 0) return denied('invalid_hub_provider_binding');
+  const stored = row(h.networkId!, input.id);
+  if (!stored || stored.revision !== input.revision) return denied('hub_provider_revision_conflict');
+  const config = JSON.parse(stored.config_json) as Config;
+  if (!config.enabled) return denied('hub_provider_disabled');
+  // Never silently treat Chat Completions/Anthropic as Codex Responses.
+  if (config.protocol !== 'openai-responses') return denied('runtime_protocol_not_supported');
+  const targetId = `hub_${createHash('sha256').update(JSON.stringify([h.networkId, input.id])).digest('hex').slice(0, 24)}`;
+  try {
+    const key = vaultGet(h.networkId!, stored.secret_key_ref); if (!key) return denied('provider_key_missing');
+    const queued = requestProviderWrite(h, input.daemon_node_id, input.daemon_revision, { id: targetId,
+      label: `Hub · ${config.label}`.slice(0, 100), enabled: true, runtimes: [{ runtime: 'codex-tui', auth: [
+        { id: 'hub_key', kind: 'api_key', models: config.models, baseUrl: config.baseUrl, key },
+      ] }] });
+    if (!queued.ok) return queued;
+    db.run(`INSERT INTO hub_provider_bindings(request_id,network_id,provider_id,provider_revision,daemon_node_id,daemon_provider_id,created_at)
+      VALUES(?1,?2,?3,?4,?5,?6,?7)`, [queued.request_id, h.networkId!, input.id, input.revision, input.daemon_node_id, targetId, Date.now()]);
+    return { ...queued, daemon_node_id: input.daemon_node_id,
+      provider_reference: { network_id: h.networkId!, id: input.id, revision: input.revision, daemon_provider_id: targetId } };
+  } catch (error) { return denied(error instanceof VaultError ? error.code : 'hub_provider_binding_failed'); }
+}

package/src/hub-timestamp.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+import { parseHubTimestamp } from "./hub-timestamp";
+
+const RAW = "2026-08-30 21:11:24";                    // sessions.last_seen_at 的真实取值
+const TRUE_UTC = Date.UTC(2026, 7, 30, 21, 11, 24);
+
+describe("parseHubTimestamp (#1650)", () => {
+  test("🔴 非 UTC 时区下也必须解出同一个 UTC 时刻", () => {
+    // `bun test` 把测试进程时区固定成 UTC(getTimezoneOffset() === 0)。
+    // 在 UTC 下,「补 Z」和「不补 Z」解析出**同一个数** —— 这个函数存在的那个
+    // 缺陷在测试进程里**结构上不可见**。所以这一条必须开 TZ≠UTC 的子进程。
+    // 实测:去掉补 Z,本文件其余各条**全绿**。
+    const child = `import { parseHubTimestamp } from ${JSON.stringify(import.meta.dir + "/hub-timestamp.ts")};
+process.stdout.write(new Date().getTimezoneOffset() + "," + parseHubTimestamp(${JSON.stringify(RAW)}));`;
+    const r = Bun.spawnSync(["bun", "-e", child], { env: { ...process.env, TZ: "Asia/Shanghai" } });
+    const [offset, parsed] = r.stdout.toString().trim().split(",");
+    // 🔴 先断言控制生效:子进程真的不在 UTC。否则 TZ 被忽略时这条又变成空测试。
+    expect(Number(offset)).not.toBe(0);
+    expect(parsed).toBe(String(TRUE_UTC));
+  });
+
+  test("已带 Z / ±HH:MM 的串不再追加时区", () => {
+    expect(parseHubTimestamp("2026-08-30T21:11:24Z")).toBe(TRUE_UTC);
+    expect(parseHubTimestamp("2026-08-30T22:11:24+01:00")).toBe(TRUE_UTC);
+  });
+
+  test("拿不到就返回 null,不返回一个看起来合理的数", () => {
+    for (const bad of [undefined, null, "", "  ", 0, 1788124284000, {}, [], "2026-08-30", "垃圾"]) {
+      expect(parseHubTimestamp(bad as unknown)).toBeNull();
+    }
+  });
+
+  test("🔴 INTEGER 列(epoch 毫秒)不归它管 —— 传数字必须返回 null,而不是悄悄接受", () => {
+    // external_schedule_edits.* 是 INTEGER。如果有人把本函数用在那儿,
+    // 应当立刻拿到 null 而不是一个错的时刻。
+    expect(parseHubTimestamp(TRUE_UTC)).toBeNull();
+  });
+});

package/src/hub-timestamp.ts

@@ -0,0 +1,27 @@
+/**
+ * #1650 — hub 的 TEXT 时间戳列是 SQLite `datetime('now')` 写的，
+ * 形如 `2026-08-30 21:11:24`：**UTC，但不带任何时区标记**。
+ *
+ * 🔴 `new Date(raw)` / `Date.parse(raw)` 对这种串按**本地时间**解析（ES 规范：
+ *    带时间的形式无偏移时视为本地时间），误差恰好等于主机时区偏移，**而且不报错**：
+ *
+ *      TZ=UTC                   误差  0h
+ *      TZ=Asia/Shanghai         误差 -8h   （看起来更陈旧）
+ *      TZ=America/Los_Angeles   误差 +7h   （看起来更新鲜 ← 朝好的一侧错）
+ *
+ * 🔴 **只对 TEXT 列用它。** 同一个字段名在不同表里可能是不同类型：
+ *      sessions.last_seen_at / licenses.expires_at   → TEXT（要用本函数）
+ *      external_schedule_edits.expires_at 等 4 列     → INTEGER（epoch 毫秒，直接 new Date 就对）
+ *    按字段名判会判错 —— 见 #1650 里的更正。
+ *
+ * 与 agent-network 侧的同名函数是**有意的重复**：server 包不依赖 agent-network，
+ * 仓里也没有共享 lib。两边各自带测试。
+ */
+export function parseHubTimestamp(raw: unknown): number | null {
+  if (typeof raw !== "string") return null;
+  const t = raw.trim();
+  if (!/^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}/.test(t)) return null;
+  const hasZone = /([Zz]|[+-]\d{2}:?\d{2})$/.test(t);
+  const ms = Date.parse(t.replace(" ", "T") + (hasZone ? "" : "Z"));
+  return Number.isFinite(ms) ? ms : null;
+}

package/src/human-dm.ts

@@ -0,0 +1,215 @@
+// 多用户账号:人与人私信(同一网络里的两个用户之间)。
+//
+// 投递复用 user_inbox(与 send_desktop_message 同一张表、同一条 /events/users/me 推送、同一套
+// /api/messages?scope=user 未读与 ack),另外记下 sender_user_id —— 由 Hub 按发信人的用户令牌写入,
+// 不是客户端声称的 from_session。会话记录按 (收件人, sender_user_id) 双向取,所以发信人看得到自己发的。
+//
+// 与 Agent 权限无关:受限成员(看不到任何 Agent 的成员)照样能和网络里的其他人私信。
+
+import { db, uuidv4 } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { isAgentRestricted } from "./agent-access.js";
+import { pushUserEvent, hasUserSubscribers } from "./push.js";
+import { existsSync, readFileSync } from "fs";
+import { DM_FILE_SCOPE, FILE_ID_REGEX, indexEntryPath, validateAttachments, validateIndexEntry, type UploadIndexEntry } from "./uploads.js";
+import { restrictedMemberCanUseFile } from "./restricted-files.js";
+import { redactMessageRow } from "./redact-tokens.js";
+
+export const HUMAN_DM_KIND = "human_dm";
+export const MAX_DM_CHARS = 10_000;
+
+export type HumanDmSendInput = {
+  networkId: string;
+  sender: { userId: string; username: string };
+  toUserId?: unknown;
+  toUsername?: unknown;
+  message?: unknown;
+  attachments?: unknown;
+  clientRequestId?: unknown;
+};
+
+export type HumanDmSendResult =
+  | { ok: true; message: Record<string, unknown>; delivered: boolean }
+  | { ok: false; error: string; status: number };
+
+export function sendHumanDm(input: HumanDmSendInput): HumanDmSendResult {
+  const { networkId, sender } = input;
+  if (!getUserNetworkRole(sender.userId, networkId)) return { ok: false, error: "not a member of this network", status: 403 };
+  const text = typeof input.message === "string" ? input.message : "";
+  if (text.length > MAX_DM_CHARS) return { ok: false, error: "message_too_long", status: 400 };
+
+  const byId = typeof input.toUserId === "string" && input.toUserId
+    ? db.get<{ user_id: string; username: string }>("SELECT user_id, username FROM users WHERE user_id = ?1", input.toUserId)
+    : null;
+  const byName = typeof input.toUsername === "string" && input.toUsername
+    ? db.get<{ user_id: string; username: string }>("SELECT user_id, username FROM users WHERE username = ?1", input.toUsername)
+    : null;
+  if (byId && byName && byId.user_id !== byName.user_id) return { ok: false, error: "dm_target_mismatch", status: 400 };
+  const target = byId ?? byName;
+  // 不存在与不在本网络同一个错误,不给用户名探测留差异。
+  if (!target || !getUserNetworkRole(target.user_id, networkId)) return { ok: false, error: "dm_target_not_in_network", status: 404 };
+  if (target.user_id === sender.userId) return { ok: false, error: "dm_to_self", status: 400 };
+
+  const attachments = validateAttachments(input.attachments);
+  if (!attachments.ok) return { ok: false, error: "bad_attachments", status: 400 };
+  if (!text.trim() && attachments.attachments.length === 0) return { ok: false, error: "message_required", status: 400 };
+  const restricted = isAgentRestricted(sender.userId, networkId);
+  for (const a of attachments.attachments) {
+    const fileId = (a as { file_id?: string }).file_id;
+    if (!fileId) continue;
+    const entry = networkFileEntry(networkId, fileId);
+    const usable = restricted
+      ? restrictedMemberCanUseFile(sender.userId, sender.username, networkId, fileId)
+      : !!entry;
+    if (!usable) return { ok: false, error: "attachment_not_accessible", status: 403 };
+    // 私信文件只能由看得见它的人转发:否则任何成员把别人私信里的 file_id 塞进一条自己发出的私信,
+    // 就成了「私信参与者」而解锁它。上传者本人、以及已经在某段私信里收到/发出过它的人可以转。
+    if (entry?.scope === DM_FILE_SCOPE && entry.owner_id !== sender.userId && !dmParticipantSeesFile(sender.userId, networkId, fileId)) {
+      return { ok: false, error: "attachment_not_accessible", status: 403 };
+    }
+  }
+
+  const clientRequestId = typeof input.clientRequestId === "string" && /^[A-Za-z0-9._-]{1,80}$/.test(input.clientRequestId)
+    ? input.clientRequestId : null;
+  // 同一个气泡重试:按 (发信人, client_request_id) 定出同一个 message_id,重投不产生第二条。
+  const messageId = clientRequestId
+    ? `dm_${sender.userId}_${clientRequestId}`.slice(0, 120)
+    : `dm_${uuidv4()}`;
+  const metaJson = attachments.attachments.length ? JSON.stringify({ attachments: attachments.attachments }) : null;
+
+  db.transaction(() => {
+    insertDmRow({ messageId, networkId, targetUserId: target.user_id, sender, title: null, text, metaJson });
+    db.run(
+      `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+       VALUES (?1, ?2, 'human_dm_sent', 'user', ?3, ?4, ?5)`,
+      [sender.userId, sender.username, target.user_id, JSON.stringify({ message_id: messageId, attachments: attachments.attachments.length }), networkId],
+    );
+  });
+  const row = db.get<Record<string, unknown>>(
+    `SELECT message_id, network_id, user_id, sender_user_id, from_session, kind, content, meta_json, acked, created_at
+       FROM user_inbox WHERE message_id = ?1`,
+    messageId,
+  )!;
+  // 推送在提交之后(与 send_desktop_message 同一条规矩:回滚的消息不能先被看见)。
+  const delivered = pushDmEvent({ messageId, networkId, targetUserId: target.user_id, sender, title: null, text, metaJson });
+  return { ok: true, message: redactMessageRow(row), delivered };
+}
+
+type DmRow = { messageId: string; networkId: string; targetUserId: string; sender: { userId: string; username: string }; title: string | null; text: string; metaJson: string | null };
+
+function insertDmRow(m: DmRow): void {
+  db.run(
+    // created_at 带毫秒:同一秒里一来一回的两条私信要能排出先后(秒级的 datetime('now') 排不出)。
+    `INSERT INTO user_inbox (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, sender_user_id, created_at)
+     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, 'info', ?8, ?9, strftime('%Y-%m-%d %H:%M:%f', 'now'))
+     ON CONFLICT(message_id) DO NOTHING`,
+    [m.messageId, m.networkId, m.targetUserId, m.sender.username, HUMAN_DM_KIND, m.title, m.text, m.metaJson, m.sender.userId],
+  );
+}
+
+/** 推 desktop_message 到收件人的 /events/users/me。返回推送时他有没有在线的订阅。 */
+function pushDmEvent(m: DmRow): boolean {
+  const delivered = hasUserSubscribers(m.networkId, m.targetUserId);
+  pushUserEvent(m.networkId, m.targetUserId, {
+    type: "desktop_message",
+    message_id: m.messageId,
+    kind: HUMAN_DM_KIND,
+    from: m.sender.username,
+    from_user_id: m.sender.userId,
+    title: m.title,
+    message: m.text,
+    severity: "info",
+    created_at: new Date().toISOString(),
+    ...(m.metaJson ? { meta: JSON.parse(m.metaJson) } : {}),
+  });
+  return delivered;
+}
+
+/**
+ * Hub 代某人发的一条私信(参与人改了任务的通知,见 requirement-notify.ts):与人发的私信同一张表、同一条推送,
+ * 所以 App 按私信展示(顶部提示 + 人员列表未读 + 与他的会话里能看到),不用新渠道。
+ * 不校验正文 / 附件(调用方生成),也不记 human_dm_sent 审计(这不是他亲手发的)。
+ * 收件人或发信人已不在网络里 → 不发。返回 false = 没发。
+ */
+export function sendNoticeDm(m: DmRow): boolean {
+  if (m.targetUserId === m.sender.userId) return false;
+  if (!getUserNetworkRole(m.sender.userId, m.networkId) || !getUserNetworkRole(m.targetUserId, m.networkId)) return false;
+  insertDmRow(m);
+  pushDmEvent(m);
+  return true;
+}
+
+/**
+ * 把一条还没读的通知私信改写成合并后的正文(同一段时间里的连续改动并成一条)。
+ * 收件人已经读过(acked)或那行没了 → false,调用方另发一条新的。
+ * 只改库、再推一次同一个 message_id:App 按 message_id 去重,不会第二次弹;会话列表下次拉到的是新正文。
+ */
+export function rewriteUnreadNoticeDm(m: DmRow): boolean {
+  const row = db.get<{ acked: number | boolean | null }>("SELECT acked FROM user_inbox WHERE message_id = ?1 AND user_id = ?2", m.messageId, m.targetUserId);
+  if (!row || row.acked) return false;
+  db.run("UPDATE user_inbox SET content = ?1, meta_json = ?2 WHERE message_id = ?3 AND user_id = ?4", [m.text, m.metaJson, m.messageId, m.targetUserId]);
+  pushDmEvent(m);
+  return true;
+}
+
+/** 带附件:文件必须属于这个网络(防把别的网络的 file_id 塞进来)。返回它的索引条目,不属于 → null。 */
+export function networkFileEntry(networkId: string, fileId: string): UploadIndexEntry | null {
+  if (!FILE_ID_REGEX.test(fileId)) return null;
+  const path = indexEntryPath(fileId);
+  if (!path || !existsSync(path)) return null;
+  try {
+    const entry = JSON.parse(readFileSync(path, "utf8"));
+    return validateIndexEntry(entry) && entry.file_id === fileId && entry.network_id === networkId ? entry : null;
+  } catch { return null; }
+}
+
+/**
+ * 这个用户是不是某段带着这个文件的私信里的一方(收到的或发出的)。私信文件(scope=dm)的下载只认它
+ * 和上传者本人(server.ts authorizeFileDownload)。LIKE 只做预筛,真正的判定按 attachments 键解析。
+ */
+export function dmParticipantSeesFile(userId: string, networkId: string, fileId: string): boolean {
+  if (!FILE_ID_REGEX.test(fileId)) return false;
+  const needle = `%"${fileId.replace(/_/g, "\\_")}"%`;
+  const rows = db.all<{ meta_json: string | null }>(
+    `SELECT meta_json FROM user_inbox
+      WHERE network_id = ?1 AND kind = '${HUMAN_DM_KIND}' AND (user_id = ?2 OR sender_user_id = ?2)
+        AND meta_json LIKE ?3 ESCAPE '\\' LIMIT 50`,
+    networkId, userId, needle,
+  );
+  return rows.some((row) => {
+    try {
+      const list = JSON.parse(row.meta_json ?? "null")?.attachments;
+      return Array.isArray(list) && list.some((a: any) => a && typeof a === "object" && a.file_id === fileId);
+    } catch { return false; }
+  });
+}
+
+/** 我和某人的私信记录(双向),新的在前。before = 上一页最后一条的 created_at。 */
+export function listDmThread(networkId: string, meUserId: string, otherUserId: string, limit = 50, before?: string | null) {
+  const params: unknown[] = [networkId, meUserId, otherUserId];
+  let sql = `SELECT message_id, network_id, user_id, sender_user_id, from_session, kind, content, meta_json, acked, created_at
+               FROM user_inbox
+              WHERE network_id = ?1 AND kind = '${HUMAN_DM_KIND}'
+                AND ((user_id = ?2 AND sender_user_id = ?3) OR (user_id = ?3 AND sender_user_id = ?2))`;
+  if (before) { params.push(before); sql += ` AND created_at < ?${params.length}`; }
+  params.push(Math.max(1, Math.min(limit, 200)));
+  sql += ` ORDER BY created_at DESC, rowid DESC LIMIT ?${params.length}`;
+  return db.all<Record<string, unknown>>(sql, ...params).map((row) => ({
+    ...redactMessageRow(row),
+    direction: row.sender_user_id === meUserId ? "out" : "in",
+  }));
+}
+
+/** 我在这个网络里的私信会话:每个对方一行,最后一条时间 + 我这边的未读数。 */
+export function listDmThreads(networkId: string, meUserId: string) {
+  return db.all<{ other_user_id: string; last_at: string; unread: number }>(
+    `SELECT other_user_id, MAX(created_at) AS last_at, SUM(unread) AS unread FROM (
+       SELECT sender_user_id AS other_user_id, created_at, CASE WHEN acked = 0 THEN 1 ELSE 0 END AS unread
+         FROM user_inbox WHERE network_id = ?1 AND user_id = ?2 AND kind = '${HUMAN_DM_KIND}' AND sender_user_id IS NOT NULL
+       UNION ALL
+       SELECT user_id AS other_user_id, created_at, 0 AS unread
+         FROM user_inbox WHERE network_id = ?1 AND sender_user_id = ?2 AND kind = '${HUMAN_DM_KIND}'
+     ) GROUP BY other_user_id ORDER BY last_at DESC`,
+    networkId, meUserId,
+  ).map((r) => ({ other_user_id: r.other_user_id, last_at: r.last_at, unread: Number(r.unread ?? 0) }));
+}

package/src/human-inbox.ts

@@ -0,0 +1,42 @@
+import { db } from "./db.js";
+
+/** Metadata only: the body of an ordinary blocked task is never fetched by this scan. */
+export function isAuthenticatedHumanInboxRow(row: { type: string; meta_json: unknown }): boolean {
+  if (row.type !== "task" && row.type !== "broadcast") return false;
+  let parsed: unknown;
+  try { parsed = typeof row.meta_json === "string" ? JSON.parse(row.meta_json) : null; }
+  catch { return false; }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+  const meta = parsed as Record<string, unknown>;
+  return meta.auth_origin === "user" && meta.source === "dashboard-chat"
+    && typeof meta.client_request_id === "string" && /^dreq_[a-f0-9]{32}$/.test(meta.client_request_id);
+}
+
+/** Caller supplies the already-authorized recipient/network WHERE clause. Both DB dialects
+ * support this scalar keyset; no JSON SQL extension, OFFSET, or arbitrary depth cutoff. */
+export function selectHumanInboxIds(whereSql: string, params: unknown[], limit: number) {
+  const ids: string[] = [];
+  let cursor: { priority_rank: number; created_at: string; fifo_id: number } | undefined;
+  let examined = 0;
+  const rank = "CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END";
+  while (ids.length < limit) {
+    const pageParams = [...params];
+    let sql = `SELECT id, type, meta_json, created_at, rowid AS fifo_id, ${rank} AS priority_rank ${whereSql}`;
+    if (cursor) {
+      const n = pageParams.length + 1;
+      sql += ` AND (${rank}, created_at, rowid) > (?${n}, ?${n + 1}, ?${n + 2})`;
+      pageParams.push(cursor.priority_rank, cursor.created_at, cursor.fifo_id);
+    }
+    sql += ` ORDER BY ${rank}, created_at, rowid LIMIT 256`;
+    const page = db.all<{ id: string; type: string; meta_json: unknown; priority_rank: number; created_at: string; fifo_id: number }>(sql, ...pageParams);
+    if (!page.length) break;
+    for (const row of page) {
+      examined++;
+      if (isAuthenticatedHumanInboxRow(row)) ids.push(row.id);
+      if (ids.length === limit) break;
+    }
+    cursor = page[page.length - 1];
+    if (page.length < 256) break;
+  }
+  return { ids, examined };
+}

package/src/inbox-caller.ts

@@ -0,0 +1,49 @@
+import { db } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { resolveNodeCaller } from "./create-node.js";
+import { resolveCanonicalAlias } from "./rename.js";
+
+type InboxCaller = {
+  tokenId?: string | null;
+  userId?: string | null;
+  networkId?: string | null;
+  nodeToken: boolean;
+  identityRejected: boolean;
+};
+
+/** Inbox reads and ACKs act as the recipient, not as a dispatch target. */
+export function resolveInboxCaller(alias: string, caller: InboxCaller):
+  { ok: true; alias: string } | { ok: false; error: string } {
+  const denied = { ok: false as const, error: "inbox_identity_mismatch" };
+  if (caller.identityRejected) return denied;
+  const requested = alias.trim();
+  if (caller.nodeToken) {
+    const node = resolveNodeCaller(caller.tokenId);
+    if (node.ok) {
+      if (node.networkId !== caller.networkId) return denied;
+      const canonical = resolveCanonicalAlias(node.networkId, requested).alias;
+      return canonical === node.alias ? { ok: true, alias: node.alias } : denied;
+    }
+    // Registration tokens are network-scoped human tokens, not node tokens.
+    // Missing/foreign/ambiguous node identities never fall back to the issuer.
+    if (node.reason !== "not_a_node_token" || !caller.tokenId) return denied;
+    const token = db.get<{ name: string | null }>(
+      "SELECT name FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL", caller.tokenId,
+    );
+    if (!token || token.name?.startsWith("node:")) return denied;
+  }
+  // Preserve open-development and legacy global-token mode.
+  if (!caller.userId) return { ok: true, alias: requested };
+  const user = db.get<{ username: string }>("SELECT username FROM users WHERE user_id = ?1", caller.userId);
+  if (user?.username === requested) return { ok: true, alias: requested };
+  if (!caller.networkId) return { ok: false, error: "network_id_required" };
+  const role = getUserNetworkRole(caller.userId, caller.networkId);
+  if (!role) return denied;
+  const canonical = resolveCanonicalAlias(caller.networkId, requested).alias;
+  if (role === "owner" || role === "admin") return { ok: true, alias: canonical };
+  const owned = db.get<{ node_id: string }>(
+    "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2 AND owner_user_id = ?3 LIMIT 1",
+    canonical, caller.networkId, caller.userId,
+  );
+  return owned ? { ok: true, alias: canonical } : denied;
+}