@sleep2agi/commhub-server 0.9.0-preview.14 → 0.9.0-preview.141

package/src/node-token-privilege-http.test.ts

@@ -0,0 +1,158 @@
+// 节点令牌不继承签发者的账号权限与 Hub 管理员身份。
+//
+// 生产上几乎所有节点令牌(ntok_)都由管理员签发,resolveToken 把它解析成那个管理员用户。
+// 以前一部分端点直接看 `resolved.user.role === "admin"` 或把令牌当成用户本人,于是任何一个节点
+// 都能:列全部用户、读服务端日志与审计日志、给签发者再签用户令牌 / 节点令牌、改签发者资料与密码、
+// 建 / 改 / 删网络、管成员与邀请、读别的网络详情、看全部网络的 SSE 拓扑。
+// 这里每一条在修复前(main)都是红的;管理员自己的用户令牌作为正控,照常可用。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetwork, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-ntok-priv-"));
+let BASE = "";
+let hub: any = null;
+const PW = "NtokPrivPassw0rd!";
+let adminToken = "", adminId = "", NET = "", OTHER_NET = "", ntok = "";
+
+const auth = (t: string) => ({ Authorization: `Bearer ${t}` });
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...auth(token), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const admin = register(`ntok_admin_${Date.now()}`, PW);
+  adminToken = admin.token!; adminId = admin.user!.user_id; NET = admin.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [adminId]);
+  const other = createNetwork(adminId, "ntok-other");
+  OTHER_NET = (other as any).network_id;
+  const minted = createNetworkTokenForNode(adminId, NET, "ntok-node", "node_ntok_priv");
+  expect(minted.ok).toBe(true);
+  ntok = minted.token!;
+  register(`ntok_someone_${Date.now()}`, PW);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("hub-admin powers need a user token", () => {
+  test("GET /api/users", async () => {
+    expect((await call(ntok, "GET", "/api/users")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/users")).status).toBe(200);
+  });
+  test("GET /api/server-logs", async () => {
+    expect((await call(ntok, "GET", "/api/server-logs")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/server-logs")).status).toBe(200);
+  });
+  test("GET /api/audit-log", async () => {
+    expect((await call(ntok, "GET", "/api/audit-log")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/audit-log")).status).toBe(200);
+  });
+  test("GET /api/networks/:id of a network the token is not bound to", async () => {
+    expect((await call(ntok, "GET", `/api/networks/${OTHER_NET}`)).status).toBe(403);
+    expect((await call(ntok, "GET", `/api/networks/${NET}`)).status).toBe(200);
+  });
+  test("GET /api/stats/sse is limited to the bound network", async () => {
+    const ctrl = new AbortController();
+    const sub = await fetch(`${BASE}/events/some-agent?network_id=${OTHER_NET}`, { headers: auth(adminToken), signal: ctrl.signal }).catch(() => null);
+    const r = await call(ntok, "GET", "/api/stats/sse");
+    ctrl.abort();
+    expect(r.status).toBe(200);
+    expect(Object.keys(r.body.sessions).every((k) => k.split(":").includes(NET))).toBe(true);
+    expect(JSON.stringify(r.body)).not.toContain(OTHER_NET);
+    void sub;
+  });
+  test("POST /api/admin/users and agent-grants", async () => {
+    expect((await call(ntok, "POST", "/api/admin/users", { username: "ntok_made", password: PW })).status).toBe(403);
+    expect((await call(ntok, "GET", `/api/networks/${NET}/members/${adminId}/agent-grants`)).status).toBe(403);
+  });
+});
+
+describe("account and network management need a user token", () => {
+  test("token management: cannot list, mint user tokens, mint node tokens or revoke", async () => {
+    expect((await call(ntok, "GET", "/api/auth/tokens")).status).toBe(403);
+    const minted = await call(ntok, "POST", "/api/auth/tokens", { name: "escalate" });
+    expect(minted.status).toBe(403);
+    expect(minted.body.token).toBeUndefined();
+    expect((await call(ntok, "POST", "/api/auth/node-token", { network_id: OTHER_NET, node_name: "x" })).status).toBe(403);
+    expect((await call(ntok, "DELETE", "/api/auth/tokens/tok_whatever")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/auth/tokens")).status).toBe(200);
+  });
+  test("cannot edit the owner's profile or password", async () => {
+    expect((await call(ntok, "PUT", "/api/auth/me", { display_name: "pwned" })).status).toBe(403);
+    expect(db.get<{ display_name: string }>("SELECT display_name FROM users WHERE user_id = ?1", adminId)?.display_name).not.toBe("pwned");
+    expect((await call(ntok, "POST", "/api/auth/password", { old_password: PW, new_password: "AnotherPassw0rd!" })).status).toBe(403);
+  });
+  test("cannot create, rename or delete networks", async () => {
+    expect((await call(ntok, "POST", "/api/networks", { name: "ntok-made" })).status).toBe(403);
+    expect((await call(ntok, "PUT", `/api/networks/${OTHER_NET}`, { name: "renamed" })).status).toBe(403);
+    expect((await call(ntok, "DELETE", `/api/networks/${OTHER_NET}`)).status).toBe(403);
+    expect(db.get("SELECT 1 FROM networks WHERE network_id = ?1", OTHER_NET)).toBeTruthy();
+  });
+  test("cannot manage members, invites or join", async () => {
+    expect((await call(ntok, "GET", `/api/networks/${NET}/members`)).status).toBe(403);
+    expect((await call(ntok, "POST", `/api/networks/${NET}/members`, { user_id: "u_x" })).status).toBe(403);
+    expect((await call(ntok, "POST", `/api/networks/${NET}/invite`, { role: "admin" })).status).toBe(403);
+    expect((await call(ntok, "POST", "/api/networks/join", { invite_code: "inv_x" })).status).toBe(403);
+    expect((await call(adminToken, "GET", `/api/networks/${NET}/members`)).status).toBe(200);
+  });
+  test("renames: a node token may only rename ITSELF in its bound network", async () => {
+    // 别的网络 / 别的节点 → user_token_required
+    expect((await call(ntok, "POST", "/api/node-rename/prepare", { network_id: OTHER_NET, old_alias: "ntok-node", new_alias: "b" })).status).toBe(403);
+    db.run(`INSERT INTO sessions (resume_id, alias, status, network_id) VALUES ('r_other_node', 'other-node', 'idle', ?1)`, [NET]);
+    expect((await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "other-node", new_alias: "b" })).status).toBe(403);
+    // 另一个节点(管理员用户令牌)开的事务,本节点不能提交
+    const foreign = await call(adminToken, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "other-node", new_alias: "other-node-2" });
+    expect(foreign.body.ok).toBe(true);
+    expect((await call(ntok, "POST", "/api/node-rename/commit", { txn_id: foreign.body.txn_id })).status).toBe(403);
+    expect((await call(adminToken, "POST", "/api/node-rename/abort", { txn_id: foreign.body.txn_id })).body.ok).toBe(true);
+    // 自己:照常(anet node rename 就是这么用的)
+    db.run(`INSERT INTO sessions (resume_id, alias, status, network_id) VALUES ('r_self_node', 'ntok-node', 'idle', ?1)`, [NET]);
+    const mine = await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "ntok-node", new_alias: "ntok-node-2" });
+    expect(mine.body.ok).toBe(true);
+    expect((await call(ntok, "POST", "/api/node-rename/abort", { txn_id: mine.body.txn_id })).body.ok).toBe(true);
+  });
+  test("rename rejects line breaks, tabs and other control characters before reserving an alias", async () => {
+    for (const newAlias of ["hidden\nnode", "hidden\tnode", "hidden\u001fnode", "hidden\u007fnode", "hidden\u2028node", "hidden\u2029node"]) {
+      const r = await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "ntok-node", new_alias: newAlias });
+      expect(r.status).toBe(400);
+      expect(r.body).toMatchObject({ ok: false, error: "node_alias_invalid", code: "node_alias_invalid", reason: "control_character" });
+      expect(r.body.message).toContain("control character U+");
+    }
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM rename_txn WHERE network_id = ?1 AND status = 'prepared'", NET)?.n).toBe(0);
+  });
+});
+
+describe("/api/auth/me says what the credential is", () => {
+  test("node token: owner user for compatibility, but credential.kind=node and only the bound network", async () => {
+    const r = await call(ntok, "GET", "/api/auth/me");
+    expect(r.status).toBe(200);
+    expect(r.body.credential).toMatchObject({ kind: "node", network_id: NET, node_alias: "ntok-node", acts_as_owner: false });
+    expect(r.body.current_network).toBe(NET);
+    expect(r.body.networks.map((n: any) => n.network_id)).toEqual([NET]);
+    const u = await call(adminToken, "GET", "/api/auth/me");
+    expect(u.body.credential).toEqual({ kind: "user" });
+    expect(u.body.networks.map((n: any) => n.network_id).sort()).toEqual([NET, OTHER_NET].sort());
+  });
+  test("node token keeps its own network powers (still a member): status and tasks read fine", async () => {
+    expect((await call(ntok, "GET", "/api/status")).status).toBe(200);
+    expect((await call(ntok, "GET", "/api/tasks")).status).toBe(200);
+  });
+});

package/src/observer-avatar-http.test.ts

@@ -0,0 +1,442 @@
+// #461 + #462 — HTTP integration tests against the real Bun.serve hub.
+//
+// Boots a PRIVATE server instance via the #434 seam (`bootServer({ port: 0 })`,
+// same signature as PR #438) and derives BASE from the actual bound port.
+// This keeps the suite alive in aggregate runs: `await import("./server.js")`
+// is a module-cache no-op when another file booted first, so relying on the
+// import side effect + own PORT env leaves every fetch ConnectionRefused
+// while the tests still "run" (通信龙 #461 review, finding 2). Gate:
+//   bun test src/uploads-http.test.ts src/observer-avatar-http.test.ts → 0 fail
+//
+// #461: GET /events/network/:id observer stream — membership auth incl.
+//       member-removal revocation, summary events for third-party traffic
+//       (REST dispatch + MCP send_reply), no content leakage.
+// #462: PUT /api/nodes/:ref/avatar + GET /api/nodes round trip — persistence,
+//       href normalization, XSS-shaped rejects, clear semantics, write gate.
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { register, login, addNetworkMember, removeNetworkMember, createNetworkTokenForNode } from "./auth.js";
+import { registerTools } from "./tools.js";
+import { db } from "./db.js";
+
+const SERVER_DB = mkdtempSync(join(tmpdir(), "anet-obs-avatar-db-")) + "/commhub.db";
+
+let BASE = "";
+let privateServer: any = null;
+
+let memberToken = "";
+let memberNetworkId = "";
+let memberUserId = "";
+let outsiderToken = "";
+let outsiderUserId = "";
+const TARGET_ALIAS = "obs-target-agent";
+const AVATAR_NODE_ID = "node_avatar_test_1";
+
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
+beforeAll(async () => {
+  // Kept for per-file runs launched without an external COMMHUB_DB (the
+  // documented contract still is to set it externally; see db-adapter.ts).
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || SERVER_DB;
+  process.env.HOST = "127.0.0.1";
+  // (#438 corrective: importing server.js is side-effect-free — no
+  // default instance, no PORT juggling; only the private bootServer
+  // instance below listens.)
+
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const pw = "BootstrapPw123Aa!";
+
+  const memberName = `obs_member_${suffix}`;
+  let r = register(memberName, pw, undefined, "seed");
+  if (!r.ok || !r.token) {
+    const lr = login(memberName, pw);
+    if (lr.token) { memberToken = lr.token; memberNetworkId = lr.network_id ?? ""; }
+  } else {
+    memberToken = r.token;
+    memberNetworkId = r.network_id ?? "";
+  }
+  expect(memberToken).toBeTruthy();
+  expect(memberNetworkId).toBeTruthy();
+  memberUserId = db.get<any>("SELECT user_id FROM users WHERE username = ?1", memberName)?.user_id ?? "";
+  expect(memberUserId).toBeTruthy();
+
+  const outsiderName = `obs_outsider_${suffix}`;
+  const r2 = register(outsiderName, pw, undefined, "seed");
+  if (r2.ok && r2.token) outsiderToken = r2.token;
+  expect(outsiderToken).toBeTruthy();
+  outsiderUserId = db.get<any>("SELECT user_id FROM users WHERE username = ?1", outsiderName)?.user_id ?? "";
+  expect(outsiderUserId).toBeTruthy();
+
+  // Target agent session in the member's network, freshly seen → online.
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, datetime('now'), datetime('now'))`,
+    [`resume_${suffix}`, TARGET_ALIAS, memberNetworkId]
+  );
+
+  // Node row for the avatar round trip.
+  db.run(
+    `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at)
+     VALUES (?1, 'avatar-test-node', ?2, ?3, datetime('now'), datetime('now'))`,
+    [AVATAR_NODE_ID, TARGET_ALIAS, memberNetworkId]
+  );
+
+  // Private instance on an OS-assigned port — collision-free by
+  // construction (kernel-assigned).
+  const mod: any = await import("./server.js");
+  privateServer = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${privateServer.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { privateServer?.stop?.(true); } catch {}
+  try { rmSync(SERVER_DB, { recursive: true, force: true }); } catch {}
+});
+
+function auth(token: string): Record<string, string> {
+  return { "Authorization": `Bearer ${token}` };
+}
+
+/** Read the next SSE data frame from a fetch Response, with timeout. */
+async function readFrame(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  timeoutMs = 3_000,
+): Promise<Record<string, any>> {
+  const decoder = new TextDecoder();
+  let buf = "";
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const result = await Promise.race([
+      reader.read(),
+      new Promise<never>((_, rej) =>
+        setTimeout(() => rej(new Error(`no SSE frame within ${timeoutMs}ms`)), deadline - Date.now()),
+      ),
+    ]);
+    if (result.done) throw new Error("SSE stream ended unexpectedly");
+    buf += decoder.decode(result.value, { stream: true });
+    const sep = buf.indexOf("\n\n");
+    if (sep === -1) continue;
+    const rawFrame = buf.slice(0, sep);
+    buf = buf.slice(sep + 2);
+    const dataLine = rawFrame.split("\n").find((l) => l.startsWith("data: "));
+    if (!dataLine) continue;
+    return JSON.parse(dataLine.slice(6));
+  }
+  throw new Error(`no SSE frame within ${timeoutMs}ms`);
+}
+
+describe("#461 GET /events/network/:id — auth", () => {
+  test("anonymous → 401", async () => {
+    const res = await fetch(`${BASE}/events/network/${memberNetworkId}`);
+    expect(res.status).toBe(401);
+  });
+
+  test("non-member user token → 403", async () => {
+    const res = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(outsiderToken) });
+    expect(res.status).toBe(403);
+    const body = await res.json() as any;
+    expect(body.ok).toBe(false);
+  });
+
+  test("member user token → SSE stream with observer connected frame", async () => {
+    const res = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(memberToken) });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type") || "").toContain("text/event-stream");
+    const reader = res.body!.getReader();
+    const connected = await readFrame(reader);
+    expect(connected.type).toBe("connected");
+    expect(connected.observer).toBe(true);
+    expect(connected.network_id).toBe(memberNetworkId);
+    await reader.cancel();
+  });
+
+  test("membership removal revokes observer access — ntok exploit repro (通信龙 review finding 1)", async () => {
+    // Exact repro of the review's exploit: add user C to network A, mint
+    // an ntok BOUND to A, remove C from A — the same live ntok must lose
+    // the stream. (Before #488 network_members was the only revocation
+    // mechanism — removeNetworkMember did not revoke tokens; the old
+    // `!role && authCtx.networkId !== observedNetId` OR-form let the
+    // token's network binding bypass the membership check (utok would
+    // not catch this: its authCtx.networkId is null, so only ntok
+    // exercises the vulnerable branch — verified by stubbing the OR
+    // back in: THIS test goes red, the utok variants stay green).
+    // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+    const added = addNetworkMember(memberNetworkId, outsiderUserId, "member", undefined, { agentAccess: "all" });
+    expect(added.ok).toBe(true);
+    const minted = createNetworkTokenForNode(outsiderUserId, memberNetworkId, "revocation-probe");
+    expect(minted.ok).toBe(true);
+    const ntok = minted.token!;
+    expect(ntok.startsWith("ntok_")).toBe(true);
+
+    const whileMember = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(ntok) });
+    expect(whileMember.status).toBe(200);
+    const reader = whileMember.body!.getReader();
+    expect((await readFrame(reader)).type).toBe("connected");
+    await reader.cancel();
+
+    const removed = removeNetworkMember(memberNetworkId, outsiderUserId);
+    expect(removed.ok).toBe(true);
+    // The review's failing probe: /events/network/A with the network-bound
+    // token → must no longer be 200. Since #488 removeNetworkMember revokes
+    // the user's tokens for that network and resolveToken rejects a
+    // non-member's network token, so the token itself is refused (401).
+    const afterRemoval = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(ntok) });
+    expect(afterRemoval.status).toBe(401);
+    // utok of the removed user is denied too.
+    const utokAfter = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(outsiderToken) });
+    expect(utokAfter.status).toBe(403);
+  });
+});
+
+describe("GET /events/users/me — Desktop user stream auth", () => {
+  test("anonymous → 401", async () => {
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`);
+    expect(res.status).toBe(401);
+  });
+
+  test("ntok is refused for user stream", async () => {
+    const minted = createNetworkTokenForNode(memberUserId, memberNetworkId, "desktop-ntok-probe");
+    expect(minted.ok).toBe(true);
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`, { headers: auth(minted.token!) });
+    expect(res.status).toBe(403);
+    const body = await res.json() as any;
+    expect(body.error).toBe("user_token_required");
+  });
+
+  test("utok without network_id → 400", async () => {
+    const res = await fetch(`${BASE}/events/users/me`, { headers: auth(memberToken) });
+    expect(res.status).toBe(400);
+    const body = await res.json() as any;
+    expect(body.error).toBe("network_id required");
+  });
+
+  test("non-member utok → 403", async () => {
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`, { headers: auth(outsiderToken) });
+    expect(res.status).toBe(403);
+    const body = await res.json() as any;
+    expect(body.error).toBe("not a member of this network");
+  });
+
+  test("member utok → user stream connected frame keyed to authenticated user", async () => {
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`, { headers: auth(memberToken) });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type") || "").toContain("text/event-stream");
+    const reader = res.body!.getReader();
+    const connected = await readFrame(reader);
+    expect(connected.type).toBe("connected");
+    expect(connected.user).toBe(true);
+    expect(connected.network_id).toBe(memberNetworkId);
+    expect(connected.user_id).toBe(memberUserId);
+    await reader.cancel();
+  });
+});
+
+describe("GET /api/messages — client inbox count", () => {
+  test("alias filter returns only that inbox and pending_count for unacked rows", async () => {
+    const selfAlias = `user-${memberUserId}`;
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+       VALUES (?1, ?2, 'task', 'normal', 'unread self', 'agent-a', 0, ?3, datetime('now'))`,
+      [`msg_self_unread_${Date.now()}`, selfAlias, memberNetworkId],
+    );
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+       VALUES (?1, ?2, 'task', 'normal', 'read self', 'agent-a', 1, ?3, datetime('now'))`,
+      [`msg_self_read_${Date.now()}`, selfAlias, memberNetworkId],
+    );
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+       VALUES (?1, 'other-alias', 'task', 'normal', 'other inbox', 'agent-b', 0, ?2, datetime('now'))`,
+      [`msg_other_${Date.now()}`, memberNetworkId],
+    );
+
+    const res = await fetch(`${BASE}/api/messages?alias=${encodeURIComponent(selfAlias)}&network_id=${encodeURIComponent(memberNetworkId)}&limit=20`, {
+      headers: auth(memberToken),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.ok).toBe(true);
+    expect(body.pending_count).toBe(1);
+    expect(body.messages.length).toBeGreaterThanOrEqual(2);
+    expect(body.messages.every((m: any) => m.to_alias === selfAlias)).toBe(true);
+    expect(body.messages.some((m: any) => m.content === "other inbox")).toBe(false);
+  });
+});
+
+describe("#461 observer receives third-party traffic summaries", () => {
+  test("REST /api/task dispatch → observer gets new_task summary, no content", async () => {
+    const res = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(memberToken) });
+    const reader = res.body!.getReader();
+    await readFrame(reader); // connected
+
+    const secret = `SECRET-TASK-CONTENT-${Date.now()}`;
+    const body = { alias: TARGET_ALIAS, task: secret, priority: "high", from: "third-party-sender", network_id: memberNetworkId };
+    // Human tokens send as their authenticated username; they cannot stand
+    // in for an Agent. Keep that refusal and exercise the observer with an
+    // actual bound sender token instead of weakening the identity contract.
+    const spoof = await fetch(`${BASE}/api/task`, {
+      method: "POST", headers: { ...auth(memberToken), "Content-Type": "application/json" }, body: JSON.stringify(body),
+    });
+    expect(spoof.status).toBe(403);
+    expect((await spoof.json() as any).error).toBe("from_session_identity_mismatch");
+    const sender = createNetworkTokenForNode(memberUserId, memberNetworkId, "third-party-sender", `node_obs_sender_${Date.now()}`);
+    expect(sender.ok).toBe(true);
+    const dispatch = await fetch(`${BASE}/api/task`, {
+      method: "POST",
+      headers: { ...auth(sender.token!), "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    expect([200, 202]).toContain(dispatch.status);
+    const dispatched = await dispatch.json() as any;
+    expect(dispatched.task_id).toBeTruthy();
+
+    const evt = await readFrame(reader);
+    expect(evt.type).toBe("new_task");
+    expect(evt.task_id).toBe(dispatched.task_id);
+    expect(evt.from).toBe("third-party-sender");
+    expect(evt.to).toBe(TARGET_ALIAS);
+    // Online session was seeded → delivered; offline would report queued.
+    expect(evt.status).toBe("delivered");
+    expect(evt.priority).toBe("high");
+    expect(evt.network_id).toBe(memberNetworkId);
+    expect(evt.scope).toBe("network");
+    // The acceptance line: summary must NOT leak the task body.
+    expect(JSON.stringify(evt)).not.toContain(secret);
+    await reader.cancel();
+  });
+
+  test("MCP send_reply → observer gets new_reply summary, reply text NOT in frame", async () => {
+    // Drive the REAL registered MCP handler (same interception pattern as
+    // ack-create-request.test.ts) with the member's network enforced, and
+    // read the observer stream over real HTTP.
+    const res = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(memberToken) });
+    const reader = res.body!.getReader();
+    await readFrame(reader); // connected
+
+    const tools: Record<string, (args: any) => Promise<any>> = {};
+    const mcp = new McpServer({ name: "test", version: "0" }) as any;
+    mcp.tool = (name: string, _desc: string, _schema: any, handler: any) => { tools[name] = handler; };
+    registerTools(mcp, undefined, memberNetworkId, memberUserId);
+    expect(typeof tools["send_reply"]).toBe("function");
+
+    const secret = `SECRET-REPLY-TEXT-${Date.now()}`;
+    const result = await tools["send_reply"]({
+      alias: TARGET_ALIAS,
+      text: secret,
+      status: "replied",
+      from_session: "reply-worker",
+    });
+    const parsed = JSON.parse(result.content[0].text);
+    expect(parsed.ok).toBe(true);
+
+    const evt = await readFrame(reader);
+    expect(evt.type).toBe("new_reply");
+    expect(evt.from).toBe("reply-worker");
+    expect(evt.to).toBe(TARGET_ALIAS);
+    expect(evt.status).toBe("replied");
+    expect(evt.message_id).toBe(parsed.message_id);
+    expect(evt.network_id).toBe(memberNetworkId);
+    expect(JSON.stringify(evt)).not.toContain(secret);
+    await reader.cancel();
+  });
+});
+
+describe("#462 PUT /api/nodes/:ref/avatar + GET /api/nodes", () => {
+  test("set avatar → 200, GET /api/nodes returns it (cross-device persistence)", async () => {
+    const avatarUrl = "https://cdn.example.com/avatars/custom-1.png";
+    const put = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { ...auth(memberToken), "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: avatarUrl }),
+    });
+    expect(put.status).toBe(200);
+    const putBody = await put.json() as any;
+    expect(putBody.ok).toBe(true);
+    expect(putBody.avatar_url).toBe(avatarUrl);
+
+    const list = await fetch(`${BASE}/api/nodes?node_id=${AVATAR_NODE_ID}`, { headers: auth(memberToken) });
+    expect(list.status).toBe(200);
+    const listBody = await list.json() as any;
+    expect(listBody.ok).toBe(true);
+    const row = listBody.nodes.find((n: any) => n.node_id === AVATAR_NODE_ID);
+    expect(row).toBeTruthy();
+    expect(row.avatar_url).toBe(avatarUrl);
+    // #312 discipline still holds — internals must not leak.
+    expect("config_snapshot" in row).toBe(false);
+  });
+
+  test("markup-hostile chars are stored NORMALIZED (href), not raw (通信龙 review finding 3)", async () => {
+    const put = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { ...auth(memberToken), "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: 'https://cdn.example.com/a"b.png' }),
+    });
+    expect(put.status).toBe(200);
+    const putBody = await put.json() as any;
+    expect(putBody.avatar_url).toBe("https://cdn.example.com/a%22b.png");
+    const row = db.get<any>("SELECT avatar_url FROM nodes WHERE node_id = ?1", AVATAR_NODE_ID);
+    expect(row.avatar_url).toBe("https://cdn.example.com/a%22b.png");
+    expect(row.avatar_url).not.toContain('"');
+  });
+
+  test("clear avatar with null → avatar_url null in list", async () => {
+    const put = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { ...auth(memberToken), "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: null }),
+    });
+    expect(put.status).toBe(200);
+    const list = await fetch(`${BASE}/api/nodes?node_id=${AVATAR_NODE_ID}`, { headers: auth(memberToken) });
+    const listBody = await list.json() as any;
+    const row = listBody.nodes.find((n: any) => n.node_id === AVATAR_NODE_ID);
+    expect(row.avatar_url).toBeNull();
+  });
+
+  test("javascript: URL → 400 invalid_avatar_url, value NOT persisted", async () => {
+    const put = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { ...auth(memberToken), "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: "javascript:alert(1)" }),
+    });
+    expect(put.status).toBe(400);
+    const body = await put.json() as any;
+    expect(body.error).toBe("invalid_avatar_url");
+    const row = db.get<any>("SELECT avatar_url FROM nodes WHERE node_id = ?1", AVATAR_NODE_ID);
+    expect(row.avatar_url ?? null).toBeNull();
+  });
+
+  test("data: URL → 400", async () => {
+    const put = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { ...auth(memberToken), "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: "data:text/html,<script>alert(1)</script>" }),
+    });
+    expect(put.status).toBe(400);
+  });
+
+  test("anonymous → 401; non-member → 404/403 (network-scoped lookup)", async () => {
+    const anon = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: "https://example.com/x.png" }),
+    });
+    expect(anon.status).toBe(401);
+
+    // Outsider's network scope can't even see the node → 404 (or 403 if
+    // visibility rules change later; both deny the write).
+    const outsider = await fetch(`${BASE}/api/nodes/${AVATAR_NODE_ID}/avatar`, {
+      method: "PUT",
+      headers: { ...auth(outsiderToken), "Content-Type": "application/json" },
+      body: JSON.stringify({ avatar_url: "https://example.com/x.png" }),
+    });
+    expect([403, 404]).toContain(outsider.status);
+    const row = db.get<any>("SELECT avatar_url FROM nodes WHERE node_id = ?1", AVATAR_NODE_ID);
+    expect(row.avatar_url ?? null).toBeNull();
+  });
+});