@sleep2agi/commhub-server 0.9.0-preview.14 → 0.9.0-preview.141

package/src/report-status-resume-id-handover.test.ts

@@ -0,0 +1,184 @@
+// 同一 alias 换 resume_id 上报时,hub 的 report_status 走的是「DELETE 旧行 + INSERT 新行」,
+// ON CONFLICT 里的 COALESCE 一次都不会触发 —— 上报里没带的描述性列(version / agent /
+// hostname / 遥测 / registered_at)全部变 NULL。
+//
+// 2026-09-04 DEV 真机(hub 日志):
+//   12:46:47 grok-v1 (sdk-n_6c)  → report_status: working       version=2.5.0-preview.64
+//   12:46:53 grok-v1 (grok-cli)  → report_status: working       ← TUI 的 MCP 上报,不带 version
+//   12:46:54 grok-v1 (sdk-n_6c)  → report_status: idle          ← 又换回来,也不带 version
+// 结果:version=NULL、registered_at 被改成 12:46:54。舰队里 grok 3/10、claude 5/15 有 version,
+// codex 34/34 有 —— 差别就是有没有第二个上报者。
+//
+// 判据:换 resume_id 之后,只有一行;上报了的列以上报为准,没上报的列从被替换的那行接手。
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+const NET_ID = "net_handover";
+const USER_ID = "u_handover";
+const NODE_ID = "n_handover";
+const ALIAS = "grok-handover";
+const TOK_ID = "tok_handover";
+const RESUME_SDK = `sdk-${NODE_ID}`;
+const RESUME_CLI = `grok-cli-${NODE_ID}`;
+const OLD_REGISTERED_AT = "2026-01-02 03:04:05";
+
+type ToolHandler = (args: any, extra?: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup() {
+  for (const [sql, params] of [
+    ["DELETE FROM agent_telemetry WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM sessions WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM nodes WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM api_tokens WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM network_members WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM networks WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM users WHERE user_id = ?1", [USER_ID]],
+  ] as const) {
+    try { db.run(sql, params as any); } catch {}
+  }
+}
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER_ID, USER_ID]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET_ID, NET_ID, USER_ID]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER_ID, NET_ID]);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'), 'active')`,
+    [NODE_ID, ALIAS, ALIAS, NET_ID, "dev-box"],
+  );
+  // agent-node 自己注册的那行:带 version / agent / hostname / 遥测 / 早就存在的 registered_at
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, version, agent, hostname, server, project_dir,
+                           cpu_cores, mem_total_gb, disk_total_gb, registered_at, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'working', ?3, ?4, '2.5.0-preview.64', 'agent-node:grok-build-cli', 'dev-box', 'dev-box', '/home/x/proj',
+             8, 61.4, 500, ?5, datetime('now'), datetime('now'))`,
+    [RESUME_SDK, ALIAS, NODE_ID, NET_ID, OLD_REGISTERED_AT],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [TOK_ID, USER_ID, NET_ID, `node:${ALIAS}`, `hash_${TOK_ID}`],
+  );
+}
+
+function buildHandlers(): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, _schema: any, handler: ToolHandler) => { tools[name] = handler; return origTool(name, _desc, _schema, handler); };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, _cfg: any, handler: ToolHandler) => { tools[name] = handler; return origRegisterTool(name, _cfg, handler); };
+  }
+  registerTools(server, undefined, NET_ID, USER_ID, ALIAS, true, TOK_ID);
+  return tools;
+}
+
+async function call(handler: ToolHandler, args: any): Promise<any> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0]!.text);
+}
+
+type Row = { resume_id: string; status: string; version: string | null; agent: string | null; hostname: string | null;
+  cpu_cores: number | null; mem_total_gb: number | null; registered_at: string; task: string | null };
+function rows(): Row[] {
+  return db.all("SELECT resume_id, status, version, agent, hostname, cpu_cores, mem_total_gb, registered_at, task FROM sessions WHERE alias = ?1 AND network_id = ?2", [ALIAS, NET_ID]) as Row[];
+}
+
+type OsRow = { resume_id: string; os_user: string | null };
+function osRows(): OsRow[] {
+  return db.all("SELECT resume_id, os_user FROM sessions WHERE alias = ?1 AND network_id = ?2", [ALIAS, NET_ID]) as OsRow[];
+}
+
+describe("report_status: 同 alias 换 resume_id 时,描述性列从被替换的那行接手", () => {
+  test("第二个上报者(grok-cli)不带 version/agent/遥测 → 这些列保留,status/task 以本次为准,仍只有一行", async () => {
+    seed();
+    const tools = buildHandlers();
+    const r = await call(tools.report_status!, { resume_id: RESUME_CLI, alias: ALIAS, status: "working", task: "PING 已收到", network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    const all = rows();
+    expect(all.length).toBe(1);
+    const row = all[0]!;
+    expect(row.resume_id).toBe(RESUME_CLI);
+    expect(row.status).toBe("working");
+    expect(row.task).toBe("PING 已收到");
+    expect(row.version).toBe("2.5.0-preview.64");
+    expect(row.agent).toBe("agent-node:grok-build-cli");
+    expect(row.hostname).toBe("dev-box");
+    expect(row.cpu_cores).toBe(8);
+    expect(row.mem_total_gb).toBe(61.4);
+    expect(row.registered_at).toBe(OLD_REGISTERED_AT);
+  });
+
+  test("上报里带了的列以上报为准(version 变了就用新的)", async () => {
+    seed();
+    const tools = buildHandlers();
+    const r = await call(tools.report_status!, { resume_id: RESUME_CLI, alias: ALIAS, status: "idle", version: "9.9.9", hostname: "other-box", network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    const row = rows()[0]!;
+    expect(rows().length).toBe(1);
+    expect(row.version).toBe("9.9.9");
+    expect(row.hostname).toBe("other-box");
+    expect(row.agent).toBe("agent-node:grok-build-cli");
+  });
+
+  test("再换回原 resume_id(sdk)也不丢:两个上报者轮流说话,version 始终在", async () => {
+    seed();
+    const tools = buildHandlers();
+    await call(tools.report_status!, { resume_id: RESUME_CLI, alias: ALIAS, status: "working", network_id: NET_ID });
+    const r = await call(tools.report_status!, { resume_id: RESUME_SDK, alias: ALIAS, status: "idle", network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    const all = rows();
+    expect(all.length).toBe(1);
+    expect(all[0]!.resume_id).toBe(RESUME_SDK);
+    expect(all[0]!.status).toBe("idle");
+    expect(all[0]!.version).toBe("2.5.0-preview.64");
+    expect(all[0]!.registered_at).toBe(OLD_REGISTERED_AT);
+  });
+
+  test("没有别的行可接手时(全新 alias)行为不变:INSERT 一行,registered_at 取 now", async () => {
+    seed();
+    db.run("DELETE FROM sessions WHERE network_id = ?1", [NET_ID]);
+    const tools = buildHandlers();
+    const r = await call(tools.report_status!, { resume_id: RESUME_SDK, alias: ALIAS, status: "idle", network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    const all = rows();
+    expect(all.length).toBe(1);
+    expect(all[0]!.version).toBeNull();
+    expect(all[0]!.registered_at).not.toBe(OLD_REGISTERED_AT);
+  });
+
+  test("same resume_id stores os_user, and a later report that omits it keeps the value", async () => {
+    seed();
+    const tools = buildHandlers();
+    const set = await call(tools.report_status!, { resume_id: RESUME_SDK, alias: ALIAS, status: "working", os_user: "alice", network_id: NET_ID });
+    expect(set.ok, JSON.stringify(set)).toBe(true);
+    expect(osRows()).toEqual([{ resume_id: RESUME_SDK, os_user: "alice" }]);
+    const keep = await call(tools.report_status!, { resume_id: RESUME_SDK, alias: ALIAS, status: "idle", network_id: NET_ID });
+    expect(keep.ok, JSON.stringify(keep)).toBe(true);
+    expect(osRows()).toEqual([{ resume_id: RESUME_SDK, os_user: "alice" }]);
+  });
+
+  test("换 resume_id 且本次不带 os_user 时,从被替换的那行接手", async () => {
+    seed();
+    db.run("UPDATE sessions SET os_user = ?1 WHERE resume_id = ?2", ["alice", RESUME_SDK]);
+    const tools = buildHandlers();
+    const r = await call(tools.report_status!, { resume_id: RESUME_CLI, alias: ALIAS, status: "working", network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    expect(osRows()).toEqual([{ resume_id: RESUME_CLI, os_user: "alice" }]);
+  });
+
+  test("换 resume_id 且本次带了 os_user 时,以上报为准", async () => {
+    seed();
+    db.run("UPDATE sessions SET os_user = ?1 WHERE resume_id = ?2", ["alice", RESUME_SDK]);
+    const tools = buildHandlers();
+    const r = await call(tools.report_status!, { resume_id: RESUME_CLI, alias: ALIAS, status: "idle", os_user: "bob", network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    expect(osRows()).toEqual([{ resume_id: RESUME_CLI, os_user: "bob" }]);
+  });
+});

package/src/report-status-secret-keys.test.ts

@@ -0,0 +1,140 @@
+// #1474 (#909) — `report_status` accepts the NAMES of the env keys a node has.
+//
+// Called through a real MCP client (InMemoryTransport) rather than the raw
+// handler: the shape rules live in the tool's zod schema, and invoking the
+// handler directly bypasses them — the first version of this file "passed" a
+// `lower-case` key because no validation ran.
+//
+// Two behaviours are load-bearing:
+//   1. `[]` is a REAL report ("this node has no secrets") and must overwrite the
+//      stored list; only an ABSENT field keeps the previous value.
+//   2. A value accidentally placed in the array must be rejected at the
+//      boundary, not stored and later rendered.
+import { beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_secret_keys";
+const USER = "u_secret_keys";
+const RESUME = "r_secret_keys";
+const ALIAS = "sk-node";
+
+type ToolResult = { content: Array<{ type: string; text?: string }>; isError?: boolean };
+
+async function connectClient() {
+  const server = new McpServer({ name: "secret-keys-test", version: "1" });
+  // report_status is a node heartbeat: the harness presents a NETWORK token.
+  registerTools(server, undefined, NET, USER, ALIAS, true, null);
+  const client = new Client({ name: "secret-keys-client", version: "1" });
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  await server.connect(serverTransport);
+  await client.connect(clientTransport);
+  return client;
+}
+
+const report = (extra: Record<string, unknown> = {}) => ({
+  resume_id: RESUME, alias: ALIAS, status: "idle", network_id: NET, ...extra,
+});
+
+async function call(client: Client, args: Record<string, unknown>): Promise<{ ok: boolean; body: any }> {
+  const res = (await client.callTool({ name: "report_status", arguments: args })) as ToolResult;
+  const text = res.content[0]?.text;
+  if (!text) throw new Error("missing text tool result");
+  // A schema rejection comes back as a plain error string ("MCP error ..."),
+  // not JSON: that is exactly the boundary we want to observe.
+  let body: any;
+  try { body = JSON.parse(text); } catch { body = { error: text }; }
+  return { ok: res.isError !== true, body };
+}
+
+const stored = () =>
+  db.get<{ secret_keys: string | null }>("SELECT secret_keys FROM sessions WHERE resume_id = ?1", RESUME)?.secret_keys ?? null;
+
+beforeEach(() => {
+  db.run("INSERT OR IGNORE INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))", [USER, USER]);
+  db.run("INSERT OR IGNORE INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))", [NET, USER]);
+  db.run("INSERT OR IGNORE INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [USER, NET]);
+  db.run("DELETE FROM sessions WHERE resume_id = ?1", [RESUME]);
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, datetime('now'), datetime('now'))`,
+    [RESUME, ALIAS, NET],
+  );
+});
+
+describe("report_status — secret key names", () => {
+  test("stores the names as a JSON array", async () => {
+    const client = await connectClient();
+    const r = await call(client, report({ secret_keys: ["ALPHA_KEY", "BETA_KEY"] }));
+    expect(r.body.ok).toBe(true);
+    expect(stored()).toBe(JSON.stringify(["ALPHA_KEY", "BETA_KEY"]));
+  });
+
+  test("an absent field keeps the previous list", async () => {
+    const client = await connectClient();
+    await call(client, report({ secret_keys: ["ALPHA_KEY"] }));
+    await call(client, report());
+    expect(stored()).toBe(JSON.stringify(["ALPHA_KEY"]));
+  });
+
+  test("an EMPTY array is a real report and clears the list", async () => {
+    const client = await connectClient();
+    await call(client, report({ secret_keys: ["ALPHA_KEY"] }));
+    await call(client, report({ secret_keys: [] }));
+    expect(stored()).toBe("[]");
+  });
+
+  test("a malformed name is rejected at the boundary and nothing is written", async () => {
+    const client = await connectClient();
+    await call(client, report({ secret_keys: ["ALPHA_KEY"] }));
+    const r = await call(client, report({ secret_keys: ["lower-case"] }));
+    expect(r.ok).toBe(false);
+    expect(stored()).toBe(JSON.stringify(["ALPHA_KEY"]));
+  });
+
+  test("more than 50 names is rejected", async () => {
+    const client = await connectClient();
+    const many = Array.from({ length: 51 }, (_, i) => `KEY_${String(i).padStart(3, "0")}`);
+    const r = await call(client, report({ secret_keys: many }));
+    expect(r.ok).toBe(false);
+    expect(stored()).toBeNull();
+  });
+
+  test("a value-shaped string is rejected (the field is a name list, not free text)", async () => {
+    const client = await connectClient();
+    const value = "ghp_" + "A".repeat(40);
+    const r = await call(client, report({ secret_keys: [value] }));
+    expect(r.ok).toBe(false);
+    expect(stored()).toBeNull();
+  });
+});
+
+// #1510 — the node reports how it reaches this hub; reporting only.
+describe("report_status — env_transport", () => {
+  test("stores the reported link kind", async () => {
+    const client = await connectClient();
+    const r = await call(client, report({ env_transport: "loopback" }));
+    expect(r.body.ok).toBe(true);
+    const row = db.get<{ env_transport: string | null }>("SELECT env_transport FROM sessions WHERE resume_id = ?1", RESUME);
+    expect(row?.env_transport).toBe("loopback");
+  });
+
+  test("an unknown value is rejected at the boundary", async () => {
+    const client = await connectClient();
+    const r = await call(client, report({ env_transport: "carrier-pigeon" }));
+    expect(r.ok).toBe(false);
+    const row = db.get<{ env_transport: string | null }>("SELECT env_transport FROM sessions WHERE resume_id = ?1", RESUME);
+    expect(row?.env_transport ?? null).toBeNull();
+  });
+
+  test("an absent field keeps the previous value", async () => {
+    const client = await connectClient();
+    await call(client, report({ env_transport: "https" }));
+    await call(client, report());
+    const row = db.get<{ env_transport: string | null }>("SELECT env_transport FROM sessions WHERE resume_id = ?1", RESUME);
+    expect(row?.env_transport).toBe("https");
+  });
+});

package/src/require-explicit-test-db.ts

@@ -0,0 +1,9 @@
+// #434: real-server integration tests must know their DB before importing
+// auth/db/server modules. Setting COMMHUB_DB in beforeAll is too late because
+// ESM dependencies have already evaluated the db singleton.
+if (!process.env.COMMHUB_DB) {
+  throw new Error(
+    "explicit_test_database_required: run `cd server && bun run test`, " +
+    "or set COMMHUB_DB to an isolated temporary path before running this file",
+  );
+}