@sleep2agi/commhub-server 0.9.0-preview.144 → 0.9.0-preview.146

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.144",
+  "version": "0.9.0-preview.146",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -322,6 +322,21 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
 `);
 
+// 账号头像上传（二进制 PNG，Hub 自己发 URL）。与 users.avatar_url 并存：
+// avatar_url 仍可指向内建池/外链；这张表只存「上传到 Hub 本人的那张」。
+// 单行/人：新版本覆盖旧版本，旧 URL 立刻 404（version 变了），不做历史留存。
+db.exec(`
+  CREATE TABLE IF NOT EXISTS user_avatar_uploads (
+    user_id    TEXT PRIMARY KEY,
+    version    TEXT NOT NULL,
+    png        BLOB NOT NULL,
+    bytes      INTEGER NOT NULL,
+    width      INTEGER NOT NULL,
+    height     INTEGER NOT NULL,
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+`);
+
 // Human profile avatar. Additive for existing databases; old binaries ignore it.
 try {
   db.exec("ALTER TABLE users ADD COLUMN avatar_url TEXT");

package/src/departments-mcp.test.ts

@@ -0,0 +1,128 @@
+// #1894 —— 组织架构的 MCP 面：Agent 用 API 就能建部门、把 Agent 归进去，
+// 不用人手动点。这里跑的是真实的 in-process MCP transport（不是直接调函数），
+// 因为要验的正是「工具真的注册上、参数真的能过 schema、权限真的按 caller 判」。
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_dept_mcp";
+const OWNER = "u_dept_mcp_owner";
+const OTHER = "u_dept_mcp_other";
+const AGENT_A = "n_dept_mcp_a";
+const AGENT_B = "n_dept_mcp_b";
+
+function cleanup() {
+  for (const [table, col] of [
+    ["audit_log", "network_id"], ["nodes", "network_id"], ["network_departments", "network_id"],
+    ["network_members", "network_id"], ["networks", "network_id"],
+  ] as const) {
+    try { db.run(`DELETE FROM ${table} WHERE ${col} = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id IN (?1, ?2)", [OWNER, OTHER]); } catch {}
+}
+
+function seed() {
+  cleanup();
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))", [OWNER, OWNER]);
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))", [OTHER, OTHER]);
+  db.run("INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))", [NET, NET, OWNER]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [OWNER, NET]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'member', datetime('now'))", [OTHER, NET]);
+  for (const [id, alias] of [[AGENT_A, "dept-agent-a"], [AGENT_B, "dept-agent-b"]] as const) {
+    db.run("INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'))", [id, alias, NET]);
+  }
+}
+
+async function connect(callerUserId: string, alias = "dept-agent-a") {
+  const server = new McpServer({ name: "dept-mcp-test", version: "1" });
+  registerTools(server, undefined, NET, callerUserId, alias, true, null);
+  const client = new Client({ name: "dept-mcp-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  return { client, server };
+}
+
+type Result = { content: Array<{ type: string; text?: string }>; isError?: boolean };
+const json = (r: Result) => JSON.parse(String(r.content[0]?.text ?? "{}"));
+
+beforeEach(seed);
+afterAll(cleanup);
+
+describe("#1894 departments over MCP", () => {
+  test("owner can list, create, assign and read back the counts", async () => {
+    const { client, server } = await connect(OWNER);
+    try {
+      const before = json(await client.callTool({ name: "departments", arguments: { action: "list" } }) as Result);
+      expect(before.ok).toBe(true);
+      expect(before.unassigned_agents).toBe(2);
+
+      const created = json(await client.callTool({
+        name: "departments", arguments: { action: "create", name: "TMAI", department_id: "dept_test_tmai" },
+      }) as Result);
+      expect(created.ok).toBe(true);
+      expect(created.department.id).toBe("dept_test_tmai");
+
+      const child = json(await client.callTool({
+        name: "departments", arguments: { action: "create", name: "TMAI-内容", parent_id: "dept_test_tmai" },
+      }) as Result);
+      expect(child.ok).toBe(true);
+      expect(child.department.parent_id).toBe("dept_test_tmai");
+
+      const assigned = json(await client.callTool({
+        name: "departments", arguments: { action: "assign_agent", alias: "dept-agent-a", department_id: "dept_test_tmai" },
+      }) as Result);
+      expect(assigned.ok).toBe(true);
+      expect(assigned.node_id).toBe(AGENT_A);
+
+      const after = json(await client.callTool({ name: "departments", arguments: { action: "list" } }) as Result);
+      expect(after.unassigned_agents).toBe(1);
+      const tmai = after.departments.find((d: any) => d.id === "dept_test_tmai");
+      expect(tmai.agent_count).toBe(1);
+      const agent = after.agents.find((a: any) => a.node_id === AGENT_A);
+      expect(agent.department_id).toBe("dept_test_tmai");
+
+      // 清空归属同样要能通过 API 做
+      const cleared = json(await client.callTool({
+        name: "departments", arguments: { action: "assign_agent", node_id: AGENT_A, department_id: null },
+      }) as Result);
+      expect(cleared.ok).toBe(true);
+      expect(cleared.department_id).toBeNull();
+    } finally {
+      await server.close();
+    }
+  });
+
+  test("a plain member cannot write departments", async () => {
+    const { client, server } = await connect(OTHER, "dept-agent-b");
+    try {
+      const read = json(await client.callTool({ name: "departments", arguments: { action: "list" } }) as Result);
+      expect(read.ok).toBe(true);
+      const created = json(await client.callTool({
+        name: "departments", arguments: { action: "create", name: "不该被建出来" },
+      }) as Result);
+      expect(created.ok).toBe(false);
+      const assigned = json(await client.callTool({
+        name: "departments", arguments: { action: "assign_agent", node_id: AGENT_B, department_id: null },
+      }) as Result);
+      expect(assigned.ok).toBe(false);
+    } finally {
+      await server.close();
+    }
+  });
+
+  test("deleting a department that still has agents is refused", async () => {
+    const { client, server } = await connect(OWNER);
+    try {
+      json(await client.callTool({ name: "departments", arguments: { action: "create", name: "B 站", department_id: "dept_test_b" } }) as Result);
+      json(await client.callTool({ name: "departments", arguments: { action: "assign_agent", node_id: AGENT_B, department_id: "dept_test_b" } }) as Result);
+      const refused = json(await client.callTool({ name: "departments", arguments: { action: "delete", department_id: "dept_test_b" } }) as Result);
+      expect(refused.ok).toBe(false);
+    } finally {
+      await server.close();
+    }
+  });
+});

package/src/departments.ts

@@ -218,11 +218,14 @@ export function updateDepartment(networkId: string, id: string, body: Record<str
 }
 
 /** 只删空部门:有子部门 / 有成员 → 409(带数字,界面照着说)。 */
-export function deleteDepartment(networkId: string, id: string): Ok<{ deleted: string }> | (Fail & { children?: number; members?: number }) {
+export function deleteDepartment(networkId: string, id: string): Ok<{ deleted: string }> | (Fail & { children?: number; members?: number; agents?: number }) {
   if (!one(networkId, id)) return fail(404, "department_not_found");
   const children = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM network_departments WHERE network_id = ?1 AND parent_id = ?2", networkId, id)?.n ?? 0;
   const members = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM network_members WHERE network_id = ?1 AND department_id = ?2", networkId, id)?.n ?? 0;
-  if (children || members) return { ...fail(409, "department_not_empty"), children, members };
+  // #1894 —— Agent 的部门归属是 nodes.department_id（显式归属线）。以前只数人类成员，
+  // 于是「部门里还有 300 个 Agent」也能被删掉，留下指向不存在部门的悬空归属。
+  const agents = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM nodes WHERE network_id = ?1 AND department_id = ?2", networkId, id)?.n ?? 0;
+  if (children || members || agents) return { ...fail(409, "department_not_empty"), children, members, agents };
   // RFC-040:部门的项目授权(network_department_project_grants)和部门同一事务删掉。
   groupTx(() => {
     db.run("DELETE FROM network_departments WHERE network_id = ?1 AND department_id = ?2", [networkId, id]);

package/src/mcp-context-cost-http.test.ts

@@ -29,7 +29,11 @@ if (!activeDbPath) throw new Error("mcp-context-cost requires COMMHUB_DB (or COM
 // Hub #938 clone_node is audience both (60 tools / 58,169 B). OpenCode V2
 // catalog adds read_opencode_catalog and get_opencode_catalog on that user
 // list. Measured together: 62 tools / 59,409 B. Ceiling keeps ~401 B.
-const TOOLS_LIST_MAX_BYTES = 59_810;
+// #1894（2026-10-23）：新增 `departments` 一个工具（组织架构的 list/create/update/
+// delete/assign_agent 合并成一个，避免 5 个工具把上下文顶穿）。实测 63 个工具
+// 60,089 B，比原上限高 279 B —— 这是**有意的功能增长**，不是描述悄悄变长，
+// 所以显式抬到 60_500（留 411 B 余量）并在同一行写清理由。
+const TOOLS_LIST_MAX_BYTES = 60_500;
 /** 单个工具(名字 + 描述 + 输入 schema)的上限;最大的是 report_status(节点心跳,~8.4 KB 的遥测结构)。 */
 const TOOL_MAX_BYTES = 9_000;
 /** 单条工具描述的上限(说明写进参数的 describe,或者拆短)。 */

package/src/node-lifecycle-read-http.test.ts

@@ -66,8 +66,13 @@ test("public errors redact free text for granted viewers on every projection", a
       "adopt_codex_session_conflict", "adopt_codex_port_unavailable", "adopt_codex_stage_still_running",
       "adopt_codex_identity_unproven",
       "TUI session mismatch", "opencode_launch_health:TUI session mismatch", "opencode_tui_session_mismatch",
+      // #2012：daemon 明确拒绝的固定安全码，必须原样投影给用户，而不是退化成 lifecycle_error。
+      "copresence_adopt_v2",
+      // 负控：带后缀/路径/空白的形状仍必须清成 lifecycle_error（只精确放行这一串）。
+      "copresence_adopt_v2: /private/fixture", "copresence_adopt_v2x", " copresence_adopt_v2",
     ]) {
       const publicCodes = ["adopt_start_timeout", "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed", "opencode_tui_session_mismatch",
+        "copresence_adopt_v2",
         "adopt_codex_external_start_unproven", "adopt_codex_launch_failed", "adopt_codex_launch_timeout",
         "adopt_codex_port_unproven", "adopt_codex_start_superseded", "adopt_codex_binding_generation_unproven",
         "adopt_codex_start_evidence_missing", "adopt_codex_start_evidence_changed",

package/src/node-lifecycle-read.ts

@@ -33,6 +33,9 @@ const publicLifecycleErrors = new Set([
   "adopt_pane_process_mismatch", "adopt_socket_directory_unsafe", "adopt_socket_unsafe",
   "adopt_pid_changed", "adopt_pid_invalid", "adopt_pidfile_unsafe",
   "opencode_tui_session_mismatch",
+  // #2012 —— daemon 的 copresence_adopt_v2 拒绝是固定安全码（无路径/无异常文本），
+  // 不放行会让用户投影退化成 lifecycle_error，看不到「为什么被拒绝」。
+  "copresence_adopt_v2",
   "adopt_proc_invalid", "adopt_proc_unreadable", "adopt_platform_unsupported",
   "adopt_registry_conflict", "adopt_registry_entry_invalid", "adopt_registry_invalid",
   "adopt_registry_unsafe", "adopt_config_env_invalid", "adopt_env_file_invalid",

package/src/node-permissions.ts

@@ -269,6 +269,8 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   broadcast: "broadcast",
   // 任务看板:在 requirements.ts 里按卡判(REST 与 MCP 同一处)
   requirements_list: "requirements", requirements_people: "requirements", requirements_get: "requirements", requirements_create: "requirements",
+  // #1894 —— 组织架构：读是常规读，写由工具内部再判网络 owner/admin（普通成员/节点写会被拒并 audit）。
+  departments: "requirements",
   requirements_update: "requirements", requirements_checklist_toggle: "requirements", requirements_upsert_by_external_ref: "requirements",
   requirements_events: "requirements", requirements_comment: "requirements", projects_list: "requirements",
   // 定时任务(#733):在 schedule-agent.ts 里按排程判(范围 / 目标 = send_task 的 dispatchVerdict / 配额)

package/src/node-session-control-http.test.ts

@@ -0,0 +1,308 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, setSystemTime, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const dir = mkdtempSync(join(tmpdir(), "anet-session-control-"));
+process.env.COMMHUB_DB ||= join(dir, "hub.db");
+const root = "/api/node-session-control";
+let server: any, base: string, db: any, net: string, otherNet: string;
+let owner: any, admin: any, member: any, outsider: any, ntok: any, peer: any;
+let legacyOwner: any, legacyAdmin: any, legacyMember: any, legacyOutsider: any, legacyFull: any, legacyNetwork: any;
+let binding = { session_id: "session_1", binding_id: "binding_1" }, serial = 0;
+const nodeId = "n_session_control", peerId = "n_session_control_peer";
+async function api(token: string, path: string, value?: unknown, method?: string) {
+  const res = await fetch(`${base}${path}`, { method: method ?? (value === undefined ? "GET" : "POST"),
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    ...(value === undefined ? {} : { body: JSON.stringify(value) }) });
+  return { status: res.status, body: await res.json() as any };
+}
+const registerBridge = (v = binding, token = ntok.token!) => api(token, `${root}/bridge`,
+  { ...v, expected: { node_id: nodeId, network_id: net } });
+const enqueue = (operation = "background", extra = {}) => api(owner.token!, root,
+  { network_id: net, node_id: nodeId, operation, expected: binding, ...extra });
+const pull = (token = ntok.token!, v = binding) => api(token, `${root}/pull`, v);
+const read = (request: string, token = owner.token!, network = net) => api(token, `${root}/${request}?network_id=${network}`);
+const state = () => ({ ...binding, supported: true, active: true, can_request_background: true, observed_at: Date.now() });
+const ack = (request: string, result: unknown, extra = {}) => api(ntok.token!, `${root}/${request}/ack`,
+  { ...binding, status: "done", result, ...extra });
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register, addNetworkMember, createNetworkTokenForNode, createToken } = await import("./auth.js");
+  const stamp = Date.now();
+  admin = register(`sc_admin_${stamp}`, "SessionControl-Test-1!");
+  owner = register(`sc_owner_${stamp}`, "SessionControl-Test-2!");
+  member = register(`sc_member_${stamp}`, "SessionControl-Test-3!");
+  outsider = register(`sc_other_${stamp}`, "SessionControl-Test-4!");
+  expect(admin.ok && owner.ok && member.ok && outsider.ok).toBe(true);
+  net = admin.network_id!; otherNet = outsider.network_id!;
+  for (const u of [owner, member]) expect(addNetworkMember(net, u.user.user_id, "member", admin.user.user_id, { agentAccess: "all" }).ok).toBe(true);
+  // Real atok hashes via the legacy issuer; only fixture rows are converted
+  // to the historical global scope=user shape. No prefix-based authority.
+  const legacyUser = (u: any) => {
+    const t = createToken(u.user.user_id, "sc-legacy-user");
+    expect(t.ok).toBe(true);
+    expect(t.token).toMatch(/^atok_/);
+    db.run("UPDATE api_tokens SET scope='user' WHERE token_id=?1", t.token_id);
+    return t;
+  };
+  legacyOwner = legacyUser(owner); legacyAdmin = legacyUser(admin);
+  legacyMember = legacyUser(member); legacyOutsider = legacyUser(outsider);
+  legacyFull = createToken(owner.user.user_id, "sc-legacy-global-full");
+  legacyNetwork = createToken(owner.user.user_id, "sc-legacy-network", net);
+  expect(legacyFull.ok && legacyNetwork.ok).toBe(true);
+  ntok = createNetworkTokenForNode(owner.user.user_id, net, "sc-target", nodeId);
+  peer = createNetworkTokenForNode(owner.user.user_id, net, "sc-peer", peerId);
+  expect(ntok.ok && peer.ok).toBe(true);
+  db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status) VALUES (?1,?2,?3,?4,'idle')", ["r_sc_target", "sc-target", nodeId, net]);
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+beforeEach(async () => {
+  binding = { session_id: `session_${++serial}`, binding_id: `binding_${serial}` };
+  expect((await registerBridge()).status).toBe(200);
+});
+afterEach(() => setSystemTime());
+afterAll(() => { server?.stop(true); rmSync(dir, { recursive: true, force: true }); });
+
+describe("#2017 human-to-exact-Bridge HTTP relay", () => {
+  test("[2017 identity] missing or malformed expected is refused without fallback", async () => {
+    for (const expected of [undefined, {}, { node_id: nodeId }, { node_id: nodeId, network_id: net, token_id: ntok.token_id }]) {
+      const rejected = await api(ntok.token!, `${root}/bridge`, { ...binding, expected });
+      expect(rejected.status).toBe(400);
+      expect(rejected.body.error).toBe("session_control_request_invalid");
+    }
+    expect((await registerBridge()).status).toBe(200);
+  });
+  test("[2017 identity] A credential expected B cannot sweep, replace or retire the valid binding", async () => {
+    const made = await enqueue("state"), clock = Date.now();
+    const tokenBefore = db.get("SELECT token_id,bound_node_id,network_id FROM api_tokens WHERE token_id=?1", ntok.token_id);
+    const nodeBefore = db.get("SELECT node_id,network_id,owner_user_id FROM nodes WHERE node_id=?1", nodeId);
+    // Advancing beyond the request deadline exposes an accidental sweep before
+    // rejecting expected. Restore only the clock, never the authoritative queue.
+    setSystemTime(new Date(clock + 16_000));
+    for (const expected of [{ node_id: peerId, network_id: net }, { node_id: nodeId, network_id: otherNet }]) {
+      const rejected = await api(ntok.token!, `${root}/bridge`, {
+        session_id: "would_replace_session", binding_id: "would_retire_binding", expected,
+      });
+      expect(rejected.status).toBe(409);
+      expect(rejected.body.error).toBe("session_control_changed");
+    }
+    setSystemTime(new Date(clock));
+    expect((await read(made.body.request_id)).body.status).toBe("pending");
+    expect((await registerBridge()).status).toBe(200); // Original generation was not retired.
+    expect((await pull()).body.request).toMatchObject({ request_id: made.body.request_id, ...binding });
+    expect(db.get("SELECT token_id,bound_node_id,network_id FROM api_tokens WHERE token_id=?1", ntok.token_id)).toEqual(tokenBefore);
+    expect(db.get("SELECT node_id,network_id,owner_user_id FROM nodes WHERE node_id=?1", nodeId)).toEqual(nodeBefore);
+  });
+  test("[2017 identity] success carries the authenticated token row identity, never credential material", async () => {
+    const response = await registerBridge();
+    const row = db.get("SELECT token_id,bound_node_id,network_id FROM api_tokens WHERE token_id=?1", ntok.token_id);
+    expect(response.status).toBe(200);
+    expect(response.body.identity).toEqual({ node_id: row.bound_node_id, network_id: row.network_id, token_id: row.token_id });
+    expect(Object.keys(response.body).sort()).toEqual(["expires_at", "identity", "ok"]);
+    expect(JSON.stringify(response.body)).not.toContain(ntok.token);
+  });
+  test("normal state and background receipts are separate from actual tool completion", async () => {
+    const s = await enqueue("state");
+    expect(s.body).toMatchObject({ ok: true, status: "pending" });
+    expect(s.body.request_id).toMatch(/^sc_\d{13}_[A-Za-z0-9_-]{8,64}$/);
+    expect((await pull()).body.request).toMatchObject({ request_id: s.body.request_id, operation: "state", ...binding });
+    const observed = state();
+    expect((await ack(s.body.request_id, observed)).body.status).toBe("done");
+    expect((await read(s.body.request_id)).body.result).toEqual(observed);
+    const b = await enqueue();
+    expect(b.body.request_id).toMatch(/^bg_\d{13}_[A-Za-z0-9_-]{8,64}$/);
+    expect(b.body.expires_at).toBeGreaterThan(Date.now());
+    await pull();
+    const result = { outcome: "request_processed", state: state() };
+    expect((await ack(b.body.request_id, result)).body.status).toBe("done");
+    expect((await read(b.body.request_id)).body).toMatchObject({ ok: true, status: "done", result });
+  });
+  test("[2017 review] already_idle cannot confirm an active or background-capable state", async () => {
+    for (const flags of [
+      { active: true, can_request_background: true },
+      { active: true, can_request_background: false },
+      { active: false, can_request_background: true },
+    ]) {
+      const made = await enqueue(); await pull();
+      const reply = await ack(made.body.request_id, { outcome: "already_idle", state: { ...state(), ...flags } });
+      expect(reply.status).toBe(400);
+      expect(reply.body.error).toBe("session_control_invalid_response");
+      expect((await read(made.body.request_id)).body).toMatchObject({ status: "unknown", error: "session_control_invalid_response" });
+    }
+  });
+  test("[2017 review] legacy user atok owner/admin and global full can create and read control", async () => {
+    for (const t of [legacyOwner, legacyAdmin, legacyFull]) {
+      for (const operation of ["state", "background"]) {
+        const made = await api(t.token, root, { network_id: net, node_id: nodeId, operation, expected: binding });
+        expect(made.status).toBe(200);
+        expect((await read(made.body.request_id, t.token)).body.status).toBe("pending");
+        expect((await pull()).body.request.request_id).toBe(made.body.request_id);
+        const result = operation === "state" ? state() : { outcome: "request_processed", state: state() };
+        expect((await ack(made.body.request_id, result)).body.status).toBe("done");
+        expect((await read(made.body.request_id, t.token)).body.result).toEqual(result);
+      }
+    }
+  });
+  test("[2017 review] legacy atok still requires current target ownership and exact network", async () => {
+    for (const t of [legacyMember, legacyOutsider]) {
+      expect((await api(t.token, root, { network_id: net, node_id: nodeId, operation: "state" })).status).toBe(403);
+    }
+    expect((await api(legacyOwner.token, root, { network_id: otherNet, node_id: nodeId, operation: "state" })).status).toBe(403);
+    const made = await enqueue("state");
+    for (const t of [legacyMember, legacyOutsider]) expect((await read(made.body.request_id, t.token)).status).toBe(403);
+    expect((await read(made.body.request_id, legacyOwner.token, otherNet)).status).toBe(403);
+  });
+  test("[2017 review] legacy atok user and unbound network credentials cannot impersonate Bridge", async () => {
+    const made = await enqueue("state");
+    for (const t of [legacyOwner, legacyAdmin, legacyFull, legacyNetwork]) {
+      expect((await registerBridge(binding, t.token)).status).toBe(403);
+      expect((await pull(t.token)).status).toBe(403);
+      expect((await api(t.token, `${root}/${made.body.request_id}/ack`, { ...binding, status: "done", result: state() })).status).toBe(403);
+    }
+    expect((await read(made.body.request_id)).body.status).toBe("pending");
+    expect((await pull()).body.request.request_id).toBe(made.body.request_id);
+  });
+  test("[2017 review] unknown, revoked, expired or unsupported-scope credentials stay refused", async () => {
+    const request = () => api(legacyOwner.token, root, { network_id: net, node_id: nodeId, operation: "state" });
+    expect((await api("atok_00000000000000000000000000000000", root, {})).status).toBe(401);
+    for (const patch of ["revoked_at=datetime('now')", "expires_at=datetime('now','-1 day')", "scope='unsupported'"]) {
+      db.run(`UPDATE api_tokens SET ${patch} WHERE token_id=?1`, legacyOwner.token_id);
+      try { expect((await request()).status).toBeGreaterThanOrEqual(400); }
+      finally { db.run("UPDATE api_tokens SET revoked_at=NULL,expires_at=NULL,scope='user' WHERE token_id=?1", legacyOwner.token_id); }
+    }
+    expect((await request()).status).toBe(200);
+  });
+  test("SSE is a scoped doorbell only; the request lives in pull", async () => {
+    const abort = new AbortController();
+    const response = await fetch(`${base}/events/sc-target`, { headers: { authorization: `Bearer ${ntok.token}` }, signal: abort.signal });
+    expect(response.status).toBe(200);
+    const reader = response.body!.getReader();
+    try {
+      const made = await enqueue();
+      let data = "";
+      for (let i = 0; i < 4 && !data.includes('"type":"session_control"'); i++) {
+        const next = await reader.read(); data += new TextDecoder().decode(next.value);
+      }
+      const event = data.split("\n").filter(s => s.startsWith("data: ")).map(s => JSON.parse(s.slice(6))).find(s => s.type === "session_control");
+      expect(event).toEqual({ type: "session_control", request_id: made.body.request_id });
+      expect((await pull()).body.request.request_id).toBe(made.body.request_id);
+    } finally { abort.abort(); await reader.cancel().catch(() => {}); }
+  });
+  test("node, peer, anonymous, master and member cannot impersonate human owner/admin", async () => {
+    for (const token of [ntok.token, peer.token, "", "legacy-test-only", member.token, outsider.token]) {
+      expect((await api(token, root, { network_id: net, node_id: nodeId, operation: "state" })).status).toBeGreaterThanOrEqual(400);
+    }
+    const adminMade = await api(admin.token!, root, { network_id: net, node_id: nodeId, operation: "state" });
+    expect(adminMade.status).toBe(200);
+    expect((await read(adminMade.body.request_id, member.token!)).status).toBe(403);
+    expect((await read(adminMade.body.request_id, ntok.token!)).status).toBe(403);
+    expect((await read(adminMade.body.request_id, owner.token!, otherNet)).status).toBe(403);
+  });
+  test("cross-network, wrong expected, absent expected and command/path keys are refused", async () => {
+    expect((await enqueue("background", { network_id: otherNet })).status).toBe(403);
+    expect((await enqueue("background", { expected: { ...binding, session_id: "other_session" } })).body.error).toBe("session_control_changed");
+    expect((await api(owner.token!, root, { network_id: net, node_id: nodeId, operation: "background" })).status).toBe(400);
+    for (const key of ["url", "path", "keys", "shell"]) expect((await enqueue("state", { [key]: "unsafe" })).status).toBe(400);
+    expect((await registerBridge({ ...binding, node_id: peerId } as any)).status).toBe(400);
+  });
+  test("peer token and legacy unbound token never receive target requests", async () => {
+    const { createNetworkTokenForNode } = await import("./auth.js");
+    const legacy = createNetworkTokenForNode(owner.user.user_id, net, "sc-unbound");
+    expect(legacy.ok).toBe(true);
+    // Same-holder refreshes now bind existing rows. Construct an actual old
+    // unbound credential whose name only hints at this target instead.
+    db.run("UPDATE api_tokens SET name='node:sc-target' WHERE token_id=?1", legacy.token_id);
+    expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id=?1", legacy.token_id).bound_node_id).toBeNull();
+    expect((await registerBridge(binding, legacy.token!)).status).toBe(403);
+    expect((await registerBridge(binding, owner.token!)).status).toBe(403);
+    const made = await enqueue();
+    expect((await pull(peer.token!)).body.request).toBeUndefined();
+    expect((await pull()).body.request.request_id).toBe(made.body.request_id);
+    expect((await api(peer.token!, `${root}/${made.body.request_id}/ack`, { ...binding, status: "done", result: state() })).status).toBe(409);
+  });
+  test("concurrent claims yield exactly one delivery and do not replay", async () => {
+    const made = await enqueue();
+    expect((await enqueue()).status).toBe(429);
+    const claims = await Promise.all([pull(), pull(), pull()]);
+    expect(claims.filter(r => r.body.request?.request_id === made.body.request_id)).toHaveLength(1);
+    expect((await read(made.body.request_id)).body.status).toBe("in_progress");
+    expect((await pull()).body.request).toBeNull();
+  });
+  test("expired pending request is never delivered", async () => {
+    const made = await enqueue();
+    setSystemTime(new Date(Date.now() + 16_000));
+    expect((await pull()).body.request).toBeNull();
+    expect((await read(made.body.request_id)).body.status).toBe("expired");
+  });
+  test("lost ACK becomes unknown, never success; late ACK and repeated pull cannot replay", async () => {
+    const made = await enqueue(); await pull();
+    setSystemTime(new Date(Date.now() + 16_000));
+    expect((await read(made.body.request_id)).body).toMatchObject({ status: "unknown", error: "session_background_outcome_unknown" });
+    expect((await ack(made.body.request_id, { outcome: "request_processed", state: state() })).status).toBe(409);
+    expect((await pull()).body.request).toBeNull();
+  });
+  test("new generation invalidates pending and cannot be overwritten by delayed old Bridge", async () => {
+    const old = { ...binding }, made = await enqueue();
+    binding = { session_id: "new_session", binding_id: `new_binding_${serial}` };
+    expect((await registerBridge()).status).toBe(200);
+    expect((await registerBridge(old)).body.error).toBe("session_control_changed");
+    expect((await pull(ntok.token!, old)).body.error).toBe("session_control_changed");
+    expect((await read(made.body.request_id)).body).toMatchObject({ status: "failed", error: "session_control_changed" });
+    expect((await pull()).body.request).toBeNull();
+  });
+  test("handle change after claim is unknown and old-session ACK cannot complete", async () => {
+    const old = { ...binding }, made = await enqueue(); await pull();
+    binding = { ...binding, binding_id: `changed_${serial}` }; await registerBridge();
+    expect((await api(ntok.token!, `${root}/${made.body.request_id}/ack`, { ...old, status: "done", result: { outcome: "already_idle", state: { ...state(), ...old } } })).status).toBe(409);
+    expect((await read(made.body.request_id)).body.status).toBe("unknown");
+  });
+  test("requester revocation before pull prevents delivery and current read permission is rechecked", async () => {
+    const made = await enqueue();
+    db.run("UPDATE network_members SET role='member' WHERE network_id=?1 AND user_id=?2", [net, owner.user.user_id]);
+    db.run("UPDATE nodes SET owner_user_id=?1 WHERE node_id=?2", [member.user.user_id, nodeId]);
+    try {
+      expect((await pull()).body.request).toBeNull();
+      expect((await read(made.body.request_id)).status).toBe(403);
+      expect((await read(made.body.request_id, admin.token!)).body.status).toBe("failed");
+    } finally { db.run("UPDATE nodes SET owner_user_id=?1 WHERE node_id=?2", [owner.user.user_id, nodeId]); }
+  });
+  test("target token revocation is checked at pull, not only registration", async () => {
+    const made = await enqueue();
+    db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id=?1", ntok.token_id);
+    try {
+      expect((await pull()).status).toBeGreaterThanOrEqual(400);
+      expect((await read(made.body.request_id)).body.status).toBe("failed");
+    } finally { db.run("UPDATE api_tokens SET revoked_at=NULL WHERE token_id=?1", ntok.token_id); }
+  });
+  test("malformed runtime results and raw exception strings never become success or leak", async () => {
+    const made = await enqueue(); await pull();
+    const reply = await ack(made.body.request_id, { outcome: "request_processed", state: { ...state(), binding_id: "wrong" } });
+    expect(reply.status).toBe(400);
+    expect((await read(made.body.request_id)).body).toMatchObject({ status: "unknown", error: "session_control_invalid_response" });
+    const next = await enqueue(); await pull();
+    const secret = "http://secret-host/?token=ntok_secret";
+    expect((await api(ntok.token!, `${root}/${next.body.request_id}/ack`, { ...binding, status: "failed", error: secret })).body.error).toBe("session_control_invalid_response");
+    expect(JSON.stringify((await read(next.body.request_id)).body)).not.toContain(secret);
+  });
+  test("known runtime refusal is failed; already_idle receipt is accepted", async () => {
+    const made = await enqueue(); await pull();
+    expect((await api(ntok.token!, `${root}/${made.body.request_id}/ack`, { ...binding, status: "failed", error: "session_control_unsupported" })).body.status).toBe("failed");
+    const next = await enqueue(); await pull();
+    expect((await ack(next.body.request_id, { outcome: "already_idle", state: { ...state(), active: false, can_request_background: false } })).body.status).toBe("done");
+  });
+  test("lease expiry refuses new work and Hub restart loses IDs without replay", async () => {
+    const made = await enqueue();
+    setSystemTime(new Date(Date.now() + 76_000));
+    expect((await enqueue()).body.error).toBe("session_control_unavailable");
+    setSystemTime();
+    server.stop(true);
+    const { bootServer } = await import("./server.js");
+    server = bootServer({ port: 0, hostname: "127.0.0.1" }); base = `http://127.0.0.1:${server.port}`;
+    expect((await read(made.body.request_id)).status).toBe(404);
+    expect((await pull()).body.error).toBe("session_control_changed");
+  });
+});