@sleep2agi/commhub-server 0.9.0-preview.148 → 0.9.0-preview.149

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.148",
+  "version": "0.9.0-preview.149",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/env-transport-gate-http.test.ts

@@ -19,6 +19,11 @@ let server: ReturnType<typeof Bun.serve>;
 let base = "";
 const PLAIN = "n_gate_plain";
 const TLS = "n_gate_tls";
+// #1510 acceptance names three transports: loopback passes, https passes, plain
+// public is refused. log/enforce only ever *special-case* `plain`, so loopback
+// could rot without anyone noticing it is still accepted — seed it as its own
+// node rather than folding it in with TLS, so a regression reads by name.
+const LOOPBACK = "n_gate_loopback";
 
 const post = async (path: string, token: string, body: unknown) => {
   const r = await fetch(`${base}${path}`, {
@@ -50,6 +55,7 @@ beforeAll(async () => {
   );
   seed(PLAIN, "plain");
   seed(TLS, "https");
+  seed(LOOPBACK, "loopback");
   // The transport is reported on the session row (that is where report_status
   // writes it).
   const session = (nodeId: string, transport: string) => db.run(
@@ -59,6 +65,7 @@ beforeAll(async () => {
   );
   session(PLAIN, "plain");
   session(TLS, "https");
+  session(LOOPBACK, "loopback");
 
   const mod = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
@@ -74,7 +81,7 @@ beforeEach(async () => {
   // The lane allows one pending request per node; drain whatever the previous
   // case left so the next one starts clean.
   const { pullNodeSecrets, ackNodeSecrets } = await import("./scoped-secrets.js");
-  for (const nodeId of [PLAIN, TLS]) {
+  for (const nodeId of [PLAIN, TLS, LOOPBACK]) {
     const daemon = { ok: true as const, networkId: net, daemonNodeId: nodeId, daemonAlias: nodeId };
     const pulled = pullNodeSecrets(daemon) as any;
     for (const r of (pulled?.requests ?? [])) ackNodeSecrets(daemon, r.request_id, null, true);
@@ -102,6 +109,19 @@ describe("log mode (default)", () => {
     expect(after).toBe(before);
   });
 
+  // #1510 acceptance leg 1: loopback is an allowed transport, so it must neither
+  // be refused nor pollute the would-refuse log (the log is the decision input
+  // for turning enforce on — a loopback hit in it would read as "something to
+  // block" when nothing is).
+  test("a put to a loopback node succeeds AND leaves no hit", async () => {
+    const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    const r = await post(`/api/nodes/${LOOPBACK}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "LB_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+    const after = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    expect(after).toBe(before);
+  });
+
   test("list is not observed (it carries no secret)", async () => {
     const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
     await post(`/api/nodes/${PLAIN}/secrets?network_id=${net}`, ownerToken, { action: "list" });
@@ -123,6 +143,17 @@ describe("enforce mode", () => {
     const r = await post(`/api/nodes/${TLS}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "D_KEY", value: "v", revision: 1 });
     expect(r.status).toBe(200);
   });
+
+  // #1510 acceptance: "loopback 通过 / https 通过 / 明文公网被拒". enforce is
+  // defined as *refuse plain* — loopback is a local link and must keep working
+  // under enforce, otherwise turning the gate on would break the one transport
+  // it exists to protect.
+  test("a loopback node passes enforce too", async () => {
+    process.env.ANET_SECRET_TRANSPORT_GATE = "enforce";
+    const r = await post(`/api/nodes/${LOOPBACK}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "LB2_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+  });
 });
 
 describe("off mode", () => {

package/src/node-session-control-http.test.ts

@@ -297,7 +297,9 @@ describe("#2017 human-to-exact-Bridge HTTP relay", () => {
   test("lease expiry refuses new work and Hub restart loses IDs without replay", async () => {
     const made = await enqueue();
     setSystemTime(new Date(Date.now() + 76_000));
-    expect((await enqueue()).body.error).toBe("session_control_unavailable");
+    // #2014: no live bridge is its own code, so a client can tell "this node has no
+    // bridge (upgrade / start it)" from a permission refusal.
+    expect((await enqueue()).body.error).toBe("session_control_bridge_missing");
     setSystemTime();
     server.stop(true);
     const { bootServer } = await import("./server.js");

package/src/node-session-control.ts

@@ -198,7 +198,11 @@ export function createNodeSessionControlRelay() {
         const n = node(v.node_id);
         if (!n || n.network_id !== v.network_id || !human(tokenId, n)) return fail("session_control_unavailable", 403);
         const b = bridges.get(key(n));
-        if (!b || b.expires <= now || !bound(b.tokenId, n)) return fail("session_control_unavailable");
+        // A distinct code for "this node has no live bridge" (never registered, or
+        // its 75 s lease expired). #2014 needs it: the client can then say "upgrade
+        // the node / start it" instead of the generic "refresh later" it shows for
+        // `session_control_unavailable` (which also covers permission refusals).
+        if (!b || b.expires <= now || !bound(b.tokenId, n)) return fail("session_control_bridge_missing");
         if (v.expected && !same(v.expected as Identity, b)) return fail("session_control_changed");
         if (entries.size >= CAP || [...entries.values()].some(e => e.nodeId === n.node_id
           && e.networkId === n.network_id && (e.status === "pending" || e.status === "in_progress"))) {