@sleep2agi/commhub-server 0.9.0-preview.148 → 0.9.0-preview.150

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.148",
+  "version": "0.9.0-preview.150",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/env-transport-gate-http.test.ts

@@ -19,6 +19,11 @@ let server: ReturnType<typeof Bun.serve>;
 let base = "";
 const PLAIN = "n_gate_plain";
 const TLS = "n_gate_tls";
+// #1510 acceptance names three transports: loopback passes, https passes, plain
+// public is refused. log/enforce only ever *special-case* `plain`, so loopback
+// could rot without anyone noticing it is still accepted — seed it as its own
+// node rather than folding it in with TLS, so a regression reads by name.
+const LOOPBACK = "n_gate_loopback";
 
 const post = async (path: string, token: string, body: unknown) => {
   const r = await fetch(`${base}${path}`, {
@@ -50,6 +55,7 @@ beforeAll(async () => {
   );
   seed(PLAIN, "plain");
   seed(TLS, "https");
+  seed(LOOPBACK, "loopback");
   // The transport is reported on the session row (that is where report_status
   // writes it).
   const session = (nodeId: string, transport: string) => db.run(
@@ -59,6 +65,7 @@ beforeAll(async () => {
   );
   session(PLAIN, "plain");
   session(TLS, "https");
+  session(LOOPBACK, "loopback");
 
   const mod = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
@@ -74,7 +81,7 @@ beforeEach(async () => {
   // The lane allows one pending request per node; drain whatever the previous
   // case left so the next one starts clean.
   const { pullNodeSecrets, ackNodeSecrets } = await import("./scoped-secrets.js");
-  for (const nodeId of [PLAIN, TLS]) {
+  for (const nodeId of [PLAIN, TLS, LOOPBACK]) {
     const daemon = { ok: true as const, networkId: net, daemonNodeId: nodeId, daemonAlias: nodeId };
     const pulled = pullNodeSecrets(daemon) as any;
     for (const r of (pulled?.requests ?? [])) ackNodeSecrets(daemon, r.request_id, null, true);
@@ -102,6 +109,19 @@ describe("log mode (default)", () => {
     expect(after).toBe(before);
   });
 
+  // #1510 acceptance leg 1: loopback is an allowed transport, so it must neither
+  // be refused nor pollute the would-refuse log (the log is the decision input
+  // for turning enforce on — a loopback hit in it would read as "something to
+  // block" when nothing is).
+  test("a put to a loopback node succeeds AND leaves no hit", async () => {
+    const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    const r = await post(`/api/nodes/${LOOPBACK}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "LB_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+    const after = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
+    expect(after).toBe(before);
+  });
+
   test("list is not observed (it carries no secret)", async () => {
     const before = (await get(`/api/networks/${net}/env-transport-log`, ownerToken)).body.total;
     await post(`/api/nodes/${PLAIN}/secrets?network_id=${net}`, ownerToken, { action: "list" });
@@ -123,6 +143,17 @@ describe("enforce mode", () => {
     const r = await post(`/api/nodes/${TLS}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "D_KEY", value: "v", revision: 1 });
     expect(r.status).toBe(200);
   });
+
+  // #1510 acceptance: "loopback 通过 / https 通过 / 明文公网被拒". enforce is
+  // defined as *refuse plain* — loopback is a local link and must keep working
+  // under enforce, otherwise turning the gate on would break the one transport
+  // it exists to protect.
+  test("a loopback node passes enforce too", async () => {
+    process.env.ANET_SECRET_TRANSPORT_GATE = "enforce";
+    const r = await post(`/api/nodes/${LOOPBACK}/secrets?network_id=${net}`, ownerToken, { action: "put", key: "LB2_KEY", value: "v", revision: 1 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+  });
 });
 
 describe("off mode", () => {

package/src/host-supervisors-daemon-version.test.ts

@@ -0,0 +1,137 @@
+// #973 — /api/host-supervisors surfaces the daemon's self-reported runtime
+// version (`agent_node_version`).
+//
+// Why it needs a session join: nodes already send `version` in report_status
+// (agent-node/src/cli.ts writes AGENT_NODE_VERSION) and the Hub stores it on the
+// session row, which is why /api/status can show it. `nodes` has no version
+// column, so the daemon list reads the newest session row for the same
+// (network_id, node_id).
+//
+// 🔴 Absent stays absent: a daemon that never reported a version must NOT get a
+// default, an empty string or the Hub's own version — "unknown" and "old" are
+// different facts, and inventing one would make the client show a stale daemon
+// as up to date.
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { register, login } from "./auth.js";
+import { db } from "./db.js";
+
+let BASE = "";
+let server: any = null;
+let userToken = "";
+let userNetworkId = "";
+let userId = "";
+
+beforeAll(async () => {
+  process.env.HOST = "127.0.0.1";
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const password = "DaemonVersionPw123Aa!";
+  const seed = register(`dver_seed_${suffix}`, password, undefined, "seed");
+  if (!seed.ok) throw new Error("seed failed");
+  db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`dver_seed_${suffix}`]);
+  const u = register(`dver_u_${suffix}`, password, undefined, "seed");
+  if (!u.ok || !u.token) throw new Error("user register failed");
+  userToken = u.token;
+  userNetworkId = u.network_id ?? "";
+  userId = login(`dver_u_${suffix}`, password).user!.user_id;
+
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+  await new Promise((r) => setTimeout(r, 100));
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+});
+
+function seedDaemon(alias: string): void {
+  db.run(
+    `INSERT OR REPLACE INTO nodes (
+       node_id, node_name, alias, runtime, model, config_path,
+       channels, server, hostname, network_id,
+       config_revision, config_snapshot
+     ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
+    [`dver_n_${alias}`, alias, alias, "claude-agent-sdk", "claude-sonnet-4-5",
+     "/tmp/cfg.json", "[]", "test-host", "test-host", userNetworkId,
+     0, JSON.stringify({ role: "host_supervisor" })],
+  );
+  db.run(
+    `INSERT OR REPLACE INTO api_tokens (
+       token_id, token_hash, user_id, network_id, name, scope
+     ) VALUES (?1, ?2, ?3, ?4, ?5, ?6)`,
+    [`dver_t_${alias}`, `hash_${alias}`, userId, userNetworkId, `node:${alias}`, "network"],
+  );
+}
+
+function seedSession(alias: string, version: string | null): void {
+  const now = new Date().toISOString();
+  db.run(
+    `INSERT OR REPLACE INTO sessions (
+       node_id, alias, network_id, registered_at, updated_at,
+       peer_reply_inbox_capable, rules_file_capable, skills_capable,
+       files_capable, logs_capable, version
+     ) VALUES (?1, ?2, ?3, ?4, ?4, 1, 1, 1, 1, 1, ?5)`,
+    [`dver_n_${alias}`, alias, userNetworkId, now, version],
+  );
+}
+
+function clearAll(): void {
+  db.run("DELETE FROM sessions WHERE network_id = ?1", [userNetworkId]);
+  db.run("DELETE FROM nodes WHERE network_id = ?1", [userNetworkId]);
+  db.run("DELETE FROM api_tokens WHERE network_id = ?1 AND name LIKE 'node:%'", [userNetworkId]);
+}
+
+async function listDaemons(): Promise<any[]> {
+  const res = await fetch(`${BASE}/api/host-supervisors`, {
+    headers: { "Authorization": `Bearer ${userToken}` },
+  });
+  const body = await res.json();
+  if (!body.ok) throw new Error("list failed: " + JSON.stringify(body));
+  return body.daemons;
+}
+
+const find = (rows: any[], alias: string) => rows.find((r) => r.alias === alias)!;
+
+describe("#973 — daemon list carries the self-reported runtime version", () => {
+  test("a daemon whose newest session reported a version exposes agent_node_version", async () => {
+    clearAll();
+    seedDaemon("versioned-a");
+    seedSession("versioned-a", "2.5.0-preview.155");
+    const d = find(await listDaemons(), "versioned-a");
+    expect(d.agent_node_version).toBe("2.5.0-preview.155");
+  });
+
+  test("🔴 no session / no version → the field is ABSENT (never a default)", async () => {
+    clearAll();
+    seedDaemon("silent-a");
+    const d = find(await listDaemons(), "silent-a");
+    expect("agent_node_version" in d).toBe(false);
+  });
+
+  test("an older session's version does not win over the newest one", async () => {
+    clearAll();
+    seedDaemon("newest-a");
+    const old = new Date(Date.now() - 60_000).toISOString();
+    const now = new Date().toISOString();
+    // Same (network_id, node_id) with two rows: the newest updated_at must win.
+    db.run(
+      `INSERT OR REPLACE INTO sessions (
+         node_id, alias, network_id, registered_at, updated_at,
+         peer_reply_inbox_capable, rules_file_capable, skills_capable,
+         files_capable, logs_capable, version
+       ) VALUES (?1, ?2, ?3, ?4, ?5, 1, 1, 1, 1, 1, ?6)`,
+      ["dver_n_newest-a", "newest-a", userNetworkId, old, old, "2.5.0-preview.146"],
+    );
+    db.run(
+      `INSERT OR REPLACE INTO sessions (
+         node_id, alias, network_id, registered_at, updated_at,
+         peer_reply_inbox_capable, rules_file_capable, skills_capable,
+         files_capable, logs_capable, version
+       ) VALUES (?1, ?2, ?3, ?4, ?5, 1, 1, 1, 1, 1, ?6)`,
+      ["dver_n_newest-a", "newest-a", userNetworkId, now, now, "2.5.0-preview.155"],
+    );
+    const d = find(await listDaemons(), "newest-a");
+    expect(d.agent_node_version).toBe("2.5.0-preview.155");
+  });
+});

package/src/node-session-control-http.test.ts

@@ -297,7 +297,9 @@ describe("#2017 human-to-exact-Bridge HTTP relay", () => {
   test("lease expiry refuses new work and Hub restart loses IDs without replay", async () => {
     const made = await enqueue();
     setSystemTime(new Date(Date.now() + 76_000));
-    expect((await enqueue()).body.error).toBe("session_control_unavailable");
+    // #2014: no live bridge is its own code, so a client can tell "this node has no
+    // bridge (upgrade / start it)" from a permission refusal.
+    expect((await enqueue()).body.error).toBe("session_control_bridge_missing");
     setSystemTime();
     server.stop(true);
     const { bootServer } = await import("./server.js");

package/src/node-session-control.ts

@@ -198,7 +198,11 @@ export function createNodeSessionControlRelay() {
         const n = node(v.node_id);
         if (!n || n.network_id !== v.network_id || !human(tokenId, n)) return fail("session_control_unavailable", 403);
         const b = bridges.get(key(n));
-        if (!b || b.expires <= now || !bound(b.tokenId, n)) return fail("session_control_unavailable");
+        // A distinct code for "this node has no live bridge" (never registered, or
+        // its 75 s lease expired). #2014 needs it: the client can then say "upgrade
+        // the node / start it" instead of the generic "refresh later" it shows for
+        // `session_control_unavailable` (which also covers permission refusals).
+        if (!b || b.expires <= now || !bound(b.tokenId, n)) return fail("session_control_bridge_missing");
         if (v.expected && !same(v.expected as Identity, b)) return fail("session_control_changed");
         if (entries.size >= CAP || [...entries.values()].some(e => e.nodeId === n.node_id
           && e.networkId === n.network_id && (e.status === "pending" || e.status === "in_progress"))) {

package/src/server.ts

@@ -4918,9 +4918,18 @@ return Bun.serve({
         isPrivileged = true;
       }
 
+      // #973 — the daemon's self-reported runtime version. Nodes already send
+      // `version` in report_status (agent-node/src/cli.ts writes AGENT_NODE_VERSION)
+      // and the Hub stores it on the session row — that is why /api/status shows it.
+      // `nodes` has no version column, so read the daemon's newest session row.
+      // Absent stays absent: a daemon that never reported must read as "unknown",
+      // never as a made-up version.
       const sqlRows = hostSupervisorIdentityRows(`SELECT n.node_id, n.alias, n.hostname, n.network_id, n.owner_user_id,
           n.runtimes_supported, n.allowed_secret_keys,
-          n.created_at, n.updated_at, n.config_snapshot
+          n.created_at, n.updated_at, n.config_snapshot,
+          (SELECT s.version FROM sessions s
+             WHERE s.network_id = n.network_id AND s.node_id = n.node_id
+             ORDER BY s.updated_at DESC LIMIT 1) AS reported_version
         FROM nodes n WHERE n.network_id = ?1 ORDER BY n.updated_at DESC`, [effectiveNetId]);
 
       const nowMs = Date.now();
@@ -5025,6 +5034,9 @@ return Bun.serve({
             allowed_secret_keys: secrets,
             host_telemetry: telemetry,
           };
+          // #973 — only when the daemon actually reported one (see the SQL comment).
+          const reportedVersion = (r as unknown as { reported_version?: string | null }).reported_version;
+          if (typeof reportedVersion === "string" && reportedVersion) out.agent_node_version = reportedVersion;
           if (lifecycleUser && typeof adoptCapable === "boolean") {
             // Do not reveal even the new capability for a node the user cannot read.
             const visibleParams: any[] = [r.node_id];