@sleep2agi/commhub-server 0.9.0-preview.151 → 0.9.0-preview.153

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.151",
+  "version": "0.9.0-preview.153",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.ts

@@ -516,6 +516,9 @@ export function deleteNetwork(userId: string, networkId: string): { ok: boolean;
     // deleted network. Remove memberships with the network.
     db.run("DELETE FROM network_members WHERE network_id = ?1", [networkId]);
     deleteNetworkAgentGroups(networkId); deleteDepartmentsForNetwork(networkId); for (const t of AGENT_TEAM_TABLES) if (tableExists(t)) db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [networkId]); // #2144, #419, #764 (one line: docs pin auth.ts line numbers)
+    // #993: the rules text belongs to the network; leaving it behind would make a
+    // later network that reuses the id inherit somebody else's rules.
+    if (tableExists("network_rules")) db.run("DELETE FROM network_rules WHERE network_id = ?1", [networkId]);
   });
   return { ok: true };
 }
@@ -966,6 +969,8 @@ const NETWORK_CLEANUP_TABLES = [
   "task_events", "task_terminal_events", "task_late_replies", "scheduled_task_runs", "external_schedule_edits",
   // 标签颜色:网络本身的元数据(标签本体在 requirements 行里,那张表是阻断项)。
   "network_tags",
+  // #993/#1542 全团队规则:规则文本是网络元数据,网络删了它不该留成孤儿行。
+  "network_rules",
   // 组织架构(board #419):部门是网络本身的元数据。
   "network_departments",
   // Agent 团队(#764):Agent 自己的组织树,同样是网络元数据。

package/src/network-rules-http.test.ts

@@ -102,11 +102,63 @@ describe("#993 — network rules storage + CAS write", () => {
   });
 
   test("oversized content is refused (bytes, not UTF-16 units)", async () => {
-    const r = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: "a".repeat(200 * 1024 + 1), expected_revision: 1 });
+    const r = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: "a".repeat(256 * 1024 + 1), expected_revision: 1 });
     expect(r.status).toBe(413);
     expect(r.body.error).toBe("rules_too_large");
   });
 
+  test("re-writing identical bytes is idempotent (revision does not move, changed=false)", async () => {
+    // The next slice injects a managed block keyed by revision; a no-op save that
+    // bumped the number would make every node rewrite its file for nothing.
+    const before = (await send(adminToken, "GET", `/api/networks/${netId}/rules`)).body.rules;
+    const w = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, {
+      content: before.content, expected_revision: before.revision,
+    });
+    expect(w.status).toBe(200);
+    expect(w.body.changed).toBe(false);
+    expect(w.body.rules.revision).toBe(before.revision);
+    // …and a real edit still moves it.
+    const w2 = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, {
+      content: before.content + "\n- one more line\n", expected_revision: before.revision,
+    });
+    expect(w2.status).toBe(200);
+    expect(w2.body.changed).toBe(true);
+    expect(w2.body.rules.revision).toBe(before.revision + 1);
+  });
+
+  test("the 256 KiB cap is the same ruler as write_node_rules_file", async () => {
+    // 200 KiB used to be the cap here while node rules allowed 256 KiB — the same text
+    // could fit in the Hub and then be refused at the node.
+    const atCap = "a".repeat(256 * 1024);
+    const rev = (await send(adminToken, "GET", `/api/networks/${netId}/rules`)).body.rules.revision;
+    const ok = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: atCap, expected_revision: rev });
+    expect(ok.status).toBe(200);
+    const rev2 = ok.body.rules.revision;
+    const over = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: atCap + "a", expected_revision: rev2 });
+    expect(over.status).toBe(413);
+  });
+
+  test("deleting the network deletes its rules row (no orphans)", async () => {
+    const own = register(`nr_del_${Date.now()}`, "DelPw123Aa!", undefined, "del");
+    expect(own.ok).toBe(true);
+    const put = await send(own.token!, "PUT", `/api/networks/${own.network_id}/rules`, { content: "team rules", expected_revision: 0 });
+    expect(put.status).toBe(200);
+    const del = await send(own.token!, "DELETE", `/api/networks/${own.network_id}`);
+    expect(del.status).toBe(200);
+    const left = db.get<{ cnt: number }>("SELECT COUNT(*) as cnt FROM network_rules WHERE network_id = ?1", own.network_id!);
+    expect(left!.cnt).toBe(0);
+  });
+
+  test("a node token cannot read another network's rules", async () => {
+    // The node token belongs to a hub admin (that is how it was minted), so the
+    // hubAdmin branch alone would have allowed it. A node stays inside its network.
+    const other = register(`nr_net2_${Date.now()}`, "OtherPw123Aa!", undefined, "net2");
+    expect(other.ok).toBe(true);
+    const r = await send(nodeToken, "GET", `/api/networks/${other.network_id}/rules`);
+    expect(r.status).toBe(403);
+    expect(r.body.error).toBe("not_a_member");
+  });
+
   test("a non-member cannot read", async () => {
     const other = register(`nr_other_${Date.now()}`, "OtherPw123Aa!", undefined, "other");
     expect(other.ok).toBe(true);

package/src/network-rules.ts

@@ -16,8 +16,12 @@
 //     content is a file the node will write to disk.
 import type { DbAdapter } from "./db-adapter.js";
 
-/** 200 KiB. A team rule file is small; anything near this is a mistake. */
-export const NETWORK_RULES_MAX_BYTES = 200 * 1024;
+/**
+ * 256 KiB — deliberately the same ruler as `write_node_rules_file` (tools.ts), because
+ * these two texts are meant to end up next to each other on a node. Two different caps
+ * for the same kind of document is how "it fit in the Hub but not on the node" happens.
+ */
+export const NETWORK_RULES_MAX_BYTES = 256 * 1024;
 
 export type NetworkRules = {
   network_id: string;
@@ -76,7 +80,7 @@ export function readNetworkRules(database: DbAdapter, networkId: string): Networ
 }
 
 export type WriteResult =
-  | { ok: true; rules: NetworkRules }
+  | { ok: true; rules: NetworkRules; changed: boolean }
   | { ok: false; status: number; error: "invalid_rules_content" | "rules_too_large" | "rules_revision_conflict" };
 
 /**
@@ -102,6 +106,12 @@ export function writeNetworkRules(
   const row = current(database, networkId);
   const revision = row ? Number(row.revision) || 0 : 0;
   if (revision !== expectedRevision) return { ok: false, status: 409, error: "rules_revision_conflict" };
+  // Idempotent revision: writing the same bytes must not mint a new revision.
+  // The next slice injects a managed block keyed by revision, so a no-op save that
+  // bumped the number would make every node rewrite its file for nothing.
+  if (row && row.content === content) {
+    return { ok: true, rules: readNetworkRules(database, networkId), changed: false };
+  }
   const next = revision + 1;
   const actorJson = JSON.stringify({ user_id: actor.user_id, username: actor.username });
   if (row) {
@@ -115,5 +125,5 @@ export function writeNetworkRules(
       [networkId, content, next, now, actorJson],
     );
   }
-  return { ok: true, rules: readNetworkRules(database, networkId) };
+  return { ok: true, rules: readNetworkRules(database, networkId), changed: true };
 }

package/src/server.ts

@@ -1903,6 +1903,12 @@ return Bun.serve({
       const role = getUserNetworkRole(resolved.user.user_id, netId);
       ensureNetworkRulesOnce(db);
       if (req.method === "GET") {
+        // A node token resolves to the human who created it, which may be a hub
+        // admin — that must not turn a node into a reader of *every* network's
+        // rules. A node token is confined to its own network.
+        if (resolved.networkId && resolved.networkId !== netId) {
+          return withCors(req, Response.json({ ok: false, error: "not_a_member" }, { status: 403 }));
+        }
         // Reading is for anyone in the network: the rules are what the nodes obey.
         if (!hubAdmin && !role) return withCors(req, Response.json({ ok: false, error: "not_a_member" }, { status: 403 }));
         return withCors(req, Response.json({ ok: true, rules: readNetworkRules(db, netId) }));
@@ -1923,9 +1929,13 @@ return Bun.serve({
           username: resolved.user.username ?? null,
         });
         if (!result.ok) return withCors(req, Response.json({ ok: false, error: result.error }, { status: result.status }));
-        logAudit(resolved.user.user_id, resolved.user.username ?? null, "network_rules_updated", "network_rules", netId,
-          JSON.stringify({ revision: result.rules.revision, bytes: Buffer.byteLength(result.rules.content, "utf8") }), undefined, netId);
-        return withCors(req, Response.json({ ok: true, rules: result.rules }));
+        // An idempotent save (same bytes) changes nothing, so it must not invent an
+        // audit entry that says the rules were updated.
+        if (result.changed) {
+          logAudit(resolved.user.user_id, resolved.user.username ?? null, "network_rules_updated", "network_rules", netId,
+            JSON.stringify({ revision: result.rules.revision, bytes: Buffer.byteLength(result.rules.content, "utf8") }), undefined, netId);
+        }
+        return withCors(req, Response.json({ ok: true, changed: result.changed, rules: result.rules }));
       }
       return withCors(req, Response.json({ ok: false, error: "method_not_allowed" }, { status: 405 }));
     }