@sleep2agi/commhub-server 0.9.0-preview.152 → 0.9.0-preview.154

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.152",
+  "version": "0.9.0-preview.154",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.ts

@@ -516,6 +516,9 @@ export function deleteNetwork(userId: string, networkId: string): { ok: boolean;
     // deleted network. Remove memberships with the network.
     db.run("DELETE FROM network_members WHERE network_id = ?1", [networkId]);
     deleteNetworkAgentGroups(networkId); deleteDepartmentsForNetwork(networkId); for (const t of AGENT_TEAM_TABLES) if (tableExists(t)) db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [networkId]); // #2144, #419, #764 (one line: docs pin auth.ts line numbers)
+    // #993: the rules text belongs to the network; leaving it behind would make a
+    // later network that reuses the id inherit somebody else's rules.
+    if (tableExists("network_rules")) db.run("DELETE FROM network_rules WHERE network_id = ?1", [networkId]);
   });
   return { ok: true };
 }
@@ -966,6 +969,8 @@ const NETWORK_CLEANUP_TABLES = [
   "task_events", "task_terminal_events", "task_late_replies", "scheduled_task_runs", "external_schedule_edits",
   // 标签颜色:网络本身的元数据(标签本体在 requirements 行里,那张表是阻断项)。
   "network_tags",
+  // #993/#1542 全团队规则:规则文本是网络元数据,网络删了它不该留成孤儿行。
+  "network_rules",
   // 组织架构(board #419):部门是网络本身的元数据。
   "network_departments",
   // Agent 团队(#764):Agent 自己的组织树,同样是网络元数据。

package/src/db.ts

@@ -137,6 +137,13 @@ for (const col of [
   // Node run-log view — the same session answers logs_tail on the rules-file
   // doorbell (node-logs.ts). Sticky, bound-token only, like above.
   { name: "logs_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // #2211 — what the node last did with the network's team rules (agent-node .156+
+  // reports it on every status). Not sticky: the newest report wins, and a node that
+  // later starts reporting `skipped` must be able to clear an older revision.
+  { name: "team_rules_revision", def: "INTEGER" },
+  { name: "team_rules_status", def: "TEXT" },
+  { name: "team_rules_at", def: "TEXT" },
+  { name: "team_rules_reason", def: "TEXT" },
 ]) {
   try { db.exec(`ALTER TABLE sessions ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }

package/src/network-rules-http.test.ts

@@ -102,11 +102,53 @@ describe("#993 — network rules storage + CAS write", () => {
   });
 
   test("oversized content is refused (bytes, not UTF-16 units)", async () => {
-    const r = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: "a".repeat(200 * 1024 + 1), expected_revision: 1 });
+    const r = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: "a".repeat(256 * 1024 + 1), expected_revision: 1 });
     expect(r.status).toBe(413);
     expect(r.body.error).toBe("rules_too_large");
   });
 
+  test("re-writing identical bytes is idempotent (revision does not move, changed=false)", async () => {
+    // The next slice injects a managed block keyed by revision; a no-op save that
+    // bumped the number would make every node rewrite its file for nothing.
+    const before = (await send(adminToken, "GET", `/api/networks/${netId}/rules`)).body.rules;
+    const w = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, {
+      content: before.content, expected_revision: before.revision,
+    });
+    expect(w.status).toBe(200);
+    expect(w.body.changed).toBe(false);
+    expect(w.body.rules.revision).toBe(before.revision);
+    // …and a real edit still moves it.
+    const w2 = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, {
+      content: before.content + "\n- one more line\n", expected_revision: before.revision,
+    });
+    expect(w2.status).toBe(200);
+    expect(w2.body.changed).toBe(true);
+    expect(w2.body.rules.revision).toBe(before.revision + 1);
+  });
+
+  test("the 256 KiB cap is the same ruler as write_node_rules_file", async () => {
+    // 200 KiB used to be the cap here while node rules allowed 256 KiB — the same text
+    // could fit in the Hub and then be refused at the node.
+    const atCap = "a".repeat(256 * 1024);
+    const rev = (await send(adminToken, "GET", `/api/networks/${netId}/rules`)).body.rules.revision;
+    const ok = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: atCap, expected_revision: rev });
+    expect(ok.status).toBe(200);
+    const rev2 = ok.body.rules.revision;
+    const over = await send(adminToken, "PUT", `/api/networks/${netId}/rules`, { content: atCap + "a", expected_revision: rev2 });
+    expect(over.status).toBe(413);
+  });
+
+  test("deleting the network deletes its rules row (no orphans)", async () => {
+    const own = register(`nr_del_${Date.now()}`, "DelPw123Aa!", undefined, "del");
+    expect(own.ok).toBe(true);
+    const put = await send(own.token!, "PUT", `/api/networks/${own.network_id}/rules`, { content: "team rules", expected_revision: 0 });
+    expect(put.status).toBe(200);
+    const del = await send(own.token!, "DELETE", `/api/networks/${own.network_id}`);
+    expect(del.status).toBe(200);
+    const left = db.get<{ cnt: number }>("SELECT COUNT(*) as cnt FROM network_rules WHERE network_id = ?1", own.network_id!);
+    expect(left!.cnt).toBe(0);
+  });
+
   test("a node token cannot read another network's rules", async () => {
     // The node token belongs to a hub admin (that is how it was minted), so the
     // hubAdmin branch alone would have allowed it. A node stays inside its network.

package/src/network-rules.ts

@@ -16,8 +16,12 @@
 //     content is a file the node will write to disk.
 import type { DbAdapter } from "./db-adapter.js";
 
-/** 200 KiB. A team rule file is small; anything near this is a mistake. */
-export const NETWORK_RULES_MAX_BYTES = 200 * 1024;
+/**
+ * 256 KiB — deliberately the same ruler as `write_node_rules_file` (tools.ts), because
+ * these two texts are meant to end up next to each other on a node. Two different caps
+ * for the same kind of document is how "it fit in the Hub but not on the node" happens.
+ */
+export const NETWORK_RULES_MAX_BYTES = 256 * 1024;
 
 export type NetworkRules = {
   network_id: string;
@@ -76,7 +80,7 @@ export function readNetworkRules(database: DbAdapter, networkId: string): Networ
 }
 
 export type WriteResult =
-  | { ok: true; rules: NetworkRules }
+  | { ok: true; rules: NetworkRules; changed: boolean }
   | { ok: false; status: number; error: "invalid_rules_content" | "rules_too_large" | "rules_revision_conflict" };
 
 /**
@@ -102,6 +106,12 @@ export function writeNetworkRules(
   const row = current(database, networkId);
   const revision = row ? Number(row.revision) || 0 : 0;
   if (revision !== expectedRevision) return { ok: false, status: 409, error: "rules_revision_conflict" };
+  // Idempotent revision: writing the same bytes must not mint a new revision.
+  // The next slice injects a managed block keyed by revision, so a no-op save that
+  // bumped the number would make every node rewrite its file for nothing.
+  if (row && row.content === content) {
+    return { ok: true, rules: readNetworkRules(database, networkId), changed: false };
+  }
   const next = revision + 1;
   const actorJson = JSON.stringify({ user_id: actor.user_id, username: actor.username });
   if (row) {
@@ -115,5 +125,5 @@ export function writeNetworkRules(
       [networkId, content, next, now, actorJson],
     );
   }
-  return { ok: true, rules: readNetworkRules(database, networkId) };
+  return { ok: true, rules: readNetworkRules(database, networkId), changed: true };
 }

package/src/rest-projections.ts

@@ -21,6 +21,8 @@ export const SESSION_REST_COLUMNS = [
   "node_id", "session_id", "config_path", "channels", "last_seen_at", "model",
   "external_schedules", "rules_file_capable", "skills_capable", "files_capable",
   "logs_capable",
+  // #2211 — the node's last team-rules outcome (see team-rules-status.ts).
+  "team_rules_revision", "team_rules_status", "team_rules_at", "team_rules_reason",
 ] as const;
 
 export const AUDIT_LOG_REST_COLUMNS = [

package/src/scheduled-requirement-wake-http.test.ts

@@ -252,12 +252,21 @@ describe("#1279 authoritative scoped requirement-event wake over HTTP/MCP", () =
     // schema startup is not the race under qualification.
     for(let i=0;i<2;i++){
       const child=Bun.spawn([process.execPath,"-e",code],{cwd:process.cwd(),stdout:"pipe",stderr:"pipe",env:process.env});
+      // #1279: the child's stderr used to be piped and never read, so a worker that
+      // exited non-zero below left only "Received: 1" — no reason at all. Drain it in
+      // parallel and surface it when the exit code is not 0.
+      const errChunks:string[]=[];
+      const drain=(async()=>{const r=child.stderr.getReader();for(;;){const part=await r.read();if(part.done)break;errChunks.push(new TextDecoder().decode(part.value));}})();
       const reader=child.stdout.getReader();let start="";
       for(;;){const part=await reader.read();if(part.done)throw new Error('worker exited before ready');start+=new TextDecoder().decode(part.value);if(start.includes('READY'))break;}
-      workers.push({child,reader,start});
+      workers.push({child,reader,start,stderr:()=>errChunks.join(''),drain});
     }
     await Bun.write(gate,"go");const results=[];
-    for(const w of workers){let output=w.start;for(;;){const part=await w.reader.read();if(part.done)break;output+=new TextDecoder().decode(part.value);}expect(await w.child.exited).toBe(0);results.push(JSON.parse(output.trim().split("\n").at(-1)!).wake);}
+    for(const w of workers){let output=w.start;for(;;){const part=await w.reader.read();if(part.done)break;output+=new TextDecoder().decode(part.value);}
+      const code=await w.child.exited;await w.drain;
+      // Show the worker's own words on failure instead of a bare exit code.
+      expect({exit:code,stderr:w.stderr().trim().slice(0,800)}).toEqual({exit:0,stderr:""});
+      results.push(JSON.parse(output.trim().split("\n").at(-1)!).wake);}
     expect(results.sort()).toEqual([false,true]);expect(state(scheduleId).revision).toBe(before.revision+1);expect(poll(scheduleId)).toBe(false);
   });
 

package/src/server.ts

@@ -25,6 +25,7 @@ import { z } from "zod/v4";
 import { registerTools } from "./tools.js";
 import { db, logTaskEvent, logAudit, syncScheduledRunForTask } from "./db.js";
 import { ensureNetworkRulesOnce, readNetworkRules, writeNetworkRules } from "./network-rules.js";
+import { deriveTeamRulesView } from "./team-rules-status.js";
 import { recentNodeIdentityConflicts } from "./node-identity-conflict.js";
 import { createSSEStream, createNetworkObserverStream, createUserEventStream, pushEvent, pushNetworkObserverEvent, getSSEStats, PRINTABLE_OBSERVER_KEY_PREFIX, closeUserStreamsInNetwork, getUserPresence, onUserPresenceChange, pushUserEventToNetwork } from "./push.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
@@ -1929,9 +1930,13 @@ return Bun.serve({
           username: resolved.user.username ?? null,
         });
         if (!result.ok) return withCors(req, Response.json({ ok: false, error: result.error }, { status: result.status }));
-        logAudit(resolved.user.user_id, resolved.user.username ?? null, "network_rules_updated", "network_rules", netId,
-          JSON.stringify({ revision: result.rules.revision, bytes: Buffer.byteLength(result.rules.content, "utf8") }), undefined, netId);
-        return withCors(req, Response.json({ ok: true, rules: result.rules }));
+        // An idempotent save (same bytes) changes nothing, so it must not invent an
+        // audit entry that says the rules were updated.
+        if (result.changed) {
+          logAudit(resolved.user.user_id, resolved.user.username ?? null, "network_rules_updated", "network_rules", netId,
+            JSON.stringify({ revision: result.rules.revision, bytes: Buffer.byteLength(result.rules.content, "utf8") }), undefined, netId);
+        }
+        return withCors(req, Response.json({ ok: true, changed: result.changed, rules: result.rules }));
       }
       return withCors(req, Response.json({ ok: false, error: "method_not_allowed" }, { status: 405 }));
     }
@@ -3220,6 +3225,20 @@ return Bun.serve({
       // #500 step 2 — full projection only: queue_depth = open tasks on that node (task-queue-ahead.ts), one query for
       // all rows. The light / alias-resolver projections keep their exact bytes and do not read tasks.
       const depth = isLight ? null : queueDepthByNode(rows.map((r: any) => r.alias));
+      // #2211 — the network's current team-rules revision, one query for all rows (not N+1).
+      // Language models must not be able to infer "current" from a missing row: absent = no rules.
+      // The table is created lazily on first use of the rules API, so a Hub that never
+      // had a rules write may not have it yet — treat "no table" as "no rules".
+      const rulesRevisionByNetwork = isLight ? null : (() => {
+        try {
+          return new Map<string, number>(
+            db.all<{ network_id: string; revision: number }>("SELECT network_id, revision FROM network_rules")
+              .map((r) => [r.network_id, Number(r.revision)]),
+          );
+        } catch {
+          return new Map<string, number>();
+        }
+      })();
       // `model` comes straight from the explicit sessions projection; `runtime` is
       // derived from the raw `agent` field. Both default to null for old nodes
       // that never reported a model — the dashboard falls back to a placeholder.
@@ -3248,11 +3267,30 @@ return Bun.serve({
           if (typeof s.external_schedules !== "string") return null;
           try { return JSON.parse(s.external_schedules); } catch { return null; }
         })();
-        const { external_schedules: _externalSchedulesJson, ...publicSession } = s;
+        // #2211 — the four raw columns feed `team_rules` below; they must not leak into
+        // the session object itself (a `toEqual` on this shape is how the API contract is
+        // pinned in several suites).
+        const {
+          external_schedules: _externalSchedulesJson,
+          team_rules_revision: _trRev, team_rules_status: _trStatus,
+          team_rules_at: _trAt, team_rules_reason: _trReason,
+          ...publicSession
+        } = s;
         return {
           ...publicSession,
           external_schedules: externalSchedules,
           // app#225 follow-up — sqlite INTEGER 0/1 → boolean on the wire.
+          // #2211 — one derived word per node: current / outdated / failed / never.
+          // Omitted entirely for a session that never reported (keeps old clients' bytes stable).
+          ...(() => {
+            const view = deriveTeamRulesView(
+              s.team_rules_revision == null && !s.team_rules_status
+                ? null
+                : { revision: s.team_rules_revision, status: s.team_rules_status, reason: s.team_rules_reason, at: s.team_rules_at },
+              rulesRevisionByNetwork ? (rulesRevisionByNetwork.get(s.network_id) ?? null) : null,
+            );
+            return view ? { team_rules: view } : {};
+          })(),
           rules_file_capable: s.rules_file_capable === 1,
           skills_capable: s.skills_capable === 1,
           files_capable: s.files_capable === 1,

package/src/team-rules-status-http.test.ts

@@ -0,0 +1,90 @@
+// #2211 — the wired half: what the node reports must reach `/api/status` as one word.
+//
+// The pure derivation has its own tests (team-rules-status.test.ts). This file checks the
+// three seams that can still be wrong after that module is correct:
+//   1. the session row actually carries the reported columns (db.ts migration + tools.ts persist);
+//   2. the projection compares against the *network's* current revision (not a global one);
+//   3. a session that never reported stays byte-identical (no `team_rules` key at all).
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+import { ensureNetworkRules } from "./network-rules.js";
+
+let BASE = "";
+let server: any = null;
+let token = "";
+let netId = "";
+
+async function getStatus(query = "") {
+  const res = await fetch(`${BASE}/api/status${query}`, { headers: { Authorization: `Bearer ${token}` } });
+  expect(res.status).toBe(200);
+  return await res.json();
+}
+
+function seedSession(resumeId: string, alias: string, cols: Record<string, unknown> = {}) {
+  const keys = ["resume_id", "alias", "network_id", ...Object.keys(cols)];
+  const values = [resumeId, alias, netId, ...Object.values(cols)];
+  db.run(
+    `INSERT INTO sessions (${keys.join(",")}) VALUES (${keys.map((_, i) => `?${i + 1}`).join(",")})`,
+    values,
+  );
+}
+
+beforeAll(async () => {
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const a = register(`trs_${suffix}`, "TrsPw123Aa!", undefined, "trs");
+  expect(a.ok).toBe(true);
+  token = a.token!;
+  netId = a.network_id!;
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => { try { server?.stop?.(true); } catch {} });
+
+describe("#2211 — team rules state in /api/status", () => {
+  test("a session that never reported has no team_rules key", async () => {
+    seedSession(`never-${Date.now()}`, `never-${Date.now()}`);
+    const body = await getStatus();
+    const row = body.sessions.find((s: any) => s.alias.startsWith("never-"));
+    expect(row).toBeTruthy();
+    expect("team_rules" in row).toBe(false);
+  });
+
+  test("reported revision behind the network's → outdated; equal → current", async () => {
+    ensureNetworkRules(db);   // created lazily by the rules API; this test seeds it directly
+    const rev = Number((db.get<{ revision: number }>("SELECT revision FROM network_rules WHERE network_id = ?1", netId)?.revision) ?? 0) + 2;
+    db.run(
+      "INSERT INTO network_rules (network_id, content, revision, updated_at, updated_by_json) VALUES (?1, 'rules', ?2, datetime('now'), NULL) ON CONFLICT(network_id) DO UPDATE SET revision = ?2",
+      [netId, rev],
+    );
+    seedSession(`behind-${Date.now()}`, `behind-${Date.now()}`, { team_rules_revision: rev - 1, team_rules_status: "unchanged" });
+    seedSession(`equal-${Date.now()}`, `equal-${Date.now()}`, { team_rules_revision: rev, team_rules_status: "injected" });
+    const body = await getStatus();
+    const behind = body.sessions.find((s: any) => s.alias.startsWith("behind-"));
+    const equal = body.sessions.find((s: any) => s.alias.startsWith("equal-"));
+    expect(behind.team_rules.state).toBe("outdated");
+    expect(behind.team_rules.applied_revision).toBe(rev - 1);
+    expect(behind.team_rules.current_revision).toBe(rev);
+    expect(equal.team_rules.state).toBe("current");
+  });
+
+  test("an error report is failed, with its reason", async () => {
+    seedSession(`errored-${Date.now()}`, `errored-${Date.now()}`, {
+      team_rules_status: "error", team_rules_reason: "expected exactly one BEGIN",
+    });
+    const body = await getStatus();
+    const row = body.sessions.find((s: any) => s.alias.startsWith("errored-"));
+    expect(row.team_rules.state).toBe("failed");
+    expect(row.team_rules.reason).toBe("expected exactly one BEGIN");
+  });
+
+  test("the light projection keeps its exact shape (no team_rules, no extra bytes)", async () => {
+    const res = await fetch(`${BASE}/api/status?light=1`, { headers: { Authorization: `Bearer ${token}` } });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    for (const row of body.sessions) expect("team_rules" in row).toBe(false);
+  });
+});

package/src/team-rules-status.test.ts

@@ -0,0 +1,59 @@
+// #2211 — the four states, as decisions rather than as prose.
+//
+// The point of these cases is that "behind" and "failed" are different words:
+// v1 injects at full start, so a node that simply has not restarted is `outdated`.
+// Calling that `failed` would send someone to debug a node that is doing fine.
+import { describe, expect, test } from "bun:test";
+import { deriveTeamRulesView } from "./team-rules-status";
+
+const report = (o: Record<string, unknown>) => o as any;
+
+describe("deriveTeamRulesView (#2211)", () => {
+  test("a node that never attempted is omitted entirely (not reported as null state)", () => {
+    expect(deriveTeamRulesView(null, 3)).toBeNull();
+    expect(deriveTeamRulesView(undefined, 3)).toBeNull();
+    expect(deriveTeamRulesView(report({}), 3)).toBeNull();
+  });
+
+  test("applied revision equals the network's current revision → current", () => {
+    const v = deriveTeamRulesView(report({ revision: 3, status: "injected", at: "2026-10-24T12:00:00Z" }), 3)!;
+    expect(v).toMatchObject({ state: "current", applied_revision: 3, current_revision: 3 });
+  });
+
+  test("behind the current revision → outdated, with the reason kept for context", () => {
+    const v = deriveTeamRulesView(report({ revision: 2, status: "unchanged" }), 3)!;
+    expect(v.state).toBe("outdated");
+    expect(v.applied_revision).toBe(2);
+    expect(v.current_revision).toBe(3);
+  });
+
+  test("an error is failed even when it also happens to carry the current revision", () => {
+    const v = deriveTeamRulesView(report({ revision: 3, status: "error", reason: "expected exactly one BEGIN" }), 3)!;
+    expect(v.state).toBe("failed");
+    expect(v.reason).toBe("expected exactly one BEGIN");
+  });
+
+  test("skipped with no revision (disabled / hub unreachable) → never, reason preserved", () => {
+    const v = deriveTeamRulesView(report({ revision: null, status: "skipped", reason: "hub_timeout" }), 3)!;
+    expect(v).toMatchObject({ state: "never", applied_revision: null, reason: "hub_timeout" });
+  });
+
+  test("the network lost its rules but the node still carries a block → outdated", () => {
+    const v = deriveTeamRulesView(report({ revision: 4, status: "injected" }), null)!;
+    expect(v.state).toBe("outdated");
+    expect(v.current_revision).toBeNull();
+  });
+
+  test("a hub rollback (node ahead of the current revision) is not called current", () => {
+    const v = deriveTeamRulesView(report({ revision: 5, status: "injected" }), 3)!;
+    expect(v.state).toBe("outdated");
+  });
+
+  test("malformed input never throws and never fabricates a revision", () => {
+    const v = deriveTeamRulesView(report({ revision: "3" as any, status: 42 as any, reason: 7 as any }), 3);
+    expect(v).not.toBeNull();
+    expect(v!.state).toBe("never");
+    expect(v!.applied_revision).toBeNull();
+    expect(v!.reason).toBeNull();
+  });
+});

package/src/team-rules-status.ts

@@ -0,0 +1,72 @@
+// #2211 — turn "what the node last did" into one word an operator can act on.
+//
+// The node reports `team_rules: { revision, status, reason?, at }` on every status
+// report (agent-node .156). The Hub knows the network's current revision. This module
+// is the pure comparison between the two — no database, no HTTP, so the rules are
+// testable before any wiring exists.
+//
+// The four states are deliberately about *the node being behind*, not about a failed
+// push: v1 injects at full start, so a node that has not restarted since a rule change
+// is `outdated`, not `failed`. Calling that "failed" would blame the wrong side.
+//
+//   current  — applied revision equals the network's current revision
+//   outdated — this node has not picked up the current revision yet (restart needed)
+//   failed   — the last attempt ended in an error; `reason` says why
+//   never    — this node has never attempted an injection (or the rules are empty and
+//              it has nothing to apply)
+//
+// Unknown input never throws: a malformed report degrades to `never` with the reason
+// preserved, because a status line is not worth a 500.
+
+export type TeamRulesState = "current" | "outdated" | "failed" | "never";
+
+export type TeamRulesReportIn = {
+  revision?: number | null;
+  status?: string | null;
+  reason?: string | null;
+  at?: string | null;
+};
+
+export type TeamRulesView = {
+  state: TeamRulesState;
+  applied_revision: number | null;
+  current_revision: number | null;
+  status: string | null;
+  reason: string | null;
+  at: string | null;
+};
+
+/**
+ * @param report       what the node last reported (null/undefined = it never reported)
+ * @param currentRevision the network's current `network_rules.revision` (null when no row)
+ */
+export function deriveTeamRulesView(
+  report: TeamRulesReportIn | null | undefined,
+  currentRevision: number | null,
+): TeamRulesView | null {
+  if (!report || (report.revision == null && !report.status)) return null;
+
+  const applied = typeof report.revision === "number" && Number.isFinite(report.revision) ? report.revision : null;
+  const current = typeof currentRevision === "number" && Number.isFinite(currentRevision) ? currentRevision : null;
+  const status = typeof report.status === "string" ? report.status : null;
+  const reason = typeof report.reason === "string" && report.reason ? report.reason : null;
+  const at = typeof report.at === "string" && report.at ? report.at : null;
+
+  let state: TeamRulesState;
+  if (status === "error") {
+    state = "failed";
+  } else if (applied == null) {
+    // attempted but nothing was applied (disabled / skipped with no revision)
+    state = "never";
+  } else if (current == null) {
+    // the network has no rules row (revision absent) but the node carries a block
+    state = "outdated";
+  } else if (applied === current) {
+    state = "current";
+  } else {
+    // behind (usual case) or ahead after a Hub rollback — either way it does not match
+    state = "outdated";
+  }
+
+  return { state, applied_revision: applied, current_revision: current, status, reason, at };
+}

package/src/tools.ts

@@ -1053,6 +1053,16 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // no `nodes` row, and config_snapshot is persisted per node_id. Only a
       // node token bound to this same alias can set it; see the UPDATE below.
       rules_file_capable: z.literal(true).optional(),
+      // #2211 — what this process last did with the network's team rules.
+      // Every field is `.catch(...)`: a malformed value must not reject the whole
+      // status report (that would mark a healthy node offline — see the #1225 note
+      // above). Unknown extra keys are dropped, not rejected: this object is not strict.
+      team_rules: z.object({
+        revision: z.number().nullable().optional().catch(null),
+        status: z.string().max(40).optional().catch(undefined),
+        reason: z.string().max(500).optional().catch(undefined),
+        at: z.string().max(40).optional().catch(undefined),
+      }).optional(),
       // Node skills view — same doorbell, ops skills_list / skill_read.
       skills_capable: z.literal(true).optional(),
       // Project folder view — same doorbell, ops files_list / file_read.
@@ -1064,7 +1074,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // instead of rejecting the whole report (see node-health-store.ts).
       health: nodeHealthSchema,
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, os_user: osUser, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable, health: nodeHealth, secret_keys: secretKeys, env_transport: envTransport }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, os_user: osUser, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable, team_rules: teamRules, health: nodeHealth, secret_keys: secretKeys, env_transport: envTransport }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -1359,6 +1369,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         if (logsCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
           db.run("UPDATE sessions SET logs_capable = 1 WHERE resume_id = ?1", [resume_id]);
         }
+        // #2211 — newest report wins (not sticky): a later `skipped` must be able to
+        // clear an older revision. Only this alias's own bound node token may write it.
+        if (teamRules && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run(
+            `UPDATE sessions SET team_rules_revision = ?2, team_rules_status = ?3, team_rules_at = ?4, team_rules_reason = ?5
+             WHERE resume_id = ?1`,
+            [resume_id,
+             typeof teamRules.revision === "number" ? teamRules.revision : null,
+             typeof teamRules.status === "string" ? teamRules.status : null,
+             typeof teamRules.at === "string" ? teamRules.at : null,
+             typeof teamRules.reason === "string" ? teamRules.reason : null],
+          );
+        }
         if (host || proc) {
           db.run(
             `INSERT INTO agent_telemetry (id, network_id, resume_id, alias, hostname, ip, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, created_at)