@sleep2agi/commhub-server 0.9.0-preview.153 → 0.9.0-preview.155

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.153",
+  "version": "0.9.0-preview.155",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -137,6 +137,13 @@ for (const col of [
   // Node run-log view — the same session answers logs_tail on the rules-file
   // doorbell (node-logs.ts). Sticky, bound-token only, like above.
   { name: "logs_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // #2211 — what the node last did with the network's team rules (agent-node .156+
+  // reports it on every status). Not sticky: the newest report wins, and a node that
+  // later starts reporting `skipped` must be able to clear an older revision.
+  { name: "team_rules_revision", def: "INTEGER" },
+  { name: "team_rules_status", def: "TEXT" },
+  { name: "team_rules_at", def: "TEXT" },
+  { name: "team_rules_reason", def: "TEXT" },
 ]) {
   try { db.exec(`ALTER TABLE sessions ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }

package/src/project-viewer-can-http.test.ts

@@ -91,7 +91,9 @@ describe("GET /api/requirements/projects 的 viewer_can.edit", () => {
 
   test("只加字段:其余键与之前逐字相同", async () => {
     const row = (await projects("alice"))["pvc-P2"];
-    expect(Object.keys(row).sort()).toEqual(["archived", "color", "createdAt", "id", "name", "sort", "viewer_can"]);
+    // parentId 是 2026-10-24 加的「子项目」字段（admin：管理项目里看不到层级）；
+    // 它同样是加法式的：这里钉的是「已知键一个不多一个不少」，新键必须显式加进这个清单。
+    expect(Object.keys(row).sort()).toEqual(["archived", "color", "createdAt", "id", "name", "parentId", "sort", "viewer_can"]);
     expect(Object.keys(row.viewer_can)).toEqual(["edit"]);
   });
 

package/src/requirements-errors.ts

@@ -40,6 +40,13 @@ const ENTRIES: Record<string, Entry> = {
   tag_parent_not_found: { field: 'parent_id', message: 'No tag named that in this network.', hint: 'Create the parent first (parent_id: null), or read GET /api/requirements/tags → nodes for the names that exist.' },
   invalid_tag_parent_id: { field: 'parent_id', message: 'parent_id must be a tag name in this network, or null for the root.', hint: 'Tag names are 1–20 characters; read GET /api/requirements/tags → nodes for the names that exist.' },
   tag_parent_cycle: { field: 'parent_id', message: 'A tag cannot be its own parent.', hint: 'Pass a different parent, or null for the root.' },
+  // 子项目（admin 2026-10-24）：项目也能成层级，错误码与标签那几条**分开**，文案指向 proj_… 而不是标签名。
+  invalid_project_parent: { field: 'parent_id', message: 'parent_id must be a project id (proj_…) or null for a top-level project.', hint: 'Call projects_list to get project ids.' },
+  project_parent_not_found: { field: 'parent_id', message: 'No project with that id in this network (or it was deleted).', hint: 'Call projects_list to get the ids that exist.' },
+  project_parent_archived: { field: 'parent_id', message: 'That parent project is archived, so it cannot take children.', hint: 'Unarchive it first, or pick an active project.' },
+  project_parent_cycle: { field: 'parent_id', message: 'That parent would make the project its own ancestor.', hint: 'Pick a project that is not this one or one of its children.' },
+  project_parent_too_deep: { field: 'parent_id', message: 'Projects nest at most 3 levels (a top-level project counts as level 1).', hint: 'Attach it to a higher-level project.' },
+  project_has_children: { message: 'This project still has sub-projects, so it cannot be deleted.', hint: 'Move or delete the sub-projects first (a parent is never silently orphaned).' },
   tag_depth_exceeded: { field: 'parent_id', message: 'Tags nest at most 4 levels (the root counts as level 1).', hint: 'Attach the tag to a higher-level tag.' },
   invalid_tag: { field: 'name', message: 'Tag names are 1–20 characters after trimming, with no control characters.', hint: 'Shorten the name, or remove line breaks.' },
   checklist_item_not_found: { field: 'item_id', message: 'This task has no checklist item with that id.', hint: 'Item ids (ck_…) are in requirements_get → checklist[].id.' },

package/src/requirements-migrate.ts

@@ -41,6 +41,9 @@ export function ensureRequirementProjects(database: DbAdapter): void {
     );
     CREATE INDEX IF NOT EXISTS idx_requirement_projects_network ON requirement_projects(network_id, sort);
   `);
+  // 子项目（admin 2026-10-24：管理项目里没有层级）。加法式列，老库用 ALTER 补；重复执行无副作用。
+  // NULL = 顶层项目，所以现有行不需要回填。
+  try { database.exec("ALTER TABLE requirement_projects ADD COLUMN parent_id TEXT"); } catch {}
 }
 
 /**

package/src/requirements-projects-parent-http.test.ts

@@ -0,0 +1,123 @@
+// 子项目（admin 2026-10-24：管理项目里只能平铺，看不到层级）。
+//
+// 本文件钉住四件事，任何一条错都会让「项目」这个词变得不可信：
+//   1. 建/搬家都能指定 parent_id，GET 列表能读回；
+//   2. 深度上限 3 层（顶层=1），超了拒绝而不是悄悄截断；
+//   3. 环（把自己挂到自己的后代下面 / 挂到自己身上）必须拒绝；
+//   4. 有子项目的项目不能直接删（不偷偷把子项目变孤儿或改写它们的层级）。
+// 另外：父项目必须同网络、未归档。
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { register } from "./auth.js";
+import { bootServer } from "./server.js";
+
+let BASE = "";
+let server: any = null;
+let token = "";
+let NET = "";
+
+async function send(method: string, path: string, payload?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let body: any = null;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+
+const P = (path: string) => `${path}${path.includes("?") ? "&" : "?"}network_id=${NET}`;
+const mk = (name: string, parent_id?: string | null) =>
+  send("POST", P("/api/requirements/projects"), parent_id === undefined ? { name } : { name, parent_id });
+
+beforeAll(async () => {
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const a = register(`projparent_${suffix}`, "ProjParentPw123!", undefined, "pp");
+  expect(a.ok).toBe(true);
+  token = a.token!;
+  NET = a.network_id!;
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => { try { server?.stop?.(true); } catch {} });
+
+describe("sub-projects (parent_id)", () => {
+  test("create a child and read the hierarchy back", async () => {
+    const parent = await mk("父项目");
+    expect(parent.status).toBe(201);
+    const parentId = parent.body.project.id;
+    expect(parent.body.project.parentId).toBeNull();
+
+    const child = await mk("子项目", parentId);
+    expect(child.status).toBe(201);
+    expect(child.body.project.parentId).toBe(parentId);
+
+    const list = await send("GET", P("/api/requirements/projects"));
+    expect(list.status).toBe(200);
+    const rows = list.body.projects as any[];
+    expect(rows.find((r) => r.name === "子项目")!.parentId).toBe(parentId);
+    expect(rows.find((r) => r.name === "父项目")!.parentId).toBeNull();
+  });
+
+  test("a project can be moved under another one, and back to the top", async () => {
+    const a = await mk("可搬 A");
+    const b = await mk("可搬 B");
+    const moved = await send("PATCH", P(`/api/requirements/projects/${b.body.project.id}`), { parent_id: a.body.project.id });
+    expect(moved.status).toBe(200);
+    expect(moved.body.project.parentId).toBe(a.body.project.id);
+
+    const back = await send("PATCH", P(`/api/requirements/projects/${b.body.project.id}`), { parent_id: null });
+    expect(back.status).toBe(200);
+    expect(back.body.project.parentId).toBeNull();
+  });
+
+  test("depth is capped at 3 (top level counts as 1)", async () => {
+    const l1 = await mk("深 1");
+    const l2 = await mk("深 2", l1.body.project.id);
+    const l3 = await mk("深 3", l2.body.project.id);
+    expect(l3.status).toBe(201);
+    const l4 = await mk("深 4", l3.body.project.id);
+    expect(l4.status).toBe(400);
+    expect(l4.body.error).toBe("project_parent_too_deep");
+  });
+
+  test("a cycle is refused (self, and a descendant)", async () => {
+    const a = await mk("环 A");
+    const b = await mk("环 B", a.body.project.id);
+    const self = await send("PATCH", P(`/api/requirements/projects/${a.body.project.id}`), { parent_id: a.body.project.id });
+    expect(self.status).toBe(400);
+    expect(self.body.error).toBe("project_parent_cycle");
+
+    // 把 A 挂到它自己的子项目 B 下面 = 环
+    const loop = await send("PATCH", P(`/api/requirements/projects/${a.body.project.id}`), { parent_id: b.body.project.id });
+    expect(loop.status).toBe(400);
+    expect(loop.body.error).toBe("project_parent_cycle");
+  });
+
+  test("a parent that does not exist, is archived, or lives in another network is refused", async () => {
+    const missing = await mk("缺父", "proj_does_not_exist");
+    expect(missing.status).toBe(404);
+    expect(missing.body.error).toBe("project_parent_not_found");
+
+    const parent = await mk("会归档的父");
+    await send("PATCH", P(`/api/requirements/projects/${parent.body.project.id}`), { archived: true });
+    const archived = await mk("挂到归档父", parent.body.project.id);
+    expect(archived.status).toBe(400);
+    expect(archived.body.error).toBe("project_parent_archived");
+  });
+
+  test("a project with children cannot be deleted (children are not silently orphaned)", async () => {
+    const parent = await mk("有孩子的父");
+    const child = await mk("孩子", parent.body.project.id);
+    const del = await send("DELETE", P(`/api/requirements/projects/${parent.body.project.id}`));
+    expect(del.status).toBe(409);
+    expect(del.body.error).toBe("project_has_children");
+
+    // 先删孩子，父就能删
+    expect((await send("DELETE", P(`/api/requirements/projects/${child.body.project.id}`))).status).toBe(200);
+    expect((await send("DELETE", P(`/api/requirements/projects/${parent.body.project.id}`))).status).toBe(200);
+  });
+});

package/src/requirements-status-participants-http.test.ts

@@ -213,8 +213,8 @@ describe("tool descriptions", () => {
     // #478:节点令牌的 tools/list 里本来就没有 projects_create / projects_update(调了也是 403),那两条的说明从人的列表里读。
     expect(byName.has("projects_create")).toBe(false);
     const human = new Map(((await rpc(U.member.token, "tools/list", {})).result.tools as any[]).map(t => [t.name, t]));
-    expect(byName.get("projects_list").description).toMatch(/node \(Agent\) tokens can only read projects/i);
-    for (const name of ["projects_create", "projects_update"]) expect(human.get(name).description).toMatch(/node \(Agent\) tokens can only read projects/i);
+    expect(byName.get("projects_list").description).toMatch(/node (?:\(Agent\) )?tokens can only read projects/i);
+    for (const name of ["projects_create", "projects_update"]) expect(human.get(name).description).toMatch(/node (?:\(Agent\) )?tokens can only read projects/i);
     const denied = await mcp(U.nodeA.token, "projects_create", { name: "示例项目" });
     expect(denied.status).toBe(403);
     expect(denied.error).toBe("user_token_required");

package/src/requirements.ts

@@ -348,11 +348,13 @@ function storedChecklist(raw: string | null): ChecklistItem[] {
 // ── 项目 ──
 // 按网络隔离;名字 1–40 字,同一网络里未归档的项目不重名;颜色 #RRGGBB;sort 越小越靠前。
 // 删除 = 删项目行 + 把引用它的卡片 project_id 置空(卡片本身不动);归档 = 保留引用,只是不能再被选。
-type ProjectRow = { project_id: string; network_id: string; name: string; color: string; sort: number; archived: number; created_at: string };
+type ProjectRow = { project_id: string; network_id: string; name: string; color: string; sort: number; archived: number; created_at: string; parent_id: string | null };
 const PROJECT_COLOR = /^#[0-9a-fA-F]{6}$/;
 const PROJECT_PALETTE = ["#2563eb", "#16a34a", "#d97706", "#dc2626", "#7c3aed", "#0891b2", "#db2777", "#4b5563"];
-const PROJECT_SELECT = "project_id, network_id, name, color, sort, archived, created_at";
-const projectPublic = (row: ProjectRow) => ({ id: row.project_id, name: row.name, color: row.color, sort: row.sort, archived: !!row.archived, createdAt: row.created_at });
+const PROJECT_SELECT = "project_id, network_id, name, color, sort, archived, created_at, parent_id";
+/** 子项目最多 3 层（顶层=1）。再深的话「项目」这个词就没有意义了，也没人能在选择器里点对。 */
+const PROJECT_MAX_DEPTH = 3;
+const projectPublic = (row: ProjectRow) => ({ id: row.project_id, name: row.name, color: row.color, sort: row.sort, archived: !!row.archived, createdAt: row.created_at, parentId: row.parent_id ?? null });
 const projectName = (raw: unknown): string | null => {
   if (typeof raw !== "string") return null;
   const name = raw.replace(/[\r\n\t]+/g, " ").trim();
@@ -361,6 +363,50 @@ const projectName = (raw: unknown): string | null => {
 function projectNameTaken(networkId: string, name: string, except?: string): boolean {
   return !!db.get("SELECT 1 FROM requirement_projects WHERE network_id = ?1 AND name = ?2 AND archived = 0 AND project_id != ?3", networkId, name, except ?? "");
 }
+/** 这个项目往上数有几层（自己算第一层）。用于深度上限与环路判断。 */
+function projectDepth(projectId: string): number {
+  let depth = 0;
+  let cur: string | null = projectId;
+  const seen = new Set<string>();
+  while (cur && depth < 64) {
+    if (seen.has(cur)) return Number.POSITIVE_INFINITY;  // 循环：当成超深，调用方会拒绝
+    seen.add(cur);
+    depth++;
+    const row: { parent_id: string | null } | null = db.get("SELECT parent_id FROM requirement_projects WHERE project_id = ?1", cur);
+    cur = row?.parent_id ?? null;
+  }
+  return depth;
+}
+
+/**
+ * 校验 parent_id（新项目或搬家时）。返回 { parent } 或错误码。
+ * 规则：同一网络、存在、未归档、不是自己或自己的后代、加进来后不超过 PROJECT_MAX_DEPTH。
+ */
+function validateProjectParent(
+  networkId: string, parentId: string, selfId: string | null,
+): { ok: true; parent: ProjectRow } | { ok: false; error: string } {
+  const parent = db.get<ProjectRow>(`SELECT ${PROJECT_SELECT} FROM requirement_projects WHERE project_id = ?1`, parentId);
+  if (!parent || parent.network_id !== networkId) return { ok: false, error: "project_parent_not_found" };
+  if (parent.archived) return { ok: false, error: "project_parent_archived" };
+  if (selfId) {
+    if (parent.project_id === selfId) return { ok: false, error: "project_parent_cycle" };
+    // 把 A 挂到 A 的后代下面 = 环。沿 parent 链往上走，遇到自己就拒绝。
+    let cur: string | null = parent.parent_id ?? null;
+    const seen = new Set<string>();
+    while (cur && !seen.has(cur)) {
+      if (cur === selfId) return { ok: false, error: "project_parent_cycle" };
+      seen.add(cur);
+      cur = db.get<{ parent_id: string | null }>("SELECT parent_id FROM requirement_projects WHERE project_id = ?1", cur)?.parent_id ?? null;
+    }
+    if (projectDepth(selfId) + projectDepth(parent.project_id) > PROJECT_MAX_DEPTH) {
+      return { ok: false, error: "project_parent_too_deep" };
+    }
+  } else if (projectDepth(parent.project_id) + 1 > PROJECT_MAX_DEPTH) {
+    return { ok: false, error: "project_parent_too_deep" };
+  }
+  return { ok: true, parent };
+}
+
 /** 卡片上的 project_id:null 清空;字符串必须是同一网络、未归档的项目。 */
 function projectRef(value: unknown, networkId: string): string | null {
   if (value === null) return null;
@@ -405,13 +451,24 @@ async function handleProjects(ctx: RequirementsRequestContext): Promise<Response
     const sort = body.sort === undefined ? count : body.sort;
     if (!Number.isInteger(sort)) return jsonError("invalid_project_sort", 400);
     const id = `proj_${crypto.randomUUID()}`;
-    db.run(`INSERT INTO requirement_projects (${PROJECT_SELECT}) VALUES (?1, ?2, ?3, ?4, ?5, 0, ?6)`, [id, networkId, name, color, sort, new Date().toISOString()]);
+    // 子项目：parent_id 可选；null/缺省 = 顶层。
+    let parentId: string | null = null;
+    if (body.parent_id !== undefined && body.parent_id !== null && body.parent_id !== "") {
+      if (typeof body.parent_id !== "string") return jsonError("invalid_project_parent", 400);
+      const check = validateProjectParent(networkId, body.parent_id, null);
+      if (!check.ok) return jsonError(check.error, check.error === "project_parent_not_found" ? 404 : 400);
+      parentId = check.parent.project_id;
+    }
+    db.run(`INSERT INTO requirement_projects (${PROJECT_SELECT}) VALUES (?1, ?2, ?3, ?4, ?5, 0, ?6, ?7)`, [id, networkId, name, color, sort, new Date().toISOString(), parentId]);
     return Response.json({ ok: true, project: projectPublic(db.get<ProjectRow>(`SELECT ${PROJECT_SELECT} FROM requirement_projects WHERE project_id = ?1`, id)!) }, { status: 201 });
   }
   if (!one) return jsonError("not_found", 404);
   const current = db.get<ProjectRow>(`SELECT ${PROJECT_SELECT} FROM requirement_projects WHERE project_id = ?1`, decodeURIComponent(one[1]));
   if (!current || current.network_id !== networkId) return jsonError("project_not_found", 404);
   if (req.method === "DELETE") {
+    // 子项目不能凭空变孤儿：先搬走或删掉它们（明确拒绝，不偷偷改层级）。
+    const kids = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM requirement_projects WHERE parent_id = ?1", current.project_id)?.n ?? 0;
+    if (kids > 0) return jsonError("project_has_children", 409);
     // 先把卡片上的引用置空,再删项目:卡片一张不少。
     // updated_at 跟着动:按 updated_since 增量同步的客户端要看得见「项目被清空」这一改动。
     // 每张被清空项目的卡记一条「项目 X → 无」(与清空同一个事务)。
@@ -445,8 +502,20 @@ async function handleProjects(ctx: RequirementsRequestContext): Promise<Response
     if (typeof body.archived !== "boolean") return jsonError("invalid_project_archived", 400);
     archived = body.archived ? 1 : 0;
   }
+  let parentId: string | null = current.parent_id ?? null;
+  if ("parent_id" in body) {
+    if (body.parent_id === null || body.parent_id === "") {
+      parentId = null;                                    // 变成顶层
+    } else if (typeof body.parent_id !== "string") {
+      return jsonError("invalid_project_parent", 400);
+    } else {
+      const check = validateProjectParent(networkId, body.parent_id, current.project_id);
+      if (!check.ok) return jsonError(check.error, check.error === "project_parent_not_found" ? 404 : 400);
+      parentId = check.parent.project_id;
+    }
+  }
   if (!archived && projectNameTaken(networkId, name, current.project_id)) return jsonError("project_name_taken", 409);
-  db.run("UPDATE requirement_projects SET name = ?1, color = ?2, sort = ?3, archived = ?4 WHERE project_id = ?5", [name, color, sort, archived, current.project_id]);
+  db.run("UPDATE requirement_projects SET name = ?1, color = ?2, sort = ?3, archived = ?4, parent_id = ?6 WHERE project_id = ?5", [name, color, sort, archived, current.project_id, parentId]);
   return Response.json({ ok: true, project: projectPublic(db.get<ProjectRow>(`SELECT ${PROJECT_SELECT} FROM requirement_projects WHERE project_id = ?1`, current.project_id)!) });
 }
 

package/src/rest-projections.ts

@@ -21,6 +21,8 @@ export const SESSION_REST_COLUMNS = [
   "node_id", "session_id", "config_path", "channels", "last_seen_at", "model",
   "external_schedules", "rules_file_capable", "skills_capable", "files_capable",
   "logs_capable",
+  // #2211 — the node's last team-rules outcome (see team-rules-status.ts).
+  "team_rules_revision", "team_rules_status", "team_rules_at", "team_rules_reason",
 ] as const;
 
 export const AUDIT_LOG_REST_COLUMNS = [

package/src/scheduled-requirement-wake-http.test.ts

@@ -252,12 +252,21 @@ describe("#1279 authoritative scoped requirement-event wake over HTTP/MCP", () =
     // schema startup is not the race under qualification.
     for(let i=0;i<2;i++){
       const child=Bun.spawn([process.execPath,"-e",code],{cwd:process.cwd(),stdout:"pipe",stderr:"pipe",env:process.env});
+      // #1279: the child's stderr used to be piped and never read, so a worker that
+      // exited non-zero below left only "Received: 1" — no reason at all. Drain it in
+      // parallel and surface it when the exit code is not 0.
+      const errChunks:string[]=[];
+      const drain=(async()=>{const r=child.stderr.getReader();for(;;){const part=await r.read();if(part.done)break;errChunks.push(new TextDecoder().decode(part.value));}})();
       const reader=child.stdout.getReader();let start="";
       for(;;){const part=await reader.read();if(part.done)throw new Error('worker exited before ready');start+=new TextDecoder().decode(part.value);if(start.includes('READY'))break;}
-      workers.push({child,reader,start});
+      workers.push({child,reader,start,stderr:()=>errChunks.join(''),drain});
     }
     await Bun.write(gate,"go");const results=[];
-    for(const w of workers){let output=w.start;for(;;){const part=await w.reader.read();if(part.done)break;output+=new TextDecoder().decode(part.value);}expect(await w.child.exited).toBe(0);results.push(JSON.parse(output.trim().split("\n").at(-1)!).wake);}
+    for(const w of workers){let output=w.start;for(;;){const part=await w.reader.read();if(part.done)break;output+=new TextDecoder().decode(part.value);}
+      const code=await w.child.exited;await w.drain;
+      // Show the worker's own words on failure instead of a bare exit code.
+      expect({exit:code,stderr:w.stderr().trim().slice(0,800)}).toEqual({exit:0,stderr:""});
+      results.push(JSON.parse(output.trim().split("\n").at(-1)!).wake);}
     expect(results.sort()).toEqual([false,true]);expect(state(scheduleId).revision).toBe(before.revision+1);expect(poll(scheduleId)).toBe(false);
   });
 

package/src/server.ts

@@ -25,6 +25,7 @@ import { z } from "zod/v4";
 import { registerTools } from "./tools.js";
 import { db, logTaskEvent, logAudit, syncScheduledRunForTask } from "./db.js";
 import { ensureNetworkRulesOnce, readNetworkRules, writeNetworkRules } from "./network-rules.js";
+import { deriveTeamRulesView } from "./team-rules-status.js";
 import { recentNodeIdentityConflicts } from "./node-identity-conflict.js";
 import { createSSEStream, createNetworkObserverStream, createUserEventStream, pushEvent, pushNetworkObserverEvent, getSSEStats, PRINTABLE_OBSERVER_KEY_PREFIX, closeUserStreamsInNetwork, getUserPresence, onUserPresenceChange, pushUserEventToNetwork } from "./push.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
@@ -3224,6 +3225,20 @@ return Bun.serve({
       // #500 step 2 — full projection only: queue_depth = open tasks on that node (task-queue-ahead.ts), one query for
       // all rows. The light / alias-resolver projections keep their exact bytes and do not read tasks.
       const depth = isLight ? null : queueDepthByNode(rows.map((r: any) => r.alias));
+      // #2211 — the network's current team-rules revision, one query for all rows (not N+1).
+      // Language models must not be able to infer "current" from a missing row: absent = no rules.
+      // The table is created lazily on first use of the rules API, so a Hub that never
+      // had a rules write may not have it yet — treat "no table" as "no rules".
+      const rulesRevisionByNetwork = isLight ? null : (() => {
+        try {
+          return new Map<string, number>(
+            db.all<{ network_id: string; revision: number }>("SELECT network_id, revision FROM network_rules")
+              .map((r) => [r.network_id, Number(r.revision)]),
+          );
+        } catch {
+          return new Map<string, number>();
+        }
+      })();
       // `model` comes straight from the explicit sessions projection; `runtime` is
       // derived from the raw `agent` field. Both default to null for old nodes
       // that never reported a model — the dashboard falls back to a placeholder.
@@ -3252,11 +3267,30 @@ return Bun.serve({
           if (typeof s.external_schedules !== "string") return null;
           try { return JSON.parse(s.external_schedules); } catch { return null; }
         })();
-        const { external_schedules: _externalSchedulesJson, ...publicSession } = s;
+        // #2211 — the four raw columns feed `team_rules` below; they must not leak into
+        // the session object itself (a `toEqual` on this shape is how the API contract is
+        // pinned in several suites).
+        const {
+          external_schedules: _externalSchedulesJson,
+          team_rules_revision: _trRev, team_rules_status: _trStatus,
+          team_rules_at: _trAt, team_rules_reason: _trReason,
+          ...publicSession
+        } = s;
         return {
           ...publicSession,
           external_schedules: externalSchedules,
           // app#225 follow-up — sqlite INTEGER 0/1 → boolean on the wire.
+          // #2211 — one derived word per node: current / outdated / failed / never.
+          // Omitted entirely for a session that never reported (keeps old clients' bytes stable).
+          ...(() => {
+            const view = deriveTeamRulesView(
+              s.team_rules_revision == null && !s.team_rules_status
+                ? null
+                : { revision: s.team_rules_revision, status: s.team_rules_status, reason: s.team_rules_reason, at: s.team_rules_at },
+              rulesRevisionByNetwork ? (rulesRevisionByNetwork.get(s.network_id) ?? null) : null,
+            );
+            return view ? { team_rules: view } : {};
+          })(),
           rules_file_capable: s.rules_file_capable === 1,
           skills_capable: s.skills_capable === 1,
           files_capable: s.files_capable === 1,

package/src/team-rules-status-http.test.ts

@@ -0,0 +1,90 @@
+// #2211 — the wired half: what the node reports must reach `/api/status` as one word.
+//
+// The pure derivation has its own tests (team-rules-status.test.ts). This file checks the
+// three seams that can still be wrong after that module is correct:
+//   1. the session row actually carries the reported columns (db.ts migration + tools.ts persist);
+//   2. the projection compares against the *network's* current revision (not a global one);
+//   3. a session that never reported stays byte-identical (no `team_rules` key at all).
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+import { ensureNetworkRules } from "./network-rules.js";
+
+let BASE = "";
+let server: any = null;
+let token = "";
+let netId = "";
+
+async function getStatus(query = "") {
+  const res = await fetch(`${BASE}/api/status${query}`, { headers: { Authorization: `Bearer ${token}` } });
+  expect(res.status).toBe(200);
+  return await res.json();
+}
+
+function seedSession(resumeId: string, alias: string, cols: Record<string, unknown> = {}) {
+  const keys = ["resume_id", "alias", "network_id", ...Object.keys(cols)];
+  const values = [resumeId, alias, netId, ...Object.values(cols)];
+  db.run(
+    `INSERT INTO sessions (${keys.join(",")}) VALUES (${keys.map((_, i) => `?${i + 1}`).join(",")})`,
+    values,
+  );
+}
+
+beforeAll(async () => {
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const a = register(`trs_${suffix}`, "TrsPw123Aa!", undefined, "trs");
+  expect(a.ok).toBe(true);
+  token = a.token!;
+  netId = a.network_id!;
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => { try { server?.stop?.(true); } catch {} });
+
+describe("#2211 — team rules state in /api/status", () => {
+  test("a session that never reported has no team_rules key", async () => {
+    seedSession(`never-${Date.now()}`, `never-${Date.now()}`);
+    const body = await getStatus();
+    const row = body.sessions.find((s: any) => s.alias.startsWith("never-"));
+    expect(row).toBeTruthy();
+    expect("team_rules" in row).toBe(false);
+  });
+
+  test("reported revision behind the network's → outdated; equal → current", async () => {
+    ensureNetworkRules(db);   // created lazily by the rules API; this test seeds it directly
+    const rev = Number((db.get<{ revision: number }>("SELECT revision FROM network_rules WHERE network_id = ?1", netId)?.revision) ?? 0) + 2;
+    db.run(
+      "INSERT INTO network_rules (network_id, content, revision, updated_at, updated_by_json) VALUES (?1, 'rules', ?2, datetime('now'), NULL) ON CONFLICT(network_id) DO UPDATE SET revision = ?2",
+      [netId, rev],
+    );
+    seedSession(`behind-${Date.now()}`, `behind-${Date.now()}`, { team_rules_revision: rev - 1, team_rules_status: "unchanged" });
+    seedSession(`equal-${Date.now()}`, `equal-${Date.now()}`, { team_rules_revision: rev, team_rules_status: "injected" });
+    const body = await getStatus();
+    const behind = body.sessions.find((s: any) => s.alias.startsWith("behind-"));
+    const equal = body.sessions.find((s: any) => s.alias.startsWith("equal-"));
+    expect(behind.team_rules.state).toBe("outdated");
+    expect(behind.team_rules.applied_revision).toBe(rev - 1);
+    expect(behind.team_rules.current_revision).toBe(rev);
+    expect(equal.team_rules.state).toBe("current");
+  });
+
+  test("an error report is failed, with its reason", async () => {
+    seedSession(`errored-${Date.now()}`, `errored-${Date.now()}`, {
+      team_rules_status: "error", team_rules_reason: "expected exactly one BEGIN",
+    });
+    const body = await getStatus();
+    const row = body.sessions.find((s: any) => s.alias.startsWith("errored-"));
+    expect(row.team_rules.state).toBe("failed");
+    expect(row.team_rules.reason).toBe("expected exactly one BEGIN");
+  });
+
+  test("the light projection keeps its exact shape (no team_rules, no extra bytes)", async () => {
+    const res = await fetch(`${BASE}/api/status?light=1`, { headers: { Authorization: `Bearer ${token}` } });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    for (const row of body.sessions) expect("team_rules" in row).toBe(false);
+  });
+});

package/src/team-rules-status.test.ts

@@ -0,0 +1,59 @@
+// #2211 — the four states, as decisions rather than as prose.
+//
+// The point of these cases is that "behind" and "failed" are different words:
+// v1 injects at full start, so a node that simply has not restarted is `outdated`.
+// Calling that `failed` would send someone to debug a node that is doing fine.
+import { describe, expect, test } from "bun:test";
+import { deriveTeamRulesView } from "./team-rules-status";
+
+const report = (o: Record<string, unknown>) => o as any;
+
+describe("deriveTeamRulesView (#2211)", () => {
+  test("a node that never attempted is omitted entirely (not reported as null state)", () => {
+    expect(deriveTeamRulesView(null, 3)).toBeNull();
+    expect(deriveTeamRulesView(undefined, 3)).toBeNull();
+    expect(deriveTeamRulesView(report({}), 3)).toBeNull();
+  });
+
+  test("applied revision equals the network's current revision → current", () => {
+    const v = deriveTeamRulesView(report({ revision: 3, status: "injected", at: "2026-10-24T12:00:00Z" }), 3)!;
+    expect(v).toMatchObject({ state: "current", applied_revision: 3, current_revision: 3 });
+  });
+
+  test("behind the current revision → outdated, with the reason kept for context", () => {
+    const v = deriveTeamRulesView(report({ revision: 2, status: "unchanged" }), 3)!;
+    expect(v.state).toBe("outdated");
+    expect(v.applied_revision).toBe(2);
+    expect(v.current_revision).toBe(3);
+  });
+
+  test("an error is failed even when it also happens to carry the current revision", () => {
+    const v = deriveTeamRulesView(report({ revision: 3, status: "error", reason: "expected exactly one BEGIN" }), 3)!;
+    expect(v.state).toBe("failed");
+    expect(v.reason).toBe("expected exactly one BEGIN");
+  });
+
+  test("skipped with no revision (disabled / hub unreachable) → never, reason preserved", () => {
+    const v = deriveTeamRulesView(report({ revision: null, status: "skipped", reason: "hub_timeout" }), 3)!;
+    expect(v).toMatchObject({ state: "never", applied_revision: null, reason: "hub_timeout" });
+  });
+
+  test("the network lost its rules but the node still carries a block → outdated", () => {
+    const v = deriveTeamRulesView(report({ revision: 4, status: "injected" }), null)!;
+    expect(v.state).toBe("outdated");
+    expect(v.current_revision).toBeNull();
+  });
+
+  test("a hub rollback (node ahead of the current revision) is not called current", () => {
+    const v = deriveTeamRulesView(report({ revision: 5, status: "injected" }), 3)!;
+    expect(v.state).toBe("outdated");
+  });
+
+  test("malformed input never throws and never fabricates a revision", () => {
+    const v = deriveTeamRulesView(report({ revision: "3" as any, status: 42 as any, reason: 7 as any }), 3);
+    expect(v).not.toBeNull();
+    expect(v!.state).toBe("never");
+    expect(v!.applied_revision).toBeNull();
+    expect(v!.reason).toBeNull();
+  });
+});

package/src/team-rules-status.ts

@@ -0,0 +1,72 @@
+// #2211 — turn "what the node last did" into one word an operator can act on.
+//
+// The node reports `team_rules: { revision, status, reason?, at }` on every status
+// report (agent-node .156). The Hub knows the network's current revision. This module
+// is the pure comparison between the two — no database, no HTTP, so the rules are
+// testable before any wiring exists.
+//
+// The four states are deliberately about *the node being behind*, not about a failed
+// push: v1 injects at full start, so a node that has not restarted since a rule change
+// is `outdated`, not `failed`. Calling that "failed" would blame the wrong side.
+//
+//   current  — applied revision equals the network's current revision
+//   outdated — this node has not picked up the current revision yet (restart needed)
+//   failed   — the last attempt ended in an error; `reason` says why
+//   never    — this node has never attempted an injection (or the rules are empty and
+//              it has nothing to apply)
+//
+// Unknown input never throws: a malformed report degrades to `never` with the reason
+// preserved, because a status line is not worth a 500.
+
+export type TeamRulesState = "current" | "outdated" | "failed" | "never";
+
+export type TeamRulesReportIn = {
+  revision?: number | null;
+  status?: string | null;
+  reason?: string | null;
+  at?: string | null;
+};
+
+export type TeamRulesView = {
+  state: TeamRulesState;
+  applied_revision: number | null;
+  current_revision: number | null;
+  status: string | null;
+  reason: string | null;
+  at: string | null;
+};
+
+/**
+ * @param report       what the node last reported (null/undefined = it never reported)
+ * @param currentRevision the network's current `network_rules.revision` (null when no row)
+ */
+export function deriveTeamRulesView(
+  report: TeamRulesReportIn | null | undefined,
+  currentRevision: number | null,
+): TeamRulesView | null {
+  if (!report || (report.revision == null && !report.status)) return null;
+
+  const applied = typeof report.revision === "number" && Number.isFinite(report.revision) ? report.revision : null;
+  const current = typeof currentRevision === "number" && Number.isFinite(currentRevision) ? currentRevision : null;
+  const status = typeof report.status === "string" ? report.status : null;
+  const reason = typeof report.reason === "string" && report.reason ? report.reason : null;
+  const at = typeof report.at === "string" && report.at ? report.at : null;
+
+  let state: TeamRulesState;
+  if (status === "error") {
+    state = "failed";
+  } else if (applied == null) {
+    // attempted but nothing was applied (disabled / skipped with no revision)
+    state = "never";
+  } else if (current == null) {
+    // the network has no rules row (revision absent) but the node carries a block
+    state = "outdated";
+  } else if (applied === current) {
+    state = "current";
+  } else {
+    // behind (usual case) or ahead after a Hub rollback — either way it does not match
+    state = "outdated";
+  }
+
+  return { state, applied_revision: applied, current_revision: current, status, reason, at };
+}

package/src/tools.ts

@@ -1053,6 +1053,16 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // no `nodes` row, and config_snapshot is persisted per node_id. Only a
       // node token bound to this same alias can set it; see the UPDATE below.
       rules_file_capable: z.literal(true).optional(),
+      // #2211 — what this process last did with the network's team rules.
+      // Every field is `.catch(...)`: a malformed value must not reject the whole
+      // status report (that would mark a healthy node offline — see the #1225 note
+      // above). Unknown extra keys are dropped, not rejected: this object is not strict.
+      team_rules: z.object({
+        revision: z.number().nullable().optional().catch(null),
+        status: z.string().max(40).optional().catch(undefined),
+        reason: z.string().max(500).optional().catch(undefined),
+        at: z.string().max(40).optional().catch(undefined),
+      }).optional(),
       // Node skills view — same doorbell, ops skills_list / skill_read.
       skills_capable: z.literal(true).optional(),
       // Project folder view — same doorbell, ops files_list / file_read.
@@ -1064,7 +1074,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // instead of rejecting the whole report (see node-health-store.ts).
       health: nodeHealthSchema,
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, os_user: osUser, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable, health: nodeHealth, secret_keys: secretKeys, env_transport: envTransport }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, os_user: osUser, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable, team_rules: teamRules, health: nodeHealth, secret_keys: secretKeys, env_transport: envTransport }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -1359,6 +1369,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         if (logsCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
           db.run("UPDATE sessions SET logs_capable = 1 WHERE resume_id = ?1", [resume_id]);
         }
+        // #2211 — newest report wins (not sticky): a later `skipped` must be able to
+        // clear an older revision. Only this alias's own bound node token may write it.
+        if (teamRules && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run(
+            `UPDATE sessions SET team_rules_revision = ?2, team_rules_status = ?3, team_rules_at = ?4, team_rules_reason = ?5
+             WHERE resume_id = ?1`,
+            [resume_id,
+             typeof teamRules.revision === "number" ? teamRules.revision : null,
+             typeof teamRules.status === "string" ? teamRules.status : null,
+             typeof teamRules.at === "string" ? teamRules.at : null,
+             typeof teamRules.reason === "string" ? teamRules.reason : null],
+          );
+        }
         if (host || proc) {
           db.run(
             `INSERT INTO agent_telemetry (id, network_id, resume_id, alias, hostname, ip, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, created_at)
@@ -4081,7 +4104,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "tail_node_logs",
-    "Ask a node for the tail of its own agent-node run log (read-only, redacted on the node before it leaves). No path argument: the node reads only its own log directory. User logins only; the node's owner or a network owner/admin. Poll get_rules_file_result — content is JSON {files, lines:[{ts, level, text, key}], truncated, matched, now_ts}; it is handed out once and then purged.",
+    "Tail of a node's own agent-node run log (read-only, redacted on the node). No path argument: it reads only its own log directory. User logins only (node owner or network owner/admin). Poll get_rules_file_result; JSON {files, lines, truncated, matched}; handed out once, then purged.",
     {
       ...NODE_ID_ALIAS_FIELDS,
       alias: z.string().min(1).max(200).optional().describe("Alias instead of node_id (a node, or a session reporting logs_capable)."),
@@ -6893,7 +6916,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "projects_list",
-    "List requirement projects in your network (id, name, color, sort, archived). Node (Agent) tokens can only read projects; creating / changing them (projects_create / projects_update) needs a person's token.",
+    "List requirement projects (id, name, color, sort, archived, parentId). node tokens can only read projects; creating / changing needs a person's token (projects_create / projects_update).",
     { network_id: z.string().max(200).optional() },
     async ({ network_id }) => requirementsCall("GET", "/api/requirements/projects", network_id),
   );
@@ -6903,19 +6926,20 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // write access and is refused to 「仅相关任务」(task-scoped) members; events use the task list's visibility.
   server.tool(
     "projects_create",
-    "Create a requirement project in your network (same as 管理项目 → 新建 in the app). name 1–40 characters, unique in the network; color #RRGGBB (default: next palette colour); sort integer. Returns { project }. Needs a person's token: node (Agent) tokens can only read projects (403 user_token_required). Also refused (403) for task-scoped members and read-only roles.",
+    "Create a requirement project (管理项目 → 新建). name 1–40, unique; color #RRGGBB; sort int; parent_id optional (≤3 levels). Returns { project }. node tokens can only read projects (403 user_token_required); task-scoped / read-only members are refused.",
     {
       network_id: z.string().max(200).optional(),
       name: z.string().min(1).max(40),
       color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
       sort: z.number().int().optional(),
+      parent_id: z.string().max(200).nullable().optional(),
     },
-    async (args) => requirementsCall("POST", "/api/requirements/projects", args.network_id, pick(args, ["name", "color", "sort"])),
+    async (args) => requirementsCall("POST", "/api/requirements/projects", args.network_id, pick(args, ["name", "color", "sort", "parent_id"])),
   );
 
   server.tool(
     "projects_update",
-    "Rename, recolour, reorder, archive or unarchive a requirement project (same as 管理项目 in the app). Only the fields you pass change. archived=true hides it from pickers (its tasks keep project_id); archived=false brings it back. Returns { project }. Needs a person's token: node (Agent) tokens can only read projects (403 user_token_required). Also refused (403) for task-scoped members and read-only roles.",
+    "Rename, recolour, reorder, archive/unarchive, or move a project under another (parent_id; null = top level, cycles / depth>3 refused). Only the fields you pass change; archived hides it from pickers. Returns { project }. node tokens can only read projects (403); task-scoped / read-only members refused.",
     {
       network_id: z.string().max(200).optional(),
       id: z.string().min(1).max(200).describe("project id (proj_…), from projects_list"),
@@ -6923,8 +6947,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
       sort: z.number().int().optional(),
       archived: z.boolean().optional(),
+      parent_id: z.string().max(200).nullable().optional(),
     },
-    async (args) => requirementsCall("PATCH", `/api/requirements/projects/${encodeURIComponent(args.id)}`, args.network_id, pick(args, ["name", "color", "sort", "archived"])),
+    async (args) => requirementsCall("PATCH", `/api/requirements/projects/${encodeURIComponent(args.id)}`, args.network_id, pick(args, ["name", "color", "sort", "archived", "parent_id"])),
   );
 
   // #476 —— 不带 requirement_id 的全网动态默认 50 条(REST 默认 200 不变,App 走 REST);严格参数同 #471。