@sleep2agi/commhub-server 0.9.0-preview.2 → 0.9.0-preview.21

package/src/update-provider.test.ts

@@ -0,0 +1,234 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import {
+  validateBaseUrl,
+  ProbeValidationError,
+} from "./probe-validate.js";
+
+// RFC-028 P1.5 — update_provider invariants. Tests the building blocks
+// the MCP handler relies on:
+//   - SQL-level SEC-1 (provider_id × network_id uniqueness across tenants)
+//   - audit_log row written for every update
+//   - validateBaseUrl re-runs against vendor from DB (not patch) on
+//     base_url change → vendor immutability bypass attempt fails
+//   - patch-empty noop path
+//   - DELETE FROM provider_models + INSERT replacement is atomic
+//
+// Boundary behaviour (zod-strict patch wrapper, MCP -32602 on extras,
+// admin gate, cross-tenant rejection) is covered by the docker e2e
+// (qa-rfc028-update-provider). The unit layer focuses on the impl
+// guarantees that survive even if the MCP boundary changes.
+
+const NET_A = "net_test_pa_alpha";
+const NET_B = "net_test_pa_beta";
+const PROV_A = "prov_test_p15_alpha";
+const PROV_B = "prov_test_p15_beta";
+
+beforeEach(() => {
+  for (const p of [PROV_A, PROV_B]) {
+    try { db.run("DELETE FROM provider_models WHERE provider_id = ?1", [p]); } catch {}
+    try { db.run("DELETE FROM providers WHERE provider_id = ?1", [p]); } catch {}
+  }
+  try { db.run("DELETE FROM audit_log WHERE target_id IN (?1, ?2)", [PROV_A, PROV_B]); } catch {}
+});
+
+afterAll(() => {
+  for (const p of [PROV_A, PROV_B]) {
+    try { db.run("DELETE FROM provider_models WHERE provider_id = ?1", [p]); } catch {}
+    try { db.run("DELETE FROM providers WHERE provider_id = ?1", [p]); } catch {}
+  }
+  try { db.run("DELETE FROM audit_log WHERE target_id IN (?1, ?2)", [PROV_A, PROV_B]); } catch {}
+});
+
+function seedProvider(provider_id: string, network_id: string, opts: Partial<{ name: string; vendor: string; base_url: string; enabled: number }> = {}) {
+  db.run(
+    `INSERT INTO providers (provider_id, network_id, name, vendor, base_url, secret_key_ref, created_at, created_by, enabled)
+     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)`,
+    [provider_id, network_id, opts.name ?? "anthro-prod", opts.vendor ?? "anthropic",
+     opts.base_url ?? "https://api.anthropic.com", "ANTHROPIC_API_KEY",
+     Date.now(), "test", opts.enabled ?? 1],
+  );
+}
+
+describe("update_provider — SQL invariants (RFC-028 P1.5)", () => {
+  test("SEC-1: provider_id is unique-per-network — netA query for netB provider_id returns nothing", () => {
+    seedProvider(PROV_A, NET_A);
+    seedProvider(PROV_B, NET_B);
+    // The handler's lookup query: SELECT ... WHERE provider_id = ? AND network_id = ?
+    const fromNetA = db.get<any>(
+      "SELECT provider_id FROM providers WHERE provider_id = ?1 AND network_id = ?2",
+      PROV_B, NET_A,
+    );
+    expect(fromNetA == null).toBe(true);
+    // Sanity: PROV_B does exist in its own network
+    const fromNetB = db.get<any>(
+      "SELECT provider_id FROM providers WHERE provider_id = ?1 AND network_id = ?2",
+      PROV_B, NET_B,
+    );
+    expect(fromNetB?.provider_id).toBe(PROV_B);
+  });
+
+  test("vendor immutability via validateBaseUrl: changing base_url uses DB vendor, attempt to widen via patched vendor fails", () => {
+    seedProvider(PROV_A, NET_A, { vendor: "anthropic" });
+    // Handler reads vendor from DB row, NOT from patch. Suppose patch tried
+    // to set vendor=evil + base_url=https://attacker.example.com — the
+    // handler ignores the vendor from patch (it's not a field in the
+    // zod patch schema), and validateBaseUrl runs with vendor='anthropic'
+    // from the DB, so the host check is applied.
+    const dbVendor = db.get<{vendor: string}>("SELECT vendor FROM providers WHERE provider_id = ?1", PROV_A)!.vendor;
+    expect(dbVendor).toBe("anthropic");
+    // attempting to use base_url not in anthropic allowlist fails
+    expect(() => validateBaseUrl(dbVendor, "https://attacker.example.com")).toThrow(ProbeValidationError);
+    expect(() => validateBaseUrl(dbVendor, "https://attacker.example.com")).toThrow(/probe_target_forbidden/);
+    // valid anthropic host passes
+    expect(() => validateBaseUrl(dbVendor, "https://api.anthropic.com/v1")).not.toThrow();
+  });
+
+  test("patch noop: enabled set to same value → SET clause skipped", () => {
+    seedProvider(PROV_A, NET_A, { enabled: 1 });
+    const before = db.get<{enabled: number}>("SELECT enabled FROM providers WHERE provider_id = ?1", PROV_A)!.enabled;
+    expect(before).toBe(1);
+    // simulate the handler's diff logic: if patch.enabled === row.enabled, skip
+    const newEnabled = true ? 1 : 0;
+    const shouldUpdate = newEnabled !== before;
+    expect(shouldUpdate).toBe(false);
+    // verify no SET ran (row unchanged)
+    const after = db.get<{enabled: number}>("SELECT enabled FROM providers WHERE provider_id = ?1", PROV_A)!.enabled;
+    expect(after).toBe(1);
+  });
+
+  test("enabled toggle 1→0 written + audit log row created in same transaction", () => {
+    seedProvider(PROV_A, NET_A, { enabled: 1 });
+    db.exec("BEGIN");
+    db.run("UPDATE providers SET enabled = 0 WHERE provider_id = ?1", [PROV_A]);
+    db.run(
+      `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+       VALUES (?1, ?2, 'update_provider', 'provider', ?3, ?4, ?5)`,
+      ["u_test", "test", PROV_A, JSON.stringify({ diff: { enabled: { before: true, after: false } } }), NET_A],
+    );
+    db.exec("COMMIT");
+    expect(db.get<{enabled:number}>("SELECT enabled FROM providers WHERE provider_id = ?1", PROV_A)?.enabled).toBe(0);
+    const audit = db.get<any>("SELECT action, target_id, detail FROM audit_log WHERE target_id = ?1 AND action = 'update_provider'", PROV_A);
+    expect(audit?.action).toBe("update_provider");
+    expect(audit?.target_id).toBe(PROV_A);
+    expect(JSON.parse(audit!.detail).diff.enabled.after).toBe(false);
+  });
+
+  test("audit detail does NOT contain secret_key_ref VALUE under any patch", () => {
+    seedProvider(PROV_A, NET_A);
+    // Even if an attacker tried to slip secret into the diff (impossible
+    // through the schema, but defense-in-depth), the audit serializer
+    // only includes the fields actually in `diff`. Secret isn't a patch
+    // field, so it can't reach the diff. Verify the absence:
+    const auditPayload = JSON.stringify({ diff: { name: { before: "old", after: "new" } } });
+    expect(auditPayload).not.toContain("secret");
+    expect(auditPayload).not.toContain("ANTHROPIC_API_KEY");
+    expect(auditPayload).not.toContain("sk-");
+  });
+
+  test("provider_models DELETE+INSERT atomicity (transaction wraps both)", () => {
+    seedProvider(PROV_A, NET_A);
+    db.run(
+      `INSERT INTO provider_models (model_id, provider_id, model_name, enabled, created_at)
+       VALUES ('pm_old1', ?1, 'claude-old-1', 1, ?2), ('pm_old2', ?1, 'claude-old-2', 1, ?2)`,
+      [PROV_A, Date.now()],
+    );
+    expect(db.all("SELECT model_id FROM provider_models WHERE provider_id = ?1", PROV_A).length).toBe(2);
+    // Replace in one transaction
+    db.exec("BEGIN");
+    db.run("DELETE FROM provider_models WHERE provider_id = ?1", [PROV_A]);
+    db.run(
+      `INSERT INTO provider_models (model_id, provider_id, model_name, enabled, created_at)
+       VALUES ('pm_new1', ?1, 'claude-new-1', 1, ?2)`,
+      [PROV_A, Date.now()],
+    );
+    db.exec("COMMIT");
+    const rows = db.all<{model_name: string}>("SELECT model_name FROM provider_models WHERE provider_id = ?1", PROV_A);
+    expect(rows.length).toBe(1);
+    expect(rows[0].model_name).toBe("claude-new-1");
+  });
+
+  test("base_url change rejected via validateBaseUrl when host not in vendor allowlist", () => {
+    seedProvider(PROV_A, NET_A, { vendor: "anthropic" });
+    const vendor = db.get<{vendor: string}>("SELECT vendor FROM providers WHERE provider_id = ?1", PROV_A)!.vendor;
+    // any host other than api.anthropic.com is rejected
+    expect(() => validateBaseUrl(vendor, "https://api.openai.com")).toThrow(/probe_target_forbidden/);
+    expect(() => validateBaseUrl(vendor, "https://169.254.169.254/v1")).toThrow(/probe_target_forbidden/);
+    expect(() => validateBaseUrl(vendor, "http://api.anthropic.com")).toThrow(/probe_base_url_invalid/);
+  });
+
+  test("provider_disabled error distinct from provider_not_found in probe lookup", () => {
+    seedProvider(PROV_A, NET_A, { enabled: 0 });
+    // The new probe handler does the lookup WITHOUT enabled filter, then
+    // checks .enabled — distinguishing not_found vs disabled.
+    const row = db.get<{enabled: number}>("SELECT enabled FROM providers WHERE provider_id = ?1 AND network_id = ?2", PROV_A, NET_A);
+    expect(row).toBeTruthy();
+    expect(row!.enabled).toBe(0);
+    // dashboard renders different message for these two cases
+  });
+
+  test("no-op same-value patch: NO audit_log row written (通信牛 nit)", () => {
+    // Regression for the post-merge fix: when patch fields all match the
+    // existing row (e.g. dashboard saves an unchanged form), the handler
+    // must early-return WITHOUT inserting an empty-diff audit row.
+    // Empty audit rows pollute the trail and make `forced_*` / sensitive
+    // actions harder to find.
+    seedProvider(PROV_A, NET_A, { name: "same-name", enabled: 1 });
+    const auditBefore = db.get<{n:number}>(
+      "SELECT COUNT(*) AS n FROM audit_log WHERE target_id = ?1 AND action = 'update_provider'",
+      PROV_A,
+    )!.n;
+
+    // Mirror the handler's diff-check logic on a same-value patch
+    const row = db.get<{name:string, enabled:number, base_url:string}>(
+      "SELECT name, enabled, base_url FROM providers WHERE provider_id = ?1", PROV_A,
+    )!;
+    const patch = { name: "same-name", enabled: true };
+    const sets: string[] = [];
+    if (patch.name !== undefined && patch.name !== row.name) sets.push("name");
+    if (patch.enabled !== undefined && (patch.enabled ? 1 : 0) !== row.enabled) sets.push("enabled");
+    const willReplaceModels = false;   // no patch.models
+
+    // sets MUST be empty for a same-value patch
+    expect(sets.length).toBe(0);
+    expect(willReplaceModels).toBe(false);
+
+    // Handler returns here WITHOUT writing audit_log → count unchanged
+    const auditAfter = db.get<{n:number}>(
+      "SELECT COUNT(*) AS n FROM audit_log WHERE target_id = ?1 AND action = 'update_provider'",
+      PROV_A,
+    )!.n;
+    expect(auditAfter).toBe(auditBefore);
+    expect(auditAfter).toBe(0);
+  });
+
+  test("real change DOES write audit_log row (positive guard for the early-return)", () => {
+    // Belt-and-suspenders: no-op early-return MUST NOT trigger when even
+    // one field actually changes. Otherwise we'd silently lose audit
+    // coverage for real updates.
+    seedProvider(PROV_A, NET_A, { name: "old-name", enabled: 1 });
+    const row = db.get<{name:string, enabled:number}>(
+      "SELECT name, enabled FROM providers WHERE provider_id = ?1", PROV_A,
+    )!;
+    const patch = { name: "new-name", enabled: true };
+    const sets: string[] = [];
+    if (patch.name !== undefined && patch.name !== row.name) sets.push("name");
+    if (patch.enabled !== undefined && (patch.enabled ? 1 : 0) !== row.enabled) sets.push("enabled");
+    expect(sets).toEqual(["name"]);
+
+    db.exec("BEGIN");
+    db.run("UPDATE providers SET name = ?1 WHERE provider_id = ?2", ["new-name", PROV_A]);
+    db.run(
+      `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+       VALUES (?1, ?2, 'update_provider', 'provider', ?3, ?4, ?5)`,
+      ["u_test", "test", PROV_A, JSON.stringify({ diff: { name: { before: "old-name", after: "new-name" } }, fields_changed: ["name"] }), NET_A],
+    );
+    db.exec("COMMIT");
+
+    const audit = db.get<any>(
+      "SELECT detail FROM audit_log WHERE target_id = ?1 AND action = 'update_provider' ORDER BY id DESC LIMIT 1",
+      PROV_A,
+    )!;
+    expect(JSON.parse(audit.detail).fields_changed).toEqual(["name"]);
+  });
+});

package/src/uploads.test.ts

@@ -312,3 +312,69 @@ describe("indexEntryPath", () => {
     expect(p).toBe(`/srv/up/.index/${id}.json`);
   });
 });
+
+import { stripHostLocalPathsForCrossHostSafe } from "./uploads";
+
+describe("stripHostLocalPathsForCrossHostSafe (#222 cross-host attachment safety)", () => {
+  test("strips path when file_id is present (cross-host safe — agent will fetch via /api/files/<id>)", () => {
+    const meta = {
+      attachments: [
+        { type: "file", file_id: "abc12345", path: "/home/hub/uploads/abc12345.png", mime: "image/png" },
+      ],
+      otherKey: "preserved",
+    };
+    const out = stripHostLocalPathsForCrossHostSafe(meta);
+    expect(out.attachments[0]).toEqual({ type: "file", file_id: "abc12345", mime: "image/png" });
+    expect(out.attachments[0].path).toBeUndefined();
+    expect(out.otherKey).toBe("preserved");
+  });
+
+  test("PRESERVES path when file_id is absent (feishu single-host fallback)", () => {
+    // 🔴 通信龙 PR #222 pre-review nit — feishu-bridge ships path-only
+    // attachments (writes /work/feishu-attachments/...). If we strip
+    // unconditionally those break too. Lock the conditional contract.
+    const meta = {
+      attachments: [
+        { type: "file", path: "/work/feishu-attachments/feishu-local/oc_xxx/img.jpg", mime: "image/jpeg" },
+      ],
+    };
+    const out = stripHostLocalPathsForCrossHostSafe(meta);
+    expect(out.attachments[0].path).toBe("/work/feishu-attachments/feishu-local/oc_xxx/img.jpg");
+    expect(out.attachments[0].file_id).toBeUndefined();
+  });
+
+  test("mixed array: strips path on entries with file_id, preserves on path-only entries", () => {
+    const meta = {
+      attachments: [
+        { type: "file", file_id: "id1xxxxx", path: "/hub/local/id1.png", mime: "image/png" },
+        { type: "file", path: "/work/feishu-attachments/x.jpg", mime: "image/jpeg" },
+        { type: "file", file_id: "id2yyyyy", mime: "image/gif" },                            // already path-free
+      ],
+    };
+    const out = stripHostLocalPathsForCrossHostSafe(meta);
+    expect(out.attachments[0]).toEqual({ type: "file", file_id: "id1xxxxx", mime: "image/png" });
+    expect(out.attachments[1]).toEqual({ type: "file", path: "/work/feishu-attachments/x.jpg", mime: "image/jpeg" });
+    expect(out.attachments[2]).toEqual({ type: "file", file_id: "id2yyyyy", mime: "image/gif" });
+  });
+
+  test("no-op when meta has no attachments array", () => {
+    const meta = { something: "else" };
+    expect(stripHostLocalPathsForCrossHostSafe(meta)).toBe(meta);
+  });
+
+  test("no-op when nothing to strip (returns SAME object reference, not a copy)", () => {
+    const meta = { attachments: [{ type: "file", file_id: "x12345xx", mime: "image/png" }] };
+    expect(stripHostLocalPathsForCrossHostSafe(meta)).toBe(meta);
+  });
+
+  test("handles null / non-object meta gracefully", () => {
+    expect(stripHostLocalPathsForCrossHostSafe(null)).toBe(null);
+    expect(stripHostLocalPathsForCrossHostSafe(undefined as any)).toBe(undefined);
+    expect(stripHostLocalPathsForCrossHostSafe("string" as any)).toBe("string");
+  });
+
+  test("handles non-array attachments field gracefully", () => {
+    const meta = { attachments: "not-an-array" };
+    expect(stripHostLocalPathsForCrossHostSafe(meta)).toBe(meta);
+  });
+});

package/src/uploads.ts

@@ -241,6 +241,42 @@ export type TaskAttachment = {
   size?: number;
 };
 
+/**
+ * #222 cross-host attachment safety — strip `path` from meta.attachments
+ * entries that ALSO carry a `file_id`. Reason: the hub's /api/upload
+ * returns `{file_id, path}` where `path` is a hub-machine-local
+ * absolute path. Senders sometimes echo `path` back into meta.attachments.
+ * When the receiving agent runs on a different host (Vincent 2026-06-30
+ * toodadev2 case), that path string is meaningless. agent-node's
+ * fetch-attachment.ts will fetch via `file_id` regardless, but leaving
+ * the stale `path` in the JSON misleads any tooling that reads it.
+ *
+ * CRITICAL — conditional, not unconditional (通信龙 PR #222 pre-review
+ * nit): feishu-bridge currently writes `/work/feishu-attachments/<conn>/
+ * <chat>/` directly and ships path-only attachments (NO file_id). If we
+ * strip path unconditionally those break too. Only strip when file_id
+ * is present (the "safe to drop" signal). Single-host feishu fallback
+ * preserved.
+ *
+ * Shared by tools.ts (MCP send_task) and index.ts (REST /api/task) so
+ * both transports apply the same sanitization to meta.
+ */
+export function stripHostLocalPathsForCrossHostSafe(meta: any): any {
+  if (!meta || typeof meta !== "object") return meta;
+  if (!Array.isArray((meta as any).attachments)) return meta;
+  let mutated = false;
+  const sanitized = (meta as any).attachments.map((a: any) => {
+    if (a && typeof a === "object" && typeof a.file_id === "string" && a.file_id && typeof a.path === "string") {
+      mutated = true;
+      const { path: _stripped, ...rest } = a;
+      return rest;
+    }
+    return a;
+  });
+  if (!mutated) return meta;
+  return { ...meta, attachments: sanitized };
+}
+
 /** Light validator usable from the REST handler. Returns null on success or an error message string. */
 export function validateAttachments(input: unknown): { ok: true; attachments: TaskAttachment[] } | { ok: false; error: string } {
   if (input === undefined || input === null) return { ok: true, attachments: [] };

package/src/vault.test.ts

@@ -0,0 +1,200 @@
+// RFC-028 P1 §4.1 vault layer tests. F2 lazy gate is the critical
+// invariant — existing prod hub升级 without ANET_HUB_SECRET_VAULT_KEY
+// must NOT boot-fail. Every test runs with deterministic key isolation.
+
+import { describe, expect, test, beforeEach, afterAll } from "bun:test";
+import {
+  encryptSecret, decryptSecret,
+  vaultUpsert, vaultGet, vaultListKeys, vaultDelete,
+  vaultStatusForBoot, vaultMasterKeyFingerprint,
+  _resetVaultKeyForTest, VaultError,
+} from "./vault.js";
+import { db } from "./db.js";
+
+const TEST_KEY_HEX = "0123456789abcdef".repeat(4);   // 32 bytes hex = 64 chars
+
+function setKey(hex: string | undefined): void {
+  if (hex === undefined) delete process.env.ANET_HUB_SECRET_VAULT_KEY;
+  else process.env.ANET_HUB_SECRET_VAULT_KEY = hex;
+  _resetVaultKeyForTest();
+}
+
+beforeEach(() => {
+  db.run("DELETE FROM network_secrets");
+  db.run("DELETE FROM provider_models");
+  db.run("DELETE FROM providers");
+});
+afterAll(() => { _resetVaultKeyForTest(); delete process.env.ANET_HUB_SECRET_VAULT_KEY; });
+
+describe("RFC-028 P1 §4.1 F2 — LAZY GATE (critical: don't brick prod hub)", () => {
+  test("hub boot WITHOUT env + WITHOUT vault data → vaultStatusForBoot says configured=false, needsKeyToOp=false (boots OK)", () => {
+    setKey(undefined);
+    const s = vaultStatusForBoot();
+    expect(s.configured).toBe(false);
+    expect(s.tablesHaveData).toBe(false);
+    expect(s.needsKeyToOp).toBe(false);
+    // Crucially: no throw, no crash, hub keeps running.
+  });
+
+  test("hub boot WITH env + WITHOUT vault data → configured=true, tablesEmpty (no fingerprint needed)", () => {
+    setKey(TEST_KEY_HEX);
+    const s = vaultStatusForBoot();
+    expect(s.configured).toBe(true);
+    expect(s.tablesHaveData).toBe(false);
+    expect(s.needsKeyToOp).toBe(false);
+  });
+
+  test("hub WITHOUT env + WITH vault data → needsKeyToOp=true (banner warning, NO throw)", () => {
+    setKey(TEST_KEY_HEX);
+    vaultUpsert("net_test", "TEST_KEY", "plaintext-value");
+    setKey(undefined);
+    const s = vaultStatusForBoot();
+    expect(s.configured).toBe(false);
+    expect(s.tablesHaveData).toBe(true);
+    expect(s.needsKeyToOp).toBe(true);
+    // Still no throw — banner is informational; throw only happens on
+    // actual vault op (test below).
+  });
+
+  test("vault op WITHOUT env throws vault_master_key_missing (lazy throw, not boot throw)", () => {
+    setKey(undefined);
+    expect(() => vaultUpsert("net_test", "K", "v")).toThrow(VaultError);
+    try { vaultUpsert("net_test", "K", "v"); }
+    catch (e: any) { expect(e.code).toBe("vault_master_key_missing"); }
+  });
+
+  test("vault op WITH invalid env (not 32 bytes hex) throws vault_master_key_invalid", () => {
+    setKey("not-hex");
+    expect(() => vaultUpsert("net_test", "K", "v")).toThrow(/vault_master_key_invalid/);
+    setKey("aabbcc");  // too short
+    expect(() => vaultUpsert("net_test", "K", "v")).toThrow(/vault_master_key_invalid/);
+  });
+});
+
+describe("RFC-028 P1 §4.1 — AES-GCM encrypt/decrypt round-trip", () => {
+  test("encrypt+decrypt roundtrip preserves plaintext", () => {
+    setKey(TEST_KEY_HEX);
+    const pt = "sk-ant-api03-abc123xyz";
+    const enc = encryptSecret(pt);
+    expect(enc.ciphertext.length).toBeGreaterThan(0);
+    expect(enc.iv.length).toBe(12);
+    expect(enc.tag.length).toBe(16);
+    expect(decryptSecret(enc)).toBe(pt);
+  });
+
+  test("ciphertext is unique per call (random IV)", () => {
+    setKey(TEST_KEY_HEX);
+    const a = encryptSecret("same-secret");
+    const b = encryptSecret("same-secret");
+    expect(a.iv.equals(b.iv)).toBe(false);
+    expect(a.ciphertext.equals(b.ciphertext)).toBe(false);
+    // Both decrypt back to same plaintext
+    expect(decryptSecret(a)).toBe("same-secret");
+    expect(decryptSecret(b)).toBe("same-secret");
+  });
+
+  test("tamper detection — flipping ciphertext bit throws vault_decrypt_failed", () => {
+    setKey(TEST_KEY_HEX);
+    const enc = encryptSecret("important");
+    enc.ciphertext[0] ^= 0x01;
+    expect(() => decryptSecret(enc)).toThrow(/vault_decrypt_failed/);
+  });
+
+  test("tamper detection — flipping tag bit throws vault_decrypt_failed", () => {
+    setKey(TEST_KEY_HEX);
+    const enc = encryptSecret("important");
+    enc.tag[0] ^= 0x01;
+    expect(() => decryptSecret(enc)).toThrow(/vault_decrypt_failed/);
+  });
+
+  test("wrong key cannot decrypt", () => {
+    setKey(TEST_KEY_HEX);
+    const enc = encryptSecret("important");
+    setKey("ff".repeat(32));  // different key
+    expect(() => decryptSecret(enc)).toThrow(/vault_decrypt_failed/);
+  });
+});
+
+describe("RFC-028 P1 §4.1 — DB ops + key listing (永不返 value)", () => {
+  test("vaultUpsert + vaultGet roundtrip via DB", () => {
+    setKey(TEST_KEY_HEX);
+    vaultUpsert("net_A", "ANTHROPIC_API_KEY", "sk-ant-prod-1");
+    expect(vaultGet("net_A", "ANTHROPIC_API_KEY")).toBe("sk-ant-prod-1");
+  });
+
+  test("vaultUpsert replaces existing key (same network_id + key)", () => {
+    setKey(TEST_KEY_HEX);
+    vaultUpsert("net_B", "K1", "v1");
+    vaultUpsert("net_B", "K1", "v2");
+    expect(vaultGet("net_B", "K1")).toBe("v2");
+  });
+
+  test("vaultGet returns null for missing key (does NOT throw)", () => {
+    setKey(TEST_KEY_HEX);
+    expect(vaultGet("net_X", "MISSING")).toBeNull();
+  });
+
+  test("vaultListKeys returns key NAMES only (no values, ever)", () => {
+    setKey(TEST_KEY_HEX);
+    vaultUpsert("net_L", "KEY_A", "value-a");
+    vaultUpsert("net_L", "KEY_B", "value-b");
+    const keys = vaultListKeys("net_L");
+    expect(keys).toEqual(["KEY_A", "KEY_B"]);  // sorted; no values
+    expect(JSON.stringify(keys)).not.toContain("value-a");
+    expect(JSON.stringify(keys)).not.toContain("value-b");
+  });
+
+  test("network isolation — netA's secret不 visible to netB", () => {
+    setKey(TEST_KEY_HEX);
+    vaultUpsert("net_A", "SHARED_NAME", "value-from-A");
+    vaultUpsert("net_B", "SHARED_NAME", "value-from-B");
+    expect(vaultGet("net_A", "SHARED_NAME")).toBe("value-from-A");
+    expect(vaultGet("net_B", "SHARED_NAME")).toBe("value-from-B");
+    expect(vaultListKeys("net_A")).toEqual(["SHARED_NAME"]);
+    expect(vaultListKeys("net_B")).toEqual(["SHARED_NAME"]);
+  });
+
+  test("vaultDelete removes key + returns true; second delete returns false", () => {
+    setKey(TEST_KEY_HEX);
+    vaultUpsert("net_D", "K", "v");
+    expect(vaultDelete("net_D", "K")).toBe(true);
+    expect(vaultGet("net_D", "K")).toBeNull();
+    expect(vaultDelete("net_D", "K")).toBe(false);  // no-op
+  });
+});
+
+describe("RFC-028 P1 §4.1 — master key fingerprint", () => {
+  test("fingerprint same for same key, different for different key", () => {
+    setKey(TEST_KEY_HEX);
+    const fp1 = vaultMasterKeyFingerprint();
+    expect(fp1.length).toBe(16);
+    setKey(TEST_KEY_HEX);  // re-set same key
+    expect(vaultMasterKeyFingerprint()).toBe(fp1);
+    setKey("ff".repeat(32));
+    expect(vaultMasterKeyFingerprint()).not.toBe(fp1);
+  });
+});
+
+describe("RFC-028 P1 §4.1 — DB ciphertext storage (PRAGMA-style: NO plaintext in DB)", () => {
+  test("BLOB stored is ciphertext, not plaintext (raw SELECT verifies)", () => {
+    setKey(TEST_KEY_HEX);
+    const plaintext = "sk-very-secret-key-do-not-leak";
+    vaultUpsert("net_P", "ANTHROPIC_API_KEY", plaintext);
+    const raw = db.get<{ ciphertext: Buffer | Uint8Array; iv: Buffer | Uint8Array; tag: Buffer | Uint8Array }>(
+      "SELECT ciphertext, iv, tag FROM network_secrets WHERE network_id = ?1 AND key = ?2",
+      "net_P", "ANTHROPIC_API_KEY",
+    );
+    expect(raw).not.toBeNull();
+    const ctBuf = Buffer.isBuffer(raw!.ciphertext) ? raw!.ciphertext : Buffer.from(raw!.ciphertext as any);
+    // Plaintext substring MUST NOT appear in ciphertext bytes
+    expect(ctBuf.toString("binary")).not.toContain(plaintext);
+    expect(ctBuf.toString("utf8")).not.toContain(plaintext);
+    // Even as hex / base64 / partial — bytes must not match plaintext bytes
+    const plainBytes = Buffer.from(plaintext, "utf8");
+    let found = false;
+    for (let i = 0; i <= ctBuf.length - plainBytes.length; i++) {
+      if (ctBuf.subarray(i, i + plainBytes.length).equals(plainBytes)) { found = true; break; }
+    }
+    expect(found).toBe(false);
+  });
+});