@sleep2agi/commhub-server 0.9.0-preview.20 → 0.9.0-preview.22

package/src/config-apply-validate.ts

@@ -57,6 +57,35 @@ export const RESTART_REQUIRED_FLAGS = new Set<string>([
   "timeout",
 ]);
 
+/**
+ * Channels the dashboard may enable/disable on a node via
+ * update_node_config. Intentionally narrow — the panel only exposes
+ * enable/disable, per-channel secrets stay in the node's local
+ * config.json (see #260 wire discipline).
+ *
+ * The list mirrors agent-node's actual runtime capability. See
+ * agent-node/src/cli.ts:671-676 — CHANNELS are parsed into per-type
+ * worker inits (initTelegramChannel + initFeishuChannel), and any
+ * other channel type triggers `process.exit(1)` at boot. So the
+ * hub-side allow-list here is telegram + feishu ONLY. `commhub` is
+ * the RPC transport that every node speaks unconditionally; treating
+ * it as a per-node channel would be a UX lie (toggle looks off but
+ * commhub is always on).
+ *
+ * Dashboard PR #31 currently includes `commhub` in its own
+ * EDITABLE_CHANNELS whitelist — that follow-up narrowing is filed for
+ * the next dashboard rally, and until then hub silently drops any
+ * `commhub` entry via narrowChannelsPatch.
+ *
+ * Not part of SECURITY_SENSITIVE_FLAGS (通信龙 P5 派工): flipping a
+ * channel on/off is a lifecycle-tier operation like `restart_node`, not
+ * a privilege elevation. Cross-tenant reach is already gated by SEC-1.
+ */
+export const EDITABLE_CHANNELS = new Set<string>([
+  "telegram",
+  "feishu",
+]);
+
 /**
  * Role-gate for the patch's flag set. SEC-2 enforcement lives here.
  *
@@ -99,22 +128,53 @@ export function isAllowedToChangeFlag(
 
 /**
  * Classify the patch's required apply mode. Empty patch (model + flags
- * both empty) → "restart_only" (used by restart_node tool). Any
- * restart-required field present → "restart". Otherwise → "hot".
+ * both empty, no channels) → "restart_only" (used by restart_node tool).
+ * Any restart-required field present, OR a channels change → "restart"
+ * (channels is restart-tier by design: the node reads its channel set
+ * once at boot in agent-node/src/cli.ts and forks per-channel workers
+ * from it, so a channel enable/disable takes effect on process restart
+ * only — see #260 P5 wire discipline). Otherwise → "hot".
  */
 export function computeApplyMode(
   model: string | undefined,
   flags: Record<string, unknown>,
+  channels?: string[] | undefined,
 ): "hot" | "restart" | "restart_only" {
-  const fieldCount = (model !== undefined ? 1 : 0) + Object.keys(flags).length;
+  const fieldCount = (model !== undefined ? 1 : 0) + Object.keys(flags).length + (channels !== undefined ? 1 : 0);
   if (fieldCount === 0) return "restart_only";
   if (model !== undefined) return "restart";
+  if (channels !== undefined) return "restart";
   for (const key of Object.keys(flags)) {
     if (RESTART_REQUIRED_FLAGS.has(key)) return "restart";
   }
   return "hot";
 }
 
+/**
+ * Narrow + allow-list `channels` from untrusted patch JSON. Returns the
+ * final channel key list (case-folded, deduped, in EDITABLE_CHANNELS
+ * order-preserving), OR null if the input isn't an array. Non-strings,
+ * unknown keys, empty strings, and duplicates are silently dropped —
+ * same fail-shape as the dashboard route's whitelist so the two sides
+ * behave identically end-to-end. Callers pass `undefined` through when
+ * the patch didn't include a channels key at all (a distinct case from
+ * `channels: []` which means "disable all editable channels").
+ */
+export function narrowChannelsPatch(raw: unknown): string[] | null {
+  if (!Array.isArray(raw)) return null;
+  const allow = EDITABLE_CHANNELS;
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const v of raw) {
+    if (typeof v !== "string") continue;
+    const key = v.trim().toLowerCase();
+    if (!allow.has(key) || seen.has(key)) continue;
+    seen.add(key);
+    out.push(key);
+  }
+  return out;
+}
+
 /**
  * Validate the patch shape — allowlist + per-field range / enum. Returns
  * null on pass, or `{ field, reason }` on reject. Caller wraps in error
@@ -123,12 +183,30 @@ export function computeApplyMode(
 export function validatePatch(
   model: string | undefined,
   flags: Record<string, unknown>,
+  channels?: string[] | undefined,
 ): { field: string; reason: string } | null {
   if (model !== undefined) {
     if (typeof model !== "string" || model.length === 0 || model.length > 200) {
       return { field: "model", reason: "must be a non-empty string ≤ 200 chars" };
     }
   }
+  if (channels !== undefined) {
+    // Zod already enforced string[], and narrowChannelsPatch dropped
+    // unknown keys before this point — but re-verify defensively so a
+    // future caller that skips narrowChannelsPatch can't smuggle
+    // unknown keys through validatePatch alone.
+    if (!Array.isArray(channels)) {
+      return { field: "channels", reason: "must be an array of strings" };
+    }
+    for (const c of channels) {
+      if (typeof c !== "string") {
+        return { field: "channels", reason: "must contain only strings" };
+      }
+      if (!EDITABLE_CHANNELS.has(c)) {
+        return { field: `channels.${c}`, reason: "not in editable channels allowlist" };
+      }
+    }
+  }
   for (const [key, val] of Object.entries(flags)) {
     if (!ALLOWED_FLAGS.has(key)) {
       return { field: `flags.${key}`, reason: "not in allowlist" };

package/src/db.ts

@@ -338,6 +338,16 @@ try {
   if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
 }
 
+// #462 — user-set custom avatar (nullable http/https image URL). Pure
+// display attribute: deliberately NOT part of the RFC-024 config-apply
+// pipeline (nothing for agent-node to consume, no revision/ack). Written
+// only via PUT /api/nodes/:ref/avatar which validates the URL shape.
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN avatar_url TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
 // RFC-027 §2 — stop/delete request envelope. Mirrors
 // node_create_requests structure so the daemon-side pull/ack pattern
 // is symmetric with create_node. action='stop'|'delete' picks which

package/src/health-redaction.test.ts

@@ -0,0 +1,176 @@
+// #473 — /health information-leak redaction.
+//
+// Public-hub audit (通信龙, 2026-07-30) showed anonymous GET /health
+// returning the full SSE key breakdown: `{networkId}:{alias}` for every
+// live connection — network id + all 95 agent aliases on the audited
+// hub. The fix keeps /health anonymous (HARD CONSTRAINT: the central
+// watchdog curls it every minute; auth here would blind it) but strips
+// the per-key detail down to aggregate counts; the detail moved behind
+// auth at GET /api/stats/sse (master token or admin only).
+//
+// Witnessed-red: on pre-fix main (8c11edf5) the "no leak" test below is
+// red — the /health body contains the connected alias and network id.
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+
+const SERVER_DB = mkdtempSync(join(tmpdir(), "anet-health-red-db-")) + "/commhub.db";
+
+let BASE = "";
+let server: any = null;
+let sseReader: ReadableStreamDefaultReader<Uint8Array> | null = null;
+
+let userToken = "";
+let userNetworkId = "";
+let userName = "";
+let adminToken = "";
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || SERVER_DB;
+  process.env.HOST = "127.0.0.1";
+
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const pw = "BootstrapPw123Aa!";
+
+  // Burn a seed registration first so our member is NOT auto-admin (the
+  // "first registered user → admin" rule only bites when this suite owns
+  // the DB; per-file runs need this guard). We set roles explicitly below.
+  register(`health_seed_${suffix}`, pw, undefined, "seed");
+
+  userName = `health_user_${suffix}`;
+  const r = register(userName, pw, undefined, "seed");
+  if (!r.ok || !r.token) throw new Error("register failed: " + JSON.stringify(r));
+  userToken = r.token;
+  userNetworkId = r.network_id ?? "";
+  if (!userNetworkId) throw new Error("no network for user");
+  // Pin to plain member — defend against any residual auto-admin.
+  db.run("UPDATE users SET role = 'user' WHERE username = ?1", [userName]);
+
+  const adminName = `health_admin_${suffix}`;
+  const a = register(adminName, pw, undefined, "seed");
+  if (!a.ok || !a.token) throw new Error("admin register failed: " + JSON.stringify(a));
+  adminToken = a.token;
+  // Explicit promotion — "first registered user is auto-admin" does not
+  // hold in aggregate runs (see api-host-supervisors-fallback.test.ts).
+  db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [adminName]);
+
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+
+  // Open a real SSE connection so the stats have a key that WOULD leak:
+  // the dashboard-user channel (sessionName === own username, Path 3
+  // gate 4a) registers `${networkId}:${username}` in the clients map.
+  const res = await fetch(`${BASE}/events/${encodeURIComponent(userName)}?network_id=${userNetworkId}`, {
+    headers: { Authorization: `Bearer ${userToken}` },
+  });
+  if (res.status !== 200) throw new Error("SSE subscribe failed: " + res.status);
+  sseReader = res.body!.getReader();
+  await sseReader.read(); // consume the connected frame → registration done
+});
+
+afterAll(() => {
+  try { sseReader?.cancel(); } catch {}
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(SERVER_DB, { recursive: true, force: true }); } catch {}
+});
+
+describe("#473 anonymous /health — watchdog contract intact, no topology leak", () => {
+  test("stays anonymous 200 with parseable aggregates (watchdog judge: curl -sf gets 2xx)", async () => {
+    const res = await fetch(`${BASE}/health`);
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.ok).toBe(true);
+    expect(typeof body.version).toBe("string");
+    expect(typeof body.sessions_count).toBe("number");
+    expect(typeof body.sse_connections).toBe("number");
+    expect(body.sse_connections).toBeGreaterThanOrEqual(1);
+  });
+
+  test("CLI count source stays truthful: health.sse_connections == /api/stats/sse total (no fake 0)", async () => {
+    // The CLI's `anet doctor` line reads health.sse_connections now
+    // (was Object.keys(sse_sessions).length). This pins that aggregate to
+    // the same number the auth-gated detail endpoint reports — so a live
+    // hub with N connections shows N, never the "0 active" regression the
+    // review caught. There is exactly one live SSE connection in setup.
+    const health = await (await fetch(`${BASE}/health`)).json() as any;
+    const detail = await (await fetch(`${BASE}/api/stats/sse`, { headers: { Authorization: `Bearer ${adminToken}` } })).json() as any;
+    expect(health.sse_connections).toBe(detail.total);
+    expect(health.sse_connections).toBeGreaterThanOrEqual(1);
+  });
+
+  test("does NOT expose SSE key detail: no sse_sessions field, no alias, no network id", async () => {
+    const res = await fetch(`${BASE}/health`);
+    const text = await res.text();
+    const body = JSON.parse(text);
+    expect("sse_sessions" in body).toBe(false);
+    // The live connection's identifying strings must not appear anywhere
+    // in the anonymous body.
+    expect(text).not.toContain(userName);
+    expect(text).not.toContain(userNetworkId);
+  });
+});
+
+describe("#473 GET /api/stats/sse — detail survives, behind ops auth", () => {
+  test("anonymous → 401", async () => {
+    const res = await fetch(`${BASE}/api/stats/sse`);
+    expect(res.status).toBe(401);
+  });
+
+  test("regular member token → 403 (detail spans every network)", async () => {
+    const res = await fetch(`${BASE}/api/stats/sse`, { headers: { Authorization: `Bearer ${userToken}` } });
+    expect(res.status).toBe(403);
+  });
+
+  test("admin → 200 with the full key breakdown (ops capability preserved)", async () => {
+    const res = await fetch(`${BASE}/api/stats/sse`, { headers: { Authorization: `Bearer ${adminToken}` } });
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.ok).toBe(true);
+    expect(typeof body.total).toBe("number");
+    expect(body.sessions[`${userNetworkId}:${userName}`]).toBeGreaterThanOrEqual(1);
+  });
+
+  test("legacy master token → 200 (ops path — restAuth null, isLegacyAuthToken)", () => {
+    // COMMHUB_AUTH_TOKEN is captured at module import, so this path needs
+    // a fresh process with the env set before boot (aggregate order can't
+    // guarantee this file imports server.ts first). Subprocess, like the
+    // patrol test. Reviewer flagged this path had code but no test.
+    const script = `
+      process.env.COMMHUB_AUTH_TOKEN = "master-secret-xyz";
+      const { startHub } = await import("./src/server.js");
+      const hub = startHub({ port: 0, hostname: "127.0.0.1" });
+      const base = "http://127.0.0.1:" + hub.port;
+      const anon = await fetch(base + "/api/stats/sse");
+      const master = await fetch(base + "/api/stats/sse", { headers: { Authorization: "Bearer master-secret-xyz" } });
+      const health = await fetch(base + "/health");
+      const hb = await health.json();
+      console.log("RESULT:" + JSON.stringify({
+        anon: anon.status,
+        master: master.status,
+        masterOk: (await master.json()).ok,
+        healthHasSseSessions: "sse_sessions" in hb,
+      }));
+      hub.stop(true);
+      process.exit(0);
+    `;
+    const child = Bun.spawnSync({
+      cmd: ["bun", "-e", script],
+      cwd: `${import.meta.dir}/..`,
+      env: { ...process.env, COMMHUB_DB: process.env.COMMHUB_DB || "/tmp/anet-473-master.db" },
+      timeout: 15_000,
+    });
+    const out = new TextDecoder().decode(child.stdout);
+    const m = out.match(/RESULT:(\{.*\})/);
+    expect(m).not.toBeNull();
+    const r = JSON.parse(m![1]);
+    expect(r.anon).toBe(401);        // token configured → anonymous rejected
+    expect(r.master).toBe(200);      // legacy master token → ops access
+    expect(r.masterOk).toBe(true);
+    expect(r.healthHasSseSessions).toBe(false); // /health still redacted with a token set
+  }, 20_000);
+});