@sleep2agi/commhub-server 0.9.0-preview.24 → 0.9.0-preview.26

package/README.md

@@ -38,13 +38,16 @@ Once running:
 
 ## Pairs with
 
-| Package | Version |
+| Package | |
 |---|---|
-| [`@sleep2agi/agent-network`](https://www.npmjs.com/package/@sleep2agi/agent-network) | 2.1.7 |
-| [`@sleep2agi/agent-network-dashboard`](https://www.npmjs.com/package/@sleep2agi/agent-network-dashboard) | 0.4.2 |
-| [`@sleep2agi/agent-node`](https://www.npmjs.com/package/@sleep2agi/agent-node) | 2.3.0 |
+| [`@sleep2agi/agent-network`](https://www.npmjs.com/package/@sleep2agi/agent-network) | CLI |
+| [`@sleep2agi/agent-network-dashboard`](https://www.npmjs.com/package/@sleep2agi/agent-network-dashboard) | Web UI |
+| [`@sleep2agi/agent-node`](https://www.npmjs.com/package/@sleep2agi/agent-node) | Agent runtime host |
 
-## MCP tools (17)
+Install the matching versions with `npm install -g <pkg>` — the `latest` dist-tag on npm is
+authoritative. Pinning versions here goes stale on every release and nobody comes back to fix it.
+
+## MCP tools
 
 ### Agent-side
 | Tool | Description |
@@ -96,7 +99,7 @@ Network-management endpoints (`/api/networks…`) are present and used by the cu
 
 Auth: `Authorization: Bearer <token>` header, or `?token=<token>` query.
 
-## SQLite schema (13 tables)
+## SQLite schema
 
 Auto-created on first run.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.24",
+  "version": "0.9.0-preview.26",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and 17 MCP tools.",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.ts

@@ -297,6 +297,11 @@ export function deleteNetwork(userId: string, networkId: string): { ok: boolean;
   const sessions = db.get<{ cnt: number }>("SELECT COUNT(*) as cnt FROM sessions WHERE network_id = ?1", networkId);
   if (sessions && sessions.cnt > 0) return { ok: false, error: `network has ${sessions.cnt} active session(s) — stop them first` };
   db.run("DELETE FROM networks WHERE network_id = ?1 AND owner_id = ?2", [networkId, userId]);
+  // PR #519 codex catch: leaving membership rows behind made deleted
+  // networks count toward getUserNetworkIds — a stale row could flip a
+  // single-network user to "ambiguous" or auto-resolve writes INTO the
+  // deleted network. Remove memberships with the network.
+  db.run("DELETE FROM network_members WHERE network_id = ?1", [networkId]);
   return { ok: true };
 }
 

package/src/avatar-validate.test.ts

@@ -60,8 +60,10 @@ describe("#462 validateAvatarUrl", () => {
     expect(validateAvatarUrl("ftp://example.com/a.png").ok).toBe(false);
   });
 
-  test("rejects relative / protocol-relative / non-URL strings", () => {
-    expect(validateAvatarUrl("/avatars/1.png").ok).toBe(false);
+  test("rejects protocol-relative / non-URL / schemeless strings", () => {
+    // SPEC CHANGE (通信龙 裁定, avatar 接线单): same-origin pool paths
+    // (/avatars/<name>.<ext>) are now ACCEPTED — that case moved to the
+    // dedicated relative-branch suite below. Everything here stays rejected.
     expect(validateAvatarUrl("//cdn.example.com/1.png").ok).toBe(false);
     expect(validateAvatarUrl("not a url").ok).toBe(false);
     expect(validateAvatarUrl("example.com/x.png").ok).toBe(false);
@@ -111,3 +113,51 @@ describe("#462 validateAvatarUrl", () => {
     expect(validateAvatarUrl(ok + "a").ok).toBe(false);
   });
 });
+
+// ── Same-origin relative branch (通信龙 裁定: relax to portable pool paths;
+//    absolute URLs would weld one hostname into the DB across multi-origin
+//    entry points). Each direction is its OWN test so any single guard
+//    being deleted turns its OWN assertion red (no merged catch-all).
+describe("validateAvatarUrl — same-origin relative pool paths", () => {
+  test("accepts a pool path: /avatars/avatar-09.webp", () => {
+    const r = validateAvatarUrl("/avatars/avatar-09.webp");
+    expect(r).toEqual({ ok: true, value: "/avatars/avatar-09.webp" });
+  });
+
+  test("accepts png and svg pool files", () => {
+    expect(validateAvatarUrl("/avatars/intern_avatar.png")).toEqual({ ok: true, value: "/avatars/intern_avatar.png" });
+    expect(validateAvatarUrl("/avatars/team-logo.svg")).toEqual({ ok: true, value: "/avatars/team-logo.svg" });
+  });
+
+  test("rejects protocol-relative //host (classic same-origin bypass)", () => {
+    const r = validateAvatarUrl("//evil.com/x.png");
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.reason).toContain("protocol-relative");
+  });
+
+  test("rejects javascript: scheme (still, after the relax)", () => {
+    expect(validateAvatarUrl("javascript:alert(1)").ok).toBe(false);
+  });
+
+  test("rejects non-/avatars/ absolute paths (/etc/passwd)", () => {
+    expect(validateAvatarUrl("/etc/passwd").ok).toBe(false);
+  });
+
+  test("rejects non-whitelisted extensions under /avatars/", () => {
+    expect(validateAvatarUrl("/avatars/payload.html").ok).toBe(false);
+  });
+
+  test("rejects nested/traversal paths (charset forbids further slashes)", () => {
+    expect(validateAvatarUrl("/avatars/../secrets.webp").ok).toBe(false);
+    expect(validateAvatarUrl("/avatars/sub/x.webp").ok).toBe(false);
+  });
+
+  test("rejects percent-encoding inside the filename (no encoded surprises)", () => {
+    expect(validateAvatarUrl("/avatars/a%2f..%2fx.webp").ok).toBe(false);
+  });
+
+  test("absolute http(s) branch is UNTOUCHED by the relax (positive control)", () => {
+    const r = validateAvatarUrl("https://example.com/pic.png");
+    expect(r.ok).toBe(true);
+  });
+});

package/src/avatar-validate.ts

@@ -15,9 +15,26 @@ export type AvatarValidation =
  * Normalize + validate an untrusted avatar_url patch value.
  *
  *   null / undefined / "" / whitespace-only  → { ok, value: null }  (clear)
- *   valid absolute http(s) URL               → { ok, value: trimmed }
+ *   same-origin pool path /avatars/<name>.<ext>  → { ok, value: trimmed }
+ *   valid absolute http(s) URL               → { ok, value: normalized }
  *   anything else                            → { ok: false, reason }
+ *
+ * Relative branch rationale (通信龙 裁定, avatar 接线单): the hub is
+ * reached through several origins (localhost dev, public domains) — an
+ * absolute URL would weld ONE hostname into the DB and break the image
+ * for every other entry point; a same-origin relative path is portable.
+ * 🔴 Trap this branch must block: "starts with /" ≠ "same-origin" —
+ * "//evil.com/x.png" ALSO starts with "/" but is a protocol-relative URL
+ * the browser resolves to evil.com. Hence: single leading slash with the
+ * SECOND char not "/", then an exact value-set match (the /avatars/ pool
+ * prefix + extension whitelist), not a shape match.
  */
+
+// Exact allowed set for same-origin values: the dashboard's designed pool
+// under /avatars/. Filename charset excludes "/" (no traversal, no nested
+// paths) and "%" (no encoded surprises); extensions mirror the actual
+// pool contents. Widen ONLY by extending this list deliberately.
+const SAME_ORIGIN_AVATAR_RE = /^\/avatars\/[A-Za-z0-9._-]+\.(webp|png|svg)$/;
 export function validateAvatarUrl(raw: unknown): AvatarValidation {
   if (raw === null || raw === undefined) return { ok: true, value: null };
   if (typeof raw !== "string") {
@@ -35,6 +52,23 @@ export function validateAvatarUrl(raw: unknown): AvatarValidation {
   if (/[\u0000-\u001f\u007f-\u009f\s]/.test(trimmed)) {
     return { ok: false, reason: "avatar_url must not contain whitespace or control characters" };
   }
+  // Same-origin relative branch (runs AFTER the whitespace/control gate
+  // above — that check protects this branch too). Order of the two tests
+  // matters for the reason string, not for safety: the exact-set regex
+  // alone already rejects "//…" (second char is "/", first segment must
+  // literally be "avatars"), the explicit double-slash check just names
+  // the classic bypass in its own words.
+  if (trimmed.startsWith("/")) {
+    if (trimmed.startsWith("//")) {
+      return { ok: false, reason: "avatar_url must not be protocol-relative (//host/…)" };
+    }
+    if (!SAME_ORIGIN_AVATAR_RE.test(trimmed)) {
+      return { ok: false, reason: "relative avatar_url must match /avatars/<name>.(webp|png|svg)" };
+    }
+    return { ok: true, value: trimmed };
+  }
+  // Absolute http(s) branch — unchanged from #462 (do not touch while
+  // relaxing: 通信龙 裁定 condition 3).
   let parsed: URL;
   try {
     parsed = new URL(trimmed);

package/src/ext-validation-regression.test.ts

@@ -0,0 +1,138 @@
+// Task #25 — regression pins for ext validation in validateIndexEntry.
+//
+// 🔴 SCOPE (lead d505179d): this suite covers ONLY the ext regex copy
+// inside `validateIndexEntry` (uploads.ts). The same-shape regex has
+// FOUR copies in this file:
+//   • L93  sanitizeExt         /\.([A-Za-z0-9]{1,16})$/    (client-name parse; no leading-dot anchor, captures group)
+//   • L141 buildStoragePath    /^\.[A-Za-z0-9]{1,16}$/     (upload-path build)
+//   • L165 pathForExistingBlob /^\.[A-Za-z0-9]{1,16}$/     (download-path build)
+//   • L219 validateIndexEntry  /^\.[A-Za-z0-9]{1,16}$/     ← THIS SUITE
+// Mutation reversal proved the other three copies get ZERO coverage
+// from this suite (each was widened to `/./` in turn — this suite still
+// passed 30/0). See docs/tests/p-25-ext-regression/mutation-red.txt.
+// Do NOT read the file name "ext validation regression" as "the ext
+// validation is regression-protected" — the ext validation exists in
+// four independent copies and only ONE is pinned here.
+// Follow-up issue tracks the dedup/alignment evaluation (see PR body).
+//
+// Background (通信龙 d01bb8ce): the current regex `/^\.[A-Za-z0-9]{1,16}$/`
+// in validateIndexEntry (uploads.ts) correctly rejects 11 known malicious
+// ext values (path-escape, traversal, absolute paths, doubles, NUL bytes,
+// backslash forms, over-length, whitespace). Verified via real-run on
+// origin/main by lead — 11/11 malicious values → false.
+//
+// But NO test locked that behavior. Anyone who widens the regex in the
+// future (accidentally or on purpose) would not hit a red test — the
+// live protection would degrade silently. This suite pins current
+// behavior in two directions:
+//
+//   1. SAFETY  (欠修 direction) — 11 malicious values → false, one row
+//      per value with the exact literal. If regex is widened to accept
+//      any of them, that row turns red.
+//   2. NON-REGRESSION (过修 direction) — a set of common legitimate
+//      extensions → true. If regex is tightened to reject any of them
+//      (e.g. someone locks down to a whitelist), that row turns red.
+//
+// Witnessed-red for the SAFETY rows: temporarily widen the regex to
+// `/./` (or comment it out) in validateIndexEntry, run this suite,
+// confirm all 11 malicious rows turn red, then revert. The mutation
+// itself is not committed; the assertion IS the mutation-red proof
+// for the reader. Recording the mutation output in the followup PR
+// body (per Constraint 3 discipline established in #503).
+//
+// Pure unit test — no server setup, no DB, no filesystem. The regex
+// lives in a pure function, so the guard is testable at that level.
+
+import { describe, expect, test } from "bun:test";
+import { validateIndexEntry } from "./uploads.js";
+
+// A structurally-valid base entry — file_id / date_bucket / size all
+// pass their own checks — so `ext` is the only field a test row varies.
+// This isolates the ext regex as the deciding factor.
+const validBase = {
+  file_id: "0123456789abcdef0123456789abcdef",
+  date_bucket: "2026-07-30",
+  size: 0,
+};
+
+describe("Task #25 (#503 followup) — ext validation regression pins", () => {
+  describe("SAFETY: the 11 malicious ext values from lead d01bb8ce all return false", () => {
+    // Each row uses the exact literal from lead's verification list so
+    // a widening regex catches on the same value the manual audit did.
+    const malicious: Array<{ label: string; ext: string }> = [
+      { label: "path-escape prefix",          ext: "../x" },
+      { label: "deep traversal to /etc",       ext: "../../etc/passwd" },
+      { label: "absolute path",               ext: "/abs/x" },
+      { label: "double-dot alone",            ext: ".." },
+      { label: "single-dot alone",            ext: "." },
+      { label: "chained after legit prefix",  ext: ".png/../../y" },
+      { label: "embedded whitespace",         ext: ".p ng" },
+      { label: "over-length (>16 chars)",     ext: "." + "a".repeat(17) },
+      { label: "embedded NUL byte",           ext: ".p\x00ng" },
+      { label: "backslash traversal",         ext: ".\\..\\x" },
+      { label: "double-backslash prefix",     ext: "..\\x" },
+    ];
+    for (const { label, ext } of malicious) {
+      test(`rejects: ${label} — ext=${JSON.stringify(ext)}`, () => {
+        expect(validateIndexEntry({ ...validBase, ext })).toBe(false);
+      });
+    }
+
+    test("precondition: 11 malicious cases enumerated (defends against silent test-shrink)", () => {
+      // If someone deletes rows from the malicious list, this fails
+      // instead of the deletion silently narrowing the guard. Number
+      // matches lead's verification list — bump only when lead adds a
+      // case and confirms it via real-run.
+      expect(malicious.length).toBe(11);
+    });
+  });
+
+  describe("NON-REGRESSION: common legitimate extensions all return true (防过修)", () => {
+    // These are the extensions the live upload path actually produces
+    // via sanitizeExt / mime-typed multipart uploads. If someone
+    // tightens the regex to a stricter whitelist, any of these turning
+    // red flags a break in a normal user path.
+    const legal = [".png", ".pdf", ".pptx", ".jpg", ".jpeg", ".txt", ".mp4", ".zip", ".json", ".md"];
+    for (const ext of legal) {
+      test(`accepts: ext=${JSON.stringify(ext)}`, () => {
+        expect(validateIndexEntry({ ...validBase, ext })).toBe(true);
+      });
+    }
+
+    test("empty ext is accepted (file with no extension is a legitimate upload)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "" })).toBe(true);
+    });
+
+    test("precondition: at least 10 legitimate ext values pinned", () => {
+      // Same discipline as the malicious side — reject silent shrink.
+      expect(legal.length).toBeGreaterThanOrEqual(10);
+    });
+  });
+
+  describe("regex shape assumptions (documented, not enforced by the function)", () => {
+    // These rows document facts the current regex enforces beyond the
+    // 11 malicious literals. They are close to the boundary and would
+    // be the first things to move if someone reworked the regex.
+    test("upper-case extensions accepted (regex is case-insensitive by [A-Za-z])", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".PNG" })).toBe(true);
+    });
+    test("mixed-case extensions accepted", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".PdF" })).toBe(true);
+    });
+    test("digits after dot accepted (e.g. .mp4, .mp3)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".mp4" })).toBe(true);
+    });
+    test("exactly 16 chars after dot is accepted (upper bound of {1,16})", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "." + "a".repeat(16) })).toBe(true);
+    });
+    test("exactly 17 chars after dot is rejected (immediately past upper bound)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "." + "a".repeat(17) })).toBe(false);
+    });
+    test("compound extensions like .tar.gz are rejected (contains inner dot)", () => {
+      // Documented: the current regex does not support compound
+      // extensions. If we ever want .tar.gz support, it needs its
+      // own explicit design + this row updated with lead sign-off.
+      expect(validateIndexEntry({ ...validBase, ext: ".tar.gz" })).toBe(false);
+    });
+  });
+});

package/src/file-download-authz.test.ts

@@ -56,6 +56,16 @@ const rA = register(nameA, "BootstrapPw123Aa!", undefined, "userA");
 if (!rA.ok) throw new Error(`userA register failed: ${rA.error}`);
 const userAToken = rA.token!;
 const userAUserId = rA.user!.user_id;
+const userANetworkId = rA.network_id!;
+
+// #503 — userA joins userB's network below, which makes userA a
+// SAME-network peer. Cross-network denial needs a principal who is in
+// neither, so userC exists purely to be an outsider.
+const nameC = `userccc_495_${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+const rC = register(nameC, "BootstrapPw123Aa!", undefined, "userC");
+if (!rC.ok) throw new Error(`userC register failed: ${rC.error}`);
+const userCToken = rC.token!;
+const userCUserId = rC.user!.user_id;
 
 const nameB = `userbbb_495_${Date.now()}_${Math.floor(Math.random() * 1000)}`;
 const rB = register(nameB, "BootstrapPw123Aa!", undefined, "userB");
@@ -132,10 +142,16 @@ afterAll(() => {
   delete process.env.COMMHUB_AUTH_TOKEN;
 });
 
-async function uploadAs(token: string, content: Uint8Array, filename: string): Promise<string> {
+// #503 — a utok_ holder in more than one network must name the target
+// network; the server refuses to guess ("first network" is not assumed).
+// Callers using a single-network token can still omit it.
+async function uploadAs(token: string, content: Uint8Array, filename: string, networkId?: string): Promise<string> {
   const form = new FormData();
   form.append("file", new Blob([content], { type: "application/octet-stream" }), filename);
-  const res = await fetch(`${BASE}/api/upload`, {
+  const url = networkId
+    ? `${BASE}/api/upload?network_id=${encodeURIComponent(networkId)}`
+    : `${BASE}/api/upload`;
+  const res = await fetch(url, {
     method: "POST",
     body: form,
     headers: { Authorization: `Bearer ${token}` },
@@ -173,27 +189,36 @@ describe.skipIf(!isProdMode)("#495 — GET /api/files/:file_id authorization (ow
     expect(await res.text()).toBe("agent-blob");
   });
 
-  test("🔴 non-owner (userA) downloads userB's file → 404 (was 200 pre-#495)", async () => {
-    const res = await downloadAs(userAToken, userBFileId);
+  test("🔴 cross-network non-owner (userC) downloads userB's file → 404 (was 200 pre-#495)", async () => {
+    // Precondition — userC is in NEITHER of userB's networks, so the 404
+    // is cross-network denial. This row used to use userA, but #503 made
+    // userA a legitimate same-network reader; keeping userA here would
+    // have turned #495's guarantee into a test that asserts nothing.
+    const rows = db.all<{ network_id: string }>(
+      "SELECT network_id FROM network_members WHERE user_id = ?1 AND network_id = ?2",
+      userCUserId, userBNetworkId,
+    );
+    expect(rows.length).toBe(0);
+    const res = await downloadAs(userCToken, userBFileId);
     expect(res.status).toBe(404);
     const body: any = await res.json();
     expect(body.error).toBe("not_found");
   });
 
-  test("🔴 same-network non-owner (userA is a member of userB's network) → 404 (STAGED carve-out; follow-up #503)", async () => {
-    // Precondition — userA really is a member of userB's default
-    // network (added in module setup). Guard the invariant so the
-    // 404 result actually represents "same-network peer denied",
-    // not "cross-network denied".
+  test("🔴 same-network non-owner (userA is a member of userB's network) → 200 (#503 lifted the #495 staged carve-out)", async () => {
+    // Precondition — userA really is a member of userB's default network
+    // (added in module setup), so the 200 represents "same-network peer
+    // allowed" rather than an owner match or an admin bypass.
     const rows = db.all<{ network_id: string }>(
       "SELECT network_id FROM network_members WHERE user_id = ?1 AND network_id = ?2",
       userAUserId, userBNetworkId,
     );
     expect(rows.length).toBe(1);
+    expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", userAUserId)?.role)
+      .not.toBe("admin");
     const res = await downloadAs(userAToken, userBFileId);
-    expect(res.status).toBe(404);
-    const body: any = await res.json();
-    expect(body.error).toBe("not_found");
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("secret-from-B");
   });
 
   test("admin caller downloads any file → 200 (operational access preserved)", async () => {
@@ -247,8 +272,10 @@ describe.skipIf(!isProdMode)("#500 CR2 — HEAD /api/files/:file_id authorizatio
     expect(res.headers.get("x-content-type-options")).toBe("nosniff");
   });
 
-  test("🔴 cross-owner HEAD (userA HEAD userB's file) → 404 via helper (was fallback 200 pre-CR2)", async () => {
-    const res = await headAs(userAToken, userBFileId);
+  test("🔴 cross-network HEAD (userC HEAD userB's file) → 404 via helper (was fallback 200 pre-CR2)", async () => {
+    // userC, not userA — #503 makes userA a same-network reader, so the
+    // GET/HEAD parity claim needs a principal who is genuinely denied.
+    const res = await headAs(userCToken, userBFileId);
     expect(res.status).toBe(404);
     // 404 must originate from authorizeFileDownload, not the fallback
     // page. Body is application/json ({"ok":false,"error":"not_found"})
@@ -284,7 +311,9 @@ describe.skipIf(!isProdMode)("#500 CR2 — HEAD /api/files/:file_id authorizatio
 // in the authorizeFileDownload comment and this test enforces it.
 describe.skipIf(!isProdMode)("#500 CR2 — upload persists truthy owner_id (D1)", () => {
   test("D1: userA authenticated upload → index entry owner_id === userA.userId (never null)", async () => {
-    const fileId = await uploadAs(userAToken, new TextEncoder().encode("owner-persistence-check"), "d1.bin");
+    // userA belongs to two networks (own default + userB's), so #503
+    // requires the target network to be named explicitly.
+    const fileId = await uploadAs(userAToken, new TextEncoder().encode("owner-persistence-check"), "d1.bin", userANetworkId);
     const { readFileSync } = await import("fs");
     const entryPath = join(UPLOADS_DIR, ".index", `${fileId}.json`);
     expect(existsSync(entryPath)).toBe(true);
@@ -314,13 +343,18 @@ describe.skipIf(!isProdMode)("#495 — null-owner policy in production (DEV_OPEN
     // reproduces the shape a DEV_OPEN or legacy master upload would
     // create, without needing to spin up a second server in a
     // different mode.
-    nullOwnerFileId = await uploadAs(userAToken, new TextEncoder().encode("legacy-blob"), "legacy.txt");
+    nullOwnerFileId = await uploadAs(userAToken, new TextEncoder().encode("legacy-blob"), "legacy.txt", userANetworkId);
     const { readFileSync: rfs, writeFileSync: wfs } = await import("fs");
     const entryFile = join(UPLOADS_DIR, ".index", `${nullOwnerFileId}.json`);
     if (!existsSync(entryFile)) throw new Error(`index entry not found: ${entryFile}`);
     const entry = JSON.parse(rfs(entryFile, "utf-8"));
     entry.owner = null;
     entry.owner_id = null;
+    // #503 — a true legacy entry predates network attribution entirely.
+    // Deleting the key (rather than nulling it) matches what the writer
+    // emits when there is no attribution, so this fixture exercises the
+    // legacy compatibility branch instead of the network branch.
+    delete entry.network_id;
     wfs(entryFile, JSON.stringify(entry, null, 2));
   });