@sleep2agi/commhub-server 0.9.0-preview.27 → 0.9.0-preview.29

package/bin/commhub.ts

@@ -54,6 +54,10 @@ Examples:
   }
 }
 
+// Opt into the default production DB path before loading the server graph.
+// Ordinary imports / bun -e probes do not receive this capability.
+process.env.COMMHUB_SERVER = "1";
+
 // Load the server module (side-effect-free since the #438 corrective:
 // importing binds nothing) and start the hub EXPLICITLY. Never rely on
 // import side effects or import.meta.main here — this bin is a dynamic

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.27",
+  "version": "0.9.0-preview.29",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and 17 MCP tools.",
   "type": "module",
   "main": "src/index.ts",
@@ -12,9 +12,9 @@
     "bin"
   ],
   "scripts": {
-    "start": "bun run src/index.ts",
-    "dev": "bun --watch run src/index.ts",
-    "test": "COMMHUB_DB=/tmp/test-commhub-$$.db bun test src/"
+    "start": "COMMHUB_SERVER=1 bun run src/index.ts",
+    "dev": "COMMHUB_SERVER=1 bun --watch run src/index.ts",
+    "test": "bun run scripts/test-aggregate.ts"
   },
   "keywords": [
     "commhub",

package/src/ack-create-request-transport.test.ts

@@ -0,0 +1,159 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_ack_transport";
+const DAEMON_NODE_ID = "node_ack_transport_daemon";
+const DAEMON_ALIAS = "ack-transport-daemon";
+const DAEMON_USER = "u_ack_transport_owner";
+const DAEMON_TOKEN_ID = "tok_ack_transport_daemon";
+
+function cleanup() {
+  try { db.run("DELETE FROM audit_log WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM node_create_requests WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM nodes WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [DAEMON_USER]); } catch {}
+}
+
+function seedWorld() {
+  db.run(
+    `INSERT INTO users (user_id, username, password_hash, role, created_at)
+     VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+    [DAEMON_USER, DAEMON_USER],
+  );
+  db.run(
+    `INSERT INTO networks (network_id, network_name, owner_id, created_at)
+     VALUES (?1, ?2, ?3, datetime('now'))`,
+    [NET, NET, DAEMON_USER],
+  );
+  db.run(
+    `INSERT INTO network_members (user_id, network_id, role, joined_at)
+     VALUES (?1, ?2, 'owner', datetime('now'))`,
+    [DAEMON_USER, NET],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at)
+     VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [DAEMON_NODE_ID, DAEMON_ALIAS, DAEMON_ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [DAEMON_TOKEN_ID, DAEMON_USER, NET, `node:${DAEMON_ALIAS}`, "hash_ack_transport_daemon"],
+  );
+}
+
+function seedRequest(requestId: string) {
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, created_at, created_by_token)
+     VALUES (?1, ?2, ?3, ?4, 'codex-sdk', 'x', '{}', '[]', 'delivered', ?5, ?6)`,
+    [requestId, DAEMON_NODE_ID, `child_${requestId}`, NET, Date.now(), DAEMON_TOKEN_ID],
+  );
+}
+
+async function connectClient() {
+  const server = new McpServer({ name: "ack-transport-test", version: "1" });
+  registerTools(
+    server,
+    undefined,
+    NET,
+    DAEMON_USER,
+    DAEMON_ALIAS,
+    true,
+    DAEMON_TOKEN_ID,
+  );
+  const client = new Client({ name: "ack-transport-client", version: "1" });
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  await server.connect(serverTransport);
+  await client.connect(clientTransport);
+  return { client, server };
+}
+
+type ToolResult = { content: Array<{ type: string; text?: string }>; isError?: boolean };
+
+function responseJson(result: ToolResult) {
+  const first = result.content[0];
+  if (!first || first.type !== "text" || typeof first.text !== "string") throw new Error("missing text tool result");
+  return JSON.parse(first.text) as { ok?: boolean; status?: string };
+}
+
+function expectTransportValidationError(result: ToolResult) {
+  expect(result.isError).toBe(true);
+  const first = result.content[0];
+  expect(first?.type).toBe("text");
+  expect(first?.text).toMatch(/Input validation error.*ack_create_request/i);
+}
+
+beforeEach(() => {
+  cleanup();
+  seedWorld();
+});
+afterAll(cleanup);
+
+describe("#344 ack_create_request real in-process MCP transport", () => {
+  test("accepts runtime_capability_check_failed plus string runtime through the SDK zod gate", async () => {
+    const requestId = "cr_transport_accept";
+    seedRequest(requestId);
+    const { client, server } = await connectClient();
+    try {
+      const result = await client.callTool({
+        name: "ack_create_request",
+        arguments: {
+          request_id: requestId,
+          status: "runtime_capability_check_failed",
+          error: "child died within 5000ms post-spawn",
+          runtime: "codex-sdk",
+        },
+      });
+      expect(responseJson(result)).toMatchObject({ ok: true, status: "runtime_capability_check_failed" });
+      expect(db.get<{ status: string }>("SELECT status FROM node_create_requests WHERE request_id = ?1", requestId)?.status)
+        .toBe("runtime_capability_check_failed");
+    } finally {
+      await client.close();
+      await server.close();
+    }
+  });
+
+  test("rejects unknown status at the transport gate before the handler mutates the row", async () => {
+    const requestId = "cr_transport_bad_status";
+    seedRequest(requestId);
+    const { client, server } = await connectClient();
+    try {
+      const result = await client.callTool({
+        name: "ack_create_request",
+        arguments: { request_id: requestId, status: "capability_failed_typo", runtime: "codex-sdk" },
+      });
+      expectTransportValidationError(result);
+      expect(db.get<{ status: string }>("SELECT status FROM node_create_requests WHERE request_id = ?1", requestId)?.status)
+        .toBe("delivered");
+    } finally {
+      await client.close();
+      await server.close();
+    }
+  });
+
+  test("rejects non-string runtime at the transport gate before the handler mutates the row", async () => {
+    const requestId = "cr_transport_bad_runtime";
+    seedRequest(requestId);
+    const { client, server } = await connectClient();
+    try {
+      const result = await client.callTool({
+        name: "ack_create_request",
+        arguments: { request_id: requestId, status: "runtime_capability_check_failed", runtime: 42 },
+      });
+      expectTransportValidationError(result);
+      expect(db.get<{ status: string }>("SELECT status FROM node_create_requests WHERE request_id = ?1", requestId)?.status)
+        .toBe("delivered");
+    } finally {
+      await client.close();
+      await server.close();
+    }
+  });
+});

package/src/ack-create-request.test.ts

@@ -13,11 +13,11 @@ import { registerTools } from "./tools.js";
 // `daemon_capability_lied` audit was written when in fact the action wasn't
 // in the audit enum and no insert ran.
 //
-// This handler-driven suite drives the registered MCP tool through
-// registerTools() so a daemon's exact ack shape (status + runtime field)
-// flows through the real zod schema + handler branch + audit insert. It
-// would have caught the lane-recurring "single component passes but cross-
-// component path stays broken" failure mode immediately.
+// This handler-driven suite captures and invokes the registered callback
+// directly. It validates handler branches and DB effects, but deliberately
+// does NOT claim to exercise the MCP SDK's zod transport gate. The
+// complementary in-process transport coverage lives in
+// ack-create-request-transport.test.ts (#344).
 
 const NET = "net_ack_t";
 const DAEMON_NODE_ID = "node_ack_daemon";

package/src/admin-networks-http.test.ts

@@ -0,0 +1,84 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { NETWORK_REST_COLUMNS } from "./rest-projections.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-admin-networks-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let adminToken = "";
+let memberToken = "";
+let nodeToken = "";
+let adminNetworkId = "";
+let memberNetworkId = "";
+
+async function listNetworks(token: string): Promise<any[]> {
+  const response = await fetch(`${base}/api/networks`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  expect(response.status).toBe(200);
+  const body = await response.json() as any;
+  expect(body.ok).toBe(true);
+  return body.networks;
+}
+
+beforeAll(async () => {
+  const { db } = await import("./db.js");
+  const { createNetworkTokenForNode, register } = await import("./auth.js");
+
+  // The first registered user is the global Hub admin. The second user owns a
+  // separate network and is intentionally not a member of the admin's network.
+  const admin = register(`admin_networks_${Date.now()}`, "AdminNetworks-Strong-1!", undefined, "admin");
+  expect(admin.ok).toBe(true);
+  adminToken = admin.token!;
+  adminNetworkId = admin.network_id!;
+
+  const member = register(`member_networks_${Date.now()}`, "MemberNetworks-Strong-1!", undefined, "member");
+  expect(member.ok).toBe(true);
+  memberToken = member.token!;
+  memberNetworkId = member.network_id!;
+
+  const memberUserId = db.get<{ user_id: string }>(
+    "SELECT user_id FROM users WHERE username LIKE 'member_networks_%' ORDER BY created_at DESC LIMIT 1",
+  )!.user_id;
+  const minted = createNetworkTokenForNode(memberUserId, memberNetworkId, "admin-networks-node");
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/networks global-admin visibility (#94)", () => {
+  test("global admin utok sees every network without losing public shape", async () => {
+    const rows = await listNetworks(adminToken);
+    expect(new Set(rows.map((row) => row.network_id))).toEqual(new Set([adminNetworkId, memberNetworkId]));
+
+    const own = rows.find((row) => row.network_id === adminNetworkId);
+    const foreign = rows.find((row) => row.network_id === memberNetworkId);
+    expect(own.member_role).toBe("owner");
+    expect(foreign.member_role).toBe("admin");
+    expect(Object.keys(foreign).sort()).toEqual([...NETWORK_REST_COLUMNS, "member_role", "name"].sort());
+  });
+
+  test("ordinary utok remains limited to member networks", async () => {
+    const rows = await listNetworks(memberToken);
+    expect(rows.map((row) => row.network_id)).toEqual([memberNetworkId]);
+    expect(rows.some((row) => row.network_id === adminNetworkId)).toBe(false);
+  });
+
+  test("network token remains limited to its bound network", async () => {
+    const rows = await listNetworks(nodeToken);
+    expect(rows.map((row) => row.network_id)).toEqual([memberNetworkId]);
+    expect(rows.some((row) => row.network_id === adminNetworkId)).toBe(false);
+  });
+});

package/src/api-host-supervisors-fallback.test.ts

@@ -20,13 +20,10 @@
 // server on an ephemeral port with a temp DB, hit it with fetch().
 
 import { describe, expect, test, beforeAll, afterAll } from "bun:test";
-import { mkdtempSync, rmSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
+import "./require-explicit-test-db.js";
 import { register, login, createNetwork } from "./auth.js";
 import { db } from "./db.js";
 
-const SERVER_DB = mkdtempSync(join(tmpdir(), "anet-hs-fallback-db-")) + "/commhub.db";
 // #438 corrective: private bootServer({ port: 0 }) instance (see
 // uploads-http.test.ts for rationale).
 let BASE = "";
@@ -42,7 +39,6 @@ let multiNetworkA = "", multiNetworkB = "";
 let soloDaemonAlias = "";
 
 beforeAll(async () => {
-  process.env.COMMHUB_DB = SERVER_DB;
   process.env.HOST = "127.0.0.1";
 
   const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
@@ -155,7 +151,6 @@ function seedHostSupervisorDaemon(opts: {
 
 afterAll(() => {
   try { server?.stop?.(true); } catch {}
-  try { rmSync(SERVER_DB, { recursive: true, force: true }); } catch {}
 });
 
 async function get(path: string, token: string): Promise<{ status: number; body: any }> {

package/src/auth.ts

@@ -3,6 +3,7 @@
  */
 import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js";
 import { WEAK_PASSWORDS } from "./password-dict.js";
+import { NETWORK_REST_COLUMNS, NETWORK_REST_SELECT, sqlColumns } from "./rest-projections.js";
 
 // Round-6 A1 hardening — dummy hash for username-enumeration timing
 // close. We compute ONE scrypt hash of a throwaway password and reuse
@@ -87,11 +88,32 @@ export function register(username: string, password: string, email?: string, dis
     [userId, username, pwHash, email || null, displayName || username, isFirstUser ? "admin" : "user"]
   );
 
-  // Auto-create default network + add as owner member
+  // Auto-create the user's own network + add as owner member.
+  //
+  // Name it after the user rather than the literal "default". Every
+  // registration used to mint a network called "default", so a hub with N
+  // users showed N identical "default" rows in the Dashboard sidebar with
+  // no way to tell them apart (23 of them on the live hub, 22 empty).
+  // Three CLI call sites (bin/cli.ts debate / demo-social / pr-review) resolve
+  // a network as:
+  //     me.user.default_network_id
+  //       || networks.find(n => n.network_name === "default")
+  //       || networks[0]
+  // Checked against the live hub: GET /api/auth/me returns
+  // {user_id, username, display_name, email, role} — there is no
+  // default_network_id field, and nothing in server/ ever writes one. So the
+  // first term is always undefined and the name lookup is the operative path,
+  // not a fallback.
+  //
+  // After this change that lookup misses for new users and they land on
+  // networks[0]. That still resolves to this network because listNetworks()
+  // is `ORDER BY created_at` ascending (auth.ts:296) and this row is the
+  // user's oldest. Reordering that query would silently point those three
+  // commands at the wrong network.
   const networkId = generateId("net");
   db.run(
     "INSERT INTO networks (network_id, network_name, owner_id, description) VALUES (?1, ?2, ?3, ?4)",
-    [networkId, "default", userId, "Auto-created default network"]
+    [networkId, username, userId, `Auto-created network for ${username}`]
   );
   db.run(
     "INSERT INTO network_members (network_id, user_id, role) VALUES (?1, ?2, 'owner')",
@@ -191,18 +213,67 @@ export function login(username: string, password: string): AuthResult {
   };
 }
 
-/** Create a network-scoped token (ntok_) for a specific node */
-export function createNetworkTokenForNode(userId: string, networkId: string, nodeName: string): { ok: boolean; token?: string; error?: string } {
+/**
+ * Create a network-scoped token (ntok_) for a specific node.
+ *
+ * RFC-036: callers that provide nodeId atomically establish the immutable
+ * node-owner binding before the plaintext token is returned. The 3-argument
+ * legacy form remains available for old clients, but its token has no bound
+ * node id and therefore cannot consume external-schedule edit intents.
+ */
+export function createNetworkTokenForNode(userId: string, networkId: string, nodeName: string, nodeId?: string): { ok: boolean; token?: string; token_id?: string; node_id?: string; error?: string } {
   // Verify user is a member of this network with write access
   const role = getUserNetworkRole(userId, networkId);
   if (!role || role === "viewer") return { ok: false, error: "no write access to this network" };
+  if (!nodeName || nodeName.length > 200) return { ok: false, error: "invalid_node_name" };
+  if (nodeId !== undefined && (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(nodeId))) {
+    return { ok: false, error: "invalid_node_id" };
+  }
   const token = generateNetworkToken();
   const tokenId = generateId("tok");
-  db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-    [tokenId, hashToken(token), userId, networkId, `node:${nodeName}`, "network"]
-  );
-  return { ok: true, token };
+  try {
+    db.transaction(() => {
+      if (nodeId) {
+        const existing = db.get<{ network_id: string | null; owner_user_id: string | null }>(
+          "SELECT network_id, owner_user_id FROM nodes WHERE node_id = ?1",
+          nodeId,
+        );
+        if (existing?.network_id && existing.network_id !== networkId) throw new Error("cross_network_node");
+        // Existing pre-RFC-036 rows have no trustworthy owner anchor. A token
+        // refresh must not turn knowledge of a legacy node_id into ownership.
+        // They remain read-only until a separately authorized migration.
+        if (existing && !existing.owner_user_id) throw new Error("node_owner_unclaimed");
+        if (existing?.owner_user_id && existing.owner_user_id !== userId) throw new Error("node_owner_mismatch");
+        db.run(
+          `INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, updated_at)
+           VALUES (?1, ?2, ?2, ?3, ?4, datetime('now'))
+           ON CONFLICT(node_id) DO UPDATE SET
+             node_name = COALESCE(nodes.node_name, ?2),
+             alias = COALESCE(nodes.alias, ?2),
+             network_id = COALESCE(nodes.network_id, ?3),
+             owner_user_id = COALESCE(nodes.owner_user_id, ?4),
+             updated_at = datetime('now')`,
+          [nodeId, nodeName, networkId, userId],
+        );
+        if (!existing) {
+          db.run(
+            `INSERT INTO audit_log (user_id, action, target_type, target_id, detail, network_id)
+             VALUES (?1, 'external_schedule.owner_claimed', 'node', ?2, ?3, ?4)`,
+            [userId, nodeId, JSON.stringify({ node_id: nodeId, network_id: networkId }), networkId],
+          );
+        }
+      }
+      db.run(
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, bound_node_id) VALUES (?1, ?2, ?3, ?4, ?5, 'network', ?6)",
+        [tokenId, hashToken(token), userId, networkId, `node:${nodeName}`, nodeId ?? null],
+      );
+    });
+  } catch (error: any) {
+    const code = String(error?.message || "node_token_create_failed");
+    if (code === "cross_network_node" || code === "node_owner_unclaimed" || code === "node_owner_mismatch") return { ok: false, error: code };
+    throw error;
+  }
+  return { ok: true, token, token_id: tokenId, ...(nodeId ? { node_id: nodeId } : {}) };
 }
 
 export function resolveToken(token: string): { user: AuthUser; networkId: string | null; tokenName: string | null; tokenId: string | null } | null {
@@ -235,7 +306,7 @@ export function resolveToken(token: string): { user: AuthUser; networkId: string
 
 export function getUserNetworks(userId: string) {
   return db.all<any>(
-    "SELECT * FROM networks WHERE owner_id = ?1 ORDER BY created_at",
+    `SELECT ${NETWORK_REST_SELECT} FROM networks WHERE owner_id = ?1 ORDER BY created_at`,
     userId);
 }
 
@@ -280,7 +351,7 @@ export function listTokens(userId: string) {
 }
 
 export function renameNetwork(userId: string, networkId: string, newName: string): { ok: boolean; error?: string } {
-  const net = db.get<any>("SELECT * FROM networks WHERE network_id = ?1", networkId);
+  const net = db.get<any>("SELECT owner_id FROM networks WHERE network_id = ?1", networkId);
   if (!net) return { ok: false, error: "network not found" };
   if (net.owner_id !== userId) return { ok: false, error: "not your network" };
   const dup = db.get<any>("SELECT network_id FROM networks WHERE owner_id = ?1 AND network_name = ?2", userId, newName);
@@ -290,7 +361,7 @@ export function renameNetwork(userId: string, networkId: string, newName: string
 }
 
 export function deleteNetwork(userId: string, networkId: string): { ok: boolean; error?: string } {
-  const net = db.get<any>("SELECT * FROM networks WHERE network_id = ?1", networkId);
+  const net = db.get<any>("SELECT owner_id FROM networks WHERE network_id = ?1", networkId);
   if (!net) return { ok: false, error: "network not found" };
   if (net.owner_id !== userId) return { ok: false, error: "not your network" };
   // Check if any sessions/tasks still reference this network
@@ -449,7 +520,10 @@ export function createInvite(networkId: string, createdBy: string, role: string
 }
 
 export function joinByInvite(inviteCode: string, userId: string): { ok: boolean; network_id?: string; role?: string; error?: string } {
-  const invite = db.get<any>("SELECT * FROM network_invites WHERE invite_code = ?1", inviteCode);
+  const invite = db.get<any>(
+    "SELECT invite_code, network_id, role, created_by, max_uses, used_count, expires_at, created_at FROM network_invites WHERE invite_code = ?1",
+    inviteCode,
+  );
   if (!invite) return { ok: false, error: "invalid invite code" };
   if (invite.max_uses > 0 && invite.used_count >= invite.max_uses) return { ok: false, error: "invite code fully used" };
   if (invite.expires_at) {
@@ -474,7 +548,7 @@ export function joinByInvite(inviteCode: string, userId: string): { ok: boolean;
 /** Get all networks a user is a member of (replaces owner-only query) */
 export function getUserAllNetworks(userId: string) {
   return db.all<any>(
-    `SELECT n.*, nm.role as member_role
+    `SELECT ${sqlColumns(NETWORK_REST_COLUMNS, "n")}, nm.role as member_role
      FROM networks n JOIN network_members nm ON n.network_id = nm.network_id
      WHERE nm.user_id = ?1 ORDER BY nm.role = 'owner' DESC, n.created_at`,
     userId);

package/src/dashboard-slash-routing-http.test.ts

@@ -0,0 +1,103 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { isInteractiveDashboardTask } from "../../agent-node/src/inbox-dispatch";
+import { shouldCreateScheduledGoal } from "../../agent-node/src/goals/routing";
+import { createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-dashboard-slash-http-"));
+const TARGET = `dashboard-slash-target-${process.pid}`;
+const TARGET_NODE_ID = `node_dashboard_slash_target_${process.pid}`;
+const TARGET_RESUME_ID = `resume_dashboard_slash_target_${process.pid}`;
+let server: any;
+let base = "";
+let userToken = "";
+let nodeToken = "";
+let networkId = "";
+let requestSequence = 0;
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
+  const username = `dashboard_slash_${Date.now()}`;
+  const registered = register(username, "DashboardSlash123!", undefined, "seed");
+  expect(registered.ok).toBe(true);
+  userToken = registered.token!;
+  networkId = registered.network_id!;
+  const userId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", [username])!.user_id;
+  const minted = createNetworkTokenForNode(userId, networkId, "dashboard-slash-node");
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [TARGET_RESUME_ID, TARGET, TARGET_NODE_ID, networkId],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'), 'active')`,
+    [TARGET_NODE_ID, TARGET, networkId],
+  );
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+async function postAndRead(token: string, from: string, task: string) {
+  requestSequence += 1;
+  const clientRequestId = `dreq_${requestSequence.toString(16).padStart(32, "0")}`;
+  const response = await fetch(`${base}/api/task`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({
+      alias: TARGET,
+      from,
+      network_id: networkId,
+      task,
+      meta: { source: "dashboard-chat", client_request_id: clientRequestId, auth_origin: "user" },
+    }),
+  });
+  const body = await response.json() as any;
+  expect([200, 202]).toContain(response.status);
+  const taskId = body.task_id ?? body.message_id;
+  const row = db.get<{ content: string; meta_json: string }>(
+    "SELECT content, meta_json FROM inbox WHERE id = ?1",
+    [taskId],
+  );
+  expect(row).toBeTruthy();
+  return { type: "task", content: row!.content, meta_json: row!.meta_json };
+}
+
+describe("real Hub → authenticated Dashboard slash routing", () => {
+  test("Dashboard /goal and /loop remain exact native payloads for every runtime", async () => {
+    for (const command of ["/goal 更新一下文档", "/loop 5m native loop"] as const) {
+      const row = await postAndRead(userToken, "dashboard-user", command);
+      expect(row.content).toBe(command);
+      expect(isInteractiveDashboardTask(row)).toBe(true);
+      for (const runtime of ["codex-app-server", "codex", "claude", "grok", "opencode"] as const) {
+        expect(shouldCreateScheduledGoal(row.content, runtime, true)).toBe(false);
+      }
+    }
+  });
+
+  test("Dashboard /agoal and /aloop use the Agent Network scheduler", async () => {
+    for (const command of ["/agoal 5m update docs", "/aloop 5m update docs"] as const) {
+      const row = await postAndRead(userToken, "dashboard-user", command);
+      expect(isInteractiveDashboardTask(row)).toBe(true);
+      expect(shouldCreateScheduledGoal(row.content, "codex-app-server", true)).toBe(true);
+    }
+  });
+
+  test("node token cannot forge Dashboard pass-through and keeps legacy compatibility", async () => {
+    const row = await postAndRead(nodeToken, "dashboard-slash-node", "/loop 5m legacy automation");
+    expect(JSON.parse(row.meta_json).auth_origin).toBe("node");
+    expect(isInteractiveDashboardTask(row)).toBe(false);
+    expect(shouldCreateScheduledGoal(row.content, "codex-app-server", false)).toBe(true);
+  });
+});