@sleep2agi/commhub-server 0.9.0-preview.27 → 0.9.0-preview.29

package/src/db-adapter-guard.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+import {
+  assertSafeTestDatabaseEnv,
+  resolveDatabaseTarget,
+} from "./db-adapter";
+
+const BASE_ENV: NodeJS.ProcessEnv = { HOME: "/nonexistent" };
+
+describe("#435 inherited DATABASE_URL guard", () => {
+  for (const databaseUrl of [
+    "postgres://user:pw@prod.example:5432/commhub",
+    "postgresql://user:pw@prod.example:5432/commhub",
+    "sqlite:///tmp/not-an-escape",
+  ]) {
+    test(`NODE_ENV=test rejects ${databaseUrl.split(":", 1)[0]} DATABASE_URL`, () => {
+      expect(() => assertSafeTestDatabaseEnv({
+        ...BASE_ENV,
+        NODE_ENV: "test",
+        DATABASE_URL: databaseUrl,
+      })).toThrow(/REFUSING to honor inherited DATABASE_URL/);
+    });
+  }
+
+  test("test without DATABASE_URL leaves the existing SQLite guard in charge", () => {
+    expect(() => assertSafeTestDatabaseEnv({ ...BASE_ENV, NODE_ENV: "test" })).not.toThrow();
+    expect(() => resolveDatabaseTarget({ ...BASE_ENV, NODE_ENV: "test" }))
+      .toThrow(/REFUSING to open the default SQLite database/);
+  });
+
+  test("DATABASE_URL refusal wins even when COMMHUB_DB is also set", () => {
+    expect(() => resolveDatabaseTarget({
+      ...BASE_ENV,
+      NODE_ENV: "test",
+      DATABASE_URL: "postgres://user:pw@prod.example:5432/commhub",
+      COMMHUB_DB: "/tmp/isolated.db",
+    })).toThrow(/REFUSING to honor inherited DATABASE_URL/);
+  });
+
+  test("production postgres branch remains unchanged without constructing it", () => {
+    const url = "postgres://user:pw@prod.example:5432/commhub";
+    expect(resolveDatabaseTarget({
+      ...BASE_ENV,
+      NODE_ENV: "production",
+      DATABASE_URL: url,
+    })).toEqual({ kind: "postgres", url });
+  });
+
+  test("unset NODE_ENV still selects postgres", () => {
+    const url = "postgresql://user:pw@prod.example:5432/commhub";
+    expect(resolveDatabaseTarget({ ...BASE_ENV, DATABASE_URL: url }))
+      .toEqual({ kind: "postgres", url });
+  });
+
+  test("explicit SQLite targets remain unchanged in test and production", () => {
+    for (const NODE_ENV of ["test", "production"]) {
+      expect(resolveDatabaseTarget({
+        ...BASE_ENV,
+        NODE_ENV,
+        COMMHUB_DB: "/tmp/isolated.db",
+      })).toEqual({ kind: "sqlite", path: "/tmp/isolated.db" });
+    }
+  });
+
+  test("non-server callers cannot silently fall through to the production default SQLite path", () => {
+    for (const NODE_ENV of [undefined, "development", "production"]) {
+      expect(() => resolveDatabaseTarget({ ...BASE_ENV, NODE_ENV }))
+        .toThrow(/explicit COMMHUB_DB|COMMHUB_SERVER=1/);
+    }
+  });
+
+  test("the explicit server boot capability permits the canonical default SQLite path", () => {
+    expect(resolveDatabaseTarget({
+      ...BASE_ENV,
+      NODE_ENV: "production",
+      COMMHUB_SERVER: "1",
+    })).toEqual({ kind: "sqlite", path: "/nonexistent/.commhub/commhub.db" });
+  });
+
+  test("lookalike server capability values fail closed", () => {
+    for (const COMMHUB_SERVER of ["", "true", "yes", "01", " 1"] ) {
+      expect(() => resolveDatabaseTarget({ ...BASE_ENV, COMMHUB_SERVER }))
+        .toThrow(/COMMHUB_SERVER=1/);
+    }
+  });
+});

package/src/db-adapter.ts

@@ -212,10 +212,28 @@ export class PgAdapter implements DbAdapter {
 //  Factory
 // ════════════════════════════════════════════
 
+export type DbTarget =
+  | { kind: "postgres"; url: string }
+  | { kind: "sqlite"; path: string };
+
 /**
- * Create the appropriate adapter based on environment.
- * - DATABASE_URL starts with "postgres://" → PgAdapter
- * - Otherwise → SQLiteAdapter with COMMHUB_DB or default path
+ * Refuse every inherited DATABASE_URL under the Bun test environment before
+ * adapter selection, logging, DNS, or construction. A test that intentionally
+ * exercises PostgreSQL needs a separately reviewed isolated harness; accepting
+ * a shell/CI DATABASE_URL here could connect a unit test to production.
+ */
+export function assertSafeTestDatabaseEnv(env: NodeJS.ProcessEnv = process.env): void {
+  if (env.NODE_ENV === "test" && env.DATABASE_URL) {
+    throw new Error(
+      "[commhub] REFUSING to honor inherited DATABASE_URL under NODE_ENV=test.\n" +
+      "  Tests must unset DATABASE_URL and set COMMHUB_DB to an isolated path.\n" +
+      "  This guard is fail-closed and has no opt-in bypass."
+    );
+  }
+}
+
+/**
+ * Pure target selection after the inherited-DATABASE_URL safety gate.
  *
  * Test-default-prod GUARD: when `NODE_ENV === "test"` (set automatically by
  * `bun test`) AND `COMMHUB_DB` is unset, we REFUSE to fall through to the
@@ -227,27 +245,20 @@ export class PgAdapter implements DbAdapter {
  * pre-existing history of test pollution in the same DB). The guard makes
  * the failure mode loud + actionable instead of silent + destructive.
  *
- * The guard does NOT fire when:
- *   - COMMHUB_DB is set (the test runner's documented contract); or
- *   - NODE_ENV is unset (production server) or any non-"test" value.
- *
- * Operators who run `bun -e` snippets that touch the DB are expected to
- * `COMMHUB_DB=/tmp/...` themselves — `bun -e` doesn't set NODE_ENV, so the
- * guard can't catch that case. The rule (never read or write the
- * production hub database) is documented in CLAUDE.md.
+ * The production default path is a capability, not a generic fallback:
+ * only canonical server entrypoints set COMMHUB_SERVER=1 before importing
+ * the database graph. Tests, scripts, and `bun -e` probes must name an
+ * explicit COMMHUB_DB (or a reviewed PostgreSQL DATABASE_URL), so forgetting
+ * one fails before mkdir/open/write instead of touching the live Hub.
  */
-export function createAdapter(): DbAdapter {
-  const dbUrl = process.env.DATABASE_URL;
+function resolveDatabaseTargetAfterGuard(env: NodeJS.ProcessEnv): DbTarget {
+  const dbUrl = env.DATABASE_URL;
   if (dbUrl && (dbUrl.startsWith("postgres://") || dbUrl.startsWith("postgresql://"))) {
-    console.log("[commhub] database: PostgreSQL");
-    return new PgAdapter(dbUrl);
+    return { kind: "postgres", url: dbUrl };
   }
-  // Default: SQLite
-  const { mkdirSync } = require("fs");
-  const { dirname } = require("path");
 
   // Test-default-prod GUARD (see docblock above).
-  if (process.env.NODE_ENV === "test" && !process.env.COMMHUB_DB) {
+  if (env.NODE_ENV === "test" && !env.COMMHUB_DB) {
     throw new Error(
       "[commhub] REFUSING to open the default SQLite database under NODE_ENV=test.\n" +
       "  Tests must explicitly set COMMHUB_DB to a throwaway path so they don't\n" +
@@ -257,10 +268,40 @@ export function createAdapter(): DbAdapter {
     );
   }
 
-  const dbPath = process.env.COMMHUB_DB || `${process.env.HOME}/.commhub/commhub.db`;
-  mkdirSync(dirname(dbPath), { recursive: true });
-  console.log(`[commhub] database: ${dbPath}`);
-  const rawDb = new Database(dbPath);
+  if (!env.COMMHUB_DB && env.COMMHUB_SERVER !== "1") {
+    throw new Error(
+      "[commhub] REFUSING to open the default production SQLite database from a non-server entrypoint.\n" +
+      "  Scripts and probes must set an explicit COMMHUB_DB path. The canonical\n" +
+      "  Hub entrypoints set COMMHUB_SERVER=1 before loading the database."
+    );
+  }
+
+  return { kind: "sqlite", path: env.COMMHUB_DB || `${env.HOME}/.commhub/commhub.db` };
+}
+
+/** Pure public resolver used by tests without constructing an adapter. */
+export function resolveDatabaseTarget(env: NodeJS.ProcessEnv = process.env): DbTarget {
+  assertSafeTestDatabaseEnv(env);
+  return resolveDatabaseTargetAfterGuard(env);
+}
+
+/**
+ * Create the appropriate adapter based on environment.
+ * The inherited-DATABASE_URL guard is deliberately the first executable line.
+ */
+export function createAdapter(): DbAdapter {
+  assertSafeTestDatabaseEnv(process.env);
+  const target = resolveDatabaseTargetAfterGuard(process.env);
+  if (target.kind === "postgres") {
+    console.log("[commhub] database: PostgreSQL");
+    return new PgAdapter(target.url);
+  }
+
+  const { mkdirSync } = require("fs");
+  const { dirname } = require("path");
+  mkdirSync(dirname(target.path), { recursive: true });
+  console.log(`[commhub] database: ${target.path}`);
+  const rawDb = new Database(target.path);
   rawDb.exec("PRAGMA journal_mode=WAL");
   rawDb.exec("PRAGMA busy_timeout=5000");
   return new SQLiteAdapter(rawDb);

package/src/db.ts

@@ -89,6 +89,8 @@ for (const col of [
   { name: "process_cpu_pct", def: "REAL" },
   { name: "process_uptime_seconds", def: "REAL" },
   { name: "process_in_flight_count", def: "INTEGER" },
+  { name: "external_schedules", def: "TEXT" },
+  { name: "peer_reply_inbox_capable", def: "INTEGER NOT NULL DEFAULT 0" },
 ]) {
   try { db.exec(`ALTER TABLE sessions ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }
@@ -162,6 +164,11 @@ for (const col of [
   { name: "scope", def: "TEXT DEFAULT 'single'" },
   { name: "meta_json", def: "TEXT" },
   { name: "node_id", def: "TEXT" },
+  // #520 — explicit logical task identity.  Initial deliveries historically
+  // used inbox.id == tasks.task_id, while retry/reassign generate a fresh
+  // inbox row id.  Keep transport-row identity and logical-task identity
+  // separate so runtime evidence/replies survive those redeliveries.
+  { name: "task_id", def: "TEXT" },
 ]) {
   try { db.exec(`ALTER TABLE inbox ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }
@@ -191,6 +198,8 @@ db.exec(`
     created_at        TEXT NOT NULL DEFAULT (datetime('now')),
     delivered_at      TEXT,
     started_at        TEXT,
+    runtime_submitted_at TEXT,
+    consumed_at       TEXT,
     completed_at      TEXT,
     expires_at        TEXT
   );
@@ -237,6 +246,8 @@ db.exec(`
     task_id       TEXT NOT NULL,
     from_status   TEXT,
     to_status     TEXT NOT NULL,
+    event_type    TEXT,
+    event_key     TEXT,
     actor         TEXT NOT NULL DEFAULT 'system',
     detail        TEXT,
     created_at    TEXT NOT NULL DEFAULT (datetime('now'))
@@ -301,6 +312,16 @@ try {
   if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
 }
 
+// RFC-036 / B4 — immutable per-node owner. New nodes receive this value in
+// the same transaction that mints their node token. Heartbeats may verify the
+// binding but must never first-claim or replace it. Legacy NULL rows remain
+// read-only for external-schedule writes.
+try {
+  db.exec(`ALTER TABLE nodes ADD COLUMN owner_user_id TEXT`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
 // RFC-026 §9 / #338 PR2 — daemon self-declare fields promoted from
 // config_snapshot to first-class indexable columns. The hub
 // `list_host_supervisors` MCP tool reads these directly without parsing
@@ -495,6 +516,7 @@ for (const ddl of [
   "ALTER TABLE api_tokens ADD COLUMN request_id TEXT",
   "ALTER TABLE api_tokens ADD COLUMN revoked_at TEXT",
   "ALTER TABLE api_tokens ADD COLUMN role TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN bound_node_id TEXT",
 ]) {
   try { db.exec(ddl); }
   catch (e: any) {
@@ -503,6 +525,8 @@ for (const ddl of [
 }
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_request ON api_tokens(request_id)`); }
 catch (e: any) { /* index may already exist */ void e; }
+try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_bound_node ON api_tokens(bound_node_id)`); }
+catch (e: any) { void e; }
 
 // RFC-026 v4 §2.5 + §4.4 — node_create_requests. Metadata only;
 // env_blob NEVER lives in this table (F1 mint-stream-evict — secret
@@ -634,6 +658,37 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_audit_network ON audit_log(network_id);
 `);
 
+// SkillHub — immutable, network-scoped skill submissions. A (network, slug,
+// version) tuple is write-once: retries with the same content are idempotent,
+// while different content must use a new version. Node submissions remain
+// pending until an owner/admin explicitly publishes them.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS skillhub_skills (
+    skill_id          TEXT PRIMARY KEY,
+    network_id        TEXT NOT NULL,
+    slug              TEXT NOT NULL,
+    name              TEXT NOT NULL,
+    description       TEXT NOT NULL DEFAULT '',
+    version           TEXT NOT NULL,
+    content           TEXT NOT NULL,
+    content_hash      TEXT NOT NULL,
+    status            TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'published', 'rejected', 'archived')),
+    source_type       TEXT NOT NULL CHECK(source_type IN ('node', 'user')),
+    source_alias      TEXT,
+    created_by_user   TEXT,
+    reviewed_by_user  TEXT,
+    review_note       TEXT,
+    created_at        TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at        TEXT NOT NULL DEFAULT (datetime('now')),
+    reviewed_at       TEXT,
+    UNIQUE(network_id, slug, version)
+  );
+  CREATE INDEX IF NOT EXISTS idx_skillhub_network_status
+    ON skillhub_skills(network_id, status, updated_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_skillhub_network_slug
+    ON skillhub_skills(network_id, slug, version);
+`);
+
 // ── V3: licenses table ──
 db.exec(`
   CREATE TABLE IF NOT EXISTS licenses (
@@ -744,6 +799,14 @@ for (const table of ["sessions", "nodes", "tasks", "inbox", "task_events", "comp
   try { db.exec(`ALTER TABLE ${table} ADD COLUMN network_id TEXT`); } catch {}
 }
 
+// #167 — stable lifecycle event names plus an internal idempotency key.
+// Ordinary status transitions keep event_key NULL, so retries and repeated
+// transitions remain auditable. Watcher warnings set a stable key; the unique
+// index makes every (task, threshold) write-once across patrol rounds/workers.
+try { db.exec("ALTER TABLE task_events ADD COLUMN event_type TEXT"); } catch {}
+try { db.exec("ALTER TABLE task_events ADD COLUMN event_key TEXT"); } catch {}
+try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_task_events_task_key ON task_events(task_id, event_key)"); } catch {}
+
 // PR-1 (#146): durable node identity on historical inbox/tasks rows. Some
 // existing databases created `tasks` before from_node_id/to_node_id were in the
 // CREATE TABLE statement, so keep these ALTERs explicit and idempotent.
@@ -1030,6 +1093,102 @@ try { db.exec("CREATE INDEX IF NOT EXISTS idx_completions_network ON completions
 // the reply up the chain via parent_task_id.
 try { db.exec("ALTER TABLE tasks ADD COLUMN parent_task_id TEXT"); } catch {}
 try { db.exec("ALTER TABLE tasks ADD COLUMN meta_json TEXT"); } catch {}
+// #520 — two monotonic evidence levels for this exact task:
+// runtime_submitted_at means agent-node handed the body to the vendor runtime;
+// consumed_at requires an attributable turn-start/first-activity signal.
+// Both stay separate from delivered_at (enqueue), acked (process receipt), and
+// started_at (legacy report_status/content matching). Old binaries ignore them.
+try { db.exec("ALTER TABLE tasks ADD COLUMN runtime_submitted_at TEXT"); } catch {}
+try { db.exec("ALTER TABLE tasks ADD COLUMN consumed_at TEXT"); } catch {}
+
+// ── Hub scheduled tasks ──────────────────────────────────────────────
+// Scheduling is a Hub concern: clients manage these rows, while agents only
+// receive the ordinary inbox/tasks rows produced for each occurrence.  Keep
+// the occurrence table separate so retries, skips and failures remain
+// auditable without overloading the task lifecycle.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS scheduled_tasks (
+    schedule_id      TEXT PRIMARY KEY,
+    network_id       TEXT NOT NULL,
+    created_by       TEXT,
+    name             TEXT NOT NULL,
+    target_node_id   TEXT NOT NULL,
+    target_alias     TEXT NOT NULL,
+    task_content     TEXT NOT NULL,
+    priority         TEXT NOT NULL DEFAULT 'normal',
+    schedule_type    TEXT NOT NULL,
+    schedule_json    TEXT NOT NULL,
+    timezone         TEXT NOT NULL DEFAULT 'UTC',
+    overlap_policy   TEXT NOT NULL DEFAULT 'skip',
+    misfire_policy   TEXT NOT NULL DEFAULT 'catch_up_once',
+    status           TEXT NOT NULL DEFAULT 'active',
+    next_run_at      TEXT,
+    last_run_at      TEXT,
+    revision         INTEGER NOT NULL DEFAULT 1,
+    created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_due
+    ON scheduled_tasks(status, next_run_at);
+  CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_network
+    ON scheduled_tasks(network_id, updated_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_target
+    ON scheduled_tasks(network_id, target_node_id);
+
+  CREATE TABLE IF NOT EXISTS scheduled_task_runs (
+    run_id           TEXT PRIMARY KEY,
+    schedule_id      TEXT NOT NULL,
+    network_id       TEXT NOT NULL,
+    scheduled_for    TEXT NOT NULL,
+    task_id          TEXT,
+    status           TEXT NOT NULL,
+    error_code       TEXT,
+    error_message    TEXT,
+    created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+    completed_at     TEXT,
+    UNIQUE(schedule_id, scheduled_for)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_scheduled_runs_schedule
+    ON scheduled_task_runs(schedule_id, created_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_scheduled_runs_network
+    ON scheduled_task_runs(network_id, created_at DESC);
+`);
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN misfire_policy TEXT NOT NULL DEFAULT 'catch_up_once'"); } catch {}
+
+// RFC-036 / B4 — owner-authorized edits of node-host managed schedules.
+// This is intentionally separate from Hub scheduled_tasks: these rows are
+// one-shot control intents consumed by the exact token-bound node. The partial
+// unique index makes the single-flight promise survive multiple Hub workers.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS external_schedule_edits (
+    intent_id          TEXT PRIMARY KEY,
+    network_id         TEXT NOT NULL,
+    node_id            TEXT NOT NULL,
+    schedule_id        TEXT NOT NULL,
+    base_revision      INTEGER NOT NULL,
+    patch_json         TEXT NOT NULL,
+    status             TEXT NOT NULL DEFAULT 'pending',
+    expires_at         INTEGER NOT NULL,
+    created_at         INTEGER NOT NULL,
+    delivered_at       INTEGER,
+    acked_at           INTEGER,
+    created_by_user    TEXT NOT NULL,
+    created_by_token   TEXT NOT NULL,
+    consumed_by_token  TEXT,
+    result_revision    INTEGER,
+    error_code         TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_external_schedule_edits_node
+    ON external_schedule_edits(network_id, node_id, status, created_at);
+  CREATE INDEX IF NOT EXISTS idx_external_schedule_edits_owner
+    ON external_schedule_edits(created_by_user, created_at DESC);
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_external_schedule_edits_singleflight
+    ON external_schedule_edits(node_id, schedule_id)
+    WHERE status IN ('pending', 'delivered');
+`);
 try { db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_parent ON tasks(parent_task_id)"); } catch {}
 
 // Helpers
@@ -1338,38 +1497,40 @@ export function chainReplyToParent(
     const marker = `\n\n[via ${childAlias} 子任务结果]\n${currentReply}`;
     const newResult = parent.result ? parent.result + marker : `[via ${childAlias} 子任务结果]\n${currentReply}`;
 
-    // Bump parent status to replied if still open. If it was already replied
-    // (e.g. 指挥室 sent an early status update), we still want to update the
-    // result so the dashboard can render the final chained answer — but keep
-    // status as replied (it was already terminal).
-    if (parent.status === "delivered" || parent.status === "acked" || parent.status === "running" || parent.status === "created") {
-      db.run(
-        "UPDATE tasks SET status = ?1, result = ?2, completed_at = datetime('now') WHERE task_id = ?3",
-        [replyStatus, newResult.slice(0, 8000), parent.task_id]
-      );
-      logTaskEvent(parent.task_id, parent.status, replyStatus, "auto-chain", `from ${childAlias}`);
-    } else {
-      db.run(
-        "UPDATE tasks SET result = ?1, completed_at = datetime('now') WHERE task_id = ?2",
-        [newResult.slice(0, 8000), parent.task_id]
-      );
-      logTaskEvent(parent.task_id, parent.status, parent.status, "auto-chain-append", `from ${childAlias}`);
-    }
-
-    if (parent.from_name && parent.from_name !== "hub" && parent.from_name !== "api") {
-      try {
-        const notifyId = `chain_${crypto.randomUUID().replace(/-/g, "").slice(0, 16)}`;
-        const notifyNode = db.get<{ node_id: string | null }>(
-          "SELECT node_id FROM sessions WHERE alias = ?1 AND COALESCE(network_id, 'default') = COALESCE(?2, 'default') ORDER BY updated_at DESC LIMIT 1",
-          [parent.from_name, parent.network_id ?? null]
+    db.transaction(() => {
+      // Bump parent status to replied if still open. The task transition and
+      // its scheduler-run mirror share this transaction, so a crash cannot
+      // leave one terminal while the other remains delivered.
+      if (parent.status === "delivered" || parent.status === "acked" || parent.status === "running" || parent.status === "created") {
+        db.run(
+          "UPDATE tasks SET status = ?1, result = ?2, completed_at = datetime('now') WHERE task_id = ?3",
+          [replyStatus, newResult.slice(0, 8000), parent.task_id]
         );
+        syncScheduledRunForTask(parent.task_id, parent.network_id);
+        logTaskEvent(parent.task_id, parent.status, replyStatus, "auto-chain", `from ${childAlias}`);
+      } else {
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id)
-           VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7)`,
-          [notifyId, parent.from_name, notifyNode?.node_id ?? null, `[${childAlias} 子任务完成]\n${currentReply.slice(0, 4000)}`, parent.to_name, parent.task_id, parent.network_id ?? null]
+          "UPDATE tasks SET result = ?1, completed_at = datetime('now') WHERE task_id = ?2",
+          [newResult.slice(0, 8000), parent.task_id]
         );
-      } catch {}
-    }
+        logTaskEvent(parent.task_id, parent.status, parent.status, "auto-chain-append", `from ${childAlias}`);
+      }
+
+      if (parent.from_name && parent.from_name !== "hub" && parent.from_name !== "api") {
+        try {
+          const notifyId = `chain_${crypto.randomUUID().replace(/-/g, "").slice(0, 16)}`;
+          const notifyNode = db.get<{ node_id: string | null }>(
+            "SELECT node_id FROM sessions WHERE alias = ?1 AND COALESCE(network_id, 'default') = COALESCE(?2, 'default') ORDER BY updated_at DESC LIMIT 1",
+            [parent.from_name, parent.network_id ?? null]
+          );
+          db.run(
+            `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id)
+             VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7)`,
+            [notifyId, parent.from_name, notifyNode?.node_id ?? null, `[${childAlias} 子任务完成]\n${currentReply.slice(0, 4000)}`, parent.to_name, parent.task_id, parent.network_id ?? null]
+          );
+        } catch {}
+      }
+    });
 
     // This iteration actually wrote a parent row (and possibly an
     // inbox notification). Record that so the caller can gate its
@@ -1383,12 +1544,98 @@ export function chainReplyToParent(
   return { chained };
 }
 
+const SCHEDULED_RUN_TERMINAL_STATUSES = new Set(["replied", "failed", "cancelled", "expired"]);
+
+type ScheduledTaskLifecycleRow = {
+  task_id: string;
+  network_id: string | null;
+  status: string;
+  completed_at: string | null;
+};
+
+type ScheduledTaskBinding = { run_id: string; schedule_id: string };
+
+/**
+ * Mirror an exact scheduler-created task's lifecycle into its run row.
+ *
+ * The status is always read back from `tasks`; callers cannot supply one.
+ * The scheduler's storage binding is the four-part tuple
+ * (run_id, schedule_id, task_id, network_id). It is read from
+ * `scheduled_task_runs`, not caller-controlled task metadata (which may also
+ * legitimately be replaced by reply attachment metadata).
+ *
+ * Terminal states close the run. `retry_task` calls this after resetting the
+ * same logical task_id to delivered, which deliberately reopens that run so
+ * the history reflects the current retry rather than the first failed attempt.
+ */
+export function syncScheduledRunForTask(taskId: string, expectedNetworkId?: string | null): { matched: boolean; status?: string } {
+  const task = db.get<ScheduledTaskLifecycleRow>(
+    `SELECT task_id, network_id, status, completed_at
+       FROM tasks
+      WHERE task_id = ?1
+        AND (?2 IS NULL OR network_id = ?2)`,
+    taskId,
+    expectedNetworkId ?? null,
+  );
+  if (!task?.network_id) return { matched: false };
+  const bindings = db.all<ScheduledTaskBinding>(
+    `SELECT run_id, schedule_id FROM scheduled_task_runs
+      WHERE task_id = ?1 AND network_id = ?2`,
+    task.task_id,
+    task.network_id,
+  );
+  // One task belongs to at most one scheduled occurrence. Fail closed if a
+  // corrupt/legacy database violates that invariant rather than fanning one
+  // lifecycle transition into multiple runs.
+  if (bindings.length !== 1) return { matched: false };
+  const binding = bindings[0];
+
+  if (SCHEDULED_RUN_TERMINAL_STATUSES.has(task.status)) {
+    const errorCode = task.status === "replied" ? null : `task_${task.status}`;
+    const updated = db.run(
+      `UPDATE scheduled_task_runs
+          SET status = ?1,
+              error_code = ?2,
+              error_message = NULL,
+              completed_at = COALESCE(?3, datetime('now'))
+        WHERE run_id = ?4 AND task_id = ?5 AND network_id = ?6 AND schedule_id = ?7`,
+      [task.status, errorCode, task.completed_at, binding.run_id, task.task_id, task.network_id, binding.schedule_id],
+    );
+    return { matched: updated.changes === 1, status: task.status };
+  }
+
+  if (task.status === "delivered") {
+    const updated = db.run(
+      `UPDATE scheduled_task_runs
+          SET status = 'delivered', error_code = NULL, error_message = NULL, completed_at = NULL
+        WHERE run_id = ?1 AND task_id = ?2 AND network_id = ?3 AND schedule_id = ?4`,
+      [binding.run_id, task.task_id, task.network_id, binding.schedule_id],
+    );
+    return { matched: updated.changes === 1, status: task.status };
+  }
+
+  return { matched: false };
+}
+
+function taskEventTypeForStatus(toStatus: string): string {
+  switch (toStatus) {
+    case "delivered": return "task.send.delivered";
+    case "acked": return "task.ack";
+    case "running": return "task.started";
+    case "replied": return "task.replied";
+    case "expired": return "task.expired";
+    case "failed":
+    case "cancelled": return "task.failed";
+    default: return `task.status.${toStatus}`;
+  }
+}
+
 export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus: string, actor: string, detail?: string) {
   try {
     db.run(
-      `INSERT INTO task_events (task_id, from_status, to_status, actor, detail, network_id)
-       VALUES (?1, ?2, ?3, ?4, ?5, (SELECT network_id FROM tasks WHERE task_id = ?1))`,
-      [taskId, fromStatus, toStatus, actor, detail ?? null]
+      `INSERT INTO task_events (task_id, from_status, to_status, event_type, actor, detail, network_id)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, (SELECT network_id FROM tasks WHERE task_id = ?1))`,
+      [taskId, fromStatus, toStatus, taskEventTypeForStatus(toStatus), actor, detail ?? null]
     );
   } catch {}
 }

package/src/ext-token-shared.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildStoragePath,
+  pathForExistingBlob,
+  validateIndexEntry,
+} from "./uploads.js";
+
+const fileId = "0123456789abcdef0123456789abcdef";
+const dateBucket = "2026-08-09";
+const uploadsRoot = "/srv/uploads";
+
+const malicious = [
+  "../x",
+  "/abs/x",
+  ".png/../../y",
+  ".p ng",
+  ".p\0ng",
+  ".\\..\\x",
+  "." + "a".repeat(17),
+  ".tar.gz",
+];
+
+const legal = ["", ".png", ".PNG", ".mp4", "." + "a".repeat(16)];
+
+describe("#527 shared extension-token invariant", () => {
+  test("new-upload path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => buildStoragePath(fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(buildStoragePath(fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("existing-blob path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("stored-index gate rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+    for (const ext of legal) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(true);
+    }
+  });
+
+  test("all three boundaries fail closed on non-string runtime values", () => {
+    for (const ext of [undefined, null, 7, {}, []]) {
+      expect(() => buildStoragePath(fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+  });
+});