@sleep2agi/commhub-server 0.9.0-preview.3 → 0.9.0-preview.30

package/src/config-apply-validate.ts

@@ -57,6 +57,35 @@ export const RESTART_REQUIRED_FLAGS = new Set<string>([
   "timeout",
 ]);
 
+/**
+ * Channels the dashboard may enable/disable on a node via
+ * update_node_config. Intentionally narrow — the panel only exposes
+ * enable/disable, per-channel secrets stay in the node's local
+ * config.json (see #260 wire discipline).
+ *
+ * The list mirrors agent-node's actual runtime capability. See
+ * agent-node/src/cli.ts:671-676 — CHANNELS are parsed into per-type
+ * worker inits (initTelegramChannel + initFeishuChannel), and any
+ * other channel type triggers `process.exit(1)` at boot. So the
+ * hub-side allow-list here is telegram + feishu ONLY. `commhub` is
+ * the RPC transport that every node speaks unconditionally; treating
+ * it as a per-node channel would be a UX lie (toggle looks off but
+ * commhub is always on).
+ *
+ * Dashboard PR #31 currently includes `commhub` in its own
+ * EDITABLE_CHANNELS whitelist — that follow-up narrowing is filed for
+ * the next dashboard rally, and until then hub silently drops any
+ * `commhub` entry via narrowChannelsPatch.
+ *
+ * Not part of SECURITY_SENSITIVE_FLAGS (通信龙 P5 派工): flipping a
+ * channel on/off is a lifecycle-tier operation like `restart_node`, not
+ * a privilege elevation. Cross-tenant reach is already gated by SEC-1.
+ */
+export const EDITABLE_CHANNELS = new Set<string>([
+  "telegram",
+  "feishu",
+]);
+
 /**
  * Role-gate for the patch's flag set. SEC-2 enforcement lives here.
  *
@@ -99,22 +128,53 @@ export function isAllowedToChangeFlag(
 
 /**
  * Classify the patch's required apply mode. Empty patch (model + flags
- * both empty) → "restart_only" (used by restart_node tool). Any
- * restart-required field present → "restart". Otherwise → "hot".
+ * both empty, no channels) → "restart_only" (used by restart_node tool).
+ * Any restart-required field present, OR a channels change → "restart"
+ * (channels is restart-tier by design: the node reads its channel set
+ * once at boot in agent-node/src/cli.ts and forks per-channel workers
+ * from it, so a channel enable/disable takes effect on process restart
+ * only — see #260 P5 wire discipline). Otherwise → "hot".
  */
 export function computeApplyMode(
   model: string | undefined,
   flags: Record<string, unknown>,
+  channels?: string[] | undefined,
 ): "hot" | "restart" | "restart_only" {
-  const fieldCount = (model !== undefined ? 1 : 0) + Object.keys(flags).length;
+  const fieldCount = (model !== undefined ? 1 : 0) + Object.keys(flags).length + (channels !== undefined ? 1 : 0);
   if (fieldCount === 0) return "restart_only";
   if (model !== undefined) return "restart";
+  if (channels !== undefined) return "restart";
   for (const key of Object.keys(flags)) {
     if (RESTART_REQUIRED_FLAGS.has(key)) return "restart";
   }
   return "hot";
 }
 
+/**
+ * Narrow + allow-list `channels` from untrusted patch JSON. Returns the
+ * final channel key list (case-folded, deduped, in EDITABLE_CHANNELS
+ * order-preserving), OR null if the input isn't an array. Non-strings,
+ * unknown keys, empty strings, and duplicates are silently dropped —
+ * same fail-shape as the dashboard route's whitelist so the two sides
+ * behave identically end-to-end. Callers pass `undefined` through when
+ * the patch didn't include a channels key at all (a distinct case from
+ * `channels: []` which means "disable all editable channels").
+ */
+export function narrowChannelsPatch(raw: unknown): string[] | null {
+  if (!Array.isArray(raw)) return null;
+  const allow = EDITABLE_CHANNELS;
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const v of raw) {
+    if (typeof v !== "string") continue;
+    const key = v.trim().toLowerCase();
+    if (!allow.has(key) || seen.has(key)) continue;
+    seen.add(key);
+    out.push(key);
+  }
+  return out;
+}
+
 /**
  * Validate the patch shape — allowlist + per-field range / enum. Returns
  * null on pass, or `{ field, reason }` on reject. Caller wraps in error
@@ -123,12 +183,30 @@ export function computeApplyMode(
 export function validatePatch(
   model: string | undefined,
   flags: Record<string, unknown>,
+  channels?: string[] | undefined,
 ): { field: string; reason: string } | null {
   if (model !== undefined) {
     if (typeof model !== "string" || model.length === 0 || model.length > 200) {
       return { field: "model", reason: "must be a non-empty string ≤ 200 chars" };
     }
   }
+  if (channels !== undefined) {
+    // Zod already enforced string[], and narrowChannelsPatch dropped
+    // unknown keys before this point — but re-verify defensively so a
+    // future caller that skips narrowChannelsPatch can't smuggle
+    // unknown keys through validatePatch alone.
+    if (!Array.isArray(channels)) {
+      return { field: "channels", reason: "must be an array of strings" };
+    }
+    for (const c of channels) {
+      if (typeof c !== "string") {
+        return { field: "channels", reason: "must contain only strings" };
+      }
+      if (!EDITABLE_CHANNELS.has(c)) {
+        return { field: `channels.${c}`, reason: "not in editable channels allowlist" };
+      }
+    }
+  }
   for (const [key, val] of Object.entries(flags)) {
     if (!ALLOWED_FLAGS.has(key)) {
       return { field: `flags.${key}`, reason: "not in allowlist" };

package/src/create-node.ts

@@ -272,8 +272,55 @@ export function resolveCallerDaemonTokenBound(opts: {
 // RFC-026 §4.5 — append a row to audit_log for every create_node
 // lifecycle event. Best-effort: never throw out (calling tool should
 // continue even if audit insert fails for any reason).
+/** RFC-027 §4.5 D8 — tx-aware variant. Identical SQL to auditCreateNode
+ *  but RE-THROWS on failure so a BEGIN..COMMIT around lifecycle UPDATE +
+ *  audit INSERT can ROLLBACK if the audit row would have been lost.
+ *  Required for the "no audit-but state changed" window that §4.5 / D8
+ *  explicitly closes (PR1 SF-2 review catch — auditCreateNode's
+ *  swallow-and-warn defeats atomicity).
+ *
+ *  Callers in a non-transaction context should keep using auditCreateNode
+ *  (best-effort, never throws). */
+export function auditCreateNodeStrict(input: {
+  action: Parameters<typeof auditCreateNode>[0]["action"];
+  user_id?: string | null;
+  username?: string | null;
+  network_id?: string | null;
+  target_id?: string | null;
+  detail: Record<string, unknown>;
+}): void {
+  db.run(
+    `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+     VALUES (?1, ?2, ?3, 'node_create_request', ?4, ?5, ?6)`,
+    [
+      input.user_id || null,
+      input.username || null,
+      input.action,
+      input.target_id || null,
+      JSON.stringify(input.detail),
+      input.network_id || null,
+    ],
+  );
+}
+
 export function auditCreateNode(input: {
-  action: "create_node_dispatched" | "create_node_rejected" | "create_node_succeeded" | "create_node_sweeper_revoked";
+  action:
+    | "create_node_dispatched"
+    | "create_node_rejected"
+    | "create_node_succeeded"
+    | "create_node_sweeper_revoked"
+    | "daemon_capability_lied"                  // RFC-026 §9.3 D2 — daemon declared runtime support, child died before serving
+    // RFC-027 §4.5 — stop/delete lifecycle audit action enum extension.
+    // Re-using auditCreateNode is fine: the action column carries the
+    // discriminator; target_type stays 'node_create_request' which is a
+    // misnomer for stop/delete rows but updating the schema would force a
+    // wider migration (see P1.1 issue).
+    | "stop_node_dispatched"
+    | "stop_node_completed"
+    | "delete_node_dispatched"
+    | "delete_node_completed"
+    | "forced_stop_with_in_flight"
+    | "backup_purged";
   user_id?: string | null;
   username?: string | null;
   network_id?: string | null;

package/src/dashboard-slash-routing-http.test.ts

@@ -0,0 +1,103 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { isInteractiveDashboardTask } from "../../agent-node/src/inbox-dispatch";
+import { shouldCreateScheduledGoal } from "../../agent-node/src/goals/routing";
+import { createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-dashboard-slash-http-"));
+const TARGET = `dashboard-slash-target-${process.pid}`;
+const TARGET_NODE_ID = `node_dashboard_slash_target_${process.pid}`;
+const TARGET_RESUME_ID = `resume_dashboard_slash_target_${process.pid}`;
+let server: any;
+let base = "";
+let userToken = "";
+let nodeToken = "";
+let networkId = "";
+let requestSequence = 0;
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
+  const username = `dashboard_slash_${Date.now()}`;
+  const registered = register(username, "DashboardSlash123!", undefined, "seed");
+  expect(registered.ok).toBe(true);
+  userToken = registered.token!;
+  networkId = registered.network_id!;
+  const userId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", [username])!.user_id;
+  const minted = createNetworkTokenForNode(userId, networkId, "dashboard-slash-node");
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [TARGET_RESUME_ID, TARGET, TARGET_NODE_ID, networkId],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'), 'active')`,
+    [TARGET_NODE_ID, TARGET, networkId],
+  );
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+async function postAndRead(token: string, from: string, task: string) {
+  requestSequence += 1;
+  const clientRequestId = `dreq_${requestSequence.toString(16).padStart(32, "0")}`;
+  const response = await fetch(`${base}/api/task`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({
+      alias: TARGET,
+      from,
+      network_id: networkId,
+      task,
+      meta: { source: "dashboard-chat", client_request_id: clientRequestId, auth_origin: "user" },
+    }),
+  });
+  const body = await response.json() as any;
+  expect([200, 202]).toContain(response.status);
+  const taskId = body.task_id ?? body.message_id;
+  const row = db.get<{ content: string; meta_json: string }>(
+    "SELECT content, meta_json FROM inbox WHERE id = ?1",
+    [taskId],
+  );
+  expect(row).toBeTruthy();
+  return { type: "task", content: row!.content, meta_json: row!.meta_json };
+}
+
+describe("real Hub → authenticated Dashboard slash routing", () => {
+  test("Dashboard /goal and /loop remain exact native payloads for every runtime", async () => {
+    for (const command of ["/goal 更新一下文档", "/loop 5m native loop"] as const) {
+      const row = await postAndRead(userToken, "dashboard-user", command);
+      expect(row.content).toBe(command);
+      expect(isInteractiveDashboardTask(row)).toBe(true);
+      for (const runtime of ["codex-app-server", "codex", "claude", "grok", "opencode"] as const) {
+        expect(shouldCreateScheduledGoal(row.content, runtime, true)).toBe(false);
+      }
+    }
+  });
+
+  test("Dashboard /agoal and /aloop use the Agent Network scheduler", async () => {
+    for (const command of ["/agoal 5m update docs", "/aloop 5m update docs"] as const) {
+      const row = await postAndRead(userToken, "dashboard-user", command);
+      expect(isInteractiveDashboardTask(row)).toBe(true);
+      expect(shouldCreateScheduledGoal(row.content, "codex-app-server", true)).toBe(true);
+    }
+  });
+
+  test("node token cannot forge Dashboard pass-through and keeps legacy compatibility", async () => {
+    const row = await postAndRead(nodeToken, "dashboard-slash-node", "/loop 5m legacy automation");
+    expect(JSON.parse(row.meta_json).auth_origin).toBe("node");
+    expect(isInteractiveDashboardTask(row)).toBe(false);
+    expect(shouldCreateScheduledGoal(row.content, "codex-app-server", false)).toBe(true);
+  });
+});

package/src/db-adapter-guard.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+import {
+  assertSafeTestDatabaseEnv,
+  resolveDatabaseTarget,
+} from "./db-adapter";
+
+const BASE_ENV: NodeJS.ProcessEnv = { HOME: "/nonexistent" };
+
+describe("#435 inherited DATABASE_URL guard", () => {
+  for (const databaseUrl of [
+    "postgres://user:pw@prod.example:5432/commhub",
+    "postgresql://user:pw@prod.example:5432/commhub",
+    "sqlite:///tmp/not-an-escape",
+  ]) {
+    test(`NODE_ENV=test rejects ${databaseUrl.split(":", 1)[0]} DATABASE_URL`, () => {
+      expect(() => assertSafeTestDatabaseEnv({
+        ...BASE_ENV,
+        NODE_ENV: "test",
+        DATABASE_URL: databaseUrl,
+      })).toThrow(/REFUSING to honor inherited DATABASE_URL/);
+    });
+  }
+
+  test("test without DATABASE_URL leaves the existing SQLite guard in charge", () => {
+    expect(() => assertSafeTestDatabaseEnv({ ...BASE_ENV, NODE_ENV: "test" })).not.toThrow();
+    expect(() => resolveDatabaseTarget({ ...BASE_ENV, NODE_ENV: "test" }))
+      .toThrow(/REFUSING to open the default SQLite database/);
+  });
+
+  test("DATABASE_URL refusal wins even when COMMHUB_DB is also set", () => {
+    expect(() => resolveDatabaseTarget({
+      ...BASE_ENV,
+      NODE_ENV: "test",
+      DATABASE_URL: "postgres://user:pw@prod.example:5432/commhub",
+      COMMHUB_DB: "/tmp/isolated.db",
+    })).toThrow(/REFUSING to honor inherited DATABASE_URL/);
+  });
+
+  test("production postgres branch remains unchanged without constructing it", () => {
+    const url = "postgres://user:pw@prod.example:5432/commhub";
+    expect(resolveDatabaseTarget({
+      ...BASE_ENV,
+      NODE_ENV: "production",
+      DATABASE_URL: url,
+    })).toEqual({ kind: "postgres", url });
+  });
+
+  test("unset NODE_ENV still selects postgres", () => {
+    const url = "postgresql://user:pw@prod.example:5432/commhub";
+    expect(resolveDatabaseTarget({ ...BASE_ENV, DATABASE_URL: url }))
+      .toEqual({ kind: "postgres", url });
+  });
+
+  test("explicit SQLite targets remain unchanged in test and production", () => {
+    for (const NODE_ENV of ["test", "production"]) {
+      expect(resolveDatabaseTarget({
+        ...BASE_ENV,
+        NODE_ENV,
+        COMMHUB_DB: "/tmp/isolated.db",
+      })).toEqual({ kind: "sqlite", path: "/tmp/isolated.db" });
+    }
+  });
+
+  test("non-server callers cannot silently fall through to the production default SQLite path", () => {
+    for (const NODE_ENV of [undefined, "development", "production"]) {
+      expect(() => resolveDatabaseTarget({ ...BASE_ENV, NODE_ENV }))
+        .toThrow(/explicit COMMHUB_DB|COMMHUB_SERVER=1/);
+    }
+  });
+
+  test("the explicit server boot capability permits the canonical default SQLite path", () => {
+    expect(resolveDatabaseTarget({
+      ...BASE_ENV,
+      NODE_ENV: "production",
+      COMMHUB_SERVER: "1",
+    })).toEqual({ kind: "sqlite", path: "/nonexistent/.commhub/commhub.db" });
+  });
+
+  test("lookalike server capability values fail closed", () => {
+    for (const COMMHUB_SERVER of ["", "true", "yes", "01", " 1"] ) {
+      expect(() => resolveDatabaseTarget({ ...BASE_ENV, COMMHUB_SERVER }))
+        .toThrow(/COMMHUB_SERVER=1/);
+    }
+  });
+});

package/src/db-adapter.ts

@@ -212,10 +212,28 @@ export class PgAdapter implements DbAdapter {
 //  Factory
 // ════════════════════════════════════════════
 
+export type DbTarget =
+  | { kind: "postgres"; url: string }
+  | { kind: "sqlite"; path: string };
+
 /**
- * Create the appropriate adapter based on environment.
- * - DATABASE_URL starts with "postgres://" → PgAdapter
- * - Otherwise → SQLiteAdapter with COMMHUB_DB or default path
+ * Refuse every inherited DATABASE_URL under the Bun test environment before
+ * adapter selection, logging, DNS, or construction. A test that intentionally
+ * exercises PostgreSQL needs a separately reviewed isolated harness; accepting
+ * a shell/CI DATABASE_URL here could connect a unit test to production.
+ */
+export function assertSafeTestDatabaseEnv(env: NodeJS.ProcessEnv = process.env): void {
+  if (env.NODE_ENV === "test" && env.DATABASE_URL) {
+    throw new Error(
+      "[commhub] REFUSING to honor inherited DATABASE_URL under NODE_ENV=test.\n" +
+      "  Tests must unset DATABASE_URL and set COMMHUB_DB to an isolated path.\n" +
+      "  This guard is fail-closed and has no opt-in bypass."
+    );
+  }
+}
+
+/**
+ * Pure target selection after the inherited-DATABASE_URL safety gate.
  *
  * Test-default-prod GUARD: when `NODE_ENV === "test"` (set automatically by
  * `bun test`) AND `COMMHUB_DB` is unset, we REFUSE to fall through to the
@@ -227,27 +245,20 @@ export class PgAdapter implements DbAdapter {
  * pre-existing history of test pollution in the same DB). The guard makes
  * the failure mode loud + actionable instead of silent + destructive.
  *
- * The guard does NOT fire when:
- *   - COMMHUB_DB is set (the test runner's documented contract); or
- *   - NODE_ENV is unset (production server) or any non-"test" value.
- *
- * Operators who run `bun -e` snippets that touch the DB are expected to
- * `COMMHUB_DB=/tmp/...` themselves — `bun -e` doesn't set NODE_ENV, so the
- * guard can't catch that case. The rule (never read or write the
- * production hub database) is documented in CLAUDE.md.
+ * The production default path is a capability, not a generic fallback:
+ * only canonical server entrypoints set COMMHUB_SERVER=1 before importing
+ * the database graph. Tests, scripts, and `bun -e` probes must name an
+ * explicit COMMHUB_DB (or a reviewed PostgreSQL DATABASE_URL), so forgetting
+ * one fails before mkdir/open/write instead of touching the live Hub.
  */
-export function createAdapter(): DbAdapter {
-  const dbUrl = process.env.DATABASE_URL;
+function resolveDatabaseTargetAfterGuard(env: NodeJS.ProcessEnv): DbTarget {
+  const dbUrl = env.DATABASE_URL;
   if (dbUrl && (dbUrl.startsWith("postgres://") || dbUrl.startsWith("postgresql://"))) {
-    console.log("[commhub] database: PostgreSQL");
-    return new PgAdapter(dbUrl);
+    return { kind: "postgres", url: dbUrl };
   }
-  // Default: SQLite
-  const { mkdirSync } = require("fs");
-  const { dirname } = require("path");
 
   // Test-default-prod GUARD (see docblock above).
-  if (process.env.NODE_ENV === "test" && !process.env.COMMHUB_DB) {
+  if (env.NODE_ENV === "test" && !env.COMMHUB_DB) {
     throw new Error(
       "[commhub] REFUSING to open the default SQLite database under NODE_ENV=test.\n" +
       "  Tests must explicitly set COMMHUB_DB to a throwaway path so they don't\n" +
@@ -257,10 +268,40 @@ export function createAdapter(): DbAdapter {
     );
   }
 
-  const dbPath = process.env.COMMHUB_DB || `${process.env.HOME}/.commhub/commhub.db`;
-  mkdirSync(dirname(dbPath), { recursive: true });
-  console.log(`[commhub] database: ${dbPath}`);
-  const rawDb = new Database(dbPath);
+  if (!env.COMMHUB_DB && env.COMMHUB_SERVER !== "1") {
+    throw new Error(
+      "[commhub] REFUSING to open the default production SQLite database from a non-server entrypoint.\n" +
+      "  Scripts and probes must set an explicit COMMHUB_DB path. The canonical\n" +
+      "  Hub entrypoints set COMMHUB_SERVER=1 before loading the database."
+    );
+  }
+
+  return { kind: "sqlite", path: env.COMMHUB_DB || `${env.HOME}/.commhub/commhub.db` };
+}
+
+/** Pure public resolver used by tests without constructing an adapter. */
+export function resolveDatabaseTarget(env: NodeJS.ProcessEnv = process.env): DbTarget {
+  assertSafeTestDatabaseEnv(env);
+  return resolveDatabaseTargetAfterGuard(env);
+}
+
+/**
+ * Create the appropriate adapter based on environment.
+ * The inherited-DATABASE_URL guard is deliberately the first executable line.
+ */
+export function createAdapter(): DbAdapter {
+  assertSafeTestDatabaseEnv(process.env);
+  const target = resolveDatabaseTargetAfterGuard(process.env);
+  if (target.kind === "postgres") {
+    console.log("[commhub] database: PostgreSQL");
+    return new PgAdapter(target.url);
+  }
+
+  const { mkdirSync } = require("fs");
+  const { dirname } = require("path");
+  mkdirSync(dirname(target.path), { recursive: true });
+  console.log(`[commhub] database: ${target.path}`);
+  const rawDb = new Database(target.path);
   rawDb.exec("PRAGMA journal_mode=WAL");
   rawDb.exec("PRAGMA busy_timeout=5000");
   return new SQLiteAdapter(rawDb);