@sleep2agi/commhub-server 0.9.0-preview.31 → 0.9.0-preview.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.31",
+  "version": "0.9.0-preview.33",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/create-node-tool-schema.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+type ToolHandler = (args: any) => Promise<any> | any;
+
+function captureSchemas(): Record<string, Record<string, any>> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const schemas: Record<string, Record<string, any>> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, desc: string, schema: any, handler: ToolHandler) => {
+    schemas[name] = schema;
+    return origTool(name, desc, schema, handler);
+  };
+  registerTools(server, undefined, null, "u_schema_test", "schema-test", false, null);
+  return schemas;
+}
+
+describe("create_node MCP schema", () => {
+  test("model is optional on daemon create specs but empty strings stay invalid", () => {
+    const schemas = captureSchemas();
+    const nodeSpec = schemas.create_node.node_spec;
+
+    expect(nodeSpec.safeParse({
+      name: "child",
+      runtime: "claude-agent-sdk",
+    }).success).toBe(true);
+    expect(nodeSpec.safeParse({
+      name: "child",
+      runtime: "claude-agent-sdk",
+      model: null,
+    }).success).toBe(true);
+    expect(nodeSpec.safeParse({
+      name: "child",
+      runtime: "claude-agent-sdk",
+      model: "",
+    }).success).toBe(false);
+  });
+});

package/src/create-node-validate.test.ts

@@ -169,6 +169,16 @@ describe("buildAnetArgs (§4.2.2 F2 — fully validated argv)", () => {
     expect(args).toContain("--permission-mode");
     expect(args[args.indexOf("--permission-mode") + 1]).toBe("plan");
   });
+  test("omitted model is allowed and does not emit --model", () => {
+    const args = buildAnetArgs({
+      name: "x", runtime: "codex-sdk",
+      flags: { permissionMode: "plan" },
+    });
+    expect(args).toEqual(["node", "create", "x", "--runtime", "codex-sdk", "--permission-mode", "plan"]);
+  });
+  test("empty model is still rejected", () => {
+    expect(() => buildAnetArgs({ name: "x", runtime: "codex-sdk", model: "" })).toThrow(ValidationError);
+  });
   test("rejects bad name with shell metachar", () => {
     expect(() => buildAnetArgs({ name: ";rm -rf /", runtime: "claude-agent-sdk", model: "x" })).toThrow(ValidationError);
   });

package/src/create-node-validate.ts

@@ -46,7 +46,8 @@ export function validateRuntime(s: unknown): asserts s is Runtime {
   }
 }
 
-export function validateModel(s: unknown): asserts s is string {
+export function validateModel(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
   if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s)) {
     throw new ValidationError("model_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
   }
@@ -173,7 +174,7 @@ export function validateChannelsP1(channels: unknown): void {
 export interface NodeSpec {
   name: string;
   runtime: Runtime;
-  model: string;
+  model?: string | null;
   flags?: Record<string, unknown>;
   channels?: unknown;
 }
@@ -192,7 +193,8 @@ export function buildAnetArgs(spec: NodeSpec): string[] {
   validateModel(spec.model);
   validateChannelsP1(spec.channels);
 
-  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime, "--model", spec.model];
+  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime];
+  if (spec.model) args.push("--model", spec.model);
   if (spec.flags && typeof spec.flags === "object") {
     for (const [k, v] of Object.entries(spec.flags)) {
       if (!(FLAG_KEYS as readonly string[]).includes(k)) {

package/src/db-timestamp.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "bun:test";
+import { parseDbTimestampMs } from "./db-timestamp.js";
+
+const NAIVE = "2026-08-27 11:23:54";
+const EXPECTED = Date.UTC(2026, 7, 27, 11, 23, 54);
+
+describe("parseDbTimestampMs", () => {
+  // ⚠ 这条在 **TZ=UTC 的环境**下没有分辨力：裸 Date.parse 在 UTC 下恰好正确。
+  // CI runner 与容器默认就是 UTC（本仓 Docker 套件亦然），所以缺陷在常规跑法里
+  // 恒绿。（更正：Bun 是尊重 TZ 的，不存在"bun test 固定 UTC"——通信评审牛 #1279
+  // 独审③ 独立复跑证伪了我最初的说法。）真正稳定见红的门是下面那条强制子进程。
+  it("treats a naive SQLite timestamp as UTC", () => {
+    expect(parseDbTimestampMs(NAIVE)).toBe(EXPECTED);
+  });
+
+  // 分辨力关键：宿主是 UTC 时,裸 Date.parse 与正确写法结果相同,断言恒绿。
+  // 强制子进程 TZ=Asia/Shanghai,让缺陷在任何 CI 时区下都显形。
+  it("is unaffected by a non-UTC host timezone (child process TZ=Asia/Shanghai)", () => {
+    const r = Bun.spawnSync({
+      cmd: ["bun", "-e",
+        `const {parseDbTimestampMs} = await import("${import.meta.dir}/db-timestamp.ts");` +
+        `console.log(parseDbTimestampMs("${NAIVE}"));`],
+      env: { ...process.env, TZ: "Asia/Shanghai" },
+    });
+    expect(Number(r.stdout.toString().trim())).toBe(EXPECTED);
+  });
+
+  it("keeps explicit-offset timestamps intact", () => {
+    expect(parseDbTimestampMs("2026-08-27T11:23:54Z")).toBe(EXPECTED);
+    expect(parseDbTimestampMs("2026-08-27T19:23:54+08:00")).toBe(EXPECTED);
+  });
+
+  it("an online window of 5min holds for a heartbeat written 1s ago", () => {
+    const now = Date.now();
+    const iso = new Date(now - 1000).toISOString().slice(0, 19).replace("T", " ");
+    expect(now - parseDbTimestampMs(iso)).toBeLessThanOrEqual(5 * 60_000);
+  });
+});

package/src/db-timestamp.ts

@@ -0,0 +1,15 @@
+/**
+ * SQLite 里的时间戳列（sessions.last_seen_at、tasks.created_at 等）存的是
+ * **无时区标记的 UTC 串**（`YYYY-MM-DD HH:MM:SS`，由 SQLite `datetime('now')` 写入）。
+ *
+ * 裸 `Date.parse("2026-08-27 11:23:54")` 会按**宿主机本地时区**解释这个串。
+ * 生产机 TZ=CST+0800 时，它比真实 UTC 时刻早 8 小时——所以 `now - parsed`
+ * 恒为 +480 分钟，任何「最近 N 秒内算在线」的判据都会恒判离线。
+ * 在 TZ=UTC 的机器上两种写法结果相同，缺陷不会显形。
+ */
+export function parseDbTimestampMs(value: string): number {
+  const s = String(value).trim();
+  // 已带时区标记（ISO 的 Z / ±HH:MM）就原样交给 Date
+  if (/[Zz]$|[+-]\d{2}:?\d{2}$/.test(s)) return Date.parse(s);
+  return Date.parse(s.replace(" ", "T") + "Z");
+}

package/src/db.ts

@@ -543,7 +543,7 @@ db.exec(`
     child_name        TEXT NOT NULL,
     network_id        TEXT NOT NULL,
     runtime           TEXT NOT NULL,
-    model             TEXT NOT NULL,
+    model             TEXT,
     flags_json        TEXT NOT NULL,
     env_keys          TEXT NOT NULL,
     status            TEXT NOT NULL,
@@ -560,6 +560,63 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_ncr_network ON node_create_requests(network_id);
   CREATE INDEX IF NOT EXISTS idx_ncr_child_name ON node_create_requests(child_name);
 `);
+function migrateNodeCreateRequestsModelNullable() {
+  if (db.dialect === "postgres") {
+    try { db.exec("ALTER TABLE node_create_requests ALTER COLUMN model DROP NOT NULL"); } catch {}
+    return;
+  }
+
+  let needsRebuild = false;
+  try {
+    const createSql = db.get<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'node_create_requests'");
+    needsRebuild = !!createSql?.sql && /\bmodel\s+TEXT\s+NOT\s+NULL\b/i.test(createSql.sql);
+  } catch {}
+  if (!needsRebuild) return;
+
+  db.transaction(() => {
+    db.exec("DROP TABLE IF EXISTS node_create_requests_migrated");
+    db.exec(`
+      CREATE TABLE node_create_requests_migrated (
+        request_id        TEXT PRIMARY KEY,
+        daemon_node_id    TEXT NOT NULL,
+        child_name        TEXT NOT NULL,
+        network_id        TEXT NOT NULL,
+        runtime           TEXT NOT NULL,
+        model             TEXT,
+        flags_json        TEXT NOT NULL,
+        env_keys          TEXT NOT NULL,
+        status            TEXT NOT NULL,
+        error             TEXT,
+        child_token_id    TEXT,
+        created_at        INTEGER NOT NULL,
+        created_by_token  TEXT NOT NULL,
+        delivered_at      INTEGER,
+        acked_at          INTEGER,
+        child_node_id     TEXT
+      )
+    `);
+    db.exec(`
+      INSERT INTO node_create_requests_migrated (
+        request_id, daemon_node_id, child_name, network_id, runtime, model,
+        flags_json, env_keys, status, error, child_token_id, created_at,
+        created_by_token, delivered_at, acked_at, child_node_id
+      )
+      SELECT
+        request_id, daemon_node_id, child_name, network_id, runtime, model,
+        flags_json, env_keys, status, error, child_token_id, created_at,
+        created_by_token, delivered_at, acked_at, child_node_id
+      FROM node_create_requests
+    `);
+    db.exec("DROP TABLE node_create_requests");
+    db.exec("ALTER TABLE node_create_requests_migrated RENAME TO node_create_requests");
+  });
+}
+migrateNodeCreateRequestsModelNullable();
+db.exec(`
+  CREATE INDEX IF NOT EXISTS idx_ncr_daemon_status ON node_create_requests(daemon_node_id, status);
+  CREATE INDEX IF NOT EXISTS idx_ncr_network ON node_create_requests(network_id);
+  CREATE INDEX IF NOT EXISTS idx_ncr_child_name ON node_create_requests(child_name);
+`);
 try {
   // Single-flight per (daemon, child_name) — prevents racing dashboard
   // create on same name. Mirrors RFC-024 uniq_ncu_node_inflight.

package/src/delivered-without-push.test.ts

@@ -0,0 +1,140 @@
+// f015d9d6 症状①：tasks.status 被置为 'delivered'，而 SSE 推送根本没发出。
+//
+// send_task 无条件以字面量 'delivered' 插入 tasks 行，推送却另外被
+// `if (target.state === "online")` 挡着（tools.ts:1432）。同一段代码里给
+// network observer 的事件把同一件事标成 "queued" —— 也就是说代码**知道**
+// 它没投出去，却仍然把 delivered 写进了 tasks.status。
+//
+// 而 "online" 的判据是 resolveDeliveryTarget 里的
+//   stale = now - (last_seen_at || updated_at) > 5 分钟
+// 且 last_seen_at 只在 report_status 时刷新（tools.ts:674/702）。
+// 全网「停发心跳/状态类消息」的省额度规则之下，一个安静的 MCP 会话必然变 stale。
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { __resetSSEClientsForTest, createSSEStream } from "./push.js";
+
+const NET = "net_delivered_push_f015";
+const USER = "user_delivered_push_f015";
+const SENDER = "sender-f015b";
+const TARGET = "quiet-mcp-f015b";
+
+type ToolHandler = (args: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup() {
+  __resetSSEClientsForTest();
+  for (const t of ["tasks", "inbox", "task_events", "sessions", "api_tokens", "nodes", "rename_txn"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM network_members WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+/** minutesAgo 控制目标会话的 last_seen_at —— 这是本文件唯一要动的变量。 */
+function seed(minutesAgo: number) {
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'admin', datetime('now'))", [USER]);
+  db.run("INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))", [NET, USER]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [USER, NET]);
+  for (const alias of [SENDER, TARGET]) {
+    db.run(
+      "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, 'network')",
+      [`token-${alias}`, `hash-${alias}`, USER, NET, `node:${alias}`],
+    );
+  }
+  db.run(
+    "INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at) VALUES (?1, ?1, 'idle', NULL, ?2, datetime('now'), datetime('now', ?3))",
+    [SENDER, NET, "-1 minutes"],
+  );
+  // 🔴 目标：MCP 挂载的 claude-code 会话形状（node_id NULL），
+  //    status 是 'idle'（不是 offline），只是安静了 minutesAgo 分钟。
+  db.run(
+    "INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at) VALUES (?1, ?2, 'idle', NULL, ?3, datetime('now', ?4), datetime('now', ?4))",
+    [`cc-n_${TARGET}`, TARGET, NET, `-${minutesAgo} minutes`],
+  );
+}
+
+function toolsFor(alias: string): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "delivered-push-f015", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const original = server.tool.bind(server);
+  server.tool = (name: string, description: string, schema: any, handler: ToolHandler) => {
+    tools[name] = handler; return original(name, description, schema, handler);
+  };
+  registerTools(server, undefined, NET, USER, alias, true, `token-${alias}`);
+  return tools;
+}
+
+/** 从订阅者那一侧真正读出字节 —— 地面真相，不是连接计数。 */
+async function readUntil(reader: ReadableStreamDefaultReader<Uint8Array>, needle: string, ms = 1500): Promise<string | null> {
+  const dec = new TextDecoder();
+  let buf = "";
+  const deadline = Date.now() + ms;
+  while (Date.now() < deadline) {
+    const chunk = await Promise.race([
+      reader.read(),
+      new Promise<{ done: true; value: undefined }>((r) => setTimeout(() => r({ done: true, value: undefined }), 200)),
+    ]);
+    if (chunk.value) buf += dec.decode(chunk.value, { stream: true });
+    if (buf.includes(needle)) return buf;
+  }
+  return null;
+}
+
+let sendSeq = 0;
+/** minutesAgo = 目标安静了多久；withSubscriber = 是否真的有人连着。 */
+async function send(minutesAgo: number, withSubscriber = true) {
+  cleanup(); seed(minutesAgo);
+  let reader: ReadableStreamDefaultReader<Uint8Array> | null = null;
+  if (withSubscriber) {
+    const res = createSSEStream(TARGET, NET);
+    reader = res.body!.getReader();
+  }
+  const r = await toolsFor(SENDER).send_task({ alias: TARGET, task: `ping-${++sendSeq}`, priority: "normal" });
+  const out = JSON.parse(r.content[0].text);
+  const row = db.get<{ status: string }>("SELECT status FROM tasks WHERE to_name = ?1 AND network_id = ?2", TARGET, NET);
+  const received = reader ? await readUntil(reader, "new_task") : null;
+  return { out, taskStatus: row?.status ?? null, received };
+}
+
+describe("f015d9d6 症状① — delivered 置位与实际推送不同步", () => {
+  beforeEach(() => cleanup());
+  afterAll(() => cleanup());
+
+  test("对照：目标 1 分钟前还活跃 ⇒ 订阅者收到 new_task", async () => {
+    const { taskStatus, received } = await send(1);
+    expect(taskStatus).toBe("delivered");
+    expect(received).toContain("new_task");
+  });
+
+  test("🔴 核心：目标安静 10 分钟但订阅者连着 ⇒ 仍然收得到（修复前这里收到 null）", async () => {
+    const { taskStatus, received } = await send(10);
+    expect(received).toContain("new_task");
+    expect(taskStatus).toBe("delivered");   // 现在这个 delivered 是真话了
+  });
+
+  test("🔴 可达性判据必须来自订阅者注册表，不是 last_seen_at 的时间戳猜测", async () => {
+    // 安静 10 分钟 = 时间戳判据会说 offline；而实际上有人在听。
+    const quiet = await send(10);
+    expect(quiet.received).toContain("new_task");
+    // 真没人听的时候，pushEvent 本来就是 no-op，不需要额外的闸来保护。
+    const nobody = await send(10, false);
+    expect(nobody.received).toBeNull();
+  });
+
+  test("真的没有订阅者时，tasks 行仍写 delivered —— 本 PR 刻意不改，记录在案", async () => {
+    const { taskStatus, received } = await send(10, false);
+    expect(received).toBeNull();
+    // 这一条钉的是**当前行为**，不是我认为对的行为：没人收到，行仍自称 delivered。
+    expect(taskStatus).toBe("delivered");
+  });
+
+  test("活性判据的输入 last_seen_at 只由 report_status 刷新 —— 发送方不刷新它", async () => {
+    cleanup(); seed(4);
+    const before = db.get<{ last_seen_at: string }>("SELECT last_seen_at FROM sessions WHERE alias = ?1 AND network_id = ?2", TARGET, NET);
+    await toolsFor(SENDER).send_task({ alias: TARGET, task: `ping-${++sendSeq}`, priority: "normal" });
+    const after = db.get<{ last_seen_at: string }>("SELECT last_seen_at FROM sessions WHERE alias = ?1 AND network_id = ?2", TARGET, NET);
+    expect(after?.last_seen_at).toBe(before!.last_seen_at);
+  });
+});

package/src/desktop-message.test.ts

@@ -0,0 +1,222 @@
+// Desktop user push contract.
+//
+// Pins the new user-keyed SSE path and send_desktop_message MCP tool:
+// - user streams are keyed by networkId:userId, never alias
+// - ntok callers cannot cross network by supplying a foreign to_user_id/network_id
+// - target ambiguity/miss is fail-closed before audit/push
+
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import {
+  __resetSSEClientsForTest,
+  createUserEventStream,
+  pushUserEvent,
+} from "./push.js";
+
+const NET_A = "net_desktop_a";
+const NET_B = "net_desktop_b";
+const NODE_USER = "u_desktop_node_owner";
+const SENDER_USER = "u_desktop_sender";
+const TARGET_A = "u_desktop_target_a";
+const TARGET_B = "u_desktop_target_b";
+const TARGET_BOTH = "u_desktop_target_both";
+const ALL_USERS = [NODE_USER, SENDER_USER, TARGET_A, TARGET_B, TARGET_BOTH];
+
+type ToolHandler = (args: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup() {
+  try { db.run("DELETE FROM audit_log WHERE action = 'send_desktop_message' OR network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  for (const u of ALL_USERS) {
+    try { db.run("DELETE FROM users WHERE user_id = ?1", [u]); } catch {}
+  }
+}
+
+function seed() {
+  for (const u of ALL_USERS) {
+    db.run(
+      `INSERT INTO users (user_id, username, password_hash, role, created_at)
+       VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+      [u, `${u}_name`],
+    );
+  }
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_A, SENDER_USER]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_B, TARGET_B]);
+  const member = (userId: string, networkId: string, role: string) =>
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, ?3, datetime('now'))`, [userId, networkId, role]);
+  member(NODE_USER, NET_A, "member");
+  member(SENDER_USER, NET_A, "owner");
+  member(TARGET_A, NET_A, "member");
+  member(TARGET_B, NET_B, "member");
+  member(TARGET_BOTH, NET_A, "member");
+  member(TARGET_BOTH, NET_B, "member");
+}
+
+beforeEach(() => { cleanup(); seed(); });
+afterEach(() => { __resetSSEClientsForTest(); });
+afterAll(cleanup);
+
+function buildHandlers(opts: { netId?: string | null; userId?: string | null; alias?: string | null; isNetwork?: boolean }) {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, schema: any, handler: ToolHandler) => {
+    tools[name] = handler;
+    return origTool(name, _desc, schema, handler);
+  };
+  registerTools(
+    server,
+    undefined,
+    opts.netId ?? null,
+    opts.userId ?? null,
+    opts.alias ?? opts.userId ?? null,
+    opts.isNetwork ?? false,
+    "tok_desktop_test",
+  );
+  return tools;
+}
+
+async function call(handler: ToolHandler, args: any): Promise<Record<string, any>> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0].text);
+}
+
+async function readFrame(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  timeoutMs = 2_000,
+): Promise<Record<string, any>> {
+  const decoder = new TextDecoder();
+  let buf = "";
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const result = await Promise.race([
+      reader.read(),
+      new Promise<never>((_, rej) =>
+        setTimeout(() => rej(new Error(`no SSE frame within ${timeoutMs}ms`)), deadline - Date.now()),
+      ),
+    ]);
+    if (result.done) throw new Error("SSE stream ended unexpectedly");
+    buf += decoder.decode(result.value, { stream: true });
+    const sep = buf.indexOf("\n\n");
+    if (sep === -1) continue;
+    const rawFrame = buf.slice(0, sep);
+    buf = buf.slice(sep + 2);
+    const dataLine = rawFrame.split("\n").find((l) => l.startsWith("data: "));
+    if (!dataLine) continue;
+    return JSON.parse(dataLine.slice(6));
+  }
+  throw new Error(`no SSE frame within ${timeoutMs}ms`);
+}
+
+function auditCount() {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM audit_log WHERE action = 'send_desktop_message'")?.n ?? 0;
+}
+
+describe("send_desktop_message", () => {
+  test("ntok caller can push to a user in the same bound network", async () => {
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      message: "desktop hello",
+      severity: "success",
+    });
+
+    expect(result.ok).toBe(true);
+    expect(result.message_id).toStartWith("dm_");
+    expect(auditCount()).toBe(1);
+    const evt = await readFrame(reader);
+    expect(evt.type).toBe("desktop_message");
+    expect(evt.message_id).toBe(result.message_id);
+    expect(evt.message).toBe("desktop hello");
+    expect(evt.from).toBe("node-a");
+    expect(evt.network_id).toBe(NET_A);
+    expect(evt.user_id).toBe(TARGET_A);
+    expect(evt.scope).toBe("user");
+    await reader.cancel();
+  });
+
+  test("utok caller can push with explicit network_id to a member user", async () => {
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ userId: SENDER_USER, alias: "sender-user" });
+    const result = await call(tools.send_desktop_message, {
+      to_username: `${TARGET_A}_name`,
+      network_id: NET_A,
+      title: "Heads up",
+      message: "from user token",
+    });
+
+    expect(result.ok).toBe(true);
+    const evt = await readFrame(reader);
+    expect(evt.title).toBe("Heads up");
+    expect(evt.message).toBe("from user token");
+    expect(evt.network_id).toBe(NET_A);
+    await reader.cancel();
+  });
+
+  test("ntok caller cannot cross network with foreign network_id and to_user_id; no audit or push happens first", async () => {
+    const stream = createUserEventStream(NET_B, TARGET_B);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_B,
+      network_id: NET_B,
+      message: "must not cross",
+    });
+
+    expect(result).toEqual({ ok: false, error: "desktop_target_not_in_network", network_id: NET_A });
+    expect(auditCount()).toBe(0);
+
+    pushUserEvent(NET_B, TARGET_B, { type: "desktop_message", message_id: "marker_after_denied" });
+    expect((await readFrame(reader)).message_id).toBe("marker_after_denied");
+    await reader.cancel();
+  });
+
+  test("missing target is fail-closed before audit", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, { message: "nobody" });
+    expect(result).toEqual({
+      ok: false,
+      error: "desktop_target_required",
+      message: "to_user_id or to_username is required",
+    });
+    expect(auditCount()).toBe(0);
+  });
+
+  test("conflicting to_user_id and to_username is fail-closed before audit", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      to_username: `${TARGET_BOTH}_name`,
+      message: "conflict",
+    });
+    expect(result).toEqual({
+      ok: false,
+      error: "desktop_target_mismatch",
+      to_user_id: TARGET_A,
+      to_username: `${TARGET_BOTH}_name`,
+    });
+    expect(auditCount()).toBe(0);
+  });
+
+  test("unknown target is fail-closed before audit", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_username: "not_a_real_user",
+      message: "lost",
+    });
+    expect(result).toEqual({ ok: false, error: "desktop_target_not_found", field: "to_username" });
+    expect(auditCount()).toBe(0);
+  });
+});

package/src/observer-avatar-http.test.ts

@@ -187,6 +187,81 @@ describe("#461 GET /events/network/:id — auth", () => {
   });
 });
 
+describe("GET /events/users/me — Desktop user stream auth", () => {
+  test("anonymous → 401", async () => {
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`);
+    expect(res.status).toBe(401);
+  });
+
+  test("ntok is refused for user stream", async () => {
+    const minted = createNetworkTokenForNode(memberUserId, memberNetworkId, "desktop-ntok-probe");
+    expect(minted.ok).toBe(true);
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`, { headers: auth(minted.token!) });
+    expect(res.status).toBe(403);
+    const body = await res.json() as any;
+    expect(body.error).toBe("user_token_required");
+  });
+
+  test("utok without network_id → 400", async () => {
+    const res = await fetch(`${BASE}/events/users/me`, { headers: auth(memberToken) });
+    expect(res.status).toBe(400);
+    const body = await res.json() as any;
+    expect(body.error).toBe("network_id required");
+  });
+
+  test("non-member utok → 403", async () => {
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`, { headers: auth(outsiderToken) });
+    expect(res.status).toBe(403);
+    const body = await res.json() as any;
+    expect(body.error).toBe("not a member of this network");
+  });
+
+  test("member utok → user stream connected frame keyed to authenticated user", async () => {
+    const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(memberNetworkId)}`, { headers: auth(memberToken) });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type") || "").toContain("text/event-stream");
+    const reader = res.body!.getReader();
+    const connected = await readFrame(reader);
+    expect(connected.type).toBe("connected");
+    expect(connected.user).toBe(true);
+    expect(connected.network_id).toBe(memberNetworkId);
+    expect(connected.user_id).toBe(memberUserId);
+    await reader.cancel();
+  });
+});
+
+describe("GET /api/messages — client inbox count", () => {
+  test("alias filter returns only that inbox and pending_count for unacked rows", async () => {
+    const selfAlias = `user-${memberUserId}`;
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+       VALUES (?1, ?2, 'task', 'normal', 'unread self', 'agent-a', 0, ?3, datetime('now'))`,
+      [`msg_self_unread_${Date.now()}`, selfAlias, memberNetworkId],
+    );
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+       VALUES (?1, ?2, 'task', 'normal', 'read self', 'agent-a', 1, ?3, datetime('now'))`,
+      [`msg_self_read_${Date.now()}`, selfAlias, memberNetworkId],
+    );
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+       VALUES (?1, 'other-alias', 'task', 'normal', 'other inbox', 'agent-b', 0, ?2, datetime('now'))`,
+      [`msg_other_${Date.now()}`, memberNetworkId],
+    );
+
+    const res = await fetch(`${BASE}/api/messages?alias=${encodeURIComponent(selfAlias)}&network_id=${encodeURIComponent(memberNetworkId)}&limit=20`, {
+      headers: auth(memberToken),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.ok).toBe(true);
+    expect(body.pending_count).toBe(1);
+    expect(body.messages.length).toBeGreaterThanOrEqual(2);
+    expect(body.messages.every((m: any) => m.to_alias === selfAlias)).toBe(true);
+    expect(body.messages.some((m: any) => m.content === "other inbox")).toBe(false);
+  });
+});
+
 describe("#461 observer receives third-party traffic summaries", () => {
   test("REST /api/task dispatch → observer gets new_task summary, no content", async () => {
     const res = await fetch(`${BASE}/events/network/${memberNetworkId}`, { headers: auth(memberToken) });