@sleep2agi/commhub-server 0.9.0-preview.4 → 0.9.0-preview.41

package/src/rest-write-network-resolution.test.ts

@@ -0,0 +1,133 @@
+// #819 — `resolveRestWriteNetworkId` 是 network-scope.ts 里唯一没有任何测试点名的
+// 导出函数。同文件的五个兄弟各有 1-2 个测试文件点名它们:
+//
+//   resolveRestNetworkScope  1        canRestWriteNetwork  1
+//   singleNetworkId          2        addNetworkScope      1
+//   getUserNetworkIds        1        resolveRestWriteNetworkId  🔴 0
+//
+// 而它决定的是**一次 REST 写入落到哪个网络**。它的 docstring 说明了一条不显然的
+// 规则:管理员的**读**作用域按设计是全局的(networkIds=null),所以它本身表达不了
+// 「这个管理员恰好只属于一个网络」;而**写**不能继承这个歧义 —— 只有在确实只有
+// 一个成员关系时才用它,0 个或 ≥2 个都必须显式指定网络。
+//
+// 🔴 这条规则的两半都要钉:
+//   - **放行那半**(admin + 恰好 1 个成员关系 → 用它)如果坏了,会退化成「管理员
+//     写任何东西都要显式带 network_id」——很吵,但**安全**,所以没人会急着修;
+//   - **收紧那半**(admin + 0 或 ≥2 → null)如果坏了,一次写入会**落到一个没被
+//     指定的网络里**,而调用方看到的是成功。
+//
+// 只写反向断言是不够的:一个「永远返回 null」的实现能通过所有「收紧」用例。
+// 所以每一条收紧断言都配了正控。
+//
+// Run: COMMHUB_DB=/tmp/819-rest-write-scope.db bun test src/rest-write-network-resolution.test.ts
+
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { resolveRestNetworkScope, resolveRestWriteNetworkId, type RestNetworkScope } from "./network-scope.js";
+
+const NET_A = "net_819_a";
+const NET_B = "net_819_b";
+const U_SINGLE = "u819_single";   // 只属于 NET_A
+const U_MULTI = "u819_multi";     // 属于 NET_A + NET_B
+const U_NONE = "u819_none";       // 一个都不属于
+const ALL_USERS = [U_SINGLE, U_MULTI, U_NONE];
+
+function cleanup() {
+  try { db.run("DELETE FROM network_members WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  for (const u of ALL_USERS) {
+    try { db.run("DELETE FROM users WHERE user_id = ?1", [u]); } catch {}
+  }
+}
+
+function seed() {
+  for (const u of ALL_USERS) {
+    db.run(
+      `INSERT INTO users (user_id, username, password_hash, role, created_at)
+       VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+      [u, u],
+    );
+  }
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_A, U_SINGLE]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_B, U_MULTI]);
+  const member = (u: string, net: string, role: string) =>
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, ?3, datetime('now'))`, [u, net, role]);
+  member(U_SINGLE, NET_A, "owner");
+  member(U_MULTI, NET_A, "member");
+  member(U_MULTI, NET_B, "owner");
+}
+
+beforeEach(() => { cleanup(); seed(); });
+afterAll(() => { cleanup(); });
+
+/** 管理员的读作用域:全局(networkIds=null),这正是歧义的来源。 */
+const ADMIN_SCOPE: RestNetworkScope = { networkIds: null };
+const scopeOf = (...ids: string[]): RestNetworkScope => ({ networkIds: ids });
+const ctx = (userId: string) => ({ userId, networkId: null });
+
+describe("#819 resolveRestWriteNetworkId — 作用域里就能确定时,直接用它", () => {
+  test("作用域恰好一个网络 → 用那一个(与是不是 admin 无关)", () => {
+    expect(resolveRestWriteNetworkId(scopeOf(NET_A), ctx(U_MULTI), false)).toBe(NET_A);
+    expect(resolveRestWriteNetworkId(scopeOf(NET_A), ctx(U_MULTI), true)).toBe(NET_A);
+  });
+
+  test("作用域两个网络 → 歧义,null(即使调用者是 admin)", () => {
+    expect(resolveRestWriteNetworkId(scopeOf(NET_A, NET_B), ctx(U_MULTI), true)).toBeNull();
+  });
+
+  // 🔴 这一条我一开始断错了,留下来当记录:我以为「作用域为空数组 → null」,
+  // 实测是 NET_A。原因是 `[]` 过不了 singleNetworkId,于是落到 admin 的成员关系
+  // 回退分支,而 U_SINGLE 恰好只有一个成员关系。
+  //
+  // 而 `networkIds: []` 在 resolveRestNetworkScope 里有确切含义:`:46` 那一行,
+  // **非 admin 请求了一个自己没有角色的网络** —— 它带着 `denied: "access denied
+  // to requested network"`。也就是说 `[]` 不是「没指定」,是「明确被拒」。
+  //
+  // 现在**没有**问题,因为那一行只对非 admin 产生(admin 在 `:42` 就提前返回
+  // networkIds:null 了),而非 admin 走到这里必然 null —— 见下一条。
+  //
+  // 但它是一个潜伏的形状:如果将来有任何路径让 admin 拿到 networkIds: [],
+  // 这次写入会**忽略那条明确的拒绝**,回退到他的单一成员关系。所以两条都钉住:
+  // 当前行为,以及那条让它安全的前提。
+  test("作用域为空数组 + admin + 恰好一个成员关系 → 回退到成员关系(当前行为,记录)", () => {
+    expect(resolveRestWriteNetworkId(scopeOf(), ctx(U_SINGLE), true)).toBe(NET_A);
+  });
+
+  test("🔴 让上一条安全的前提:空数组作用域只由非 admin 产生,而非 admin → null", () => {
+    expect(resolveRestWriteNetworkId(scopeOf(), ctx(U_SINGLE), false)).toBeNull();
+    // 前提本身也断一次:resolveRestNetworkScope 对 admin 从不产出空数组。
+    const adminScope = resolveRestNetworkScope(NET_B, ctx(U_NONE), true);
+    expect(adminScope.networkIds).toBeNull();
+  });
+});
+
+describe("#819 admin 的全局读作用域不能替写入决定网络", () => {
+  test("🔴 admin + 恰好 1 个成员关系 → 用那一个(放行那半)", () => {
+    expect(resolveRestWriteNetworkId(ADMIN_SCOPE, ctx(U_SINGLE), true)).toBe(NET_A);
+  });
+
+  test("🔴 admin + 2 个成员关系 → null,必须显式指定(收紧那半)", () => {
+    expect(resolveRestWriteNetworkId(ADMIN_SCOPE, ctx(U_MULTI), true)).toBeNull();
+  });
+
+  test("🔴 admin + 0 个成员关系 → null(不能因为读是全局的就随便挑一个)", () => {
+    expect(resolveRestWriteNetworkId(ADMIN_SCOPE, ctx(U_NONE), true)).toBeNull();
+  });
+
+  test("非 admin + 全局作用域 → null(这种组合本身就不该发生,fail closed)", () => {
+    // 正控在上面那条「admin + 单成员 → NET_A」:如果实现改成永远 null,那条会红。
+    expect(resolveRestWriteNetworkId(ADMIN_SCOPE, ctx(U_SINGLE), false)).toBeNull();
+  });
+
+  test("没有 authCtx + 全局作用域 → null", () => {
+    expect(resolveRestWriteNetworkId(ADMIN_SCOPE, null, true)).toBeNull();
+  });
+});
+
+describe("#819 作用域优先于成员关系回退", () => {
+  test("作用域说 NET_B,而该用户唯一的成员关系是 NET_A → 结果是 NET_B", () => {
+    // 归属由作用域决定,不由「他碰巧属于哪个网络」决定。
+    // 如果实现把两者的优先级搞反,这条会返回 NET_A。
+    expect(resolveRestWriteNetworkId(scopeOf(NET_B), ctx(U_SINGLE), true)).toBe(NET_B);
+  });
+});

package/src/runtime-label.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import { normalizeSessionRuntime } from "./runtime-label";
+
+describe("session runtime projection", () => {
+  test("preserves exact co-presence and CLI runtimes", () => {
+    expect(normalizeSessionRuntime("agent-node:codex-app-server")).toBe("codex-app-server");
+    expect(normalizeSessionRuntime("agent-node:grok-build-cli")).toBe("grok-build-cli");
+  });
+  test("keeps legacy labels backward-compatible", () => {
+    expect(normalizeSessionRuntime("agent-node:codex")).toBe("codex-sdk");
+    expect(normalizeSessionRuntime("agent-node:claude")).toBe("claude-agent-sdk");
+    expect(normalizeSessionRuntime("agent-node:grok")).toBe("grok-build-acp");
+    expect(normalizeSessionRuntime("agent-node:opencode")).toBe("opencode-cli");
+    expect(normalizeSessionRuntime("claude-code")).toBe("claude-code-cli");
+  });
+  test("does not invent unknown runtimes", () => {
+    expect(normalizeSessionRuntime("agent-node:future-runtime")).toBeNull();
+    expect(normalizeSessionRuntime("agent-node:codex-app-server-evil")).toBeNull();
+    expect(normalizeSessionRuntime("agent-node:grok-build-cli-preview")).toBeNull();
+    expect(normalizeSessionRuntime(null)).toBeNull();
+  });
+});

package/src/runtime-label.ts

@@ -0,0 +1,21 @@
+/** Preserve exact agent-node runtimes before applying legacy family aliases. */
+export function normalizeSessionRuntime(agent: unknown): string | null {
+  if (typeof agent !== "string" || agent.length === 0) return null;
+  if (agent === "claude-code") return "claude-code-cli";
+  const reported = agent.startsWith("agent-node:") ? agent.slice("agent-node:".length) : "";
+  const exact: Record<string, string> = {
+    "codex-app-server": "codex-app-server",
+    "grok-build-cli": "grok-build-cli",
+    opencode: "opencode-cli",
+    "opencode-cli": "opencode-cli",
+    codex: "codex-sdk",
+    "codex-sdk": "codex-sdk",
+    claude: "claude-agent-sdk",
+    "claude-agent-sdk": "claude-agent-sdk",
+    grok: "grok-build-acp",
+    "grok-build-acp": "grok-build-acp",
+  };
+  if (exact[reported]) return exact[reported];
+  if (agent === "http-api" || agent === "http" || agent === "api") return "http-api";
+  return null;
+}

package/src/scheduled-run-terminal.test.ts

@@ -0,0 +1,268 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db, chainReplyToParent } from "./db.js";
+import { dispatchScheduledOccurrence } from "./scheduled-tasks.js";
+import { registerTools } from "./tools.js";
+import { patrolExpiredTasks } from "./server.js";
+
+const NET = "net_690_scheduler_terminal";
+const USER = "u_690_owner";
+const NODE = "n_690_grok";
+const ALIAS = "A站GrokTUI-690";
+
+type Handler = (args: any, extra?: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup(): void {
+  for (const table of ["task_events", "inbox", "scheduled_task_runs", "scheduled_tasks", "tasks", "sessions", "nodes", "network_members", "networks", "users"]) {
+    try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedIdentity(): void {
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))", [USER, USER]);
+  db.run("INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))", [NET, USER]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [USER, NET]);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, runtime, network_id, lifecycle_state)
+     VALUES (?1, ?2, ?2, 'grok-build-acp', ?3, 'active')`,
+    [NODE, ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES ('r_690', ?1, 'idle', ?2, ?3, datetime('now'), datetime('now'))`,
+    [ALIAS, NODE, NET],
+  );
+}
+
+function handlers(): Record<string, Handler> {
+  const server = new McpServer({ name: "test690", version: "0" }) as any;
+  const result: Record<string, Handler> = {};
+  const original = server.tool.bind(server);
+  server.tool = (name: string, ...args: any[]) => {
+    const handler = args.at(-1);
+    if (typeof handler === "function") result[name] = handler;
+    return original(name, ...args);
+  };
+  registerTools(server, undefined, NET, USER, USER, false, null);
+  return result;
+}
+
+async function call(handler: Handler, args: any): Promise<any> {
+  const reply = await handler(args);
+  return JSON.parse(reply.content[0].text);
+}
+
+function seedScheduledTask(status = "delivered", suffix = crypto.randomUUID()): { taskId: string; runId: string; scheduleId: string } {
+  const taskId = `task_${suffix}`;
+  const runId = `srun_${suffix}`;
+  const scheduleId = `sched_${suffix}`;
+  const meta = JSON.stringify({ scheduled_task_id: scheduleId, scheduled_run_id: runId, auth_origin: "hub_scheduler" });
+  db.run(
+    `INSERT INTO scheduled_tasks
+       (schedule_id, network_id, name, target_node_id, target_alias, task_content, priority,
+        schedule_type, schedule_json, timezone, status, next_run_at)
+     VALUES (?1, ?2, 'test690', ?3, ?4, 'test690 task', 'normal', 'interval',
+             '{"type":"interval","every_seconds":3600}', 'UTC', 'active', datetime('now', '+1 hour'))`,
+    [scheduleId, NET, NODE, ALIAS],
+  );
+  db.run(
+    `INSERT INTO tasks
+       (task_id, from_name, to_node_id, to_name, priority, status, content, requires_response,
+        created_at, delivered_at, expires_at, network_id, meta_json)
+     VALUES (?1, 'scheduler', ?2, ?3, 'normal', ?4, 'test690 task', 'reply',
+             datetime('now'), datetime('now'), datetime('now', '+1 hour'), ?5, ?6)`,
+    [taskId, NODE, ALIAS, status, NET, meta],
+  );
+  db.run(
+    `INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, from_session, requires_response, network_id, meta_json)
+     VALUES (?1, ?1, ?2, ?3, 'task', 'normal', 'test690 task', 'scheduler', 'reply', ?4, ?5)`,
+    [taskId, ALIAS, NODE, NET, meta],
+  );
+  db.run(
+    `INSERT INTO scheduled_task_runs (run_id, schedule_id, network_id, scheduled_for, task_id, status, completed_at)
+     VALUES (?1, ?2, ?3, datetime('now'), ?4, ?5, datetime('now'))`,
+    [runId, scheduleId, NET, taskId, status],
+  );
+  return { taskId, runId, scheduleId };
+}
+
+const readRun = (runId: string) => db.get<any>(
+  "SELECT run_id, task_id, network_id, status, error_code, completed_at FROM scheduled_task_runs WHERE run_id = ?1",
+  runId,
+);
+
+beforeEach(() => { cleanup(); seedIdentity(); });
+afterAll(cleanup);
+
+describe("#690 scheduled run follows the real task lifecycle", () => {
+  test("dispatch is open until the task reaches a terminal state", () => {
+    const scheduleId = `sched_dispatch_${crypto.randomUUID()}`;
+    const row: any = {
+      schedule_id: scheduleId,
+      network_id: NET,
+      name: "dispatch open",
+      target_node_id: NODE,
+      target_alias: ALIAS,
+      task_content: "dispatch open",
+      priority: "normal",
+      schedule_type: "interval",
+      schedule_json: JSON.stringify({ type: "interval", every_seconds: 3600 }),
+      timezone: "UTC",
+      overlap_policy: "skip",
+      misfire_policy: "catch_up_once",
+      status: "active",
+      next_run_at: new Date(Date.now() + 3600_000).toISOString(),
+      last_run_at: null,
+      revision: 1,
+    };
+    db.run(
+      `INSERT INTO scheduled_tasks
+         (schedule_id, network_id, name, target_node_id, target_alias, task_content, priority,
+          schedule_type, schedule_json, timezone, overlap_policy, misfire_policy, status, next_run_at)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14)`,
+      [scheduleId, NET, row.name, NODE, ALIAS, row.task_content, row.priority, row.schedule_type,
+       row.schedule_json, row.timezone, row.overlap_policy, row.misfire_policy, row.status, row.next_run_at],
+    );
+    const dispatched = dispatchScheduledOccurrence(row, new Date().toISOString(), false);
+    const run = readRun(dispatched.runId);
+    expect(["delivered", "queued"]).toContain(run.status);
+    expect(run.completed_at).toBeNull();
+  });
+
+  test("send_reply terminalizes the exact bound run", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    const reply = await call(handlers().send_reply, {
+      alias: ALIAS,
+      text: "verified",
+      in_reply_to: taskId,
+      status: "replied",
+      network_id: NET,
+      attachments: [{ type: "file", file_id: "file_690_reply", name: "evidence.json", size: 12, mime: "application/json" }],
+    });
+    expect(reply.ok).toBe(true);
+    expect(readRun(runId).status).toBe("replied");
+    expect(readRun(runId).completed_at).toBeTruthy();
+  });
+
+  test("task and run terminal transition roll back together on an injected run-write failure", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    db.exec(
+      `CREATE TRIGGER test690_fail_run_terminal
+         BEFORE UPDATE OF status ON scheduled_task_runs
+         WHEN NEW.run_id = '${runId}' AND NEW.status = 'replied'
+       BEGIN
+         SELECT RAISE(ABORT, 'test690_injected_run_failure');
+       END`,
+    );
+    let threw = false;
+    try {
+      await call(handlers().send_reply, {
+        alias: ALIAS,
+        text: "must roll back",
+        in_reply_to: taskId,
+        status: "replied",
+        network_id: NET,
+      });
+    } catch (error: any) {
+      threw = /test690_injected_run_failure/.test(String(error?.message || error));
+    } finally {
+      db.exec("DROP TRIGGER IF EXISTS test690_fail_run_terminal");
+    }
+    expect(threw).toBe(true);
+    expect(db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = ?1", taskId)?.status).toBe("delivered");
+    expect(readRun(runId).status).toBe("delivered");
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM inbox WHERE in_reply_to = ?1", taskId)?.count).toBe(0);
+  });
+
+  test("cancel terminalizes, retry reopens, and the retry result closes the same run", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    const tools = handlers();
+    expect((await call(tools.cancel_task, { task_id: taskId, reason: "operator", network_id: NET })).ok).toBe(true);
+    expect(readRun(runId).status).toBe("cancelled");
+    expect(readRun(runId).completed_at).toBeTruthy();
+
+    expect((await call(tools.retry_task, { task_id: taskId, network_id: NET })).ok).toBe(true);
+    expect(readRun(runId).status).toBe("delivered");
+    expect(readRun(runId).completed_at).toBeNull();
+
+    expect((await call(tools.send_reply, {
+      alias: ALIAS,
+      text: "runtime failed",
+      in_reply_to: taskId,
+      status: "failed",
+      network_id: NET,
+    })).ok).toBe(true);
+    expect(readRun(runId).status).toBe("failed");
+    expect(readRun(runId).error_code).toBe("task_failed");
+  });
+
+  test("report_completion terminalizes a scheduler run", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    const reply = await call(handlers().report_completion, {
+      alias: ALIAS,
+      task: taskId,
+      result: "done",
+      network_id: NET,
+    });
+    expect(reply.ok).toBe(true);
+    expect(readRun(runId).status).toBe("replied");
+  });
+
+  test("expiration patrol closes the exact run in the same lifecycle pass", () => {
+    const { taskId, runId } = seedScheduledTask();
+    db.run("UPDATE tasks SET expires_at = datetime('now', '-1 minute') WHERE task_id = ?1", [taskId]);
+    patrolExpiredTasks();
+    expect(db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = ?1", taskId)?.status).toBe("expired");
+    expect(readRun(runId).status).toBe("expired");
+    expect(readRun(runId).error_code).toBe("task_expired");
+    expect(readRun(runId).completed_at).toBeTruthy();
+  });
+
+  test("child auto-chain terminalizes a scheduled parent", () => {
+    const { taskId: parentId, runId } = seedScheduledTask();
+    const childId = `child_${crypto.randomUUID()}`;
+    db.run(
+      `INSERT INTO tasks
+         (task_id, parent_task_id, from_name, to_name, priority, status, content, requires_response, created_at, network_id)
+       VALUES (?1, ?2, ?3, 'A站负责人', 'normal', 'replied', 'verify candidate', 'reply', datetime('now'), ?4)`,
+      [childId, parentId, ALIAS, NET],
+    );
+    const result = chainReplyToParent(childId, "news_id=14519", "replied", 5, NET);
+    expect(result.chained).toBe(true);
+    expect(readRun(runId).status).toBe("replied");
+  });
+
+  test("forged metadata cannot cross-bind another task or network run", async () => {
+    const victim = seedScheduledTask("delivered", "victim");
+    const attackerTaskId = "task_attacker";
+    const forgedMeta = JSON.stringify({ scheduled_task_id: victim.scheduleId, scheduled_run_id: victim.runId, auth_origin: "hub_scheduler" });
+    db.run(
+      `INSERT INTO tasks
+         (task_id, from_name, to_node_id, to_name, priority, status, content, requires_response, created_at, network_id, meta_json)
+       VALUES (?1, 'scheduler', ?2, ?3, 'normal', 'delivered', 'forged', 'reply', datetime('now'), ?4, ?5)`,
+      [attackerTaskId, NODE, ALIAS, NET, forgedMeta],
+    );
+    await call(handlers().send_reply, {
+      alias: ALIAS,
+      text: "forged close",
+      in_reply_to: attackerTaskId,
+      status: "replied",
+      network_id: NET,
+    });
+    expect(readRun(victim.runId).status).toBe("delivered");
+  });
+
+  test("a task cannot close a run whose persisted network binding differs", async () => {
+    const victim = seedScheduledTask("delivered", "foreign_network");
+    db.run("UPDATE scheduled_task_runs SET network_id = 'net_690_foreign' WHERE run_id = ?1", [victim.runId]);
+    await call(handlers().send_reply, {
+      alias: ALIAS,
+      text: "must not cross network",
+      in_reply_to: victim.taskId,
+      status: "replied",
+      network_id: NET,
+    });
+    expect(readRun(victim.runId).status).toBe("delivered");
+  });
+});