@sleep2agi/commhub-server 0.9.0-preview.4 → 0.9.0-preview.41

package/src/api-host-supervisors-fallback.test.ts

@@ -0,0 +1,267 @@
+// #380 fix — REST /api/host-supervisors utok→default-network fallback.
+//
+// Before this patch the endpoint hard-4xxed when the client omitted the
+// `network_id` query param. The dashboard's create-node wizard was
+// reported as "hub 400" against a prod hub that had zero daemons AND was
+// being polled without the query — the frontend read that as "no
+// available servers" and blocked the wizard.
+//
+// Post-fix contract:
+//   - ntok caller                                → uses bound network (existing)
+//   - utok caller + `?network_id=...` verified   → uses that (existing)
+//   - utok caller + NO query + 1 accessible net  → fallback to that net (200)
+//   - utok caller + NO query + 2+ accessible net → 400, error=network_id_required_multi
+//   - utok caller + NO query + 0 accessible net  → 400, error=missing_network_id
+//
+// The multi-network case is the authz boundary — we refuse to guess
+// which network to list from (per 通信龙 spec "别 fallback 到错 network").
+//
+// Test pattern mirrors uploads-http.test.ts: bind the real Bun.serve
+// server on an ephemeral port with a temp DB, hit it with fetch().
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { register, login, createNetwork } from "./auth.js";
+import { db } from "./db.js";
+
+// #438 corrective: private bootServer({ port: 0 }) instance (see
+// uploads-http.test.ts for rationale).
+let BASE = "";
+let server: any = null;
+
+// Three users:
+//   soloUser    — single accessible network (fallback should work)
+//   multiUser   — two accessible networks (fallback should refuse)
+//   orphanUser  — zero networks (fallback has nothing to derive)
+let soloToken = "", multiToken = "", orphanToken = "", adminToken = "";
+let soloNetworkId = "";
+let multiNetworkA = "", multiNetworkB = "";
+let soloDaemonAlias = "";
+
+beforeAll(async () => {
+  process.env.HOST = "127.0.0.1";
+
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const password = "BootstrapPw123Aa!";
+
+  // Pre-register a first user so subsequent test users are NOT auto-admin.
+  // resolveRestNetworkScope's admin branch bypasses fallback (admin can
+  // legitimately query any network), which would make solo's no-query
+  // case a false-negative for our fix contract.
+  const seed = register(`seed_admin_${suffix}`, password, undefined, "seed");
+  if (!seed.ok || !seed.token) throw new Error("seed admin failed: " + JSON.stringify(seed));
+  // "First registered user is auto-admin" only holds when this suite has
+  // the DB to itself. In an aggregate run another suite registers first,
+  // the seed lands as a plain user, and paths 7/8 silently test the
+  // wrong role. Promote explicitly — resolveToken reads users.role at
+  // request time, so promotion after token issuance is effective.
+  db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`seed_admin_${suffix}`]);
+  // Save the admin token so path 7 can hit /api/host-supervisors as an
+  // admin directly (通信龙 review point 1: verify admin+no-query goes 400
+  // explicitly, not only implicitly via seed_admin's shadow presence).
+  adminToken = seed.token;
+
+  // Solo user — register() auto-creates a default network; nothing to add.
+  const solo = register(`solo_${suffix}`, password, undefined, "seed");
+  if (!solo.ok || !solo.token) throw new Error("solo register failed: " + JSON.stringify(solo));
+  soloToken = solo.token;
+  soloNetworkId = solo.network_id ?? "";
+  if (!soloNetworkId) throw new Error("solo default network missing");
+
+  // Multi user — register + create a second owned network.
+  const multi = register(`multi_${suffix}`, password, undefined, "seed");
+  if (!multi.ok || !multi.token) throw new Error("multi register failed: " + JSON.stringify(multi));
+  multiToken = multi.token;
+  multiNetworkA = multi.network_id ?? "";
+  if (!multiNetworkA) throw new Error("multi default network missing");
+  const authCtx = login(`multi_${suffix}`, password);
+  const secondNet: any = createNetwork(authCtx.user!.user_id, `multi_second_${suffix}`);
+  if (!secondNet.ok || !secondNet.network_id) throw new Error("multi second-net create failed: " + JSON.stringify(secondNet));
+  multiNetworkB = secondNet.network_id;
+
+  // Orphan user — register then delete membership in the default net so
+  // the user has zero networks. Direct DB manipulation is fine here;
+  // we're modeling an edge case the production API would never let a
+  // normal user hit (they'd always keep at least their default), but
+  // the endpoint contract still needs to be locked.
+  const orphan = register(`orphan_${suffix}`, password, undefined, "seed");
+  if (!orphan.ok || !orphan.token) throw new Error("orphan register failed: " + JSON.stringify(orphan));
+  orphanToken = orphan.token;
+  const orphanUserId = login(`orphan_${suffix}`, password).user!.user_id;
+  db.run("DELETE FROM network_members WHERE user_id = ?1", [orphanUserId]);
+
+  // 通信龙 review point 2: path-2's fallback response must land the
+  // daemon list *from soloNetworkId specifically*, not from the whole
+  // sessions/nodes table. The original test-2 asserted daemons was an
+  // array but a clean fixture (0 daemons in the DB) would trivially
+  // satisfy that. Insert:
+  //   (a) a host_supervisor daemon in soloNetworkId — should show up in
+  //       fallback response
+  //   (b) a host_supervisor daemon in multiNetworkA — should NOT show
+  //       up in solo's fallback (cross-tenant isolation lock)
+  soloDaemonAlias = `solo_daemon_${suffix}`;
+  seedHostSupervisorDaemon({
+    alias: soloDaemonAlias,
+    networkId: soloNetworkId,
+    userIdForToken: login(`solo_${suffix}`, password).user!.user_id,
+  });
+  seedHostSupervisorDaemon({
+    alias: `other_daemon_${suffix}`,
+    networkId: multiNetworkA,
+    userIdForToken: login(`multi_${suffix}`, password).user!.user_id,
+  });
+
+  // server.ts is side-effect-free to import; boot a private instance.
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+  await new Promise((r) => setTimeout(r, 100));
+});
+
+// Insert a minimal `nodes` row + `api_tokens` row so the daemon shows up
+// in /api/host-supervisors' JOIN-then-role-filter query (index.ts
+// GET /api/host-supervisors handler, at the SELECT ... FROM nodes n ...
+// EXISTS (SELECT 1 FROM api_tokens ...) branch). The api_tokens row
+// with name='node:<alias>' + revoked_at IS NULL is the "still active"
+// witness — without it EXISTS drops the row.
+function seedHostSupervisorDaemon(opts: {
+  alias: string;
+  networkId: string;
+  userIdForToken: string;
+}) {
+  const nodeId = `n_test_${opts.alias}`;
+  db.run(
+    `INSERT OR REPLACE INTO nodes (
+       node_id, node_name, alias, runtime, model, config_path,
+       channels, server, hostname, network_id,
+       config_revision, config_snapshot
+     ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
+    [nodeId, opts.alias, opts.alias, "claude-agent-sdk", "claude-sonnet-4-5",
+     "/tmp/cfg.json", "[]", "test-host", "test-host", opts.networkId,
+     0, JSON.stringify({ role: "host_supervisor", daemon_capabilities: {} })],
+  );
+  db.run(
+    `INSERT OR REPLACE INTO api_tokens (
+       token_id, token_hash, user_id, network_id, name, scope
+     ) VALUES (?1, ?2, ?3, ?4, ?5, ?6)`,
+    [`tok_test_${opts.alias}`, `hash_test_${opts.alias}`,
+     opts.userIdForToken, opts.networkId, `node:${opts.alias}`, "network"],
+  );
+}
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+});
+
+async function get(path: string, token: string): Promise<{ status: number; body: any }> {
+  const res = await fetch(`${BASE}${path}`, {
+    headers: { "Authorization": `Bearer ${token}` },
+  });
+  const body = await res.json().catch(() => null);
+  return { status: res.status, body };
+}
+
+describe("#380 — /api/host-supervisors utok→default-network fallback", () => {
+  test("path 1 — utok with 1 network, WITH ?network_id → 200 (existing behavior)", async () => {
+    const r = await get(`/api/host-supervisors?network_id=${soloNetworkId}`, soloToken);
+    expect(r.status).toBe(200);
+    expect(r.body?.ok).toBe(true);
+    expect(Array.isArray(r.body?.daemons)).toBe(true);
+    expect(typeof r.body?.count).toBe("number");
+  });
+
+  test("path 2 — utok with 1 network, NO ?network_id → 200 (fallback lands AND scopes correctly)", async () => {
+    // This is the core #380 fix: dashboard forgot the query but the user
+    // only has one network anyway, so we can safely fall back to it.
+    //
+    // 通信龙 review point 2: harden the assertion beyond "daemons is an
+    // array". We seeded one daemon in soloNetworkId and one in
+    // multiNetworkA (multi user); the fallback response MUST include the
+    // solo one and NOT the multi one. Otherwise a future regression that
+    // wired the fallback to "all networks the user knows about" would
+    // slip through — cross-tenant leak.
+    const r = await get(`/api/host-supervisors`, soloToken);
+    expect(r.status).toBe(200);
+    expect(r.body?.ok).toBe(true);
+    expect(Array.isArray(r.body?.daemons)).toBe(true);
+
+    const aliases: string[] = r.body.daemons.map((d: any) => d.alias);
+    expect(aliases).toContain(soloDaemonAlias);
+    // Belt: nothing from the multi user's network snuck through.
+    expect(aliases.every((a: string) => !a.startsWith("other_daemon_"))).toBe(true);
+    // Every returned daemon's daemon_node_id should be one this user can
+    // legitimately see — locking the shape end-to-end.
+    for (const d of r.body.daemons) {
+      expect(typeof d.daemon_node_id).toBe("string");
+      expect(typeof d.alias).toBe("string");
+    }
+  });
+
+  test("path 3 — utok with 2 networks, NO ?network_id → 400 network_id_required_multi", async () => {
+    // Authz boundary: refuse to guess which network to list. Distinguishing
+    // error field lets the client tell the user "pick a network" vs
+    // "you're not in any networks".
+    const r = await get(`/api/host-supervisors`, multiToken);
+    expect(r.status).toBe(400);
+    expect(r.body?.ok).toBe(false);
+    expect(r.body?.error).toBe("network_id_required_multi");
+    expect(r.body?.memberships).toBe(2);
+  });
+
+  test("path 4 — utok with 2 networks, WITH ?network_id → 200 (explicit choice honored)", async () => {
+    const r = await get(`/api/host-supervisors?network_id=${multiNetworkA}`, multiToken);
+    expect(r.status).toBe(200);
+    expect(r.body?.ok).toBe(true);
+    const r2 = await get(`/api/host-supervisors?network_id=${multiNetworkB}`, multiToken);
+    expect(r2.status).toBe(200);
+    expect(r2.body?.ok).toBe(true);
+  });
+
+  test("path 5 — utok with 2 networks, WITH ?network_id (not a member) → denied by scope layer", async () => {
+    // Requesting a network the user isn't in must never leak — this is
+    // enforced upstream at resolveRestNetworkScope, but re-lock here.
+    const foreignNet = "net_absolutely_not_a_member";
+    const r = await get(`/api/host-supervisors?network_id=${foreignNet}`, multiToken);
+    expect(r.status).toBe(403);
+  });
+
+  test("path 7 — admin utok, NO ?network_id → 400 (admin can span every network; no cross-network guessing)", async () => {
+    // 通信龙 review point 1: the previous suite only asserted admin
+    // indirectly (seed_admin was created first so other test users
+    // weren't auto-admin). This test hits /api/host-supervisors with
+    // seed_admin's own utok — resolveRestNetworkScope's isAdmin branch
+    // returns networkIds:null, singleNetworkId returns null, endpoint
+    // 400s. The response distinguishes it from the multi-network case
+    // via `memberships` being absent-or-0 (admin doesn't populate
+    // scope.networkIds), so the client sees an explicit "you're admin,
+    // pass network_id" affordance.
+    const r = await get(`/api/host-supervisors`, adminToken);
+    expect(r.status).toBe(400);
+    expect(r.body?.ok).toBe(false);
+    // Not the multi-network error — admin path goes through the "no
+    // scope.networkIds" branch → memberships defaults to 0 (the ??
+    // coalesce in the handler). This asymmetry lets the client
+    // distinguish "you own too many" from "you can see all of them".
+    expect(r.body?.error).toBe("missing_network_id");
+  });
+
+  test("path 8 — admin utok, WITH explicit ?network_id → 200 (admin can inspect any network)", async () => {
+    // Complement to path 7: even without membership in a target network,
+    // admin can query it. Locks resolveRestNetworkScope's isAdmin =>
+    // {networkId: requested, networkIds: null} branch.
+    const r = await get(`/api/host-supervisors?network_id=${multiNetworkA}`, adminToken);
+    expect(r.status).toBe(200);
+    expect(r.body?.ok).toBe(true);
+    // The daemon we seeded in multiNetworkA must be reachable.
+    const aliases: string[] = r.body.daemons.map((d: any) => d.alias);
+    expect(aliases.some(a => a.startsWith("other_daemon_"))).toBe(true);
+  });
+
+  test("path 6 — utok with 0 networks, NO ?network_id → 400 missing_network_id (memberships=0)", async () => {
+    const r = await get(`/api/host-supervisors`, orphanToken);
+    expect(r.status).toBe(400);
+    expect(r.body?.ok).toBe(false);
+    expect(r.body?.error).toBe("missing_network_id");
+    expect(r.body?.memberships).toBe(0);
+  });
+});

package/src/api-nodes-shape.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 import { db } from "./db.js";
+import { parseStoredTags } from "./node-attrs-validate.js";
 
 // Regression test for SELECT * fragility on GET /api/nodes.
 //
@@ -29,8 +30,28 @@ afterAll(() => {
   try { db.run("DELETE FROM nodes WHERE node_id = ?1", [TEST_NODE]); } catch {}
 });
 
+// Helper: mirror handler's role-extraction pass to mimic the production
+// response shape exactly. Keeps the test the source of truth for the
+// contract; if the handler changes, the assertions still lock what
+// the dashboard / external clients see.
+function mapRow(r: Record<string, unknown>): Record<string, unknown> {
+  let role: string | null = null;
+  const snap = r.config_snapshot;
+  if (snap) {
+    try { role = (typeof snap === "string" ? JSON.parse(snap) : snap)?.role ?? null; }
+    catch { /* malformed */ }
+  }
+  const { config_snapshot, ...rest } = r;
+  return {
+    ...rest,
+    tags: parseStoredTags(r.tags),
+    attrs_revision: Number(r.attrs_revision ?? 0),
+    role,
+  };
+}
+
 describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", () => {
-  test("explicit columns: internal config_revision/config_snapshot NOT in response", () => {
+  test("explicit columns + role extracted: config_snapshot NOT in response, role IS", () => {
     // Insert a row with the leak-prone columns populated. Use INSERT OR
     // REPLACE so concurrent test runs don't trip on PRIMARY KEY.
     db.run(
@@ -43,38 +64,111 @@ describe("RFC-024 regression — GET /api/nodes response shape (no SELECT *)", (
        )`,
       [TEST_NODE, "test-shape", "test-shape", "claude-agent-sdk", "claude-opus",
        "/tmp/cfg.json", "[]", "localhost", "test-host", TEST_NETWORK,
-       7, JSON.stringify({ model: "claude-opus", flags: { x: true } })],
+       7, JSON.stringify({ model: "claude-opus", flags: { x: true }, role: "host_supervisor" })],
     );
 
-    // Run the same SQL the handler runs (mirror; if handler changes, this
-    // assertion still locks the shape).
-    const rows = db.all<Record<string, unknown>>(
+    // Mirror handler SQL + mapping
+    const raw = db.all<Record<string, unknown>>(
       `SELECT node_id, node_name, alias, runtime, model,
               config_path, channels, server, hostname,
-              network_id, created_at, updated_at
+              network_id, created_at, updated_at,
+              config_snapshot, display_name, team, tags, attrs_revision
        FROM nodes WHERE node_id = ?1`,
       TEST_NODE,
     );
+    const rows = raw.map(mapRow);
 
     expect(rows).toHaveLength(1);
     const row = rows[0]!;
-    // Expected fields present
+    // Expected fields present (13 = 12 contract + new role)
     for (const k of ["node_id", "node_name", "alias", "runtime", "model",
                      "config_path", "channels", "server", "hostname",
-                     "network_id", "created_at", "updated_at"]) {
+                     "network_id", "created_at", "updated_at", "role"]) {
       expect(row).toHaveProperty(k);
     }
-    // Internal fields NOT present (these are the leak the test guards against)
+    // Internal fields NOT present
     expect(row).not.toHaveProperty("config_revision");
     expect(row).not.toHaveProperty("config_snapshot");
-    // Belt: full key set is exactly the 12 contract fields
+    // role is EXTRACTED from config_snapshot JSON, not the raw blob
+    expect(row.role).toBe("host_supervisor");
+    // Belt: the key set is exactly the dashboard-facing contract.
+    // NOTE: this file MIRRORS the handler's SQL rather than calling it, so
+    // it can drift — it already lagged behind `lifecycle_state` /
+    // `avatar_url`, which the handler selects but this mirror does not.
+    // Treat a diff here as "re-read the handler", not as proof of the wire
+    // shape; node-attrs.test.ts asserts the real HTTP response.
     expect(Object.keys(row).sort()).toEqual([
-      "alias", "channels", "config_path", "created_at", "hostname",
-      "model", "network_id", "node_id", "node_name", "runtime",
-      "server", "updated_at",
+      "alias", "attrs_revision", "channels", "config_path", "created_at",
+      "display_name", "hostname", "model", "network_id", "node_id",
+      "node_name", "role", "runtime", "server", "tags", "team",
+      "updated_at",
     ]);
   });
 
+  test("role is null when config_snapshot is empty / missing / malformed", () => {
+    // Empty snapshot → null
+    db.run(
+      `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, network_id, config_snapshot)
+       VALUES (?1, ?2, ?3, ?4, NULL)`,
+      [TEST_NODE, "test-shape", "test-shape", TEST_NETWORK],
+    );
+    let row = mapRow(db.get<Record<string, unknown>>(
+      `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
+       FROM nodes WHERE node_id = ?1`,
+      TEST_NODE,
+    )!);
+    expect(row.role).toBeNull();
+    expect(row).not.toHaveProperty("config_snapshot");
+
+    // Malformed JSON → null (handler doesn't throw, just leaves role null)
+    db.run(`UPDATE nodes SET config_snapshot = ?1 WHERE node_id = ?2`, ["not-json{", TEST_NODE]);
+    row = mapRow(db.get<Record<string, unknown>>(
+      `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
+       FROM nodes WHERE node_id = ?1`,
+      TEST_NODE,
+    )!);
+    expect(row.role).toBeNull();
+
+    // Snapshot without role key → null
+    db.run(`UPDATE nodes SET config_snapshot = ?1 WHERE node_id = ?2`,
+           [JSON.stringify({ model: "x", flags: {} }), TEST_NODE]);
+    row = mapRow(db.get<Record<string, unknown>>(
+      `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
+       FROM nodes WHERE node_id = ?1`,
+      TEST_NODE,
+    )!);
+    expect(row.role).toBeNull();
+  });
+
+  test("daemon discovery use-case: dashboard finds role=host_supervisor without prefix heuristic", () => {
+    // Daemon registered with arbitrary node_id (NO `node_daemon_` prefix)
+    db.run(
+      `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, network_id, config_snapshot)
+       VALUES (?1, ?2, ?3, ?4, ?5)`,
+      [TEST_NODE, "my-daemon", "my-daemon", TEST_NETWORK,
+       JSON.stringify({ role: "host_supervisor", runtime: "claude-agent-sdk" })],
+    );
+    const rows = db.all<Record<string, unknown>>(
+      `SELECT node_id, node_name, alias, runtime, model, config_path, channels,
+              server, hostname, network_id, created_at, updated_at, config_snapshot,
+              display_name, team, tags, attrs_revision
+       FROM nodes WHERE network_id = ?1`,
+      TEST_NETWORK,
+    ).map(mapRow);
+    // Dashboard's lookup: find first node with role==='host_supervisor'
+    const daemon = rows.find(r => r.role === "host_supervisor");
+    expect(daemon).toBeTruthy();
+    expect(daemon!.node_id).toBe(TEST_NODE);
+    // Even though node_id does NOT start with `node_daemon_` (the prior heuristic)
+    expect(String(daemon!.node_id).startsWith("node_daemon_")).toBe(false);
+  });
+
   test("internal columns are still readable via dedicated query (config snapshot endpoint path)", () => {
     db.run(
       `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, network_id,

package/src/auth.ts

@@ -3,6 +3,7 @@
  */
 import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js";
 import { WEAK_PASSWORDS } from "./password-dict.js";
+import { NETWORK_REST_COLUMNS, NETWORK_REST_SELECT, sqlColumns } from "./rest-projections.js";
 
 // Round-6 A1 hardening — dummy hash for username-enumeration timing
 // close. We compute ONE scrypt hash of a throwaway password and reuse
@@ -87,11 +88,32 @@ export function register(username: string, password: string, email?: string, dis
     [userId, username, pwHash, email || null, displayName || username, isFirstUser ? "admin" : "user"]
   );
 
-  // Auto-create default network + add as owner member
+  // Auto-create the user's own network + add as owner member.
+  //
+  // Name it after the user rather than the literal "default". Every
+  // registration used to mint a network called "default", so a hub with N
+  // users showed N identical "default" rows in the Dashboard sidebar with
+  // no way to tell them apart (23 of them on the live hub, 22 empty).
+  // Three CLI call sites (bin/cli.ts debate / demo-social / pr-review) resolve
+  // a network as:
+  //     me.user.default_network_id
+  //       || networks.find(n => n.network_name === "default")
+  //       || networks[0]
+  // Checked against the live hub: GET /api/auth/me returns
+  // {user_id, username, display_name, email, role} — there is no
+  // default_network_id field, and nothing in server/ ever writes one. So the
+  // first term is always undefined and the name lookup is the operative path,
+  // not a fallback.
+  //
+  // After this change that lookup misses for new users and they land on
+  // networks[0]. That still resolves to this network because listNetworks()
+  // is `ORDER BY created_at` ascending (auth.ts:296) and this row is the
+  // user's oldest. Reordering that query would silently point those three
+  // commands at the wrong network.
   const networkId = generateId("net");
   db.run(
     "INSERT INTO networks (network_id, network_name, owner_id, description) VALUES (?1, ?2, ?3, ?4)",
-    [networkId, "default", userId, "Auto-created default network"]
+    [networkId, username, userId, `Auto-created network for ${username}`]
   );
   db.run(
     "INSERT INTO network_members (network_id, user_id, role) VALUES (?1, ?2, 'owner')",
@@ -191,18 +213,67 @@ export function login(username: string, password: string): AuthResult {
   };
 }
 
-/** Create a network-scoped token (ntok_) for a specific node */
-export function createNetworkTokenForNode(userId: string, networkId: string, nodeName: string): { ok: boolean; token?: string; error?: string } {
+/**
+ * Create a network-scoped token (ntok_) for a specific node.
+ *
+ * RFC-036: callers that provide nodeId atomically establish the immutable
+ * node-owner binding before the plaintext token is returned. The 3-argument
+ * legacy form remains available for old clients, but its token has no bound
+ * node id and therefore cannot consume external-schedule edit intents.
+ */
+export function createNetworkTokenForNode(userId: string, networkId: string, nodeName: string, nodeId?: string): { ok: boolean; token?: string; token_id?: string; node_id?: string; error?: string } {
   // Verify user is a member of this network with write access
   const role = getUserNetworkRole(userId, networkId);
   if (!role || role === "viewer") return { ok: false, error: "no write access to this network" };
+  if (!nodeName || nodeName.length > 200) return { ok: false, error: "invalid_node_name" };
+  if (nodeId !== undefined && (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(nodeId))) {
+    return { ok: false, error: "invalid_node_id" };
+  }
   const token = generateNetworkToken();
   const tokenId = generateId("tok");
-  db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-    [tokenId, hashToken(token), userId, networkId, `node:${nodeName}`, "network"]
-  );
-  return { ok: true, token };
+  try {
+    db.transaction(() => {
+      if (nodeId) {
+        const existing = db.get<{ network_id: string | null; owner_user_id: string | null }>(
+          "SELECT network_id, owner_user_id FROM nodes WHERE node_id = ?1",
+          nodeId,
+        );
+        if (existing?.network_id && existing.network_id !== networkId) throw new Error("cross_network_node");
+        // Existing pre-RFC-036 rows have no trustworthy owner anchor. A token
+        // refresh must not turn knowledge of a legacy node_id into ownership.
+        // They remain read-only until a separately authorized migration.
+        if (existing && !existing.owner_user_id) throw new Error("node_owner_unclaimed");
+        if (existing?.owner_user_id && existing.owner_user_id !== userId) throw new Error("node_owner_mismatch");
+        db.run(
+          `INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, updated_at)
+           VALUES (?1, ?2, ?2, ?3, ?4, datetime('now'))
+           ON CONFLICT(node_id) DO UPDATE SET
+             node_name = COALESCE(nodes.node_name, ?2),
+             alias = COALESCE(nodes.alias, ?2),
+             network_id = COALESCE(nodes.network_id, ?3),
+             owner_user_id = COALESCE(nodes.owner_user_id, ?4),
+             updated_at = datetime('now')`,
+          [nodeId, nodeName, networkId, userId],
+        );
+        if (!existing) {
+          db.run(
+            `INSERT INTO audit_log (user_id, action, target_type, target_id, detail, network_id)
+             VALUES (?1, 'external_schedule.owner_claimed', 'node', ?2, ?3, ?4)`,
+            [userId, nodeId, JSON.stringify({ node_id: nodeId, network_id: networkId }), networkId],
+          );
+        }
+      }
+      db.run(
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, bound_node_id) VALUES (?1, ?2, ?3, ?4, ?5, 'network', ?6)",
+        [tokenId, hashToken(token), userId, networkId, `node:${nodeName}`, nodeId ?? null],
+      );
+    });
+  } catch (error: any) {
+    const code = String(error?.message || "node_token_create_failed");
+    if (code === "cross_network_node" || code === "node_owner_unclaimed" || code === "node_owner_mismatch") return { ok: false, error: code };
+    throw error;
+  }
+  return { ok: true, token, token_id: tokenId, ...(nodeId ? { node_id: nodeId } : {}) };
 }
 
 export function resolveToken(token: string): { user: AuthUser; networkId: string | null; tokenName: string | null; tokenId: string | null } | null {
@@ -235,7 +306,7 @@ export function resolveToken(token: string): { user: AuthUser; networkId: string
 
 export function getUserNetworks(userId: string) {
   return db.all<any>(
-    "SELECT * FROM networks WHERE owner_id = ?1 ORDER BY created_at",
+    `SELECT ${NETWORK_REST_SELECT} FROM networks WHERE owner_id = ?1 ORDER BY created_at`,
     userId);
 }
 
@@ -280,7 +351,7 @@ export function listTokens(userId: string) {
 }
 
 export function renameNetwork(userId: string, networkId: string, newName: string): { ok: boolean; error?: string } {
-  const net = db.get<any>("SELECT * FROM networks WHERE network_id = ?1", networkId);
+  const net = db.get<any>("SELECT owner_id FROM networks WHERE network_id = ?1", networkId);
   if (!net) return { ok: false, error: "network not found" };
   if (net.owner_id !== userId) return { ok: false, error: "not your network" };
   const dup = db.get<any>("SELECT network_id FROM networks WHERE owner_id = ?1 AND network_name = ?2", userId, newName);
@@ -290,13 +361,18 @@ export function renameNetwork(userId: string, networkId: string, newName: string
 }
 
 export function deleteNetwork(userId: string, networkId: string): { ok: boolean; error?: string } {
-  const net = db.get<any>("SELECT * FROM networks WHERE network_id = ?1", networkId);
+  const net = db.get<any>("SELECT owner_id FROM networks WHERE network_id = ?1", networkId);
   if (!net) return { ok: false, error: "network not found" };
   if (net.owner_id !== userId) return { ok: false, error: "not your network" };
   // Check if any sessions/tasks still reference this network
   const sessions = db.get<{ cnt: number }>("SELECT COUNT(*) as cnt FROM sessions WHERE network_id = ?1", networkId);
   if (sessions && sessions.cnt > 0) return { ok: false, error: `network has ${sessions.cnt} active session(s) — stop them first` };
   db.run("DELETE FROM networks WHERE network_id = ?1 AND owner_id = ?2", [networkId, userId]);
+  // PR #519 codex catch: leaving membership rows behind made deleted
+  // networks count toward getUserNetworkIds — a stale row could flip a
+  // single-network user to "ambiguous" or auto-resolve writes INTO the
+  // deleted network. Remove memberships with the network.
+  db.run("DELETE FROM network_members WHERE network_id = ?1", [networkId]);
   return { ok: true };
 }
 
@@ -444,7 +520,10 @@ export function createInvite(networkId: string, createdBy: string, role: string
 }
 
 export function joinByInvite(inviteCode: string, userId: string): { ok: boolean; network_id?: string; role?: string; error?: string } {
-  const invite = db.get<any>("SELECT * FROM network_invites WHERE invite_code = ?1", inviteCode);
+  const invite = db.get<any>(
+    "SELECT invite_code, network_id, role, created_by, max_uses, used_count, expires_at, created_at FROM network_invites WHERE invite_code = ?1",
+    inviteCode,
+  );
   if (!invite) return { ok: false, error: "invalid invite code" };
   if (invite.max_uses > 0 && invite.used_count >= invite.max_uses) return { ok: false, error: "invite code fully used" };
   if (invite.expires_at) {
@@ -469,7 +548,7 @@ export function joinByInvite(inviteCode: string, userId: string): { ok: boolean;
 /** Get all networks a user is a member of (replaces owner-only query) */
 export function getUserAllNetworks(userId: string) {
   return db.all<any>(
-    `SELECT n.*, nm.role as member_role
+    `SELECT ${sqlColumns(NETWORK_REST_COLUMNS, "n")}, nm.role as member_role
      FROM networks n JOIN network_members nm ON n.network_id = nm.network_id
      WHERE nm.user_id = ?1 ORDER BY nm.role = 'owner' DESC, n.created_at`,
     userId);