@sleep2agi/commhub-server 0.9.0-preview.40 → 0.9.0-preview.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.40",
+  "version": "0.9.0-preview.41",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -53,6 +53,38 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_inbox_pending
     ON inbox(session_name, acked) WHERE acked = 0;
 
+  -- #1459 ① — agent→用户的 desktop message 持久化收件箱。
+  -- inbox 是 session_name(alias) 寻址的;desktop message 目标是 user_id,不能复用
+  -- inbox(否则 /api/messages+inbox_count+SSE gate 一票 alias 域查询会隐性开始返回
+  -- 用户消息)。单独一张 user_id 寻址表,镜像 inbox 的 acked/count 语义。
+  -- message_id 即主键(dm_<uuid>,与 inbox「消息 id 即主键」同形)→ 写入用
+  -- INSERT OR IGNORE,send_desktop_message 重试天然幂等,不会插出重复消息行。
+  -- 索引留到 P3:读取查询形状定了再按真实 WHERE 加(SDK马 review:没查询就加索引是猜;
+  -- 部分索引 acked=0 若「近期」读含已 ack 行则用不上)。P1 只落表。
+  CREATE TABLE IF NOT EXISTS user_inbox (
+    message_id    TEXT PRIMARY KEY,
+    network_id    TEXT,
+    user_id       TEXT NOT NULL,
+    from_session  TEXT,
+    kind          TEXT NOT NULL DEFAULT 'info',
+    title         TEXT,
+    content       TEXT NOT NULL,
+    severity      TEXT NOT NULL DEFAULT 'info',
+    meta_json     TEXT,
+    acked         INTEGER NOT NULL DEFAULT 0,
+    created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+    acked_at      TEXT
+  );
+
+  -- #1459 ① P3 —— 现在有真实查询了才建索引（P1 刻意没建：没有查询就加索引是猜）。
+  -- 覆盖回读分支的两条：
+  --   列表  SELECT ... WHERE user_id = ? [AND acked = 0] ORDER BY created_at DESC
+  --   未读数 SELECT COUNT(*) WHERE user_id = ? AND acked = 0
+  -- 不是部分索引（不写 WHERE acked = 0）：列表在 unacked=0 时要读**含已 ack 的**
+  -- 近期消息，部分索引那时用不上。
+  CREATE INDEX IF NOT EXISTS idx_user_inbox_user_acked
+    ON user_inbox(user_id, acked, created_at);
+
   CREATE TABLE IF NOT EXISTS completions (
     id               TEXT PRIMARY KEY,
     session_name     TEXT NOT NULL,

package/src/desktop-message-seam.test.ts

@@ -0,0 +1,150 @@
+// #1459 —— P2 写路径与 P3 读路径的**接缝**。
+//
+// 通信龙 在 origin/main 上核出的覆盖缝：desktop-message.test.ts 测真实 send 但
+// 不碰 scope=user 读；user-inbox-read-http.test.ts 测 scope=user 读但用 SQL 直接
+// 播种行。两半各自对着自己的夹具绿，而"真实 send 写进的行、真实 scope=user
+// 读得回来"从没验过。本文件就走这一条：真 send → 真 HTTP 读。
+//
+// 附带钉住 network_id 不为 NULL 的**真实机制**：不是 INSERT 时兜底，而是
+// tools.ts 里 `if (!effectiveNetId) return writeDeniedReply(...)` 在写之前就拒。
+// 见下面 "解析不出 network 时拒发" 那条 —— 把那个 if 拿掉，本文件会红。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-dm-seam-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let targetToken = "";
+let senderId = "", targetId = "", senderNet = "", secondNet = "";
+let send: (args: any) => Promise<Record<string, any>>;
+
+function buildSend(opts: { netId: string | null; userId: string | null; alias: string | null }) {
+  const mcp = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, any> = {};
+  const origTool = mcp.tool.bind(mcp);
+  mcp.tool = (name: string, _d: string, _s: any, handler: any) => { tools[name] = handler; return origTool(name, _d, _s, handler); };
+  const { registerTools } = require("./tools.js");
+  registerTools(mcp, undefined, opts.netId, opts.userId, opts.alias, false, "tok_seam_test");
+  return async (args: any) => JSON.parse((await tools["send_desktop_message"](args)).content[0].text);
+}
+
+beforeAll(async () => {
+  const { db } = await import("./db.js");
+  const { register, addNetworkMember } = await import("./auth.js");
+  const stamp = Date.now();
+
+  // 首个注册用户自动成为全局 admin，而 admin 读侧不走 scope 过滤分支。
+  // 收件人必须是普通 user，否则"读得回来"可能只是因为它绕过了过滤。
+  expect(register(`seam_admin_${stamp}`, "SeamAdmin-Strong-1!").ok).toBe(true);
+  const s = register(`seam_sender_${stamp}`, "SeamSender-Strong-1!");
+  const t = register(`seam_target_${stamp}`, "SeamTarget-Strong-1!");
+  expect(s.ok && t.ok).toBe(true);
+  targetToken = t.token!;
+  senderNet = s.network_id!;
+  secondNet = t.network_id!;
+  senderId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `seam_sender_${stamp}`)!.user_id;
+  targetId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `seam_target_${stamp}`)!.user_id;
+  expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", targetId)?.role).toBe("user");
+
+  // 收件人进发件人的网（真实形态：同网两成员）。
+  expect(addNetworkMember(senderNet, targetId, "member").ok).toBe(true);
+
+  send = buildSend({ netId: senderNet, userId: senderId, alias: "seam-sender" });
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+const readOwn = async (token: string, qs = "") => {
+  const r = await fetch(`${base}/api/messages?scope=user${qs}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+
+describe("#1459 P2 写 → P3 读 接缝", () => {
+  test("🔴 真实 send_desktop_message 写进的行，真实 GET ?scope=user 读得回来", async () => {
+    const sent = await send({ to_user_id: targetId, message: "接缝测试正文", title: "接缝", severity: "warning", kind: "agent_message" });
+    expect([sent.ok, sent.persisted]).toEqual([true, true]);
+
+    const { status, body } = await readOwn(targetToken);
+    expect(status).toBe(200);
+    const row = body.messages.find((m: any) => m.message_id === sent.message_id);
+    expect(row).toBeTruthy();                      // 承重：两半接得上
+    expect(row.content).toBe("接缝测试正文");
+    expect(row.title).toBe("接缝");
+    expect(row.severity).toBe("warning");
+    expect(row.user_id).toBe(targetId);
+  });
+
+  test("🔴 落库的 network_id 就是授权用的那个网，不是 NULL —— 否则 scoped 读回不来", async () => {
+    const { db } = require("./db.js");
+    const sent = await send({ to_user_id: targetId, message: "网络归属" });
+    const row = db.get<any>("SELECT network_id FROM user_inbox WHERE message_id = ?1", sent.message_id);
+    expect(row.network_id).toBe(senderNet);
+
+    const { body } = await readOwn(targetToken);
+    expect(body.messages.map((m: any) => m.message_id)).toContain(sent.message_id);
+  });
+
+  test("unread 随真实 send 增长", async () => {
+    const before = (await readOwn(targetToken)).body.unread;
+    await send({ to_user_id: targetId, message: "计数 +1" });
+    expect((await readOwn(targetToken)).body.unread).toBe(before + 1);
+  });
+
+  test("redact-at-read 作用在真实写进去的正文上", async () => {
+    const sent = await send({ to_user_id: targetId, message: "凭据 ntok_seamtoken123456 在正文里" });
+    const { db } = require("./db.js");
+    // 存储侧保留原文，遮蔽发生在**回读**时 —— 这两句一起才说明是 read-time 脱敏。
+    expect(db.get<any>("SELECT content FROM user_inbox WHERE message_id = ?1", sent.message_id).content)
+      .toContain("ntok_seamtoken123456");
+    const row = (await readOwn(targetToken)).body.messages.find((m: any) => m.message_id === sent.message_id);
+    expect(row.content).toContain("ntok_***redacted***");
+    expect(row.content).not.toContain("ntok_seamtoken123456");
+  });
+
+  // 🔴 这一条是 `if (!effectiveNetId) return` 这道守卫**唯一**能被触发的场景。
+  //    有 auth ctx 时前一道 `canWrite` 就拦了；而 canRestWriteNetwork 对
+  //    legacy 全局 token / --dev-open（authCtx 为 null）是 `return true`
+  //    （network-scope.ts:96）—— 那条路上只剩这道守卫挡着 NULL 孤儿行。
+  //    把 tools.ts:2320 那行删掉，本条会红（写出一行 network_id=NULL）。
+  test("🔴 legacy 无 auth ctx 的调用者同样拒发，不写 NULL 孤儿行", async () => {
+    const { db } = require("./db.js");
+    const legacy = buildSend({ netId: null, userId: null as any, alias: null as any });
+    const before = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n;
+    const r = await legacy({ to_user_id: targetId, message: "legacy 无网络上下文" });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("network_id_required");
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n).toBe(before);
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE network_id IS NULL")!.n).toBe(0);
+  });
+
+  test("🔴 解析不出 network 时**拒发**，而不是写一行 network_id=NULL 的孤儿", async () => {
+    const { db } = require("./db.js");
+    const { addNetworkMember } = require("./auth.js");
+    // 发件人进第二个网 ⇒ 不带 network_id 时 singleNetworkId 解析不出唯一网。
+    addNetworkMember(secondNet, senderId, "member");
+    const ambiguous = buildSend({ netId: null, userId: senderId, alias: "seam-sender" });
+
+    const before = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n;
+    const r = await ambiguous({ to_user_id: targetId, message: "无法解析网络" });
+
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("network_id_required");
+    // 承重：拒发意味着**一行都不写**。若把 tools.ts 的
+    // `if (!effectiveNetId) return writeDeniedReply(...)` 拿掉，这里会多出一行
+    // network_id=NULL 的孤儿 —— 写得进去、scoped 读不回来。
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n).toBe(before);
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE network_id IS NULL")!.n).toBe(0);
+  });
+});

package/src/desktop-message.test.ts

@@ -284,3 +284,85 @@ describe("#1459 send_desktop_message 返回值反映真实投递态", () => {
     expect(offline.delivered).not.toBe(online.delivered);
   });
 });
+
+// #1459 ① P2 —— 写入持久化。
+describe("#1459 ① P2 send_desktop_message 持久化", () => {
+  const rowsFor = (mid: string) =>
+    db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n ?? 0;
+
+  test("🔴 发一条消息 ⇒ user_inbox 落一行，字段与事件一致", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A, message: "persist me", severity: "warning", title: "T", kind: "agent_message",
+    });
+    expect(r.ok).toBe(true);
+    expect(r.persisted).toBe(true);
+    const row = db.get<any>("SELECT * FROM user_inbox WHERE message_id = ?1", r.message_id);
+    expect(row).toBeTruthy();
+    expect(row.user_id).toBe(TARGET_A);
+    expect(row.content).toBe("persist me");
+    expect(row.severity).toBe("warning");
+    expect(row.title).toBe("T");
+    expect(row.from_session).toBe("node-a");
+    expect(row.network_id).toBe(NET_A);
+    expect(row.acked).toBe(0);
+  });
+
+  test("🔴 没有活订阅者时也要落库 —— 「丢了」变成「待补投」的那一格", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "offline body" });
+    expect(r.delivered).toBe(false);
+    expect(r.reason).toBe("no_live_subscriber");
+    expect(r.persisted).toBe(true);
+    expect(rowsFor(r.message_id)).toBe(1);
+  });
+
+  test("🔴 zod 默认值不可依赖：直接调 handler 不传 kind/severity 也必须落库", async () => {
+    // 测试与未来的内部调用方绕过 MCP 的 zod .default()，拿到的是 undefined。
+    // 列上虽有 DEFAULT，但显式传 NULL 会覆盖它 —— 所以写入侧要自己兜。
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "no kind given" });
+    expect(rowsFor(r.message_id)).toBe(1);
+    const row = db.get<any>("SELECT kind, severity FROM user_inbox WHERE message_id = ?1", r.message_id);
+    expect(row.kind).toBe("agent_message");
+    expect(row.severity).toBe("info");
+  });
+
+  test("audit_log 与 user_inbox 同生共死（同一事务，条数一致）", async () => {
+    const before = auditCount();
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const r = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "paired" });
+    expect(auditCount()).toBe(before + 1);
+    expect(rowsFor(r.message_id)).toBe(1);
+  });
+});
+
+// #1459 ① P2 —— 幂等写法的选择本身要被钉住。
+//
+// 🔴 实现时踩到的：最初用 `INSERT OR IGNORE`，它对「重投同一 message_id」是对的，
+//    但**连 NOT NULL 违规也一起吞掉** —— kind 为 undefined 时整行被静默丢弃，
+//    而工具照样返回 persisted:true。**一条消息凭空消失且报告成功**，正是本
+//    issue 要消灭的那个形状。改成 ON CONFLICT(message_id) DO NOTHING：
+//    只赦免主键冲突，别的约束照常抛。
+describe("#1459 ① P2 幂等写法：赦免重复，但不吞约束错误", () => {
+  const stmt = `INSERT INTO user_inbox
+      (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json)
+    VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+    ON CONFLICT(message_id) DO NOTHING`;
+
+  test("重复的 message_id ⇒ 不抛错、也不产生第二行", () => {
+    const mid = `dm_dup_${Date.now()}`;
+    const ins = () => db.run(stmt, [mid, NET_A, TARGET_A, "node-a", "info", null, "body", "info", null]);
+    ins();
+    expect(() => ins()).not.toThrow();
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n).toBe(1);
+  });
+
+  test("🔴 NOT NULL 违规必须抛出来 —— 不能像 OR IGNORE 那样静默丢行", () => {
+    const mid = `dm_bad_${Date.now()}`;
+    expect(() =>
+      db.run(stmt, [mid, NET_A, TARGET_A, "node-a", null, null, "body", "info", null]),
+    ).toThrow();
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n).toBe(0);
+  });
+});

package/src/redact-tokens.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { redactTokens, redactMessageRow } from "./redact-tokens.js";
+
+describe("#1459 ③ redact-at-read", () => {
+  test("🔴 各种前缀形状都被遮住，且前缀保留（读者仍知道泄漏的是哪一类）", () => {
+    const cases: Array<[string, string]> = [
+      ["ntok_abcdef123456", "ntok_"],
+      ["utok_abcdef123456", "utok_"],
+      ["ghp_" + "A".repeat(24), "ghp_"],
+      ["github_pat_" + "B".repeat(24), "github_pat_"],
+      ["xoxb-1234567890-abcdef", "xoxb-"],
+      ["sk-" + "C".repeat(20), "sk-"],
+    ];
+    for (const [raw, prefix] of cases) {
+      const out = redactTokens(`before ${raw} after`);
+      expect(out).toContain("***redacted***");
+      expect(out).toContain(prefix);
+      expect(out).not.toContain(raw);          // 原值一定不能整体幸存
+      expect(out).toContain("before");         // 周围文本不受影响
+      expect(out).toContain("after");
+    }
+  });
+
+  test("🔴 保守：不像凭据的内容一个字都不能改", () => {
+    for (const s of [
+      "任务完成，磁盘 96%",
+      "see https://example.com/a-b_c",
+      "sk-",                       // 太短，不是凭据
+      "ntok_",                     // 光前缀
+      "the stock ticker is SKU-12",
+    ]) {
+      expect(redactTokens(s)).toBe(s);
+    }
+  });
+
+  test("同一段里的多个 token 全部被遮", () => {
+    const out = redactTokens(`a ntok_aaaaaaaaaa b sk-${"z".repeat(20)} c`);
+    expect(out.match(/\*\*\*redacted\*\*\*/g)?.length).toBe(2);
+  });
+
+  test("redactMessageRow 只碰自由文本字段，不动结构字段", () => {
+    const row = {
+      message_id: "dm_ntok_looking_but_is_an_id",
+      user_id: "u_1",
+      content: "here is ntok_abcdef123456",
+      title: "sk-" + "d".repeat(20),
+      meta_json: JSON.stringify({ note: "ghp_" + "E".repeat(24) }),
+      created_at: "2026-08-30 00:00:00",
+    };
+    const out = redactMessageRow(row);
+    expect(out.content).toContain("***redacted***");
+    expect(out.title).toContain("***redacted***");
+    expect(out.meta_json).toContain("***redacted***");
+    // 结构字段原样 —— 即便 message_id 里恰好有个像前缀的子串
+    expect(out.message_id).toBe(row.message_id);
+    expect(out.user_id).toBe(row.user_id);
+    expect(out.created_at).toBe(row.created_at);
+  });
+
+  test("非字符串原样返回（null/数字不该被改成字符串）", () => {
+    expect(redactTokens(null as any)).toBeNull();
+    expect(redactTokens(42 as any)).toBe(42);
+    expect(redactMessageRow({ content: null, title: 7 } as any)).toEqual({ content: null, title: 7 } as any);
+  });
+});

package/src/redact-tokens.ts

@@ -0,0 +1,40 @@
+// #1459 ③ —— 读取时的 token 形状脱敏（redact-at-read）。
+//
+// 为什么在**读取**侧而不是写入侧：写入方是 agent，不受信任。存储侧已经走
+// normalizeMetaJson（跨主机路径脱敏，与 inbox 一致），那一层防的是"路径泄漏"；
+// 这一层防的是"有人把凭据塞进消息正文或 meta"。两层管的不是同一件事。
+//
+// 🔴 保守优先：宁可漏脱敏一个不像凭据的串，也不要把正常内容改花。所以只匹配
+//    几个**有明确前缀**的形状，不做熵检测、不猜。
+
+/** 有明确前缀的凭据形状。
+ *
+ *  🔴 前缀用**捕获组显式声明**，不靠"切到第一个下划线"之类的推断 ——
+ *     第一版就是那么写的，`github_pat_xxx` 被切成了 `github_`，把"这是哪一类
+ *     凭据"这个唯一有用的信息也遮掉了。声明比推断短，也不会错。 */
+const TOKEN_PATTERNS: ReadonlyArray<RegExp> = [
+  /\b(ntok_|utok_|atok_)[A-Za-z0-9_-]{6,}/g,          // 本仓自己的 token
+  /\b(github_pat_)[A-Za-z0-9_]{20,}/g,                // GitHub fine-grained PAT（必须排在 ghp_ 之前无关，但更长的前缀先声明更清楚）
+  /\b(ghp_)[A-Za-z0-9]{20,}/g,                        // GitHub classic PAT
+  /\b(xox[bpoars]-)[A-Za-z0-9-]{10,}/g,               // Slack
+  /\b(sk-)[A-Za-z0-9_-]{16,}/g,                       // OpenAI 风格
+];
+
+/** 对任意文本做 token 形状脱敏。非字符串原样返回。 */
+export function redactTokens<T>(value: T): T {
+  if (typeof value !== "string") return value;
+  let out: string = value;
+  // 保留捕获到的前缀（让读者知道泄漏的是哪一类），其余一律遮掉；不保留尾部 ——
+  // 尾部对识别没帮助，却能帮攻击者缩小搜索空间。
+  for (const re of TOKEN_PATTERNS) out = out.replace(re, (_m, prefix: string) => `${prefix}***redacted***`);
+  return out as unknown as T;
+}
+
+/** 对一行消息做脱敏：只碰会承载自由文本的字段，不动 id/时间戳等结构字段。 */
+export function redactMessageRow<T extends Record<string, unknown>>(row: T): T {
+  const out: Record<string, unknown> = { ...row };
+  for (const field of ["content", "title", "meta_json"]) {
+    if (typeof out[field] === "string") out[field] = redactTokens(out[field] as string);
+  }
+  return out as T;
+}

package/src/server.ts

@@ -1,3 +1,4 @@
+import { redactMessageRow } from "./redact-tokens.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { buildControllableMap, isLifecycleControllable } from "./node-lifecycle-controllable.js";
@@ -2627,6 +2628,50 @@ return Bun.serve({
       }
     }
 
+    // ── REST: per-user desktop inbox (#1459 ① P3) ──
+    // 🔴 只在 ?scope=user 时走这条；下面按 alias 寻址的既有分支一行未动
+    //    （dashboard 依赖那条 inbox 查询）。
+    if (url.pathname === "/api/messages" && url.searchParams.get("scope") === "user") {
+      // 🔴 收件人取自**鉴权上下文**，不接受 query 指定 —— 否则任何人都能
+      //    ?user_id=<别人> 读走别人的私信。
+      const callerUserId = restAuth?.userId ?? null;
+      if (!callerUserId) {
+        return withCors(req, Response.json({ ok: false, error: "auth_required" }, { status: 401 }));
+      }
+      const limit = Math.min(Number(url.searchParams.get("limit")) || 100, 500);
+      const unackedOnly = url.searchParams.get("unacked") === "1";
+
+      const params: any[] = [callerUserId];
+      let sql = `SELECT message_id, network_id, user_id, from_session, kind, title, content, severity,
+                        meta_json, acked, created_at, acked_at
+                 FROM user_inbox WHERE user_id = ?1`;
+      if (unackedOnly) sql += " AND acked = 0";
+      // 复用 alias 分支同一个 scope 助手：新读路径漏 scope 是已被审计证实的真风险。
+      sql = addNetworkScope(sql, params, restScope);
+      sql += ` ORDER BY created_at DESC LIMIT ?${params.length + 1}`;
+      params.push(limit);
+      const rows = db.all<any>(sql, ...params);
+
+      // 未读数与列表用同一个 user_id + 同一个 scope 助手算，避免两处口径漂开。
+      const countParams: any[] = [callerUserId];
+      let countSql = "SELECT COUNT(*) AS cnt FROM user_inbox WHERE user_id = ?1 AND acked = 0";
+      countSql = addNetworkScope(countSql, countParams, restScope);
+      const unread = db.get<{ cnt: number }>(countSql, ...countParams)?.cnt ?? 0;
+
+      // 🔴 redact-at-read：写入方是 agent，不受信任。存储侧已做跨主机路径脱敏，
+      //    这一层单独防"有人把凭据塞进正文/标题/meta"。
+      const messages = rows.map(redactMessageRow);
+
+      return withCors(req, Response.json({
+        ok: true,
+        messages,
+        unread,
+        // 同一个数的两个名字：`unread` 给角标读，`pending_count` 与 alias 分支
+        // 的字段名保持一致。**一处计算**，不是两处实现。
+        pending_count: unread,
+      }));
+    }
+
     // ── REST: recent messages (for Dashboard communication graph) ──
     if (url.pathname === "/api/messages") {
       const limit = Math.min(Number(url.searchParams.get("limit")) || 100, 500);
@@ -2654,6 +2699,34 @@ return Bun.serve({
       return withCors(req, Response.json({ ok: true, messages: rows, ...(alias ? { pending_count: pendingCount ?? 0 } : {}) }));
     }
 
+    // ── REST: ack per-user desktop messages (#1459 ① P3) ──
+    if (url.pathname === "/api/messages/ack" && req.method === "POST") {
+      const callerUserId = restAuth?.userId ?? null;
+      if (!callerUserId) {
+        return withCors(req, Response.json({ ok: false, error: "auth_required" }, { status: 401 }));
+      }
+      let body: any = null;
+      try { body = await req.json(); } catch { /* 下面按缺参处理 */ }
+      const ids: string[] = Array.isArray(body?.message_ids)
+        ? body.message_ids.filter((x: unknown) => typeof x === "string" && x.length > 0)
+        : (typeof body?.message_id === "string" && body.message_id ? [body.message_id] : []);
+      if (ids.length === 0) {
+        return withCors(req, Response.json({ ok: false, error: "message_id_required" }, { status: 400 }));
+      }
+      if (ids.length > 500) {
+        return withCors(req, Response.json({ ok: false, error: "too_many_ids", limit: 500 }, { status: 400 }));
+      }
+      // 🔴 `AND user_id = <ctx>`：只能 ack 自己的。别人的 message_id 传进来
+      //    也匹配不到行，所以既不会改到别人的状态，也不会因此泄漏它是否存在。
+      const params: any[] = [callerUserId, ...ids];
+      const placeholders = ids.map((_, i) => `?${i + 2}`).join(", ");
+      let sql = `UPDATE user_inbox SET acked = 1, acked_at = datetime('now')
+                 WHERE user_id = ?1 AND message_id IN (${placeholders}) AND acked = 0`;
+      sql = addNetworkScope(sql, params, restScope);
+      const res = db.run(sql, params);
+      return withCors(req, Response.json({ ok: true, acked: res.changes ?? 0 }));
+    }
+
     // ── REST: stats summary ──
     if (url.pathname === "/api/stats") {
       const taskStatsParams: any[] = [];

package/src/tools.ts

@@ -2363,25 +2363,61 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         ...(meta && Object.keys(meta).length ? { meta } : {}),
       };
 
-      db.run(
-        `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
-         VALUES (?1, ?2, 'send_desktop_message', 'user', ?3, ?4, ?5)`,
-        [
-          enforceUserId || null,
-          callerAlias || null,
-          target.user_id,
-          JSON.stringify({
-            message_id: messageId,
-            to_username: target.username,
-            from: from_session,
-            severity,
-            kind,
-            title: title || null,
-            meta_keys: meta && typeof meta === "object" ? Object.keys(meta) : [],
-          }),
-          effectiveNetId,
-        ],
-      );
+      // #1459 ① P2 —— 审计与收件持久化必须同生共死：只落其中一半，就会出现
+      // 「审计说发过、而用户永远收不到」或者反过来。放进同一个事务。
+      db.transaction(() => {
+        db.run(
+          `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+           VALUES (?1, ?2, 'send_desktop_message', 'user', ?3, ?4, ?5)`,
+          [
+            enforceUserId || null,
+            callerAlias || null,
+            target.user_id,
+            JSON.stringify({
+              message_id: messageId,
+              to_username: target.username,
+              from: from_session,
+              severity,
+              kind,
+              title: title || null,
+              meta_keys: meta && typeof meta === "object" ? Object.keys(meta) : [],
+            }),
+            effectiveNetId,
+          ],
+        );
+        // 🔴 `ON CONFLICT(message_id) DO NOTHING`，而不是 `INSERT OR IGNORE`：
+        //   两者对"重投同一个 message_id"效果相同（幂等，不产生重复消息），
+        //   但 OR IGNORE 会**连同其它约束错误一起吞掉** —— 我在实现本段时就
+        //   撞上了：`kind` 为 NULL 触发 NOT NULL，OR IGNORE 静默丢弃整行，
+        //   而工具照样返回 `persisted: true`。**一条消息凭空消失且报告成功**，
+        //   正是本 issue 要消灭的那个形状。
+        //   DO NOTHING 只针对主键冲突，别的约束照常抛出、事务回滚。
+        //
+        //   另：普通 INSERT 会让重试抛主键冲突（无害重试变 500）；
+        //   OR REPLACE 会覆盖旧行、把用户已 ack 的状态冲掉。都不取。
+        db.run(
+          `INSERT INTO user_inbox
+             (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+           ON CONFLICT(message_id) DO NOTHING`,
+          [
+            messageId,
+            effectiveNetId ?? null,
+            target.user_id,
+            from_session,
+            // 🔴 不依赖 zod 的 .default()：直接调用 handler 的调用方（测试、
+            //    未来的内部调用）拿不到 zod 默认值，会把 NULL 写进 NOT NULL 列。
+            //    列上虽有 DEFAULT，但**显式传 NULL 会覆盖列默认值**。
+            kind ?? "agent_message",
+            title || null,
+            message,
+            severity ?? "info",
+            // 存储侧走与 inbox 一致的跨主机脱敏；读取侧另有一道 token 形状
+            // 脱敏（规格 ③ redact-at-read），两层分别防不同的东西。
+            meta && typeof meta === "object" ? normalizeMetaJson(meta) : null,
+          ],
+        );
+      });
       // #1459 — pushUserEvent 在没有订阅者时静默 return，而这个工具既不写
       // inbox、也没有任何 user 级回读路径（/api/messages 只 SELECT FROM inbox）。
       // 也就是说用户 dashboard 关着的时候这条消息就永久没了。
@@ -2395,6 +2431,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       //    变成「已入库、等重连补投」。把值取成 no_live_subscriber 而不是
       //    "lost"/"dropped"，就是为了那天不用改写历史含义 —— 届时按需细分
       //    （如 lost vs queued）即可，现在不预先把语义焊死。
+      // 🔴 push 必须在事务**提交之后**：放进事务里的话，活订阅者可能先收到
+      //    事件、而行还没提交；一旦回滚，用户就看到了一条数据库里不存在的消息。
       const delivered = hasUserSubscribers(effectiveNetId, target.user_id);
       pushUserEvent(effectiveNetId, target.user_id, event);
 
@@ -2402,6 +2440,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         ok: true,
         message_id: messageId,
         delivered,
+        // #1459 ① P2 —— 有了持久化之后，「此刻没人在听」不再等于「丢了」。
+        // `delivered` 说的是实时投递、`persisted` 说的是它已经入库等重连补投。
+        // `reason` 仍报**观测到的事实**而不是它的后果，所以这个中间态没有说错话。
+        persisted: true,
         ...(delivered ? {} : { reason: "no_live_subscriber" }),
         delivered_to_user_id: target.user_id,
         network_id: effectiveNetId,

package/src/user-inbox-read-http.test.ts

@@ -0,0 +1,220 @@
+// #1459 ① P3 —— per-user 收件回读 + ack + 未读数 + redact-at-read。
+//
+// 承重的是**隔离**：A 只能读到 A 的。所以下面每条隔离断言都额外钉住探针身份 ——
+// 首个注册用户会自动成为全局 admin，而 admin 在别处走的是不过滤的分支；
+// 若探针恰好是 admin，隔离断言会"通过但什么都没证明"（#500/#506 同款）。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-user-inbox-read-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let adminToken = "", aToken = "", bToken = "";
+const MASTER_TOKEN = "legacy-master-token-for-test";
+let aUserId = "", bUserId = "", aNet = "", bNet = "";
+let adminUserId = "";
+
+const get = async (path: string, token: string) => {
+  const r = await fetch(`${base}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+const post = async (path: string, token: string, body: unknown) => {
+  const r = await fetch(`${base}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return { status: r.status, body: await r.json() as any };
+};
+
+function seedMessage(mid: string, userId: string, netId: string, content: string, meta?: string, acked = 0) {
+  const { db } = require("./db.js");
+  db.run(
+    `INSERT INTO user_inbox (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, acked, acked_at)
+     VALUES (?1, ?2, ?3, 'node-x', 'agent_message', NULL, ?4, 'info', ?5, ?6, ?7)`,
+    [mid, netId, userId, content, meta ?? null, acked, acked ? "2026-01-01 00:00:00" : null],
+  );
+}
+
+beforeAll(async () => {
+  // 传统全局 master token：requireAuth 对 GET /api/* 放行，但 resolveRequestAuth
+  // 返回 null（没有 user）。这条路径是分支内 `if (!callerUserId)` 唯一能被触发的
+  // 场景 —— 必须在 import server.js 之前设，AUTH_TOKEN 是模块加载期读的常量。
+  process.env.COMMHUB_AUTH_TOKEN ||= MASTER_TOKEN;
+
+  const { db } = await import("./db.js");
+  const { register, addNetworkMember } = await import("./auth.js");
+  const stamp = Date.now();
+
+  // 首个注册用户 = 全局 admin。**故意先注册一个用不到的 admin**，这样下面
+  // 两个探针 A/B 都不是 admin —— 隔离断言才有分辨力。
+  const admin = register(`ui_admin_${stamp}`, "UiAdmin-Strong-1!");
+  expect(admin.ok).toBe(true);
+  adminToken = admin.token!;
+  adminUserId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `ui_admin_${stamp}`)!.user_id;
+
+  const a = register(`ui_a_${stamp}`, "UiA-Strong-1!");
+  const b = register(`ui_b_${stamp}`, "UiB-Strong-1!");
+  expect(a.ok && b.ok).toBe(true);
+  aToken = a.token!; bToken = b.token!;
+  aNet = a.network_id!; bNet = b.network_id!;
+  aUserId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `ui_a_${stamp}`)!.user_id;
+  bUserId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `ui_b_${stamp}`)!.user_id;
+
+  // 前提断言：探针不是 admin。靠"注册顺序"是隐式前提，会随夹具变化悄悄失效，
+  // 所以显式断言。
+  // 承重的是 role ≠ "admin"；这里钉死具体值（auth.ts:88 非首用户写 "user"），
+  // 因为 `not.toBe("admin")` 在 role 为 undefined（查不到行）时也会通过 —— 松判据
+  // 会朝"没问题"那边失败。
+  for (const [name, id] of [["A", aUserId], ["B", bUserId]] as const) {
+    const role = db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", id)?.role;
+    expect([name, role]).toEqual([name, "user"]);
+  }
+
+  // 🔴 B 必须在**同一个 network** 里也有一条私信。
+  //    第一版夹具让 A/B 各处一网，于是 addNetworkScope 顺手挡住了 B 的行 ——
+  //    变异掉 `WHERE user_id = ?1` 后隔离断言照样通过（M1/M2/M4 全部存活）。
+  //    同网同事之间，user_id 过滤是**唯一**的隔离手段，夹具必须落在那一格。
+  expect(addNetworkMember(aNet, bUserId, "member").ok).toBe(true);
+
+  seedMessage("dm_a1", aUserId, aNet, "A 的第一条");
+  seedMessage("dm_a2", aUserId, aNet, "A 的第二条");
+  seedMessage("dm_b_same_net", bUserId, aNet, "B 在 A 同网里的私信");
+  seedMessage("dm_b1", bUserId, bNet, "B 的私信");
+  // A 自己的、但落在 A 不是成员的 network 上的行（例如 A 被移出该网后的遗留）。
+  // 它是 addNetworkScope 这次调用的唯一 witnessed-red 对象：user_id 过滤对它无效。
+  seedMessage("dm_a_foreign_net", aUserId, bNet, "A 在外网的遗留私信");
+  // network_id 为 NULL 的行。**写路径产不出这种行** —— send_desktop_message 有
+  // 三道闸（canWrite / `if (!effectiveNetId)` / targetRole），拆掉任意一道都还有
+  // 别的挡着，见 desktop-message-seam.test.ts 的两条孤儿断言。这里是手写夹具，
+  // 用来钉「万一库里有这种行（历史数据、将来的第二个写入方），谁读得到」。
+  seedMessage("dm_a_nonet", aUserId, null as any, "A 的无网络私信");
+  seedMessage("dm_admin_nonet", adminUserId, null as any, "admin 的无网络私信");
+  seedMessage("dm_a_read", aUserId, aNet, "A 已读的一条", undefined, 1);
+  seedMessage("dm_a_secret", aUserId, aNet,
+    "凭据在正文里 ntok_abcdef123456", JSON.stringify({ k: "ghp_" + "A".repeat(24) }));
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("#1459 ① P3 GET /api/messages?scope=user", () => {
+  test("🔴 只返回调用者自己的消息 —— A 读不到 B 的", async () => {
+    const { status, body } = await get("/api/messages?scope=user", aToken);
+    expect(status).toBe(200);
+    expect(body.ok).toBe(true);
+    const ids = body.messages.map((m: any) => m.message_id);
+    expect(ids).toContain("dm_a1");
+    expect(ids).toContain("dm_a_read");          // 不加 unacked 时已读也要回来
+    expect(ids).not.toContain("dm_b_same_net");  // 承重：同网，只有 user_id 过滤挡得住
+    expect(ids).not.toContain("dm_b1");          // 跨网，scope 助手挡
+    expect(ids).not.toContain("dm_a_foreign_net"); // 承重：A 自己的行，只有 scope 助手挡得住
+    expect(body.messages.every((m: any) => m.user_id === aUserId)).toBe(true);
+  });
+
+  test("🔴 收件人取自 auth ctx —— query 里指定别人的 user_id 无效", async () => {
+    const { body } = await get(`/api/messages?scope=user&user_id=${bUserId}`, aToken);
+    const ids = body.messages.map((m: any) => m.message_id);
+    expect(ids).not.toContain("dm_b_same_net");
+    expect(ids).not.toContain("dm_b1");
+    expect(body.messages.every((m: any) => m.user_id === aUserId)).toBe(true);
+  });
+
+  test("🔴 redact-at-read：正文与 meta 里的凭据形状被遮住", async () => {
+    const { body } = await get("/api/messages?scope=user", aToken);
+    const row = body.messages.find((m: any) => m.message_id === "dm_a_secret");
+    expect(row).toBeTruthy();
+    expect(row.content).toContain("ntok_***redacted***");
+    expect(row.content).not.toContain("ntok_abcdef123456");
+    expect(row.meta_json).toContain("ghp_***redacted***");
+  });
+
+  // NULL 网络行的可见性**取决于调用者的 scope，不取决于行本身**：
+  //   受网络限制的成员 → addNetworkScope 生成 `network_id IN (...)`，NULL 不匹配 ⇒ 读不到
+  //   admin（resolveRestNetworkScope 给 networkIds=null，助手是 no-op） ⇒ 读得到
+  // 两条一起才说明"NULL 读不到"是 scope 造成的，不是 user_id 过滤造成的。
+  test("NULL 网络行：受网络限制的成员读不到", async () => {
+    const { body } = await get("/api/messages?scope=user", aToken);
+    expect(body.messages.map((m: any) => m.message_id)).not.toContain("dm_a_nonet");
+  });
+
+  test("NULL 网络行：scope 为 no-op 的调用者（admin）读得到自己的那条", async () => {
+    const { body } = await get("/api/messages?scope=user", adminToken);
+    const ids = body.messages.map((m: any) => m.message_id);
+    expect(ids).toContain("dm_admin_nonet");
+    expect(ids).not.toContain("dm_a1");   // 仍然只读自己的：admin 不绕过 user_id 过滤
+  });
+
+  test("unread 是未读数而非总数（A：4 条里 3 条未读）", async () => {
+    const { body } = await get("/api/messages?scope=user", aToken);
+    expect(body.messages.length).toBe(4);
+    expect(body.unread).toBe(3);
+    expect(body.pending_count).toBe(body.unread);
+  });
+
+  test("unacked=1 排掉已读那条", async () => {
+    const { body } = await get("/api/messages?scope=user&unacked=1", aToken);
+    const ids = body.messages.map((m: any) => m.message_id);
+    expect(ids).not.toContain("dm_a_read");      // 承重：集合里确实有已读行才有分辨力
+    expect(ids.sort()).toEqual(["dm_a1", "dm_a2", "dm_a_secret"]);
+  });
+
+  test("未鉴权 ⇒ 401（/api 全局闸）", async () => {
+    const r = await fetch(`${base}/api/messages?scope=user`);
+    expect(r.status).toBe(401);
+  });
+
+  test("🔴 legacy master token 过得了全局闸但没有 user ⇒ 401，不能回一个空列表", async () => {
+    // 这条才是分支内 `if (!callerUserId)` 的 witnessed-red：把它换成
+    // `?? ""` 后本条从 401 变成 200 + 空列表 —— "看起来正常"的错误答案。
+    const { status, body } = await get("/api/messages?scope=user", MASTER_TOKEN);
+    expect([status, body.error]).toEqual([401, "auth_required"]);
+  });
+
+  test("alias 分支未受影响（dashboard 依赖它）", async () => {
+    const { status, body } = await get("/api/messages", adminToken);
+    expect(status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(Array.isArray(body.messages)).toBe(true);
+    expect(body.unread).toBeUndefined();          // 老分支不该多出新字段
+  });
+});
+
+describe("#1459 ① P3 POST /api/messages/ack", () => {
+  test("ack 自己的消息 ⇒ acked 置位、未读数下降", async () => {
+    const before = (await get("/api/messages?scope=user", aToken)).body.unread;
+    const { status, body } = await post("/api/messages/ack", aToken, { message_id: "dm_a1" });
+    expect(status).toBe(200);
+    expect(body.acked).toBe(1);
+    const after = (await get("/api/messages?scope=user", aToken)).body.unread;
+    expect(after).toBe(before - 1);
+  });
+
+  test("🔴 ack 不了同网同事的消息 —— 改动行数为 0，且对方仍是未读", async () => {
+    const { body } = await post("/api/messages/ack", aToken, { message_id: "dm_b_same_net" });
+    expect(body.acked).toBe(0);
+    const bView = (await get("/api/messages?scope=user", bToken)).body;
+    expect(bView.messages.find((m: any) => m.message_id === "dm_b_same_net").acked).toBe(0);
+  });
+
+  test("ack 跨网的消息同样为 0", async () => {
+    const { body } = await post("/api/messages/ack", aToken, { message_id: "dm_b1" });
+    expect(body.acked).toBe(0);
+  });
+
+  test("缺参 ⇒ 400；未鉴权 ⇒ 401", async () => {
+    expect((await post("/api/messages/ack", aToken, {})).status).toBe(400);
+    const r = await fetch(`${base}/api/messages/ack`, { method: "POST", body: "{}" });
+    expect(r.status).toBe(401);
+  });
+});

package/src/user-inbox-schema.test.ts

@@ -0,0 +1,53 @@
+// #1459 ① — user_inbox 建表 + 幂等打底(P1)。零行为变化,只落 schema。
+//
+// 承重属性(SDK马 review 要点):message_id 即主键 → send_desktop_message 因 HTTP
+// 响应丢失被重试时,同一 dm_<uuid> 用 INSERT OR IGNORE 不会插出重复行(前端免去重)。
+
+import { describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+
+describe("#1459 user_inbox schema (P1)", () => {
+  test("table exists with the expected columns", () => {
+    const cols = db.all<{ name: string }>("PRAGMA table_info(user_inbox)").map(c => c.name);
+    for (const c of ["message_id", "network_id", "user_id", "from_session", "kind", "title", "content", "severity", "meta_json", "acked", "created_at", "acked_at"]) {
+      expect(cols).toContain(c);
+    }
+  });
+
+  // 注:这条钉的是「主键在我们以为的那一列」(SQLite 行为),**不是**「写入路径幂等」——
+  // 后者要 P2 驱动真实 send_desktop_message 两次来证(SDK马 review)。这里只保证主键选对。
+  test("message_id is PRIMARY KEY → INSERT OR IGNORE dedups on the same id", () => {
+    const mid = `dm_test_${Date.now()}`;
+    try {
+      const ins = () => db.run(
+        `INSERT OR IGNORE INTO user_inbox (message_id, network_id, user_id, from_session, content)
+         VALUES (?1, ?2, ?3, ?4, ?5)`,
+        [mid, "net_test_1459", "u_test_1459", "sender-a", "hello"],
+      );
+      ins();
+      ins();   // 同 message_id 第二次插入应被 IGNORE
+      const n = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE message_id = ?1", mid)?.n ?? 0;
+      expect(n).toBe(1);
+    } finally {
+      db.run("DELETE FROM user_inbox WHERE message_id = ?1", mid);
+    }
+  });
+
+  test("defaults: acked=0, kind/severity='info'", () => {
+    const mid = `dm_def_${Date.now()}`;
+    try {
+      db.run(
+        `INSERT INTO user_inbox (message_id, user_id, content) VALUES (?1, ?2, ?3)`,
+        [mid, "u_def_1459", "body"],
+      );
+      const row = db.get<{ acked: number; kind: string; severity: string }>(
+        "SELECT acked, kind, severity FROM user_inbox WHERE message_id = ?1", mid,
+      );
+      expect(row?.acked).toBe(0);
+      expect(row?.kind).toBe("info");
+      expect(row?.severity).toBe("info");
+    } finally {
+      db.run("DELETE FROM user_inbox WHERE message_id = ?1", mid);
+    }
+  });
+});