@sleep2agi/commhub-server 0.9.0-preview.43 → 0.9.0-preview.45

package/src/node-id-alias.test.ts

@@ -145,3 +145,44 @@ describe("#1281 real handler path — stop_node routes both names to the same pl
     expect(r.error).toBe("node_id_conflict");
   });
 });
+
+describe("app#196 —— 「解析不到 daemon」的两种情况必须给不同的话", () => {
+  // 🔴 生产实测(2026-08-28):218 个节点里 207 个是 `n_…`(有人直接
+  //    `anet node start` 起的),它们**根本没有 daemon**。原先这两种情况
+  //    打印同一句 `pass daemon_node_id explicitly` —— 对那 207 个来说,
+  //    **这句建议的前提是假的**,照着做只会走进死路。
+  const HAND_STARTED = "n_73687f17";      // 手工起的节点,真实形状
+  const DAEMON_CHILD = "node_test_1281";  // daemon 建的子节点
+
+  test("手工起的节点 → not_daemon_managed,并且**不**建议传 daemon_node_id", async () => {
+    const r = await call("stop_node", { node_id: HAND_STARTED });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("not_daemon_managed");
+    // 🔴 这一条是本组的核心:旧文案的那句建议**不能**再出现在这条路径上。
+    expect(r.message).not.toContain("pass daemon_node_id explicitly");
+    // 而且要告诉他真正能走的那条路。
+    expect(r.message).toContain("anet node stop");
+  });
+
+  test("daemon 建的子节点(无 create-request 行) → 仍是 daemon_not_resolvable", async () => {
+    const r = await call("stop_node", { node_id: DAEMON_CHILD });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("daemon_not_resolvable");
+    expect(r.message).toContain("pass daemon_node_id explicitly");
+  });
+
+  test("delete_node 走同一条判别(两个调用点不能只改一个)", async () => {
+    const r = await call("delete_node", { node_id: HAND_STARTED, confirm_alias: "x" });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("not_daemon_managed");
+  });
+
+  // 🔴 反向见证:两种情况必须**真的不同**。若有人把判别改成恒定一支,
+  //    上面三条里至少一条会红 —— 但那还不够明显,所以这里直接断言两者不等。
+  test("两种情况的 error 与 message 都不相同", async () => {
+    const a = await call("stop_node", { node_id: HAND_STARTED });
+    const b = await call("stop_node", { node_id: DAEMON_CHILD });
+    expect(a.error).not.toBe(b.error);
+    expect(a.message).not.toBe(b.message);
+  });
+});

package/src/observer-avatar-http.test.ts

@@ -36,6 +36,10 @@ let outsiderUserId = "";
 const TARGET_ALIAS = "obs-target-agent";
 const AVATAR_NODE_ID = "node_avatar_test_1";
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   // Kept for per-file runs launched without an external COMMHUB_DB (the
   // documented contract still is to set it externally; see db-adapter.ts).
@@ -88,7 +92,7 @@ beforeAll(async () => {
   const mod: any = await import("./server.js");
   privateServer = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
   BASE = `http://127.0.0.1:${privateServer.port}`;
-});
+}, 30_000);
 
 afterAll(() => {
   try { privateServer?.stop?.(true); } catch {}

package/src/report-status-host-schema.test.ts

@@ -74,3 +74,138 @@ describe("report_status host telemetry schema", () => {
     })).not.toThrow();
   });
 });
+
+/* #1545 —— `create_capability_observed_ms_ago` 的**验证宽度**本身就是判据。
+ *
+ * 这一格是纯诊断信息(那个 can_create_nodes 是多久以前测出来的)。zod 对象里
+ * 任何一个**已知字段**验证失败,整份 report_status 都会被拒 —— 不是丢掉这一格。
+ * 所以给它加 `.int()/.min()/.max()` 等于:一台节点发了个奇怪的诊断数字,
+ * 就在 hub 上整个失联。**#1225/#1498 已经用 host.ip 演过一遍这件事了。**
+ *
+ * 消毒在读取处(`/api/host-supervisors`),不在这里。 */
+describe("#1545 create_capability_observed_ms_ago —— schema 必须收得宽", () => {
+  const caps = () => schemas.report_status.config_snapshot;
+
+  test("前提:抓到的确实是 config_snapshot 形状,且它接受 daemon_capabilities", () => {
+    expect(caps()).toBeTruthy();
+    const parsed = caps().parse({
+      flags: {}, config_update_capable: false, peer_reply_inbox_capable: true,
+      daemon_capabilities: { can_create_nodes: true },
+    });
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+  });
+
+  test("正常值:透传", () => {
+    const parsed = caps().parse({
+      flags: {}, config_update_capable: false, peer_reply_inbox_capable: true,
+      daemon_capabilities: { can_create_nodes: true, create_capability_observed_ms_ago: 0 },
+    });
+    expect(parsed.daemon_capabilities.create_capability_observed_ms_ago).toBe(0);
+  });
+
+  test("null 必须被接受(显式「我没测过」和「我不发这一格」都要能表达)", () => {
+    const parsed = caps().parse({
+      flags: {}, config_update_capable: false, peer_reply_inbox_capable: true,
+      daemon_capabilities: { can_create_nodes: true, create_capability_observed_ms_ago: null },
+    });
+    expect(parsed.daemon_capabilities.create_capability_observed_ms_ago).toBeNull();
+  });
+
+  /* 🔴 这四个值**一个都不许让整份 report 被拒**。它们在读取侧会被当成「没报」,
+   *    但那是读取侧的事 —— 这一层的职责只有一个:别把节点踢下线。 */
+  test.each([
+    ["负数", -1],
+    ["非整数", 1234.5678],
+    ["超过一年", 400 * 24 * 60 * 60 * 1000],
+    ["NaN", Number.NaN],
+  ])("怪值不得拒掉整份 report_status:%s", (_label, value) => {
+    expect(() => caps().parse({
+      flags: {}, config_update_capable: false, peer_reply_inbox_capable: true,
+      daemon_capabilities: { can_create_nodes: false,
+        create_nodes_blocked_reason: "anet_bin_source",
+        create_capability_observed_ms_ago: value },
+    })).not.toThrow();
+  });
+
+  /* 🔴 反向锚:上面那组「不抛」如果只是因为**这个 key 压根没被 schema 看见**,
+   * 它们会一样绿。所以这里证明 schema 确实在看它:喂一个非数字,值必须**被改写成
+   * null**(而不是原样穿过去)。原样穿过去 = key 被忽略,那组测试就什么也没测。 */
+  test("反向锚:非数字被改写成 null(不是原样穿过)⇒ 证明 schema 确实在看这个 key", () => {
+    const parsed = caps().parse({
+      flags: {}, config_update_capable: false, peer_reply_inbox_capable: true,
+      daemon_capabilities: { can_create_nodes: true, create_capability_observed_ms_ago: "0" },
+    });
+    expect(parsed.daemon_capabilities.create_capability_observed_ms_ago).toBeNull();
+    expect(parsed.daemon_capabilities.create_capability_observed_ms_ago).not.toBe("0");
+  });
+});
+
+/* 🔴 #1545 —— 把 `host:` 上方那段方框注释里的表**钉住**。
+ *
+ * 那段注释说的是:这份 schema 的子对象一半 strict 一半不 strict,而「往里加一个
+ * hub 还不认识的键」的后果完全相反 —— 非 strict 静默丢弃(节点活着、字段蒸发),
+ * strict 拒掉整份 report(节点当场失联,#1225 的形状)。
+ *
+ * 注释会烂。这组测试的作用**不是禁止改 strict**(两种都各有其位),而是:谁改了,
+ * 谁就会在这里撞红,从而**被迫连注释一起改**。所以断言写成「和注释里那张表一致」,
+ * 而不是「必须是某个值」。 */
+describe("#1545 report_status 子对象的 strict 分布(注释里那张表的可执行副本)", () => {
+  const rs = () => schemas.report_status;
+  const UNKNOWN = { __hub_does_not_know_this_key__: 1 };
+
+  function acceptsUnknownKey(schema: any, base: object): "dropped" | "rejected" {
+    try {
+      const parsed = schema.parse({ ...base, ...UNKNOWN });
+      return "__hub_does_not_know_this_key__" in parsed ? "rejected" /* 不可能:留着说明它根本没被处理 */ : "dropped";
+    } catch { return "rejected"; }
+  }
+
+  const SIDE_THREAD = {
+    supported: true, runtime: "codex", runtimeVersion: "1.0",
+    topology: "native-exact-fork", evidenceRevision: "r1",
+  };
+  const SNAP_BASE = { flags: {}, config_update_capable: false, peer_reply_inbox_capable: true };
+
+  test.each([
+    ["host", () => rs().host, {}, "dropped"],
+    ["process_telemetry", () => rs().process_telemetry, {}, "dropped"],
+    ["config_snapshot", () => rs().config_snapshot, SNAP_BASE, "dropped"],
+    ["external_schedules", () => rs().external_schedules, { schedules: [] }, "rejected"],
+  ])("%s → 未知键被 %s", (_name, get, base, expected) => {
+    expect(acceptsUnknownKey(get(), base)).toBe(expected as string);
+  });
+
+  test("daemon_capabilities(嵌在 config_snapshot 里)→ 未知键被丢弃,不拒整份", () => {
+    const parsed: any = rs().config_snapshot.parse({
+      ...SNAP_BASE,
+      daemon_capabilities: { can_create_nodes: true, ...UNKNOWN },
+    });
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+    expect("__hub_does_not_know_this_key__" in parsed.daemon_capabilities).toBe(false);
+  });
+
+  test("side_thread_capability(同一个 config_snapshot 里)→ 未知键拒掉**整份**", () => {
+    expect(() => rs().config_snapshot.parse({
+      ...SNAP_BASE,
+      side_thread_capability: { ...SIDE_THREAD, ...UNKNOWN },
+    })).toThrow();
+    // 反向锚:去掉那个未知键必须过 —— 否则上面那条可能是被别的必填字段拒的,
+    // 和 strict 无关。
+    expect(() => rs().config_snapshot.parse({
+      ...SNAP_BASE, side_thread_capability: SIDE_THREAD,
+    })).not.toThrow();
+  });
+
+  /* 分母自证:上面这张表**两侧都有**。如果哪天全变成 dropped(或全 rejected),
+   * 那段注释描述的「不对称」就不存在了,而这条会先红。 */
+  test("这张表确实是不对称的(两种后果各至少一个)", () => {
+    const results = [
+      acceptsUnknownKey(rs().host, {}),
+      acceptsUnknownKey(rs().process_telemetry, {}),
+      acceptsUnknownKey(rs().config_snapshot, SNAP_BASE),
+      acceptsUnknownKey(rs().external_schedules, { schedules: [] }),
+    ];
+    expect(results.filter(r => r === "dropped").length).toBeGreaterThan(0);
+    expect(results.filter(r => r === "rejected").length).toBeGreaterThan(0);
+  });
+});

package/src/rest-explicit-columns-http.test.ts

@@ -82,6 +82,10 @@ async function api(path: string): Promise<any> {
   return response.json();
 }
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   ({ db } = await import("./db.js"));
   const { register } = await import("./auth.js");
@@ -135,7 +139,7 @@ beforeAll(async () => {
   const mod = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
   base = `http://127.0.0.1:${server.port}`;
-});
+}, 30_000);
 
 afterAll(() => {
   try { server?.stop(true); } catch {}

package/src/rules-file-transport.test.ts

@@ -0,0 +1,235 @@
+// app#225 — 节点规则文件远程读写：走真 MCP in-process transport 的端到端。
+//
+// 验的是 #225 验收里 hub 能验的那几条：
+//   1. 客户端只用 node_id 就能发起读/写；工具的 inputSchema 里**没有**任何
+//      路径/文件名字段（验收第 5 条「不能借路径参数写任意文件」在 hub 侧的形状）。
+//   2. 节点用网络 token + alias 拉到的请求里也没有路径字段；ack 后客户端轮询拿到内容。
+//   3. SEC-1：跨网络节点发不了、别的节点 ack 不了、用户 token 拉不了。
+//   4. 单飞 + 超时回收。
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/rules.db bun test src/rules-file-transport.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_rules_file";
+const OTHER_NET = "net_rules_file_other";
+const USER = "u_rules_file_owner";
+const NODE_ID = "node_rules_file_claude";
+const NODE_ALIAS = "rules-file-claude";
+const OTHER_NODE_ID = "node_rules_file_other";
+const OTHER_NODE_ALIAS = "rules-file-other";
+const NODE_TOKEN = "tok_rules_file_node";
+const OTHER_NODE_TOKEN = "tok_rules_file_other_node";
+
+function cleanup() {
+  for (const net of [NET, OTHER_NET]) {
+    try { db.run("DELETE FROM node_rules_requests WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM audit_log WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM network_members WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [net]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedWorld() {
+  db.run(
+    `INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+    [USER, USER],
+  );
+  for (const net of [NET, OTHER_NET]) {
+    db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [net, net, USER]);
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER, net]);
+  }
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [NODE_ID, NODE_ALIAS, NODE_ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [OTHER_NODE_ID, OTHER_NODE_ALIAS, OTHER_NODE_ALIAS, OTHER_NET],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [NODE_TOKEN, USER, NET, `node:${NODE_ALIAS}`, "hash_rules_file_node"],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [OTHER_NODE_TOKEN, USER, OTHER_NET, `node:${OTHER_NODE_ALIAS}`, "hash_rules_file_other"],
+  );
+}
+
+type Identity = { net: string; alias: string; isNetworkToken: boolean; tokenId: string };
+const asUser: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_rules_file_user" };
+const asNode: Identity = { net: NET, alias: NODE_ALIAS, isNetworkToken: true, tokenId: NODE_TOKEN };
+const asOtherNode: Identity = { net: OTHER_NET, alias: OTHER_NODE_ALIAS, isNetworkToken: true, tokenId: OTHER_NODE_TOKEN };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "rules-file-test", version: "1" });
+  registerTools(server, undefined, id.net, USER, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "rules-file-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}`);
+    return JSON.parse(first.text);
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { client, server, call, close };
+}
+
+beforeEach(() => { cleanup(); seedWorld(); });
+afterAll(cleanup);
+
+describe("app#225 rules file — schema has no path", () => {
+  test("read/write tool inputs are node id + content only; no path / file_name / dir field anywhere", async () => {
+    // 🔴 不走 client.listTools():main 上 report_status / send_desktop_message /
+    // update_node_config / create_node 四个存量工具的 zod 形状让 SDK 的
+    // toJSONSchema 抛 `schema._zod`,listTools 整个失败(与本 PR 无关,实验见
+    // PR 正文)。这里直接看 McpServer 登记表里的 zod shape —— 它就是 hub 校验
+    // 入参用的那份,比 JSON schema 更接近真相。
+    const u = await connect(asUser);
+    try {
+      const reg: Record<string, any> = (u.server as any)._registeredTools;
+      const shapeKeys = (name: string): string[] => {
+        expect(reg[name], name).toBeDefined();
+        const schema = reg[name].inputSchema;
+        const shape = schema?.shape ?? schema?._def?.shape?.() ?? schema ?? {};
+        return Object.keys(shape).sort();
+      };
+      expect(shapeKeys("read_node_rules_file")).toEqual(["child_node_id", "network_id", "node_id"]);
+      expect(shapeKeys("write_node_rules_file")).toEqual(["child_node_id", "content", "network_id", "node_id"]);
+      expect(shapeKeys("get_rules_file_request")).toEqual([]);
+      // ack 的 file_name 是节点**回报**它用了哪个文件,不是客户端**指定**用哪个文件。
+      expect(shapeKeys("ack_rules_file_request")).toEqual(["content", "error", "exists", "file_name", "request_id", "status"]);
+      expect(shapeKeys("get_rules_file_result")).toEqual(["network_id", "request_id"]);
+      for (const name of ["read_node_rules_file", "write_node_rules_file", "get_rules_file_request", "get_rules_file_result"]) {
+        for (const k of shapeKeys(name)) expect(k, `${name}.${k}`).not.toMatch(/path|dir|file|cwd/i);
+      }
+    } finally { await u.close(); }
+  }, 20_000);
+});
+
+describe("app#225 rules file — read round trip", () => {
+  test("user enqueues read → node pulls (no path in request) → acks content → user polls done", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      expect(enq).toMatchObject({ ok: true, op: "read" });
+      expect(enq.request_id).toMatch(/^rf_/);
+
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: true, status: "pending", op: "read" });
+
+      const pulled = await n.call("get_rules_file_request", {});
+      expect(pulled.ok).toBe(true);
+      expect(Object.keys(pulled.request).sort()).toEqual(["op", "request_id"]);
+      expect(pulled.request).toEqual({ request_id: enq.request_id, op: "read" });
+      // 第二次拉:已经 in_progress,不再重复下发
+      expect(await n.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+
+      expect(await n.call("ack_rules_file_request", {
+        request_id: enq.request_id, status: "done", file_name: "CLAUDE.md", exists: true, content: "# 规则\n",
+      })).toMatchObject({ ok: true, status: "done" });
+
+      const res = await u.call("get_rules_file_result", { request_id: enq.request_id });
+      expect(res).toMatchObject({ ok: true, status: "done", op: "read", file_name: "CLAUDE.md", exists: true, content: "# 规则\n", error: null });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+
+  test("write: content travels to the node verbatim; result carries no content back", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const body = "# new rules\n\n- 不碰生产 DB\n";
+      const enq = await u.call("write_node_rules_file", { node_id: NODE_ID, content: body });
+      expect(enq).toMatchObject({ ok: true, op: "write" });
+      const pulled = await n.call("get_rules_file_request", {});
+      expect(pulled.request).toEqual({ request_id: enq.request_id, op: "write", content: body });
+      await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "CLAUDE.md", exists: true });
+      const res = await u.call("get_rules_file_result", { request_id: enq.request_id });
+      expect(res).toMatchObject({ ok: true, status: "done", op: "write", file_name: "CLAUDE.md" });
+      expect(res.content).toBeUndefined();
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+
+  test("node failure is surfaced with its reason", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const enq = await u.call("write_node_rules_file", { node_id: NODE_ID, content: "x" });
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "failed", file_name: "CLAUDE.md", error: "EACCES: permission denied" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: true, status: "failed", error: "EACCES: permission denied" });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});
+
+describe("app#225 rules file — SEC-1 and lifecycle", () => {
+  test("cross-network node cannot be targeted", async () => {
+    const u = await connect(asUser);
+    try {
+      expect(await u.call("read_node_rules_file", { node_id: OTHER_NODE_ID })).toMatchObject({ ok: false, error: "cross_network_node" });
+      expect(db.get<{ c: number }>("SELECT COUNT(*) AS c FROM node_rules_requests WHERE node_id = ?1", OTHER_NODE_ID)?.c).toBe(0);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("a node in another network can neither pull nor ack this node's request", async () => {
+    const u = await connect(asUser);
+    const o = await connect(asOtherNode);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      expect(await o.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+      expect(await o.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "stolen" })).toMatchObject({ ok: true, ignored: "unknown_or_foreign_request" });
+      expect(db.get<{ status: string }>("SELECT status FROM node_rules_requests WHERE request_id = ?1", enq.request_id)?.status).toBe("pending");
+    } finally { await u.close(); await o.close(); }
+  }, 20_000);
+
+  test("user token (not a network token) cannot use the node-side pull/ack", async () => {
+    const u = await connect(asUser);
+    try {
+      expect(await u.call("get_rules_file_request", {})).toMatchObject({ ok: false, error: "network_token_required" });
+      expect(await u.call("ack_rules_file_request", { request_id: "rf_nope", status: "done" })).toMatchObject({ ok: false, error: "network_token_required" });
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("single flight: a second request while one is pending is refused; a stale one is superseded", async () => {
+    const u = await connect(asUser);
+    try {
+      const first = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      expect(await u.call("read_node_rules_file", { node_id: NODE_ID })).toMatchObject({ ok: false, error: "request_in_flight", existing_request_id: first.request_id });
+      db.run("UPDATE node_rules_requests SET created_at = ?1 WHERE request_id = ?2", [Date.now() - 120_000, first.request_id]);
+      const second = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      expect(second.ok).toBe(true);
+      expect(db.get<{ status: string }>("SELECT status FROM node_rules_requests WHERE request_id = ?1", first.request_id)?.status).toBe("timeout");
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("polling a request the node never answered flips it to timeout with a readable reason", async () => {
+    const u = await connect(asUser);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      db.run("UPDATE node_rules_requests SET created_at = ?1 WHERE request_id = ?2", [Date.now() - 120_000, enq.request_id]);
+      const res = await u.call("get_rules_file_result", { request_id: enq.request_id });
+      expect(res).toMatchObject({ ok: true, status: "timeout" });
+      expect(res.error).toMatch(/did not answer/);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("oversized content is refused before anything is queued", async () => {
+    const u = await connect(asUser);
+    try {
+      const r: any = await u.client.callTool({ name: "write_node_rules_file", arguments: { node_id: NODE_ID, content: "x".repeat(256 * 1024 + 1) } });
+      expect(r.isError).toBe(true);
+      expect(db.get<{ c: number }>("SELECT COUNT(*) AS c FROM node_rules_requests WHERE node_id = ?1", NODE_ID)?.c).toBe(0);
+    } finally { await u.close(); }
+  }, 20_000);
+});

package/src/scheduled-tasks-http.test.ts

@@ -26,6 +26,10 @@ async function api(token: string, path: string, init?: RequestInit) {
   return { status: res.status, body: await res.json() as any };
 }
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   const owner = register(`scheduler_owner_${Date.now()}`, "SchedulerOwner123!", undefined, "seed");
   expect(owner.ok).toBe(true);
@@ -53,7 +57,7 @@ beforeAll(async () => {
   const mod: any = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
   base = `http://127.0.0.1:${server.port}`;
-});
+}, 30_000);
 
 afterAll(() => {
   try { server?.stop?.(true); } catch {}

package/src/server.ts

@@ -56,6 +56,7 @@ import { recordDeliveredStaleEvents } from "./task-lifecycle-watcher.js";
 import { SIDE_THREAD_FEATURE_FLAG, SideThreadCoordinator, SideThreadPortRegistry, SideThreadStore, type SideThreadActor, type SideThreadAttachmentRef, type SideThreadExecutionPort } from "./side-thread.js";
 import { handleSideThreadHttpRequest } from "./side-thread-http.js";
 import { createProductionSideThreadTransport } from "./side-thread-production.js";
+import { parseHubTimestamp } from "./hub-timestamp";
 
 const PORT = resolvePort(process.env.PORT);
 const HOST = process.env.HOST || "127.0.0.1";
@@ -1002,9 +1003,13 @@ return Bun.serve({
       if (!license) return withCors(req, Response.json({ ok: true, status: "no_license" }));
       const now = new Date().toISOString().replace("T", " ").slice(0, 19);
       const expired = license.expires_at && license.expires_at < now;
-      const daysLeft = license.expires_at
-        ? Math.max(0, Math.ceil((new Date(license.expires_at).getTime() - Date.now()) / 86400000))
-        : null;
+      // #1650 — licenses.expires_at 是 TEXT(datetime('now') 家族),UTC 但不带时区
+      //   标记;`new Date()` 会按本机时区解析,边界上差一天。parse 失败时返回 null
+      //   而不是 NaN —— JSON.stringify(NaN) 本来也序列化成 null,线上字节不变。
+      const expiresMs = parseHubTimestamp(license.expires_at);
+      const daysLeft = expiresMs === null
+        ? null
+        : Math.max(0, Math.ceil((expiresMs - Date.now()) / 86400000));
       return withCors(req, Response.json({
         ok: true,
         license: { type: license.type, expires_at: license.expires_at, days_left: daysLeft, expired },
@@ -3152,6 +3157,12 @@ return Bun.serve({
           // upgraded past preview.55.
           let snapCanCreate: boolean | undefined;
           let snapBlockedReason: string | undefined;
+          // #1545 —— 见 report_status schema 里 create_capability_observed_ms_ago 的注释:
+          // 上报侧**故意收得宽**(无 int/min/max,免得一个诊断字段能让整份 report 被拒),
+          // 消毒放在这里。非有限数、负数、超过 1 年的一律当作「没报」——
+          // 🔴 不是 clamp 成边界值:clamp 会把一个坏值变成一个**看起来正常的年龄**,
+          //    而这一格存在的全部意义就是让人分辨新鲜和陈旧。
+          let snapObservedMsAgo: number | undefined;
           if (r.config_snapshot) {
             try {
               const parsed = typeof r.config_snapshot === "string" ? JSON.parse(r.config_snapshot) : r.config_snapshot;
@@ -3164,12 +3175,18 @@ return Bun.serve({
                   && caps.create_nodes_blocked_reason.length > 0) {
                 snapBlockedReason = caps.create_nodes_blocked_reason;
               }
+              const rawAge = caps?.create_capability_observed_ms_ago;
+              if (typeof rawAge === "number" && Number.isFinite(rawAge)
+                  && rawAge >= 0 && rawAge <= 365 * 24 * 60 * 60 * 1000) {
+                snapObservedMsAgo = rawAge;
+              }
             } catch { /* malformed */ }
           }
-          return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason };
+          return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason,
+            observedMsAgo: snapObservedMsAgo };
         })
         .filter(({ role }) => role === "host_supervisor")
-        .map(({ row: r, canCreate, blockedReason }) => {
+        .map(({ row: r, canCreate, blockedReason, observedMsAgo }) => {
           let online = false;
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
@@ -3221,6 +3238,18 @@ return Bun.serve({
             if (canCreate === false && blockedReason) {
               out.create_nodes_blocked_reason = blockedReason;
             }
+            // #1545 —— 只在 daemon 真的报了这一格时才出现。
+            // 🔴 缺席**不能**当成 0:那等于替一个从不重算的旧 daemon 宣称
+            //    「这是刚测的」,正好朝「没问题」方向说谎。缺席就让它缺席,
+            //    读的人据此说「年龄未知」(与 can_create_nodes 本身
+            //    undefined-vs-false 的处理同一条规矩,见上面 #1353 Fix ②)。
+            //
+            // 语义:该能力值是在**这份 report 发出前 N 毫秒**测得的。
+            // 绝对年龄 = (now - last_seen_at) + create_capability_observed_ms_ago。
+            // 用节点自己的钟只量了「多久以前」,绝对时间全部由 hub 的钟出。
+            if (typeof observedMsAgo === "number") {
+              out.create_capability_observed_ms_ago = observedMsAgo;
+            }
           }
           return out;
         });

package/src/side-thread-http-integration.test.ts

@@ -56,6 +56,10 @@ function headers(token = ownerToken) {
   };
 }
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   process.env.NODE_ENV = "test";
   process.env.COMMHUB_DB = dbPath;
@@ -100,7 +104,7 @@ beforeAll(async () => {
   detachPort = serverModule.installSideThreadExecutionPort(new HttpFakePort());
   hub = serverModule.bootServer({ port: 0, hostname: "127.0.0.1" });
   base = `http://127.0.0.1:${hub.port}`;
-});
+}, 30_000);
 
 afterAll(() => {
   detachPort();

package/src/skillhub-http.test.ts

@@ -28,6 +28,10 @@ async function tool(token: string, name: string, args: Record<string, unknown>)
   return JSON.parse(payload.result.content[0].text);
 }
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   process.env.COMMHUB_DB ||= join(dir, "hub.db");
   const owner = register(`skill_owner_${Date.now()}`, "SkillHubOwner123!", undefined, "seed");
@@ -41,7 +45,7 @@ beforeAll(async () => {
   const mod: any = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
   base = `http://127.0.0.1:${server.port}`;
-});
+}, 30_000);
 
 afterAll(() => { try { server?.stop?.(true); } catch {} try { rmSync(dir, { recursive: true, force: true }); } catch {} });
 

package/src/task-auth-origin-http.test.ts

@@ -15,6 +15,10 @@ const TARGET = `auth-origin-http-target-${process.pid}`;
 const TARGET_NODE_ID = `node_auth_origin_target_${process.pid}`;
 const TARGET_RESUME_ID = `resume_auth_origin_target_${process.pid}`;
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
   const username = `auth_origin_${Date.now()}`;
@@ -39,7 +43,7 @@ beforeAll(async () => {
   const mod: any = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
   base = `http://127.0.0.1:${server.port}`;
-});
+}, 30_000);
 
 afterAll(() => {
   try { server?.stop?.(true); } catch {}

package/src/task-consumption.test.ts

@@ -166,7 +166,7 @@ describe("task consumed_at identity and lifecycle", () => {
       after_terminal_seq: after, limit: 100,
     });
     expect(late.tasks.map((task: any) => task.task_id)).toEqual(["old-open-task"]);
-  }, 20_000);
+  }, 60_000);  // #1627 —— 原 20_000。历史基线 4196ms;2026-08-31 实测 21018ms(5.0×),撞上限。
   test("enqueue and process-level ack keep consumed_at null", async () => {
     const content = "connected process has not started a model turn";
     const before = db.get<{ last_seen_at: string; task: string | null }>(

package/src/task-diagnostic-http.test.ts

@@ -49,6 +49,10 @@ async function openSse(token: string, networkId: string): Promise<ReadableStream
   return reader;
 }
 
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
 beforeAll(async () => {
   ({ db } = await import("./db.js"));
   const { register } = await import("./auth.js");
@@ -79,7 +83,7 @@ beforeAll(async () => {
   const mod = await import("./server.js");
   server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
   base = `http://127.0.0.1:${server.port}`;
-});
+}, 30_000);
 
 afterAll(() => {
   try { server?.stop(true); } catch {}