@sleep2agi/commhub-server 0.9.0-preview.45 → 0.9.0-preview.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.45",
+  "version": "0.9.0-preview.47",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/blocked-exit-on-reply.test.ts

@@ -0,0 +1,122 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+// #1548 —— 一个活着、能收发任务的节点可以在名册里永远显示 `blocked`:
+// 只有 report_completion 会把 sessions.status 拉回 idle,而现在大多数 agent 用
+// send_reply(终态)结束任务、用 send_task 派活 —— 这两条路径此前都不碰 sessions.status。
+// 「它刚回了我一条终态消息 / 刚派了一条任务」本身就是最强的活性证据。
+// 只出 `blocked`;`working` 可能真在忙别的任务,不碰(保守)。
+const NET_ID = "net_1548_blocked";
+const USER_ID = "u_1548";
+const NODE_ID = "node_1548_agent";
+const AGENT_ALIAS = "agent-1548";
+const DISPATCHER_NODE_ID = "node_1548_dispatcher";
+const DISPATCHER_ALIAS = "dispatcher-1548";
+const AGENT_TOK_ID = "tok_1548";
+
+type ToolHandler = (args: any, extra?: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup() {
+  for (const [sql, params] of [
+    ["DELETE FROM tasks WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM inbox WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM task_events WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM sessions WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM nodes WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM api_tokens WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM network_members WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM networks WHERE network_id = ?1", [NET_ID]],
+    ["DELETE FROM users WHERE user_id = ?1", [USER_ID]],
+  ] as const) {
+    try { db.run(sql, params as any); } catch {}
+  }
+}
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed(agentStatus: string) {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER_ID, USER_ID]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET_ID, NET_ID, USER_ID]);
+  db.run(
+    `INSERT INTO network_members (user_id, network_id, role, joined_at)
+     VALUES (?1, ?2, 'owner', datetime('now'))`,
+    [USER_ID, NET_ID],
+  );
+  for (const [nodeId, alias] of [[DISPATCHER_NODE_ID, DISPATCHER_ALIAS], [NODE_ID, AGENT_ALIAS]] as const) {
+    db.run(
+      `INSERT INTO nodes (node_id, node_name, alias, network_id, hostname, created_at, updated_at, lifecycle_state)
+       VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'), 'active')`,
+      [nodeId, alias, alias, NET_ID, `host-${alias}`],
+    );
+  }
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [`res_${DISPATCHER_ALIAS}`, DISPATCHER_ALIAS, DISPATCHER_NODE_ID, NET_ID],
+  );
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'))`,
+    [`res_${AGENT_ALIAS}`, AGENT_ALIAS, agentStatus, NODE_ID, NET_ID],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [AGENT_TOK_ID, USER_ID, NET_ID, `node:${AGENT_ALIAS}`, `hash_${AGENT_TOK_ID}`],
+  );
+}
+function makeTask(): string {
+  const id = "t_" + Math.random().toString(36).slice(2, 14);
+  db.run(
+    `INSERT INTO tasks (task_id, from_name, to_name, to_node_id, priority, status, content, requires_response, created_at, network_id)
+     VALUES (?1, ?2, ?3, ?4, 'normal', 'delivered', 'test', 'reply', datetime('now'), ?5)`,
+    [id, DISPATCHER_ALIAS, AGENT_ALIAS, NODE_ID, NET_ID],
+  );
+  return id;
+}
+function buildHandlers(): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, _schema: any, handler: ToolHandler) => { tools[name] = handler; return origTool(name, _desc, _schema, handler); };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, _cfg: any, handler: ToolHandler) => { tools[name] = handler; return origRegisterTool(name, _cfg, handler); };
+  }
+  registerTools(server, undefined, NET_ID, USER_ID, AGENT_ALIAS, true, AGENT_TOK_ID);
+  return tools;
+}
+async function call(handler: ToolHandler, args: any): Promise<any> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0]!.text);
+}
+function agentStatus(): string {
+  return (db.get("SELECT status FROM sessions WHERE alias = ?1 AND network_id = ?2", [AGENT_ALIAS, NET_ID]) as { status: string }).status;
+}
+
+describe("#1548 blocked has an exit: a terminal reply or an outbound task proves the agent is alive", () => {
+  test("terminal send_reply from a blocked agent puts it back to idle", async () => {
+    seed("blocked");
+    const tools = buildHandlers();
+    const taskId = makeTask();
+    const r = await call(tools.send_reply!, { text: "done", in_reply_to: taskId, status: "replied", from_session: AGENT_ALIAS, network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    expect(agentStatus()).toBe("idle");
+  });
+  test("send_task from a blocked agent puts it back to idle", async () => {
+    seed("blocked");
+    const tools = buildHandlers();
+    const r = await call(tools.send_task!, { alias: DISPATCHER_ALIAS, task: "ping", priority: "normal", from_session: AGENT_ALIAS, network_id: NET_ID });
+    expect(r.ok, JSON.stringify(r)).toBe(true);
+    expect(agentStatus()).toBe("idle");
+  });
+  test("a working agent is left alone (it may be busy with another task)", async () => {
+    seed("working");
+    const tools = buildHandlers();
+    const taskId = makeTask();
+    await call(tools.send_reply!, { text: "done", in_reply_to: taskId, status: "replied", from_session: AGENT_ALIAS, network_id: NET_ID });
+    expect(agentStatus()).toBe("working");
+  });
+});

package/src/tools-list-json-schema.test.ts

@@ -0,0 +1,66 @@
+// #1756 — 标准 MCP 客户端的 tools/list 必须能成功。
+//
+// 2026-09-02 量到:main 上 client.listTools() 直接抛
+//   McpError -32603: undefined is not an object (evaluating 'schema._zod')
+// 逐字段二分,肇事者是四处 `z.record(z.unknown())`(report_status.config_snapshot /
+// send_desktop_message.meta / update_node_config.patch.flags / create_node.node_spec.*):
+// zod v4 的 z.record 要两个参数(key, value),单参数时 value schema 是 undefined,
+// SDK 生成 JSON Schema 时对它取 `_zod` 就炸。修法:z.record(z.string(), z.unknown())。
+//
+// 这条测试守两件事:① listTools 整体成功且条数 == 登记表条数;② 每个工具单独都能
+// toJSONSchema —— 第 ② 条让下一次谁再写单参 record 时,红的是「哪个工具哪个字段」。
+// 跑法:cd server && COMMHUB_DB=/tmp/lt.db bun test src/tools-list-json-schema.test.ts
+import { describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod/v4";
+import { registerTools } from "./tools.js";
+
+async function connect() {
+  const server = new McpServer({ name: "list-tools-test", version: "1" });
+  registerTools(server, undefined, "net_list_tools", "u_list_tools", "u_list_tools", false, "tok_list_tools");
+  const client = new Client({ name: "list-tools-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  return { server, client, close: async () => { await client.close(); await server.close(); } };
+}
+
+describe("#1756 tools/list", () => {
+  test("every registered tool converts to JSON Schema on its own (names the offender)", async () => {
+    const { server, close } = await connect();
+    try {
+      const reg: Record<string, any> = (server as any)._registeredTools;
+      const names = Object.keys(reg);
+      expect(names.length).toBeGreaterThan(40);
+      const bad: string[] = [];
+      for (const n of names) {
+        const schema = reg[n]?.inputSchema;
+        const shape = schema?.shape ?? schema ?? {};
+        for (const [k, v] of Object.entries(shape)) {
+          try { z.toJSONSchema(z.object({ [k]: v as any })); } catch (e: any) { bad.push(`${n}.${k}: ${String(e?.message).slice(0, 60)}`); }
+        }
+      }
+      expect(bad).toEqual([]);
+    } finally { await close(); }
+  }, 20_000);
+
+  test("client.listTools() succeeds and returns every registered tool", async () => {
+    const { server, client, close } = await connect();
+    try {
+      const reg: Record<string, any> = (server as any)._registeredTools;
+      const listed = (await client.listTools()).tools;
+      expect(listed.length).toBe(Object.keys(reg).length);
+      const byName = new Set(listed.map(t => t.name));
+      for (const n of ["report_status", "send_desktop_message", "update_node_config", "create_node", "read_node_rules_file"]) {
+        expect(byName.has(n), n).toBe(true);
+      }
+      // 修过的四个字段在 JSON Schema 里必须是 object(不是 undefined / 空)
+      const schemaOf = (n: string) => listed.find(t => t.name === n)!.inputSchema as any;
+      expect(schemaOf("report_status").properties.config_snapshot).toBeDefined();
+      expect(schemaOf("send_desktop_message").properties.meta.type).toBe("object");
+      expect(schemaOf("update_node_config").properties.patch.properties.flags.type).toBe("object");
+    } finally { await close(); }
+  }, 20_000);
+});

package/src/tools.ts

@@ -362,6 +362,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     return sql;
   };
 
+  /** #1548 —— 把一个还标着 blocked 的会话拉回 idle。只在「它刚发出终态回复 / 刚派了任务」这两个活性证据处调用。 */
+  const releaseBlockedSession = (alias: string | null | undefined, networkId: string | null | undefined): void => {
+    if (!alias) return;
+    const params: any[] = [alias];
+    let sql = "UPDATE sessions SET status = 'idle', updated_at = datetime('now') WHERE alias = ?1 AND status = 'blocked'";
+    sql = addScope(sql, params, networkId ?? null);
+    try {
+      db.run(sql, params);
+    } catch {
+      // 展示层的一次修正失败不能影响主路径。
+    }
+  };
+
   type ReadScope = { networkId?: string | null; networkIds?: string[] | null; denied?: string };
 
   // Delegates to the shared membership query (network-scope.ts) — was a
@@ -598,7 +611,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // can grey out remote-restart for them.
       config_snapshot: z.object({
         model: z.string().max(200).optional().nullable(),
-        flags: z.record(z.unknown()).optional(),
+        flags: z.record(z.string(), z.unknown()).optional(),
         config_revision: z.number().int().min(0).optional(),
         config_update_capable: z.boolean().optional(),
         peer_reply_inbox_capable: z.literal(true).optional(),
@@ -1598,6 +1611,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
         touchSql = addScope(touchSql, touchParams, effectiveNetId);
         db.run(touchSql, touchParams);
+        // #1548 —— 能派活的发送方不可能真的 blocked;此处出 blocked → idle。
+        releaseBlockedSession(from_session, effectiveNetId);
       });
       logTaskEvent(id, null, "delivered", from_session, parentTaskId ? `→ ${targetAlias} (parent=${parentTaskId.slice(0,8)})` : `→ ${targetAlias}`);
       // Only stamp the dedup index after the inbox/tasks transaction
@@ -1938,6 +1953,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             throw new Error(`reply_atomic_cas_failed:${in_reply_to}`);
           }
           syncScheduledRunForTask(in_reply_to, effectiveNetId);
+          // #1548 —— 终态回复是最强的活性证据:一个还标着 blocked 的发送方在此回到 idle。
+          //   只出 blocked;working 可能真在忙别的任务,不碰。
+          releaseBlockedSession(from_session, effectiveNetId);
           return { ok: true as const, replyLogged: true };
         }
         return { ok: true as const, replyLogged: false };
@@ -2377,7 +2395,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       message: z.string().min(1).max(10000),
       severity: z.enum(["info", "success", "warning", "error"]).optional().default("info"),
       kind: z.string().min(1).max(80).optional().default("agent_message"),
-      meta: z.record(z.unknown()).optional(),
+      meta: z.record(z.string(), z.unknown()).optional(),
       from_session: z.string().max(200).optional(),
       network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens; ntok stays bound to its network)."),
     },
@@ -2674,7 +2692,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       base_revision: z.number().int().min(0).describe("Current revision per the dashboard's last GET — 409 if hub's current revision differs."),
       patch: z.object({
         model: z.string().max(200).optional(),
-        flags: z.record(z.unknown()).optional(),
+        flags: z.record(z.string(), z.unknown()).optional(),
         // #260 P5 — channel enable/disable. Restart-tier field (agent-node
         // reads config.channels once at boot to fork per-channel workers,
         // so the swap takes effect via process restart). Not
@@ -2682,7 +2700,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         // (network scope) only.
         //
         // Deliberately `z.array(z.unknown()).max(16)` (mirrors flags's
-        // `z.record(z.unknown())`): trust nothing at the wire boundary,
+        // `z.record(z.string(), z.unknown())`): trust nothing at the wire boundary,
         // narrow the same way `narrowChannelsPatch` narrows raw untrusted
         // JSON (typeof + allowlist + dedup + case-fold). A strict
         // `z.array(z.string())` would fail-fast on a single non-string
@@ -3477,7 +3495,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         name: z.string().min(1).max(64),
         runtime: z.string().min(1).max(64),
         model: z.string().min(1).max(100).optional().nullable(),
-        flags: z.record(z.unknown()).optional(),
+        flags: z.record(z.string(), z.unknown()).optional(),
         env_refs: z.array(z.string().max(64)).optional(),
         channels: z.array(z.unknown()).optional(),
       }),