@sleep2agi/commhub-server 0.9.0-preview.50 → 0.9.0-preview.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.50",
+  "version": "0.9.0-preview.52",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/node-create-request-status-http.test.ts

@@ -0,0 +1,92 @@
+// 桌面向导要看得到 daemon 回的失败原因:GET /api/node-create-requests?request_id=…
+// 承重:① 只在调用者的网络作用域里能读到(别的网络 → 404,与不存在同形);② 无用户上下文 401;③ 缺参 400;
+// ④ 回的是 daemon ack 写进去的 status/error 原文。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-create-request-status-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let aToken = "", bToken = "", aNet = "", bNet = "";
+const MASTER_TOKEN = "legacy-master-token-for-test";
+
+const get = async (path: string, token: string) => {
+  const r = await fetch(`${base}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+
+beforeAll(async () => {
+  process.env.COMMHUB_AUTH_TOKEN ||= MASTER_TOKEN;
+  const { db } = await import("./db.js");
+  const { register } = await import("./auth.js");
+  const stamp = Date.now();
+  const admin = register(`cr_admin_${stamp}`, "CrAdmin-Strong-1!");
+  expect(admin.ok).toBe(true);
+  const a = register(`cr_a_${stamp}`, "CrA-Strong-1!");
+  const b = register(`cr_b_${stamp}`, "CrB-Strong-1!");
+  expect(a.ok && b.ok).toBe(true);
+  aToken = a.token!; bToken = b.token!; aNet = a.network_id!; bNet = b.network_id!;
+  const uid = (name: string) => db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", name)!.user_id;
+  for (const id of [uid(`cr_a_${stamp}`), uid(`cr_b_${stamp}`)]) {
+    expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", id)?.role).toBe("user");
+  }
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token, acked_at, error)
+     VALUES ('cr_a_failed', 'node_daemon_a', 'vansin-go', ?1, 'opencode-cli', NULL, '{}', '[]', 'failed', NULL, ?2, 'tok', ?2,
+             'opencode-cli package entrypoint verification currently requires Linux')`,
+    [aNet, Date.now()],
+  );
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token)
+     VALUES ('cr_b_pending', 'node_daemon_b', 'other', ?1, 'codex-app-server', NULL, '{}', '[]', 'pending', NULL, ?2, 'tok')`,
+    [bNet, Date.now()],
+  );
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/node-create-requests?request_id=", () => {
+  test("A reads her own failed request with the daemon's error verbatim", async () => {
+    const { status, body } = await get("/api/node-create-requests?request_id=cr_a_failed", aToken);
+    expect(status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.request).toMatchObject({
+      request_id: "cr_a_failed", child_name: "vansin-go", runtime: "opencode-cli", status: "failed",
+      error: "opencode-cli package entrypoint verification currently requires Linux",
+    });
+  });
+  test("🔴 B cannot read A's request — 404, same shape as nonexistent", async () => {
+    const other = await get("/api/node-create-requests?request_id=cr_a_failed", bToken);
+    const missing = await get("/api/node-create-requests?request_id=cr_nope", bToken);
+    expect(other.status).toBe(404);
+    expect(missing.status).toBe(404);
+    expect(other.body).toEqual(missing.body);
+  });
+  test("pending request reads as pending with no error", async () => {
+    const { body } = await get("/api/node-create-requests?request_id=cr_b_pending", bToken);
+    expect(body.request.status).toBe("pending");
+    expect(body.request.error).toBeNull();
+  });
+  test("missing request_id → 400", async () => {
+    const { status, body } = await get("/api/node-create-requests", aToken);
+    expect(status).toBe(400);
+    expect(body.error).toBe("request_id_required");
+  });
+  test("legacy master token (no user context) → 401", async () => {
+    const { status, body } = await get("/api/node-create-requests?request_id=cr_a_failed", MASTER_TOKEN);
+    expect(status).toBe(401);
+    expect(body.error).toBe("auth_required");
+  });
+});

package/src/server.ts

@@ -2637,6 +2637,15 @@ return Bun.serve({
       }
     }
 
+    // #1828 —— 用户名与某个节点 alias 撞名时,inbox 里 session_name=用户名 的行属于那个节点,
+    //    不能当成用户的未读、也不能替它 ack。只看当前 REST scope 内的节点。
+    const userInboxAliasCollides = (username: string, scope: RestNetworkScope): boolean => {
+      const p: any[] = [username];
+      let q = "SELECT 1 AS hit FROM nodes WHERE alias = ?1";
+      q = addNetworkScope(q, p, scope);
+      return !!db.get<{ hit: number }>(q + " LIMIT 1", ...p);
+    };
+
     // ── REST: per-user desktop inbox (#1459 ① P3) ──
     // 🔴 只在 ?scope=user 时走这条；下面按 alias 寻址的既有分支一行未动
     //    （dashboard 依赖那条 inbox 查询）。
@@ -2667,6 +2676,27 @@ return Bun.serve({
       countSql = addNetworkScope(countSql, countParams, restScope);
       const unread = db.get<{ cnt: number }>(countSql, ...countParams)?.cnt ?? 0;
 
+      // #1828 —— 按 agent 分的未读:user_inbox(agent 主动发给用户)+ inbox 里发给**这个用户名**的
+      //    reply/task/message 行(agent 对用户任务的回复;acked 从来没人置 1,见 app#260)。
+      //    `unread`/`pending_count` 口径不动(只算 user_inbox,qa-hub-14 钉着);两表之和另给 `unread_total`。
+      //    🔴 用户名恰好也是某个节点 alias 时,inbox 里那些行是节点的待办,不是用户的 —— 跳过 inbox 半边。
+      const byAgent: Record<string, number> = {};
+      const addByAgent = (agentRows: Array<{ agent: string | null; n: number }>) => {
+        for (const r of agentRows) byAgent[r.agent || "hub"] = (byAgent[r.agent || "hub"] ?? 0) + Number(r.n ?? 0);
+      };
+      const uiAgentParams: any[] = [callerUserId];
+      let uiAgentSql = "SELECT from_session AS agent, COUNT(*) AS n FROM user_inbox WHERE user_id = ?1 AND acked = 0";
+      uiAgentSql = addNetworkScope(uiAgentSql, uiAgentParams, restScope);
+      addByAgent(db.all<{ agent: string | null; n: number }>(uiAgentSql + " GROUP BY from_session", ...uiAgentParams));
+      const callerUsername = restAuth?.username ?? "";
+      if (callerUsername && !userInboxAliasCollides(callerUsername, restScope)) {
+        const ibParams: any[] = [callerUsername];
+        let ibSql = "SELECT from_session AS agent, COUNT(*) AS n FROM inbox WHERE session_name = ?1 AND acked = 0 AND type IN ('reply', 'task', 'message')";
+        ibSql = addNetworkScope(ibSql, ibParams, restScope);
+        addByAgent(db.all<{ agent: string | null; n: number }>(ibSql + " GROUP BY from_session", ...ibParams));
+      }
+      const unreadTotal = Object.values(byAgent).reduce((a, b) => a + b, 0);
+
       // 🔴 redact-at-read：写入方是 agent，不受信任。存储侧已做跨主机路径脱敏，
       //    这一层单独防"有人把凭据塞进正文/标题/meta"。
       const messages = rows.map(redactMessageRow);
@@ -2678,6 +2708,8 @@ return Bun.serve({
         // 同一个数的两个名字：`unread` 给角标读，`pending_count` 与 alias 分支
         // 的字段名保持一致。**一处计算**，不是两处实现。
         pending_count: unread,
+        unread_by_agent: byAgent,
+        unread_total: unreadTotal,
       }));
     }
 
@@ -2733,7 +2765,19 @@ return Bun.serve({
                  WHERE user_id = ?1 AND message_id IN (${placeholders}) AND acked = 0`;
       sql = addNetworkScope(sql, params, restScope);
       const res = db.run(sql, params);
-      return withCors(req, Response.json({ ok: true, acked: res.changes ?? 0 }));
+      // #1828 —— 同一批 id 也可能是 inbox 里发给这个用户名的 reply/task/message 行(agent 回复);
+      //    用户看过就 ack 掉。只动 session_name = 调用者用户名 的行,别人的 id 匹配不到;
+      //    用户名与节点 alias 撞名时跳过(那是节点的待办)。
+      let inboxAcked = 0;
+      const callerUsername = restAuth?.username ?? "";
+      if (callerUsername && !userInboxAliasCollides(callerUsername, restScope)) {
+        const ibParams: any[] = [callerUsername, ...ids];
+        let ibSql = `UPDATE inbox SET acked = 1
+                     WHERE session_name = ?1 AND id IN (${placeholders}) AND acked = 0 AND type IN ('reply', 'task', 'message')`;
+        ibSql = addNetworkScope(ibSql, ibParams, restScope);
+        inboxAcked = db.run(ibSql, ibParams).changes ?? 0;
+      }
+      return withCors(req, Response.json({ ok: true, acked: (res.changes ?? 0) + inboxAcked, acked_user_inbox: res.changes ?? 0, acked_inbox: inboxAcked }));
     }
 
     // ── REST: stats summary ──
@@ -3076,6 +3120,31 @@ return Bun.serve({
     // Mirror of the `list_host_supervisors` MCP tool for non-MCP callers.
     // Same SQL + role-extract + member-脱敏 logic; SEC-1 scoped via REST
     // auth pipeline (restScope). Returns {ok, daemons:[...], count}.
+    // ── REST: one node_create_request's outcome (app#… 桌面向导) ──
+    // 向导 POST create_node 后只会轮询「子节点注册了没」,daemon 回的失败原因(ack_create_request 写进
+    // node_create_requests.status/error)此前没有任何读接口 —— 用户只看到「24s 没注册」。
+    // 这里按 request_id 读一行;网络作用域与其它 REST 相同(addNetworkScope),无用户上下文 401。
+    if (url.pathname === "/api/node-create-requests" && req.method === "GET") {
+      if (!restAuth) {
+        return withCors(req, Response.json({ ok: false, error: "auth_required" }, { status: 401 }));
+      }
+      const requestId = url.searchParams.get("request_id")?.trim() ?? "";
+      if (!requestId) {
+        return withCors(req, Response.json({ ok: false, error: "request_id_required" }, { status: 400 }));
+      }
+      const params: any[] = [requestId];
+      let sql = `SELECT request_id, daemon_node_id, child_name, network_id, runtime, model, status, error,
+                        created_at, delivered_at, acked_at
+                 FROM node_create_requests WHERE request_id = ?1`;
+      sql = addNetworkScope(sql, params, restScope);
+      const row = db.get<Record<string, unknown>>(sql, ...params);
+      if (!row) {
+        // 不存在与不在你作用域内长一样:不泄漏别的网络里有没有这个 id。
+        return withCors(req, Response.json({ ok: false, error: "request_not_found" }, { status: 404 }));
+      }
+      return withCors(req, Response.json({ ok: true, request: row }));
+    }
+
     if (url.pathname === "/api/host-supervisors") {
       // #380 — utok callers with exactly one accessible network get a
       // safe fallback so the create-node wizard doesn't have to bake

package/src/user-inbox-by-agent-http.test.ts

@@ -0,0 +1,161 @@
+// #1828 —— /api/messages?scope=user 按 agent 分的未读 + 用户 ack 覆盖 inbox 里的回复行。
+//
+// 生产 hub 24h:admin 收到的 70 条 agent 回复全在 `inbox`(session_name='admin', type='reply',
+// acked 永远 0),`user_inbox` 只有 2 行;角标链只读 user_inbox,所以回复从不进未读(app#260)。
+// 这里让 scope=user 同时给 `unread_by_agent`(两表合并)与 `unread_total`,`unread`/`pending_count`
+// 口径不动(qa-hub-14 钉着);POST /api/messages/ack 也能 ack inbox 里发给调用者用户名的回复行。
+//
+// 承重的是两条边界:
+//   ① 只算/只 ack **调用者自己用户名** 的 inbox 行 —— B 拿 A 的 id 来 ack 匹配不到;
+//   ② 用户名与某节点 alias 撞名时,inbox 那半边整体跳过(那是节点的待办,不是用户的)。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-user-inbox-by-agent-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let aToken = "", bToken = "", cToken = "";
+let aUserId = "", bUserId = "", cUserId = "", aNet = "", cNet = "";
+let aName = "", bName = "", cName = "";
+
+const get = async (path: string, token: string) => {
+  const r = await fetch(`${base}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+const post = async (path: string, token: string, body: unknown) => {
+  const r = await fetch(`${base}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return { status: r.status, body: await r.json() as any };
+};
+
+function seedUserInbox(mid: string, userId: string, netId: string, from: string) {
+  const { db } = require("./db.js");
+  db.run(
+    `INSERT INTO user_inbox (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, acked)
+     VALUES (?1, ?2, ?3, ?4, 'agent_message', NULL, 'dm', 'info', NULL, 0)`,
+    [mid, netId, userId, from],
+  );
+}
+function seedInbox(id: string, sessionName: string, netId: string, from: string, type = "reply", acked = 0) {
+  const { db } = require("./db.js");
+  db.run(
+    `INSERT INTO inbox (id, session_name, type, priority, content, from_session, acked, network_id, created_at)
+     VALUES (?1, ?2, ?3, 'normal', 'reply body', ?4, ?5, ?6, datetime('now'))`,
+    [id, sessionName, type, from, acked, netId],
+  );
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_AUTH_TOKEN ||= "legacy-master-token-for-test";
+  const { db } = await import("./db.js");
+  const { register, addNetworkMember } = await import("./auth.js");
+  const stamp = Date.now();
+
+  // 首个注册用户 = 全局 admin;探针 A/B/C 都不是 admin(admin 走不过滤分支,隔离断言会白过)。
+  const admin = register(`uba_admin_${stamp}`, "UbaAdmin-Strong-1!");
+  expect(admin.ok).toBe(true);
+  aName = `uba_a_${stamp}`; bName = `uba_b_${stamp}`; cName = `uba_c_${stamp}`;
+  const a = register(aName, "UbaA-Strong-1!");
+  const b = register(bName, "UbaB-Strong-1!");
+  const c = register(cName, "UbaC-Strong-1!");
+  expect(a.ok && b.ok && c.ok).toBe(true);
+  aToken = a.token!; bToken = b.token!; cToken = c.token!;
+  aNet = a.network_id!; cNet = c.network_id!;
+  const uid = (name: string) => db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", name)!.user_id;
+  aUserId = uid(aName); bUserId = uid(bName); cUserId = uid(cName);
+  for (const id of [aUserId, bUserId, cUserId]) {
+    expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", id)?.role).toBe("user");
+  }
+  // B 与 A 同网:user_id / session_name 过滤是唯一的隔离手段。
+  expect(addNetworkMember(aNet, bUserId, "member").ok).toBe(true);
+
+  // A:user_inbox 两条(node-x),inbox 回复两条(peer-1)+ 一条已 ack + 一条 status 类(不算)。
+  seedUserInbox("dm_a1", aUserId, aNet, "node-x");
+  seedUserInbox("dm_a2", aUserId, aNet, "node-x");
+  seedInbox("ib_a1", aName, aNet, "peer-1");
+  seedInbox("ib_a2", aName, aNet, "peer-1");
+  seedInbox("ib_a_acked", aName, aNet, "peer-1", "reply", 1);
+  seedInbox("ib_a_status", aName, aNet, "peer-1", "status");
+  // B 同网:自己的一条回复;不该出现在 A 的数里。
+  seedInbox("ib_b1", bName, aNet, "peer-2");
+  // C:用户名撞节点 alias —— inbox 里那行是节点的待办。
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at)
+     VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [`node_${stamp}`, cName, cName, cNet],
+  );
+  seedInbox("ib_c_node_task", cName, cNet, "leader", "task");
+  seedUserInbox("dm_c1", cUserId, cNet, "node-y");
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("#1828 GET /api/messages?scope=user unread_by_agent", () => {
+  test("A:user_inbox + inbox 回复按 agent 合并;unread/pending_count 口径不变", async () => {
+    const { status, body } = await get("/api/messages?scope=user", aToken);
+    expect(status).toBe(200);
+    expect(body.unread).toBe(2);                 // 只算 user_inbox(qa-hub-14 钉着)
+    expect(body.pending_count).toBe(2);
+    expect(body.unread_by_agent).toEqual({ "node-x": 2, "peer-1": 2 }); // 已 ack 与 status 类不算
+    expect(body.unread_total).toBe(4);
+  });
+
+  test("B(同网):只看到自己的回复,看不到 A 的", async () => {
+    const { body } = await get("/api/messages?scope=user", bToken);
+    expect(body.unread_by_agent).toEqual({ "peer-2": 1 });
+    expect(body.unread_total).toBe(1);
+  });
+
+  test("🔴 C 的用户名撞节点 alias:inbox 半边整体跳过,只剩 user_inbox", async () => {
+    const { body } = await get("/api/messages?scope=user", cToken);
+    expect(body.unread_by_agent).toEqual({ "node-y": 1 });
+    expect(body.unread_total).toBe(1);
+  });
+});
+
+describe("#1828 POST /api/messages/ack covers inbox reply rows", () => {
+  test("🔴 B 拿 A 的 inbox id 来 ack:匹配不到,A 的数不动", async () => {
+    const { body } = await post("/api/messages/ack", bToken, { message_ids: ["ib_a1"] });
+    expect(body).toMatchObject({ ok: true, acked: 0, acked_inbox: 0 });
+    const a = await get("/api/messages?scope=user", aToken);
+    expect(a.body.unread_by_agent["peer-1"]).toBe(2);
+  });
+
+  test("A ack 一条 inbox 回复 + 一条 user_inbox:两边各减一,响应分开计数", async () => {
+    const { body } = await post("/api/messages/ack", aToken, { message_ids: ["ib_a1", "dm_a1"] });
+    expect(body).toMatchObject({ ok: true, acked: 2, acked_user_inbox: 1, acked_inbox: 1 });
+    const a = await get("/api/messages?scope=user", aToken);
+    expect(a.body.unread).toBe(1);
+    expect(a.body.unread_by_agent).toEqual({ "node-x": 1, "peer-1": 1 });
+    expect(a.body.unread_total).toBe(2);
+    // 再 ack 同一条:幂等,0 行。
+    const again = await post("/api/messages/ack", aToken, { message_ids: ["ib_a1"] });
+    expect(again.body.acked).toBe(0);
+  });
+
+  test("status 类 inbox 行不会被用户 ack 掉(不是发给用户的消息)", async () => {
+    const { body } = await post("/api/messages/ack", aToken, { message_ids: ["ib_a_status"] });
+    expect(body.acked_inbox).toBe(0);
+  });
+
+  test("🔴 C 撞名:节点的待办不能被用户 ack 走", async () => {
+    const { body } = await post("/api/messages/ack", cToken, { message_ids: ["ib_c_node_task"] });
+    expect(body.acked_inbox).toBe(0);
+    const { db } = require("./db.js");
+    expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = 'ib_c_node_task'")?.acked).toBe(0);
+  });
+});