@sleep2agi/commhub-server 0.9.0-preview.51 → 0.9.0-preview.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.51",
+  "version": "0.9.0-preview.53",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/create-node-validate.test.ts

@@ -35,6 +35,15 @@ describe("validateRuntime / validateModel (§4.2.2)", () => {
     expect(() => validateModel("gpt-4o")).not.toThrow();
     expect(() => validateModel("bad model")).toThrow(ValidationError);
     expect(() => validateModel("x;rm")).toThrow(ValidationError);
+    // provider/model(OpenCode 共存;桌面向导 0.2.61 起发这种形状,Vincent 2026-09-08 撞到 model_invalid)
+    expect(() => validateModel("opencode/mimo-v2.5-free")).not.toThrow();
+    expect(() => validateModel("anthropic/claude-sonnet-4")).not.toThrow();
+    expect(() => validateModel("a/b/c")).toThrow(ValidationError);      // 只许一个斜杠
+    expect(() => validateModel("/model")).toThrow(ValidationError);     // 不能以斜杠开头
+    expect(() => validateModel("provider/")).toThrow(ValidationError);  // 不能以斜杠结尾
+    expect(() => validateModel("../x")).toThrow(ValidationError);       // 纯点段(路径穿越形状)
+    expect(() => validateModel("x/.")).toThrow(ValidationError);
+    expect(() => validateModel("open code/m")).toThrow(ValidationError);
     expect(() => validateModel("")).toThrow(ValidationError);
   });
 });

package/src/create-node-validate.ts

@@ -58,7 +58,11 @@ const ENV_KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
 
 // §4.2.2 name + model.
 const NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
-const MODEL_RE = /^[a-zA-Z0-9._:\-]+$/;
+// OpenCode 共存的模型带 provider 前缀(`opencode/mimo-v2.5-free`,agent-node parseModelRef 按第一个 `/` 切),
+// 桌面向导 0.2.61 起就发这种形状 —— 允许**恰好一个**斜杠分隔的两段;每段仍是原字符集,且不能是纯点(`..`/`.`)。
+const MODEL_SEGMENT = "[a-zA-Z0-9._:\\-]+";
+const MODEL_RE = new RegExp(`^${MODEL_SEGMENT}(?:/${MODEL_SEGMENT})?$`);
+const MODEL_DOT_ONLY_SEGMENT = /(^|\/)\.+(\/|$)/;
 
 export function validateName(s: unknown): asserts s is string {
   if (typeof s !== "string" || !NAME_RE.test(s)) {
@@ -90,7 +94,7 @@ export function validateRuntime(s: unknown): asserts s is Runtime {
 
 export function validateModel(s: unknown): asserts s is string | undefined | null {
   if (s === undefined || s === null) return;
-  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s)) {
+  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s) || MODEL_DOT_ONLY_SEGMENT.test(s)) {
     throw new ValidationError("model_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
   }
 }

package/src/node-create-request-status-http.test.ts

@@ -0,0 +1,92 @@
+// 桌面向导要看得到 daemon 回的失败原因:GET /api/node-create-requests?request_id=…
+// 承重:① 只在调用者的网络作用域里能读到(别的网络 → 404,与不存在同形);② 无用户上下文 401;③ 缺参 400;
+// ④ 回的是 daemon ack 写进去的 status/error 原文。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-create-request-status-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let aToken = "", bToken = "", aNet = "", bNet = "";
+const MASTER_TOKEN = "legacy-master-token-for-test";
+
+const get = async (path: string, token: string) => {
+  const r = await fetch(`${base}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+
+beforeAll(async () => {
+  process.env.COMMHUB_AUTH_TOKEN ||= MASTER_TOKEN;
+  const { db } = await import("./db.js");
+  const { register } = await import("./auth.js");
+  const stamp = Date.now();
+  const admin = register(`cr_admin_${stamp}`, "CrAdmin-Strong-1!");
+  expect(admin.ok).toBe(true);
+  const a = register(`cr_a_${stamp}`, "CrA-Strong-1!");
+  const b = register(`cr_b_${stamp}`, "CrB-Strong-1!");
+  expect(a.ok && b.ok).toBe(true);
+  aToken = a.token!; bToken = b.token!; aNet = a.network_id!; bNet = b.network_id!;
+  const uid = (name: string) => db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", name)!.user_id;
+  for (const id of [uid(`cr_a_${stamp}`), uid(`cr_b_${stamp}`)]) {
+    expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", id)?.role).toBe("user");
+  }
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token, acked_at, error)
+     VALUES ('cr_a_failed', 'node_daemon_a', 'vansin-go', ?1, 'opencode-cli', NULL, '{}', '[]', 'failed', NULL, ?2, 'tok', ?2,
+             'opencode-cli package entrypoint verification currently requires Linux')`,
+    [aNet, Date.now()],
+  );
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token)
+     VALUES ('cr_b_pending', 'node_daemon_b', 'other', ?1, 'codex-app-server', NULL, '{}', '[]', 'pending', NULL, ?2, 'tok')`,
+    [bNet, Date.now()],
+  );
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/node-create-requests?request_id=", () => {
+  test("A reads her own failed request with the daemon's error verbatim", async () => {
+    const { status, body } = await get("/api/node-create-requests?request_id=cr_a_failed", aToken);
+    expect(status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.request).toMatchObject({
+      request_id: "cr_a_failed", child_name: "vansin-go", runtime: "opencode-cli", status: "failed",
+      error: "opencode-cli package entrypoint verification currently requires Linux",
+    });
+  });
+  test("🔴 B cannot read A's request — 404, same shape as nonexistent", async () => {
+    const other = await get("/api/node-create-requests?request_id=cr_a_failed", bToken);
+    const missing = await get("/api/node-create-requests?request_id=cr_nope", bToken);
+    expect(other.status).toBe(404);
+    expect(missing.status).toBe(404);
+    expect(other.body).toEqual(missing.body);
+  });
+  test("pending request reads as pending with no error", async () => {
+    const { body } = await get("/api/node-create-requests?request_id=cr_b_pending", bToken);
+    expect(body.request.status).toBe("pending");
+    expect(body.request.error).toBeNull();
+  });
+  test("missing request_id → 400", async () => {
+    const { status, body } = await get("/api/node-create-requests", aToken);
+    expect(status).toBe(400);
+    expect(body.error).toBe("request_id_required");
+  });
+  test("legacy master token (no user context) → 401", async () => {
+    const { status, body } = await get("/api/node-create-requests?request_id=cr_a_failed", MASTER_TOKEN);
+    expect(status).toBe(401);
+    expect(body.error).toBe("auth_required");
+  });
+});

package/src/server.ts

@@ -3120,6 +3120,31 @@ return Bun.serve({
     // Mirror of the `list_host_supervisors` MCP tool for non-MCP callers.
     // Same SQL + role-extract + member-脱敏 logic; SEC-1 scoped via REST
     // auth pipeline (restScope). Returns {ok, daemons:[...], count}.
+    // ── REST: one node_create_request's outcome (app#… 桌面向导) ──
+    // 向导 POST create_node 后只会轮询「子节点注册了没」,daemon 回的失败原因(ack_create_request 写进
+    // node_create_requests.status/error)此前没有任何读接口 —— 用户只看到「24s 没注册」。
+    // 这里按 request_id 读一行;网络作用域与其它 REST 相同(addNetworkScope),无用户上下文 401。
+    if (url.pathname === "/api/node-create-requests" && req.method === "GET") {
+      if (!restAuth) {
+        return withCors(req, Response.json({ ok: false, error: "auth_required" }, { status: 401 }));
+      }
+      const requestId = url.searchParams.get("request_id")?.trim() ?? "";
+      if (!requestId) {
+        return withCors(req, Response.json({ ok: false, error: "request_id_required" }, { status: 400 }));
+      }
+      const params: any[] = [requestId];
+      let sql = `SELECT request_id, daemon_node_id, child_name, network_id, runtime, model, status, error,
+                        created_at, delivered_at, acked_at
+                 FROM node_create_requests WHERE request_id = ?1`;
+      sql = addNetworkScope(sql, params, restScope);
+      const row = db.get<Record<string, unknown>>(sql, ...params);
+      if (!row) {
+        // 不存在与不在你作用域内长一样:不泄漏别的网络里有没有这个 id。
+        return withCors(req, Response.json({ ok: false, error: "request_not_found" }, { status: 404 }));
+      }
+      return withCors(req, Response.json({ ok: true, request: row }));
+    }
+
     if (url.pathname === "/api/host-supervisors") {
       // #380 — utok callers with exactly one accessible network get a
       // safe fallback so the create-node wizard doesn't have to bake