@sleep2agi/commhub-server 0.9.0-preview.53 → 0.9.0-preview.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.53",
+  "version": "0.9.0-preview.55",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/http-gzip.test.ts

@@ -0,0 +1,73 @@
+import { expect, test } from "bun:test";
+import { maybeGzipResponse, wantsGzip, isCompressibleResponse, trimLightTask, GZIP_MIN_BYTES, LIGHT_TASK_MAX_CHARS } from "./http-gzip";
+
+const big = JSON.stringify({ sessions: Array.from({ length: 200 }, (_, i) => ({ alias: `节点${i}`, task: "x".repeat(50) })) });
+const json = (body: string, extra: Record<string, string> = {}) =>
+  new Response(body, { status: 200, headers: { "Content-Type": "application/json; charset=utf-8", ...extra } });
+const reqWith = (ae?: string, method = "GET") =>
+  new Request("http://hub/api/status?light=1", { method, headers: ae === undefined ? {} : { "Accept-Encoding": ae } });
+
+test("wantsGzip reads Accept-Encoding, including q-values", () => {
+  expect(wantsGzip(reqWith("gzip, deflate, br"))).toBe(true);
+  expect(wantsGzip(reqWith("br;q=1.0, gzip;q=0.8"))).toBe(true);
+  expect(wantsGzip(reqWith("identity"))).toBe(false);
+  expect(wantsGzip(reqWith("gzip;q=0"))).toBe(false);
+  expect(wantsGzip(reqWith())).toBe(false);
+});
+
+test("a large JSON body is gzipped only when the client asked, and round-trips", async () => {
+  const out = await maybeGzipResponse(reqWith("gzip"), json(big));
+  expect(out!.headers.get("Content-Encoding")).toBe("gzip");
+  expect(out!.headers.get("Vary")).toContain("Accept-Encoding");
+  const bytes = new Uint8Array(await out!.arrayBuffer());
+  expect(bytes.byteLength).toBeLessThan(big.length / 3);
+  expect(Number(out!.headers.get("Content-Length"))).toBe(bytes.byteLength);
+  expect(new TextDecoder().decode(Bun.gunzipSync(bytes))).toBe(big);
+  expect(out!.headers.get("Content-Type")).toContain("application/json");
+
+  const plain = json(big);
+  expect(await maybeGzipResponse(reqWith(), plain)).toBe(plain); // untouched object
+});
+
+test("small, streamed, already-encoded, SSE, 204 and HEAD responses are left alone", async () => {
+  const small = json("{\"ok\":true}");
+  const outSmall = await maybeGzipResponse(reqWith("gzip"), small);
+  expect(outSmall!.headers.get("Content-Encoding")).toBeNull();
+  expect(await outSmall!.text()).toBe("{\"ok\":true}");
+  expect(GZIP_MIN_BYTES).toBe(1024);
+
+  const sse = new Response(new ReadableStream(), { headers: { "Content-Type": "text/event-stream" } });
+  expect(isCompressibleResponse(sse)).toBe(false);
+  expect(await maybeGzipResponse(reqWith("gzip"), sse)).toBe(sse);
+
+  const encoded = json(big, { "Content-Encoding": "br" });
+  expect(await maybeGzipResponse(reqWith("gzip"), encoded)).toBe(encoded);
+
+  const noContent = new Response(null, { status: 204 });
+  expect(await maybeGzipResponse(reqWith("gzip"), noContent)).toBe(noContent);
+
+  const head = json(big);
+  expect(await maybeGzipResponse(reqWith("gzip", "HEAD"), head)).toBe(head);
+
+  // /api/files downloads: Range replies and attachments keep their exact byte lengths (CI #509/#514 caught this)
+  const partial = new Response("x".repeat(4096), { status: 206, headers: { "Content-Type": "text/plain", "Content-Range": "bytes 0-4095/8192" } });
+  expect(await maybeGzipResponse(reqWith("gzip"), partial)).toBe(partial);
+  const attachment = new Response("y".repeat(4096), { status: 200, headers: { "Content-Type": "text/plain", "Content-Disposition": "attachment; filename=\"a.txt\"" } });
+  expect(await maybeGzipResponse(reqWith("gzip"), attachment)).toBe(attachment);
+
+  const binary = new Response(new Uint8Array(4096), { headers: { "Content-Type": "image/png" } });
+  expect(await maybeGzipResponse(reqWith("gzip"), binary)).toBe(binary);
+
+  expect(await maybeGzipResponse(reqWith("gzip"), undefined)).toBeUndefined();
+});
+
+test("trimLightTask keeps a one-line preview under the cap", () => {
+  expect(trimLightTask(null)).toBeNull();
+  expect(trimLightTask("   ")).toBeNull();
+  expect(trimLightTask("a\n  b")).toBe("a b");
+  const long = "字".repeat(LIGHT_TASK_MAX_CHARS + 40);
+  const t = trimLightTask(long)!;
+  expect(t.endsWith("…")).toBe(true);
+  expect([...t].length).toBe(LIGHT_TASK_MAX_CHARS + 1);
+  expect(trimLightTask("short")).toBe("short");
+});

package/src/http-gzip.ts

@@ -0,0 +1,60 @@
+// 2026-09-16(Vincent:「发一个消息都要被吞一段时间」「打开窗口历史很久才出来」):
+// 桌面端经 RELAY 连 hub,链路实测只有 ~13 KB/s;/api/status?light=1 128 KB 要 17 s,
+// 一页 20 条任务 41 KB 要 5.6 s,而 hub 从不压缩。gzip 后 128 KB → 31 KB、137 KB → 49 KB。
+// 只在客户端明确 `Accept-Encoding: gzip` 时压;text/event-stream(SSE)与流式 body 一律不碰。
+export const GZIP_MIN_BYTES = 1024;
+
+const COMPRESSIBLE = /^(application\/json|text\/(plain|html|css|javascript)|application\/javascript)\b/i;
+
+export function wantsGzip(req: Request): boolean {
+  const ae = req.headers.get("accept-encoding") || "";
+  for (const part of ae.split(",")) {
+    const [coding, ...params] = part.trim().split(";").map((x) => x.trim());
+    if (coding.toLowerCase() !== "gzip") continue;
+    const q = params.find((x) => /^q=/i.test(x));
+    if (!q) return true;
+    const n = Number(q.slice(2));
+    return Number.isFinite(n) && n > 0;
+  }
+  return false;
+}
+
+export function isCompressibleResponse(res: Response): boolean {
+  // 只压完整的 200:206 Partial Content / Content-Range / 附件下载(Content-Disposition)都有自己的
+  // 字节语义(Range 客户端按 Content-Length 数字节),压了就错 —— CI 的 /api/files Range 测试抓到的。
+  if (res.status !== 200 || !res.body) return false;
+  if (res.headers.get("content-encoding") || res.headers.get("content-range") || res.headers.get("content-disposition")) return false;
+  const ct = res.headers.get("content-type") || "";
+  if (/text\/event-stream/i.test(ct)) return false;
+  return COMPRESSIBLE.test(ct);
+}
+
+/**
+ * Gzip a finished response when the client asked for it and the body is worth it.
+ * Reads the body once; callers must not have consumed it. Anything streamed or
+ * not compressible is returned untouched (same object).
+ */
+export async function maybeGzipResponse(req: Request, res: Response | undefined | void): Promise<Response | undefined> {
+  if (!res) return res as undefined;
+  if (req.method === "HEAD" || !wantsGzip(req) || !isCompressibleResponse(res)) return res;
+  const raw = new Uint8Array(await res.arrayBuffer());
+  if (raw.byteLength < GZIP_MIN_BYTES) {
+    return new Response(raw, { status: res.status, statusText: res.statusText, headers: res.headers });
+  }
+  const gz = Bun.gzipSync(raw);
+  const headers = new Headers(res.headers);
+  headers.set("Content-Encoding", "gzip");
+  headers.set("Content-Length", String(gz.byteLength));
+  const vary = headers.get("Vary");
+  headers.set("Vary", vary && !/accept-encoding/i.test(vary) ? `${vary}, Accept-Encoding` : (vary || "Accept-Encoding"));
+  return new Response(gz, { status: res.status, statusText: res.statusText, headers });
+}
+
+/** 轻量列表里的 task 只给列表预览用;全文占了 light 载荷的一半以上。 */
+export const LIGHT_TASK_MAX_CHARS = 160;
+export function trimLightTask(task: unknown): string | null {
+  if (typeof task !== "string") return null;
+  const t = task.replace(/\s+/g, " ").trim();
+  if (!t) return null;
+  return t.length > LIGHT_TASK_MAX_CHARS ? `${t.slice(0, LIGHT_TASK_MAX_CHARS)}…` : t;
+}

package/src/messages-ack-by-agent-http.test.ts

@@ -0,0 +1,142 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+
+// #1909 —— POST /api/messages/ack 的 `{ agent }` 形态:把调用者收到的、来自该 agent 的
+// 两张表(user_inbox + inbox reply/task/message)全部标已读。角标分母 unread_by_agent
+// 数的是全集,按 id 只能 ack 拉到的那一页 ⇒ 老行永远清不掉,这一形态补上。
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-ack-by-agent-http-"));
+let server: any;
+let base = "";
+let tokenA = "";
+let tokenB = "";
+let userA = "";
+let userB = "";
+let userIdA = "";
+let userIdB = "";
+let netA = "";
+let netB = "";
+
+const AGENT = "ack-agent-x";
+const OTHER = "ack-agent-y";
+
+function seed() {
+  const ui = (id: string, net: string, uid: string, from: string) =>
+    db.run(
+      `INSERT INTO user_inbox (message_id, network_id, user_id, from_session, kind, content) VALUES (?1, ?2, ?3, ?4, 'agent_message', 'x')`,
+      [id, net, uid, from],
+    );
+  const ib = (id: string, net: string, to: string, from: string, type: string) =>
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, content, from_session, network_id) VALUES (?1, ?2, ?3, 'x', ?4, ?5)`,
+      [id, to, type, from, net],
+    );
+  ui("ui_a_x_1", netA, userIdA, AGENT);
+  ui("ui_a_x_2", netA, userIdA, AGENT);
+  ui("ui_a_y_1", netA, userIdA, OTHER);
+  ui("ui_b_x_1", netB, userIdB, AGENT);
+  ib("ib_a_x_reply", netA, userA, AGENT, "reply");
+  ib("ib_a_x_task", netA, userA, AGENT, "task");
+  ib("ib_a_x_status", netA, userA, AGENT, "status"); // 不在 reply/task/message 内,不该被 ack
+  ib("ib_a_y_reply", netA, userA, OTHER, "reply");
+  ib("ib_b_x_reply", netB, userB, AGENT, "reply");
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
+  const stamp = `${Date.now()}_${process.pid}`;
+  userA = `ack_agent_a_${stamp}`;
+  userB = `ack_agent_b_${stamp}`;
+  const a = register(userA, "AckAgent123!", undefined, "seed");
+  const b = register(userB, "AckAgent123!", undefined, "seed");
+  expect(a.ok).toBe(true);
+  expect(b.ok).toBe(true);
+  tokenA = a.token!; netA = a.network_id!;
+  tokenB = b.token!; netB = b.network_id!;
+  userIdA = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", [userA])!.user_id;
+  userIdB = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", [userB])!.user_id;
+  seed();
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+async function ack(token: string, body: unknown): Promise<{ status: number; body: any }> {
+  const response = await fetch(`${base}/api/messages/ack`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return { status: response.status, body: await response.json() };
+}
+
+const uiAcked = (id: string) => db.get<{ acked: number }>("SELECT acked FROM user_inbox WHERE message_id = ?1", [id])!.acked;
+const ibAcked = (id: string) => db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = ?1", [id])!.acked;
+
+async function unreadByAgent(token: string): Promise<Record<string, number>> {
+  const response = await fetch(`${base}/api/messages?scope=user&limit=5`, { headers: { Authorization: `Bearer ${token}` } });
+  expect(response.status).toBe(200);
+  return ((await response.json()) as any).unread_by_agent ?? {};
+}
+
+describe("POST /api/messages/ack { agent } (#1909)", () => {
+  test("missing everything → message_id_required; agent + ids → ambiguous_ack", async () => {
+    const none = await ack(tokenA, {});
+    expect(none.status).toBe(400);
+    expect(none.body.error).toBe("message_id_required");
+    const both = await ack(tokenA, { agent: AGENT, message_ids: ["ui_a_x_1"] });
+    expect(both.status).toBe(400);
+    expect(both.body.error).toBe("ambiguous_ack");
+    // 拒绝的那次不能有副作用
+    expect(uiAcked("ui_a_x_1")).toBe(0);
+  });
+
+  test("unread_by_agent counts the seeded rows before ack", async () => {
+    const by = await unreadByAgent(tokenA);
+    expect(by[AGENT]).toBe(4); // 2 user_inbox + reply + task (status 不计)
+    expect(by[OTHER]).toBe(2);
+  });
+
+  test("agent form acks both tables, only that agent, only the caller", async () => {
+    const r = await ack(tokenA, { agent: `  ${AGENT}  ` });
+    expect(r.status).toBe(200);
+    expect(r.body).toMatchObject({ ok: true, scope: "agent", agent: AGENT, acked: 4, acked_user_inbox: 2, acked_inbox: 2 });
+    expect(uiAcked("ui_a_x_1")).toBe(1);
+    expect(uiAcked("ui_a_x_2")).toBe(1);
+    expect(ibAcked("ib_a_x_reply")).toBe(1);
+    expect(ibAcked("ib_a_x_task")).toBe(1);
+    // 不该动的:别的 agent、非 reply/task/message 类型、别的用户
+    expect(uiAcked("ui_a_y_1")).toBe(0);
+    expect(ibAcked("ib_a_x_status")).toBe(0);
+    expect(ibAcked("ib_a_y_reply")).toBe(0);
+    expect(uiAcked("ui_b_x_1")).toBe(0);
+    expect(ibAcked("ib_b_x_reply")).toBe(0);
+    const by = await unreadByAgent(tokenA);
+    expect(by[AGENT] ?? 0).toBe(0);
+    expect(by[OTHER]).toBe(2);
+    expect((await unreadByAgent(tokenB))[AGENT]).toBe(2);
+  });
+
+  test("agent form is idempotent: second call changes 0 rows", async () => {
+    const r = await ack(tokenA, { agent: AGENT });
+    expect(r.status).toBe(200);
+    expect(r.body.acked).toBe(0);
+  });
+
+  test("id form still works and now reports scope ids", async () => {
+    const r = await ack(tokenA, { message_ids: ["ui_a_y_1", "ib_a_y_reply", "ui_b_x_1"] });
+    expect(r.status).toBe(200);
+    expect(r.body).toMatchObject({ ok: true, scope: "ids", acked: 2, acked_user_inbox: 1, acked_inbox: 1 });
+    expect(uiAcked("ui_a_y_1")).toBe(1);
+    expect(ibAcked("ib_a_y_reply")).toBe(1);
+    expect(uiAcked("ui_b_x_1")).toBe(0); // 别人的 id 匹配不到
+  });
+});

package/src/server.ts

@@ -1,4 +1,5 @@
 import { buildServeErrorResponse } from "./serve-error.js";
+import { maybeGzipResponse, trimLightTask } from "./http-gzip";
 import { redactMessageRow } from "./redact-tokens.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
@@ -792,6 +793,8 @@ return Bun.serve({
   error: (err) => buildServeErrorResponse(err),
 
   async fetch(req, server) {
+    // 2026-09-16 —— 所有 JSON/文本响应在客户端要求时 gzip(见 http-gzip.ts);SSE/流式/二进制原样。
+    return maybeGzipResponse(req, await (async (): Promise<Response | undefined> => {
     const url = new URL(req.url, `http://localhost:${PORT}`);
 
     // ── CORS preflight ──
@@ -1661,7 +1664,8 @@ return Bun.serve({
             alias: s.alias,
             status: s.status,
             agent: s.agent ?? null,
-            task: s.task ?? null,
+            // 列表预览只要一行;全文 task 占 light 载荷 52%(294 节点 128 KB)。全量 /api/status 不变。
+            task: trimLightTask(s.task),
             server: s.server ?? null,
             updated_at: s.updated_at ?? null,
             runtime: normalizeRuntime(s.agent),
@@ -2751,6 +2755,34 @@ return Bun.serve({
       const ids: string[] = Array.isArray(body?.message_ids)
         ? body.message_ids.filter((x: unknown) => typeof x === "string" && x.length > 0)
         : (typeof body?.message_id === "string" && body.message_id ? [body.message_id] : []);
+      // #1909 —— 按 agent 整体 ack:`{ agent: "<alias>" }`。角标的分母是 `unread_by_agent`,
+      //    它数的是**全部**未 ack 行,而客户端一页只看得到最近 200/300 条 ⇒ 老行永远 ack 不到,
+      //    红点永远清不掉(生产 admin:user_inbox 522 + inbox 5660 行)。这一形态把调用者
+      //    收到的、来自该 agent 的两张表全部标已读;同样只动自己的行。
+      const agentRaw = typeof body?.agent === "string" ? body.agent.trim() : "";
+      if (agentRaw && ids.length > 0) {
+        return withCors(req, Response.json({ ok: false, error: "ambiguous_ack" }, { status: 400 }));
+      }
+      if (agentRaw) {
+        const uiParams: any[] = [callerUserId, agentRaw];
+        let uiSql = `UPDATE user_inbox SET acked = 1, acked_at = datetime('now')
+                     WHERE user_id = ?1 AND from_session = ?2 AND acked = 0`;
+        uiSql = addNetworkScope(uiSql, uiParams, restScope);
+        const uiAcked = db.run(uiSql, uiParams).changes ?? 0;
+        let agentInboxAcked = 0;
+        const agentCallerUsername = restAuth?.username ?? "";
+        if (agentCallerUsername && !userInboxAliasCollides(agentCallerUsername, restScope)) {
+          const ibAgentParams: any[] = [agentCallerUsername, agentRaw];
+          let ibAgentSql = `UPDATE inbox SET acked = 1
+                            WHERE session_name = ?1 AND from_session = ?2 AND acked = 0 AND type IN ('reply', 'task', 'message')`;
+          ibAgentSql = addNetworkScope(ibAgentSql, ibAgentParams, restScope);
+          agentInboxAcked = db.run(ibAgentSql, ibAgentParams).changes ?? 0;
+        }
+        return withCors(req, Response.json({
+          ok: true, scope: "agent", agent: agentRaw,
+          acked: uiAcked + agentInboxAcked, acked_user_inbox: uiAcked, acked_inbox: agentInboxAcked,
+        }));
+      }
       if (ids.length === 0) {
         return withCors(req, Response.json({ ok: false, error: "message_id_required" }, { status: 400 }));
       }
@@ -2777,7 +2809,7 @@ return Bun.serve({
         ibSql = addNetworkScope(ibSql, ibParams, restScope);
         inboxAcked = db.run(ibSql, ibParams).changes ?? 0;
       }
-      return withCors(req, Response.json({ ok: true, acked: (res.changes ?? 0) + inboxAcked, acked_user_inbox: res.changes ?? 0, acked_inbox: inboxAcked }));
+      return withCors(req, Response.json({ ok: true, scope: "ids", acked: (res.changes ?? 0) + inboxAcked, acked_user_inbox: res.changes ?? 0, acked_inbox: inboxAcked }));
     }
 
     // ── REST: stats summary ──
@@ -3571,6 +3603,7 @@ Security: ${SECURITY_LABEL}
 `,
       { status: 200, headers: { "Content-Type": "text/plain; charset=utf-8" } }   // #426
     ));
+    })());
   },
 
   // ── WebSocket handler for tmux terminal streaming ──