@sleep2agi/commhub-server 0.9.0-preview.57 → 0.9.0-preview.59

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.57",
+  "version": "0.9.0-preview.59",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -130,6 +130,9 @@ for (const col of [
   // Node skills view — the same session answers skills_list / skill_read on the
   // rules-file doorbell (node-skills.ts). Sticky, bound-token only, like above.
   { name: "skills_capable", def: "INTEGER NOT NULL DEFAULT 0" },
+  // Project folder view — the same session answers files_list / file_read on the
+  // rules-file doorbell (node-files.ts). Sticky, bound-token only, like above.
+  { name: "files_capable", def: "INTEGER NOT NULL DEFAULT 0" },
 ]) {
   try { db.exec(`ALTER TABLE sessions ADD COLUMN ${col.name} ${col.def}`); } catch {}
 }

package/src/node-files-transport.test.ts

@@ -0,0 +1,344 @@
+// Project folder view — list_node_files / read_node_file ride the rules-file
+// queue + doorbell (ops files_list / file_read).
+//
+// Hub-side contract verified here:
+//   1. report_status { files_capable: true } is sticky and set only by the
+//      session's own node token (bound or legacy-unbound, same rule as skills).
+//   2. Both tools reach a session with no nodes row by alias; the pulled
+//      request carries the normalized RELATIVE path; results come back through
+//      get_rules_file_result.
+//   3. Absolute paths, `..`, `~`, drive letters, backslashes and NUL are refused
+//      before any request row exists (the node re-checks; this is the first wall).
+//   4. A node token may not enqueue a files op (it would read another node's
+//      disk), and only the token that asked may read a files result.
+//   5. A token bound to node A never pulls or acks node B's files request; an
+//      unbound legacy token falls back to its alias exactly as it does for skills.
+//   6. Its own single-flight lane; rules-capable-only sessions are refused.
+//   7. Files acks may carry up to 1 MiB (escaped JSON of a 256 KiB file); rules
+//      acks keep their 256 KiB cap.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/files-transport.db bun test src/node-files-transport.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_files_session";
+const OTHER_NET = "net_files_session_other";
+const USER = "u_files_session_owner";
+const SESSION_ALIAS = "files-session-cc";
+const SESSION_RESUME = "cc-files-session-1";
+const PEER_ALIAS = "files-session-peer";
+const NODE_A = "files-node-a";
+const NODE_B = "files-node-b";
+const NODE_A_ID = "node_files_a";
+const NODE_B_ID = "node_files_b";
+const LEGACY_ALIAS = "files-node-legacy";
+const LEGACY_ID = "node_files_legacy";
+const T_SESSION = "tok_files_session_cc";
+const T_PEER = "tok_files_session_peer";
+const T_OTHER_NET_SAME_ALIAS = "tok_files_session_other_net";
+const T_A = "tok_files_node_a";
+const T_B = "tok_files_node_b";
+const T_LEGACY = "tok_files_node_legacy";
+
+function cleanup() {
+  for (const net of [NET, OTHER_NET]) {
+    try { db.run("DELETE FROM node_rules_requests WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM rename_txn WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM sessions WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM network_members WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [net]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedWorld() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER, USER]);
+  for (const net of [NET, OTHER_NET]) {
+    db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [net, net, USER]);
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER, net]);
+  }
+  const tok = (id: string, net: string, alias: string, bound: string | null = null) => db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at, bound_node_id) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL, ?6)`,
+    [id, USER, net, `node:${alias}`, `hash_${id}`, bound],
+  );
+  const node = (id: string, alias: string) => db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [id, alias, alias, NET],
+  );
+  node(NODE_A_ID, NODE_A);
+  node(NODE_B_ID, NODE_B);
+  node(LEGACY_ID, LEGACY_ALIAS);
+  tok(T_SESSION, NET, SESSION_ALIAS);
+  tok(T_PEER, NET, PEER_ALIAS);
+  tok(T_OTHER_NET_SAME_ALIAS, OTHER_NET, SESSION_ALIAS);
+  tok(T_A, NET, NODE_A, NODE_A_ID);
+  tok(T_B, NET, NODE_B, NODE_B_ID);
+  tok(T_LEGACY, NET, LEGACY_ALIAS, null);
+}
+
+type Identity = { net: string; alias: string; isNetworkToken: boolean; tokenId: string };
+const asUser: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_files_session_user" };
+const asUserOtherLogin: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_files_session_user_other_login" };
+const asSession: Identity = { net: NET, alias: SESSION_ALIAS, isNetworkToken: true, tokenId: T_SESSION };
+const asPeer: Identity = { net: NET, alias: PEER_ALIAS, isNetworkToken: true, tokenId: T_PEER };
+const asOtherNetSameAlias: Identity = { net: OTHER_NET, alias: SESSION_ALIAS, isNetworkToken: true, tokenId: T_OTHER_NET_SAME_ALIAS };
+const asA: Identity = { net: NET, alias: NODE_A, isNetworkToken: true, tokenId: T_A };
+const asB: Identity = { net: NET, alias: NODE_B, isNetworkToken: true, tokenId: T_B };
+const asLegacy: Identity = { net: NET, alias: LEGACY_ALIAS, isNetworkToken: true, tokenId: T_LEGACY };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "files-session-test", version: "1" });
+  registerTools(server, undefined, id.net, USER, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "files-session-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}: ${JSON.stringify(r).slice(0, 300)}`);
+    try { return JSON.parse(first.text); } catch { return { raw: first.text, isError: r.isError === true }; }
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { call, close };
+}
+
+const capable = (alias: string, net = NET) =>
+  db.get<{ c: number }>("SELECT files_capable AS c FROM sessions WHERE alias = ?1 AND network_id = ?2", alias, net)?.c;
+const rowCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_rules_requests WHERE network_id = ?1", NET)!.n;
+
+async function report(id: Identity, alias: string, resume: string, flags: Record<string, true>) {
+  const c = await connect(id);
+  try { return await c.call("report_status", { resume_id: resume, alias, status: "idle", agent: "claude-code", ...flags }); }
+  finally { await c.close(); }
+}
+const ALL_FLAGS = { rules_file_capable: true, skills_capable: true, files_capable: true } as const;
+
+beforeEach(() => { cleanup(); seedWorld(); });
+afterAll(cleanup);
+
+describe("files_capable is set only by the session's own node token", () => {
+  test("own token sets it; a later report without it does not clear it; a peer cannot set it", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    expect(capable(SESSION_ALIAS)).toBe(1);
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, {});
+    expect(capable(SESSION_ALIAS)).toBe(1);
+    const r = await report(asPeer, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    expect(r).toMatchObject({ ok: false });
+    // A user login cannot set it either.
+    await report(asUser, PEER_ALIAS, "cc-files-user-report", ALL_FLAGS);
+    expect(capable(PEER_ALIAS) ?? 0).toBe(0);
+  }, 20_000);
+
+  test("a stale process whose report is rewritten to a renamed alias does not grant that alias the flag", async () => {
+    const NEW_ALIAS = "files-session-renamed";
+    db.run(
+      `INSERT INTO rename_txn (txn_id, network_id, old_alias, new_alias, status, committed_at) VALUES ('txn_files_rename', ?1, ?2, ?3, 'committed', datetime('now'))`,
+      [NET, PEER_ALIAS, NEW_ALIAS],
+    );
+    // Token still carries the old alias; the hub rewrites the report to NEW_ALIAS.
+    const r = await report(asPeer, PEER_ALIAS, "cc-files-renamed", ALL_FLAGS);
+    expect(r.ok).toBe(true);
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM sessions WHERE alias = ?1 AND network_id = ?2", NEW_ALIAS, NET)!.n).toBe(1);
+    expect(capable(NEW_ALIAS)).toBe(0);
+  }, 20_000);
+});
+
+describe("list / read by alias reach a session with no nodes row", () => {
+  test("list: pulled request carries the normalized relative path; result comes back", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const s = await connect(asSession);
+    try {
+      const enq = await u.call("list_node_files", { alias: SESSION_ALIAS, path: "./src//lib/" });
+      expect(enq).toMatchObject({ ok: true, op: "files_list" });
+      const pulled = await s.call("get_rules_file_request", {});
+      expect(pulled.request).toEqual({ request_id: enq.request_id, op: "files_list", content: "src/lib" });
+      const payload = JSON.stringify({ path: "src/lib", entries: [{ name: "a.ts", type: "file", size: 3, mtime: 1 }], truncated: false, total: 1 });
+      expect(await s.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "files", exists: true, content: payload })).toMatchObject({ ok: true, status: "done" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: true, op: "files_list", status: "done", content: payload });
+    } finally { await u.close(); await s.close(); }
+  }, 20_000);
+
+  test("list with no path targets the root (empty content)", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const s = await connect(asSession);
+    try {
+      const enq = await u.call("list_node_files", { alias: SESSION_ALIAS });
+      expect((await s.call("get_rules_file_request", {})).request).toEqual({ request_id: enq.request_id, op: "files_list", content: "" });
+    } finally { await u.close(); await s.close(); }
+  }, 20_000);
+
+  test("read round trip", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const s = await connect(asSession);
+    try {
+      const enq = await u.call("read_node_file", { alias: SESSION_ALIAS, path: "docs/README.md" });
+      expect(enq).toMatchObject({ ok: true, op: "file_read" });
+      expect((await s.call("get_rules_file_request", {})).request).toEqual({ request_id: enq.request_id, op: "file_read", content: "docs/README.md" });
+      const payload = JSON.stringify({ path: "docs/README.md", name: "README.md", kind: "text", size: 6, content: "# hi\n" });
+      await s.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "README.md", exists: true, content: payload });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "done", content: payload });
+    } finally { await u.close(); await s.close(); }
+  }, 20_000);
+});
+
+describe("path validation happens before any row is written", () => {
+  test("absolute, .., ~, drive letters, backslashes, NUL, and an empty read path are refused", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    try {
+      const bad = ["/etc/passwd", "../outside", "a/../../b", "src/..", "~/.ssh/id_rsa", "C:/Windows", "a\\b", "..\\x", "a\u0000b", "x".repeat(1025)];
+      for (const path of bad) {
+        // Over-long paths are stopped by the zod schema (an MCP input error); the rest by invalid_path.
+        const r = await u.call("read_node_file", { alias: SESSION_ALIAS, path });
+        expect(r.ok).not.toBe(true);
+        if (path.length <= 1024) expect(r).toMatchObject({ ok: false, error: "invalid_path" });
+        const l = await u.call("list_node_files", { alias: SESSION_ALIAS, path });
+        expect(l.ok).not.toBe(true);
+      }
+      expect(await u.call("read_node_file", { alias: SESSION_ALIAS, path: "/" })).toMatchObject({ ok: false, error: "invalid_path" });
+      expect(await u.call("read_node_file", { alias: SESSION_ALIAS, path: "./" })).toMatchObject({ ok: false, error: "invalid_path" });
+      expect(rowCount()).toBe(0);
+    } finally { await u.close(); }
+  }, 20_000);
+});
+
+describe("who may ask, and who may read the answer", () => {
+  test("a node token cannot enqueue a files op on another node (or itself)", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const a = await connect(asA);
+    try {
+      expect(await a.call("list_node_files", { alias: SESSION_ALIAS })).toMatchObject({ ok: false, error: "node_token_cannot_browse_files" });
+      expect(await a.call("read_node_file", { node_id: NODE_B_ID, path: ".env" })).toMatchObject({ ok: false, error: "node_token_cannot_browse_files" });
+      expect(await a.call("list_node_files", { node_id: NODE_A_ID })).toMatchObject({ ok: false, error: "node_token_cannot_browse_files" });
+      expect(rowCount()).toBe(0);
+    } finally { await a.close(); }
+  }, 20_000);
+
+  test("only the token that asked can read a files result; node tokens never can", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const other = await connect(asUserOtherLogin);
+    const s = await connect(asSession);
+    const a = await connect(asA);
+    try {
+      const enq = await u.call("read_node_file", { alias: SESSION_ALIAS, path: "notes.txt" });
+      await s.call("get_rules_file_request", {});
+      await s.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: JSON.stringify({ path: "notes.txt", kind: "text", content: "x" }) });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: true, status: "done" });
+      expect(await other.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+      expect(await a.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+      // The serving session itself cannot read the stored result back through the client tool either.
+      expect(await s.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+    } finally { await u.close(); await other.close(); await s.close(); await a.close(); }
+  }, 20_000);
+
+  test("rules/skills results stay readable by any writer of the network (unchanged)", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const other = await connect(asUserOtherLogin);
+    try {
+      const enq = await u.call("list_node_skills", { alias: SESSION_ALIAS });
+      expect(await other.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: true, status: "pending" });
+    } finally { await u.close(); await other.close(); }
+  }, 20_000);
+});
+
+describe("a token bound to node A cannot touch node B's files request", () => {
+  test("B's request: A pulls nothing, A's ack is ignored, B pulls and acks it", async () => {
+    const u = await connect(asUser);
+    const a = await connect(asA);
+    const b = await connect(asB);
+    try {
+      const enq = await u.call("read_node_file", { node_id: NODE_B_ID, path: "secret-plan.md" });
+      expect(enq).toMatchObject({ ok: true });
+      expect((await a.call("get_rules_file_request", {})).request).toBeNull();
+      expect(await a.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{\"forged\":true}" })).toMatchObject({ ok: true, ignored: "unknown_or_foreign_request" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "pending" });
+      expect((await b.call("get_rules_file_request", {})).request).toEqual({ request_id: enq.request_id, op: "file_read", content: "secret-plan.md" });
+      expect(await b.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{}" })).toMatchObject({ ok: true, status: "done" });
+    } finally { await u.close(); await a.close(); await b.close(); }
+  }, 20_000);
+
+  test("same alias in another network neither pulls nor acks; a peer's ack is ignored", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const other = await connect(asOtherNetSameAlias);
+    const peer = await connect(asPeer);
+    try {
+      const enq = await u.call("list_node_files", { alias: SESSION_ALIAS });
+      expect((await other.call("get_rules_file_request", {})).request).toBeNull();
+      expect(await other.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{}" })).toMatchObject({ ignored: "unknown_or_foreign_request" });
+      expect(await peer.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{}" })).toMatchObject({ ignored: "unknown_or_foreign_request" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "pending" });
+    } finally { await u.close(); await other.close(); await peer.close(); }
+  }, 20_000);
+
+  test("an unbound legacy token gets what skills gives it: alias fallback pull + ack, and it can set its own flag", async () => {
+    const u = await connect(asUser);
+    const legacy = await connect(asLegacy);
+    try {
+      await report(asLegacy, LEGACY_ALIAS, `sdk-${LEGACY_ID}`, ALL_FLAGS);
+      expect(capable(LEGACY_ALIAS)).toBe(1);
+      const skills = await u.call("list_node_skills", { node_id: LEGACY_ID });
+      const files = await u.call("list_node_files", { node_id: LEGACY_ID, path: "src" });
+      expect(skills).toMatchObject({ ok: true });
+      expect(files).toMatchObject({ ok: true });
+      const first = (await legacy.call("get_rules_file_request", {})).request;
+      const second = (await legacy.call("get_rules_file_request", {})).request;
+      expect([first.request_id, second.request_id].sort()).toEqual([skills.request_id, files.request_id].sort());
+      expect(await legacy.call("ack_rules_file_request", { request_id: files.request_id, status: "done", content: "{}" })).toMatchObject({ ok: true, status: "done" });
+      expect(await legacy.call("ack_rules_file_request", { request_id: skills.request_id, status: "done", content: "{}" })).toMatchObject({ ok: true, status: "done" });
+    } finally { await u.close(); await legacy.close(); }
+  }, 20_000);
+});
+
+describe("lanes, capability gate and ack size", () => {
+  test("files has its own single-flight lane", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    try {
+      expect(await u.call("read_node_rules_file", { alias: SESSION_ALIAS })).toMatchObject({ ok: true });
+      expect(await u.call("list_node_skills", { alias: SESSION_ALIAS })).toMatchObject({ ok: true });
+      const list = await u.call("list_node_files", { alias: SESSION_ALIAS });
+      expect(list).toMatchObject({ ok: true });
+      expect(await u.call("read_node_file", { alias: SESSION_ALIAS, path: "a.txt" })).toMatchObject({ ok: false, error: "request_in_flight", existing_request_id: list.request_id });
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("rules+skills capable but not files capable → files_target_not_found, no row", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, { rules_file_capable: true, skills_capable: true });
+    const u = await connect(asUser);
+    try {
+      expect(await u.call("list_node_files", { alias: SESSION_ALIAS })).toMatchObject({ ok: false, error: "files_target_not_found" });
+      expect(rowCount()).toBe(0);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("a files ack may carry up to 1 MiB; a rules ack keeps its 256 KiB cap", async () => {
+    await report(asSession, SESSION_ALIAS, SESSION_RESUME, ALL_FLAGS);
+    const u = await connect(asUser);
+    const s = await connect(asSession);
+    try {
+      const big = JSON.stringify({ path: "big.txt", kind: "text", content: "\n".repeat(256 * 1024) });
+      expect(big.length).toBeGreaterThan(256 * 1024);
+      const f = await u.call("read_node_file", { alias: SESSION_ALIAS, path: "big.txt" });
+      const r = await u.call("read_node_rules_file", { alias: SESSION_ALIAS });
+      await s.call("get_rules_file_request", {});
+      await s.call("get_rules_file_request", {});
+      expect(await s.call("ack_rules_file_request", { request_id: f.request_id, status: "done", content: big })).toMatchObject({ ok: true, status: "done" });
+      expect(await s.call("ack_rules_file_request", { request_id: r.request_id, status: "done", content: "x".repeat(256 * 1024 + 1) })).toMatchObject({ ok: false, error: "content_too_large" });
+      const tooBig = await s.call("ack_rules_file_request", { request_id: r.request_id, status: "done", content: "x".repeat(1024 * 1024 + 1) });
+      expect(tooBig.ok).not.toBe(true);
+    } finally { await u.close(); await s.close(); }
+  }, 20_000);
+});

package/src/rest-explicit-columns-http.test.ts

@@ -45,7 +45,7 @@ const GOLDEN_RESPONSE_KEYS = {
     "process_rss_mb", "process_cpu_pct", "process_uptime_seconds",
     "process_in_flight_count", "network_id", "registered_at", "updated_at",
     "node_id", "session_id", "config_path", "channels", "last_seen_at", "model",
-    "external_schedules", "rules_file_capable", "skills_capable", "runtime", "host", "process_telemetry",
+    "external_schedules", "rules_file_capable", "skills_capable", "files_capable", "runtime", "host", "process_telemetry",
   ],
   task: [
     "task_id", "from_node_id", "from_name", "to_node_id", "to_name", "priority",

package/src/rest-projections.ts

@@ -19,7 +19,7 @@ export const SESSION_REST_COLUMNS = [
   "process_rss_mb", "process_cpu_pct", "process_uptime_seconds",
   "process_in_flight_count", "network_id", "registered_at", "updated_at",
   "node_id", "session_id", "config_path", "channels", "last_seen_at", "model",
-  "external_schedules", "rules_file_capable", "skills_capable",
+  "external_schedules", "rules_file_capable", "skills_capable", "files_capable",
 ] as const;
 
 export const AUDIT_LOG_REST_COLUMNS = [

package/src/rules-file-duplicate-alias.test.ts

@@ -0,0 +1,234 @@
+// Duplicate-alias node rows vs the node pull/ack paths (field report).
+//
+// Re-creating a node under the same alias leaves the old `nodes` row behind, so
+// one alias can own several rows in a network. The pull/ack tools used to
+// resolve the caller by `WHERE alias = ? AND network_id = ?` + `db.get`, i.e.
+// the first row SQLite yields — the stale one. Field shape: the client queued a
+// rules-file read for the live node, the node pulled with its own (bound)
+// token, the hub looked under the stale node_id, answered `request: null`, and
+// the read timed out with only `[rules-file] doorbell received` in the node log.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/rules-dup.db bun test src/rules-file-duplicate-alias.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_rules_dup";
+const USER = "u_rules_dup_owner";
+const ALIAS = "rules-dup-node";
+// Inserted first → the row a plain `db.get` on the alias returns.
+const STALE_ID = "node_rules_dup_stale";
+const LIVE_ID = "node_rules_dup_live";
+const STALE_TOKEN = "tok_rules_dup_stale";
+const LIVE_TOKEN = "tok_rules_dup_live";
+const UNBOUND_TOKEN = "tok_rules_dup_unbound";
+
+function cleanup() {
+  try { db.run("DELETE FROM node_rules_requests WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM node_config_updates WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM audit_log WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM sessions WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM nodes WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedWorld(opts: { liveSession?: boolean } = {}) {
+  db.run(
+    `INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+    [USER, USER],
+  );
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET, NET, USER]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER, NET]);
+  // Stale row first (older created_at AND lower rowid), live row second.
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, '2026-09-16 01:40:40', '2026-09-16 01:40:40')`,
+    [STALE_ID, ALIAS, ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, '2026-09-16 01:42:46', '2026-09-16 01:42:46')`,
+    [LIVE_ID, ALIAS, ALIAS, NET],
+  );
+  for (const [tok, bound, hash] of [
+    [STALE_TOKEN, STALE_ID, "hash_rules_dup_stale"],
+    [LIVE_TOKEN, LIVE_ID, "hash_rules_dup_live"],
+    [UNBOUND_TOKEN, null, "hash_rules_dup_unbound"],
+  ] as const) {
+    db.run(
+      `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at, bound_node_id) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL, ?6)`,
+      [tok, USER, NET, `node:${ALIAS}`, hash, bound],
+    );
+  }
+  if (opts.liveSession !== false) {
+    db.run(
+      `INSERT INTO sessions (resume_id, alias, network_id, node_id, status, updated_at) VALUES (?1, ?2, ?3, ?4, 'idle', datetime('now'))`,
+      [`sdk-${LIVE_ID}`, ALIAS, NET, LIVE_ID],
+    );
+  }
+}
+
+type Identity = { alias: string; isNetworkToken: boolean; tokenId: string };
+const asUser: Identity = { alias: USER, isNetworkToken: false, tokenId: "tok_rules_dup_user" };
+const asLive: Identity = { alias: ALIAS, isNetworkToken: true, tokenId: LIVE_TOKEN };
+const asStale: Identity = { alias: ALIAS, isNetworkToken: true, tokenId: STALE_TOKEN };
+const asUnbound: Identity = { alias: ALIAS, isNetworkToken: true, tokenId: UNBOUND_TOKEN };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "rules-dup-test", version: "1" });
+  registerTools(server, undefined, NET, USER, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "rules-dup-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}`);
+    return JSON.parse(first.text);
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { call, close };
+}
+
+function queuedNodeId(requestId: string): string | undefined {
+  return db.get<{ node_id: string }>("SELECT node_id FROM node_rules_requests WHERE request_id = ?1", requestId)?.node_id;
+}
+
+beforeEach(() => { cleanup(); });
+afterAll(cleanup);
+
+describe("duplicate alias — rules file pull/ack", () => {
+  test("field case: read queued for the live node_id is pulled and acked by the live node's bound token", async () => {
+    seedWorld();
+    const u = await connect(asUser);
+    const n = await connect(asLive);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: LIVE_ID });
+      expect(enq).toMatchObject({ ok: true, op: "read" });
+      const pulled = await n.call("get_rules_file_request", {});
+      expect(pulled).toEqual({ ok: true, request: { request_id: enq.request_id, op: "read" } });
+      const ack = await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "AGENTS.md", exists: true, content: "# live" });
+      expect(ack).toMatchObject({ ok: true, status: "done" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "done", content: "# live" });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+
+  test("a token bound to the stale row can neither pull nor ack the live node's request", async () => {
+    seedWorld();
+    const u = await connect(asUser);
+    const stale = await connect(asStale);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: LIVE_ID });
+      expect(await stale.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+      expect(await stale.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "# forged" }))
+        .toEqual({ ok: true, ignored: "unknown_or_foreign_request" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "pending" });
+    } finally { await u.close(); await stale.close(); }
+  }, 20_000);
+
+  test("the live token does not pull a request queued for the stale row", async () => {
+    seedWorld();
+    const u = await connect(asUser);
+    const n = await connect(asLive);
+    try {
+      await u.call("read_node_rules_file", { node_id: STALE_ID });
+      expect(await n.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+
+  test("client targeting by alias queues under the row the alias's session points at", async () => {
+    seedWorld();
+    const u = await connect(asUser);
+    try {
+      const enq = await u.call("read_node_rules_file", { alias: ALIAS });
+      expect(enq).toMatchObject({ ok: true, op: "read" });
+      expect(queuedNodeId(enq.request_id)).toBe(LIVE_ID);
+      const sk = await u.call("list_node_skills", { alias: ALIAS });
+      expect(sk).toMatchObject({ ok: true });
+      expect(queuedNodeId(sk.request_id)).toBe(LIVE_ID);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("without a session row, alias targeting falls back to the newest row", async () => {
+    seedWorld({ liveSession: false });
+    const u = await connect(asUser);
+    try {
+      const enq = await u.call("read_node_rules_file", { alias: ALIAS });
+      expect(queuedNodeId(enq.request_id)).toBe(LIVE_ID);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("the session mapping wins over recency: alias targeting picks the older row when the session points at it", async () => {
+    seedWorld({ liveSession: false });
+    db.run(
+      `INSERT INTO sessions (resume_id, alias, network_id, node_id, status, updated_at) VALUES (?1, ?2, ?3, ?4, 'idle', datetime('now'))`,
+      [`sdk-${STALE_ID}`, ALIAS, NET, STALE_ID],
+    );
+    const u = await connect(asUser);
+    try {
+      const enq = await u.call("read_node_rules_file", { alias: ALIAS });
+      expect(queuedNodeId(enq.request_id)).toBe(STALE_ID);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("a token bound to a node whose row is gone does not fall back to another row with its alias", async () => {
+    seedWorld();
+    db.run("UPDATE api_tokens SET bound_node_id = 'node_rules_dup_deleted' WHERE token_id = ?1", [STALE_TOKEN]);
+    const u = await connect(asUser);
+    const stale = await connect(asStale);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: LIVE_ID });
+      expect(await stale.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "pending" });
+    } finally { await u.close(); await stale.close(); }
+  }, 20_000);
+
+  test("an unbound legacy token resolves its alias to the session-mapped row", async () => {
+    seedWorld();
+    const u = await connect(asUser);
+    const n = await connect(asUnbound);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: LIVE_ID });
+      expect(await n.call("get_rules_file_request", {})).toEqual({ ok: true, request: { request_id: enq.request_id, op: "read" } });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});
+
+describe("duplicate alias — config update pull/ack", () => {
+  function queueUpdate(nodeId: string, updateId: string) {
+    db.run(
+      `INSERT INTO node_config_updates (update_id, node_id, network_id, patch_json, apply_mode, base_revision, status, created_at, created_by_token) VALUES (?1, ?2, ?3, '{"model":"m"}', 'hot', 0, 'pending', ?4, 'tok_rules_dup_user')`,
+      [updateId, nodeId, NET, Date.now()],
+    );
+  }
+
+  test("the live node's bound token pulls and acks its own pending update", async () => {
+    seedWorld();
+    queueUpdate(LIVE_ID, "cu_rules_dup_live");
+    const n = await connect(asLive);
+    try {
+      const pulled = await n.call("get_config_update", {});
+      expect(pulled.update?.update_id).toBe("cu_rules_dup_live");
+      const ack = await n.call("ack_config_update", { update_id: "cu_rules_dup_live", status: "applied", new_revision: 1 });
+      expect(ack.ok).toBe(true);
+      expect(ack.ignored).toBeUndefined();
+      expect(db.get<{ status: string }>("SELECT status FROM node_config_updates WHERE update_id = 'cu_rules_dup_live'")?.status).toBe("applied");
+    } finally { await n.close(); }
+  }, 20_000);
+
+  test("a token bound to the stale row cannot pull or ack the live node's update", async () => {
+    seedWorld();
+    queueUpdate(LIVE_ID, "cu_rules_dup_live2");
+    const stale = await connect(asStale);
+    try {
+      expect((await stale.call("get_config_update", {})).update).toBeNull();
+      await stale.call("ack_config_update", { update_id: "cu_rules_dup_live2", status: "applied", new_revision: 1 });
+      expect(db.get<{ status: string }>("SELECT status FROM node_config_updates WHERE update_id = 'cu_rules_dup_live2'")?.status).toBe("pending");
+    } finally { await stale.close(); }
+  }, 20_000);
+});

package/src/server.ts

@@ -1683,6 +1683,7 @@ return Bun.serve({
           // app#225 follow-up — sqlite INTEGER 0/1 → boolean on the wire.
           rules_file_capable: s.rules_file_capable === 1,
           skills_capable: s.skills_capable === 1,
+          files_capable: s.files_capable === 1,
           model: s.model ?? null,
           runtime: normalizeRuntime(s.agent),
           host: {

package/src/task-consumption.test.ts

@@ -126,6 +126,17 @@ describe("task consumed_at identity and lifecycle", () => {
     expect([...first.tasks, ...second.tasks].some((task: any) => task.task_id === "foreign-node-row")).toBe(false);
     expect((await call(handler, { from_node_id: `id_${NODE_B}`, durable_cursor: true, limit: 100 })).error).toBe("from_node_id_identity_mismatch");
   });
+  test("a legacy unbound node token is refused the durable cursor even for its own node", async () => {
+    // Pre-RFC-036 tokens carry no immutable node binding. The durable outbox
+    // cursor must stay closed to them (no bind-on-first-use); agent-node
+    // degrades to inbox-only compensation on this exact error code.
+    db.run("UPDATE api_tokens SET bound_node_id = NULL WHERE token_id = ?1", [`token_${NODE_A}`]);
+    const handler = toolsFor({ alias: NODE_A, nodeToken: true }).list_tasks;
+    expect((await call(handler, { from_node_id: `id_${NODE_A}`, durable_cursor: true, limit: 10 })).error).toBe("from_node_id_identity_mismatch");
+    expect((await call(handler, { from_node_id: `id_${NODE_B}`, durable_cursor: true, limit: 10 })).error).toBe("from_node_id_identity_mismatch");
+    const bound = db.get<{ bound_node_id: string | null }>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", `token_${NODE_A}`);
+    expect(bound?.bound_node_id).toBeNull();
+  });
   test("terminal sequence paginates beyond 2000 and admits late completion of an old task", async () => {
     db.run(
       `INSERT INTO tasks (task_id, from_node_id, from_name, to_name, status, content, network_id, created_at)

package/src/tools.ts

@@ -721,8 +721,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       rules_file_capable: z.literal(true).optional(),
       // Node skills view — same doorbell, ops skills_list / skill_read.
       skills_capable: z.literal(true).optional(),
+      // Project folder view — same doorbell, ops files_list / file_read.
+      files_capable: z.literal(true).optional(),
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -931,6 +933,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         if (skillsCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
           db.run("UPDATE sessions SET skills_capable = 1 WHERE resume_id = ?1", [resume_id]);
         }
+        if (filesCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run("UPDATE sessions SET files_capable = 1 WHERE resume_id = ?1", [resume_id]);
+        }
         if (host || proc) {
           db.run(
             `INSERT INTO agent_telemetry (id, network_id, resume_id, alias, hostname, ip, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, created_at)
@@ -2982,6 +2987,51 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // One alias can own several `nodes` rows in a network: re-creating a node
+  // under the same alias leaves the old row behind, and `db.get` on
+  // `WHERE alias = ? AND network_id = ?` then returns whichever row SQLite
+  // happens to yield first. A field report showed the result: the client
+  // queued a rules-file read for the live node, the node pulled with its own
+  // token, the hub resolved its alias to the stale row, found nothing pending
+  // and returned `request: null` until the read timed out.
+  //
+  // resolveNodeByAlias: prefer the row the alias's session points at (sessions
+  // are UNIQUE per network+alias and carry the node_id that last reported),
+  // then the newest row. Used where only an alias is known (a client targeting
+  // by alias; unbound legacy node tokens).
+  const resolveNodeByAlias = (alias: string, networkId: string) =>
+    db.get<{ node_id: string; alias: string; network_id: string | null }>(
+      `SELECT n.node_id, n.alias, n.network_id FROM nodes n
+         LEFT JOIN sessions s ON s.alias = n.alias AND s.network_id = n.network_id AND s.node_id = n.node_id
+        WHERE n.alias = ?1 AND n.network_id = ?2
+        ORDER BY (s.node_id IS NOT NULL) DESC, n.created_at DESC, n.rowid DESC
+        LIMIT 1`,
+      alias,
+      networkId,
+    ) ?? null;
+  // resolveCallerNode: the node a network token pulls/acks for. A token bound
+  // to a node resolves to exactly that node (and never to another row that
+  // shares its alias); only unbound legacy tokens fall back to the alias.
+  // Callers have already required callerTokenIsNetwork + enforceNetworkId +
+  // callerAlias.
+  const resolveCallerNode = (): { node_id: string; network_id: string | null } | null => {
+    const bound = callerTokenId
+      ? db.get<{ bound_node_id: string | null }>(
+          "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1 AND network_id = ?2",
+          callerTokenId,
+          enforceNetworkId,
+        )?.bound_node_id ?? null
+      : null;
+    if (bound) {
+      return db.get<{ node_id: string; network_id: string | null }>(
+        "SELECT node_id, network_id FROM nodes WHERE node_id = ?1 AND network_id = ?2",
+        bound,
+        enforceNetworkId,
+      ) ?? null;
+    }
+    return resolveNodeByAlias(callerAlias!, enforceNetworkId!);
+  };
+
   server.tool(
     "get_config_update",
     "Node pulls its pending config update (called from agent-node when SSE config_update doorbell arrives). RFC-024.",
@@ -3005,11 +3055,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Unconditional network_id filter (was previously conditional on
       // enforceNetworkId being set; the new ntok guard above guarantees
       // it's non-null so the filter is always applied).
-      const node = db.get<any>(
-        "SELECT node_id, network_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        callerAlias,
-        enforceNetworkId,
-      );
+      const node = resolveCallerNode();
       if (!node) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, update: null }) }] };
       }
@@ -3062,11 +3108,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Cross-tenant guard: the ack-er must own the update being acked.
       // Resolve node by caller's alias under the enforced network.
       // Network filter is unconditional (guard above guarantees non-null).
-      const node = db.get<any>(
-        "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        callerAlias,
-        enforceNetworkId,
-      );
+      const node = resolveCallerNode();
       if (!node) {
         // Silently ignore stale ack — return ok so the node doesn't retry forever.
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, ignored: "alias_unknown" }) }] };
@@ -3125,11 +3167,42 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const SKILL_NAME_RE = /^[A-Za-z0-9._-]{1,64}$/;
   const isSkillsOp = (op: string) => op === "skills_list" || op === "skill_read";
 
+  // Project folder view — files_list / file_read ride the same queue + doorbell.
+  // `content` carries a path RELATIVE to the node's work dir. The hub refuses
+  // absolute paths, `..` segments, backslashes and NUL before any row exists;
+  // the node re-validates, realpath-contains the result in its work dir and
+  // refuses secret-looking files (node-files.ts). Stricter than skills on the
+  // caller: a node token may not browse another node's disk, and only the token
+  // that asked can read the answer.
+  const NODE_FILE_PATH_MAX = 1024;
+  const NODE_FILES_RESULT_MAX_CHARS = 1024 * 1024;
+  const isFilesOp = (op: string) => op === "files_list" || op === "file_read";
+  const normalizeNodeRelPath = (raw: unknown): string | null => {
+    if (raw === undefined || raw === null) return "";
+    if (typeof raw !== "string" || raw.length > NODE_FILE_PATH_MAX) return null;
+    if (raw.includes("\0") || raw.includes("\\")) return null;
+    if (raw.startsWith("/") || raw.startsWith("~") || /^[A-Za-z]:/.test(raw)) return null;
+    const segs = raw.split("/").filter((s) => s !== "" && s !== ".");
+    if (segs.some((s) => s === "..")) return null;
+    return segs.join("/");
+  };
+
   const enqueueRulesFileRequest = (
-    op: "read" | "write" | "skills_list" | "skill_read",
+    op: "read" | "write" | "skills_list" | "skill_read" | "files_list" | "file_read",
     a: { node_id?: string; child_node_id?: string; alias?: string; network_id?: string; content?: string },
   ) => {
     const effectiveNetId = getNetworkId(a.network_id);
+    if (isFilesOp(op)) {
+      if (callerTokenIsNetwork) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_cannot_browse_files", message: "a node token cannot browse another node's project folder; use a user login" }) }] };
+      }
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, `${op} node files`);
+      const rel = normalizeNodeRelPath(a.content);
+      if (rel === null || (op === "file_read" && rel === "")) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_path", reason: "path must be relative to the node work dir: no leading / or ~, no .. segment, no backslash or NUL, at most 1024 chars" }) }] };
+      }
+      a = { ...a, content: rel };
+    }
     if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, isSkillsOp(op) ? `${op} node skills` : `${op} rules file`);
     if (op === "skill_read" && (typeof a.content !== "string" || !SKILL_NAME_RE.test(a.content) || a.content === "." || a.content === "..")) {
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_skill_name", reason: "name must match [A-Za-z0-9._-]{1,64} and not be . or .." }) }] };
@@ -3155,22 +3228,23 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       node = resolved.row as any;
     } else {
       const scopeNet = effectiveNetId || "default";
-      const byAlias = db.get<{ node_id: string; alias: string; network_id: string | null }>(
-        "SELECT node_id, alias, network_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        a.alias,
-        scopeNet,
-      );
+      const byAlias = resolveNodeByAlias(a.alias, scopeNet);
       if (byAlias) {
         node = byAlias;
       } else {
         const session = db.get<{ alias: string; network_id: string | null }>(
-          isSkillsOp(op)
+          isFilesOp(op)
+            ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND files_capable = 1 ORDER BY updated_at DESC LIMIT 1"
+            : isSkillsOp(op)
             ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND skills_capable = 1 ORDER BY updated_at DESC LIMIT 1"
             : "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND rules_file_capable = 1 ORDER BY updated_at DESC LIMIT 1",
           a.alias,
           scopeNet,
         );
         if (!session) {
+          if (isFilesOp(op)) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "files_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its project folder (its channel server may be too old)" }) }] };
+          }
           return isSkillsOp(op)
             ? { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "skills_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its skills (its channel server may be too old)" }) }] }
             : { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "rules_file_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve rules files (its channel server may be too old)" }) }] };
@@ -3194,7 +3268,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     // Separate single-flight lanes: the client opens the rules file and the
     // skills list together; one must not block the other.
     const inFlight = db.get<{ request_id: string; created_at: number; pulled_at: number | null }>(
-      isSkillsOp(op)
+      isFilesOp(op)
+        ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('files_list', 'file_read') ORDER BY created_at DESC LIMIT 1"
+        : isSkillsOp(op)
         ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('skills_list', 'skill_read') ORDER BY created_at DESC LIMIT 1"
         : "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('read', 'write') ORDER BY created_at DESC LIMIT 1",
       nodeId,
@@ -3214,7 +3290,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     const networkId = node.network_id || "default";
     db.run(
       `INSERT INTO node_rules_requests (request_id, node_id, network_id, op, content, status, created_at, created_by_token) VALUES (?1, ?2, ?3, ?4, ?5, 'pending', ?6, ?7)`,
-      [requestId, nodeId, networkId, op, op === "write" || op === "skill_read" ? a.content! : null, Date.now(), callerTokenId || "unknown"],
+      [requestId, nodeId, networkId, op, op === "write" || op === "skill_read" || isFilesOp(op) ? a.content! : null, Date.now(), callerTokenId || "unknown"],
     );
     pushEvent(node.alias, { type: "rules_file", request_id: requestId }, networkId);
     return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request_id: requestId, op }) }] };
@@ -3266,6 +3342,30 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     async ({ node_id, child_node_id, alias, name, network_id }) => enqueueRulesFileRequest("skill_read", { node_id, child_node_id, alias, content: name, network_id }),
   );
 
+  server.tool(
+    "list_node_files",
+    "Ask a node to list one directory level of its work dir (project folder view, read-only). `path` is relative to the work dir (default: the root); absolute paths and .. are refused. Poll get_rules_file_result — content is JSON {path, entries:[{name,type,size?,mtime?,hidden_reason?,no_descend?}], truncated, total}. User logins only.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported files_capable."),
+      path: z.string().max(NODE_FILE_PATH_MAX).optional().describe("Directory relative to the node's work dir; omit or \"\" for the root."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, path: relPath, network_id }) => enqueueRulesFileRequest("files_list", { node_id, child_node_id, alias, content: relPath ?? "", network_id }),
+  );
+
+  server.tool(
+    "read_node_file",
+    "Ask a node for one text file under its work dir (project folder view, read-only, 256 KiB cap; binary / too large → size only; secret-looking files → name only). `path` is relative to the work dir. Poll get_rules_file_result — content is JSON {path, name, kind, size?, mtime?, content?, hidden_reason?}. User logins only.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported files_capable."),
+      path: z.string().min(1).max(NODE_FILE_PATH_MAX).describe("File path relative to the node's work dir."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, path: relPath, network_id }) => enqueueRulesFileRequest("file_read", { node_id, child_node_id, alias, content: relPath, network_id }),
+  );
+
   server.tool(
     "get_rules_file_request",
     "Node pulls its oldest pending rules-file request (called from agent-node when the SSE rules_file doorbell arrives). app#225.",
@@ -3278,11 +3378,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!callerAlias) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "alias_required" }) }] };
       }
-      const node = db.get<any>(
-        "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        callerAlias,
-        enforceNetworkId,
-      );
+      const node = resolveCallerNode();
       // app#225 follow-up — no `nodes` row: this is a session-only target
       // (claude-code). Its queue key is `session:<alias>`, always paired with the
       // caller's network so a same-named alias in another network never matches.
@@ -3307,7 +3403,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             request: {
               request_id: req.request_id,
               op: req.op,
-              ...(req.op === "write" || req.op === "skill_read" ? { content: req.content ?? "" } : {}),
+              ...(req.op === "write" || req.op === "skill_read" || isFilesOp(req.op) ? { content: req.content ?? "" } : {}),
             },
           }),
         }],
@@ -3323,7 +3419,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       status: z.enum(["done", "failed"]),
       file_name: z.string().max(64).optional(),
       exists: z.boolean().optional(),
-      content: z.string().max(RULES_FILE_MAX_BYTES).optional(),
+      // Files results (JSON listing / a 256 KiB file, escaped) may exceed the rules
+      // cap; the per-op cap is enforced below once the row's op is known.
+      content: z.string().max(NODE_FILES_RESULT_MAX_CHARS).optional(),
       error: z.string().max(2000).optional(),
     },
     async ({ request_id: requestId, status, file_name: fileName, exists, content, error: ackError }) => {
@@ -3333,14 +3431,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!callerAlias) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "alias_required" }) }] };
       }
-      const node = db.get<any>(
-        "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        callerAlias,
-        enforceNetworkId,
-      );
+      const node = resolveCallerNode();
       const queueKey: string = node ? node.node_id : `session:${callerAlias}`;
       const req = db.get<any>(
-        "SELECT request_id, node_id, network_id, status FROM node_rules_requests WHERE request_id = ?1",
+        "SELECT request_id, node_id, network_id, status, op FROM node_rules_requests WHERE request_id = ?1",
         requestId,
       );
       // 跨租户闸：只能 ack 自己的请求；别人的当不存在处理。session 键另外核网络。
@@ -3350,6 +3444,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (req.status === "done" || req.status === "failed" || req.status === "timeout") {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, ignored: "already_terminal", current_status: req.status }) }] };
       }
+      if (typeof content === "string" && !isFilesOp(req.op) && content.length > RULES_FILE_MAX_BYTES) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "content_too_large", max: RULES_FILE_MAX_BYTES }) }] };
+      }
       db.run(
         `UPDATE node_rules_requests SET status = ?1, acked_at = ?2, file_name = ?3, file_exists = ?4, result_content = ?5, error = ?6 WHERE request_id = ?7`,
         [
@@ -3374,11 +3471,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const effectiveNetId = getNetworkId(clientNetId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "read rules file result");
       const row = db.get<any>(
-        "SELECT request_id, node_id, network_id, op, status, file_name, file_exists, result_content, error, created_at, pulled_at, acked_at FROM node_rules_requests WHERE request_id = ?1",
+        "SELECT request_id, node_id, network_id, op, status, file_name, file_exists, result_content, error, created_at, pulled_at, acked_at, created_by_token FROM node_rules_requests WHERE request_id = ?1",
         requestId,
       );
       // SEC-1：结果行的网络必须等于调用方作用域，否则当不存在。
-      if (!row || row.network_id !== (effectiveNetId || "default")) {
+      // Project folder results: only the (user) token that asked may read them.
+      const foreignFilesRow = !!row && isFilesOp(row.op) && (callerTokenIsNetwork || row.created_by_token !== (callerTokenId || "unknown"));
+      if (!row || row.network_id !== (effectiveNetId || "default") || foreignFilesRow) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found", request_id: requestId }) }] };
       }
       let status: string = row.status;