@sleep2agi/commhub-server 0.9.0-preview.59 → 0.9.0-preview.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.59",
+  "version": "0.9.0-preview.60",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -580,6 +580,16 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_nrr_node_status ON node_rules_requests(node_id, status);
   CREATE INDEX IF NOT EXISTS idx_nrr_network ON node_rules_requests(network_id);
 `);
+// Content retention (node-request-retention.ts): file bytes in content /
+// result_content are purged after the first terminal read (+grace) or a TTL;
+// these two columns record when, so the row itself survives as audit metadata.
+for (const col of ["first_read_at INTEGER", "content_purged_at INTEGER"]) {
+  try { db.exec(`ALTER TABLE node_rules_requests ADD COLUMN ${col}`); } catch {}
+}
+db.exec(`
+  CREATE INDEX IF NOT EXISTS idx_nrr_created ON node_rules_requests(created_at);
+  CREATE INDEX IF NOT EXISTS idx_nrr_first_read ON node_rules_requests(first_read_at);
+`);
 
 // ── V3: networks table ──
 db.exec(`

package/src/node-request-retention.test.ts

@@ -0,0 +1,281 @@
+// node_rules_requests content retention — privacy purge of node file bytes.
+//
+// Real MCP in-process transport, same harness as rules-file-transport.test.ts.
+// Covers:
+//   1. read result is handed out on the first terminal read, still handed out to
+//      a second reader inside the grace window (the desktop app's
+//      request_in_flight → follow path), then purged: status + metadata stay,
+//      `content_purged: true` replaces content.
+//   2. a caller outside the row's network can neither read nor stamp/purge it.
+//   3. TTL sweep: >24h content cleared (stale pending flipped to timeout first),
+//      >30d rows deleted, fresh unread rows untouched.
+//   4. write payload (`content` column) is cleared; skill_read name is kept.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/nrr.db bun test src/node-request-retention.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { CONTENT_GRACE_MS, CONTENT_TTL_MS, ROW_TTL_MS, sweepNodeRequestContent } from "./node-request-retention.js";
+import { sweepRetention } from "./retention.js";
+
+const NET = "net_nrr";
+const OTHER_NET = "net_nrr_other";
+const USER = "u_nrr_owner";
+const NODE_ID = "node_nrr_claude";
+const NODE_ALIAS = "nrr-claude";
+const NODE_TOKEN = "tok_nrr_node";
+
+function cleanup() {
+  for (const net of [NET, OTHER_NET]) {
+    try { db.run("DELETE FROM node_rules_requests WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM audit_log WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM network_members WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [net]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedWorld() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER, USER]);
+  for (const net of [NET, OTHER_NET]) {
+    db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [net, net, USER]);
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER, net]);
+  }
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [NODE_ID, NODE_ALIAS, NODE_ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [NODE_TOKEN, USER, NET, `node:${NODE_ALIAS}`, "hash_nrr_node"],
+  );
+}
+
+type Identity = { net: string; alias: string; isNetworkToken: boolean; tokenId: string };
+const asUser: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_nrr_user" };
+// Same human, scoped to the OTHER network: passes canWrite there, but the row
+// lives in NET — SEC-1 must answer request_not_found and touch nothing.
+const asUserOtherScope: Identity = { net: OTHER_NET, alias: USER, isNetworkToken: false, tokenId: "tok_nrr_user_other" };
+const asNode: Identity = { net: NET, alias: NODE_ALIAS, isNetworkToken: true, tokenId: NODE_TOKEN };
+// Same user, same network, a different login token: #1999 makes project-file
+// results readable only by the token that asked.
+const asUserOtherLogin: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_nrr_user_other_login" };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "nrr-test", version: "1" });
+  registerTools(server, undefined, id.net, USER, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "nrr-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}`);
+    return JSON.parse(first.text);
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { call, close };
+}
+
+type Row = { status: string; content: string | null; result_content: string | null; file_name: string | null; first_read_at: number | null; content_purged_at: number | null; op: string };
+const rowOf = (id: string) => db.get<Row>(
+  "SELECT status, content, result_content, file_name, first_read_at, content_purged_at, op FROM node_rules_requests WHERE request_id = ?1", id,
+);
+const ageFirstRead = (id: string, ms: number) => db.run("UPDATE node_rules_requests SET first_read_at = first_read_at - ?1 WHERE request_id = ?2", [ms, id]);
+const ageCreated = (id: string, ms: number) => db.run("UPDATE node_rules_requests SET created_at = created_at - ?1 WHERE request_id = ?2", [ms, id]);
+
+async function readRoundTrip(u: Awaited<ReturnType<typeof connect>>, n: Awaited<ReturnType<typeof connect>>, body: string) {
+  const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+  expect(enq.ok).toBe(true);
+  await n.call("get_rules_file_request", {});
+  await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "CLAUDE.md", exists: true, content: body });
+  return enq.request_id as string;
+}
+
+beforeEach(() => { cleanup(); seedWorld(); });
+afterAll(cleanup);
+
+describe("node_rules_requests — read once, purge after grace", () => {
+  test("content returned on first terminal read and to a follower inside the grace window, then purged", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const body = "# secret rules\n";
+      const rid = await readRoundTrip(u, n, body);
+      expect(rowOf(rid)!.first_read_at).toBeNull();
+
+      const first = await u.call("get_rules_file_result", { request_id: rid });
+      expect(first).toMatchObject({ ok: true, status: "done", content: body, file_name: "CLAUDE.md", exists: true });
+      expect(first.content_purged).toBeUndefined();
+      const stamped = rowOf(rid)!.first_read_at;
+      expect(stamped).not.toBeNull();
+
+      // Second reader (app follow path) inside the grace window still gets it,
+      // and the stamp is NOT pushed forward (a poller can't keep it alive).
+      sweepNodeRequestContent();
+      const follower = await u.call("get_rules_file_result", { request_id: rid });
+      expect(follower.content).toBe(body);
+      expect(rowOf(rid)!.first_read_at).toBe(stamped);
+
+      ageFirstRead(rid, CONTENT_GRACE_MS + 1);
+      // Any enqueue runs the opportunistic sweep.
+      await u.call("list_node_skills", { node_id: NODE_ID });
+      const row = rowOf(rid)!;
+      expect(row.result_content).toBeNull();
+      expect(row.content_purged_at).not.toBeNull();
+      expect(row.status).toBe("done");
+      expect(row.file_name).toBe("CLAUDE.md");
+
+      const after = await u.call("get_rules_file_result", { request_id: rid });
+      expect(after).toMatchObject({ ok: true, status: "done", file_name: "CLAUDE.md", exists: true, content_purged: true });
+      expect("content" in after).toBe(false);
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+
+  test("non-terminal polls do not stamp; a never-read result keeps its content until TTL", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      expect((await u.call("get_rules_file_result", { request_id: enq.request_id })).status).toBe("pending");
+      expect(rowOf(enq.request_id)!.first_read_at).toBeNull();
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "CLAUDE.md", exists: true, content: "x" });
+      sweepNodeRequestContent(Date.now() + CONTENT_GRACE_MS * 10);
+      expect(rowOf(enq.request_id)!.result_content).toBe("x");
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — authorization", () => {
+  test("a caller outside the row's network gets request_not_found and cannot stamp or purge it", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    const o = await connect(asUserOtherScope);
+    try {
+      const rid = await readRoundTrip(u, n, "# mine\n");
+      for (let i = 0; i < 3; i++) {
+        expect(await o.call("get_rules_file_result", { request_id: rid })).toMatchObject({ ok: false, error: "request_not_found" });
+      }
+      // Also pass the owner's network_id explicitly — scope is the token's, not the arg's.
+      expect((await o.call("get_rules_file_result", { request_id: rid, network_id: NET })).content).toBeUndefined();
+      expect(rowOf(rid)!.first_read_at).toBeNull();
+      sweepNodeRequestContent(Date.now() + CONTENT_GRACE_MS * 10);
+      expect(rowOf(rid)!.result_content).toBe("# mine\n");
+      // The rightful requester still gets it.
+      expect((await u.call("get_rules_file_result", { request_id: rid })).content).toBe("# mine\n");
+    } finally { await u.close(); await n.close(); await o.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — project files (#1999)", () => {
+  test("another login token can't read or stamp a file_read row; the requester's read starts the grace clock; path is kept", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    const other = await connect(asUserOtherLogin);
+    try {
+      const enq = await u.call("read_node_file", { node_id: NODE_ID, path: "docs/plan.md" });
+      expect(enq.ok).toBe(true);
+      await n.call("get_rules_file_request", {});
+      const body = JSON.stringify({ path: "docs/plan.md", kind: "text", content: "TOP SECRET PLAN" });
+      await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: body });
+
+      expect(await other.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+      expect(rowOf(enq.request_id)!.first_read_at).toBeNull();
+
+      expect((await u.call("get_rules_file_result", { request_id: enq.request_id })).content).toBe(body);
+      ageFirstRead(enq.request_id, CONTENT_GRACE_MS + 1);
+      sweepNodeRequestContent();
+      const row = rowOf(enq.request_id)!;
+      expect(row.result_content).toBeNull();
+      expect(row.content).toBe("docs/plan.md");
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "done", content_purged: true });
+    } finally { await u.close(); await n.close(); await other.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — write payload", () => {
+  test("write body in `content` is cleared after the grace window; skill_read name is kept", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const body = "# new rules with a secret\n";
+      const w = await u.call("write_node_rules_file", { node_id: NODE_ID, content: body });
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: w.request_id, status: "done", file_name: "CLAUDE.md", exists: true });
+      expect(rowOf(w.request_id)!.content).toBe(body);
+
+      const s = await u.call("read_node_skill", { node_id: NODE_ID, name: "my-skill" });
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: s.request_id, status: "done", content: JSON.stringify({ name: "my-skill", content: "SKILL BODY" }) });
+
+      const wr = await u.call("get_rules_file_result", { request_id: w.request_id });
+      expect(wr).toMatchObject({ status: "done", op: "write" });
+      expect(wr.content).toBeUndefined();
+      expect((await u.call("get_rules_file_result", { request_id: s.request_id })).content).toContain("SKILL BODY");
+
+      ageFirstRead(w.request_id, CONTENT_GRACE_MS + 1);
+      ageFirstRead(s.request_id, CONTENT_GRACE_MS + 1);
+      sweepNodeRequestContent();
+
+      const wRow = rowOf(w.request_id)!;
+      expect(wRow.content).toBeNull();
+      expect(wRow.content_purged_at).not.toBeNull();
+      expect(wRow.status).toBe("done");
+      const sRow = rowOf(s.request_id)!;
+      expect(sRow.result_content).toBeNull();
+      expect(sRow.content).toBe("my-skill");
+      expect(await u.call("get_rules_file_result", { request_id: w.request_id })).toMatchObject({ status: "done", op: "write", content_purged: true });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — TTL sweep", () => {
+  test(">24h content cleared (stale pending write expired first, so no node can pull an emptied write); >30d rows deleted; fresh rows kept", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      // Create everything first, age afterwards: every enqueue runs the sweep.
+      const oldRead = await readRoundTrip(u, n, "# old, never fetched\n");
+      const ancient = await readRoundTrip(u, n, "# ancient\n");
+      const fresh = await readRoundTrip(u, n, "# fresh, never fetched\n");
+      // A write the node never pulled (offline for a day). Enqueued last so
+      // single-flight doesn't refuse it.
+      const w = await u.call("write_node_rules_file", { node_id: NODE_ID, content: "# stale write body\n" });
+      expect(w.ok).toBe(true);
+      ageCreated(oldRead, CONTENT_TTL_MS + 60_000);
+      ageCreated(ancient, ROW_TTL_MS + 60_000);
+      ageCreated(w.request_id, CONTENT_TTL_MS + 60_000);
+
+      const r = sweepRetention();
+      expect(r.nodeRequests.deleted).toBe(1);
+      expect(r.nodeRequests.timedOut).toBe(1);
+      expect(r.nodeRequests.purged).toBe(2);
+
+      expect(rowOf(ancient)).toBeNull();
+      const o = rowOf(oldRead)!;
+      expect(o.result_content).toBeNull();
+      expect(o.status).toBe("done");
+      expect(o.file_name).toBe("CLAUDE.md");
+      expect(rowOf(fresh)!.result_content).toBe("# fresh, never fetched\n");
+
+      const wr = rowOf(w.request_id)!;
+      expect(wr.status).toBe("timeout");
+      expect(wr.content).toBeNull();
+      // The node coming back must not receive the emptied write.
+      expect(await n.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+
+      expect(await u.call("get_rules_file_result", { request_id: oldRead })).toMatchObject({ status: "done", content_purged: true });
+
+      // Idempotent.
+      const again = sweepNodeRequestContent();
+      expect(again).toEqual({ timedOut: 0, purged: 0, deleted: 0 });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});

package/src/node-request-retention.ts

@@ -0,0 +1,104 @@
+// node_rules_requests content retention (privacy).
+//
+// The rules-file / skills (and project-folder) queue carries **node file
+// contents** through the hub: `result_content` holds what the node sent back
+// (CLAUDE.md / AGENTS.md, SKILL.md, directory listings, file bodies) and
+// `content` holds write payloads (the full new rules file). Before this module
+// nothing ever cleared or deleted those rows — every file anyone ever opened in
+// the desktop app stayed in the hub DB forever.
+//
+// Policy (metadata — status, op, file_name, file_exists, error, timestamps,
+// requester — is kept for audit; only file bytes are dropped):
+//
+//   1. Read-once + grace: the first time an authorized requester reads a
+//      TERMINAL result (done/failed/timeout) the row is stamped `first_read_at`.
+//      CONTENT_GRACE_MS later the content is purged. Not immediate, because the
+//      desktop app has a real second-reader path: when enqueue is rejected with
+//      `request_in_flight` the app FOLLOWS the existing request id
+//      (requestIdToFollow → waitForRulesFileResult, NodeRulesSection /
+//      NodeSkillsSection / NodeFilesSection). Two windows (or a remount) polling
+//      the same request reach terminal within one poll interval (≤ 3 s) of each
+//      other; an immediate purge would hand the second one `done` with no
+//      content and NodeRulesSection would load an EMPTY editor (`content ?? ''`)
+//      that a Save would then write back to the node. 60 s is 20× the slowest
+//      poll interval.
+//   2. TTL: anything older than CONTENT_TTL_MS gets its content purged whether
+//      or not anyone ever read it (e.g. the app was closed mid-request). A
+//      still-pending/in_progress row that old is first flipped to `timeout`, so
+//      a node that comes back after a day can never pull a write whose payload
+//      was just nulled (it would otherwise receive `content: ""` and write an
+//      empty rules file).
+//   3. Rows older than ROW_TTL_MS are deleted outright.
+//
+// Every statement is bounded (LIMIT via `request_id IN (SELECT … LIMIT n)` —
+// SQLite's UPDATE/DELETE … LIMIT needs a compile flag we don't control) and
+// uses an index (idx_nrr_created / idx_nrr_first_read). It runs
+// opportunistically on enqueue and on terminal reads, from a one-shot timer
+// armed at the first terminal read, and from the hourly retention sweeper
+// (retention.ts) — so the first sweep after deploy also clears every old row
+// that predates this module.
+
+import { db } from "./db.js";
+
+export const CONTENT_GRACE_MS = 60_000;
+export const CONTENT_TTL_MS = 24 * 60 * 60 * 1000;
+export const ROW_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const SWEEP_BATCH = 500;
+
+export type NodeRequestSweepResult = { timedOut: number; purged: number; deleted: number };
+
+// `content` is only a file body for op=write. For skill_read / file_read it is
+// the skill name / relative path the requester asked for — audit metadata, kept.
+const PURGE_SET =
+  "result_content = NULL, content = CASE WHEN op = 'write' THEN NULL ELSE content END, content_purged_at = ?1";
+
+function purgeWhere(where: string, params: (string | number)[], now: number): number {
+  const r = db.run(
+    `UPDATE node_rules_requests SET ${PURGE_SET} WHERE request_id IN (SELECT request_id FROM node_rules_requests WHERE content_purged_at IS NULL AND ${where} LIMIT ${SWEEP_BATCH})`,
+    [now, ...params],
+  );
+  return r.changes ?? 0;
+}
+
+export function sweepNodeRequestContent(now: number = Date.now()): NodeRequestSweepResult {
+  const out: NodeRequestSweepResult = { timedOut: 0, purged: 0, deleted: 0 };
+  try {
+    // Delete first so rows past the row TTL aren't pointlessly purged, then
+    // expire stale non-terminal rows, then purge.
+    out.deleted = db.run(
+      `DELETE FROM node_rules_requests WHERE request_id IN (SELECT request_id FROM node_rules_requests WHERE created_at < ?1 LIMIT ${SWEEP_BATCH})`,
+      [now - ROW_TTL_MS],
+    ).changes ?? 0;
+    const ttlCutoff = now - CONTENT_TTL_MS;
+    out.timedOut = db.run(
+      `UPDATE node_rules_requests SET status = 'timeout', acked_at = ?1, error = ?2 WHERE request_id IN (SELECT request_id FROM node_rules_requests WHERE created_at < ?3 AND status IN ('pending', 'in_progress') LIMIT ${SWEEP_BATCH})`,
+      [now, "expired by retention sweep (node never answered)", ttlCutoff],
+    ).changes ?? 0;
+    // ?1 = now (PURGE_SET), ?2… = where params.
+    out.purged += purgeWhere("first_read_at IS NOT NULL AND first_read_at <= ?2 AND status IN ('done', 'failed', 'timeout')", [now - CONTENT_GRACE_MS], now);
+    out.purged += purgeWhere("created_at < ?2 AND status IN ('done', 'failed', 'timeout')", [ttlCutoff], now);
+  } catch (e: any) {
+    console.log(`[commhub retention] node_rules_requests sweep failed: ${e?.message ?? e}`);
+  }
+  return out;
+}
+
+/** Called by get_rules_file_result AFTER the requester passed every auth check
+ *  and only for a terminal status. Stamps the first terminal read, arms a
+ *  one-shot purge for after the grace window, and reports whether this row's
+ *  content is already gone. */
+export function noteTerminalResultRead(requestId: string, now: number = Date.now()): { purged: boolean } {
+  const r = db.run(
+    "UPDATE node_rules_requests SET first_read_at = ?1 WHERE request_id = ?2 AND first_read_at IS NULL",
+    [now, requestId],
+  );
+  if ((r.changes ?? 0) > 0) {
+    const t = setTimeout(() => { sweepNodeRequestContent(); }, CONTENT_GRACE_MS + 1_000);
+    (t as any).unref?.();
+  }
+  const row = db.get<{ content_purged_at: number | null }>(
+    "SELECT content_purged_at FROM node_rules_requests WHERE request_id = ?1",
+    requestId,
+  );
+  return { purged: row?.content_purged_at != null };
+}

package/src/retention.ts

@@ -20,6 +20,7 @@
 //   COMMHUB_DB=/tmp/test-retention.db bun test src/retention.test.ts
 
 import { db } from "./db.js";
+import { sweepNodeRequestContent, type NodeRequestSweepResult } from "./node-request-retention.js";
 
 export type RetentionConfig = {
   // High-frequency telemetry; default = 7 days.
@@ -52,6 +53,9 @@ export type SweepResult = {
     tasks: number;
     audit_log: number;
   };
+  // node_rules_requests: file bytes purged by age / after read, rows deleted
+  // after 30 days. Fixed policy (privacy, not disk) — no env opt-out.
+  nodeRequests: NodeRequestSweepResult;
   vacuum: {
     walCheckpointPagesMoved: number | null;
     incrementalFreedPages: number | null;
@@ -178,6 +182,8 @@ export function sweepRetention(cfg: RetentionConfig = readRetentionConfig()): Sw
     cfg.auditLogDays,
   );
 
+  const nodeRequests = sweepNodeRequestContent();
+
   // VACUUM:
   //   - wal_checkpoint(TRUNCATE): trims the WAL file. Works on every
   //     SQLite DB regardless of auto_vacuum setting. Useful after
@@ -230,6 +236,7 @@ export function sweepRetention(cfg: RetentionConfig = readRetentionConfig()): Sw
       tasks,
       audit_log: auditLog,
     },
+    nodeRequests,
     vacuum: { walCheckpointPagesMoved, incrementalFreedPages, errored },
   };
 }
@@ -249,11 +256,13 @@ export function startRetentionSweeper(
         r.deletes.inbox +
         r.deletes.tasks +
         r.deletes.audit_log;
-      if (totalDeletes > 0 || r.vacuum.errored) {
+      const nr = r.nodeRequests;
+      if (totalDeletes > 0 || nr.purged > 0 || nr.deleted > 0 || nr.timedOut > 0 || r.vacuum.errored) {
         console.log(
           `[commhub retention] swept in ${r.durationMs}ms — ` +
             `telemetry=${r.deletes.agent_telemetry} events=${r.deletes.task_events} ` +
             `inbox=${r.deletes.inbox} tasks=${r.deletes.tasks} audit=${r.deletes.audit_log} ` +
+            `nodeReqPurged=${nr.purged} nodeReqDeleted=${nr.deleted} nodeReqTimedOut=${nr.timedOut} ` +
             `walPages=${r.vacuum.walCheckpointPagesMoved} freedPages=${r.vacuum.incrementalFreedPages}`,
         );
       }

package/src/tools.ts

@@ -62,6 +62,7 @@ import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
 import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
 import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
 import { parseHubTimestamp } from "./hub-timestamp";
+import { noteTerminalResultRead, sweepNodeRequestContent } from "./node-request-retention.js";
 
 function ts(): string {
   return new Date().toTimeString().slice(0, 8);
@@ -3286,6 +3287,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       );
     }
 
+    // Opportunistic content retention (bounded, indexed) — node-request-retention.ts.
+    sweepNodeRequestContent();
     const requestId = `rf_${uuidv4()}`;
     const networkId = node.network_id || "default";
     db.run(
@@ -3490,6 +3493,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         );
         row.error = `node did not answer within ${RULES_REQUEST_STALE_MS}ms (offline, or running an agent-node without app#225 support)`;
       }
+      // Privacy: node file bytes are handed out for a short grace window after the
+      // first terminal read, then purged (node-request-retention.ts). Only reached
+      // after the SEC-1 scope check above — a foreign caller can't stamp/purge.
+      const terminal = status === "done" || status === "failed" || status === "timeout";
+      const purged = terminal ? noteTerminalResultRead(requestId).purged : false;
       return {
         content: [{
           type: "text" as const,
@@ -3501,7 +3509,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             status,
             file_name: row.file_name ?? null,
             exists: row.file_exists === null || row.file_exists === undefined ? null : row.file_exists === 1,
-            ...(status === "done" && row.op !== "write" ? { content: row.result_content ?? "" } : {}),
+            ...(status === "done" && row.op !== "write" && !purged ? { content: row.result_content ?? "" } : {}),
+            ...(purged ? { content_purged: true } : {}),
             error: row.error ?? null,
             age_ms: ageMs,
           }),