@sleep2agi/commhub-server 0.9.0-preview.60 → 0.9.0-preview.64

package/src/server.ts

@@ -16,9 +16,11 @@ import { pendingInboxCount } from "./inbox-count.js";
 import { addNetworkScope, canRestWriteNetwork, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { validateAvatarUrl } from "./avatar-validate.js";
 import { narrowTags, parseStoredTags, validateScalarAttr } from "./node-attrs-validate.js";
+import { daemonDefaultWorkdirRoot } from "./create-node-validate.js";
 import { register, login, resolveToken, getUserNetworks, getUserAllNetworks, createNetwork, deleteNetwork, renameNetwork, changePassword, issueUserToken, listTokens, createToken, revokeToken, getNetworkMembers, getUserNetworkRole, addNetworkMember, updateMemberRole, removeNetworkMember, createInvite, joinByInvite, createNetworkTokenForNode, type AuthUser } from "./auth.js";
 import { abortRename, cleanupCommittedRenameSessions, commitRename, prepareRename, resolveCanonicalAlias } from "./rename.js";
 import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
+import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
 import { getLoginClientIp, sharedLoginFailureLockout, sharedLoginIpRateLimiter } from "./auth_login_guard.js";
 import {
   FILE_ID_REGEX,
@@ -53,6 +55,7 @@ import { resolveRestFromSession } from "./rest-identity.js";
 import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
 import { diagnoseTask } from "./task-diagnostic.js";
 import { assertScheduledTaskBackendSupported, handleScheduledTaskRequest, startScheduledTaskScheduler } from "./scheduled-tasks.js";
+import { handleRequirementsRequest } from "./requirements.js";
 import { handleExternalScheduleEditRequest } from "./external-schedule-edits.js";
 import { recordDeliveredStaleEvents } from "./task-lifecycle-watcher.js";
 import { SIDE_THREAD_FEATURE_FLAG, SideThreadCoordinator, SideThreadPortRegistry, SideThreadStore, type SideThreadActor, type SideThreadAttachmentRef, type SideThreadExecutionPort } from "./side-thread.js";
@@ -738,6 +741,16 @@ export function patrolExpiredTasks(): void {
         // in this count. The WHERE clause still targets one exact guarded
         // task, so any positive count proves the task transition happened.
         if (result.changes < 1) continue;
+        // #2022 — retire the inbox rows in the same transaction. Nothing
+        // else acks them: an expired task can never be acked by its target,
+        // and retention only sweeps acked=1 rows, so leaving them unacked
+        // kept them in every "unacked inbox" consumer (the stop/delete gate,
+        // the unread badge) forever. COALESCE(task_id, id) mirrors
+        // cancel_task — legacy rows carry the logical task id in `id`.
+        db.run(
+          `UPDATE inbox SET acked = 1 WHERE COALESCE(task_id, id) = ?1 AND acked = 0`,
+          [task.task_id],
+        );
         syncScheduledRunForTask(task.task_id, task.network_id);
         changed.push(task);
       }
@@ -1614,6 +1627,16 @@ return Bun.serve({
     });
     if (scheduledResponse) return withCors(req, scheduledResponse);
 
+    const requirementsResponse = await handleRequirementsRequest({
+      req,
+      url,
+      auth: restAuth,
+      isAdmin,
+      isNodeToken: requestToken(req).startsWith("ntok_"),
+      scope: restScope,
+    });
+    if (requirementsResponse) return withCors(req, requirementsResponse);
+
     // ── #473 REST: SSE connection detail (ops-only) ──
     // The per-key breakdown /health used to expose anonymously: keys are
     // `{networkId}:{alias}` (+ `\0netobs:{networkId}` observer keys via
@@ -2391,7 +2414,6 @@ return Bun.serve({
           ...(canonical.renamed ? { renamed_from: body.alias, renamed_to: targetAlias } : {}),
         }, { status: 404 }));
       }
-      const id = crypto.randomUUID();
       // Identity binding, mirroring the MCP transport (tools.ts defaultFrom /
       // fromIdentityMismatchReply). Both transports resolve the same
       // api_tokens row through resolveToken, and auth.ts already documents the
@@ -2450,12 +2472,61 @@ return Bun.serve({
           : "legacy";
       const metaJson = normalizeMetaJson(stampTaskAuthOrigin(mergedMeta, authOrigin));
 
+      // Client-request-id idempotency, mirroring the MCP `send_task` tool
+      // (tools.ts). The app/Dashboard mint one `meta.client_request_id` per
+      // message bubble and reuse it only to retry that bubble, so:
+      //   - the task id is derived from (network, from, request id): a retry
+      //     after a lost response finds the row it already wrote and gets the
+      //     same task id back (200, idempotent_replay) — across restarts too;
+      //   - the same id with a different payload fails closed (409);
+      //   - a NEW id is a new message even when the text is identical, so it
+      //     must not hit the #212 content-hash window below (that silently
+      //     dropped a user's second 「好」 while the app showed it delivered).
+      const clientRequestId = clientRequestIdFromMeta(mergedMeta);
+      const id = clientRequestId
+        ? idempotentTaskId(taskNetId ?? null, fromSession, clientRequestId)
+        : crypto.randomUUID();
+      if (clientRequestId) {
+        const existing = db.get<StoredIdempotentTask & { to_node_id: string | null }>(
+          "SELECT task_id, from_name, to_node_id, to_name, priority, content, network_id, meta_json, status FROM tasks WHERE task_id = ?1",
+          [id],
+        );
+        if (existing) {
+          if (!idempotentTaskMatches(existing, {
+            fromName: fromSession, toName: targetAlias, priority: body.priority, content: body.task,
+            networkId: taskNetId ?? null, metaJson,
+          })) {
+            console.log(`[/api/task] ${fromSession} → ${targetAlias}: REJECTED idempotency_conflict (key=request_id, task=${existing.task_id.slice(0, 13)})`);
+            return withCors(req, Response.json({
+              ok: false,
+              error: "idempotency_conflict",
+              message: "client_request_id was already used with a different task payload",
+            }, { status: 409 }));
+          }
+          console.log(`[/api/task] ${fromSession} → ${targetAlias}: REPLAY (key=request_id, task=${existing.task_id.slice(0, 13)})`);
+          return withCors(req, Response.json({
+            ok: true,
+            task_id: existing.task_id,
+            message_id: existing.task_id,
+            task_status: existing.status,
+            idempotent_replay: true,
+            actual_to: {
+              alias: existing.to_name,
+              to_node_id: existing.to_node_id ?? null,
+              network_id: existing.network_id ?? null,
+            },
+          }));
+        }
+      }
+
       // #212 dedup guardrail. Mirrors the MCP `send_task` tool: same
       // (from_session, target_alias, task) within COMMHUB_SEND_DEDUP_WINDOW_MS
       // is rejected with a structured `duplicate_send` error so dashboard
       // dispatch buttons and scripted REST callers get the same guarantee
-      // as agent-driven MCP traffic.
-      const dedup = sharedSendDedup.check(fromSession, targetAlias, body.task);
+      // as agent-driven MCP traffic. Sends carrying a client_request_id are
+      // keyed on that id instead of the content (send_dedup.ts header).
+      const dedupScope = { requestId: clientRequestId, networkId: taskNetId ?? null };
+      const dedup = sharedSendDedup.check(fromSession, targetAlias, body.task, undefined, dedupScope);
       if (dedup.duplicate) {
         const payload = buildDuplicateSendPayload({
           from: fromSession,
@@ -2463,7 +2534,7 @@ return Bun.serve({
           ageMs: dedup.ageMs,
           windowMs: sharedSendDedup.windowMs,
         });
-        console.log(`[/api/task] ${fromSession} → ${targetAlias}: DROPPED duplicate (age=${dedup.ageMs}ms, window=${sharedSendDedup.windowMs}ms)`);
+        console.log(`[/api/task] ${fromSession} → ${targetAlias}: DROPPED duplicate (key=${dedup.kind}, age=${dedup.ageMs}ms, window=${sharedSendDedup.windowMs}ms)`);
         return withCors(req, Response.json(payload, { status: 429 }));
       }
 
@@ -2518,7 +2589,7 @@ return Bun.serve({
       // #212 — stamp the dedup index only after the inbox/tasks insert
       // succeeds. Mirrors the MCP `send_task` path so a failed write
       // never shadows a legitimate retry.
-      sharedSendDedup.record(fromSession, targetAlias, body.task);
+      sharedSendDedup.record(fromSession, targetAlias, body.task, undefined, dedupScope);
       if (target.state === "offline") {
         return withCors(req, Response.json({
           ok: false,
@@ -3360,6 +3431,13 @@ return Bun.serve({
               out.create_capability_observed_ms_ago = observedMsAgo;
             }
           }
+          // app「新建节点」确认页的默认工作目录根。出现即表示该 daemon 认 node_spec.workdir;
+          // 缺席(老 daemon / 老 hub 的 zod 剥掉了它)时 app 藏起那一行、不发 workdir。
+          // 🔴 它是那台机器的家目录路径 —— 与 ip_internal 同级,只给 admin/owner。
+          if (isPrivileged) {
+            const workdirRoot = daemonDefaultWorkdirRoot(r.config_snapshot);
+            if (workdirRoot) out.default_workdir_root = workdirRoot;
+          }
           return out;
         });
       return withCors(req, Response.json({ ok: true, daemons, count: daemons.length }));

package/src/stop-delete-node.test.ts

@@ -2,6 +2,7 @@ import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 import { db } from "./db.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { registerTools } from "./tools.js";
+import { patrolExpiredTasks } from "./server.js";
 
 // RFC-027 PR1 — handler-driven tests for stop_node, delete_node,
 // get_stop_request, ack_stop_request. Drives the MCP handlers via
@@ -42,6 +43,9 @@ function cleanup() {
     // PR1.2a restart_node tests leave node_config_updates rows; clear
     // so the next test's restart_node doesn't see them as in_flight.
     try { db.run("DELETE FROM node_config_updates WHERE network_id = ?1", [n]); } catch {}
+    // #2022 seeds tasks rows whose status drives the in-flight join; clear
+    // them by network or a later test inherits a stale terminal row.
+    try { db.run("DELETE FROM tasks WHERE network_id = ?1", [n]); } catch {}
     try { db.run("DELETE FROM nodes WHERE network_id = ?1", [n]); } catch {}
     try { db.run("DELETE FROM sessions WHERE network_id = ?1", [n]); } catch {}
     try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [n]); } catch {}
@@ -950,3 +954,211 @@ describe("delete_node — stale-deleting redispatch exit (#1286)", () => {
     expect(r.ok).toBe(true);
   });
 });
+
+// ── #2022 — in-flight gate: terminal / aged rows must not pin busy ──
+//
+// The old gate was COUNT(*) FROM inbox WHERE session_name=? AND acked=0:
+// no join to tasks, no age limit, and nothing acks an inbox row whose
+// task already died (retention sweeps only acked=1 rows), so a single
+// dead row pinned the node to node_busy_in_flight forever.
+//
+// Rule under test (#2029 review):
+//   1. type='task' rows that join to a tasks row are judged by status
+//      ALONE — terminal (replied / failed / cancelled / expired) is not
+//      counted, anything else is counted with NO age ceiling. agent-node
+//      acks the inbox row only when the task is done, so a 90-minute
+//      (or ttl_seconds>3600) run stays acked=0 the whole time and must
+//      keep the gate closed; expiry is patrolExpiredTasks' job.
+//      Join key is COALESCE(task_id, id), the logical id cancel_task
+//      uses.
+//   2. rows with no status of their own — task rows whose tasks row is
+//      gone, and non-task rows (reply / broadcast / message) — get the
+//      60-minute age ceiling; nothing else will ever retire them.
+//   3. patrolExpiredTasks acks the matching inbox rows in the same
+//      transaction that expires the task.
+
+function seedTaskWithInbox(
+  net: string,
+  alias: string,
+  opts: {
+    task_id: string;
+    status: string;
+    /** signed datetime offset for the tasks row, e.g. '-3 days' */
+    task_age?: string;
+    /** signed datetime offset for the inbox row, e.g. '-3 days' */
+    inbox_age?: string;
+    /** signed datetime offset for tasks.expires_at, e.g. '+1 hour' */
+    expires_in?: string;
+  },
+) {
+  db.run(
+    `INSERT INTO tasks (task_id, from_name, to_name, priority, status, content, requires_response,
+                        created_at, delivered_at, expires_at, network_id)
+     VALUES (?1, 'caller', ?2, 'normal', ?3, 'do the thing', 'reply',
+             datetime('now', ?4), datetime('now', ?4), datetime('now', ?5), ?6)`,
+    [opts.task_id, alias, opts.status, opts.task_age ?? "0 seconds", opts.expires_in ?? "+1 hour", net],
+  );
+  db.run(
+    `INSERT INTO inbox (id, task_id, session_name, type, priority, content, from_session, network_id, acked, created_at)
+     VALUES (?1, ?1, ?2, 'task', 'normal', 'do the thing', 'caller', ?3, 0, datetime('now', ?4))`,
+    [opts.task_id, alias, net, opts.inbox_age ?? "0 seconds"],
+  );
+}
+
+function stopArgs() {
+  return { child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A };
+}
+
+describe("#2022 stop gate — terminal task rows are not in flight", () => {
+  test("28-day-old expired + 3-day-old replied rows → stop dispatches, in_flight=0", async () => {
+    setupAlphaNetwork();
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, {
+      task_id: "task_2022_expired", status: "expired",
+      task_age: "-28 days", inbox_age: "-28 days", expires_in: "-27 days",
+    });
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, {
+      task_id: "task_2022_replied", status: "replied",
+      task_age: "-3 days", inbox_age: "-3 days", expires_in: "-2 days",
+    });
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(true);
+    expect(r.in_flight_at_dispatch).toBe(0);
+    expect(readNode(CHILD_A_ID)?.lifecycle_state).toBe("stopping");
+  });
+
+  test("FRESH terminal row (replied, 0s old) also not counted — terminal filter alone is enough", async () => {
+    setupAlphaNetwork();
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, { task_id: "task_2022_fresh_replied", status: "replied" });
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(true);
+    expect(r.in_flight_at_dispatch).toBe(0);
+  });
+});
+
+describe("#2022 stop gate — genuinely in-flight rows still block", () => {
+  test("fresh non-terminal task row → node_busy_in_flight, count surfaced, state untouched", async () => {
+    setupAlphaNetwork();
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, { task_id: "task_2022_live", status: "delivered" });
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("node_busy_in_flight");
+    expect(r.in_flight_count).toBe(1);
+    expect(readNode(CHILD_A_ID)?.lifecycle_state).toBe("active");
+    expect(readAudit("stop_node_dispatched", NET_A).length).toBe(0);
+  });
+
+  test("fresh non-task inbox row (type='reply') still counts — judged by age only", async () => {
+    setupAlphaNetwork();
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, content, from_session, network_id, acked, created_at)
+       VALUES (?1, ?2, 'reply', 'fresh reply', 'caller', ?3, 0, datetime('now'))`,
+      [`inbox_2022_fresh_reply`, CHILD_A_ALIAS, NET_A],
+    );
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("node_busy_in_flight");
+    expect(r.in_flight_count).toBe(1);
+  });
+});
+
+describe("#2022 stop gate — a live task is never aged out (status wins over age)", () => {
+  test("🔴 created 2 hours ago + task.status='running' → still node_busy_in_flight", async () => {
+    setupAlphaNetwork();
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, {
+      task_id: "task_2022_running_90m", status: "running",
+      task_age: "-120 minutes", inbox_age: "-120 minutes", expires_in: "-60 minutes",
+    });
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("node_busy_in_flight");
+    expect(r.in_flight_count).toBe(1);
+    expect(readNode(CHILD_A_ID)?.lifecycle_state).toBe("active");
+  });
+
+  test("task.status='acked' 2 hours old (patrol never expires it) → still blocked", async () => {
+    setupAlphaNetwork();
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, {
+      task_id: "task_2022_acked_120m", status: "acked",
+      inbox_age: "-120 minutes", expires_in: "+12 hours",
+    });
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.error).toBe("node_busy_in_flight");
+    expect(r.in_flight_count).toBe(1);
+  });
+});
+
+describe("#2022 stop gate — age ceiling (60 min) for rows with no status", () => {
+  test("orphan task row (tasks row reaped) 8 days old → not counted", async () => {
+    setupAlphaNetwork();
+    db.run(
+      `INSERT INTO inbox (id, task_id, session_name, type, content, from_session, network_id, acked, created_at)
+       VALUES (?1, ?1, ?2, 'task', 'orphan task', 'caller', ?3, 0, datetime('now', '-8 days'))`,
+      [`task_2022_reaped`, CHILD_A_ALIAS, NET_A],
+    );
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(true);
+    expect(r.in_flight_at_dispatch).toBe(0);
+  });
+
+  test("non-task row older than the ceiling → not counted (the production backlog shape)", async () => {
+    setupAlphaNetwork();
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, content, from_session, network_id, acked, created_at)
+       VALUES (?1, ?2, 'broadcast', 'week-old broadcast', 'caller', ?3, 0, datetime('now', '-7 days'))`,
+      [`inbox_2022_old_broadcast`, CHILD_A_ALIAS, NET_A],
+    );
+    const r = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(r.ok).toBe(true);
+    expect(r.in_flight_at_dispatch).toBe(0);
+  });
+});
+
+describe("#2022 patrolExpiredTasks — expires the task AND acks its inbox rows", () => {
+  test("same transaction: tasks.status='expired' + inbox.acked=1 → gate unblocks", async () => {
+    setupAlphaNetwork();
+    seedTaskWithInbox(NET_A, CHILD_A_ALIAS, {
+      task_id: "task_2022_due", status: "delivered",
+      inbox_age: "-10 minutes", expires_in: "-1 minute",
+    });
+
+    // Before the patrol: fresh, non-terminal → the node is correctly busy.
+    const before = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(before.error).toBe("node_busy_in_flight");
+    expect(before.in_flight_count).toBe(1);
+
+    patrolExpiredTasks();
+
+    expect(db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = ?1", "task_2022_due")?.status).toBe("expired");
+    const inboxRow = db.get<{ acked: number }>(
+      "SELECT acked FROM inbox WHERE task_id = ?1 AND session_name = ?2", "task_2022_due", CHILD_A_ALIAS,
+    );
+    expect(inboxRow?.acked).toBe(1);
+
+    // And the gate that was blocked a moment ago now dispatches.
+    const after = await call(buildHandlers(USER_A_ID).stop_node, stopArgs());
+    expect(after.ok).toBe(true);
+    expect(after.in_flight_at_dispatch).toBe(0);
+  });
+
+  test("legacy inbox row keyed by id (task_id IS NULL) is acked too", async () => {
+    setupAlphaNetwork();
+    db.run(
+      `INSERT INTO tasks (task_id, from_name, to_name, priority, status, content, requires_response,
+                          created_at, expires_at, network_id)
+       VALUES ('task_2022_legacy', 'caller', ?1, 'normal', 'delivered', 'do the thing', 'reply',
+               datetime('now', '-10 minutes'), datetime('now', '-1 minute'), ?2)`,
+      [CHILD_A_ALIAS, NET_A],
+    );
+    // Pre-task_id shape: the transport row IS the logical id.
+    db.run(
+      `INSERT INTO inbox (id, session_name, type, content, from_session, network_id, acked, created_at)
+       VALUES ('task_2022_legacy', ?1, 'task', 'do the thing', 'caller', ?2, 0, datetime('now', '-10 minutes'))`,
+      [CHILD_A_ALIAS, NET_A],
+    );
+
+    patrolExpiredTasks();
+
+    expect(db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = 'task_2022_legacy'")?.status).toBe("expired");
+    expect(db.get<{ acked: number }>("SELECT acked FROM inbox WHERE id = 'task_2022_legacy'")?.acked).toBe(1);
+  });
+});

package/src/tools.ts

@@ -15,6 +15,8 @@ import {
   validateRuntime,
   validateModel,
   validateChannelsP1,
+  validateWorkdir,
+  daemonDefaultWorkdirRoot,
   validateEnvRefs,
   FLAG_KEYS,
   validateFlagValue,
@@ -712,6 +714,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           // 不上报这一格 ≠ 0。旧 daemon 压根不发,读的人必须能把
           // 「刚测的」「很久以前测的」「不知道」分成三件事说。
           create_capability_observed_ms_ago: z.number().nullable().catch(null).optional(),
+          // app「新建节点」工作目录:daemon 的默认根。出现即表示该 daemon 认 node_spec.workdir。
+          // `.catch(undefined)`:同上一格的立场 —— 一个诊断/展示字段不许拒掉整份 report。
+          // 读取侧再按形状消毒(create-node-validate.ts daemonDefaultWorkdirRoot)。
+          default_workdir_root: z.string().max(1024).optional().catch(undefined),
         }).optional(),
       }).optional().describe("RFC-024 — masked node config snapshot"),
       // app#225 follow-up — the reporting process answers the `rules_file`
@@ -1621,6 +1627,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
               message: "client_request_id was already used with a different task payload",
             }) }] };
           }
+          console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: REPLAY (key=request_id, task=${existing.task_id.slice(0, 13)})`);
           return { content: [{ type: "text" as const, text: JSON.stringify({
             ok: true, message_id: existing.task_id, task_id: existing.task_id,
             task_status: existing.status, idempotent_replay: true,
@@ -1644,7 +1651,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // incident: 50+ identical dispatches across 5 LLM turns ignored
       // three STOP replies — the LLM cannot be trusted to debounce
       // itself, so the runtime layer must.
-      const dedup = sharedSendDedup.check(from_session, targetAlias, task);
+      //
+      // A send carrying a validated client_request_id is keyed on that id
+      // instead of the content hash (send_dedup.ts header): a human typing
+      // the same short text twice sent two messages. Same-id retries were
+      // already answered from the durable row above.
+      const dedupScope = { requestId: clientRequestId, networkId: effectiveNetId ?? null };
+      const dedup = sharedSendDedup.check(from_session, targetAlias, task, undefined, dedupScope);
       if (dedup.duplicate) {
         const payload = buildDuplicateSendPayload({
           from: from_session,
@@ -1652,7 +1665,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           ageMs: dedup.ageMs,
           windowMs: sharedSendDedup.windowMs,
         });
-        console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: DROPPED duplicate (age=${dedup.ageMs}ms, window=${sharedSendDedup.windowMs}ms)`);
+        console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: DROPPED duplicate (key=${dedup.kind}, age=${dedup.ageMs}ms, window=${sharedSendDedup.windowMs}ms)`);
         return { content: [{ type: "text" as const, text: JSON.stringify(payload) }] };
       }
 
@@ -1692,7 +1705,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Only stamp the dedup index after the inbox/tasks transaction
       // succeeds, so a failed insert never silently shadows a legitimate
       // retry.
-      sharedSendDedup.record(from_session, targetAlias, task);
+      sharedSendDedup.record(from_session, targetAlias, task, undefined, dedupScope);
 
       // SSE push by alias.
       // The SSE channel is keyed by alias (subscribers connected to /events/<alias>),
@@ -3733,6 +3746,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             telemetry.mem_gb = r.session_mem_total_gb ?? null;
             telemetry.ip_internal = r.session_ip ?? null;
           }
+          // 工作目录默认根会暴露那台机器的家目录路径 —— 与 IP 同级,只给 admin/owner
+          // (也只有他们能 create_node)。见 create-node-validate.ts daemonDefaultWorkdirRoot。
+          const workdirRoot = isPrivileged ? daemonDefaultWorkdirRoot(r.config_snapshot) : null;
           return {
             daemon_node_id: r.node_id,
             alias: r.alias,
@@ -3742,6 +3758,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             runtimes_supported: runtimes,
             allowed_secret_keys: secrets,
             host_telemetry: telemetry,
+            ...(workdirRoot ? { default_workdir_root: workdirRoot } : {}),
           };
         });
 
@@ -3764,6 +3781,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         flags: z.record(z.string(), z.unknown()).optional(),
         env_refs: z.array(z.string().max(64)).optional(),
         channels: z.array(z.unknown()).optional(),
+        // app「新建节点」确认页的工作目录(绝对路径或 ~/…,daemon 侧展开并校验)。
+        // 缺席 = 老行为:落 daemon 的 cwd。
+        workdir: z.string().max(1024).optional().nullable(),
       }),
       network_id: z.string().max(200).optional(),
     },
@@ -3908,6 +3928,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         validateRuntime(node_spec.runtime);
         validateModel(node_spec.model);
         validateChannelsP1((node_spec as any).channels);
+        validateWorkdir(node_spec.workdir);
         for (const [k, v] of Object.entries(node_spec.flags || {})) {
           if (!(FLAG_KEYS as readonly string[]).includes(k)) throw new ValidationError("flag_key_unknown", { field: k });
           validateFlagValue(k, v);
@@ -3915,6 +3936,18 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       } catch (e) {
         return validationFailReply(e);
       }
+      // 🔴 老 daemon 会**静默忽略** node_spec.workdir,把节点建在它自己的 cwd 里 ——
+      //    用户以为指定了目录,实际落到了别处(常常就是 $HOME)。所以没自报支持的 daemon
+      //    直接拒,而不是派一个会被悄悄改写的请求。app 在这种 daemon 上本就不显示那一行。
+      const requestedWorkdir = typeof node_spec.workdir === "string" ? node_spec.workdir.trim() : null;
+      if (requestedWorkdir && !daemonDefaultWorkdirRoot(daemon.config_snapshot)) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({
+          ok: false,
+          error: "workdir_not_supported_by_daemon",
+          hint: "this daemon's agent-node predates create-node workdir support; upgrade it, or omit workdir to use its current directory",
+          daemon_node_id,
+        }) }] };
+      }
 
       // P1 daemon-side allowlist: if daemon publishes allowed_runtimes,
       // enforce at hub for fast-fail; daemon repeats.
@@ -4000,12 +4033,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const envKeys = Object.keys(envBlob);
       db.run(
         `INSERT INTO node_create_requests
-           (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'pending', ?9, ?10, ?11)`,
+           (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token, workdir)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'pending', ?9, ?10, ?11, ?12)`,
         [
           requestId, daemon_node_id, node_spec.name, networkIdForChild,
           node_spec.runtime, node_spec.model ?? null, JSON.stringify(node_spec.flags || {}),
           JSON.stringify(envKeys), childTokenId, Date.now(), callerTokenId || "unknown",
+          requestedWorkdir,
         ],
       );
 
@@ -4028,6 +4062,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           model: node_spec.model ?? null,
           flag_keys: Object.keys(node_spec.flags || {}),
           env_keys: envKeys,
+          workdir: requestedWorkdir,
         },
       });
 
@@ -4161,8 +4196,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "env_blob_unavailable" }) }] };
       }
       // Hydrate spec from row.
-      const specRow = db.get<{ child_name: string; runtime: string; model: string | null; flags_json: string }>(
-        `SELECT child_name, runtime, model, flags_json FROM node_create_requests WHERE request_id = ?1`,
+      const specRow = db.get<{ child_name: string; runtime: string; model: string | null; flags_json: string; workdir: string | null }>(
+        `SELECT child_name, runtime, model, flags_json, workdir FROM node_create_requests WHERE request_id = ?1`,
         request_id,
       );
       if (!specRow) {
@@ -4185,6 +4220,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             model: specRow.model,
             flags: JSON.parse(specRow.flags_json),
             channels: [],
+            // 只在请求真带了时出现:老 daemon 看不到多余的键,新 daemon 缺席即走老布局。
+            ...(specRow.workdir ? { workdir: specRow.workdir } : {}),
           },
           child_token: blob.child_token,
           env_blob: blob.env_blob,
@@ -4528,10 +4565,50 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     // Use COALESCE so a NULL inbox row is counted against the same
     // network as the target node (which is the only safe default
     // — pre-multi-network rows existed in single-network mode).
+    //
+    // #2022 — "unacked" alone is not "in flight". Nothing acks a row
+    // whose task already reached a terminal state (report_completion,
+    // send_reply, send_ack, the TTL patrol all leave inbox alone) and
+    // retention sweeps only acked=1 rows, so those rows were counted
+    // forever: one dead row pinned this gate to node_busy_in_flight
+    // and force=true was the only way past it.
+    //
+    // Counting rule (#2029 review): a row counts while it can still be
+    // work this node is doing — and the age ceiling must NOT be applied
+    // to a task row whose tasks row we can see. agent-node acks the
+    // inbox row only once the task is done, so a 90-minute (or 3-hour,
+    // or ttl_seconds>3600) task keeps acked=0 for its whole run;
+    // capping it by age would open this gate mid-run, which is exactly
+    // what the gate exists to prevent. So:
+    //   1. type='task' row with a matching tasks row — LEFT JOIN on
+    //      COALESCE(task_id, id), the key cancel_task / ack_inbox use
+    //      (first deliveries set id == task_id; retry/reassign write a
+    //      fresh transport id). Status alone decides: terminal
+    //      (replied / failed / cancelled / expired) → not counted;
+    //      anything else → counted, no age ceiling. Expiry belongs to
+    //      patrolExpiredTasks, which now acks the inbox row in the same
+    //      transaction, so an expired task leaves this count together
+    //      with its rows.
+    //   2. every other row — a task row whose tasks row is gone
+    //      (reaped by retention, or a legacy row whose id resolves to
+    //      nothing) and non-task rows (reply / broadcast / message):
+    //      these carry no status of their own and nothing else will
+    //      ever retire them, so they get the age ceiling
+    //      IN_FLIGHT_MAX_AGE_MINUTES on inbox.created_at.
+    // The count stays a per-alias inbox count: one PK join per row.
+    const IN_FLIGHT_MAX_AGE_MINUTES = 60;
     const inFlightRow = db.get<{ n: number }>(
-      `SELECT COUNT(*) AS n FROM inbox WHERE session_name = ?1 AND acked = 0
-         AND COALESCE(network_id, ?2) = ?2`,
-      node.alias, node.network_id,
+      `SELECT COUNT(*) AS n FROM inbox i
+         LEFT JOIN tasks t
+           ON i.type = 'task'
+          AND t.task_id = COALESCE(i.task_id, i.id)
+        WHERE i.session_name = ?1 AND i.acked = 0
+          AND COALESCE(i.network_id, ?2) = ?2
+          AND ((t.task_id IS NOT NULL
+                AND t.status NOT IN ('replied', 'failed', 'cancelled', 'expired'))
+            OR (t.task_id IS NULL
+                AND i.created_at >= datetime('now', ?3)))`,
+      node.alias, node.network_id, `-${IN_FLIGHT_MAX_AGE_MINUTES} minutes`,
     );
     const inFlight = inFlightRow?.n ?? 0;
     if (inFlight > 0 && !args.force) {