@sleep2agi/commhub-server 0.9.0-preview.65 → 0.9.0-preview.67

package/src/tools.ts

@@ -8,7 +8,8 @@ import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetwork
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
-import { canRestWriteNetwork, getUserNetworkIds, singleNetworkId } from "./network-scope.js";
+import { canRestWriteNetwork, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId } from "./network-scope.js";
+import { handleRequirementsRequest } from "./requirements.js";
 import {
   buildAnetArgs as _unused_buildAnetArgs,           // ensure module is loaded
   validateName as validateChildName,
@@ -64,7 +65,7 @@ import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
 import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
 import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
 import { parseHubTimestamp } from "./hub-timestamp";
-import { noteTerminalResultRead, sweepNodeRequestContent } from "./node-request-retention.js";
+import { noteTerminalResultRead, purgeLogsResultNow, sweepNodeRequestContent } from "./node-request-retention.js";
 
 function ts(): string {
   return new Date().toTimeString().slice(0, 8);
@@ -730,8 +731,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       skills_capable: z.literal(true).optional(),
       // Project folder view — same doorbell, ops files_list / file_read.
       files_capable: z.literal(true).optional(),
+      // Node run-log view — same doorbell, op logs_tail.
+      logs_capable: z.literal(true).optional(),
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -943,6 +946,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         if (filesCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
           db.run("UPDATE sessions SET files_capable = 1 WHERE resume_id = ?1", [resume_id]);
         }
+        if (logsCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run("UPDATE sessions SET logs_capable = 1 WHERE resume_id = ?1", [resume_id]);
+        }
         if (host || proc) {
           db.run(
             `INSERT INTO agent_telemetry (id, network_id, resume_id, alias, hostname, ip, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, created_at)
@@ -3201,11 +3207,43 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     return segs.join("/");
   };
 
+  // Node run-log view — logs_tail rides the same queue + doorbell. `content`
+  // carries the filter parameters as JSON (lines / level / grep / since_ts) and
+  // never a path: the node reads only its own log directory and redacts before
+  // it answers (agent-node/src/runtime/node-logs.ts). Stricter than the project
+  // folder on the caller: user login only, and only the node's owner or a
+  // network owner/admin — a member who may chat with a node does not get to read
+  // its process log. Log bytes are purged on the first terminal read (see
+  // get_rules_file_result) and by the retention sweep after LOGS_CONTENT_TTL_MS.
+  const isLogsOp = (op: string) => op === "logs_tail";
+  const LOGS_MAX_LINES = 2000;
+  const LOGS_GREP_MAX = 200;
+  const logsParamsJson = (p: { lines?: number; level?: string; grep?: string; since_ts?: number }): string =>
+    JSON.stringify({
+      lines: Math.min(Math.max(Math.floor(p.lines ?? 500), 1), LOGS_MAX_LINES),
+      ...(p.level ? { level: p.level } : {}),
+      ...(p.grep ? { grep: p.grep.slice(0, LOGS_GREP_MAX) } : {}),
+      ...(typeof p.since_ts === "number" && p.since_ts > 0 ? { since_ts: p.since_ts } : {}),
+    });
+  // Owner of the node row, or owner/admin of the network. Legacy open mode (no
+  // user identity on the connection) keeps canWrite's allow-all semantics.
+  const canReadNodeLogs = (nodeId: string, networkId: string): boolean => {
+    if (!enforceUserId) return true;
+    const role = getUserNetworkRole(enforceUserId, networkId);
+    if (role === "owner" || role === "admin") return true;
+    if (nodeId.startsWith("session:")) return false;
+    const row = db.get<{ owner_user_id: string | null }>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", nodeId);
+    return !!row?.owner_user_id && row.owner_user_id === enforceUserId;
+  };
+
   const enqueueRulesFileRequest = (
-    op: "read" | "write" | "skills_list" | "skill_read" | "files_list" | "file_read",
+    op: "read" | "write" | "skills_list" | "skill_read" | "files_list" | "file_read" | "logs_tail",
     a: { node_id?: string; child_node_id?: string; alias?: string; network_id?: string; content?: string },
   ) => {
     const effectiveNetId = getNetworkId(a.network_id);
+    if (isLogsOp(op) && callerTokenIsNetwork) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_cannot_read_logs", message: "a node token cannot read another node's run log; use a user login" }) }] };
+    }
     if (isFilesOp(op)) {
       if (callerTokenIsNetwork) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_cannot_browse_files", message: "a node token cannot browse another node's project folder; use a user login" }) }] };
@@ -3217,7 +3255,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
       a = { ...a, content: rel };
     }
-    if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, isSkillsOp(op) ? `${op} node skills` : `${op} rules file`);
+    if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, isLogsOp(op) ? "read node logs" : isSkillsOp(op) ? `${op} node skills` : `${op} rules file`);
     if (op === "skill_read" && (typeof a.content !== "string" || !SKILL_NAME_RE.test(a.content) || a.content === "." || a.content === "..")) {
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_skill_name", reason: "name must match [A-Za-z0-9._-]{1,64} and not be . or .." }) }] };
     }
@@ -3247,7 +3285,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         node = byAlias;
       } else {
         const session = db.get<{ alias: string; network_id: string | null }>(
-          isFilesOp(op)
+          isLogsOp(op)
+            ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND logs_capable = 1 ORDER BY updated_at DESC LIMIT 1"
+            : isFilesOp(op)
             ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND files_capable = 1 ORDER BY updated_at DESC LIMIT 1"
             : isSkillsOp(op)
             ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND skills_capable = 1 ORDER BY updated_at DESC LIMIT 1"
@@ -3256,6 +3296,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           scopeNet,
         );
         if (!session) {
+          if (isLogsOp(op)) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "logs_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its run log (its agent-node may be too old)" }) }] };
+          }
           if (isFilesOp(op)) {
             return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "files_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its project folder (its channel server may be too old)" }) }] };
           }
@@ -3267,6 +3310,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
     }
     const nodeId = node.node_id;
+    if (isLogsOp(op) && !canReadNodeLogs(nodeId, node.network_id || "default")) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "logs_permission_denied", message: "only the node's owner or a network owner/admin can read its run log" }) }] };
+    }
     if (op === "write") {
       if (typeof a.content !== "string") {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_content", reason: "content must be a string" }) }] };
@@ -3282,7 +3328,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     // Separate single-flight lanes: the client opens the rules file and the
     // skills list together; one must not block the other.
     const inFlight = db.get<{ request_id: string; created_at: number; pulled_at: number | null }>(
-      isFilesOp(op)
+      isLogsOp(op)
+        ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op = 'logs_tail' ORDER BY created_at DESC LIMIT 1"
+        : isFilesOp(op)
         ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('files_list', 'file_read') ORDER BY created_at DESC LIMIT 1"
         : isSkillsOp(op)
         ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('skills_list', 'skill_read') ORDER BY created_at DESC LIMIT 1"
@@ -3306,7 +3354,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     const networkId = node.network_id || "default";
     db.run(
       `INSERT INTO node_rules_requests (request_id, node_id, network_id, op, content, status, created_at, created_by_token) VALUES (?1, ?2, ?3, ?4, ?5, 'pending', ?6, ?7)`,
-      [requestId, nodeId, networkId, op, op === "write" || op === "skill_read" || isFilesOp(op) ? a.content! : null, Date.now(), callerTokenId || "unknown"],
+      [requestId, nodeId, networkId, op, op === "write" || op === "skill_read" || isFilesOp(op) || isLogsOp(op) ? a.content! : null, Date.now(), callerTokenId || "unknown"],
     );
     pushEvent(node.alias, { type: "rules_file", request_id: requestId }, networkId);
     return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request_id: requestId, op }) }] };
@@ -3382,6 +3430,22 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     async ({ node_id, child_node_id, alias, path: relPath, network_id }) => enqueueRulesFileRequest("file_read", { node_id, child_node_id, alias, content: relPath, network_id }),
   );
 
+  server.tool(
+    "tail_node_logs",
+    "Ask a node for the tail of its own agent-node run log (read-only, redacted on the node before it leaves). No path argument: the node reads only its own log directory. User logins only; the node's owner or a network owner/admin. Poll get_rules_file_result — content is JSON {files, lines:[{ts, level, text, key}], truncated, matched, now_ts}; it is handed out once and then purged.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported logs_capable."),
+      lines: z.number().int().min(1).max(LOGS_MAX_LINES).optional().describe("How many of the newest matching lines (default 500, max 2000)."),
+      level: z.enum(["info", "warn", "error"]).optional().describe("Only lines of exactly this level."),
+      grep: z.string().min(1).max(LOGS_GREP_MAX).optional().describe("Case-insensitive substring, matched after redaction."),
+      since_ts: z.number().int().min(0).optional().describe("Only lines at or after this epoch-ms timestamp (follow mode; the client de-duplicates by line key)."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, lines, level, grep, since_ts, network_id }) =>
+      enqueueRulesFileRequest("logs_tail", { node_id, child_node_id, alias, content: logsParamsJson({ lines, level, grep, since_ts }), network_id }),
+  );
+
   server.tool(
     "get_rules_file_request",
     "Node pulls its oldest pending rules-file request (called from agent-node when the SSE rules_file doorbell arrives). app#225.",
@@ -3419,7 +3483,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             request: {
               request_id: req.request_id,
               op: req.op,
-              ...(req.op === "write" || req.op === "skill_read" || isFilesOp(req.op) ? { content: req.content ?? "" } : {}),
+              ...(req.op === "write" || req.op === "skill_read" || isFilesOp(req.op) || isLogsOp(req.op) ? { content: req.content ?? "" } : {}),
             },
           }),
         }],
@@ -3460,7 +3524,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (req.status === "done" || req.status === "failed" || req.status === "timeout") {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, ignored: "already_terminal", current_status: req.status }) }] };
       }
-      if (typeof content === "string" && !isFilesOp(req.op) && content.length > RULES_FILE_MAX_BYTES) {
+      if (typeof content === "string" && !isFilesOp(req.op) && !isLogsOp(req.op) && content.length > RULES_FILE_MAX_BYTES) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "content_too_large", max: RULES_FILE_MAX_BYTES }) }] };
       }
       db.run(
@@ -3492,7 +3556,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       );
       // SEC-1：结果行的网络必须等于调用方作用域，否则当不存在。
       // Project folder results: only the (user) token that asked may read them.
-      const foreignFilesRow = !!row && isFilesOp(row.op) && (callerTokenIsNetwork || row.created_by_token !== (callerTokenId || "unknown"));
+      // Run-log results: same rule — only the token that asked.
+      const foreignFilesRow = !!row && (isFilesOp(row.op) || isLogsOp(row.op)) && (callerTokenIsNetwork || row.created_by_token !== (callerTokenId || "unknown"));
       if (!row || row.network_id !== (effectiveNetId || "default") || foreignFilesRow) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found", request_id: requestId }) }] };
       }
@@ -3511,6 +3576,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // after the SEC-1 scope check above — a foreign caller can't stamp/purge.
       const terminal = status === "done" || status === "failed" || status === "timeout";
       const purged = terminal ? noteTerminalResultRead(requestId).purged : false;
+      // Run-log bytes are read-once: purge them in the same call that hands them
+      // out (no grace window — the app never follows someone else's logs request,
+      // it re-asks; see node-request-retention.ts).
+      if (terminal && isLogsOp(row.op) && !purged) purgeLogsResultNow(requestId);
       return {
         content: [{
           type: "text" as const,
@@ -5606,6 +5675,109 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
     },
   );
+
+  // ── 需求池 / 任务看板(Agent 读写任务,例如把 GitHub issue 同步成任务) ──
+  // 全部走 REST 同一个处理函数(requirements.ts handleRequirementsRequest):权限、校验、谁做的记录只有一份。
+  // 节点令牌只在它绑定的网络里读 / 建 / 改 / 勾子任务 / upsert / 读项目;删除和管理项目只给人。
+  const requirementsCall = async (method: string, path: string, clientNetId?: string | null, body?: Record<string, unknown>) => {
+    const scope = resolveRestNetworkScope(enforceNetworkId ? null : (clientNetId ?? null), mcpAuthCtx, false);
+    if (scope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "access_denied", message: scope.denied }) }] };
+    const url = new URL(`http://mcp.internal${path}`);
+    const req = new Request(url, { method, headers: { "content-type": "application/json" }, body: body ? JSON.stringify(body) : undefined });
+    const res = await handleRequirementsRequest({
+      req, url,
+      auth: mcpAuthCtx ? { ...mcpAuthCtx, username: "", tokenId: callerTokenId ?? null, tokenName: callerTokenIsNetwork && callerAlias ? `node:${callerAlias}` : null } : null,
+      isAdmin: false,
+      isNodeToken: callerTokenIsNetwork,
+      scope,
+    });
+    const data = res ? await res.json() : { ok: false, error: "not_found" };
+    return { content: [{ type: "text" as const, text: JSON.stringify(res && !res.ok && data && typeof data === "object" ? { ...data, status: res.status } : data) }] };
+  };
+  const reqPerson = z.object({ kind: z.enum(["user", "node"]), id: z.string().min(1).max(200) });
+  const reqChecklistItem = z.object({ id: z.string().regex(/^[A-Za-z0-9_-]{1,40}$/).optional(), text: z.string().min(1).max(500), done: z.boolean().optional() });
+  const reqFields = {
+    name: z.string().min(1).max(80).optional(),
+    priority: z.enum(["high", "normal", "low"]).optional(),
+    column: z.enum(["pool", "doing", "done"]).optional(),
+    due: z.string().max(40).optional().describe("YYYY-MM-DD (all day) or ISO 8601 with Z / ±HH:MM (stored as UTC seconds); \"\" clears"),
+    description: z.string().max(20_000).optional().describe("markdown"),
+    checklist: z.array(reqChecklistItem).max(100).optional().describe("replaces the whole list"),
+    project_id: z.string().max(200).nullable().optional(),
+    owner: reqPerson.nullable().optional().describe("负责人: must be {kind:'user'}"),
+    agent_owner: reqPerson.nullable().optional().describe("负责 Agent: must be {kind:'node'}"),
+    participants: z.array(reqPerson).max(100).optional(),
+    external_url: z.string().max(500).nullable().optional(),
+    parent_id: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/).nullable().optional().describe("parent requirement (same network, no cycles, ≤ 5 levels); null detaches"),
+  };
+  const pick = (args: Record<string, unknown>, keys: string[]) => Object.fromEntries(keys.filter(k => args[k] !== undefined).map(k => [k, args[k]]));
+  const REQ_WRITE_KEYS = [...Object.keys(reqFields), "external_ref", "archived"];
+
+  server.tool(
+    "requirements_list",
+    "List requirement tasks in your network. Filters: status (pool/doing/done), project_id ('none' = no project), owner / agent_owner ('user:<id>' / 'node:<id>' / 'none'), updated_since (ISO), external_ref, parent_id / top_level, include_archived. Newest first, max 500. Each task carries children {total, done}.",
+    {
+      network_id: z.string().max(200).optional(),
+      status: z.enum(["pool", "doing", "done"]).optional(),
+      project_id: z.string().max(200).optional(),
+      owner: z.string().max(210).optional(),
+      agent_owner: z.string().max(210).optional(),
+      updated_since: z.string().max(40).optional(),
+      external_ref: z.string().max(200).optional(),
+      include_archived: z.boolean().optional(),
+      parent_id: z.string().max(200).optional().describe("children of this requirement ('none' = top level)"),
+      top_level: z.boolean().optional(),
+    },
+    async (args) => {
+      const q = new URLSearchParams();
+      for (const k of ["status", "project_id", "owner", "agent_owner", "updated_since", "external_ref", "parent_id"] as const) if (args[k] !== undefined) q.set(k, String(args[k]));
+      if (args.include_archived) q.set("include_archived", "1");
+      if (args.top_level) q.set("top_level", "1");
+      return requirementsCall("GET", `/api/requirements${q.size ? `?${q}` : ""}`, args.network_id);
+    },
+  );
+
+  server.tool(
+    "requirements_get",
+    "Get one requirement task by id (with description, checklist, owners, project, external_ref).",
+    { id: z.string().min(1).max(200), network_id: z.string().max(200).optional() },
+    async ({ id, network_id }) => requirementsCall("GET", `/api/requirements/${encodeURIComponent(id)}`, network_id),
+  );
+
+  server.tool(
+    "requirements_create",
+    "Create a requirement task. name is required. A duplicate external_ref in the network returns 409 external_ref_exists with existing_id — use requirements_upsert_by_external_ref for syncing.",
+    { network_id: z.string().max(200).optional(), ...reqFields, name: z.string().min(1).max(80), external_ref: z.string().max(200).optional() },
+    async (args) => requirementsCall("POST", "/api/requirements", args.network_id, pick(args, REQ_WRITE_KEYS)),
+  );
+
+  server.tool(
+    "requirements_update",
+    "Patch a requirement task; omitted fields keep their value. archived=true hides it from the default list (agents cannot delete).",
+    { id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), ...reqFields, external_ref: z.string().max(200).nullable().optional(), archived: z.boolean().optional() },
+    async (args) => requirementsCall("PATCH", `/api/requirements/${encodeURIComponent(args.id)}`, args.network_id, pick(args, REQ_WRITE_KEYS)),
+  );
+
+  server.tool(
+    "requirements_checklist_toggle",
+    "Set one checklist item done / not done (only that item is written, so concurrent edits of other items are kept).",
+    { id: z.string().min(1).max(200), item_id: z.string().regex(/^[A-Za-z0-9_-]{1,40}$/), done: z.boolean(), network_id: z.string().max(200).optional() },
+    async ({ id, item_id, done, network_id }) => requirementsCall("PATCH", `/api/requirements/${encodeURIComponent(id)}/checklist/${encodeURIComponent(item_id)}`, network_id, { done }),
+  );
+
+  server.tool(
+    "requirements_upsert_by_external_ref",
+    "Idempotent sync: create the task for external_ref (e.g. github:owner/repo#123) or, if it already exists in the network, patch it (omitted fields — including status — are kept). Returns { requirement, created }.",
+    { network_id: z.string().max(200).optional(), external_ref: z.string().min(1).max(200), ...reqFields, archived: z.boolean().optional() },
+    async (args) => requirementsCall("POST", "/api/requirements/upsert", args.network_id, pick(args, REQ_WRITE_KEYS)),
+  );
+
+  server.tool(
+    "projects_list",
+    "List requirement projects in your network (id, name, color, sort, archived).",
+    { network_id: z.string().max(200).optional() },
+    async ({ network_id }) => requirementsCall("GET", "/api/requirements/projects", network_id),
+  );
 }
 
 // ────────────────────────────────────────────────────────────────────