@sleep2agi/commhub-server 0.9.0-preview.67 → 0.9.0-preview.68

package/src/health-redaction.test.ts

@@ -373,7 +373,8 @@ describe("f28a6c1b CR3 — network-scoped filter matrix (M1-M7)", () => {
     mAliceNet = rAl.network_id;
     db.run("UPDATE users SET role = 'user' WHERE username = ?1", [mAliceName]);
     mAliceId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", [mAliceName])!.user_id;
-    const addAlice = addNetworkMember(mUserANet, mAliceId, "member", mUserAId);
+    // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+    const addAlice = addNetworkMember(mUserANet, mAliceId, "member", mUserAId, { agentAccess: "all" });
     if (!addAlice.ok) throw new Error("addNetworkMember(alice→N_A) failed: " + addAlice.error);
 
     // carol — own network + will also be added to N_A, then revoked
@@ -385,7 +386,7 @@ describe("f28a6c1b CR3 — network-scoped filter matrix (M1-M7)", () => {
     mCarolNet = rC.network_id;
     db.run("UPDATE users SET role = 'user' WHERE username = ?1", [mCarolName]);
     mCarolId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", [mCarolName])!.user_id;
-    const addCarol = addNetworkMember(mUserANet, mCarolId, "member", mUserAId);
+    const addCarol = addNetworkMember(mUserANet, mCarolId, "member", mUserAId, { agentAccess: "all" });
     if (!addCarol.ok) throw new Error("addNetworkMember(carol→N_A) failed: " + addCarol.error);
 
     // Live SSE sessions — one per network — so the filter has real

package/src/human-dm.ts

@@ -0,0 +1,149 @@
+// 多用户账号:人与人私信(同一网络里的两个用户之间)。
+//
+// 投递复用 user_inbox(与 send_desktop_message 同一张表、同一条 /events/users/me 推送、同一套
+// /api/messages?scope=user 未读与 ack),另外记下 sender_user_id —— 由 Hub 按发信人的用户令牌写入,
+// 不是客户端声称的 from_session。会话记录按 (收件人, sender_user_id) 双向取,所以发信人看得到自己发的。
+//
+// 与 Agent 权限无关:受限成员(看不到任何 Agent 的成员)照样能和网络里的其他人私信。
+
+import { db, uuidv4 } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { isAgentRestricted } from "./agent-access.js";
+import { pushUserEvent, hasUserSubscribers } from "./push.js";
+import { existsSync, readFileSync } from "fs";
+import { FILE_ID_REGEX, indexEntryPath, validateAttachments, validateIndexEntry } from "./uploads.js";
+import { restrictedMemberCanUseFile } from "./restricted-files.js";
+import { redactMessageRow } from "./redact-tokens.js";
+
+export const HUMAN_DM_KIND = "human_dm";
+const MAX_DM_CHARS = 10_000;
+
+export type HumanDmSendInput = {
+  networkId: string;
+  sender: { userId: string; username: string };
+  toUserId?: unknown;
+  toUsername?: unknown;
+  message?: unknown;
+  attachments?: unknown;
+  clientRequestId?: unknown;
+};
+
+export type HumanDmSendResult =
+  | { ok: true; message: Record<string, unknown>; delivered: boolean }
+  | { ok: false; error: string; status: number };
+
+export function sendHumanDm(input: HumanDmSendInput): HumanDmSendResult {
+  const { networkId, sender } = input;
+  if (!getUserNetworkRole(sender.userId, networkId)) return { ok: false, error: "not a member of this network", status: 403 };
+  const text = typeof input.message === "string" ? input.message : "";
+  if (text.length > MAX_DM_CHARS) return { ok: false, error: "message_too_long", status: 400 };
+
+  const byId = typeof input.toUserId === "string" && input.toUserId
+    ? db.get<{ user_id: string; username: string }>("SELECT user_id, username FROM users WHERE user_id = ?1", input.toUserId)
+    : null;
+  const byName = typeof input.toUsername === "string" && input.toUsername
+    ? db.get<{ user_id: string; username: string }>("SELECT user_id, username FROM users WHERE username = ?1", input.toUsername)
+    : null;
+  if (byId && byName && byId.user_id !== byName.user_id) return { ok: false, error: "dm_target_mismatch", status: 400 };
+  const target = byId ?? byName;
+  // 不存在与不在本网络同一个错误,不给用户名探测留差异。
+  if (!target || !getUserNetworkRole(target.user_id, networkId)) return { ok: false, error: "dm_target_not_in_network", status: 404 };
+  if (target.user_id === sender.userId) return { ok: false, error: "dm_to_self", status: 400 };
+
+  const attachments = validateAttachments(input.attachments);
+  if (!attachments.ok) return { ok: false, error: "bad_attachments", status: 400 };
+  if (!text.trim() && attachments.attachments.length === 0) return { ok: false, error: "message_required", status: 400 };
+  const restricted = isAgentRestricted(sender.userId, networkId);
+  for (const a of attachments.attachments) {
+    const fileId = (a as { file_id?: string }).file_id;
+    if (!fileId) continue;
+    const usable = restricted
+      ? restrictedMemberCanUseFile(sender.userId, sender.username, networkId, fileId)
+      : fileInNetwork(networkId, fileId);
+    if (!usable) return { ok: false, error: "attachment_not_accessible", status: 403 };
+  }
+
+  const clientRequestId = typeof input.clientRequestId === "string" && /^[A-Za-z0-9._-]{1,80}$/.test(input.clientRequestId)
+    ? input.clientRequestId : null;
+  // 同一个气泡重试:按 (发信人, client_request_id) 定出同一个 message_id,重投不产生第二条。
+  const messageId = clientRequestId
+    ? `dm_${sender.userId}_${clientRequestId}`.slice(0, 120)
+    : `dm_${uuidv4()}`;
+  const metaJson = attachments.attachments.length ? JSON.stringify({ attachments: attachments.attachments }) : null;
+
+  db.transaction(() => {
+    db.run(
+      // created_at 带毫秒:同一秒里一来一回的两条私信要能排出先后(秒级的 datetime('now') 排不出)。
+      `INSERT INTO user_inbox (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, sender_user_id, created_at)
+       VALUES (?1, ?2, ?3, ?4, ?5, NULL, ?6, 'info', ?7, ?8, strftime('%Y-%m-%d %H:%M:%f', 'now'))
+       ON CONFLICT(message_id) DO NOTHING`,
+      [messageId, networkId, target.user_id, sender.username, HUMAN_DM_KIND, text, metaJson, sender.userId],
+    );
+    db.run(
+      `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+       VALUES (?1, ?2, 'human_dm_sent', 'user', ?3, ?4, ?5)`,
+      [sender.userId, sender.username, target.user_id, JSON.stringify({ message_id: messageId, attachments: attachments.attachments.length }), networkId],
+    );
+  });
+  const row = db.get<Record<string, unknown>>(
+    `SELECT message_id, network_id, user_id, sender_user_id, from_session, kind, content, meta_json, acked, created_at
+       FROM user_inbox WHERE message_id = ?1`,
+    messageId,
+  )!;
+  // 推送在提交之后(与 send_desktop_message 同一条规矩:回滚的消息不能先被看见)。
+  const delivered = hasUserSubscribers(networkId, target.user_id);
+  pushUserEvent(networkId, target.user_id, {
+    type: "desktop_message",
+    message_id: messageId,
+    kind: HUMAN_DM_KIND,
+    from: sender.username,
+    from_user_id: sender.userId,
+    title: null,
+    message: text,
+    severity: "info",
+    created_at: new Date().toISOString(),
+    ...(metaJson ? { meta: JSON.parse(metaJson) } : {}),
+  });
+  return { ok: true, message: redactMessageRow(row), delivered };
+}
+
+/** 不受限的成员带附件:文件必须属于这个网络(防把别的网络的 file_id 塞进来)。 */
+function fileInNetwork(networkId: string, fileId: string): boolean {
+  if (!FILE_ID_REGEX.test(fileId)) return false;
+  const path = indexEntryPath(fileId);
+  if (!path || !existsSync(path)) return false;
+  try {
+    const entry = JSON.parse(readFileSync(path, "utf8"));
+    return validateIndexEntry(entry) && entry.file_id === fileId && entry.network_id === networkId;
+  } catch { return false; }
+}
+
+/** 我和某人的私信记录(双向),新的在前。before = 上一页最后一条的 created_at。 */
+export function listDmThread(networkId: string, meUserId: string, otherUserId: string, limit = 50, before?: string | null) {
+  const params: unknown[] = [networkId, meUserId, otherUserId];
+  let sql = `SELECT message_id, network_id, user_id, sender_user_id, from_session, kind, content, meta_json, acked, created_at
+               FROM user_inbox
+              WHERE network_id = ?1 AND kind = '${HUMAN_DM_KIND}'
+                AND ((user_id = ?2 AND sender_user_id = ?3) OR (user_id = ?3 AND sender_user_id = ?2))`;
+  if (before) { params.push(before); sql += ` AND created_at < ?${params.length}`; }
+  params.push(Math.max(1, Math.min(limit, 200)));
+  sql += ` ORDER BY created_at DESC, rowid DESC LIMIT ?${params.length}`;
+  return db.all<Record<string, unknown>>(sql, ...params).map((row) => ({
+    ...redactMessageRow(row),
+    direction: row.sender_user_id === meUserId ? "out" : "in",
+  }));
+}
+
+/** 我在这个网络里的私信会话:每个对方一行,最后一条时间 + 我这边的未读数。 */
+export function listDmThreads(networkId: string, meUserId: string) {
+  return db.all<{ other_user_id: string; last_at: string; unread: number }>(
+    `SELECT other_user_id, MAX(created_at) AS last_at, SUM(unread) AS unread FROM (
+       SELECT sender_user_id AS other_user_id, created_at, CASE WHEN acked = 0 THEN 1 ELSE 0 END AS unread
+         FROM user_inbox WHERE network_id = ?1 AND user_id = ?2 AND kind = '${HUMAN_DM_KIND}' AND sender_user_id IS NOT NULL
+       UNION ALL
+       SELECT user_id AS other_user_id, created_at, 0 AS unread
+         FROM user_inbox WHERE network_id = ?1 AND sender_user_id = ?2 AND kind = '${HUMAN_DM_KIND}'
+     ) GROUP BY other_user_id ORDER BY last_at DESC`,
+    networkId, meUserId,
+  ).map((r) => ({ other_user_id: r.other_user_id, last_at: r.last_at, unread: Number(r.unread ?? 0) }));
+}

package/src/network-scope.ts

@@ -11,13 +11,33 @@
 
 import { db } from "./db.js";
 import { getUserNetworkRole } from "./auth.js";
+import { isAgentRestricted, restrictedNetworkIds, usernameIsAgentAlias, visibleAgents } from "./agent-access.js";
 
 export type RestNetworkScope = {
   networkId: string | null;
   networkIds: string[] | null;
   denied?: string;
+  // 多用户 Agent 权限:scope 里哪些网络对这个调用者是「只看授权 Agent」的。
+  // addNetworkScope 对这些网络 fail-closed(整网不返回);要按授权放行的路径
+  // 显式改用 addAgentNetworkScope / addOwnTrafficScope,人类数据用 addHumanNetworkScope。
+  agentRestriction?: { userId: string; username: string; networkIds: string[] };
 };
 
+type ScopeAuthCtx = { userId: string; networkId: string | null; username?: string | null };
+
+function usernameOf(userId: string, known?: string | null): string {
+  if (known) return known;
+  return db.get<{ username: string }>("SELECT username FROM users WHERE user_id = ?1", userId)?.username ?? "";
+}
+
+function withAgentRestriction(scope: RestNetworkScope, authCtx: ScopeAuthCtx): RestNetworkScope {
+  const inScope = scope.networkId ? [scope.networkId] : (scope.networkIds ?? []);
+  if (inScope.length === 0) return scope;
+  const restricted = restrictedNetworkIds(authCtx.userId).filter((id) => inScope.includes(id));
+  if (restricted.length === 0) return scope;
+  return { ...scope, agentRestriction: { userId: authCtx.userId, username: usernameOf(authCtx.userId, authCtx.username), networkIds: restricted } };
+}
+
 export function getUserNetworkIds(userId: string): string[] {
   // JOIN networks: deleteNetwork historically left network_members rows
   // behind (fixed alongside PR #519, but legacy DBs still carry strays).
@@ -31,7 +51,7 @@ export function getUserNetworkIds(userId: string): string[] {
   ).map((row) => row.network_id);
 }
 
-export function resolveRestNetworkScope(requested: string | null, authCtx: { userId: string; networkId: string | null } | null, isAdmin: boolean): RestNetworkScope {
+export function resolveRestNetworkScope(requested: string | null, authCtx: ScopeAuthCtx | null, isAdmin: boolean): RestNetworkScope {
   // Legacy global token or open dev mode keeps the old global behavior.
   if (!authCtx) return { networkId: requested || null, networkIds: null };
 
@@ -44,13 +64,41 @@ export function resolveRestNetworkScope(requested: string | null, authCtx: { use
   if (requested) {
     const role = getUserNetworkRole(authCtx.userId, requested);
     if (!role) return { networkId: null, networkIds: [], denied: "access denied to requested network" };
-    return { networkId: requested, networkIds: null };
+    return withAgentRestriction({ networkId: requested, networkIds: null }, authCtx);
   }
 
-  return { networkId: null, networkIds: getUserNetworkIds(authCtx.userId) };
+  return withAgentRestriction({ networkId: null, networkIds: getUserNetworkIds(authCtx.userId) }, authCtx);
 }
 
+function unrestrictedNetworks(scope: RestNetworkScope): string[] | null {
+  const excluded = scope.agentRestriction?.networkIds ?? [];
+  if (scope.networkId) return excluded.includes(scope.networkId) ? [] : [scope.networkId];
+  if (scope.networkIds) return scope.networkIds.filter((id) => !excluded.includes(id));
+  return null;
+}
+
+function placeholders(params: any[], values: string[]): string {
+  const start = params.length;
+  params.push(...values);
+  return values.map((_, i) => `?${start + i + 1}`).join(", ");
+}
+
+/**
+ * 默认的网络作用域 —— 对受限成员的受限网络 **fail-closed**:整网不返回。
+ * 没被逐条审过、不知道按授权怎么放行的查询,默认走这里,受限成员什么都看不到。
+ */
 export function addNetworkScope(sql: string, params: any[], scope: RestNetworkScope, column = "network_id"): string {
+  if (!scope.agentRestriction) return addHumanNetworkScope(sql, params, scope, column);
+  const allowed = unrestrictedNetworks(scope) ?? [];
+  if (allowed.length === 0) return `${sql} AND 1=0`;
+  return `${sql} AND ${column} IN (${placeholders(params, allowed)})`;
+}
+
+/**
+ * 人类数据(自己的私信收件箱、需求看板、项目、网络成员)的作用域:受限成员照常看得到
+ * 自己所在网络。只给已确认不含 Agent 内容的查询用。
+ */
+export function addHumanNetworkScope(sql: string, params: any[], scope: RestNetworkScope, column = "network_id"): string {
   if (scope.networkId) {
     sql += ` AND ${column} = ?${params.length + 1}`;
     params.push(scope.networkId);
@@ -66,6 +114,69 @@ export function addNetworkScope(sql: string, params: any[], scope: RestNetworkSc
   return sql;
 }
 
+type AgentColumns = { network?: string; alias: string; nodeId?: string };
+
+/**
+ * Agent 行(sessions / nodes)的作用域:不受限的网络整网放行;受限网络只放行授权的 Agent。
+ * mode="message" 时只放行 can_message 的授权。
+ */
+export function addAgentNetworkScope(sql: string, params: any[], scope: RestNetworkScope, cols: AgentColumns, mode: "see" | "message" = "see"): string {
+  const restriction = scope.agentRestriction;
+  if (!restriction) return addHumanNetworkScope(sql, params, scope, cols.network ?? "network_id");
+  const net = cols.network ?? "network_id";
+  const parts: string[] = [];
+  const allowed = unrestrictedNetworks(scope) ?? [];
+  if (allowed.length) parts.push(`${net} IN (${placeholders(params, allowed)})`);
+  for (const networkId of restriction.networkIds) {
+    const visible = visibleAgents(restriction.userId, networkId);
+    const aliases = mode === "message" ? visible.messageAliases : visible.aliases;
+    const nodeIds = mode === "message" ? visible.messageNodeIds : visible.nodeIds;
+    const conds: string[] = [];
+    if (aliases.length) conds.push(`${cols.alias} IN (${placeholders(params, aliases)})`);
+    if (cols.nodeId && nodeIds.length) conds.push(`${cols.nodeId} IN (${placeholders(params, nodeIds)})`);
+    if (conds.length === 0) continue;
+    parts.push(`(${net} = ${placeholders(params, [networkId])} AND (${conds.join(" OR ")}))`);
+  }
+  return parts.length ? `${sql} AND (${parts.join(" OR ")})` : `${sql} AND 1=0`;
+}
+
+type TrafficColumns = { network?: string; from: string; to: string; fromNodeId?: string; toNodeId?: string };
+
+/**
+ * 任务 / inbox 这类「谁发给谁」的行:受限网络里只放行**自己**与**授权 Agent**之间的往来
+ * (from=自己 且 to=授权 Agent,或反过来)。别人(包括 owner)和同一个 Agent 的对话看不到。
+ */
+export function addOwnTrafficScope(sql: string, params: any[], scope: RestNetworkScope, cols: TrafficColumns): string {
+  const restriction = scope.agentRestriction;
+  if (!restriction) return addHumanNetworkScope(sql, params, scope, cols.network ?? "network_id");
+  const net = cols.network ?? "network_id";
+  const parts: string[] = [];
+  const allowed = unrestrictedNetworks(scope) ?? [];
+  if (allowed.length) parts.push(`${net} IN (${placeholders(params, allowed)})`);
+  if (restriction.username) {
+    for (const networkId of restriction.networkIds) {
+      // 用户名与本网络某个 Agent 的 alias 撞名时(入网时拦过,但 Agent 之后注册的 alias 拦不住),
+      // 「发给我的」无法和「发给那个 Agent 的」区分开 —— 这个网络的往来一律不放行。
+      if (usernameIsAgentAlias(networkId, restriction.username)) continue;
+      const visible = visibleAgents(restriction.userId, networkId);
+      // 先判空再生成占位符:side() 会往 params 里推值,推了又丢弃会让参数个数对不上。
+      const useNodeIds = !!(cols.fromNodeId && cols.toNodeId) && visible.nodeIds.length > 0;
+      if (visible.aliases.length === 0 && !useNodeIds) continue;
+      const side = (aliasCol: string, nodeCol?: string): string | null => {
+        const conds: string[] = [];
+        if (visible.aliases.length) conds.push(`${aliasCol} IN (${placeholders(params, visible.aliases)})`);
+        if (nodeCol && useNodeIds) conds.push(`${nodeCol} IN (${placeholders(params, visible.nodeIds)})`);
+        return conds.length ? `(${conds.join(" OR ")})` : null;
+      };
+      const toAgent = side(cols.to, cols.toNodeId)!;
+      const fromAgent = side(cols.from, cols.fromNodeId)!;
+      const me = placeholders(params, [restriction.username]);
+      parts.push(`(${net} = ${placeholders(params, [networkId])} AND ((${cols.from} = ${me} AND ${toAgent}) OR (${cols.to} = ${me} AND ${fromAgent})))`);
+    }
+  }
+  return parts.length ? `${sql} AND (${parts.join(" OR ")})` : `${sql} AND 1=0`;
+}
+
 export function singleNetworkId(scope: RestNetworkScope): string | null {
   if (scope.networkId) return scope.networkId;
   if (scope.networkIds?.length === 1) return scope.networkIds[0];
@@ -92,7 +203,19 @@ export function resolveRestWriteNetworkId(
   return memberships.length === 1 ? memberships[0] : null;
 }
 
+/**
+ * 能不能往这个网络写**面向 Agent 的东西**(派任务、改节点、排程……)。
+ * 受限成员在受限网络里恒为 false(fail-closed);给授权 Agent 发任务的路径另用
+ * canMessageAgent 单独放行,人类侧的写入(私信、需求、上传)用 canRestWriteNetworkAsHuman。
+ */
 export function canRestWriteNetwork(authCtx: { userId: string; networkId: string | null } | null, networkId: string | null, isAdmin: boolean): boolean {
+  if (!canRestWriteNetworkAsHuman(authCtx, networkId, isAdmin)) return false;
+  if (!authCtx || isAdmin || !networkId) return true;
+  return !isAgentRestricted(authCtx.userId, networkId);
+}
+
+/** 旧的「成员且不是 viewer」判据,不看 Agent 授权。只给人类侧写入用。 */
+export function canRestWriteNetworkAsHuman(authCtx: { userId: string; networkId: string | null } | null, networkId: string | null, isAdmin: boolean): boolean {
   if (!authCtx) return true; // legacy global token or open dev mode
   if (isAdmin) return true;
   if (!networkId) return false;

package/src/node-token-privilege-http.test.ts

@@ -0,0 +1,149 @@
+// 节点令牌不继承签发者的账号权限与 Hub 管理员身份。
+//
+// 生产上几乎所有节点令牌(ntok_)都由管理员签发,resolveToken 把它解析成那个管理员用户。
+// 以前一部分端点直接看 `resolved.user.role === "admin"` 或把令牌当成用户本人,于是任何一个节点
+// 都能:列全部用户、读服务端日志与审计日志、给签发者再签用户令牌 / 节点令牌、改签发者资料与密码、
+// 建 / 改 / 删网络、管成员与邀请、读别的网络详情、看全部网络的 SSE 拓扑。
+// 这里每一条在修复前(main)都是红的;管理员自己的用户令牌作为正控,照常可用。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetwork, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-ntok-priv-"));
+let BASE = "";
+let hub: any = null;
+const PW = "NtokPrivPassw0rd!";
+let adminToken = "", adminId = "", NET = "", OTHER_NET = "", ntok = "";
+
+const auth = (t: string) => ({ Authorization: `Bearer ${t}` });
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...auth(token), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const admin = register(`ntok_admin_${Date.now()}`, PW);
+  adminToken = admin.token!; adminId = admin.user!.user_id; NET = admin.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [adminId]);
+  const other = createNetwork(adminId, "ntok-other");
+  OTHER_NET = (other as any).network_id;
+  const minted = createNetworkTokenForNode(adminId, NET, "ntok-node", "node_ntok_priv");
+  expect(minted.ok).toBe(true);
+  ntok = minted.token!;
+  register(`ntok_someone_${Date.now()}`, PW);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("hub-admin powers need a user token", () => {
+  test("GET /api/users", async () => {
+    expect((await call(ntok, "GET", "/api/users")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/users")).status).toBe(200);
+  });
+  test("GET /api/server-logs", async () => {
+    expect((await call(ntok, "GET", "/api/server-logs")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/server-logs")).status).toBe(200);
+  });
+  test("GET /api/audit-log", async () => {
+    expect((await call(ntok, "GET", "/api/audit-log")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/audit-log")).status).toBe(200);
+  });
+  test("GET /api/networks/:id of a network the token is not bound to", async () => {
+    expect((await call(ntok, "GET", `/api/networks/${OTHER_NET}`)).status).toBe(403);
+    expect((await call(ntok, "GET", `/api/networks/${NET}`)).status).toBe(200);
+  });
+  test("GET /api/stats/sse is limited to the bound network", async () => {
+    const ctrl = new AbortController();
+    const sub = await fetch(`${BASE}/events/some-agent?network_id=${OTHER_NET}`, { headers: auth(adminToken), signal: ctrl.signal }).catch(() => null);
+    const r = await call(ntok, "GET", "/api/stats/sse");
+    ctrl.abort();
+    expect(r.status).toBe(200);
+    expect(Object.keys(r.body.sessions).every((k) => k.split(":").includes(NET))).toBe(true);
+    expect(JSON.stringify(r.body)).not.toContain(OTHER_NET);
+    void sub;
+  });
+  test("POST /api/admin/users and agent-grants", async () => {
+    expect((await call(ntok, "POST", "/api/admin/users", { username: "ntok_made", password: PW })).status).toBe(403);
+    expect((await call(ntok, "GET", `/api/networks/${NET}/members/${adminId}/agent-grants`)).status).toBe(403);
+  });
+});
+
+describe("account and network management need a user token", () => {
+  test("token management: cannot list, mint user tokens, mint node tokens or revoke", async () => {
+    expect((await call(ntok, "GET", "/api/auth/tokens")).status).toBe(403);
+    const minted = await call(ntok, "POST", "/api/auth/tokens", { name: "escalate" });
+    expect(minted.status).toBe(403);
+    expect(minted.body.token).toBeUndefined();
+    expect((await call(ntok, "POST", "/api/auth/node-token", { network_id: OTHER_NET, node_name: "x" })).status).toBe(403);
+    expect((await call(ntok, "DELETE", "/api/auth/tokens/tok_whatever")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/auth/tokens")).status).toBe(200);
+  });
+  test("cannot edit the owner's profile or password", async () => {
+    expect((await call(ntok, "PUT", "/api/auth/me", { display_name: "pwned" })).status).toBe(403);
+    expect(db.get<{ display_name: string }>("SELECT display_name FROM users WHERE user_id = ?1", adminId)?.display_name).not.toBe("pwned");
+    expect((await call(ntok, "POST", "/api/auth/password", { old_password: PW, new_password: "AnotherPassw0rd!" })).status).toBe(403);
+  });
+  test("cannot create, rename or delete networks", async () => {
+    expect((await call(ntok, "POST", "/api/networks", { name: "ntok-made" })).status).toBe(403);
+    expect((await call(ntok, "PUT", `/api/networks/${OTHER_NET}`, { name: "renamed" })).status).toBe(403);
+    expect((await call(ntok, "DELETE", `/api/networks/${OTHER_NET}`)).status).toBe(403);
+    expect(db.get("SELECT 1 FROM networks WHERE network_id = ?1", OTHER_NET)).toBeTruthy();
+  });
+  test("cannot manage members, invites or join", async () => {
+    expect((await call(ntok, "GET", `/api/networks/${NET}/members`)).status).toBe(403);
+    expect((await call(ntok, "POST", `/api/networks/${NET}/members`, { user_id: "u_x" })).status).toBe(403);
+    expect((await call(ntok, "POST", `/api/networks/${NET}/invite`, { role: "admin" })).status).toBe(403);
+    expect((await call(ntok, "POST", "/api/networks/join", { invite_code: "inv_x" })).status).toBe(403);
+    expect((await call(adminToken, "GET", `/api/networks/${NET}/members`)).status).toBe(200);
+  });
+  test("renames: a node token may only rename ITSELF in its bound network", async () => {
+    // 别的网络 / 别的节点 → user_token_required
+    expect((await call(ntok, "POST", "/api/node-rename/prepare", { network_id: OTHER_NET, old_alias: "ntok-node", new_alias: "b" })).status).toBe(403);
+    db.run(`INSERT INTO sessions (resume_id, alias, status, network_id) VALUES ('r_other_node', 'other-node', 'idle', ?1)`, [NET]);
+    expect((await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "other-node", new_alias: "b" })).status).toBe(403);
+    // 另一个节点(管理员用户令牌)开的事务,本节点不能提交
+    const foreign = await call(adminToken, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "other-node", new_alias: "other-node-2" });
+    expect(foreign.body.ok).toBe(true);
+    expect((await call(ntok, "POST", "/api/node-rename/commit", { txn_id: foreign.body.txn_id })).status).toBe(403);
+    expect((await call(adminToken, "POST", "/api/node-rename/abort", { txn_id: foreign.body.txn_id })).body.ok).toBe(true);
+    // 自己:照常(anet node rename 就是这么用的)
+    db.run(`INSERT INTO sessions (resume_id, alias, status, network_id) VALUES ('r_self_node', 'ntok-node', 'idle', ?1)`, [NET]);
+    const mine = await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "ntok-node", new_alias: "ntok-node-2" });
+    expect(mine.body.ok).toBe(true);
+    expect((await call(ntok, "POST", "/api/node-rename/abort", { txn_id: mine.body.txn_id })).body.ok).toBe(true);
+  });
+});
+
+describe("/api/auth/me says what the credential is", () => {
+  test("node token: owner user for compatibility, but credential.kind=node and only the bound network", async () => {
+    const r = await call(ntok, "GET", "/api/auth/me");
+    expect(r.status).toBe(200);
+    expect(r.body.credential).toMatchObject({ kind: "node", network_id: NET, node_alias: "ntok-node", acts_as_owner: false });
+    expect(r.body.current_network).toBe(NET);
+    expect(r.body.networks.map((n: any) => n.network_id)).toEqual([NET]);
+    const u = await call(adminToken, "GET", "/api/auth/me");
+    expect(u.body.credential).toEqual({ kind: "user" });
+    expect(u.body.networks.map((n: any) => n.network_id).sort()).toEqual([NET, OTHER_NET].sort());
+  });
+  test("node token keeps its own network powers (still a member): status and tasks read fine", async () => {
+    expect((await call(ntok, "GET", "/api/status")).status).toBe(200);
+    expect((await call(ntok, "GET", "/api/tasks")).status).toBe(200);
+  });
+});

package/src/observer-avatar-http.test.ts

@@ -166,7 +166,8 @@ describe("#461 GET /events/network/:id — auth", () => {
     // not catch this: its authCtx.networkId is null, so only ntok
     // exercises the vulnerable branch — verified by stubbing the OR
     // back in: THIS test goes red, the utok variants stay green).
-    const added = addNetworkMember(memberNetworkId, outsiderUserId, "member");
+    // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+    const added = addNetworkMember(memberNetworkId, outsiderUserId, "member", undefined, { agentAccess: "all" });
     expect(added.ok).toBe(true);
     const minted = createNetworkTokenForNode(outsiderUserId, memberNetworkId, "revocation-probe");
     expect(minted.ok).toBe(true);

package/src/push.ts

@@ -84,6 +84,10 @@ type SSEClient = {
   keepaliveTimer?: ReturnType<typeof setInterval>;
   /** Stable key for log/diagnostic context. */
   key: string;
+  /** 多用户 Agent 权限:订阅者的 user_id(有的话),权限变化时据此断开重连重新鉴权。 */
+  subscriberUserId?: string;
+  /** 只推满足条件的事件(受限成员的网络观察流用)。缺省 = 全推。 */
+  eventFilter?: (event: Record<string, unknown>) => boolean;
 };
 
 // 一个 session 可能有多个 SSE 连接（重连时短暂并存）
@@ -263,10 +267,14 @@ export function createSSEStream(sessionName: string, networkId?: string | null):
 /** #461 — 创建网络级观察者 SSE Response（dashboard 观察第三方流量）。
  *  Shares the exact same registration / backpressure / liveness
  *  machinery as session streams; only the key scheme differs. */
-export function createNetworkObserverStream(networkId: string): Response {
+export function createNetworkObserverStream(
+  networkId: string,
+  opts: { subscriberUserId?: string; eventFilter?: (event: Record<string, unknown>) => boolean } = {},
+): Response {
   return createStreamForKey(
     observerKey(networkId),
     { type: "connected", observer: true, network_id: networkId },
+    opts,
   );
 }
 
@@ -276,10 +284,15 @@ export function createUserEventStream(networkId: string, userId: string): Respon
   return createStreamForKey(
     userKey(networkId, userId),
     { type: "connected", user: true, network_id: networkId, user_id: userId },
+    { subscriberUserId: userId },
   );
 }
 
-function createStreamForKey(key: string, initialEvent: Record<string, unknown>): Response {
+function createStreamForKey(
+  key: string,
+  initialEvent: Record<string, unknown>,
+  opts: { subscriberUserId?: string; eventFilter?: (event: Record<string, unknown>) => boolean } = {},
+): Response {
   const encoder = new TextEncoder();
   let client: SSEClient;
 
@@ -291,6 +304,8 @@ function createStreamForKey(key: string, initialEvent: Record<string, unknown>):
         stuckSince: null,
         closed: false,
         key,
+        ...(opts.subscriberUserId ? { subscriberUserId: opts.subscriberUserId } : {}),
+        ...(opts.eventFilter ? { eventFilter: opts.eventFilter } : {}),
       };
 
       if (!clients.has(key)) clients.set(key, []);
@@ -454,6 +469,11 @@ export function pushNetworkObserverEvent(
       needPrune = true;
       continue;
     }
+    if (c.eventFilter) {
+      let pass = false;
+      try { pass = c.eventFilter(event); } catch { pass = false; }
+      if (!pass) continue;
+    }
     const result = tryEnqueueBytes(c, c.encoder.encode(data));
     if (result === "dead") needPrune = true;
   }
@@ -503,6 +523,27 @@ export function pushUserEvent(
   if (needPrune) pruneClosed(key);
 }
 
+/**
+ * 多用户 Agent 权限:某用户在某网络的授权 / 成员资格变了,断开他在这个网络里**订阅时带了身份**
+ * 的流(网络观察流、用户流),客户端重连时按新权限重新鉴权。返回断开的条数。
+ * Agent 频道(/events/<alias>)受限成员本来就订阅不了,不需要这里处理。
+ */
+export function closeUserStreamsInNetwork(networkId: string, userId: string): number {
+  let closed = 0;
+  for (const key of [observerKey(networkId), userKey(networkId, userId)]) {
+    const arr = clients.get(key);
+    if (!arr) continue;
+    for (const c of arr) {
+      if (!c.closed && c.subscriberUserId === userId) {
+        closeClient(c, "access-changed");
+        closed++;
+      }
+    }
+    pruneClosed(key);
+  }
+  return closed;
+}
+
 export function __resetSSEClientsForTest(): void {
   for (const arr of clients.values()) {
     for (const c of arr) closeClient(c, "reset-for-test");

package/src/rename.ts

@@ -15,6 +15,7 @@
 import { randomUUID } from "crypto";
 import { db } from "./db";
 import { getUserNetworkRole, getNetworkMembers } from "./auth";
+import { canSeeAgent, isAgentRestricted } from "./agent-access";
 import { pushEvent } from "./push";
 import { eventBus } from "./event_bus";
 
@@ -35,7 +36,8 @@ export interface CanonicalAlias {
 
 function hasWriteAccess(userId: string, networkId: string): boolean {
   const role = getUserNetworkRole(userId, networkId);
-  return !!role && role !== "viewer";
+  // 改名是对 Agent 的写操作;受限成员(只看授权 Agent 的成员)不能改。
+  return !!role && role !== "viewer" && !isAgentRestricted(userId, networkId);
 }
 
 // Resolve committed alias renames (old -> new), following short chains such
@@ -214,8 +216,11 @@ export function commitRename(userId: string, txnId: string): RenameResult {
   // without this it would never receive node.renamed (#84 SSE channel fix:
   // N站马 confirmed the dashboard listens on the user channel). All members get
   // it, not just the owner, since any member's dashboard should reflect the rename.
+  // 多用户 Agent 权限:受限成员只收到他被授权的那个 Agent 的改名(否则等于把 alias 广播给他)。
   for (const member of getNetworkMembers(txn.network_id)) {
-    if (member.username) pushEvent(member.username, renamedEvent, txn.network_id);
+    if (!member.username) continue;
+    if (!canSeeAgent(member.user_id, txn.network_id, { alias: txn.new_alias, nodeId: renamedNode?.node_id ?? null })) continue;
+    pushEvent(member.username, renamedEvent, txn.network_id);
   }
 
   return { ok: true, txn_id: txnId };

package/src/requirement-tags.ts

@@ -0,0 +1,16 @@
+/** Small, network-local labels; count Unicode code points rather than UTF-16 units. */
+export function normalizeTags(value: unknown): string[] | null {
+  if (!Array.isArray(value) || value.length > 10) return null;
+  const tags: string[] = [];
+  for (const valueTag of value) {
+    if (typeof valueTag !== "string") return null;
+    const tag = valueTag.trim();
+    if (!tag || [...tag].length > 20 || /[\u0000-\u001f\u007f]/u.test(tag)) return null;
+    if (!tags.includes(tag)) tags.push(tag);
+  }
+  return tags;
+}
+
+export function storedTags(value: string | null): string[] {
+  try { return normalizeTags(JSON.parse(value || "[]")) ?? []; } catch { return []; }
+}