@sleep2agi/commhub-server 0.9.0-preview.67 → 0.9.0-preview.69

package/src/rename.ts

@@ -15,6 +15,7 @@
 import { randomUUID } from "crypto";
 import { db } from "./db";
 import { getUserNetworkRole, getNetworkMembers } from "./auth";
+import { canSeeAgent, isAgentRestricted } from "./agent-access";
 import { pushEvent } from "./push";
 import { eventBus } from "./event_bus";
 
@@ -35,7 +36,8 @@ export interface CanonicalAlias {
 
 function hasWriteAccess(userId: string, networkId: string): boolean {
   const role = getUserNetworkRole(userId, networkId);
-  return !!role && role !== "viewer";
+  // 改名是对 Agent 的写操作;受限成员(只看授权 Agent 的成员)不能改。
+  return !!role && role !== "viewer" && !isAgentRestricted(userId, networkId);
 }
 
 // Resolve committed alias renames (old -> new), following short chains such
@@ -214,8 +216,11 @@ export function commitRename(userId: string, txnId: string): RenameResult {
   // without this it would never receive node.renamed (#84 SSE channel fix:
   // N站马 confirmed the dashboard listens on the user channel). All members get
   // it, not just the owner, since any member's dashboard should reflect the rename.
+  // 多用户 Agent 权限:受限成员只收到他被授权的那个 Agent 的改名(否则等于把 alias 广播给他)。
   for (const member of getNetworkMembers(txn.network_id)) {
-    if (member.username) pushEvent(member.username, renamedEvent, txn.network_id);
+    if (!member.username) continue;
+    if (!canSeeAgent(member.user_id, txn.network_id, { alias: txn.new_alias, nodeId: renamedNode?.node_id ?? null })) continue;
+    pushEvent(member.username, renamedEvent, txn.network_id);
   }
 
   return { ok: true, txn_id: txnId };

package/src/requirement-tags.ts

@@ -0,0 +1,16 @@
+/** Small, network-local labels; count Unicode code points rather than UTF-16 units. */
+export function normalizeTags(value: unknown): string[] | null {
+  if (!Array.isArray(value) || value.length > 10) return null;
+  const tags: string[] = [];
+  for (const valueTag of value) {
+    if (typeof valueTag !== "string") return null;
+    const tag = valueTag.trim();
+    if (!tag || [...tag].length > 20 || /[\u0000-\u001f\u007f]/u.test(tag)) return null;
+    if (!tags.includes(tag)) tags.push(tag);
+  }
+  return tags;
+}
+
+export function storedTags(value: string | null): string[] {
+  try { return normalizeTags(JSON.parse(value || "[]")) ?? []; } catch { return []; }
+}

package/src/requirements-http.test.ts

@@ -55,6 +55,84 @@ afterAll(() => {
 describe("requirements stay on the hub", () => {
   let id = "";
 
+  test("name limit is consistent across create, PATCH and both upsert paths", async () => {
+    const send = (path: string, method: string, body: unknown) => api(ownerToken, path, { method, body: JSON.stringify(body) });
+    const ref = 'github:test/name-limit#1';
+    const created = await send('/api/requirements/upsert', 'POST', { name: '字'.repeat(80), external_ref: ref });
+    expect(created.status).toBe(201);
+    const path = `/api/requirements/${created.body.requirement.id}`;
+    for (const name of ['a'.repeat(150), '字'.repeat(81), '   ', null, 12]) {
+      for (const [url, method, extra] of [
+        ['/api/requirements', 'POST', {}],
+        [path, 'PATCH', {}],
+        ['/api/requirements/upsert', 'POST', { external_ref: ref }],
+        ['/api/requirements/upsert', 'POST', { external_ref: 'github:test/name-limit#2' }],
+      ] as const) {
+        const result = await send(url, method, { ...extra, name });
+        expect(result.status).toBe(400);
+        expect(result.body.error).toBe('invalid_name');
+      }
+    }
+    expect((await api(ownerToken, path)).body.requirement.name).toBe('字'.repeat(80));
+    const boundary = await send(path, 'PATCH', { name: `  ${'界'.repeat(80)}  ` });
+    expect(boundary.status).toBe(200);
+    expect(boundary.body.requirement.name).toBe('界'.repeat(80));
+    expect((await send(path, 'PATCH', { priority: 'high' })).body.requirement.name).toBe('界'.repeat(80));
+    await api(ownerToken, path, { method: 'DELETE' });
+  });
+
+  test("archived=true returns only archived tasks and default excludes them", async () => {
+    const create = async (token: string, name: string) => api(token, '/api/requirements', { method: 'POST', body: JSON.stringify({ name }) });
+    const active = (await create(ownerToken, 'archive-filter-active')).body.requirement.id;
+    const archived = (await create(ownerToken, 'archive-filter-archived')).body.requirement.id;
+    const foreign = (await create(otherToken, 'archive-filter-foreign')).body.requirement.id;
+    for (const [token, taskId] of [[ownerToken, archived], [otherToken, foreign]]) {
+      expect((await api(token, `/api/requirements/${taskId}`, { method: 'PATCH', body: JSON.stringify({ archived: true }) })).status).toBe(200);
+    }
+    const ids = async (query: string) => {
+      const result = await api(ownerToken, `/api/requirements${query}${query ? '&' : '?'}network_id=${ownerNetwork}`);
+      expect(result.status).toBe(200);
+      return result.body.requirements.map((task: any) => task.id);
+    };
+    expect(await ids('?archived=true')).toEqual([archived]);
+    expect(await ids('?archived=true&include_archived=1')).toEqual([archived]);
+    const defaults = await ids('');
+    expect(defaults).toContain(active);
+    expect(defaults).not.toContain(archived);
+    expect(defaults).not.toContain(foreign);
+    expect(await ids('?archived=false')).toEqual(defaults);
+    const all = await ids('?include_archived=1');
+    expect(all).toContain(active);
+    expect(all).toContain(archived);
+    expect(all).not.toContain(foreign);
+    for (const [token, taskId] of [[ownerToken, active], [ownerToken, archived], [otherToken, foreign]]) {
+      await api(token, `/api/requirements/${taskId}`, { method: 'DELETE' });
+    }
+  });
+
+  test("tags validate, aggregate within network, and survive old PATCH shapes", async () => {
+    const created = await api(ownerToken, '/api/requirements', { method: 'POST', body: JSON.stringify({ name: 'tagged task', tags: [' UI ', 'UI', '交付'] }) });
+    expect(created.status).toBe(201);
+    expect(created.body.requirement.tags).toEqual(['UI', '交付']);
+    const path = `/api/requirements/${created.body.requirement.id}`;
+    const old = await api(ownerToken, path, { method: 'PATCH', body: JSON.stringify({ column: 'doing', name: 'old app edit' }) });
+    expect(old.status).toBe(200);
+    expect(old.body.requirement.tags).toEqual(['UI', '交付']);
+    for (const tags of [null, 'UI', [12], [''], ['a'.repeat(21)], Array.from({ length: 11 }, (_, i) => `t${i}`)]) {
+      const invalid = await api(ownerToken, path, { method: 'PATCH', body: JSON.stringify({ tags }) });
+      expect(invalid.status).toBe(400);
+      expect(invalid.body.error).toBe('invalid_tags');
+    }
+    const own = await api(ownerToken, '/api/requirements/tags');
+    expect(own.body.tags).toEqual(['UI', '交付']);
+    expect((await api(otherToken, '/api/requirements/tags')).body.tags).toEqual([]);
+    expect((await api(nodeToken, '/api/requirements/tags')).body.tags).toEqual(['UI', '交付']);
+    expect((await api(viewerToken, `${path}?network_id=${ownerNetwork}`, { method: 'PATCH', body: JSON.stringify({ tags: [] }) })).status).toBe(403);
+    const cleared = await api(ownerToken, path, { method: 'PATCH', body: JSON.stringify({ tags: [] }) });
+    expect(cleared.body.requirement.tags).toEqual([]);
+    expect((await api(ownerToken, '/api/requirements/tags')).body.tags).toEqual([]);
+  });
+
   test("typed assignments validate network membership, preserve kinds and clear explicitly", async () => {
     const { db } = await import('./db.js');
     const ownerId = db.get<{ owner_id: string }>('SELECT owner_id FROM networks WHERE network_id=?1', ownerNetwork)!.owner_id;
@@ -294,7 +372,7 @@ describe("requirements stay on the hub", () => {
     expect((await api(ownerToken, path, { method: "PATCH", body: JSON.stringify({ due: "" }) })).body.requirement.due).toBe("");
     const listed = await api(ownerToken, "/api/requirements");
     expect(listed.body.capabilities).toContain("due_datetime");
-    expect(listed.body.capabilities).toEqual(["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements"]);
+    expect(listed.body.capabilities).toEqual(["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest"]);
   });
 
   test("sub-requirements: parent_id in the same network, no cycles, ≤ 5 levels, child counts, filters, delete detaches children", async () => {

package/src/requirements-mcp.test.ts

@@ -60,6 +60,13 @@ describe("requirements MCP tools", () => {
       expect((await s.call("requirements_create", { name: "x", owner: { kind: "robot", id: "a" } })).mcpError).toBe(true);
       expect((await s.call("requirements_checklist_toggle", { id: "r", item_id: "has space", done: true })).mcpError).toBe(true);
       expect((await s.call("requirements_create", { name: "" })).mcpError).toBe(true);
+      // P0–P3:lowest(P3 极低)在建 / 改 / upsert 都能写;不认识的值在协议边界被拒
+      expect((await s.call("requirements_create", { name: "x", priority: "urgent" })).mcpError).toBe(true);
+      const low = await s.call("requirements_create", { name: "极低", priority: "lowest" });
+      expect(low.requirement.priority).toBe("lowest");
+      expect((await s.call("requirements_update", { id: low.requirement.id, priority: "high" })).requirement.priority).toBe("high");
+      expect((await s.call("requirements_update", { id: low.requirement.id, priority: "lowest" })).requirement.priority).toBe("lowest");
+      expect((await s.call("requirements_upsert_by_external_ref", { external_ref: "github:acme/p3#1", name: "同步", priority: "lowest" })).requirement.priority).toBe("lowest");
     } finally { await s.close(); }
   });
 
@@ -70,9 +77,12 @@ describe("requirements MCP tools", () => {
       const first = await s.call("requirements_upsert_by_external_ref", { external_ref: ref, external_url: "https://github.com/acme/widgets/issues/42", name: "修复登录", description: "issue 正文", checklist: [{ id: "c1", text: "复现" }, { id: "c2", text: "修" }] });
       expect(first.ok).toBe(true);
       expect(first.created).toBe(true);
+      const tagged = await s.call("requirements_update", { id: first.requirement.id, tags: ["release"] });
+      expect(tagged.requirement.tags).toEqual(["release"]);
       expect(first.requirement.created_by).toEqual({ kind: "node", id: "node_gh_sync" });
       const again = await s.call("requirements_upsert_by_external_ref", { external_ref: ref, name: "修复登录(改了标题)" });
       expect(again.created).toBe(false);
+      expect(again.requirement.tags).toEqual(["release"]);
       expect(again.requirement.id).toBe(first.requirement.id);
       const listed = await s.call("requirements_list", { external_ref: ref });
       expect(listed.requirements.length).toBe(1);

package/src/requirements-migrate.ts

@@ -49,3 +49,35 @@ export function ensureRequirementIndexes(database: DbAdapter): void {
   database.exec("CREATE INDEX IF NOT EXISTS idx_requirements_network_updated ON requirements(network_id, updated_at)");
   database.exec("CREATE INDEX IF NOT EXISTS idx_requirements_parent ON requirements(parent_id) WHERE parent_id IS NOT NULL");
 }
+
+/**
+ * 优先级加 lowest(P3 极低)。旧库建表时带 CHECK(priority IN ('high', 'normal', 'low')),SQLite 不能就地改
+ * CHECK,只能重建一次:拿 sqlite_master 里的原建表语句(含历次加的列)只换掉那个 CHECK,整表拷过去,
+ * 再按原样重建这张表的索引。已经放开的库什么都不做。存量值不改。
+ */
+const OLD_PRIORITY_CHECK = /CHECK\s*\(\s*priority\s+IN\s*\(\s*'high'\s*,\s*'normal'\s*,\s*'low'\s*\)\s*\)/i;
+export const PRIORITY_CHECK = "CHECK(priority IN ('high', 'normal', 'low', 'lowest'))";
+export function migrateRequirementPriorityCheck(database: DbAdapter): { rebuilt: boolean } {
+  if (database.dialect === "postgres") {
+    try {
+      database.exec("ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_priority_check");
+      database.exec(`ALTER TABLE requirements ADD CONSTRAINT requirements_priority_check ${PRIORITY_CHECK}`);
+    } catch {}
+    return { rebuilt: false };
+  }
+  const table = database.get<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'requirements'");
+  if (!table?.sql || !OLD_PRIORITY_CHECK.test(table.sql)) return { rebuilt: false };
+  const indexes = database.all<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = 'requirements' AND sql IS NOT NULL");
+  const createSql = table.sql
+    .replace(/^CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?requirements["`]?/i, "CREATE TABLE requirements_migrated")
+    .replace(OLD_PRIORITY_CHECK, PRIORITY_CHECK);
+  database.transaction(() => {
+    database.exec("DROP TABLE IF EXISTS requirements_migrated");
+    database.exec(createSql);
+    database.exec("INSERT INTO requirements_migrated SELECT * FROM requirements");
+    database.exec("DROP TABLE requirements");
+    database.exec("ALTER TABLE requirements_migrated RENAME TO requirements");
+    for (const index of indexes) database.exec(index.sql);
+  });
+  return { rebuilt: true };
+}

package/src/requirements-priority-lowest.test.ts

@@ -0,0 +1,114 @@
+// P0–P3 优先级:lowest(P3 极低)。生产库的 requirements 表建于旧 db.ts,带 CHECK(priority IN ('high', 'normal', 'low')),
+// 光放开校验集合写进去也会被 SQLite 拒掉。这里先用旧建表语句建库、塞行,再走真实启动路径(db.ts + server.ts),
+// 看:表重建一次、存量行 / 索引原样、lowest 在 POST / PATCH / upsert 都能写、坏值仍被拒、再启动不再重建。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const dir = mkdtempSync(join(tmpdir(), "anet-req-priority-"));
+const file = join(dir, "hub.db");
+process.env.COMMHUB_DB = file;
+
+const legacy = new Database(file);
+legacy.exec(`
+  CREATE TABLE IF NOT EXISTS requirements (
+    requirement_id TEXT PRIMARY KEY,
+    network_id     TEXT NOT NULL,
+    title          TEXT NOT NULL,
+    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done')),
+    priority       TEXT NOT NULL DEFAULT 'normal' CHECK(priority IN ('high', 'normal', 'low')),
+    due_on         TEXT,
+    assignee       TEXT,
+    client_id      TEXT,
+    issues_json    TEXT,
+    created_by     TEXT,
+    created_at     TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at     TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_requirements_network ON requirements(network_id, created_at DESC);
+`);
+legacy.exec("ALTER TABLE requirements ADD COLUMN tags_json TEXT NOT NULL DEFAULT '[]'");
+legacy.exec("ALTER TABLE requirements ADD COLUMN description TEXT");
+const seeded = [["r_high", "high"], ["r_normal", "normal"], ["r_low", "low"]] as const;
+for (const [id, p] of seeded) {
+  legacy.run("INSERT INTO requirements (requirement_id, network_id, title, priority, client_id, description, tags_json) VALUES (?1, 'net_legacy', ?2, ?3, ?4, ?5, '[\"旧\"]')", [id, `卡 ${id}`, p, `c_${id}`, `desc ${id}`]);
+}
+// 旧库确实拒 lowest:这就是光改 PRIORITIES 不够的原因
+expect(() => legacy.run("INSERT INTO requirements (requirement_id, network_id, title, priority) VALUES ('x', 'n', 't', 'lowest')")).toThrow(/CHECK/);
+legacy.close();
+
+let base = "";
+let token = "";
+let server: { port: number; stop?: (force?: boolean) => void };
+let db: any;
+
+async function api(path: string, init?: RequestInit) {
+  const res = await fetch(`${base}${path}`, { ...init, headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" } });
+  return { status: res.status, body: await res.json() as any };
+}
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const owner = register(`prio_owner_${Date.now()}`, "PriorityOwner123!", undefined, "seed");
+  token = owner.token!;
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(dir, { recursive: true, force: true }); } catch {}
+});
+
+describe("P3 lowest priority", () => {
+  test("startup rebuilds the legacy CHECK once and keeps every row and index", async () => {
+    const sql = db.get("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'requirements'").sql as string;
+    expect(sql).toContain("'lowest'");
+    expect(sql).toContain("CHECK(column_name IN ('pool', 'doing', 'done'))");
+    const rows = db.all("SELECT requirement_id, network_id, title, priority, client_id, description, tags_json FROM requirements WHERE network_id = 'net_legacy' ORDER BY requirement_id") as any[];
+    expect(rows.map(r => [r.requirement_id, r.priority])).toEqual([["r_high", "high"], ["r_low", "low"], ["r_normal", "normal"]]);
+    for (const r of rows) {
+      expect(r.title).toBe(`卡 ${r.requirement_id}`);
+      expect(r.client_id).toBe(`c_${r.requirement_id}`);
+      expect(r.description).toBe(`desc ${r.requirement_id}`);
+      expect(r.tags_json).toBe('["旧"]');
+    }
+    const indexes = (db.all("PRAGMA index_list(requirements)") as { name: string; unique: number }[]).map(i => i.name);
+    for (const name of ["idx_requirements_network", "idx_requirements_client", "idx_requirements_external_ref", "idx_requirements_network_updated", "idx_requirements_parent"]) expect(indexes).toContain(name);
+    expect(db.get("SELECT name FROM sqlite_master WHERE name = 'requirements_migrated'")).toBeNull();
+    // 坏值仍被数据库拒
+    expect(() => db.run("INSERT INTO requirements (requirement_id, network_id, title, priority) VALUES ('bad', 'n', 't', 'urgent')")).toThrow(/CHECK/);
+    // 下次启动:已经放开,不再重建
+    const { migrateRequirementPriorityCheck } = await import("./requirements-migrate.js");
+    expect(migrateRequirementPriorityCheck(db).rebuilt).toBe(false);
+  });
+
+  test("lowest is accepted on create, PATCH and upsert; unknown values stay 400", async () => {
+    const created = await api("/api/requirements", { method: "POST", body: JSON.stringify({ name: "极低的活", priority: "lowest" }) });
+    expect(created.status).toBe(201);
+    expect(created.body.requirement.priority).toBe("lowest");
+    const id = created.body.requirement.id;
+    const patched = await api(`/api/requirements/${id}`, { method: "PATCH", body: JSON.stringify({ priority: "low" }) });
+    expect(patched.body.requirement.priority).toBe("low");
+    const back = await api(`/api/requirements/${id}`, { method: "PATCH", body: JSON.stringify({ priority: "lowest" }) });
+    expect(back.status).toBe(200);
+    expect(back.body.requirement.priority).toBe("lowest");
+    const up = await api("/api/requirements/upsert", { method: "POST", body: JSON.stringify({ name: "同步来的", external_ref: "github:t/p#1", priority: "lowest" }) });
+    expect(up.status).toBe(201);
+    expect(up.body.requirement.priority).toBe("lowest");
+    const upAgain = await api("/api/requirements/upsert", { method: "POST", body: JSON.stringify({ external_ref: "github:t/p#1", priority: "high" }) });
+    expect(upAgain.body.requirement.priority).toBe("high");
+    for (const [path, method] of [["/api/requirements", "POST"], [`/api/requirements/${id}`, "PATCH"]] as const) {
+      const bad = await api(path, { method, body: JSON.stringify({ name: "x", priority: "urgent" }) });
+      expect(bad.status).toBe(400);
+      expect(bad.body.error).toBe("invalid_priority");
+    }
+    const listed = await api("/api/requirements");
+    expect(listed.body.capabilities).toContain("priority_lowest");
+    expect(listed.body.requirements.find((r: any) => r.id === id).priority).toBe("lowest");
+  });
+});