@sleep2agi/commhub-server 0.9.0-preview.7 → 0.9.0-preview.71

package/src/create-node-validate.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import {
   ValidationError,
-  validateName, validateRuntime, validateModel, validateFlagValue,
+  validateName, validateRuntime, validateModel, validateFlagValue, RUNTIMES,
   validateEnvRefs, validateChannelsP1, serializeEnvLocal, buildAnetArgs,
   MAX_ENV_KEYS_PER_NODE,
 } from "./create-node-validate.js";
@@ -35,6 +35,15 @@ describe("validateRuntime / validateModel (§4.2.2)", () => {
     expect(() => validateModel("gpt-4o")).not.toThrow();
     expect(() => validateModel("bad model")).toThrow(ValidationError);
     expect(() => validateModel("x;rm")).toThrow(ValidationError);
+    // provider/model(OpenCode 共存;桌面向导 0.2.61 起发这种形状,Vincent 2026-09-08 撞到 model_invalid)
+    expect(() => validateModel("opencode/mimo-v2.5-free")).not.toThrow();
+    expect(() => validateModel("anthropic/claude-sonnet-4")).not.toThrow();
+    expect(() => validateModel("a/b/c")).toThrow(ValidationError);      // 只许一个斜杠
+    expect(() => validateModel("/model")).toThrow(ValidationError);     // 不能以斜杠开头
+    expect(() => validateModel("provider/")).toThrow(ValidationError);  // 不能以斜杠结尾
+    expect(() => validateModel("../x")).toThrow(ValidationError);       // 纯点段(路径穿越形状)
+    expect(() => validateModel("x/.")).toThrow(ValidationError);
+    expect(() => validateModel("open code/m")).toThrow(ValidationError);
     expect(() => validateModel("")).toThrow(ValidationError);
   });
 });
@@ -169,6 +178,16 @@ describe("buildAnetArgs (§4.2.2 F2 — fully validated argv)", () => {
     expect(args).toContain("--permission-mode");
     expect(args[args.indexOf("--permission-mode") + 1]).toBe("plan");
   });
+  test("omitted model is allowed and does not emit --model", () => {
+    const args = buildAnetArgs({
+      name: "x", runtime: "codex-sdk",
+      flags: { permissionMode: "plan" },
+    });
+    expect(args).toEqual(["node", "create", "x", "--runtime", "codex-sdk", "--permission-mode", "plan"]);
+  });
+  test("empty model is still rejected", () => {
+    expect(() => buildAnetArgs({ name: "x", runtime: "codex-sdk", model: "" })).toThrow(ValidationError);
+  });
   test("rejects bad name with shell metachar", () => {
     expect(() => buildAnetArgs({ name: ";rm -rf /", runtime: "claude-agent-sdk", model: "x" })).toThrow(ValidationError);
   });
@@ -185,3 +204,72 @@ describe("buildAnetArgs (§4.2.2 F2 — fully validated argv)", () => {
     } as any)).toThrow(ValidationError);
   });
 });
+
+// ─── runtime_invalid 要说清「允许哪些」和「还有什么路」 ────────────────
+//
+// 2026-08-28 实测：从 Dashboard 建一个 codex-app-server 节点，用户拿到的是
+//   {"ok":false,"error":"runtime_invalid","value":"codex-app-server"}
+// 而目标机器的 daemon 日志里一行都没有 —— 请求被 hub 拦在最前面，
+// 用户无从知道①哪些允许②是不是打错了③有没有别的办法。
+// 🔴 2026-08-28:这一节原本拿 `codex-app-server` / `opencode-cli` 当"非法 runtime"的例子。
+//    #1298 把 hub 的 RUNTIMES 从 3 个放开到 7 个之后,那两个变成了合法值,这两条测试因此红了 ——
+//    **测试正确地抓到了行为变更**。修法是换例子,不是削弱断言:
+//    意图仍然是「非法 runtime 要给可操作的报错」,只是例子换成永远不会合法的字符串。
+describe("validateRuntime — 报错要可操作", () => {
+  function thrown(v: unknown): any {
+    try { validateRuntime(v); } catch (e: any) { return e; }
+    throw new Error("expected validateRuntime to throw");
+  }
+
+  test("非法 runtime 的报错带上允许集合", () => {
+    const e = thrown("definitely-not-a-runtime");
+    expect(e.code).toBe("runtime_invalid");
+    expect(Array.isArray(e.detail?.allowed)).toBe(true);
+    // 🔴 断言它等于 RUNTIMES 本身,而不是等于一份手抄的清单 ——
+    //    手抄的那份会漂,漂了之后报错会理直气壮地告诉用户一组错的名字。
+    expect(e.detail.allowed).toEqual([...RUNTIMES]);
+  });
+
+  test("报错带上一条出路提示", () => {
+    const e = thrown("another-bogus-runtime");
+    expect(typeof e.detail?.hint).toBe("string");
+    expect(e.detail.hint.length).toBeGreaterThan(10);
+    // 提示必须点名那条真实存在的路,否则它只是安慰话
+    expect(e.detail.hint).toContain("anet node create");
+  });
+
+  test("仍然回报用户传进来的那个值（便于识别是不是打错了）", () => {
+    const e = thrown("codex-app-servr");   // 故意少一个 e
+    expect(e.detail.value).toBe("codex-app-servr");
+  });
+
+  test("🔴 合法 runtime 一个都不能被这次改动误伤", () => {
+    for (const r of RUNTIMES) {
+      expect(() => validateRuntime(r)).not.toThrow();
+    }
+    // 正控：非字符串必须仍然被拒 —— 否则上面那条循环全过也说明不了什么
+    expect(() => validateRuntime(123 as any)).toThrow();
+    expect(() => validateRuntime(undefined as any)).toThrow();
+  });
+});
+
+// #1298 —— daemon 远程创建放开到 7 个 runtime（Vincent 2026-08-28 定，
+// 理由是兜底排错：节点不动了，人要能进去跟 Codex / Claude Code 对话）。
+describe("#1298 RUNTIMES —— 七个都放行，且与 CLI 侧一致", () => {
+  test("三个共存 runtime 不再被拒", () => {
+    for (const r of ["codex-app-server", "grok-build-cli", "opencode-cli"]) {
+      expect(() => validateRuntime(r)).not.toThrow();
+    }
+  });
+  test("原有四个仍然放行（放开不该顺手改坏别的）", () => {
+    for (const r of ["claude-agent-sdk", "claude-code-cli", "codex-sdk", "grok-build-acp"]) {
+      expect(() => validateRuntime(r)).not.toThrow();
+    }
+  });
+  test("🔴 恰好七个 —— 多一个少一个都要有人解释", () => {
+    expect(RUNTIMES.length).toBe(7);
+    // 正控：不在名单里的仍然被拒，证明上面不是"什么都放行"
+    expect(() => validateRuntime("definitely-not-a-runtime")).toThrow();
+    expect(() => validateRuntime("")).toThrow();
+  });
+});

package/src/create-node-validate.ts

@@ -17,7 +17,33 @@ export class ValidationError extends Error {
 }
 
 // §4.2.2 — structural enums.
-export const RUNTIMES = ["claude-agent-sdk", "codex-sdk", "grok-build-acp"] as const;
+// #1298 —— daemon 远程创建允许的 runtime。2026-08-28 从 3 个放开到 7 个。
+//
+// 放开之前挡着的问题是「daemon 建出来的是**无人值守**的后台进程,而三个共存 runtime
+// 的本质是人和 agent 共用一个 TUI 会话 —— 建出来给谁用?」
+//
+// Vincent 2026-08-28 定,理由是**兜底排错**:
+//   「某个节点突然不动了,人可以进去看。在 daemon 还没那么靠谱的情况下,
+//     这非常重要 —— 至少可以跟 Codex 和 Claude Code 对话。」
+// 🔴 关键在于 **attach 是「建好之后」的动作,不是「建的时候」的前提**。
+//
+// 支撑读数(2026-08-28 实测舰队):`通信牛` 跑 codex-app-server(共存 runtime),
+// **764 次成功完成任务**,当天仍在跑 —— 比两个普通 runtime 的节点(61 次 / 3 次)
+// 都多一个量级。⇒ 任务链路不需要人坐在屏幕前。
+//
+// 🔴 这七个名字与 `agent-network/src/normalize-runtime.ts` 的 `RuntimeName` 一致。
+//    那边是 CLI 侧的全集;两边分叉过一次(daemon 侧的 VALID_RUNTIMES 早就是 7 个,
+//    只有这里还是 3 个,而记录此事的 #1298 正文写的是「三道闸都关着」——
+//    **一份快照式的盘点,只在写下的那一刻是真的**)。
+export const RUNTIMES = [
+  "claude-agent-sdk",
+  "claude-code-cli",
+  "codex-sdk",
+  "codex-app-server",
+  "grok-build-acp",
+  "grok-build-cli",
+  "opencode-cli",
+] as const;
 export type Runtime = typeof RUNTIMES[number];
 
 export const FLAG_KEYS = ["permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout"] as const;
@@ -32,7 +58,11 @@ const ENV_KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
 
 // §4.2.2 name + model.
 const NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
-const MODEL_RE = /^[a-zA-Z0-9._:\-]+$/;
+// OpenCode 共存的模型带 provider 前缀(`opencode/mimo-v2.5-free`,agent-node parseModelRef 按第一个 `/` 切),
+// 桌面向导 0.2.61 起就发这种形状 —— 允许**恰好一个**斜杠分隔的两段;每段仍是原字符集,且不能是纯点(`..`/`.`)。
+const MODEL_SEGMENT = "[a-zA-Z0-9._:\\-]+";
+const MODEL_RE = new RegExp(`^${MODEL_SEGMENT}(?:/${MODEL_SEGMENT})?$`);
+const MODEL_DOT_ONLY_SEGMENT = /(^|\/)\.+(\/|$)/;
 
 export function validateName(s: unknown): asserts s is string {
   if (typeof s !== "string" || !NAME_RE.test(s)) {
@@ -42,12 +72,29 @@ export function validateName(s: unknown): asserts s is string {
 
 export function validateRuntime(s: unknown): asserts s is Runtime {
   if (typeof s !== "string" || !(RUNTIMES as readonly string[]).includes(s)) {
-    throw new ValidationError("runtime_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
+    // 🔴 原来只回一个 `runtime_invalid` + 用户传进来的那个值 —— **不说允许哪些,
+    //    也不说还有没有别的路**。2026-08-28 实测:从 Dashboard 建一个
+    //    `codex-app-server` 节点,用户拿到的就是
+    //      {"ok":false,"error":"runtime_invalid","value":"codex-app-server"}
+    //    而目标机器的 daemon 日志里一行都没有(请求根本没到)。
+    //    用户无从知道:①哪些是允许的 ②这个名字是不是打错了 ③有没有别的办法。
+    //
+    // `allowed` 直接由 RUNTIMES 展开,不是手写的第二份清单 ——
+    // 🔴 手写一份会漂移,而漂移之后报错会**理直气壮地告诉用户一组错的名字**。
+    throw new ValidationError("runtime_invalid", {
+      value: typeof s === "string" ? s.slice(0, 80) : typeof s,
+      allowed: [...RUNTIMES],
+      // 这句提示的前提是查过的:`agent-network/src/normalize-runtime.ts` 的
+      // `RuntimeName` / `SUPPORTED_RUNTIME_NAMES` 是 7 个,包含此处不放行的那几个,
+      // 所以「在目标机器上直接建」确实是一条真实存在的路,不是安慰话。
+      hint: "daemon 远程创建目前只放行以上 runtime；其余 runtime 可以在目标机器上直接 `anet node create --runtime <name>` 创建。",
+    });
   }
 }
 
-export function validateModel(s: unknown): asserts s is string {
-  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s)) {
+export function validateModel(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
+  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s) || MODEL_DOT_ONLY_SEGMENT.test(s)) {
     throw new ValidationError("model_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
   }
 }
@@ -158,6 +205,40 @@ export function serializeEnvLocal(env: Record<string, string>): string {
   }).join("\n") + "\n";
 }
 
+// app「新建节点」工作目录 —— hub 只判**形状**(daemon 才知道那台机器的 $HOME、系统目录、
+// 目录里住没住别的节点,那几条在 agent-node/src/runtime/child-workdir.ts)。
+// 这里挡的是「根本不像一条路径」的输入,让它在派发前就失败,而不是占一个请求行再被 daemon 拒。
+export const MAX_WORKDIR_LEN = 1024;
+export function validateWorkdir(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
+  if (typeof s !== "string") throw new ValidationError("workdir_invalid", { reason: "must be string" });
+  const v = s.trim();
+  if (v.length === 0 || v.length > MAX_WORKDIR_LEN) {
+    throw new ValidationError("workdir_invalid", { reason: `length 1..${MAX_WORKDIR_LEN}` });
+  }
+  if (/[\u0000-\u001f\u007f]/.test(v)) throw new ValidationError("workdir_invalid", { reason: "control character" });
+  const shapeOk = v.startsWith("/") || v === "~" || v.startsWith("~/") || /^[A-Za-z]:[\\/]/.test(v);
+  if (!shapeOk) {
+    throw new ValidationError("workdir_invalid", { reason: "must be absolute (/…, ~/…, or C:\\…)", value: v.slice(0, 80) });
+  }
+}
+
+/** daemon 自报的默认工作目录根(`daemon_capabilities.default_workdir_root`),消毒后返回;
+ *  没报 / 形状不对 = null。**非 null 即表示该 daemon 认 `node_spec.workdir`** ——
+ *  create_node 的「老 daemon 不收 workdir」门和 /api/host-supervisors 的透出共用这一个判据。 */
+export function daemonDefaultWorkdirRoot(configSnapshot: unknown): string | null {
+  try {
+    const snap = typeof configSnapshot === "string" ? JSON.parse(configSnapshot) : configSnapshot;
+    const v = (snap as any)?.daemon_capabilities?.default_workdir_root;
+    if (typeof v !== "string" || v.length === 0 || v.length > MAX_WORKDIR_LEN) return null;
+    if (/[\u0000-\u001f\u007f]/.test(v)) return null;
+    if (!(v.startsWith("/") || /^[A-Za-z]:[\\/]/.test(v))) return null;
+    return v;
+  } catch {
+    return null;
+  }
+}
+
 // §4.2.5 — channels fail-closed in P1.
 export function validateChannelsP1(channels: unknown): void {
   if (channels === undefined || channels === null) return;
@@ -173,7 +254,7 @@ export function validateChannelsP1(channels: unknown): void {
 export interface NodeSpec {
   name: string;
   runtime: Runtime;
-  model: string;
+  model?: string | null;
   flags?: Record<string, unknown>;
   channels?: unknown;
 }
@@ -192,7 +273,8 @@ export function buildAnetArgs(spec: NodeSpec): string[] {
   validateModel(spec.model);
   validateChannelsP1(spec.channels);
 
-  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime, "--model", spec.model];
+  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime];
+  if (spec.model) args.push("--model", spec.model);
   if (spec.flags && typeof spec.flags === "object") {
     for (const [k, v] of Object.entries(spec.flags)) {
       if (!(FLAG_KEYS as readonly string[]).includes(k)) {

package/src/create-node-workdir.test.ts

@@ -0,0 +1,255 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import "./require-explicit-test-db.js";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+import { daemonDefaultWorkdirRoot, validateWorkdir, ValidationError } from "./create-node-validate.js";
+import { addNetworkMember, login, register } from "./auth.js";
+
+// app「新建节点」工作目录 —— hub 这一层管三件事:
+//   ① node_spec.workdir 的**形状**(绝对 / ~/… / C:\…),派发前就拒
+//   ② daemon 没自报 default_workdir_root(= 老 daemon,会静默忽略 workdir)⇒ 拒,不派
+//   ③ 请求行存下 workdir,get_create_request 原样交给 daemon;不带就**不出现**这个键
+// 以及 /api/host-supervisors 只给 admin/owner 透出默认根(它是那台机器的家目录路径)。
+
+const NET = "net_workdir_gate";
+const USER_ID = "u_workdir_admin";
+const DAEMON_ID = "node_workdir_daemon";
+const DAEMON_ALIAS = "workdir-daemon";
+const DAEMON_TOK = "tok_workdir_daemon";
+const ROOT = "/home/user";
+
+interface ToolHandler { (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>; }
+interface Reply { ok?: boolean; error?: string; request_id?: string; node_spec?: any; [k: string]: unknown; }
+
+function cleanup() {
+  for (const t of ["node_create_requests", "audit_log", "nodes", "sessions", "api_tokens", "network_members"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER_ID]); } catch {}
+}
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed(caps: Record<string, unknown>) {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'user', datetime('now'))`, [USER_ID]);
+  db.run(`INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET, USER_ID]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'admin', datetime('now'))`, [USER_ID, NET]);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, config_snapshot, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, ?4, 'host-x', datetime('now'), datetime('now'), 'active')`,
+    [DAEMON_ID, DAEMON_ALIAS, NET, JSON.stringify({ role: "host_supervisor", daemon_capabilities: { runtimes_supported: ["claude-agent-sdk"], ...caps } })],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [DAEMON_TOK, USER_ID, NET, `node:${DAEMON_ALIAS}`, `hash_${DAEMON_TOK}`],
+  );
+}
+
+function tools(callerTokenId: string | null = null): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const out: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, d: string, schema: any, handler: ToolHandler) => { out[name] = handler; return origTool(name, d, schema, handler); };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, cfg: any, handler: ToolHandler) => { out[name] = handler; return origRegisterTool(name, cfg, handler); };
+  }
+  registerTools(server, undefined, NET, USER_ID, null, true, callerTokenId);
+  return out;
+}
+
+async function call(h: ToolHandler, args: any): Promise<Reply> {
+  return JSON.parse((await h(args)).content[0].text) as Reply;
+}
+
+const baseSpec = { name: "wd-child", runtime: "claude-agent-sdk", model: "claude-sonnet-4-5", flags: {} };
+
+function rowCount(): number {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_create_requests WHERE daemon_node_id = ?1", DAEMON_ID)?.n ?? -1;
+}
+
+describe("validateWorkdir — shape only", () => {
+  const ok = ["/home/user/proj", "/srv/x", "~", "~/proj", "C:\\Users\\alice\\proj", "D:/work", "  /padded  "];
+  for (const v of ok) test(`accepts ${JSON.stringify(v)}`, () => { expect(() => validateWorkdir(v)).not.toThrow(); });
+  test("accepts undefined / null (field omitted)", () => {
+    expect(() => validateWorkdir(undefined)).not.toThrow();
+    expect(() => validateWorkdir(null)).not.toThrow();
+  });
+  const bad: unknown[] = ["", "   ", "proj", "./proj", "../x", "~alice/x", "C:proj", "/a\nb", "/a\u0000b", "x".repeat(10) + "/", "/" + "a".repeat(1024), 42, {}];
+  for (const v of bad) {
+    test(`rejects ${JSON.stringify(v)?.slice(0, 40)}`, () => {
+      let code = "";
+      try { validateWorkdir(v); } catch (e) { code = (e as ValidationError).code; }
+      expect(code).toBe("workdir_invalid");
+    });
+  }
+});
+
+describe("daemonDefaultWorkdirRoot — sanitize the self-report", () => {
+  const snap = (v: unknown) => JSON.stringify({ daemon_capabilities: { default_workdir_root: v } });
+  test("absolute posix root passes through", () => { expect(daemonDefaultWorkdirRoot(snap(ROOT))).toBe(ROOT); });
+  test("windows root passes through", () => { expect(daemonDefaultWorkdirRoot(snap("C:\\Users\\alice"))).toBe("C:\\Users\\alice"); });
+  test("object snapshot (not string) also accepted", () => {
+    expect(daemonDefaultWorkdirRoot({ daemon_capabilities: { default_workdir_root: ROOT } })).toBe(ROOT);
+  });
+  for (const v of [undefined, null, "", "relative", "~/x", 7, "/a\nb", "/" + "a".repeat(1100)]) {
+    test(`not reported / malformed ${JSON.stringify(v)?.slice(0, 30)} → null`, () => {
+      expect(daemonDefaultWorkdirRoot(snap(v))).toBeNull();
+    });
+  }
+  test("null / garbage snapshot → null", () => {
+    expect(daemonDefaultWorkdirRoot(null)).toBeNull();
+    expect(daemonDefaultWorkdirRoot("{not json")).toBeNull();
+  });
+});
+
+describe("create_node + workdir", () => {
+  test("🔴 old daemon (no default_workdir_root) + workdir → workdir_not_supported_by_daemon, NO row", async () => {
+    seed({});
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: `${ROOT}/wd-child` } });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("workdir_not_supported_by_daemon");
+    expect(rowCount()).toBe(0);
+  });
+
+  test("old daemon WITHOUT workdir still dispatches (no regression for existing callers)", async () => {
+    seed({});
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: baseSpec });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBeNull();
+  });
+
+  test("bad shape rejected before dispatch → workdir_invalid, NO row", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: "relative/dir" } });
+    expect(r.error).toBe("workdir_invalid");
+    expect(rowCount()).toBe(0);
+  });
+
+  test("new daemon + workdir → row stores it and get_create_request hands it to the daemon", async () => {
+    seed({ default_workdir_root: ROOT });
+    const wd = `${ROOT}/wd-child`;
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: wd } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBe(wd);
+    const g = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect(g.node_spec.workdir).toBe(wd);
+    expect(g.node_spec.name).toBe(baseSpec.name);
+  });
+
+  test("workdir is trimmed before storage", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: `  ~/wd-child  ` } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBe("~/wd-child");
+  });
+
+  test("new daemon WITHOUT workdir → get_create_request node_spec has NO workdir key (daemon keeps legacy layout)", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: baseSpec });
+    expect(r.ok).toBe(true);
+    const g = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect("workdir" in g.node_spec).toBe(false);
+  });
+
+  test("audit detail records the requested workdir", async () => {
+    seed({ default_workdir_root: ROOT });
+    const wd = `${ROOT}/wd-child`;
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: wd } });
+    const a = db.get<{ detail: string }>(
+      "SELECT detail FROM audit_log WHERE target_id = ?1 AND action = 'create_node_dispatch_attempted'", r.request_id,
+    );
+    expect(JSON.parse(a?.detail || "{}").workdir).toBe(wd);
+  });
+
+  test("list_host_supervisors (MCP) surfaces default_workdir_root for admin", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().list_host_supervisors, {});
+    const d = (r as any).daemons.find((x: any) => x.daemon_node_id === DAEMON_ID);
+    expect(d.default_workdir_root).toBe(ROOT);
+  });
+
+  test("list_host_supervisors (MCP) omits the key for an old daemon", async () => {
+    seed({});
+    const r = await call(tools().list_host_supervisors, {});
+    const d = (r as any).daemons.find((x: any) => x.daemon_node_id === DAEMON_ID);
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+});
+
+// ── REST /api/host-supervisors: admin sees the root, member does not ──────────
+let BASE = "";
+let server: any = null;
+let ownerTok = "", memberTok = "", restNet = "", ownerId = "";
+describe("/api/host-supervisors — default_workdir_root visibility", () => {
+  beforeAll(async () => {
+    process.env.HOST = "127.0.0.1";
+    const sfx = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+    const pw = "BootstrapPw123Aa!";
+    const s = register(`wd_seed_${sfx}`, pw, undefined, "seed");
+    if (!s.ok) throw new Error("seed failed");
+    db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`wd_seed_${sfx}`]);
+    const o = register(`wd_owner_${sfx}`, pw, undefined, "seed");
+    if (!o.ok || !o.token) throw new Error("owner register failed");
+    ownerTok = o.token; restNet = o.network_id ?? "";
+    ownerId = login(`wd_owner_${sfx}`, pw).user!.user_id;
+    const m = register(`wd_member_${sfx}`, pw, undefined, "seed");
+    if (!m.ok || !m.token) throw new Error("member register failed");
+    memberTok = m.token;
+    const memberId = login(`wd_member_${sfx}`, pw).user!.user_id;
+    // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+    const add = addNetworkMember(restNet, memberId, "member", undefined, { agentAccess: "all" });
+    if (!add.ok) throw new Error("add member failed: " + add.error);
+    const { bootServer } = await import("./server.js");
+    server = bootServer({ port: 0, hostname: "127.0.0.1" });
+    BASE = `http://127.0.0.1:${server.port}`;
+    for (const [alias, caps] of [["wd-new", { default_workdir_root: ROOT }], ["wd-old", {}]] as const) {
+      db.run(
+        `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, runtime, model, config_path, channels, server, hostname, network_id, config_revision, config_snapshot)
+         VALUES (?1, ?2, ?2, 'claude-agent-sdk', 'm', '/tmp/cfg.json', '[]', 'h', 'h', ?3, 0, ?4)`,
+        [`wd_n_${alias}`, alias, restNet, JSON.stringify({ role: "host_supervisor", daemon_capabilities: caps })],
+      );
+      db.run(
+        `INSERT OR REPLACE INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, 'network')`,
+        [`wd_t_${alias}`, `hash_wd_${alias}`, ownerId, restNet, `node:${alias}`],
+      );
+    }
+  });
+  afterAll(() => {
+    try { server?.stop?.(true); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [restNet]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1 AND name LIKE 'node:%'", [restNet]); } catch {}
+  });
+
+  async function list(tok: string): Promise<any[]> {
+    const res = await fetch(`${BASE}/api/host-supervisors?network_id=${encodeURIComponent(restNet)}`, { headers: { Authorization: `Bearer ${tok}` } });
+    const b = await res.json();
+    if (!b.ok) throw new Error("list failed: " + JSON.stringify(b));
+    return b.daemons;
+  }
+
+  test("owner sees default_workdir_root on the new daemon", async () => {
+    const d = (await list(ownerTok)).find(x => x.alias === "wd-new");
+    expect(d?.default_workdir_root).toBe(ROOT);
+  });
+  test("old daemon row has NO default_workdir_root key (app hides the row)", async () => {
+    const d = (await list(ownerTok)).find(x => x.alias === "wd-old");
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+  test("🔴 member does NOT see the host's home path", async () => {
+    const rows = await list(memberTok);
+    const d = rows.find(x => x.alias === "wd-new");
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+});

package/src/create-node.ts

@@ -272,8 +272,58 @@ export function resolveCallerDaemonTokenBound(opts: {
 // RFC-026 §4.5 — append a row to audit_log for every create_node
 // lifecycle event. Best-effort: never throw out (calling tool should
 // continue even if audit insert fails for any reason).
+/** RFC-027 §4.5 D8 — tx-aware variant. Identical SQL to auditCreateNode
+ *  but RE-THROWS on failure so a BEGIN..COMMIT around lifecycle UPDATE +
+ *  audit INSERT can ROLLBACK if the audit row would have been lost.
+ *  Required for the "no audit-but state changed" window that §4.5 / D8
+ *  explicitly closes (PR1 SF-2 review catch — auditCreateNode's
+ *  swallow-and-warn defeats atomicity).
+ *
+ *  Callers in a non-transaction context should keep using auditCreateNode
+ *  (best-effort, never throws). */
+export function auditCreateNodeStrict(input: {
+  action: Parameters<typeof auditCreateNode>[0]["action"];
+  user_id?: string | null;
+  username?: string | null;
+  network_id?: string | null;
+  target_id?: string | null;
+  detail: Record<string, unknown>;
+}): void {
+  db.run(
+    `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+     VALUES (?1, ?2, ?3, 'node_create_request', ?4, ?5, ?6)`,
+    [
+      input.user_id || null,
+      input.username || null,
+      input.action,
+      input.target_id || null,
+      JSON.stringify(input.detail),
+      input.network_id || null,
+    ],
+  );
+}
+
 export function auditCreateNode(input: {
-  action: "create_node_dispatched" | "create_node_rejected" | "create_node_succeeded" | "create_node_sweeper_revoked";
+  action:
+    | "create_node_dispatched"
+    | "create_node_dispatch_attempted"
+    | "create_node_rejected"
+    | "create_node_succeeded"
+    | "create_node_sweeper_revoked"
+    | "daemon_capability_lied"                  // RFC-026 §9.3 D2 — daemon declared runtime support, child died before serving
+    // RFC-027 §4.5 — stop/delete lifecycle audit action enum extension.
+    // Re-using auditCreateNode is fine: the action column carries the
+    // discriminator; target_type stays 'node_create_request' which is a
+    // misnomer for stop/delete rows but updating the schema would force a
+    // wider migration (see P1.1 issue).
+    | "stop_node_dispatched"
+    | "stop_node_completed"
+    | "start_node_dispatched"
+    | "start_node_completed"
+    | "delete_node_dispatched"
+    | "delete_node_completed"
+    | "forced_stop_with_in_flight"
+    | "backup_purged";
   user_id?: string | null;
   username?: string | null;
   network_id?: string | null;