@sleep2agi/commhub-server 0.9.0-preview.7 → 0.9.0-preview.71

package/src/node-lifecycle-controllable.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, test } from "bun:test";
+import {
+  childNodeIdForCreateRequest,
+  buildControllableMap,
+  isLifecycleControllable,
+} from "./node-lifecycle-controllable.js";
+
+// app#196 —— 桌面端对 218 个节点里的 207 个（95%）显示了「停止/重启/删除」，
+// 而那三个工具的 schema 是 regex(/^node_[a-z0-9_-]+$/)，那 207 个是 n_ 开头，
+// 点下去只会看到一段 zod 正则原文。
+describe("childNodeIdForCreateRequest —— 推导规则", () => {
+  test("cr_ 前缀 → node_ 前缀，其余部分逐字保留", () => {
+    // 🔴 这一对是 2026-08-28 生产 hub 日志里真实的 create-node finalize 行，
+    //    不是我按注释造的。
+    expect(childNodeIdForCreateRequest("cr_59723b24-8372-4270-9b3c-1552e592a09f"))
+      .toBe("node_59723b24-8372-4270-9b3c-1552e592a09f");
+  });
+  test("不是 cr_ 开头的一律 null —— 不猜、不截断", () => {
+    expect(childNodeIdForCreateRequest("node_abc")).toBeNull();
+    expect(childNodeIdForCreateRequest("n_abc")).toBeNull();
+    expect(childNodeIdForCreateRequest("abc")).toBeNull();
+    expect(childNodeIdForCreateRequest("cr_")).toBeNull();   // 只有前缀，没有主体
+  });
+  test("非字符串输入不抛，返回 null", () => {
+    for (const v of [undefined, null, 123, {}, []]) {
+      expect(childNodeIdForCreateRequest(v as any)).toBeNull();
+    }
+  });
+});
+
+describe("isLifecycleControllable —— 判据不是 id 前缀", () => {
+  const map = buildControllableMap([
+    { request_id: "cr_aaa", daemon_node_id: "node_daemon_x" },
+    { request_id: "cr_bbb", daemon_node_id: "node_daemon_y" },
+    { request_id: "not-a-request", daemon_node_id: "node_daemon_z" },  // 应被丢弃
+  ]);
+
+  test("有创建记录的 → 可控", () => {
+    expect(isLifecycleControllable("node_aaa", null, map)).toBe(true);
+    expect(map.get("node_aaa")).toBe("node_daemon_x");
+  });
+
+  test("🔴 光有 node_ 前缀但没有创建记录 → 不可控", () => {
+    // 这条是本模块存在的理由：前缀是实现细节，不是判据。
+    expect(isLifecycleControllable("node_never_created", null, map)).toBe(false);
+  });
+
+  test("手工起的 n_ 节点 → 不可控（那 207 个）", () => {
+    expect(isLifecycleControllable("n_22b777bf", null, map)).toBe(false);
+  });
+
+  test("🔴 daemon 自己可控 —— 它在 node_create_requests 里没有记录", () => {
+    // 漏掉这条会把 3 个 daemon 从可控名单里误删。
+    expect(isLifecycleControllable("node_daemon_39bd1eeae3ee", "host_supervisor", map)).toBe(true);
+    // 正控：同一个 id 但 role 不是 host_supervisor ⇒ 仍不可控，
+    // 证明上面那条过是因为 role，不是因为 id 恰好带 node_ 前缀。
+    expect(isLifecycleControllable("node_daemon_39bd1eeae3ee", null, map)).toBe(false);
+  });
+
+  test("坏的 request_id 不会污染映射", () => {
+    expect(map.has("node_not-a-request")).toBe(false);
+    expect(map.size).toBe(2);
+  });
+});

package/src/node-lifecycle-controllable.ts

@@ -0,0 +1,51 @@
+/**
+ * app#196 —— 哪些节点能走 stop_node / restart_node / delete_node。
+ *
+ * 抽成独立模块而不是写在 /api/nodes 的路由里,因为路由里的内联逻辑测不到 ——
+ * 现有的 api-nodes-shape.test.ts 是直跑 handler 的 SQL,拿不到映射步骤。
+ * 🔴 「不可测」本身就是一个设计信号,不是测试的问题。
+ */
+
+/** 子节点 id 由创建请求 id 确定性推导。
+ *
+ * 🔴 这条规则我用真实一对验过,不是只读注释:
+ *    cr_59723b24-8372-4270-9b3c-1552e592a09f → node_59723b24-8372-4270-9b3c-…
+ *    (2026-08-28 生产 hub 日志的 `create-node finalize` 行)
+ *
+ * 非 `cr_` 开头的一律返回 null —— 不猜,不截断。 */
+export function childNodeIdForCreateRequest(requestId: unknown): string | null {
+  if (typeof requestId !== "string") return null;
+  if (!requestId.startsWith("cr_")) return null;
+  const rest = requestId.slice(3);
+  if (!rest) return null;
+  return `node_${rest}`;
+}
+
+/** 由创建记录建出「child node_id → daemon node_id」的映射。 */
+export function buildControllableMap(
+  createRequests: Array<{ request_id?: unknown; daemon_node_id?: unknown }>,
+): Map<string, string> {
+  const m = new Map<string, string>();
+  for (const cr of createRequests) {
+    const child = childNodeIdForCreateRequest(cr?.request_id);
+    if (!child) continue;
+    m.set(child, typeof cr?.daemon_node_id === "string" ? cr.daemon_node_id : "");
+  }
+  return m;
+}
+
+/** 一个节点能不能走生命周期操作。
+ *
+ * 🔴 判据**不是 id 前缀**。前缀是实现细节;判据是 node_create_requests 里真有创建记录。
+ *
+ * 例外:daemon 自己(role=host_supervisor)也能被 restart/stop,而它在
+ * node_create_requests 里**没有**记录(它不是被别的 daemon 创建的)—— 单独放行。
+ * 漏掉这一条会把可控的 daemon 判成不可控。 */
+export function isLifecycleControllable(
+  nodeId: unknown,
+  role: unknown,
+  controllable: Map<string, string>,
+): boolean {
+  if (role === "host_supervisor") return true;
+  return typeof nodeId === "string" && controllable.has(nodeId);
+}

package/src/node-logs-transport.test.ts

@@ -0,0 +1,263 @@
+// Node run-log view — tail_node_logs rides the rules-file queue + doorbell (op logs_tail).
+//
+// Hub-side contract verified here:
+//   1. report_status { logs_capable: true } is sticky and set only by the node's
+//      own token; /api/status-shaped rows expose it.
+//   2. The pulled request carries only the normalised filter JSON — no path field
+//      exists anywhere in the tool schema; unknown args are dropped.
+//   3. Who may ask: user logins only (node tokens refused); the network owner/admin,
+//      or the node's owner (nodes.owner_user_id). A member who does not own the
+//      node, a viewer, and a user of another network are refused before any row.
+//   4. Who may read: only the token that asked (like the project folder).
+//   5. Storage: the result is handed out ONCE — the first terminal read purges
+//      result_content and the filter JSON; the second read says content_purged.
+//      An unread terminal result is purged by the sweep after LOGS_CONTENT_TTL_MS.
+//   6. Own single-flight lane; logs acks may carry up to 1 MiB.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/logs-transport.db bun test src/node-logs-transport.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { LOGS_CONTENT_TTL_MS, sweepNodeRequestContent } from "./node-request-retention.js";
+
+const NET = "net_logs_t";
+const OTHER_NET = "net_logs_t_other";
+const OWNER = "u_logs_net_owner";
+const MEMBER = "u_logs_member_owns_a";
+const MEMBER2 = "u_logs_member_plain";
+const VIEWER = "u_logs_viewer";
+const OUTSIDER = "u_logs_outsider";
+const NODE_A = "logs-node-a";
+const NODE_B = "logs-node-b";
+const NODE_A_ID = "node_logs_a";
+const NODE_B_ID = "node_logs_b";
+const T_A = "tok_logs_node_a";
+const T_B = "tok_logs_node_b";
+
+function cleanup() {
+  for (const net of [NET, OTHER_NET]) {
+    for (const t of ["node_rules_requests", "sessions", "nodes", "api_tokens", "network_members", "networks"]) {
+      try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [net]); } catch {}
+    }
+  }
+  for (const u of [OWNER, MEMBER, MEMBER2, VIEWER, OUTSIDER]) {
+    try { db.run("DELETE FROM users WHERE user_id = ?1", [u]); } catch {}
+  }
+}
+
+function seedWorld() {
+  for (const u of [OWNER, MEMBER, MEMBER2, VIEWER, OUTSIDER]) {
+    db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [u, u]);
+  }
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET, NET, OWNER]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [OTHER_NET, OTHER_NET, OUTSIDER]);
+  const member = (u: string, net: string, role: string) =>
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, ?3, datetime('now'))`, [u, net, role]);
+  member(OWNER, NET, "owner");
+  member(MEMBER, NET, "member");
+  member(MEMBER2, NET, "member");
+  member(VIEWER, NET, "viewer");
+  member(OUTSIDER, OTHER_NET, "owner");
+  const node = (id: string, alias: string, owner: string | null) => db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'))`,
+    [id, alias, alias, NET, owner],
+  );
+  node(NODE_A_ID, NODE_A, MEMBER);
+  node(NODE_B_ID, NODE_B, OWNER);
+  const tok = (id: string, alias: string, bound: string) => db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at, bound_node_id) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL, ?6)`,
+    [id, OWNER, NET, `node:${alias}`, `hash_${id}`, bound],
+  );
+  tok(T_A, NODE_A, NODE_A_ID);
+  tok(T_B, NODE_B, NODE_B_ID);
+}
+
+type Identity = { net: string | null; user: string; alias: string; isNetworkToken: boolean; tokenId: string };
+const asOwner: Identity = { net: null, user: OWNER, alias: OWNER, isNetworkToken: false, tokenId: "tok_logs_owner_login" };
+const asOwnerOtherLogin: Identity = { ...asOwner, tokenId: "tok_logs_owner_login_2" };
+const asMember: Identity = { net: null, user: MEMBER, alias: MEMBER, isNetworkToken: false, tokenId: "tok_logs_member_login" };
+const asMember2: Identity = { net: null, user: MEMBER2, alias: MEMBER2, isNetworkToken: false, tokenId: "tok_logs_member2_login" };
+const asViewer: Identity = { net: null, user: VIEWER, alias: VIEWER, isNetworkToken: false, tokenId: "tok_logs_viewer_login" };
+const asOutsider: Identity = { net: null, user: OUTSIDER, alias: OUTSIDER, isNetworkToken: false, tokenId: "tok_logs_outsider_login" };
+const asA: Identity = { net: NET, user: OWNER, alias: NODE_A, isNetworkToken: true, tokenId: T_A };
+const asB: Identity = { net: NET, user: OWNER, alias: NODE_B, isNetworkToken: true, tokenId: T_B };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "logs-test", version: "1" });
+  registerTools(server, undefined, id.net, id.user, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "logs-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}: ${JSON.stringify(r).slice(0, 300)}`);
+    try { return JSON.parse(first.text); } catch { return { raw: first.text, isError: r.isError === true }; }
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { call, close };
+}
+
+const rowCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_rules_requests WHERE network_id = ?1", NET)!.n;
+const row = (id: string) => db.get<any>("SELECT op, content, result_content, content_purged_at FROM node_rules_requests WHERE request_id = ?1", id);
+const SAMPLE = JSON.stringify({ files: ["2026-09-29.log"], lines: [{ ts: 1, level: "info", text: "[10:00:00] [INFO ] [x] hello", key: "2026-09-29.log:0" }], truncated: false, matched: 1, now_ts: 2 });
+
+beforeEach(() => { cleanup(); seedWorld(); });
+afterAll(cleanup);
+
+describe("logs_capable", () => {
+  test("set by the node's own token, sticky, not settable by a user login", async () => {
+    const a = await connect(asA);
+    try {
+      await a.call("report_status", { resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, logs_capable: true });
+      await a.call("report_status", { resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID });
+    } finally { await a.close(); }
+    expect(db.get<{ c: number }>("SELECT logs_capable AS c FROM sessions WHERE alias = ?1 AND network_id = ?2", NODE_A, NET)?.c).toBe(1);
+    const u = await connect(asOwner);
+    try {
+      await u.call("report_status", { resume_id: "user-logs-report", alias: NODE_B, status: "idle", network_id: NET, logs_capable: true });
+    } finally { await u.close(); }
+    expect(db.get<{ c: number }>("SELECT logs_capable AS c FROM sessions WHERE alias = ?1 AND network_id = ?2", NODE_B, NET)?.c ?? 0).toBe(0);
+  }, 20_000);
+});
+
+describe("round trip", () => {
+  test("the node pulls only the normalised filter JSON (no path), acks, the asker reads it once", async () => {
+    const u = await connect(asOwner);
+    const a = await connect(asA);
+    try {
+      const enq = await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET, lines: 99999 > 2000 ? 2000 : 1, level: "warn", grep: "boom", since_ts: 5, path: "/etc/passwd" });
+      expect(enq).toMatchObject({ ok: true, op: "logs_tail" });
+      const pulled = (await a.call("get_rules_file_request", {})).request;
+      expect(pulled.op).toBe("logs_tail");
+      expect(JSON.parse(pulled.content)).toEqual({ lines: 2000, level: "warn", grep: "boom", since_ts: 5 });
+      expect(pulled.content).not.toContain("passwd");
+      expect(await a.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "logs", exists: true, content: SAMPLE })).toMatchObject({ ok: true, status: "done" });
+
+      const first = await u.call("get_rules_file_result", { request_id: enq.request_id, network_id: NET });
+      expect(first).toMatchObject({ ok: true, op: "logs_tail", status: "done", content: SAMPLE });
+      // Read-once: purged in the same call, including the filter JSON.
+      expect(row(enq.request_id)).toMatchObject({ result_content: null, content: null });
+      expect(row(enq.request_id).content_purged_at).toBeGreaterThan(0);
+      const second = await u.call("get_rules_file_result", { request_id: enq.request_id, network_id: NET });
+      expect(second.content).toBeUndefined();
+      expect(second.content_purged).toBe(true);
+    } finally { await u.close(); await a.close(); }
+  }, 20_000);
+
+  test("lines above 2000 are refused by the schema; bad level refused", async () => {
+    const u = await connect(asOwner);
+    try {
+      expect((await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET, lines: 2001 })).ok).not.toBe(true);
+      expect((await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET, level: "debug" })).ok).not.toBe(true);
+      expect(rowCount()).toBe(0);
+    } finally { await u.close(); }
+  }, 20_000);
+});
+
+describe("who may ask", () => {
+  test("node tokens are refused — for other nodes and for themselves", async () => {
+    const a = await connect(asA);
+    try {
+      expect(await a.call("tail_node_logs", { node_id: NODE_B_ID })).toMatchObject({ ok: false, error: "node_token_cannot_read_logs" });
+      expect(await a.call("tail_node_logs", { node_id: NODE_A_ID })).toMatchObject({ ok: false, error: "node_token_cannot_read_logs" });
+      expect(rowCount()).toBe(0);
+    } finally { await a.close(); }
+  }, 20_000);
+
+  test("node owner yes; plain member no; viewer no; network owner yes", async () => {
+    const m = await connect(asMember);
+    const m2 = await connect(asMember2);
+    const v = await connect(asViewer);
+    const o = await connect(asOwner);
+    try {
+      expect(await m.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET })).toMatchObject({ ok: true });
+      expect(await m.call("tail_node_logs", { node_id: NODE_B_ID, network_id: NET })).toMatchObject({ ok: false, error: "logs_permission_denied" });
+      expect(await m2.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET })).toMatchObject({ ok: false, error: "logs_permission_denied" });
+      expect((await v.call("tail_node_logs", { node_id: NODE_B_ID, network_id: NET })).ok).toBe(false);
+      expect(await o.call("tail_node_logs", { node_id: NODE_B_ID, network_id: NET })).toMatchObject({ ok: true });
+      expect(rowCount()).toBe(2);
+    } finally { await m.close(); await m2.close(); await v.close(); await o.close(); }
+  }, 20_000);
+
+  test("a user of another network is refused (cross network)", async () => {
+    const x = await connect(asOutsider);
+    try {
+      const r1 = await x.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET });
+      expect(r1.ok).toBe(false);
+      const r2 = await x.call("tail_node_logs", { node_id: NODE_A_ID, network_id: OTHER_NET });
+      expect(r2).toMatchObject({ ok: false, error: "cross_network_node" });
+      expect(rowCount()).toBe(0);
+    } finally { await x.close(); }
+  }, 20_000);
+});
+
+describe("who may read", () => {
+  test("only the login that asked; another login of the same user, node tokens and the serving node cannot", async () => {
+    const u = await connect(asOwner);
+    const other = await connect(asOwnerOtherLogin);
+    const b = await connect(asB);
+    const a = await connect(asA);
+    try {
+      const enq = await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET });
+      await a.call("get_rules_file_request", {});
+      await a.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: SAMPLE });
+      expect(await other.call("get_rules_file_result", { request_id: enq.request_id, network_id: NET })).toMatchObject({ ok: false, error: "request_not_found" });
+      expect(await b.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+      expect(await a.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+      // Those refusals did not consume the read-once result.
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id, network_id: NET })).toMatchObject({ status: "done", content: SAMPLE });
+    } finally { await u.close(); await other.close(); await b.close(); await a.close(); }
+  }, 20_000);
+
+  test("node B never pulls or acks node A's logs request", async () => {
+    const u = await connect(asOwner);
+    const a = await connect(asA);
+    const b = await connect(asB);
+    try {
+      const enq = await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET });
+      expect((await b.call("get_rules_file_request", {})).request).toBeNull();
+      expect(await b.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{\"forged\":true}" })).toMatchObject({ ignored: "unknown_or_foreign_request" });
+      expect((await a.call("get_rules_file_request", {})).request.request_id).toBe(enq.request_id);
+    } finally { await u.close(); await a.close(); await b.close(); }
+  }, 20_000);
+});
+
+describe("storage and lanes", () => {
+  test("an unread terminal result is purged by the sweep after the logs TTL; other ops keep theirs", async () => {
+    const u = await connect(asOwner);
+    const a = await connect(asA);
+    try {
+      const enq = await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET });
+      const rules = await u.call("read_node_rules_file", { node_id: NODE_A_ID, network_id: NET });
+      await a.call("get_rules_file_request", {});
+      await a.call("get_rules_file_request", {});
+      await a.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: SAMPLE });
+      await a.call("ack_rules_file_request", { request_id: rules.request_id, status: "done", content: "# rules" });
+      sweepNodeRequestContent(Date.now() + LOGS_CONTENT_TTL_MS - 5_000);
+      expect(row(enq.request_id).result_content).toBe(SAMPLE);
+      sweepNodeRequestContent(Date.now() + LOGS_CONTENT_TTL_MS + 5_000);
+      expect(row(enq.request_id)).toMatchObject({ result_content: null, content: null });
+      expect(row(rules.request_id).result_content).toBe("# rules");
+    } finally { await u.close(); await a.close(); }
+  }, 20_000);
+
+  test("own single-flight lane; a 1 MiB-class ack is accepted", async () => {
+    const u = await connect(asOwner);
+    const a = await connect(asA);
+    try {
+      expect(await u.call("list_node_files", { node_id: NODE_A_ID, network_id: NET })).toMatchObject({ ok: true });
+      const first = await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET });
+      expect(first).toMatchObject({ ok: true });
+      expect(await u.call("tail_node_logs", { node_id: NODE_A_ID, network_id: NET })).toMatchObject({ ok: false, error: "request_in_flight", existing_request_id: first.request_id });
+      await a.call("get_rules_file_request", {});
+      await a.call("get_rules_file_request", {});
+      const big = "x".repeat(700 * 1024);
+      expect(await a.call("ack_rules_file_request", { request_id: first.request_id, status: "done", content: big })).toMatchObject({ ok: true, status: "done" });
+    } finally { await u.close(); await a.close(); }
+  }, 20_000);
+});

package/src/node-request-retention.test.ts

@@ -0,0 +1,281 @@
+// node_rules_requests content retention — privacy purge of node file bytes.
+//
+// Real MCP in-process transport, same harness as rules-file-transport.test.ts.
+// Covers:
+//   1. read result is handed out on the first terminal read, still handed out to
+//      a second reader inside the grace window (the desktop app's
+//      request_in_flight → follow path), then purged: status + metadata stay,
+//      `content_purged: true` replaces content.
+//   2. a caller outside the row's network can neither read nor stamp/purge it.
+//   3. TTL sweep: >24h content cleared (stale pending flipped to timeout first),
+//      >30d rows deleted, fresh unread rows untouched.
+//   4. write payload (`content` column) is cleared; skill_read name is kept.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/nrr.db bun test src/node-request-retention.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { CONTENT_GRACE_MS, CONTENT_TTL_MS, ROW_TTL_MS, sweepNodeRequestContent } from "./node-request-retention.js";
+import { sweepRetention } from "./retention.js";
+
+const NET = "net_nrr";
+const OTHER_NET = "net_nrr_other";
+const USER = "u_nrr_owner";
+const NODE_ID = "node_nrr_claude";
+const NODE_ALIAS = "nrr-claude";
+const NODE_TOKEN = "tok_nrr_node";
+
+function cleanup() {
+  for (const net of [NET, OTHER_NET]) {
+    try { db.run("DELETE FROM node_rules_requests WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM audit_log WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM network_members WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [net]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedWorld() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER, USER]);
+  for (const net of [NET, OTHER_NET]) {
+    db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [net, net, USER]);
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER, net]);
+  }
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [NODE_ID, NODE_ALIAS, NODE_ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [NODE_TOKEN, USER, NET, `node:${NODE_ALIAS}`, "hash_nrr_node"],
+  );
+}
+
+type Identity = { net: string; alias: string; isNetworkToken: boolean; tokenId: string };
+const asUser: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_nrr_user" };
+// Same human, scoped to the OTHER network: passes canWrite there, but the row
+// lives in NET — SEC-1 must answer request_not_found and touch nothing.
+const asUserOtherScope: Identity = { net: OTHER_NET, alias: USER, isNetworkToken: false, tokenId: "tok_nrr_user_other" };
+const asNode: Identity = { net: NET, alias: NODE_ALIAS, isNetworkToken: true, tokenId: NODE_TOKEN };
+// Same user, same network, a different login token: #1999 makes project-file
+// results readable only by the token that asked.
+const asUserOtherLogin: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_nrr_user_other_login" };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "nrr-test", version: "1" });
+  registerTools(server, undefined, id.net, USER, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "nrr-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}`);
+    return JSON.parse(first.text);
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { call, close };
+}
+
+type Row = { status: string; content: string | null; result_content: string | null; file_name: string | null; first_read_at: number | null; content_purged_at: number | null; op: string };
+const rowOf = (id: string) => db.get<Row>(
+  "SELECT status, content, result_content, file_name, first_read_at, content_purged_at, op FROM node_rules_requests WHERE request_id = ?1", id,
+);
+const ageFirstRead = (id: string, ms: number) => db.run("UPDATE node_rules_requests SET first_read_at = first_read_at - ?1 WHERE request_id = ?2", [ms, id]);
+const ageCreated = (id: string, ms: number) => db.run("UPDATE node_rules_requests SET created_at = created_at - ?1 WHERE request_id = ?2", [ms, id]);
+
+async function readRoundTrip(u: Awaited<ReturnType<typeof connect>>, n: Awaited<ReturnType<typeof connect>>, body: string) {
+  const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+  expect(enq.ok).toBe(true);
+  await n.call("get_rules_file_request", {});
+  await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "CLAUDE.md", exists: true, content: body });
+  return enq.request_id as string;
+}
+
+beforeEach(() => { cleanup(); seedWorld(); });
+afterAll(cleanup);
+
+describe("node_rules_requests — read once, purge after grace", () => {
+  test("content returned on first terminal read and to a follower inside the grace window, then purged", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const body = "# secret rules\n";
+      const rid = await readRoundTrip(u, n, body);
+      expect(rowOf(rid)!.first_read_at).toBeNull();
+
+      const first = await u.call("get_rules_file_result", { request_id: rid });
+      expect(first).toMatchObject({ ok: true, status: "done", content: body, file_name: "CLAUDE.md", exists: true });
+      expect(first.content_purged).toBeUndefined();
+      const stamped = rowOf(rid)!.first_read_at;
+      expect(stamped).not.toBeNull();
+
+      // Second reader (app follow path) inside the grace window still gets it,
+      // and the stamp is NOT pushed forward (a poller can't keep it alive).
+      sweepNodeRequestContent();
+      const follower = await u.call("get_rules_file_result", { request_id: rid });
+      expect(follower.content).toBe(body);
+      expect(rowOf(rid)!.first_read_at).toBe(stamped);
+
+      ageFirstRead(rid, CONTENT_GRACE_MS + 1);
+      // Any enqueue runs the opportunistic sweep.
+      await u.call("list_node_skills", { node_id: NODE_ID });
+      const row = rowOf(rid)!;
+      expect(row.result_content).toBeNull();
+      expect(row.content_purged_at).not.toBeNull();
+      expect(row.status).toBe("done");
+      expect(row.file_name).toBe("CLAUDE.md");
+
+      const after = await u.call("get_rules_file_result", { request_id: rid });
+      expect(after).toMatchObject({ ok: true, status: "done", file_name: "CLAUDE.md", exists: true, content_purged: true });
+      expect("content" in after).toBe(false);
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+
+  test("non-terminal polls do not stamp; a never-read result keeps its content until TTL", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const enq = await u.call("read_node_rules_file", { node_id: NODE_ID });
+      expect((await u.call("get_rules_file_result", { request_id: enq.request_id })).status).toBe("pending");
+      expect(rowOf(enq.request_id)!.first_read_at).toBeNull();
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "CLAUDE.md", exists: true, content: "x" });
+      sweepNodeRequestContent(Date.now() + CONTENT_GRACE_MS * 10);
+      expect(rowOf(enq.request_id)!.result_content).toBe("x");
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — authorization", () => {
+  test("a caller outside the row's network gets request_not_found and cannot stamp or purge it", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    const o = await connect(asUserOtherScope);
+    try {
+      const rid = await readRoundTrip(u, n, "# mine\n");
+      for (let i = 0; i < 3; i++) {
+        expect(await o.call("get_rules_file_result", { request_id: rid })).toMatchObject({ ok: false, error: "request_not_found" });
+      }
+      // Also pass the owner's network_id explicitly — scope is the token's, not the arg's.
+      expect((await o.call("get_rules_file_result", { request_id: rid, network_id: NET })).content).toBeUndefined();
+      expect(rowOf(rid)!.first_read_at).toBeNull();
+      sweepNodeRequestContent(Date.now() + CONTENT_GRACE_MS * 10);
+      expect(rowOf(rid)!.result_content).toBe("# mine\n");
+      // The rightful requester still gets it.
+      expect((await u.call("get_rules_file_result", { request_id: rid })).content).toBe("# mine\n");
+    } finally { await u.close(); await n.close(); await o.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — project files (#1999)", () => {
+  test("another login token can't read or stamp a file_read row; the requester's read starts the grace clock; path is kept", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    const other = await connect(asUserOtherLogin);
+    try {
+      const enq = await u.call("read_node_file", { node_id: NODE_ID, path: "docs/plan.md" });
+      expect(enq.ok).toBe(true);
+      await n.call("get_rules_file_request", {});
+      const body = JSON.stringify({ path: "docs/plan.md", kind: "text", content: "TOP SECRET PLAN" });
+      await n.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: body });
+
+      expect(await other.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ ok: false, error: "request_not_found" });
+      expect(rowOf(enq.request_id)!.first_read_at).toBeNull();
+
+      expect((await u.call("get_rules_file_result", { request_id: enq.request_id })).content).toBe(body);
+      ageFirstRead(enq.request_id, CONTENT_GRACE_MS + 1);
+      sweepNodeRequestContent();
+      const row = rowOf(enq.request_id)!;
+      expect(row.result_content).toBeNull();
+      expect(row.content).toBe("docs/plan.md");
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "done", content_purged: true });
+    } finally { await u.close(); await n.close(); await other.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — write payload", () => {
+  test("write body in `content` is cleared after the grace window; skill_read name is kept", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      const body = "# new rules with a secret\n";
+      const w = await u.call("write_node_rules_file", { node_id: NODE_ID, content: body });
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: w.request_id, status: "done", file_name: "CLAUDE.md", exists: true });
+      expect(rowOf(w.request_id)!.content).toBe(body);
+
+      const s = await u.call("read_node_skill", { node_id: NODE_ID, name: "my-skill" });
+      await n.call("get_rules_file_request", {});
+      await n.call("ack_rules_file_request", { request_id: s.request_id, status: "done", content: JSON.stringify({ name: "my-skill", content: "SKILL BODY" }) });
+
+      const wr = await u.call("get_rules_file_result", { request_id: w.request_id });
+      expect(wr).toMatchObject({ status: "done", op: "write" });
+      expect(wr.content).toBeUndefined();
+      expect((await u.call("get_rules_file_result", { request_id: s.request_id })).content).toContain("SKILL BODY");
+
+      ageFirstRead(w.request_id, CONTENT_GRACE_MS + 1);
+      ageFirstRead(s.request_id, CONTENT_GRACE_MS + 1);
+      sweepNodeRequestContent();
+
+      const wRow = rowOf(w.request_id)!;
+      expect(wRow.content).toBeNull();
+      expect(wRow.content_purged_at).not.toBeNull();
+      expect(wRow.status).toBe("done");
+      const sRow = rowOf(s.request_id)!;
+      expect(sRow.result_content).toBeNull();
+      expect(sRow.content).toBe("my-skill");
+      expect(await u.call("get_rules_file_result", { request_id: w.request_id })).toMatchObject({ status: "done", op: "write", content_purged: true });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});
+
+describe("node_rules_requests — TTL sweep", () => {
+  test(">24h content cleared (stale pending write expired first, so no node can pull an emptied write); >30d rows deleted; fresh rows kept", async () => {
+    const u = await connect(asUser);
+    const n = await connect(asNode);
+    try {
+      // Create everything first, age afterwards: every enqueue runs the sweep.
+      const oldRead = await readRoundTrip(u, n, "# old, never fetched\n");
+      const ancient = await readRoundTrip(u, n, "# ancient\n");
+      const fresh = await readRoundTrip(u, n, "# fresh, never fetched\n");
+      // A write the node never pulled (offline for a day). Enqueued last so
+      // single-flight doesn't refuse it.
+      const w = await u.call("write_node_rules_file", { node_id: NODE_ID, content: "# stale write body\n" });
+      expect(w.ok).toBe(true);
+      ageCreated(oldRead, CONTENT_TTL_MS + 60_000);
+      ageCreated(ancient, ROW_TTL_MS + 60_000);
+      ageCreated(w.request_id, CONTENT_TTL_MS + 60_000);
+
+      const r = sweepRetention();
+      expect(r.nodeRequests.deleted).toBe(1);
+      expect(r.nodeRequests.timedOut).toBe(1);
+      expect(r.nodeRequests.purged).toBe(2);
+
+      expect(rowOf(ancient)).toBeNull();
+      const o = rowOf(oldRead)!;
+      expect(o.result_content).toBeNull();
+      expect(o.status).toBe("done");
+      expect(o.file_name).toBe("CLAUDE.md");
+      expect(rowOf(fresh)!.result_content).toBe("# fresh, never fetched\n");
+
+      const wr = rowOf(w.request_id)!;
+      expect(wr.status).toBe("timeout");
+      expect(wr.content).toBeNull();
+      // The node coming back must not receive the emptied write.
+      expect(await n.call("get_rules_file_request", {})).toEqual({ ok: true, request: null });
+
+      expect(await u.call("get_rules_file_result", { request_id: oldRead })).toMatchObject({ status: "done", content_purged: true });
+
+      // Idempotent.
+      const again = sweepNodeRequestContent();
+      expect(again).toEqual({ timedOut: 0, purged: 0, deleted: 0 });
+    } finally { await u.close(); await n.close(); }
+  }, 20_000);
+});