@sleep2agi/commhub-server 0.9.0-preview.7 → 0.9.0-preview.71

package/src/node-request-retention.ts

@@ -0,0 +1,120 @@
+// node_rules_requests content retention (privacy).
+//
+// The rules-file / skills (and project-folder) queue carries **node file
+// contents** through the hub: `result_content` holds what the node sent back
+// (CLAUDE.md / AGENTS.md, SKILL.md, directory listings, file bodies) and
+// `content` holds write payloads (the full new rules file). Before this module
+// nothing ever cleared or deleted those rows — every file anyone ever opened in
+// the desktop app stayed in the hub DB forever.
+//
+// Policy (metadata — status, op, file_name, file_exists, error, timestamps,
+// requester — is kept for audit; only file bytes are dropped):
+//
+//   1. Read-once + grace: the first time an authorized requester reads a
+//      TERMINAL result (done/failed/timeout) the row is stamped `first_read_at`.
+//      CONTENT_GRACE_MS later the content is purged. Not immediate, because the
+//      desktop app has a real second-reader path: when enqueue is rejected with
+//      `request_in_flight` the app FOLLOWS the existing request id
+//      (requestIdToFollow → waitForRulesFileResult, NodeRulesSection /
+//      NodeSkillsSection / NodeFilesSection). Two windows (or a remount) polling
+//      the same request reach terminal within one poll interval (≤ 3 s) of each
+//      other; an immediate purge would hand the second one `done` with no
+//      content and NodeRulesSection would load an EMPTY editor (`content ?? ''`)
+//      that a Save would then write back to the node. 60 s is 20× the slowest
+//      poll interval.
+//   2. TTL: anything older than CONTENT_TTL_MS gets its content purged whether
+//      or not anyone ever read it (e.g. the app was closed mid-request). A
+//      still-pending/in_progress row that old is first flipped to `timeout`, so
+//      a node that comes back after a day can never pull a write whose payload
+//      was just nulled (it would otherwise receive `content: ""` and write an
+//      empty rules file).
+//   3. Rows older than ROW_TTL_MS are deleted outright.
+//   4. Run logs (op = logs_tail) are stricter: read-once with NO grace — the
+//      first authorized terminal read purges them in the same call
+//      (purgeLogsResultNow), because the app never follows another request's
+//      logs result (it simply asks again) and a process log is the most
+//      sensitive thing on this queue. Unread terminal results are purged after
+//      LOGS_CONTENT_TTL_MS (the requester closed the page). The filter JSON in
+//      `content` (it can hold a user-typed grep) goes with it.
+//
+// Every statement is bounded (LIMIT via `request_id IN (SELECT … LIMIT n)` —
+// SQLite's UPDATE/DELETE … LIMIT needs a compile flag we don't control) and
+// uses an index (idx_nrr_created / idx_nrr_first_read). It runs
+// opportunistically on enqueue and on terminal reads, from a one-shot timer
+// armed at the first terminal read, and from the hourly retention sweeper
+// (retention.ts) — so the first sweep after deploy also clears every old row
+// that predates this module.
+
+import { db } from "./db.js";
+
+export const CONTENT_GRACE_MS = 60_000;
+export const CONTENT_TTL_MS = 24 * 60 * 60 * 1000;
+export const ROW_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const SWEEP_BATCH = 500;
+export const LOGS_CONTENT_TTL_MS = 5 * 60 * 1000;
+
+export type NodeRequestSweepResult = { timedOut: number; purged: number; deleted: number };
+
+// `content` is only a file body for op=write. For skill_read / file_read it is
+// the skill name / relative path the requester asked for — audit metadata, kept.
+// For logs_tail it is the filter JSON, which may carry a user-typed grep — purged.
+const PURGE_SET =
+  "result_content = NULL, content = CASE WHEN op IN ('write', 'logs_tail') THEN NULL ELSE content END, content_purged_at = ?1";
+
+function purgeWhere(where: string, params: (string | number)[], now: number): number {
+  const r = db.run(
+    `UPDATE node_rules_requests SET ${PURGE_SET} WHERE request_id IN (SELECT request_id FROM node_rules_requests WHERE content_purged_at IS NULL AND ${where} LIMIT ${SWEEP_BATCH})`,
+    [now, ...params],
+  );
+  return r.changes ?? 0;
+}
+
+export function sweepNodeRequestContent(now: number = Date.now()): NodeRequestSweepResult {
+  const out: NodeRequestSweepResult = { timedOut: 0, purged: 0, deleted: 0 };
+  try {
+    // Delete first so rows past the row TTL aren't pointlessly purged, then
+    // expire stale non-terminal rows, then purge.
+    out.deleted = db.run(
+      `DELETE FROM node_rules_requests WHERE request_id IN (SELECT request_id FROM node_rules_requests WHERE created_at < ?1 LIMIT ${SWEEP_BATCH})`,
+      [now - ROW_TTL_MS],
+    ).changes ?? 0;
+    const ttlCutoff = now - CONTENT_TTL_MS;
+    out.timedOut = db.run(
+      `UPDATE node_rules_requests SET status = 'timeout', acked_at = ?1, error = ?2 WHERE request_id IN (SELECT request_id FROM node_rules_requests WHERE created_at < ?3 AND status IN ('pending', 'in_progress') LIMIT ${SWEEP_BATCH})`,
+      [now, "expired by retention sweep (node never answered)", ttlCutoff],
+    ).changes ?? 0;
+    // ?1 = now (PURGE_SET), ?2… = where params.
+    out.purged += purgeWhere("first_read_at IS NOT NULL AND first_read_at <= ?2 AND status IN ('done', 'failed', 'timeout')", [now - CONTENT_GRACE_MS], now);
+    out.purged += purgeWhere("created_at < ?2 AND status IN ('done', 'failed', 'timeout')", [ttlCutoff], now);
+    out.purged += purgeWhere("op = 'logs_tail' AND created_at < ?2 AND status IN ('done', 'failed', 'timeout')", [now - LOGS_CONTENT_TTL_MS], now);
+  } catch (e: any) {
+    console.log(`[commhub retention] node_rules_requests sweep failed: ${e?.message ?? e}`);
+  }
+  return out;
+}
+
+/** Called by get_rules_file_result AFTER the requester passed every auth check
+ *  and only for a terminal status. Stamps the first terminal read, arms a
+ *  one-shot purge for after the grace window, and reports whether this row's
+ *  content is already gone. */
+export function noteTerminalResultRead(requestId: string, now: number = Date.now()): { purged: boolean } {
+  const r = db.run(
+    "UPDATE node_rules_requests SET first_read_at = ?1 WHERE request_id = ?2 AND first_read_at IS NULL",
+    [now, requestId],
+  );
+  if ((r.changes ?? 0) > 0) {
+    const t = setTimeout(() => { sweepNodeRequestContent(); }, CONTENT_GRACE_MS + 1_000);
+    (t as any).unref?.();
+  }
+  const row = db.get<{ content_purged_at: number | null }>(
+    "SELECT content_purged_at FROM node_rules_requests WHERE request_id = ?1",
+    requestId,
+  );
+  return { purged: row?.content_purged_at != null };
+}
+
+/** Run-log results are read-once: called by get_rules_file_result right after it
+ *  handed a terminal logs_tail result to its (authorized) requester. */
+export function purgeLogsResultNow(requestId: string, now: number = Date.now()): void {
+  db.run(`UPDATE node_rules_requests SET ${PURGE_SET} WHERE request_id = ?2 AND op = 'logs_tail' AND content_purged_at IS NULL`, [now, requestId]);
+}

package/src/node-skills-transport.test.ts

@@ -0,0 +1,209 @@
+// Node skills view — list_node_skills / read_node_skill ride the rules-file
+// queue + doorbell (ops skills_list / skill_read).
+//
+// Hub-side contract verified here:
+//   1. report_status { skills_capable: true } is sticky and set only by the
+//      session's own bound node token.
+//   2. list_node_skills / read_node_skill reach a session with no nodes row by
+//      alias; the node pulls with its own token; read carries the skill NAME
+//      (never a path) in the pulled request; results come back through
+//      get_rules_file_result for both ops.
+//   3. Bad skill names are refused before any request row exists.
+//   4. A session that can serve rules files but did not report skills_capable is
+//      refused up front for skills ops (skills_target_not_found).
+//   5. Separate single-flight lanes: a pending rules read does not block a skills
+//      list and vice versa; a second skills request while one is pending is refused.
+//   6. Network isolation and foreign acks are ignored.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/skills-session.db bun test src/node-skills-transport.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_skills_session";
+const OTHER_NET = "net_skills_session_other";
+const USER = "u_skills_session_owner";
+const SESSION_ALIAS = "skills-session-cc";
+const SESSION_RESUME = "cc-skills-session-1";
+const OTHER_ALIAS = "skills-session-peer";
+const NODE_ROW_ALIAS = "skills-session-noderow";
+const NODE_ROW_ID = "node_skills_session_noderow";
+const T_SESSION = "tok_skills_session_cc";
+const T_PEER = "tok_skills_session_peer";
+const T_OTHER_NET_SAME_ALIAS = "tok_skills_session_other_net";
+const T_NODE_ROW = "tok_skills_session_noderow";
+
+function cleanup() {
+  for (const net of [NET, OTHER_NET]) {
+    try { db.run("DELETE FROM node_rules_requests WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM sessions WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM network_members WHERE network_id = ?1", [net]); } catch {}
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [net]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedWorld() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER, USER]);
+  for (const net of [NET, OTHER_NET]) {
+    db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [net, net, USER]);
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER, net]);
+  }
+  const tok = (id: string, net: string, alias: string) => db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [id, USER, net, `node:${alias}`, `hash_${id}`],
+  );
+  tok(T_SESSION, NET, SESSION_ALIAS);
+  tok(T_PEER, NET, OTHER_ALIAS);
+  tok(T_OTHER_NET_SAME_ALIAS, OTHER_NET, SESSION_ALIAS);
+  tok(T_NODE_ROW, NET, NODE_ROW_ALIAS);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [NODE_ROW_ID, NODE_ROW_ALIAS, NODE_ROW_ALIAS, NET],
+  );
+}
+
+type Identity = { net: string; alias: string; isNetworkToken: boolean; tokenId: string };
+const asUser: Identity = { net: NET, alias: USER, isNetworkToken: false, tokenId: "tok_skills_session_user" };
+const asOtherNetUser: Identity = { net: OTHER_NET, alias: USER, isNetworkToken: false, tokenId: "tok_skills_session_user2" };
+const asSession: Identity = { net: NET, alias: SESSION_ALIAS, isNetworkToken: true, tokenId: T_SESSION };
+const asPeer: Identity = { net: NET, alias: OTHER_ALIAS, isNetworkToken: true, tokenId: T_PEER };
+const asOtherNetSameAlias: Identity = { net: OTHER_NET, alias: SESSION_ALIAS, isNetworkToken: true, tokenId: T_OTHER_NET_SAME_ALIAS };
+const asNodeRow: Identity = { net: NET, alias: NODE_ROW_ALIAS, isNetworkToken: true, tokenId: T_NODE_ROW };
+
+async function connect(id: Identity) {
+  const server = new McpServer({ name: "skills-session-test", version: "1" });
+  registerTools(server, undefined, id.net, USER, id.alias, id.isNetworkToken, id.tokenId);
+  const client = new Client({ name: "skills-session-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (name: string, args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name, arguments: args });
+    const first = r.content?.[0];
+    if (!first || first.type !== "text") throw new Error(`no text result from ${name}: ${JSON.stringify(r).slice(0, 300)}`);
+    return JSON.parse(first.text);
+  };
+  const close = async () => { await client.close(); await server.close(); };
+  return { call, close };
+}
+
+const capable = (alias: string, net = NET) =>
+  db.get<{ c: number }>("SELECT skills_capable AS c FROM sessions WHERE alias = ?1 AND network_id = ?2", alias, net)?.c;
+const rowCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_rules_requests WHERE network_id = ?1", NET)!.n;
+
+async function registerSession(id: Identity, alias: string, resume: string, flag: boolean) {
+  const c = await connect(id);
+  try {
+    return await c.call("report_status", { resume_id: resume, alias, status: "idle", agent: "claude-code", ...(flag ? { rules_file_capable: true, skills_capable: true } : {}) });
+  } finally { await c.close(); }
+}
+
+beforeEach(() => { cleanup(); seedWorld(); });
+afterAll(cleanup);
+
+async function reportRulesOnly(id: Identity, alias: string, resume: string) {
+  const c = await connect(id);
+  try { return await c.call("report_status", { resume_id: resume, alias, status: "idle", agent: "claude-code", rules_file_capable: true }); }
+  finally { await c.close(); }
+}
+
+describe("skills_capable is set only by the session's own node token", () => {
+  test("bound token sets it; a report without it does not clear it; a peer cannot set it", async () => {
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, true);
+    expect(capable(SESSION_ALIAS)).toBe(1);
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, false);
+    expect(capable(SESSION_ALIAS)).toBe(1);
+    const r = await registerSession(asPeer, SESSION_ALIAS, SESSION_RESUME, true);
+    expect(r).toMatchObject({ ok: false });
+  }, 20_000);
+});
+
+describe("list / read by alias reach a session with no nodes row", () => {
+  test("list round trip: enqueue → pull (no content) → ack JSON → result carries it", async () => {
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, true);
+    const u = await connect(asUser);
+    const s = await connect(asSession);
+    try {
+      const enq = await u.call("list_node_skills", { alias: SESSION_ALIAS });
+      expect(enq).toMatchObject({ ok: true, op: "skills_list" });
+      const pulled = await s.call("get_rules_file_request", {});
+      expect(pulled.request).toEqual({ request_id: enq.request_id, op: "skills_list" });
+      const payload = JSON.stringify({ skills: [{ name: "ship", scope: "project", path_rel: ".claude/skills/ship/SKILL.md", description: "d" }] });
+      expect(await s.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "skills", exists: true, content: payload })).toMatchObject({ ok: true, status: "done" });
+      const res = await u.call("get_rules_file_result", { request_id: enq.request_id });
+      expect(res).toMatchObject({ ok: true, op: "skills_list", status: "done", content: payload });
+    } finally { await u.close(); await s.close(); }
+  }, 20_000);
+
+  test("read round trip: the pulled request carries the skill name only", async () => {
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, true);
+    const u = await connect(asUser);
+    const s = await connect(asSession);
+    try {
+      const enq = await u.call("read_node_skill", { alias: SESSION_ALIAS, name: "ship" });
+      expect(enq).toMatchObject({ ok: true, op: "skill_read" });
+      const pulled = await s.call("get_rules_file_request", {});
+      expect(pulled.request).toEqual({ request_id: enq.request_id, op: "skill_read", content: "ship" });
+      const payload = JSON.stringify({ name: "ship", scope: "project", path_rel: ".claude/skills/ship/SKILL.md", description: "d", content: "# ship" });
+      await s.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", file_name: "ship", exists: true, content: payload });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "done", content: payload });
+    } finally { await u.close(); await s.close(); }
+  }, 20_000);
+
+  test("bad names are refused before any row is written", async () => {
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, true);
+    const u = await connect(asUser);
+    try {
+      for (const name of ["..", ".", "../CLAUDE.md", "a/b", "a b"]) {
+        expect(await u.call("read_node_skill", { alias: SESSION_ALIAS, name })).toMatchObject({ ok: false, error: "invalid_skill_name" });
+      }
+      expect(rowCount()).toBe(0);
+    } finally { await u.close(); }
+  }, 20_000);
+
+  test("rules-capable but not skills-capable → skills_target_not_found, no row", async () => {
+    await reportRulesOnly(asSession, SESSION_ALIAS, SESSION_RESUME);
+    const u = await connect(asUser);
+    try {
+      expect(await u.call("list_node_skills", { alias: SESSION_ALIAS })).toMatchObject({ ok: false, error: "skills_target_not_found" });
+      expect(rowCount()).toBe(0);
+      expect(await u.call("read_node_rules_file", { alias: SESSION_ALIAS })).toMatchObject({ ok: true });
+    } finally { await u.close(); }
+  }, 20_000);
+});
+
+describe("single-flight lanes", () => {
+  test("a pending rules read does not block a skills list; a second skills request is refused", async () => {
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, true);
+    const u = await connect(asUser);
+    try {
+      expect(await u.call("read_node_rules_file", { alias: SESSION_ALIAS })).toMatchObject({ ok: true });
+      const list = await u.call("list_node_skills", { alias: SESSION_ALIAS });
+      expect(list).toMatchObject({ ok: true });
+      expect(await u.call("read_node_skill", { alias: SESSION_ALIAS, name: "ship" })).toMatchObject({ ok: false, error: "request_in_flight", existing_request_id: list.request_id });
+      expect(await u.call("read_node_rules_file", { alias: SESSION_ALIAS })).toMatchObject({ ok: false, error: "request_in_flight" });
+    } finally { await u.close(); }
+  }, 20_000);
+});
+
+describe("isolation", () => {
+  test("same alias in another network neither pulls nor acks; a peer's ack is ignored", async () => {
+    await registerSession(asSession, SESSION_ALIAS, SESSION_RESUME, true);
+    const u = await connect(asUser);
+    const other = await connect(asOtherNetSameAlias);
+    const peer = await connect(asPeer);
+    try {
+      const enq = await u.call("list_node_skills", { alias: SESSION_ALIAS });
+      expect((await other.call("get_rules_file_request", {})).request).toBeNull();
+      expect(await other.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{}" })).toMatchObject({ ok: true, ignored: "unknown_or_foreign_request" });
+      expect(await peer.call("ack_rules_file_request", { request_id: enq.request_id, status: "done", content: "{}" })).toMatchObject({ ok: true, ignored: "unknown_or_foreign_request" });
+      expect(await u.call("get_rules_file_result", { request_id: enq.request_id })).toMatchObject({ status: "pending" });
+    } finally { await u.close(); await other.close(); await peer.close(); }
+  }, 20_000);
+});

package/src/node-token-privilege-http.test.ts

@@ -0,0 +1,149 @@
+// 节点令牌不继承签发者的账号权限与 Hub 管理员身份。
+//
+// 生产上几乎所有节点令牌(ntok_)都由管理员签发,resolveToken 把它解析成那个管理员用户。
+// 以前一部分端点直接看 `resolved.user.role === "admin"` 或把令牌当成用户本人,于是任何一个节点
+// 都能:列全部用户、读服务端日志与审计日志、给签发者再签用户令牌 / 节点令牌、改签发者资料与密码、
+// 建 / 改 / 删网络、管成员与邀请、读别的网络详情、看全部网络的 SSE 拓扑。
+// 这里每一条在修复前(main)都是红的;管理员自己的用户令牌作为正控,照常可用。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetwork, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-ntok-priv-"));
+let BASE = "";
+let hub: any = null;
+const PW = "NtokPrivPassw0rd!";
+let adminToken = "", adminId = "", NET = "", OTHER_NET = "", ntok = "";
+
+const auth = (t: string) => ({ Authorization: `Bearer ${t}` });
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...auth(token), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const admin = register(`ntok_admin_${Date.now()}`, PW);
+  adminToken = admin.token!; adminId = admin.user!.user_id; NET = admin.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [adminId]);
+  const other = createNetwork(adminId, "ntok-other");
+  OTHER_NET = (other as any).network_id;
+  const minted = createNetworkTokenForNode(adminId, NET, "ntok-node", "node_ntok_priv");
+  expect(minted.ok).toBe(true);
+  ntok = minted.token!;
+  register(`ntok_someone_${Date.now()}`, PW);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("hub-admin powers need a user token", () => {
+  test("GET /api/users", async () => {
+    expect((await call(ntok, "GET", "/api/users")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/users")).status).toBe(200);
+  });
+  test("GET /api/server-logs", async () => {
+    expect((await call(ntok, "GET", "/api/server-logs")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/server-logs")).status).toBe(200);
+  });
+  test("GET /api/audit-log", async () => {
+    expect((await call(ntok, "GET", "/api/audit-log")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/audit-log")).status).toBe(200);
+  });
+  test("GET /api/networks/:id of a network the token is not bound to", async () => {
+    expect((await call(ntok, "GET", `/api/networks/${OTHER_NET}`)).status).toBe(403);
+    expect((await call(ntok, "GET", `/api/networks/${NET}`)).status).toBe(200);
+  });
+  test("GET /api/stats/sse is limited to the bound network", async () => {
+    const ctrl = new AbortController();
+    const sub = await fetch(`${BASE}/events/some-agent?network_id=${OTHER_NET}`, { headers: auth(adminToken), signal: ctrl.signal }).catch(() => null);
+    const r = await call(ntok, "GET", "/api/stats/sse");
+    ctrl.abort();
+    expect(r.status).toBe(200);
+    expect(Object.keys(r.body.sessions).every((k) => k.split(":").includes(NET))).toBe(true);
+    expect(JSON.stringify(r.body)).not.toContain(OTHER_NET);
+    void sub;
+  });
+  test("POST /api/admin/users and agent-grants", async () => {
+    expect((await call(ntok, "POST", "/api/admin/users", { username: "ntok_made", password: PW })).status).toBe(403);
+    expect((await call(ntok, "GET", `/api/networks/${NET}/members/${adminId}/agent-grants`)).status).toBe(403);
+  });
+});
+
+describe("account and network management need a user token", () => {
+  test("token management: cannot list, mint user tokens, mint node tokens or revoke", async () => {
+    expect((await call(ntok, "GET", "/api/auth/tokens")).status).toBe(403);
+    const minted = await call(ntok, "POST", "/api/auth/tokens", { name: "escalate" });
+    expect(minted.status).toBe(403);
+    expect(minted.body.token).toBeUndefined();
+    expect((await call(ntok, "POST", "/api/auth/node-token", { network_id: OTHER_NET, node_name: "x" })).status).toBe(403);
+    expect((await call(ntok, "DELETE", "/api/auth/tokens/tok_whatever")).status).toBe(403);
+    expect((await call(adminToken, "GET", "/api/auth/tokens")).status).toBe(200);
+  });
+  test("cannot edit the owner's profile or password", async () => {
+    expect((await call(ntok, "PUT", "/api/auth/me", { display_name: "pwned" })).status).toBe(403);
+    expect(db.get<{ display_name: string }>("SELECT display_name FROM users WHERE user_id = ?1", adminId)?.display_name).not.toBe("pwned");
+    expect((await call(ntok, "POST", "/api/auth/password", { old_password: PW, new_password: "AnotherPassw0rd!" })).status).toBe(403);
+  });
+  test("cannot create, rename or delete networks", async () => {
+    expect((await call(ntok, "POST", "/api/networks", { name: "ntok-made" })).status).toBe(403);
+    expect((await call(ntok, "PUT", `/api/networks/${OTHER_NET}`, { name: "renamed" })).status).toBe(403);
+    expect((await call(ntok, "DELETE", `/api/networks/${OTHER_NET}`)).status).toBe(403);
+    expect(db.get("SELECT 1 FROM networks WHERE network_id = ?1", OTHER_NET)).toBeTruthy();
+  });
+  test("cannot manage members, invites or join", async () => {
+    expect((await call(ntok, "GET", `/api/networks/${NET}/members`)).status).toBe(403);
+    expect((await call(ntok, "POST", `/api/networks/${NET}/members`, { user_id: "u_x" })).status).toBe(403);
+    expect((await call(ntok, "POST", `/api/networks/${NET}/invite`, { role: "admin" })).status).toBe(403);
+    expect((await call(ntok, "POST", "/api/networks/join", { invite_code: "inv_x" })).status).toBe(403);
+    expect((await call(adminToken, "GET", `/api/networks/${NET}/members`)).status).toBe(200);
+  });
+  test("renames: a node token may only rename ITSELF in its bound network", async () => {
+    // 别的网络 / 别的节点 → user_token_required
+    expect((await call(ntok, "POST", "/api/node-rename/prepare", { network_id: OTHER_NET, old_alias: "ntok-node", new_alias: "b" })).status).toBe(403);
+    db.run(`INSERT INTO sessions (resume_id, alias, status, network_id) VALUES ('r_other_node', 'other-node', 'idle', ?1)`, [NET]);
+    expect((await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "other-node", new_alias: "b" })).status).toBe(403);
+    // 另一个节点(管理员用户令牌)开的事务,本节点不能提交
+    const foreign = await call(adminToken, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "other-node", new_alias: "other-node-2" });
+    expect(foreign.body.ok).toBe(true);
+    expect((await call(ntok, "POST", "/api/node-rename/commit", { txn_id: foreign.body.txn_id })).status).toBe(403);
+    expect((await call(adminToken, "POST", "/api/node-rename/abort", { txn_id: foreign.body.txn_id })).body.ok).toBe(true);
+    // 自己:照常(anet node rename 就是这么用的)
+    db.run(`INSERT INTO sessions (resume_id, alias, status, network_id) VALUES ('r_self_node', 'ntok-node', 'idle', ?1)`, [NET]);
+    const mine = await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "ntok-node", new_alias: "ntok-node-2" });
+    expect(mine.body.ok).toBe(true);
+    expect((await call(ntok, "POST", "/api/node-rename/abort", { txn_id: mine.body.txn_id })).body.ok).toBe(true);
+  });
+});
+
+describe("/api/auth/me says what the credential is", () => {
+  test("node token: owner user for compatibility, but credential.kind=node and only the bound network", async () => {
+    const r = await call(ntok, "GET", "/api/auth/me");
+    expect(r.status).toBe(200);
+    expect(r.body.credential).toMatchObject({ kind: "node", network_id: NET, node_alias: "ntok-node", acts_as_owner: false });
+    expect(r.body.current_network).toBe(NET);
+    expect(r.body.networks.map((n: any) => n.network_id)).toEqual([NET]);
+    const u = await call(adminToken, "GET", "/api/auth/me");
+    expect(u.body.credential).toEqual({ kind: "user" });
+    expect(u.body.networks.map((n: any) => n.network_id).sort()).toEqual([NET, OTHER_NET].sort());
+  });
+  test("node token keeps its own network powers (still a member): status and tasks read fine", async () => {
+    expect((await call(ntok, "GET", "/api/status")).status).toBe(200);
+    expect((await call(ntok, "GET", "/api/tasks")).status).toBe(200);
+  });
+});