@sleep2agi/commhub-server 0.9.0-preview.7 → 0.9.0-preview.71

package/src/send-dedup-request-id.test.ts

@@ -0,0 +1,229 @@
+// Handler-level regression for the #212 dedup window swallowing human chat
+// messages (see send_dedup.ts header, "Key selection").
+//
+// Before the fix, POST /api/task keyed the dedup window on
+// (from, to, sha256(content)) only and ignored meta.client_request_id, so a
+// user sending the same short text twice within 5 minutes got 200/429/429 and
+// ONE stored row — and the app maps that 429 to "delivered". The table below
+// is the repro, run against both transports:
+//
+//   case                              | before (REST) | after
+//   ----------------------------------+---------------+-------------------------
+//   same text, 3 different ids        | 1 row         | 3 rows, 3 x ok
+//   same text, same id (retry)        | 1 row         | 1 row, 2 x replay (same id)
+//   different text, same id           | 3 rows        | 1 row, 2 x idempotency_conflict
+//   same text, no id (#212 agents)    | 1 row         | 1 row, 2 x duplicate_send
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { sharedSendDedup } from "./send_dedup.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-send-dedup-rid-"));
+const TARGET = `dedup-rid-target-${process.pid}`;
+const TARGET_NODE_ID = `node_dedup_rid_${process.pid}`;
+
+let server: any;
+let base = "";
+let userToken = "";
+let restNet = "";
+let restUser = "";
+
+const MCP_NET = `net_dedup_rid_${process.pid}`;
+const MCP_USER = `user_dedup_rid_${process.pid}`;
+
+function rid(n: number): string {
+  // App shape: dreq_ + 32 lowercase hex.
+  return `dreq_${n.toString(16).padStart(32, "0")}`;
+}
+
+function seedTarget(networkId: string, suffix: string) {
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [`resume_${TARGET_NODE_ID}_${suffix}`, TARGET, `${TARGET_NODE_ID}_${suffix}`, networkId],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'), 'active')`,
+    [`${TARGET_NODE_ID}_${suffix}`, TARGET, networkId],
+  );
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
+  restUser = `dedup_rid_${Date.now()}`;
+  const registered = register(restUser, "DedupRid123!", undefined, "seed");
+  expect(registered.ok).toBe(true);
+  userToken = registered.token!;
+  restNet = registered.network_id!;
+  seedTarget(restNet, "rest");
+
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'user', datetime('now'))", [MCP_USER]);
+  db.run("INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))", [MCP_NET, MCP_USER]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [MCP_USER, MCP_NET]);
+  seedTarget(MCP_NET, "mcp");
+
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+beforeEach(() => {
+  for (const net of [restNet, MCP_NET]) {
+    if (!net) continue;
+    for (const table of ["tasks", "inbox", "task_events"]) {
+      try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [net]); } catch {}
+    }
+  }
+  sharedSendDedup.clear();
+});
+
+function rowCount(networkId: string): number {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM tasks WHERE network_id = ?1", [networkId])!.n;
+}
+function inboxCount(networkId: string): number {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM inbox WHERE network_id = ?1", [networkId])!.n;
+}
+
+// ── REST ────────────────────────────────────────────────────────────────
+
+async function rest(task: string, requestId?: string): Promise<{ status: number; body: any }> {
+  const res = await fetch(`${base}/api/task`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${userToken}`, "Content-Type": "application/json" },
+    body: JSON.stringify({
+      alias: TARGET,
+      task,
+      priority: "normal",
+      network_id: restNet,
+      from: restUser,
+      meta: requestId
+        ? { source: "dashboard-chat", client_request_id: requestId }
+        : { source: "dashboard-chat" },
+    }),
+  });
+  return { status: res.status, body: await res.json() };
+}
+
+describe("POST /api/task dedup key selection", () => {
+  test("same text with 3 different request ids -> 3 rows (the reported data loss)", async () => {
+    const results = [await rest("好", rid(1)), await rest("好", rid(2)), await rest("好", rid(3))];
+    expect(results.map((r) => r.status)).toEqual([200, 200, 200]);
+    const ids = results.map((r) => r.body.task_id);
+    expect(new Set(ids).size).toBe(3);
+    expect(rowCount(restNet)).toBe(3);
+    expect(inboxCount(restNet)).toBe(3);
+  });
+
+  test("same text with the same request id -> 1 row, retries replay the same task id", async () => {
+    const first = await rest("好", rid(7));
+    const second = await rest("好", rid(7));
+    const third = await rest("好", rid(7));
+    expect(first.status).toBe(200);
+    expect(second.status).toBe(200);
+    expect(third.status).toBe(200);
+    expect(second.body).toMatchObject({ ok: true, task_id: first.body.task_id, message_id: first.body.task_id, idempotent_replay: true });
+    expect(third.body.task_id).toBe(first.body.task_id);
+    expect(rowCount(restNet)).toBe(1);
+    expect(inboxCount(restNet)).toBe(1);
+  });
+
+  test("different text with the same request id -> 1 row, reuse fails closed (409)", async () => {
+    const first = await rest("第一条", rid(9));
+    const second = await rest("第二条", rid(9));
+    const third = await rest("第三条", rid(9));
+    expect(first.status).toBe(200);
+    expect(second.status).toBe(409);
+    expect(second.body.error).toBe("idempotency_conflict");
+    expect(third.status).toBe(409);
+    expect(rowCount(restNet)).toBe(1);
+  });
+
+  test("#212 guard: same text WITHOUT a request id is still deduped (429 duplicate_send)", async () => {
+    const results = [await rest("继续"), await rest("继续"), await rest("继续")];
+    expect(results.map((r) => r.status)).toEqual([200, 429, 429]);
+    expect(results[1].body.error).toBe("duplicate_send");
+    expect(rowCount(restNet)).toBe(1);
+  });
+
+  test("no request id, different text -> each goes through", async () => {
+    const results = [await rest("a"), await rest("b"), await rest("c")];
+    expect(results.map((r) => r.status)).toEqual([200, 200, 200]);
+    expect(rowCount(restNet)).toBe(3);
+  });
+});
+
+// ── MCP send_task ──────────────────────────────────────────────────────
+
+type ToolHandler = (args: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function mcpSendTask(): ToolHandler {
+  const mcp = new McpServer({ name: "dedup-rid-test", version: "0" }) as any;
+  let handler: ToolHandler | undefined;
+  const original = mcp.tool.bind(mcp);
+  mcp.tool = (name: string, description: string, schema: any, candidate: ToolHandler) => {
+    if (name === "send_task") handler = candidate;
+    return original(name, description, schema, candidate);
+  };
+  registerTools(mcp, undefined, MCP_NET, MCP_USER, MCP_USER, false, null);
+  if (!handler) throw new Error("send_task handler missing");
+  return handler;
+}
+
+async function mcp(handler: ToolHandler, task: string, requestId?: string): Promise<any> {
+  const result = await handler({
+    alias: TARGET,
+    task,
+    priority: "normal",
+    ...(requestId ? { meta: { source: "dashboard-chat", client_request_id: requestId } } : {}),
+  });
+  return JSON.parse(result.content[0].text);
+}
+
+describe("MCP send_task dedup key selection", () => {
+  test("same text with 3 different request ids -> 3 rows", async () => {
+    const h = mcpSendTask();
+    const results = [await mcp(h, "好", rid(11)), await mcp(h, "好", rid(12)), await mcp(h, "好", rid(13))];
+    expect(results.map((r) => r.ok)).toEqual([true, true, true]);
+    expect(new Set(results.map((r) => r.message_id)).size).toBe(3);
+    expect(rowCount(MCP_NET)).toBe(3);
+  });
+
+  test("same text with the same request id -> 1 row, replay returns the same task id", async () => {
+    const h = mcpSendTask();
+    const first = await mcp(h, "好", rid(17));
+    const second = await mcp(h, "好", rid(17));
+    const third = await mcp(h, "好", rid(17));
+    expect(first.ok).toBe(true);
+    expect(second).toMatchObject({ ok: true, task_id: first.message_id, idempotent_replay: true });
+    expect(third.task_id).toBe(first.message_id);
+    expect(rowCount(MCP_NET)).toBe(1);
+  });
+
+  test("different text with the same request id -> 1 row, idempotency_conflict", async () => {
+    const h = mcpSendTask();
+    expect((await mcp(h, "第一条", rid(19))).ok).toBe(true);
+    expect((await mcp(h, "第二条", rid(19))).error).toBe("idempotency_conflict");
+    expect((await mcp(h, "第三条", rid(19))).error).toBe("idempotency_conflict");
+    expect(rowCount(MCP_NET)).toBe(1);
+  });
+
+  test("#212 guard: same text WITHOUT a request id is still deduped", async () => {
+    const h = mcpSendTask();
+    const results = [await mcp(h, "继续"), await mcp(h, "继续"), await mcp(h, "继续")];
+    expect(results[0].ok).toBe(true);
+    expect(results[1].error).toBe("duplicate_send");
+    expect(results[2].error).toBe("duplicate_send");
+    expect(rowCount(MCP_NET)).toBe(1);
+  });
+});

package/src/send-reply-agent-warning.test.ts

@@ -0,0 +1,202 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+// #498 compatibility warning remains load-bearing during the mixed-version
+// rollout. Capability-negotiated agents use send_peer_reply; old send_reply
+// callers targeting an agent get explicit migration guidance while Dashboard
+// targets stay quiet.
+
+const NET_ID = "net_498_warn";
+const USER_ID = "u_498_warn";
+const NODE_ID = "node_498_warn";
+const AGENT_ALIAS = "peer-agent-498";
+const DISPATCHER_NODE_ID = "node_498_dispatcher";
+const DISPATCHER_ALIAS = "dispatcher";
+const AGENT_TOK_ID = "tok_498_warn";
+
+interface ToolHandler {
+  (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>;
+}
+interface Reply {
+  ok?: boolean;
+  message_id?: string;
+  session_status?: string;
+  warning?: string;
+  error?: string;
+  [k: string]: unknown;
+}
+
+function cleanup() {
+  try { db.run("DELETE FROM tasks WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM inbox WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM task_events WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM sessions WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM nodes WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET_ID]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER_ID]); } catch {}
+}
+
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed() {
+  db.run(
+    `INSERT INTO users (user_id, username, password_hash, role, created_at)
+     VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+    [USER_ID, USER_ID],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'), 'active')`,
+    [DISPATCHER_NODE_ID, DISPATCHER_ALIAS, DISPATCHER_ALIAS, NET_ID, `host-${DISPATCHER_ALIAS}`],
+  );
+  db.run(
+    `INSERT INTO networks (network_id, network_name, owner_id, created_at)
+     VALUES (?1, ?2, ?3, datetime('now'))`,
+    [NET_ID, NET_ID, USER_ID],
+  );
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [`res_${DISPATCHER_ALIAS}`, DISPATCHER_ALIAS, DISPATCHER_NODE_ID, NET_ID],
+  );
+  db.run(
+    `INSERT INTO network_members (user_id, network_id, role, joined_at)
+     VALUES (?1, ?2, 'owner', datetime('now'))`,
+    [USER_ID, NET_ID],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'), 'active')`,
+    [NODE_ID, AGENT_ALIAS, AGENT_ALIAS, NET_ID, `host-${AGENT_ALIAS}`],
+  );
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [`res_${AGENT_ALIAS}`, AGENT_ALIAS, NODE_ID, NET_ID],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [AGENT_TOK_ID, USER_ID, NET_ID, `node:${AGENT_ALIAS}`, `hash_${AGENT_TOK_ID}`],
+  );
+}
+
+function makeTask(from: string): string {
+  const id = "t_" + Math.random().toString(36).slice(2, 14);
+  db.run(
+    `INSERT INTO tasks (task_id, from_name, to_name, to_node_id, priority, status, content, requires_response, created_at, network_id)
+     VALUES (?1, ?2, ?3, ?4, 'normal', 'delivered', 'test', 'reply', datetime('now'), ?5)`,
+    [id, from, AGENT_ALIAS, NODE_ID, NET_ID],
+  );
+  return id;
+}
+
+function buildHandlers(): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, _schema: any, handler: ToolHandler) => {
+    tools[name] = handler;
+    return origTool(name, _desc, _schema, handler);
+  };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, _cfg: any, handler: ToolHandler) => {
+      tools[name] = handler;
+      return origRegisterTool(name, _cfg, handler);
+    };
+  }
+  // Bind as a network token whose caller alias is the sender.
+  registerTools(
+    server,
+    undefined,
+    /* enforceNetworkId */ NET_ID,
+    /* enforceUserId */ USER_ID,
+    /* callerAlias */ AGENT_ALIAS,
+    /* callerTokenIsNetwork */ true,
+    /* callerTokenId */ AGENT_TOK_ID,
+  );
+  return tools;
+}
+
+async function call(handler: ToolHandler, args: any): Promise<Reply> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0].text) as Reply;
+}
+
+describe("send_reply legacy/Dashboard compatibility (#698)", () => {
+  test("legacy call still closes the original and enqueues one no-response result", async () => {
+    seed();
+    const tools = buildHandlers();
+    const sendReply = tools["send_reply"];
+    expect(sendReply).toBeDefined();
+
+    const taskId = makeTask(DISPATCHER_ALIAS);
+    const reply = await call(sendReply, {
+      alias: DISPATCHER_ALIAS,
+      text: "peer reply (atomic)",
+      in_reply_to: taskId,
+      status: "replied",
+      from_session: AGENT_ALIAS,
+    });
+
+    expect(reply.ok).toBe(true);
+    expect(reply.warning).toContain("commhub_send_peer_reply");
+    expect(reply.warning).toContain("terminalized the original task");
+    expect(reply.warning).not.toContain("commhub_send_task");
+    expect(reply.warning).toContain("mixed-version");
+    expect(db.get<{ status: string; result: string }>(
+      "SELECT status, result FROM tasks WHERE task_id = ?1", taskId,
+    )).toEqual(expect.objectContaining({ status: "replied", result: "peer reply (atomic)" }));
+    expect(db.all<{ type: string; requires_response: string; session_name: string }>(
+      "SELECT type, requires_response, session_name FROM inbox WHERE in_reply_to = ?1", taskId,
+    )).toEqual([{ type: "reply", requires_response: "none", session_name: DISPATCHER_ALIAS }]);
+    expect(db.get<{ n: number }>(
+      "SELECT COUNT(*) AS n FROM tasks WHERE parent_task_id = ?1", taskId,
+    )?.n).toBe(0);
+  });
+
+  test("target alias is `hub` (Dashboard path) → NO warning field", async () => {
+    seed();
+    const tools = buildHandlers();
+    const sendReply = tools["send_reply"];
+
+    const taskId = makeTask("hub");
+    const reply = await call(sendReply, {
+      alias: "hub",
+      text: "dashboard reply",
+      in_reply_to: taskId,
+      status: "replied",
+      from_session: AGENT_ALIAS,
+    });
+
+    expect(reply.ok).toBe(true);
+    // Silence-affirms the Dashboard path. Every reply carrying a
+    // warning would train the LLM to ignore it, so absence here is
+    // load-bearing.
+    expect(reply.warning).toBeUndefined();
+  });
+
+  test("target alias is `api` (Dashboard path) → NO warning field", async () => {
+    seed();
+    const tools = buildHandlers();
+    const sendReply = tools["send_reply"];
+
+    const taskId = makeTask("api");
+    const reply = await call(sendReply, {
+      alias: "api",
+      text: "dashboard reply via api",
+      in_reply_to: taskId,
+      status: "replied",
+      from_session: AGENT_ALIAS,
+    });
+
+    expect(reply.ok).toBe(true);
+    expect(reply.warning).toBeUndefined();
+  });
+});

package/src/send-reply-alias-optional.test.ts

@@ -0,0 +1,131 @@
+// #1085 — send_reply must not require `alias` when `in_reply_to` is set.
+//
+// Symptom (deployed SDK-runtime nodes): `mcp__commhub__send_reply(task_id,
+// text)` → `-32602 Invalid input: expected string, received undefined at
+// alias`. That is the HUB's Zod schema rejecting a required `alias` the
+// client never sent — the request dies before the handler runs, so the
+// original task is never terminalized and its inbox row stays unacked
+// (pending inflation).
+//
+// Fix (two parts, both in tools.ts):
+//   1. `replyToolSchema.alias` → optional (stops the MCP-layer Zod -32602).
+//   2. `handleReply` derives the target from the in_reply_to task's
+//      `from_name` when alias is omitted — the target was always knowable
+//      from the task the hub already looks up, so the param was redundant.
+//
+// This suite drives the registered handler directly (MCP Zod layer is
+// exercised separately by the framework), so it pins part (2): omit alias
+// → derive → reply lands on the original sender; omit both → clean error.
+//
+// 改坏报红 gate: revert the derive block (require alias again) and
+// "alias omitted → derives to original sender" flips to a resolve failure.
+
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+const NET_ID = "net_1085";
+const USER_ID = "u_1085";
+const NODE_ID = "node_1085";
+const AGENT_ALIAS = "worker-1085";
+const ORIGIN_ALIAS = "boss-1085"; // the task's from_name — the derive target
+const AGENT_TOK_ID = "tok_1085";
+
+interface ToolHandler {
+  (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>;
+}
+interface Reply { ok?: boolean; message_id?: string; error?: string; message?: string; [k: string]: unknown; }
+
+function cleanup() {
+  for (const t of ["tasks", "inbox", "task_events", "sessions", "nodes", "api_tokens", "network_members", "networks"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET_ID]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER_ID]); } catch {}
+}
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed(): { taskId: string } {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [USER_ID, USER_ID]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET_ID, NET_ID, USER_ID]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [USER_ID, NET_ID]);
+  db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, hostname, created_at, updated_at, lifecycle_state) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'), 'active')`, [NODE_ID, AGENT_ALIAS, AGENT_ALIAS, NET_ID, `host-${AGENT_ALIAS}`]);
+  db.run(`INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at) VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`, [`res_${AGENT_ALIAS}`, AGENT_ALIAS, NODE_ID, NET_ID]);
+  // The reply TARGET session (the task originator). Its alias is what the
+  // handler must derive from the task's from_name.
+  db.run(`INSERT INTO sessions (resume_id, alias, status, network_id, updated_at, last_seen_at) VALUES (?1, ?2, 'idle', ?3, datetime('now'), datetime('now'))`, [`res_${ORIGIN_ALIAS}`, ORIGIN_ALIAS, NET_ID]);
+  // A task from ORIGIN_ALIAS → the worker. Replying to it should land on
+  // ORIGIN_ALIAS even when the caller omits alias.
+  const taskId = `task_1085_${Date.now()}${Math.floor(Math.random() * 1000)}`;
+  db.run(`INSERT INTO tasks (task_id, from_name, to_name, status, content, requires_response, created_at, delivered_at, expires_at, network_id, priority) VALUES (?1, ?2, ?3, 'delivered', 'do the thing', 'reply', datetime('now'), datetime('now'), datetime('now', '+1 hour'), ?4, 'normal')`, [taskId, ORIGIN_ALIAS, AGENT_ALIAS, NET_ID]);
+  return { taskId };
+}
+
+async function getHandler(): Promise<ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" });
+  const tools: Record<string, ToolHandler> = {};
+  const originalTool = (server as any).tool.bind(server);
+  (server as any).tool = (name: string, ...rest: any[]) => {
+    const handler = rest[rest.length - 1];
+    if (typeof handler === "function") tools[name] = handler;
+    return originalTool(name, ...rest);
+  };
+  registerTools(server, {
+    enforceNetworkId: NET_ID,
+    enforceUserId: USER_ID,
+    callerAlias: AGENT_ALIAS,
+    callerTokenIsNetwork: true,
+    callerTokenId: AGENT_TOK_ID,
+  } as any);
+  const handler = tools.send_reply;
+  if (!handler) throw new Error("send_reply handler not registered");
+  return handler;
+}
+
+async function call(h: ToolHandler, args: any): Promise<Reply> {
+  return JSON.parse((await h(args)).content[0].text) as Reply;
+}
+
+describe("#1085 send_reply — alias optional, derived from in_reply_to", () => {
+  test("alias OMITTED + in_reply_to set → derives target from task from_name, reply lands on originator", async () => {
+    const { taskId } = seed();
+    const h = await getHandler();
+    const r = await call(h, { in_reply_to: taskId, text: "done", status: "replied", from_session: AGENT_ALIAS });
+    expect(r.ok).toBe(true);
+    // The reply inbox row must be addressed to the derived originator.
+    const row = db.get<{ session_name: string; in_reply_to: string }>(
+      "SELECT session_name, in_reply_to FROM inbox WHERE id = ?1", [r.message_id],
+    );
+    expect(row?.session_name).toBe(ORIGIN_ALIAS);
+    expect(row?.in_reply_to).toBe(taskId);
+    // And the original task is terminalized (no longer pending).
+    const task = db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = ?1", [taskId]);
+    expect(task?.status).toBe("replied");
+  });
+
+  test("alias EXPLICIT still works (unchanged path)", async () => {
+    const { taskId } = seed();
+    const h = await getHandler();
+    const r = await call(h, { alias: ORIGIN_ALIAS, in_reply_to: taskId, text: "done", from_session: AGENT_ALIAS });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ session_name: string }>("SELECT session_name FROM inbox WHERE id = ?1", [r.message_id]);
+    expect(row?.session_name).toBe(ORIGIN_ALIAS);
+  });
+
+  test("alias OMITTED + no in_reply_to → clean error, not a crash", async () => {
+    seed();
+    const h = await getHandler();
+    const r = await call(h, { text: "orphan reply", from_session: AGENT_ALIAS });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("reply_target_required");
+  });
+
+  test("alias OMITTED + in_reply_to points at nonexistent task → resolve error", async () => {
+    seed();
+    const h = await getHandler();
+    const r = await call(h, { in_reply_to: "task_does_not_exist_1085", text: "x", from_session: AGENT_ALIAS });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("reply_target_unresolved");
+  });
+});