@sleep2agi/commhub-server 0.9.0-preview.71 → 0.9.0-preview.73

package/src/commhub-bin-args.test.ts

@@ -0,0 +1,85 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// commhub-server must refuse what it does not understand instead of starting a
+// Hub on the defaults (the live ~/.commhub/commhub.db). Every child gets a
+// throwaway HOME and a throwaway PORT, so even a regression binds nothing real.
+const BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "commhub.ts");
+const PKG_VERSION = JSON.parse(readFileSync(join(dirname(BIN), "..", "package.json"), "utf8")).version as string;
+const home = mkdtempSync(join(tmpdir(), "anet-bin-args-"));
+const PORT = String(26000 + Math.floor(Math.random() * 3000));
+
+afterAll(() => rmSync(home, { recursive: true, force: true }));
+
+function run(args: string[], extraEnv: Record<string, string> = {}, timeoutMs = 15_000) {
+  const proc = Bun.spawnSync(["bun", BIN, ...args], {
+    env: { PATH: process.env.PATH ?? "", HOME: home, PORT, HOST: "127.0.0.1", ...extraEnv },
+    stdout: "pipe", stderr: "pipe", timeout: timeoutMs,
+  });
+  return { code: proc.exitCode, stdout: proc.stdout.toString(), stderr: proc.stderr.toString() };
+}
+
+async function listening(port: string): Promise<boolean> {
+  try { await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(500) }); return true; } catch { return false; }
+}
+
+describe("commhub-server argument handling", () => {
+  for (const [args, message] of [
+    [["bogus"], "unknown command bogus"],
+    [["--port=29999"], "unknown option --port=29999"],
+    [["--bogus-flag"], "unknown option --bogus-flag"],
+    [["--port"], "--port needs a value"],
+    [["--db", "--dev-open"], "--db needs a value"],
+  ] as const) {
+    test(`${args.join(" ")} → exit 2, no database, nothing listening`, async () => {
+      const r = run([...args]);
+      expect(r.code).toBe(2);
+      expect(r.stderr).toContain(message);
+      expect(r.stderr).toContain("commhub-server --help");
+      expect(existsSync(join(home, ".commhub"))).toBe(false);
+      expect(await listening(PORT)).toBe(false);
+    });
+  }
+
+  test("migrate-to-pg with missing or unknown arguments exits 2 and starts nothing", async () => {
+    const missing = run(["migrate-to-pg", "--from", "/x.db"]);
+    expect(missing.code).toBe(2);
+    expect(missing.stdout).toContain("commhub-server migrate-to-pg --from <sqlite file> --to <postgres url>");
+    const unknown = run(["migrate-to-pg", "--from", "/x.db", "--to", "postgres://u@127.0.0.1/anet_x_test", "--bogus"]);
+    expect(unknown.code).toBe(2);
+    expect(unknown.stderr).toContain("unknown argument --bogus");
+    expect(existsSync(join(home, ".commhub"))).toBe(false);
+    expect(await listening(PORT)).toBe(false);
+  });
+
+  test("--help and --version exit 0 without starting", async () => {
+    const help = run(["--help"]);
+    expect(help.code).toBe(0);
+    expect(help.stdout).toContain("--port, -p <port>");
+    const version = run(["--version"]);
+    expect(version.code).toBe(0);
+    expect(version.stdout.trim()).toBe(PKG_VERSION);
+    expect(existsSync(join(home, ".commhub"))).toBe(false);
+  });
+
+  test("the known forms still start a Hub", async () => {
+    const db = join(home, "known.db");
+    const port = String(Number(PORT) + 1);
+    const child = Bun.spawn(["bun", BIN, "--port", port, "--host", "127.0.0.1", "--db", db, "--dev-open"], {
+      env: { PATH: process.env.PATH ?? "", HOME: home }, stdout: "pipe", stderr: "pipe",
+    });
+    try {
+      let up = false;
+      for (let i = 0; i < 100 && !up; i++) { up = await listening(port); if (!up) await Bun.sleep(100); }
+      expect(up).toBe(true);
+      expect(existsSync(db)).toBe(true);
+      expect(existsSync(join(home, ".commhub", "commhub.db"))).toBe(false);
+    } finally {
+      child.kill();
+      await child.exited;
+    }
+  }, 30_000);
+});

package/src/db-adapter-guard.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import {
   assertSafeTestDatabaseEnv,
+  redactPgUrl,
   resolveDatabaseTarget,
 } from "./db-adapter";
 
@@ -83,3 +84,65 @@ describe("#435 inherited DATABASE_URL guard", () => {
     }
   });
 });
+
+describe("RFC-039 §9 COMMHUB_TEST_PG_URL (test-only PostgreSQL)", () => {
+  const TEST = { ...BASE_ENV, NODE_ENV: "test" };
+  const ok = (url: string) => expect(resolveDatabaseTarget({ ...TEST, COMMHUB_TEST_PG_URL: url })).toEqual({ kind: "postgres", url });
+  const refused = (url: string, why: RegExp) => {
+    let message = "";
+    try { resolveDatabaseTarget({ ...TEST, COMMHUB_TEST_PG_URL: url }); } catch (e: any) { message = String(e?.message ?? e); }
+    expect(message).toMatch(/REFUSING COMMHUB_TEST_PG_URL/);
+    expect(message).toMatch(why);
+    // Credentials never reach an error message.
+    expect(message).not.toContain("s3cret");
+    expect(message).not.toContain("tester");
+  };
+
+  test("loopback host + anet_*_test database is accepted under NODE_ENV=test", () => {
+    ok("postgres://tester:s3cret@127.0.0.1:5432/anet_sched_test");
+    ok("postgresql://tester:s3cret@localhost/anet_side_thread_test");
+    ok("postgres://tester:s3cret@[::1]:6543/anet_x_test?connect_timeout=2&sslmode=disable");
+  });
+
+  test("ignored outside NODE_ENV=test", () => {
+    expect(resolveDatabaseTarget({ ...BASE_ENV, NODE_ENV: "production", COMMHUB_DB: "/tmp/i.db", COMMHUB_TEST_PG_URL: "postgres://tester:s3cret@127.0.0.1/anet_x_test" }))
+      .toEqual({ kind: "sqlite", path: "/tmp/i.db" });
+  });
+
+  test("inherited DATABASE_URL still refuses even when COMMHUB_TEST_PG_URL is set", () => {
+    expect(() => resolveDatabaseTarget({
+      ...TEST,
+      DATABASE_URL: "postgres://user:pw@prod.example:5432/commhub",
+      COMMHUB_TEST_PG_URL: "postgres://tester:s3cret@127.0.0.1/anet_x_test",
+    })).toThrow(/REFUSING to honor inherited DATABASE_URL/);
+  });
+
+  test("refuses a value that is not a URL or not postgres", () => {
+    refused("not a url", /not a URL/);
+    refused("mysql://tester:s3cret@127.0.0.1/anet_x_test", /scheme/);
+  });
+
+  test("refuses every host that is not literally loopback", () => {
+    for (const host of ["10.0.0.5", "db.internal", "localhost.evil.example", "127.0.0.2", "127.0.0.1,evil.example", "LOCALHOST", "%2Ftmp"]) {
+      refused(`postgres://tester:s3cret@${host}/anet_x_test`, /host must be/);
+    }
+  });
+
+  test("refuses database names outside /^anet_[a-z0-9_]*_test$/", () => {
+    for (const name of ["commhub", "anet_x", "anet_x_test2", "ANET_X_TEST", "anet-x_test", "anet_x_test/extra", ""]) {
+      refused(`postgres://tester:s3cret@127.0.0.1/${name}`, /database name/);
+    }
+  });
+
+  test("refuses connection-steering query parameters", () => {
+    refused("postgres://tester:s3cret@127.0.0.1/anet_x_test?host=db.internal", /"host" is not allowed/);
+    refused("postgres://tester:s3cret@127.0.0.1/anet_x_test?options=-csearch_path%3Dprod", /"options" is not allowed/);
+  });
+
+  test("redactPgUrl drops user and password", () => {
+    const out = redactPgUrl("postgres://tester:s3cret@127.0.0.1:5432/anet_x_test");
+    expect(out).not.toContain("tester");
+    expect(out).not.toContain("s3cret");
+    expect(out).toContain("127.0.0.1:5432/anet_x_test");
+  });
+});

package/src/db-adapter-translate.test.ts

@@ -15,6 +15,12 @@ describe("RFC-039 S2a sqliteToPostgres", () => {
     expect(out).not.toContain("TIMESTAMP");
   });
 
+  test("strftime with milliseconds keeps SQLite's %f shape", () => {
+    expect(sqliteToPostgres("VALUES (strftime('%Y-%m-%d %H:%M:%f', 'now'))")).toBe(
+      "VALUES (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD HH24:MI:SS.MS'))",
+    );
+  });
+
   test("literal offset", () => {
     expect(sqliteToPostgres("x < datetime('now', '+14 days')")).toBe(
       "x < to_char((NOW() + INTERVAL '14 days') AT TIME ZONE 'UTC', 'YYYY-MM-DD HH24:MI:SS')",
@@ -27,6 +33,16 @@ describe("RFC-039 S2a sqliteToPostgres", () => {
     );
   });
 
+  test("INTEGER → BIGINT (epoch-ms columns), identifiers containing integer untouched", () => {
+    expect(sqliteToPostgres("created_at INTEGER NOT NULL, integer_ref TEXT")).toBe("created_at BIGINT NOT NULL, integer_ref TEXT");
+    expect(sqliteToPostgres("CAST(x AS INTEGER)")).toBe("CAST(x AS BIGINT)");
+  });
+
+  test("REAL → DOUBLE PRECISION (SQLite REAL is 8-byte), identifiers containing real untouched", () => {
+    expect(sqliteToPostgres("mem_used_gb REAL, realm TEXT")).toBe("mem_used_gb DOUBLE PRECISION, realm TEXT");
+    expect(sqliteToPostgres("CAST(x AS REAL)")).toBe("CAST(x AS DOUBLE PRECISION)");
+  });
+
   test("BLOB → BYTEA, identifiers containing blob untouched", () => {
     expect(sqliteToPostgres("iv BLOB NOT NULL, blob_ref TEXT")).toBe("iv BYTEA NOT NULL, blob_ref TEXT");
   });
@@ -34,7 +50,7 @@ describe("RFC-039 S2a sqliteToPostgres", () => {
   test("placeholders and AUTOINCREMENT unchanged in behaviour", () => {
     expect(sqliteToPostgres("SELECT * FROM t WHERE a = ?1 AND b = ?2")).toBe("SELECT * FROM t WHERE a = $1 AND b = $2");
     expect(sqliteToPostgres("a = ? AND b = ?")).toBe("a = $1 AND b = $2");
-    expect(sqliteToPostgres("id INTEGER PRIMARY KEY AUTOINCREMENT")).toBe("id SERIAL PRIMARY KEY");
+    expect(sqliteToPostgres("id INTEGER PRIMARY KEY AUTOINCREMENT")).toBe("id BIGSERIAL PRIMARY KEY");
   });
 });
 

package/src/db-adapter.ts

@@ -10,7 +10,7 @@
  *   - datetime('now'[, offset])  →  to_char(... AT TIME ZONE 'UTC', 'YYYY-MM-DD HH24:MI:SS')
  *     (timestamps stay TEXT on both backends, RFC-039 §4.1)
  *   - BLOB  →  BYTEA
- *   - INTEGER PRIMARY KEY AUTOINCREMENT  →  SERIAL PRIMARY KEY
+ *   - INTEGER PRIMARY KEY AUTOINCREMENT  →  BIGSERIAL PRIMARY KEY; INTEGER  →  BIGINT
  *   - ON CONFLICT(col) DO UPDATE SET  →  ON CONFLICT(col) DO UPDATE SET  (same syntax)
  */
 
@@ -90,6 +90,17 @@ export class SQLiteAdapter implements DbAdapter {
   }
 
   close(): void {
+    // #2151: once more than 20 distinct SQL strings have gone through query(),
+    // bun:sqlite's close() can no longer really close the connection (measured:
+    // close(true) reports "database is locked"), so SQLite never checkpoints and
+    // a cleanly stopped Hub left its latest writes in -wal. Checkpoint first,
+    // so the .db file alone is complete after a clean stop.
+    try {
+      const r = this.rawDb.query<{ busy: number; log: number; checkpointed: number }, []>("PRAGMA wal_checkpoint(TRUNCATE)").get();
+      if (r && r.busy !== 0) console.warn(`[commhub] WAL checkpoint on close was busy: ${JSON.stringify(r)}`);
+    } catch (e) {
+      console.warn(`[commhub] WAL checkpoint on close failed: ${(e as Error)?.message ?? e}`);
+    }
     this.rawDb.close();
   }
 }
@@ -125,6 +136,9 @@ export function sqliteToPostgres(sql: string): string {
   });
   // datetime('now') → UTC text of NOW()
   s = s.replace(/datetime\s*\(\s*'now'\s*\)/gi, pgUtcText("NOW()"));
+  // strftime('%Y-%m-%d %H:%M:%f', 'now') → the same text with milliseconds
+  s = s.replace(/strftime\s*\(\s*'%Y-%m-%d %H:%M:%f'\s*,\s*'now'\s*\)/gi,
+    "to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD HH24:MI:SS.MS')");
   // ── Parameter placeholders ──
   // ?1, ?2 → $1, $2  (positional params)
   s = s.replace(/\?(\d+)/g, (_, n) => `$${n}`);
@@ -132,8 +146,14 @@ export function sqliteToPostgres(sql: string): string {
   let idx = 0;
   s = s.replace(/\?(?!\d)/g, () => `$${++idx}`);
   // ── DDL translations ──
-  // INTEGER PRIMARY KEY AUTOINCREMENT → SERIAL PRIMARY KEY
-  s = s.replace(/INTEGER\s+PRIMARY\s+KEY\s+AUTOINCREMENT/gi, "SERIAL PRIMARY KEY");
+  // INTEGER PRIMARY KEY AUTOINCREMENT → BIGSERIAL PRIMARY KEY
+  s = s.replace(/INTEGER\s+PRIMARY\s+KEY\s+AUTOINCREMENT/gi, "BIGSERIAL PRIMARY KEY");
+  // INTEGER → BIGINT: SQLite integers are 64-bit, and the Hub stores epoch
+  // milliseconds in INTEGER columns (a 32-bit PG integer overflows).
+  s = s.replace(/\bINTEGER\b/gi, "BIGINT");
+  // REAL → DOUBLE PRECISION: SQLite REAL is 8-byte; PostgreSQL REAL is 4-byte
+  // and would silently round telemetry and scores.
+  s = s.replace(/\bREAL\b/gi, "DOUBLE PRECISION");
   // BLOB → BYTEA
   s = s.replace(/\bBLOB\b/gi, "BYTEA");
   return s;
@@ -278,13 +298,19 @@ export class PgAdapter implements DbAdapter {
     return { changes: result.count };
   }
 
+  /** bun:sqlite also accepts get(sql, [a, b]); a lone array argument is the parameter list. */
+  private static bindArgs(params: any[]): any[] | undefined {
+    if (params.length === 1 && Array.isArray(params[0])) return params[0];
+    return params.length > 0 ? params : undefined;
+  }
+
   get<T = any>(sql: string, ...params: any[]): T | null {
-    const result = this.querySync(sql, params.length > 0 ? params : undefined);
+    const result = this.querySync(sql, PgAdapter.bindArgs(params));
     return (result.rows?.[0] as T) ?? null;
   }
 
   all<T = any>(sql: string, ...params: any[]): T[] {
-    const result = this.querySync(sql, params.length > 0 ? params : undefined);
+    const result = this.querySync(sql, PgAdapter.bindArgs(params));
     return (result.rows as T[]) ?? [];
   }
 
@@ -373,7 +399,54 @@ export function assertSafeTestDatabaseEnv(env: NodeJS.ProcessEnv = process.env):
  * explicit COMMHUB_DB (or a reviewed PostgreSQL DATABASE_URL), so forgetting
  * one fails before mkdir/open/write instead of touching the live Hub.
  */
+/**
+ * RFC-039 §9 — the one reviewed way a `bun test` process may use PostgreSQL.
+ *
+ * The inherited-DATABASE_URL guard stays absolute. A test that means to run
+ * on PostgreSQL names a *different* variable, COMMHUB_TEST_PG_URL, which is
+ * honoured only under NODE_ENV=test and only for a literal loopback host and
+ * a database called `anet_…_test`, so it cannot reach a real Hub database by
+ * accident. Error messages never carry credentials.
+ */
+export const TEST_PG_URL_ENV = "COMMHUB_TEST_PG_URL";
+const TEST_PG_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
+const TEST_PG_DB_RE = /^anet_[a-z0-9_]*_test$/;
+const TEST_PG_QUERY_KEYS = new Set(["connect_timeout", "sslmode", "application_name"]);
+
+/** A PostgreSQL URL with user and password replaced, safe to print. */
+export function redactPgUrl(raw: string): string {
+  try {
+    const u = new URL(raw);
+    if (u.username || u.password) { u.username = "***"; u.password = ""; }
+    return u.toString();
+  } catch {
+    return "<unparseable URL>";
+  }
+}
+
+export function validateTestPgUrl(raw: string): string {
+  const refuse = (why: string) => new Error(
+    `[commhub] REFUSING ${TEST_PG_URL_ENV}=${redactPgUrl(raw)}: ${why}.\n` +
+    "  It is test-only: postgres(ql)://<user>:<password>@127.0.0.1|localhost|[::1][:port]/anet_<name>_test",
+  );
+  let u: URL;
+  try { u = new URL(raw); } catch { throw refuse("not a URL"); }
+  if (u.protocol !== "postgres:" && u.protocol !== "postgresql:") throw refuse("scheme must be postgres:// or postgresql://");
+  if (!TEST_PG_HOSTS.has(u.hostname)) throw refuse("host must be literally 127.0.0.1, localhost or ::1");
+  const dbName = decodeURIComponent(u.pathname.replace(/^\//, ""));
+  if (!TEST_PG_DB_RE.test(dbName)) throw refuse("database name must match /^anet_[a-z0-9_]*_test$/");
+  for (const key of u.searchParams.keys()) {
+    if (!TEST_PG_QUERY_KEYS.has(key)) throw refuse(`query parameter "${key}" is not allowed`);
+  }
+  return raw;
+}
+
 function resolveDatabaseTargetAfterGuard(env: NodeJS.ProcessEnv): DbTarget {
+  const testPgUrl = env[TEST_PG_URL_ENV];
+  if (env.NODE_ENV === "test" && testPgUrl) {
+    return { kind: "postgres", url: validateTestPgUrl(testPgUrl) };
+  }
+
   const dbUrl = env.DATABASE_URL;
   if (dbUrl && (dbUrl.startsWith("postgres://") || dbUrl.startsWith("postgresql://"))) {
     return { kind: "postgres", url: dbUrl };

package/src/db.ts

@@ -2007,7 +2007,7 @@ export function syncScheduledRunForTask(taskId: string, expectedNetworkId?: stri
     `SELECT task_id, network_id, status, completed_at
        FROM tasks
       WHERE task_id = ?1
-        AND (?2 IS NULL OR network_id = ?2)`,
+        AND (CAST(?2 AS TEXT) IS NULL OR network_id = ?2)`,
     taskId,
     expectedNetworkId ?? null,
   );
@@ -2073,3 +2073,9 @@ export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus
     );
   } catch {}
 }
+
+// RFC-039 F3: queries break created_at ties with SQLite's implicit rowid
+// (insertion order). PostgreSQL has none, so give these tables a real one.
+if (db.dialect === "postgres") {
+  for (const table of ["nodes", "user_inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
+}

package/src/member-presence-http.test.ts

@@ -0,0 +1,206 @@
+// 人员列表的在线状态 —— HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。
+//
+// GET /api/networks/:id/humans 给每个人加 online / last_seen_at(判据 = 此刻有没有活着的用户流
+// /events/users/me);用户流上推 member_presence。两个方向都测:
+//   看得到:普通成员、受限成员、viewer;连上 → online=true,断开 → online=false + last_seen_at。
+//   看不到:非成员 403;节点令牌拿到的仍是原来三个身份字段;别的网络的人收不到推送;自己收不到自己的。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db, hashToken, generateNetworkToken, generateId } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-member-presence-"));
+let BASE = "";
+let hub: any = null;
+
+const PW = "PresenceTestPassw0rd!x";
+let ownerToken = "";
+let NET = "";
+const users: Record<string, { token: string; userId: string }> = {};
+let nodeToken = "";
+
+const auth = (token: string) => ({ Authorization: `Bearer ${token}` });
+
+async function get(token: string, path: string): Promise<{ status: number; body: any }> {
+  const res = await fetch(`${BASE}${path}`, { headers: auth(token) });
+  const text = await res.text();
+  let body: any = text;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+async function post(token: string, path: string, payload: unknown): Promise<{ status: number; body: any }> {
+  const res = await fetch(`${BASE}${path}`, { method: "POST", headers: { ...auth(token), "Content-Type": "application/json" }, body: JSON.stringify(payload) });
+  const text = await res.text();
+  let body: any = text;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+async function login(username: string): Promise<{ token: string; userId: string }> {
+  const r = await post("", "/api/auth/login", { username, password: PW });
+  expect(r.status).toBe(200);
+  return { token: r.body.token, userId: r.body.user.user_id };
+}
+
+/** 一条用户流:收集 data: 帧,close() 模拟 app 退出。 */
+async function openUserStream(token: string, networkId: string) {
+  const ctrl = new AbortController();
+  const res = await fetch(`${BASE}/events/users/me?network_id=${encodeURIComponent(networkId)}`, { headers: auth(token), signal: ctrl.signal });
+  expect(res.status).toBe(200);
+  const events: any[] = [];
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let buf = "";
+  void (async () => {
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buf += decoder.decode(value);
+        let i: number;
+        while ((i = buf.indexOf("\n\n")) >= 0) {
+          const frame = buf.slice(0, i);
+          buf = buf.slice(i + 2);
+          for (const line of frame.split("\n")) if (line.startsWith("data: ")) events.push(JSON.parse(line.slice(6)));
+        }
+      }
+    } catch { /* aborted */ }
+  })();
+  await waitFor(() => events.some((e) => e.type === "connected"));
+  return { events, close: () => ctrl.abort(), presence: () => events.filter((e) => e.type === "member_presence") };
+}
+
+async function waitFor(cond: () => boolean | Promise<boolean>, ms = 3000): Promise<void> {
+  const until = Date.now() + ms;
+  while (Date.now() < until) {
+    if (await cond()) return;
+    await new Promise((r) => setTimeout(r, 20));
+  }
+  throw new Error("waitFor timed out");
+}
+
+const humanOf = async (token: string, userId: string) =>
+  (await get(token, `/api/networks/${NET}/humans`)).body.humans.find((h: any) => h.user_id === userId);
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+
+  const owner = register(`pres_owner_${Date.now()}`, PW, undefined, "Owner");
+  expect(owner.ok).toBe(true);
+  ownerToken = owner.token!;
+  NET = owner.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [owner.user!.user_id]);
+  users.owner = { token: ownerToken, userId: owner.user!.user_id };
+
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+
+  // 受限成员(默认 agent_access=granted)、viewer、普通成员;外人自己一个网络。
+  for (const [name, role] of [["pres_alpha", "member"], ["pres_beta", "member"], ["pres_gamma", "viewer"]] as const) {
+    const r = await post(ownerToken, "/api/admin/users", { username: name, password: PW, network_id: NET, role });
+    expect(r.status).toBe(200);
+    users[name] = await login(name);
+  }
+  const outsider = register(`pres_out_${Date.now()}`, PW);
+  expect(outsider.ok).toBe(true);
+  users.outsider = { token: outsider.token!, userId: outsider.user!.user_id };
+  users.outsider_net = { token: outsider.token!, userId: outsider.network_id! };
+
+  nodeToken = generateNetworkToken();
+  db.run("INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, 'pres-node', 'network')",
+    [generateId("tok"), hashToken(nodeToken), users.owner.userId, NET]);
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/networks/:id/humans — online / last_seen_at", () => {
+  test("never connected since hub start → online=false, last_seen_at=null (unknown, not 'long ago')", async () => {
+    const r = await get(users.pres_alpha.token, `/api/networks/${NET}/humans`);
+    expect(r.status).toBe(200);
+    expect(Object.keys(r.body.humans[0]).sort()).toEqual(["display_name", "last_seen_at", "online", "user_id", "username"]);
+    const beta = r.body.humans.find((h: any) => h.user_id === users.pres_beta.userId);
+    expect(beta.online).toBe(false);
+    expect(beta.last_seen_at).toBeNull();
+  });
+
+  test("user stream open → online for member, restricted member and viewer; closed → offline with last_seen_at", async () => {
+    const watcher = await openUserStream(users.pres_alpha.token, NET);
+    const before = Date.now();
+    const beta = await openUserStream(users.pres_beta.token, NET);
+
+    for (const viewer of ["pres_alpha", "pres_gamma", "owner"]) {
+      const h = await humanOf(users[viewer].token, users.pres_beta.userId);
+      expect(h.online).toBe(true);
+      expect(Date.parse(h.last_seen_at)).toBeGreaterThanOrEqual(before - 1000);
+    }
+    // 推送:alpha 收到 beta 上线;beta 收不到自己的。
+    await waitFor(() => watcher.presence().some((e) => e.member_user_id === users.pres_beta.userId && e.online === true));
+    const up = watcher.presence().find((e) => e.member_user_id === users.pres_beta.userId)!;
+    expect(up.network_id).toBe(NET);
+    expect(up.user_id).toBe(users.pres_alpha.userId); // 收件人
+    expect(beta.presence().filter((e) => e.member_user_id === users.pres_beta.userId)).toEqual([]);
+
+    beta.close();
+    await waitFor(async () => (await humanOf(users.pres_alpha.token, users.pres_beta.userId)).online === false);
+    const off = await humanOf(users.pres_gamma.token, users.pres_beta.userId);
+    expect(off.online).toBe(false);
+    expect(Date.parse(off.last_seen_at)).toBeGreaterThanOrEqual(before - 1000);
+    await waitFor(() => watcher.presence().some((e) => e.member_user_id === users.pres_beta.userId && e.online === false));
+    const down = watcher.presence().find((e) => e.member_user_id === users.pres_beta.userId && e.online === false)!;
+    expect(typeof down.last_seen_at).toBe("string");
+    watcher.close();
+  });
+
+  test("two streams for one user: closing one keeps them online, no offline event", async () => {
+    const watcher = await openUserStream(users.pres_alpha.token, NET);
+    const a = await openUserStream(users.pres_beta.token, NET);
+    const b = await openUserStream(users.pres_beta.token, NET);
+    await waitFor(() => watcher.presence().some((e) => e.member_user_id === users.pres_beta.userId && e.online));
+    a.close();
+    await new Promise((r) => setTimeout(r, 200));
+    expect((await humanOf(users.pres_alpha.token, users.pres_beta.userId)).online).toBe(true);
+    expect(watcher.presence().filter((e) => e.member_user_id === users.pres_beta.userId && !e.online)).toEqual([]);
+    b.close();
+    await waitFor(async () => (await humanOf(users.pres_alpha.token, users.pres_beta.userId)).online === false);
+    watcher.close();
+  });
+});
+
+describe("who must NOT see presence", () => {
+  test("non-member → 403, no humans at all", async () => {
+    const r = await get(users.outsider.token, `/api/networks/${NET}/humans`);
+    expect(r.status).toBe(403);
+    expect(r.body.humans).toBeUndefined();
+  });
+
+  test("node token → same three identity fields as before, no online / last_seen_at", async () => {
+    const beta = await openUserStream(users.pres_beta.token, NET);
+    const r = await get(nodeToken, `/api/networks/${NET}/humans`);
+    expect(r.status).toBe(200);
+    for (const h of r.body.humans) expect(Object.keys(h).sort()).toEqual(["display_name", "user_id", "username"]);
+    // 节点令牌也不能订阅用户流(既有行为,这里钉住:不能借它收 member_presence)。
+    expect((await fetch(`${BASE}/events/users/me?network_id=${NET}`, { headers: auth(nodeToken) })).status).toBe(403);
+    beta.close();
+    await waitFor(async () => (await humanOf(users.pres_alpha.token, users.pres_beta.userId)).online === false);
+  });
+
+  test("a user connected in another network gets no member_presence about this network's people", async () => {
+    const outsiderStream = await openUserStream(users.outsider.token, users.outsider_net.userId);
+    const watcher = await openUserStream(users.pres_alpha.token, NET);
+    const beta = await openUserStream(users.pres_beta.token, NET);
+    await waitFor(() => watcher.presence().some((e) => e.member_user_id === users.pres_beta.userId && e.online));
+    beta.close();
+    await waitFor(() => watcher.presence().some((e) => e.member_user_id === users.pres_beta.userId && !e.online));
+    expect(outsiderStream.presence()).toEqual([]);
+    watcher.close();
+    outsiderStream.close();
+  });
+});

package/src/migrate-sqlite-to-pg.test.ts

@@ -0,0 +1,47 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { MigrateRefused, migrateSqliteToPg } from "./migrate-sqlite-to-pg";
+
+// Only the refusals that happen before any connection is attempted; the full
+// copy runs against a real PostgreSQL in test2123 (migrate-stage.sh).
+const home = mkdtempSync(join(tmpdir(), "anet-migrate-home-"));
+const commhub = join(home, ".commhub");
+mkdirSync(commhub);
+writeFileSync(join(commhub, "commhub.db"), "");
+const elsewhere = join(home, "copies");
+mkdirSync(elsewhere);
+symlinkSync(join(commhub, "commhub.db"), join(elsewhere, "link.db"));
+const PG = "postgres://user:s3cret@127.0.0.1:1/anet_never_test";
+
+afterAll(() => rmSync(home, { recursive: true, force: true }));
+
+async function refusal(opts: Parameters<typeof migrateSqliteToPg>[0]): Promise<string> {
+  try {
+    await migrateSqliteToPg({ ...opts, home, log: () => {} });
+  } catch (e) {
+    expect(e).toBeInstanceOf(MigrateRefused);
+    return String((e as Error).message);
+  }
+  throw new Error("expected a refusal");
+}
+
+describe("RFC-039 S5 migrate-to-pg refusals", () => {
+  test("target must be a postgres URL", async () => {
+    expect(await refusal({ from: join(elsewhere, "x.db"), to: "mysql://h/db" })).toContain("--to must be a postgres");
+  });
+
+  test("missing source", async () => {
+    expect(await refusal({ from: join(elsewhere, "missing.db"), to: PG })).toContain("does not exist");
+  });
+
+  test("the live Hub directory ~/.commhub is refused, also through a symlink", async () => {
+    for (const from of [join(commhub, "commhub.db"), join(elsewhere, "link.db")]) {
+      const message = await refusal({ from, to: PG });
+      expect(message).toContain("live Hub's directory");
+      expect(message).toContain("--i-know-this-is-a-copy");
+      expect(message).not.toContain("s3cret");
+    }
+  });
+});