@sleep2agi/commhub-server 0.9.0-preview.72 → 0.9.0-preview.74

package/src/server.ts

@@ -10,12 +10,13 @@ import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/
 import { z } from "zod/v4";
 import { registerTools } from "./tools.js";
 import { db, logTaskEvent, logAudit, syncScheduledRunForTask } from "./db.js";
-import { createSSEStream, createNetworkObserverStream, createUserEventStream, pushEvent, pushNetworkObserverEvent, getSSEStats, PRINTABLE_OBSERVER_KEY_PREFIX, closeUserStreamsInNetwork } from "./push.js";
+import { createSSEStream, createNetworkObserverStream, createUserEventStream, pushEvent, pushNetworkObserverEvent, getSSEStats, PRINTABLE_OBSERVER_KEY_PREFIX, closeUserStreamsInNetwork, getUserPresence, onUserPresenceChange, pushUserEventToNetwork } from "./push.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
-import { listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
+import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
+import { getTaskAccessMode, isTaskScoped, listProjectGrants, replaceTaskGrants, NEW_MEMBER_TASK_ACCESS } from "./task-access.js";
 import { canMessageAgent, isAgentRestricted, listAgentGrants, listGroupGrants, getAgentAccessMode, replaceAgentGrants, restrictedNetworkIds, usernameIsAgentAlias, listAgentGroups, createAgentGroup, updateAgentGroup, replaceAgentGroupMembers, deleteAgentGroup, usersGrantedGroup } from "./agent-access.js";
 import { validateAvatarUrl } from "./avatar-validate.js";
 import { narrowTags, parseStoredTags, validateScalarAttr } from "./node-attrs-validate.js";
@@ -41,6 +42,7 @@ import {
   stripHostLocalPathsForCrossHostSafe,
   validateAttachments,
   validateIndexEntry,
+  DM_FILE_SCOPE,
 } from "./uploads.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, statSync, unlinkSync, renameSync } from "fs";
 import { dirname as pathDirname, join as pathJoin } from "path";
@@ -238,6 +240,16 @@ function isTmuxAllowedIP(ip: string): boolean {
 function isNodeCredential(resolved: { networkId: string | null } | null | undefined): boolean {
   return !!resolved?.networkId;
 }
+// 人员列表的在线点:某人的第一条用户流连上 / 最后一条断开时,推给他所在每个网络里其他连着用户流的成员。
+// 收件人本来就是该网络成员(用户流入口按成员资格鉴权),与 GET /api/networks/:id/humans 同一可见范围。
+// 字段叫 member_user_id:pushUserEvent 会把 user_id 写成**收件人**自己。
+onUserPresenceChange((userId, online, lastSeenAt) => {
+  const nets = db.all<{ network_id: string }>("SELECT network_id FROM network_members WHERE user_id = ?1", userId);
+  for (const { network_id } of nets) {
+    pushUserEventToNetwork(network_id, { type: "member_presence", member_user_id: userId, online, last_seen_at: lastSeenAt }, userId);
+  }
+});
+
 function isHubAdminCredential(resolved: { networkId: string | null; user: { role: string } } | null | undefined): boolean {
   return !!resolved && !resolved.networkId && resolved.user.role === "admin";
 }
@@ -375,15 +387,16 @@ export function resolvePrincipal(req: Request, options: RequestTokenOptions = {}
 // these two fields lives here and nowhere else, so the authz rules can be
 // read as rules rather than as string-checks.
 export function normalizeEntry(
-  entry: { owner_id?: unknown; network_id?: unknown },
-): { ownerId: string | null; networkId: string | null } {
+  entry: { owner_id?: unknown; network_id?: unknown; scope?: unknown },
+): { ownerId: string | null; networkId: string | null; dmScoped?: true } {
   const ownerId = typeof entry.owner_id === "string" && entry.owner_id.length > 0
     ? entry.owner_id
     : null;
   const networkId = typeof entry.network_id === "string" && entry.network_id.length > 0
     ? entry.network_id
     : null;
-  return { ownerId, networkId };
+  // dmScoped 只在是私信文件时出现:其余条目的形状与之前逐字相同。
+  return { ownerId, networkId, ...(entry.scope === DM_FILE_SCOPE ? { dmScoped: true as const } : {}) };
 }
 
 // #495/#503 — shared authorization gate for /api/files/:file_id downloads.
@@ -404,6 +417,13 @@ export function normalizeEntry(
 //     a task but not open its attachment is a broken product).
 //   - entry.network_id absent (legacy / unattributed) → the pre-#503
 //     rules stand unchanged: owner match, or null owner_id + DEV_OPEN.
+//   - entry.dmScoped (uploaded with ?purpose=dm — its first use is a
+//     human DM) → only the uploader and the users on either side of a DM
+//     that carries it (human-dm.ts dmParticipantSeesFile). Other members of
+//     the network and node tokens (agents) are denied. admin-utok and the
+//     legacy master token still pass above, as for every other file.
+//     Files uploaded any other way never become DM-scoped, including when
+//     they are later forwarded into a DM.
 //   - Everything else → deny (404). New uploads in production always
 //     carry a truthy owner_id (requireAuth blocks the null-owner-
 //     producing path when DEV_OPEN=off and no legacy master token is
@@ -418,7 +438,7 @@ export function normalizeEntry(
 // 所有文件在同一 network → 无实际影响, 但语义变更须明写, 不能悄悄发生.
 export function authorizeFileDownload(
   principal: Principal,
-  entry: { ownerId: string | null; networkId: string | null },
+  entry: { ownerId: string | null; networkId: string | null; dmScoped?: boolean },
   fileId?: string,
 ): boolean {
   if (principal.kind === "legacy-master") return true;
@@ -426,8 +446,13 @@ export function authorizeFileDownload(
 
   if (entry.networkId !== null) {
     if (principal.kind === "anonymous" || principal.kind === "dev-open-anon") return false;
-    if (principal.kind === "ntok") return principal.boundNetworkId === entry.networkId;
+    if (principal.kind === "ntok") return principal.boundNetworkId === entry.networkId && !entry.dmScoped;
     if (!getUserNetworkRole(principal.userId, entry.networkId)) return false;
+    // 私信文件:只看是不是这段私信里的人,与受限 / 不受限无关。
+    if (entry.dmScoped) {
+      if (entry.ownerId !== null && entry.ownerId === principal.userId) return true;
+      return !!fileId && dmParticipantSeesFile(principal.userId, entry.networkId, fileId);
+    }
     // 多用户 Agent 权限:受限成员只能下载自己传的,或者出现在自己与授权 Agent 往来 / 自己收件箱里的文件。
     if (!isAgentRestricted(principal.userId, entry.networkId)) return true;
     if (entry.ownerId !== null && entry.ownerId === principal.userId) return true;
@@ -1538,6 +1563,51 @@ return Bun.serve({
     // ── 多用户 Agent 权限:成员可访问的 Agent(owner/admin 管理) ──
     // GET  → { agent_access: 'all'|'granted', grants: [{node_id, alias, can_message}] }
     // PUT  { grants?: [{node_id | alias, can_message?}] | string[], agent_access?: 'all'|'granted' } → 整体替换
+    // ── 任务(需求卡)的人员权限(RFC-038 §9):成员能看 / 能改哪些卡。owner/admin/Hub 管理员管理 ──
+    // GET  → { task_access: 'all'|'scoped', restricted, project_grants: [{project_id, can_edit}] }
+    // PUT  { task_access?, project_grants?: [{project_id, can_edit?}] | string[] } → 不传的字段保持原样;传了整体替换
+    const taskGrantsMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/members\/([^/]+)\/task-grants$/);
+    if (taskGrantsMatch && (req.method === "GET" || req.method === "PUT")) {
+      const token = requestToken(req, { allowQueryToken: false });
+      const resolved = token ? resolveToken(token) : null;
+      if (!resolved) return withCors(req, Response.json({ ok: false, error: "auth required" }, { status: 401 }));
+      if (resolved.networkId) return withCors(req, Response.json({ ok: false, error: "user_token_required" }, { status: 403 }));
+      const netId = decodeURIComponent(taskGrantsMatch[1]);
+      const targetUid = decodeURIComponent(taskGrantsMatch[2]);
+      const hubAdmin = resolved.user.role === "admin";
+      const callerRole = getUserNetworkRole(resolved.user.user_id, netId);
+      if (!hubAdmin && callerRole !== "owner" && callerRole !== "admin") {
+        return withCors(req, Response.json({ ok: false, error: "owner/admin required" }, { status: 403 }));
+      }
+      const targetRole = getUserNetworkRole(targetUid, netId);
+      if (!targetRole) return withCors(req, Response.json({ ok: false, error: "member_not_found" }, { status: 404 }));
+      const view = () => ({
+        ok: true, network_id: netId, user_id: targetUid, role: targetRole,
+        task_access: getTaskAccessMode(netId, targetUid), restricted: isTaskScoped(targetUid, netId),
+        project_grants: listProjectGrants(netId, targetUid),
+      });
+      if (req.method === "GET") return withCors(req, Response.json(view()));
+      // 网络 admin 不能改 owner / 其他 admin(对他们本来也不生效)。
+      if (!hubAdmin && callerRole !== "owner" && (targetRole === "owner" || targetRole === "admin")) {
+        return withCors(req, Response.json({ ok: false, error: "owner required" }, { status: 403 }));
+      }
+      let body: any;
+      try { body = await req.json(); } catch { return withCors(req, Response.json({ ok: false, error: "invalid JSON" }, { status: 400 })); }
+      if (!body || typeof body !== "object" || Array.isArray(body)) return withCors(req, Response.json({ ok: false, error: "invalid JSON" }, { status: 400 }));
+      if (body.task_access === undefined && body.project_grants === undefined) {
+        return withCors(req, Response.json({ ok: false, error: "task_access or project_grants required" }, { status: 400 }));
+      }
+      const before = { task_access: getTaskAccessMode(netId, targetUid), project_grants: listProjectGrants(netId, targetUid) };
+      const result = replaceTaskGrants({ networkId: netId, userId: targetUid, taskAccess: body.task_access, projectGrants: body.project_grants, actorUserId: resolved.user.user_id });
+      if (!result.ok) {
+        return withCors(req, Response.json({ ok: false, error: result.error, ...(result.detail ? { detail: result.detail } : {}) }, { status: result.status }));
+      }
+      logAudit(resolved.user.user_id, resolved.user.username, "member_task_grants_changed", "network", netId,
+        JSON.stringify({ user_id: targetUid, before, after: { task_access: result.task_access, project_grants: result.project_grants } }).slice(0, 4000),
+        undefined, netId);
+      return withCors(req, Response.json(view()));
+    }
+
     const grantsMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/members\/([^/]+)\/agent-grants$/);
     if (grantsMatch && (req.method === "GET" || req.method === "PUT")) {
       const token = requestToken(req, { allowQueryToken: false });
@@ -1606,7 +1676,11 @@ return Bun.serve({
       if (resolved.user.role !== "admin" && !getUserNetworkRole(resolved.user.user_id, netId)) {
         return withCors(req, Response.json({ ok: false, error: "not a member of this network" }, { status: 403 }));
       }
-      return withCors(req, Response.json({ ok: true, network_id: netId, humans: getNetworkHumans(netId) }));
+      const humans = getNetworkHumans(netId);
+      // 在线状态(online / last_seen_at)只给用户令牌:节点令牌拿到的仍是原来的身份字段,不多得任何东西。
+      if (isNodeCredential(resolved)) return withCors(req, Response.json({ ok: true, network_id: netId, humans }));
+      const presence = getUserPresence(humans.map((h) => h.user_id));
+      return withCors(req, Response.json({ ok: true, network_id: netId, humans: humans.map((h) => ({ ...h, ...presence.get(h.user_id)! })) }));
     }
 
     // ── V3.13: Network members + invites ──
@@ -1634,8 +1708,12 @@ return Bun.serve({
         if (body.agent_access !== undefined && body.agent_access !== "all" && body.agent_access !== "granted") {
           return withCors(req, Response.json({ ok: false, error: "invalid_agent_access" }, { status: 400 }));
         }
-        const result = addNetworkMember(netId, body.user_id, body.role || "member", resolved.user.user_id, { agentAccess: body.agent_access });
-        if (result.ok) logAudit(resolved.user.user_id, resolved.user.username, "member_added", "network", netId, `${body.user_id} as ${body.role || "member"} agent_access=${body.agent_access === "all" ? "all" : "granted"}`);
+        // task_access 缺省 NEW_MEMBER_TASK_ACCESS(RFC-038 §9.4);显式传 'all' / 'scoped' 覆盖。
+        if (body.task_access !== undefined && body.task_access !== "all" && body.task_access !== "scoped") {
+          return withCors(req, Response.json({ ok: false, error: "invalid_task_access" }, { status: 400 }));
+        }
+        const result = addNetworkMember(netId, body.user_id, body.role || "member", resolved.user.user_id, { agentAccess: body.agent_access, taskAccess: body.task_access });
+        if (result.ok) logAudit(resolved.user.user_id, resolved.user.username, "member_added", "network", netId, `${body.user_id} as ${body.role || "member"} agent_access=${body.agent_access === "all" ? "all" : "granted"} task_access=${body.task_access ?? NEW_MEMBER_TASK_ACCESS}`, undefined, netId);
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
       }
       if (req.method === "PUT" && targetUid) {
@@ -1643,7 +1721,7 @@ return Bun.serve({
         const body = await req.json() as any;
         const result = updateMemberRole(netId, targetUid, body.role);
         if (result.ok) {
-          logAudit(resolved.user.user_id, resolved.user.username, "member_role_changed", "network", netId, `${targetUid} → ${body.role}`);
+          logAudit(resolved.user.user_id, resolved.user.username, "member_role_changed", "network", netId, `${targetUid} → ${body.role}`, undefined, netId);
           closeUserStreamsInNetwork(netId, targetUid);
         }
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
@@ -1652,7 +1730,7 @@ return Bun.serve({
         if (!["owner", "admin"].includes(callerRole)) return withCors(req, Response.json({ ok: false, error: "owner/admin required" }, { status: 403 }));
         const result = removeNetworkMember(netId, targetUid);
         if (result.ok) {
-          logAudit(resolved.user.user_id, resolved.user.username, "member_removed", "network", netId, targetUid);
+          logAudit(resolved.user.user_id, resolved.user.username, "member_removed", "network", netId, targetUid, undefined, netId);
           closeUserStreamsInNetwork(netId, targetUid);
         }
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
@@ -2440,6 +2518,12 @@ return Bun.serve({
       // uploaded and never gets their multipart envelope parsed.
       const principal = resolvePrincipal(req);
       const requestedNetId = url.searchParams.get("network_id");
+      // ?purpose=dm:这个文件是为一条人与人私信传的(见 UploadIndexEntry.scope)。缺省 = 旧行为。
+      // 拼错的值拒掉,不静默当成缺省 —— 否则私信图会不声不响地变成全网可见。
+      const purpose = url.searchParams.get("purpose");
+      if (purpose !== null && purpose !== DM_FILE_SCOPE) {
+        return earlyReject(Response.json({ ok: false, error: "bad_purpose", message: `purpose must be "${DM_FILE_SCOPE}" or absent` }, { status: 400 }));
+      }
       let uploadNetId: string | null = null;
 
       switch (principal.kind) {
@@ -2616,6 +2700,7 @@ return Bun.serve({
             owner_id: authCtx?.userId ?? null,
             // Key omitted (not null) when unattributed — see UploadIndexEntry.
             ...(uploadNetId ? { network_id: uploadNetId } : {}),
+            ...(purpose === DM_FILE_SCOPE ? { scope: DM_FILE_SCOPE } : {}),
             uploaded_at: new Date().toISOString(),
           }, null, 2));
         } else {

package/src/skillhub-http.test.ts

@@ -84,6 +84,22 @@ describe("SkillHub real Hub + SQLite", () => {
     expect(detail.created_by_user).toBeUndefined(); expect(detail.reviewed_by_user).toBeUndefined(); expect(detail.content_hash).toBeUndefined();
   });
 
+  test("query matches regardless of letter case (SQLite LIKE semantics, kept on PostgreSQL)", async () => {
+    for (const query of ["incident", "INCIDENT", "Handoff"]) {
+      const found = await tool(nodeToken, "list_skills", { network_id: networkId, query });
+      expect(found.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    }
+    expect((await tool(nodeToken, "list_skills", { network_id: networkId, query: "no-such-skill" })).skills).toHaveLength(0);
+  });
+
+  test("% and _ in the query are literal characters, not wildcards (#2141)", async () => {
+    const ids = async (query: string) => (await tool(nodeToken, "list_skills", { network_id: networkId, query })).skills.map((x: any) => x.skill_id);
+    expect(await ids("_")).not.toContain(skillId);       // was: matched everything
+    expect(await ids("%")).not.toContain(skillId);
+    expect(await ids("incident_handoff")).not.toContain(skillId); // `_` must not stand for the "-" in the slug
+    expect(await ids("incident-handoff")).toContain(skillId);
+  });
+
   test("foreign user cannot read or review another network", async () => {
     expect((await tool(foreignToken, "list_skills", { network_id: networkId })).ok).toBe(false);
     const review = await tool(foreignToken, "review_skill", { network_id: networkId, skill_id: skillId, decision: "rejected" });

package/src/sqlite-close-checkpoint.test.ts

@@ -0,0 +1,78 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
+import { copyFileSync, existsSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { SQLiteAdapter } from "./db-adapter";
+
+// #2151 — a cleanly stopped Hub must leave a complete .db: the -wal is absent
+// or empty, and a copy of the .db file alone still has the data.
+const dir = mkdtempSync(join(tmpdir(), "anet-wal-close-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+const walBytes = (db: string) => (existsSync(`${db}-wal`) ? statSync(`${db}-wal`).size : 0);
+
+function copyOnlyDb(db: string): Database {
+  const copy = join(dirname(db), `copy-of-${db.split("/").pop()}`);
+  copyFileSync(db, copy); // deliberately without -wal / -shm
+  return new Database(copy, { readonly: true });
+}
+
+describe("#2151 SQLite WAL is checkpointed on close", () => {
+  test("SQLiteAdapter.close() after >20 distinct statements leaves a complete .db", () => {
+    const path = join(dir, "adapter.db");
+    const raw = new Database(path);
+    raw.exec("PRAGMA journal_mode=WAL");
+    const db = new SQLiteAdapter(raw);
+    db.exec("CREATE TABLE t (x TEXT)");
+    db.run("INSERT INTO t VALUES (?1)", ["kept"]);
+    // bun:sqlite stops being able to close after more than 20 distinct query() strings.
+    for (let i = 0; i < 30; i++) db.get(`SELECT ${i} AS v`);
+    db.close();
+    expect(walBytes(path)).toBe(0);
+    const copy = copyOnlyDb(path);
+    expect(copy.query("SELECT x FROM t").all()).toEqual([{ x: "kept" }]);
+    copy.close();
+  });
+
+  test("a real Hub that served traffic and got SIGTERM leaves a complete .db", async () => {
+    const bin = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "commhub.ts");
+    const home = join(dir, "home");
+    const path = join(dir, "hub.db");
+    const port = String(27000 + Math.floor(Math.random() * 2000));
+    const base = `http://127.0.0.1:${port}`;
+    const hub = Bun.spawn(["bun", bin, "--port", port, "--host", "127.0.0.1", "--db", path], {
+      env: { PATH: process.env.PATH ?? "", HOME: home }, stdout: "pipe", stderr: "pipe",
+    });
+    try {
+      let up = false;
+      for (let i = 0; i < 150 && !up; i++) {
+        up = await fetch(`${base}/health`).then((r) => r.ok, () => false);
+        if (!up) await Bun.sleep(100);
+      }
+      expect(up).toBe(true);
+      const post = (p: string, body: unknown, token?: string) => fetch(`${base}${p}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+        body: JSON.stringify(body),
+      }).then((r) => r.json() as Promise<any>);
+      const reg = await post("/api/auth/register", { username: "walcheck", password: "StrongPassw0rd" });
+      expect(reg.ok).toBe(true);
+      const login = await post("/api/auth/login", { username: "walcheck", password: "StrongPassw0rd" });
+      const net = await post("/api/networks", { name: "wal-net" }, login.token);
+      expect(net.ok).toBe(true);
+      const ntok = await post("/api/auth/node-token", { network_id: net.network_id, node_name: "wal-agent" }, login.token);
+      expect(ntok.ok).toBe(true);
+      expect(walBytes(path)).toBeGreaterThan(0); // the writes really are in the WAL before the stop
+    } finally {
+      hub.kill("SIGTERM");
+      await hub.exited;
+    }
+    expect(walBytes(path)).toBe(0);
+    const copy = copyOnlyDb(path);
+    expect(copy.query("SELECT COUNT(*) AS n FROM users WHERE username = 'walcheck'").get()).toEqual({ n: 1 });
+    expect(copy.query("SELECT COUNT(*) AS n FROM networks WHERE network_name = 'wal-net'").get()).toEqual({ n: 1 });
+    copy.close();
+  }, 40_000);
+});