@sleep2agi/commhub-server 0.9.0-preview.8 → 0.9.0-preview.80

package/src/skillhub-http.test.ts

@@ -0,0 +1,108 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+
+const dir = mkdtempSync(join(tmpdir(), "anet-skillhub-"));
+let server: any;
+let base = "";
+let ownerToken = "";
+let nodeToken = "";
+let foreignToken = "";
+let networkId = "";
+
+async function tool(token: string, name: string, args: Record<string, unknown>) {
+  const res = await fetch(`${base}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  expect(res.status).toBe(200);
+  const raw = await res.text();
+  const dataLines = raw.split("\n").filter(x => x.startsWith("data:"));
+  const payload = dataLines.length
+    ? JSON.parse(dataLines.at(-1)!.slice(5).trim())
+    : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(dir, "hub.db");
+  const owner = register(`skill_owner_${Date.now()}`, "SkillHubOwner123!", undefined, "seed");
+  expect(owner.ok).toBe(true);
+  ownerToken = owner.token!; networkId = owner.network_id!;
+  const ownerId = db.get<{ user_id: string }>("SELECT owner_id AS user_id FROM networks WHERE network_id = ?1", networkId)!.user_id;
+  const node = createNetworkTokenForNode(ownerId, networkId, "skill-writer");
+  expect(node.ok).toBe(true); nodeToken = node.token!;
+  const foreign = register(`skill_foreign_${Date.now()}`, "SkillHubForeign123!", undefined, "seed");
+  expect(foreign.ok).toBe(true); foreignToken = foreign.token!;
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => { try { server?.stop?.(true); } catch {} try { rmSync(dir, { recursive: true, force: true }); } catch {} });
+
+describe("SkillHub real Hub + SQLite", () => {
+  let skillId = "";
+  test("node submit is token-attributed, pending and immutable/idempotent", async () => {
+    const input = { network_id: networkId, slug: "incident-handoff", name: "Incident handoff", version: "1.0.0", description: "handoff", content: "# Incident handoff\n\nVerify facts." };
+    const first = await tool(nodeToken, "submit_skill", { ...input, source_alias: "forged-admin" });
+    expect(first.ok).toBe(true); expect(first.status).toBe("pending"); expect(first.source_alias).toBe("skill-writer"); skillId = first.skill_id;
+    const retry = await tool(nodeToken, "submit_skill", input);
+    expect(retry.idempotent).toBe(true); expect(retry.skill_id).toBe(skillId);
+    const conflict = await tool(nodeToken, "submit_skill", { ...input, content: "changed" });
+    expect(conflict.error).toBe("skill_version_conflict");
+    const raceBase = { ...input, slug: "concurrent-version", version: "2.0.0" };
+    const raced = await Promise.all([
+      tool(nodeToken, "submit_skill", { ...raceBase, content: "winner-a" }),
+      tool(nodeToken, "submit_skill", { ...raceBase, content: "winner-b" }),
+    ]);
+    expect(raced.filter(x => x.ok).length).toBe(1);
+    expect(raced.filter(x => x.error === "skill_version_conflict").length).toBe(1);
+  });
+
+  test("pending is reviewer-only; owner publishes; published becomes visible", async () => {
+    const nodeList = await tool(nodeToken, "list_skills", { network_id: networkId, include_pending: true });
+    expect(nodeList.skills).toHaveLength(0);
+    expect((await tool(nodeToken, "get_skill", { network_id: networkId, skill_id: skillId })).error).toBe("skill_not_found");
+    const ownerList = await tool(ownerToken, "list_skills", { network_id: networkId, include_pending: true });
+    expect(ownerList.reviewer).toBe(true); expect(ownerList.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    expect((await tool(ownerToken, "get_skill", { network_id: networkId, skill_id: skillId })).skill.content).toContain("Verify facts");
+    const reviewed = await tool(ownerToken, "review_skill", { network_id: networkId, skill_id: skillId, decision: "published" });
+    expect(reviewed.status).toBe("published");
+    const published = await tool(nodeToken, "list_skills", { network_id: networkId });
+    expect(published.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    expect((await tool(nodeToken, "get_skill", { network_id: networkId, skill_id: skillId })).skill.skill_id).toBe(skillId);
+    const detail = (await tool(nodeToken, "get_skill", { network_id: networkId, skill_id: skillId })).skill;
+    expect(detail.created_by_user).toBeUndefined(); expect(detail.reviewed_by_user).toBeUndefined(); expect(detail.content_hash).toBeUndefined();
+  });
+
+  test("query matches regardless of letter case (SQLite LIKE semantics, kept on PostgreSQL)", async () => {
+    for (const query of ["incident", "INCIDENT", "Handoff"]) {
+      const found = await tool(nodeToken, "list_skills", { network_id: networkId, query });
+      expect(found.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    }
+    expect((await tool(nodeToken, "list_skills", { network_id: networkId, query: "no-such-skill" })).skills).toHaveLength(0);
+  });
+
+  test("% and _ in the query are literal characters, not wildcards (#2141)", async () => {
+    const ids = async (query: string) => (await tool(nodeToken, "list_skills", { network_id: networkId, query })).skills.map((x: any) => x.skill_id);
+    expect(await ids("_")).not.toContain(skillId);       // was: matched everything
+    expect(await ids("%")).not.toContain(skillId);
+    expect(await ids("incident_handoff")).not.toContain(skillId); // `_` must not stand for the "-" in the slug
+    expect(await ids("incident-handoff")).toContain(skillId);
+  });
+
+  test("foreign user cannot read or review another network", async () => {
+    expect((await tool(foreignToken, "list_skills", { network_id: networkId })).ok).toBe(false);
+    const review = await tool(foreignToken, "review_skill", { network_id: networkId, skill_id: skillId, decision: "rejected" });
+    expect(review.ok).toBe(false);
+  });
+});

package/src/sqlite-close-checkpoint.test.ts

@@ -0,0 +1,78 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
+import { copyFileSync, existsSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { SQLiteAdapter } from "./db-adapter";
+
+// #2151 — a cleanly stopped Hub must leave a complete .db: the -wal is absent
+// or empty, and a copy of the .db file alone still has the data.
+const dir = mkdtempSync(join(tmpdir(), "anet-wal-close-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+const walBytes = (db: string) => (existsSync(`${db}-wal`) ? statSync(`${db}-wal`).size : 0);
+
+function copyOnlyDb(db: string): Database {
+  const copy = join(dirname(db), `copy-of-${db.split("/").pop()}`);
+  copyFileSync(db, copy); // deliberately without -wal / -shm
+  return new Database(copy, { readonly: true });
+}
+
+describe("#2151 SQLite WAL is checkpointed on close", () => {
+  test("SQLiteAdapter.close() after >20 distinct statements leaves a complete .db", () => {
+    const path = join(dir, "adapter.db");
+    const raw = new Database(path);
+    raw.exec("PRAGMA journal_mode=WAL");
+    const db = new SQLiteAdapter(raw);
+    db.exec("CREATE TABLE t (x TEXT)");
+    db.run("INSERT INTO t VALUES (?1)", ["kept"]);
+    // bun:sqlite stops being able to close after more than 20 distinct query() strings.
+    for (let i = 0; i < 30; i++) db.get(`SELECT ${i} AS v`);
+    db.close();
+    expect(walBytes(path)).toBe(0);
+    const copy = copyOnlyDb(path);
+    expect(copy.query("SELECT x FROM t").all()).toEqual([{ x: "kept" }]);
+    copy.close();
+  });
+
+  test("a real Hub that served traffic and got SIGTERM leaves a complete .db", async () => {
+    const bin = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "commhub.ts");
+    const home = join(dir, "home");
+    const path = join(dir, "hub.db");
+    const port = String(27000 + Math.floor(Math.random() * 2000));
+    const base = `http://127.0.0.1:${port}`;
+    const hub = Bun.spawn(["bun", bin, "--port", port, "--host", "127.0.0.1", "--db", path], {
+      env: { PATH: process.env.PATH ?? "", HOME: home }, stdout: "pipe", stderr: "pipe",
+    });
+    try {
+      let up = false;
+      for (let i = 0; i < 150 && !up; i++) {
+        up = await fetch(`${base}/health`).then((r) => r.ok, () => false);
+        if (!up) await Bun.sleep(100);
+      }
+      expect(up).toBe(true);
+      const post = (p: string, body: unknown, token?: string) => fetch(`${base}${p}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+        body: JSON.stringify(body),
+      }).then((r) => r.json() as Promise<any>);
+      const reg = await post("/api/auth/register", { username: "walcheck", password: "StrongPassw0rd" });
+      expect(reg.ok).toBe(true);
+      const login = await post("/api/auth/login", { username: "walcheck", password: "StrongPassw0rd" });
+      const net = await post("/api/networks", { name: "wal-net" }, login.token);
+      expect(net.ok).toBe(true);
+      const ntok = await post("/api/auth/node-token", { network_id: net.network_id, node_name: "wal-agent" }, login.token);
+      expect(ntok.ok).toBe(true);
+      expect(walBytes(path)).toBeGreaterThan(0); // the writes really are in the WAL before the stop
+    } finally {
+      hub.kill("SIGTERM");
+      await hub.exited;
+    }
+    expect(walBytes(path)).toBe(0);
+    const copy = copyOnlyDb(path);
+    expect(copy.query("SELECT COUNT(*) AS n FROM users WHERE username = 'walcheck'").get()).toEqual({ n: 1 });
+    expect(copy.query("SELECT COUNT(*) AS n FROM networks WHERE network_name = 'wal-net'").get()).toEqual({ n: 1 });
+    copy.close();
+  }, 40_000);
+});

package/src/start-node.test.ts

@@ -0,0 +1,109 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_start_node"; const USER = "u_start_node";
+const DAEMON = "node_start_daemon"; const DAEMON_ALIAS = "start-daemon";
+const CHILD = "node_start_child"; const CHILD_ALIAS = "start-child";
+
+function cleanup() {
+  for (const table of ["node_start_requests", "node_create_requests", "audit_log", "nodes", "api_tokens", "network_members", "networks"]) {
+    try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id=?1", USER); } catch {}
+}
+beforeEach(() => { cleanup();
+  db.run(`INSERT INTO users(user_id,username,password_hash,role,created_at) VALUES(?1,?1,'x','user',datetime('now'))`, USER);
+  db.run(`INSERT INTO networks(network_id,network_name,owner_id,created_at) VALUES(?1,?1,?2,datetime('now'))`, [NET, USER]);
+  db.run(`INSERT INTO network_members(user_id,network_id,role,joined_at) VALUES(?1,?2,'owner',datetime('now'))`, [USER, NET]);
+  db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,config_snapshot,hostname,created_at,updated_at,lifecycle_state) VALUES(?1,?2,?2,?3,'{}','h',datetime('now'),datetime('now'),'active')`, [DAEMON, DAEMON_ALIAS, NET]);
+  db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,config_snapshot,hostname,created_at,updated_at,lifecycle_state) VALUES(?1,?2,?2,?3,'{}','h',datetime('now'),datetime('now'),'stopped')`, [CHILD, CHILD_ALIAS, NET]);
+  db.run(`INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES('tok_start_daemon',?1,?2,'network',?3,'h')`, [USER, NET, `node:${DAEMON_ALIAS}`]);
+  db.run(`INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id) VALUES('cr_start_child',?1,?2,?3,'codex-sdk','x','{}','[]','succeeded',1,'t',?4)`, [DAEMON, CHILD_ALIAS, NET, CHILD]);
+});
+afterAll(cleanup);
+
+function handlers(user: string | null, daemon = false) {
+  const s = new McpServer({ name: "t", version: "0" }) as any; const out: any = {};
+  const orig = s.tool.bind(s); s.tool = (n: string, d: string, schema: any, h: any) => { out[n] = h; return orig(n,d,schema,h); };
+  registerTools(s, undefined, daemon ? NET : null, user, null, daemon, daemon ? "tok_start_daemon" : null); return out;
+}
+async function call(h: any, args: any) { return JSON.parse((await h(args)).content[0].text); }
+
+describe("start_node Hub -> daemon lifecycle", () => {
+  test("dispatch, authenticated pull, ack transitions stopped -> starting -> active", async () => {
+    const u = handlers(USER); const dispatch = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(dispatch.ok).toBe(true); expect(dispatch.lifecycle_state).toBe("starting");
+    const d = handlers(null, true); const pulled = await call(d.get_start_request, { request_id: dispatch.request_id });
+    expect(pulled).toMatchObject({ ok: true, child_node_id: CHILD, child_alias: CHILD_ALIAS });
+    const ack = await call(d.ack_start_request, { request_id: dispatch.request_id, status: "started", child_pid: 4321 });
+    expect(ack.ok).toBe(true);
+    expect(db.get<any>(`SELECT lifecycle_state FROM nodes WHERE node_id=?1`, CHILD)?.lifecycle_state).toBe("active");
+    expect(db.all<any>(`SELECT action FROM audit_log WHERE target_id=?1 ORDER BY id`, dispatch.request_id).map((x:any)=>x.action)).toEqual(["start_node_dispatched", "start_node_completed"]);
+  });
+  test("active child and caller-supplied wrong daemon fail closed", async () => {
+    const u = handlers(USER);
+    db.run(`UPDATE nodes SET lifecycle_state='active' WHERE node_id=?1`, CHILD);
+    expect((await call(u.start_node, { child_node_id: CHILD, network_id: NET })).error).toBe("node_not_stopped");
+    db.run(`UPDATE nodes SET lifecycle_state='stopped' WHERE node_id=?1`, CHILD);
+    expect((await call(u.start_node, { child_node_id: CHILD, daemon_node_id: "node_wrong", network_id: NET })).error).toBe("daemon_child_mismatch");
+  });
+});
+
+// #1448 finding-2 — stale-starting reaper（对齐 update_node_config/restart_node 的 60s
+// single-flight stale-supersede）。start 只受理 stopped;卡在 starting 的节点(门铃丢 /
+// daemon 在 UPDATE starting 后死)改前永远 start 不了(gate 返 node_not_stopped)、也无
+// reaper 拉回 → 永久卡死。改后:in-flight start 请求晾过 60s ⇒ 标 timeout 超越 + 放行
+// 重派;未过阈值 ⇒ 拒 node_already_starting。
+describe("start_node — stale-starting reaper (#1448 finding-2)", () => {
+  function seedStartReq(reqId: string, status: string, ageMs: number) {
+    db.run(
+      `INSERT INTO node_start_requests(request_id,network_id,daemon_node_id,child_node_id,child_alias,created_by_token,status,created_at)
+       VALUES(?1,?2,?3,?4,?5,'t',?6,?7)`,
+      [reqId, NET, DAEMON, CHILD, CHILD_ALIAS, status, Date.now() - ageMs],
+    );
+  }
+
+  test("starting + FRESH in-flight start (< 60s) → refused node_already_starting (not superseded)", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    seedStartReq("str_fresh", "delivered", 5_000);   // 5s old — within threshold
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("node_already_starting");
+    expect(r.existing_request_id).toBe("str_fresh");
+    expect(typeof r.age_ms).toBe("number");
+    // old request untouched, no new dispatch
+    expect(db.get<any>(`SELECT status FROM node_start_requests WHERE request_id='str_fresh'`)?.status).toBe("delivered");
+  });
+
+  // witnessed-red：改前 gate 直接 `!== 'stopped' → node_not_stopped`，一个 stale 的
+  // 'starting' 节点返回 node_not_stopped、永远卡死。改后应超越重派(ok:true)。
+  test("starting + STALE in-flight start (> 60s) → supersede old + re-dispatch (converges)", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    seedStartReq("str_stale", "delivered", 61_000);   // 61s old — past 60s threshold
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(true);
+    expect(r.lifecycle_state).toBe("starting");
+    expect(typeof r.request_id).toBe("string");
+    expect(r.request_id).not.toBe("str_stale");                       // fresh request
+    // old stale request superseded → terminal, unblocks the child-inflight unique index
+    expect(db.get<any>(`SELECT status FROM node_start_requests WHERE request_id='str_stale'`)?.status).toBe("timeout");
+    // exactly one non-terminal start request now (the new one)
+    const live = db.all<any>(`SELECT request_id FROM node_start_requests WHERE child_node_id=?1 AND status IN ('pending','delivered')`, CHILD);
+    expect(live.map((x:any)=>x.request_id)).toEqual([r.request_id]);
+    // audit records the real prior state
+    const aud = db.get<any>(`SELECT detail FROM audit_log WHERE target_id=?1`, r.request_id);
+    expect(JSON.parse(aud.detail).lifecycle_state_before).toBe("starting");
+  });
+
+  test("starting + NO in-flight row (orphaned state) → self-heals by re-dispatching", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(true);
+    expect(r.lifecycle_state).toBe("starting");
+  });
+});

package/src/status-alias-filter-http.test.ts

@@ -0,0 +1,106 @@
+// GET /api/status?alias=<name> — one agent's rows instead of the whole network.
+// The app's chat info / node detail read the FULL projection for a single agent; unfiltered that
+// was every session (533 KB raw / 94 KB gzip on the production network) per open and per 10 s poll.
+// Old hubs ignore the parameter, so the app keeps picking its row by alias; this suite pins that
+// the filter narrows, never widens (network scope still applies), and that no/blank alias is the
+// old response.
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-status-alias-"));
+let BASE = "";
+let hub: any = null;
+const PW = "StatusAliasPassw0rd!";
+let aToken = "", aId = "", NET_A = "";
+let bToken = "", bId = "", NET_B = "";
+
+async function get(token: string, path: string) {
+  const res = await fetch(`${BASE}${path}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+function seed(alias: string, node: string, net: string, owner: string, minutesAgo: number) {
+  db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id) VALUES (?1, ?2, ?2, ?3, ?4)`, [node, alias, net, owner]);
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, node_id, status, network_id, task, updated_at, last_seen_at) VALUES (?1, ?2, ?3, 'idle', ?4, ?5, datetime('now', ?6), datetime('now'))`,
+    [`r_${node}`, alias, node, net, `task of ${alias}`, `-${minutesAgo} minutes`],
+  );
+}
+const aliases = (rows: any[]) => rows.map(r => r.alias);
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`sa_owner_a_${Date.now()}`, PW);
+  aToken = a.token!; aId = a.user!.user_id; NET_A = a.network_id!;
+  const b = register(`sa_owner_b_${Date.now()}`, PW);
+  bToken = b.token!; bId = b.user!.user_id; NET_B = b.network_id!;
+  seed("sa-one", "node_sa_one", NET_A, aId, 1);
+  seed("sa-two", "node_sa_two", NET_A, aId, 2);
+  seed("sa-three", "node_sa_three", NET_A, aId, 3);
+  // Same alias in someone else's network: the filter must not reach it.
+  seed("sa-two", "node_sa_two_b", NET_B, bId, 0);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("/api/status?alias=", () => {
+  test("no alias: every session in scope, newest first (unchanged)", async () => {
+    const r = await get(aToken, `/api/status?network_id=${NET_A}`);
+    expect(r.status).toBe(200);
+    expect(aliases(r.body.sessions)).toEqual(["sa-one", "sa-two", "sa-three"]);
+    expect(r.body.summary.total).toBe(3);
+  });
+
+  test("alias narrows the full projection to that agent", async () => {
+    const r = await get(aToken, `/api/status?network_id=${NET_A}&alias=sa-two`);
+    expect(r.status).toBe(200);
+    expect(aliases(r.body.sessions)).toEqual(["sa-two"]);
+    expect(r.body.sessions[0].node_id).toBe("node_sa_two");
+    // still the full projection (capability bits / host block), not the light one
+    expect(typeof r.body.sessions[0].rules_file_capable).toBe("boolean");
+    expect(r.body.sessions[0].host).toBeDefined();
+    expect(r.body.summary.total).toBe(1);
+  });
+
+  test("alias narrows the light projection too", async () => {
+    const r = await get(aToken, `/api/status?light=1&network_id=${NET_A}&alias=sa-three`);
+    expect(aliases(r.body.sessions)).toEqual(["sa-three"]);
+    expect(r.body.sessions[0].host).toBeUndefined();
+  });
+
+  test("the filter never widens scope: same alias in another network stays invisible", async () => {
+    const scoped = await get(aToken, `/api/status?network_id=${NET_A}&alias=sa-two`);
+    expect(scoped.body.sessions.map((s: any) => s.node_id)).toEqual(["node_sa_two"]);
+    // Unscoped: whatever the caller's scope already shows (the first registered user is an admin
+    // here, so that is both networks) — the filter only picks rows out of it, never adds any.
+    const all = await get(aToken, `/api/status`);
+    const unscoped = await get(aToken, `/api/status?alias=sa-two`);
+    expect(unscoped.body.sessions.map((s: any) => s.node_id)).toEqual(all.body.sessions.filter((s: any) => s.alias === "sa-two").map((s: any) => s.node_id));
+  });
+
+  test("a non-admin member only ever gets their own network's row for a shared alias", async () => {
+    const r = await get(bToken, `/api/status?alias=sa-two`);
+    expect(r.body.sessions.map((s: any) => s.node_id)).toEqual(["node_sa_two_b"]);
+    const other = await get(bToken, `/api/status?alias=sa-one`);
+    expect(other.body.sessions).toEqual([]);
+  });
+
+  test("blank alias is ignored; unknown alias is an empty list, not an error", async () => {
+    expect(aliases((await get(aToken, `/api/status?network_id=${NET_A}&alias=%20`)).body.sessions)).toEqual(["sa-one", "sa-two", "sa-three"]);
+    const none = await get(aToken, `/api/status?network_id=${NET_A}&alias=nobody`);
+    expect(none.status).toBe(200);
+    expect(none.body.sessions).toEqual([]);
+  });
+});

package/src/status-node-id-filter-http.test.ts

@@ -0,0 +1,161 @@
+// GET /api/status?node_id=<id> — one node's rows instead of the whole network.
+// Every agent-node resolves its own current alias every 30 s (CurrentAliasResolver). Unfiltered that
+// is the whole network's full projection (~91 KB gzip per call on production, ~90 nodes ⇒ ~3 req/s)
+// to read one row. This suite pins that the filter narrows, never widens (it is exactly the caller's
+// unfiltered rows with that node_id, for every kind of caller), that it combines with light=1 (which
+// then carries node_id so the caller can check the row is its own), that an unknown id is an empty
+// list rather than an error, that no/blank node_id is byte-identical to the old response, and that
+// /health advertises it.
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-status-node-id-"));
+let BASE = "";
+let hub: any = null;
+const PW = "StatusNodeIdPassw0rd!";
+let aToken = "", aId = "", NET_A = "";
+let bToken = "", bId = "", NET_B = "";
+let nodeToken = "";
+
+async function raw(token: string | null, path: string) {
+  const res = await fetch(`${BASE}${path}`, { headers: token ? { Authorization: `Bearer ${token}` } : {} });
+  return { status: res.status, text: await res.text() };
+}
+async function get(token: string, path: string) {
+  const r = await raw(token, path);
+  return { status: r.status, body: JSON.parse(r.text) as any };
+}
+function seed(alias: string, node: string, net: string, owner: string, minutesAgo: number) {
+  db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id) VALUES (?1, ?2, ?2, ?3, ?4)`, [node, alias, net, owner]);
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, node_id, status, network_id, task, updated_at, last_seen_at) VALUES (?1, ?2, ?3, 'idle', ?4, ?5, datetime('now', ?6), datetime('now'))`,
+    [`r_${node}`, alias, node, net, `task of ${alias}`, `-${minutesAgo} minutes`],
+  );
+}
+const nodeIds = (rows: any[]) => rows.map(r => r.node_id);
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`sn_owner_a_${Date.now()}`, PW);
+  aToken = a.token!; aId = a.user!.user_id; NET_A = a.network_id!;
+  const b = register(`sn_owner_b_${Date.now()}`, PW);
+  bToken = b.token!; bId = b.user!.user_id; NET_B = b.network_id!;
+  seed("sn-one", "node_sn_one", NET_A, aId, 1);
+  seed("sn-two", "node_sn_two", NET_A, aId, 2);
+  seed("sn-three", "node_sn_three", NET_A, aId, 3);
+  seed("sn-b-only", "node_sn_b_only", NET_B, bId, 0);
+  const minted = createNetworkTokenForNode(aId, NET_A, "sn-two", "node_sn_two");
+  nodeToken = minted.token!;
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("/api/status?node_id=", () => {
+  test("node_id narrows the full projection to that node", async () => {
+    const r = await get(aToken, `/api/status?network_id=${NET_A}&node_id=node_sn_two`);
+    expect(r.status).toBe(200);
+    expect(nodeIds(r.body.sessions)).toEqual(["node_sn_two"]);
+    expect(r.body.sessions[0].alias).toBe("sn-two");
+    expect(typeof r.body.sessions[0].rules_file_capable).toBe("boolean");
+    expect(r.body.sessions[0].host).toBeDefined();
+    expect(r.body.summary.total).toBe(1);
+  });
+
+  test("combines with light=1: light projection, one row, and it carries node_id", async () => {
+    const r = await get(aToken, `/api/status?light=1&network_id=${NET_A}&node_id=node_sn_three`);
+    expect(r.status).toBe(200);
+    expect(r.body.sessions).toHaveLength(1);
+    expect(r.body.sessions[0].alias).toBe("sn-three");
+    expect(r.body.sessions[0].node_id).toBe("node_sn_three");
+    expect(r.body.sessions[0].host).toBeUndefined();
+    expect(Object.keys(r.body.sessions[0]).sort()).toEqual(
+      ["agent", "alias", "network_id", "node_id", "runtime", "server", "status", "task", "updated_at"],
+    );
+  });
+
+  test("unknown id is an empty list with 200, not a 404", async () => {
+    for (const path of [`/api/status?network_id=${NET_A}&node_id=node_nobody`, `/api/status?light=1&node_id=node_nobody`]) {
+      const r = await get(aToken, path);
+      expect(r.status).toBe(200);
+      expect(r.body.ok).toBe(true);
+      expect(r.body.sessions).toEqual([]);
+      expect(r.body.summary.total).toBe(0);
+    }
+  });
+
+  test("absent or blank node_id: response bytes identical to the old read (full and light)", async () => {
+    for (const base of [`/api/status?network_id=${NET_A}`, `/api/status?light=1&network_id=${NET_A}`, `/api/status`]) {
+      const plain = await raw(aToken, base);
+      const blank = await raw(aToken, `${base}${base.includes("?") ? "&" : "?"}node_id=%20`);
+      expect(plain.status).toBe(200);
+      expect(blank.text).toBe(plain.text);
+    }
+    // the light rows without the param never gained a node_id field
+    const light = await get(aToken, `/api/status?light=1&network_id=${NET_A}`);
+    expect(light.body.sessions.length).toBe(3);
+    for (const s of light.body.sessions) expect("node_id" in s).toBe(false);
+  });
+
+  test("never widens: for every caller, filtered == that caller's unfiltered rows with that node_id", async () => {
+    const callers = [aToken, bToken, nodeToken];
+    const ids = ["node_sn_one", "node_sn_two", "node_sn_three", "node_sn_b_only", "node_nobody"];
+    for (const tok of callers) {
+      const full = await get(tok, `/api/status`);
+      expect(full.status).toBe(200);
+      for (const id of ids) {
+        const one = await get(tok, `/api/status?node_id=${id}`);
+        expect(one.status).toBe(full.status);
+        expect(one.body.sessions).toEqual(full.body.sessions.filter((s: any) => s.node_id === id));
+      }
+    }
+  });
+
+  test("a member of another network gets nothing for a node outside their network", async () => {
+    const r = await get(bToken, `/api/status?node_id=node_sn_one`);
+    expect(r.status).toBe(200);
+    expect(r.body.sessions).toEqual([]);
+    const own = await get(bToken, `/api/status?node_id=node_sn_b_only`);
+    expect(nodeIds(own.body.sessions)).toEqual(["node_sn_b_only"]);
+  });
+
+  test("a node token reads its own row (light) and nothing from another network", async () => {
+    const own = await get(nodeToken, `/api/status?light=1&node_id=node_sn_two`);
+    expect(own.status).toBe(200);
+    expect(own.body.sessions.map((s: any) => [s.node_id, s.alias])).toEqual([["node_sn_two", "sn-two"]]);
+    const foreign = await get(nodeToken, `/api/status?light=1&node_id=node_sn_b_only`);
+    expect(foreign.status).toBe(200);
+    expect(foreign.body.sessions).toEqual([]);
+    // explicit other network_id is refused exactly as without the filter
+    const cross = await raw(nodeToken, `/api/status?network_id=${NET_B}&node_id=node_sn_b_only`);
+    const crossNoFilter = await raw(nodeToken, `/api/status?network_id=${NET_B}`);
+    expect(cross.status).toBe(crossNoFilter.status);
+    if (cross.status !== 200) expect(cross.text).toBe(crossNoFilter.text);
+    else expect(JSON.parse(cross.text).sessions).toEqual([]);
+  });
+
+  test("unauthenticated read is refused exactly as without the filter", async () => {
+    const withFilter = await raw(null, `/api/status?node_id=node_sn_one`);
+    const without = await raw(null, `/api/status`);
+    expect(withFilter.status).toBe(without.status);
+    expect(withFilter.text).toBe(without.text);
+  });
+
+  test("/health advertises status_node_id", async () => {
+    const r = await raw(null, `/health`);
+    expect(r.status).toBe(200);
+    expect(JSON.parse(r.text).capabilities).toContain("status_node_id");
+  });
+});