@sleep2agi/commhub-server 0.9.0-preview.80 → 0.9.0-preview.82

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.80",
+  "version": "0.9.0-preview.82",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/project-viewer-can-http.test.ts

@@ -0,0 +1,114 @@
+// GET /api/requirements/projects 的每行 viewer_can.edit(app 任务页审计 L13)—— HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。
+//
+// 客户端据此只在新建 / 挪卡的项目下拉里列「能编辑」的项目。判据必须与真写卡时一致,所以这里对每个项目
+// 都真建一张卡,断言「viewer_can.edit === 建卡成功」,而不是另抄一份规则来比。
+//   admin —— Hub 管理员 + 网络 owner:未归档项目全 true,归档的 false(projectRef 拒归档)
+//   alice —— scoped 成员:P1 只看 → false,P2 可改 → true(只列得到这两个)
+//   carol —— task_access='all' 的成员:未归档全 true
+//   vic   —— scoped viewer,P3 只看:false(viewer 本来就不能写卡)
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-project-viewer-can-"));
+let BASE = "";
+let hub: any = null;
+const PW = "ProjViewerCanPassw0rd!x";
+let NET = "";
+const U: Record<string, { token: string; id: string }> = {};
+const P: Record<string, string> = {};
+
+type R = { status: number; body: any };
+async function send(token: string, method: string, path: string, payload?: unknown): Promise<R> {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), "Content-Type": "application/json" },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let body: any = null;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+const projects = async (who: string) => {
+  const r = await send(U[who].token, "GET", `/api/requirements/projects?network_id=${NET}`);
+  expect(r.status).toBe(200);
+  return Object.fromEntries((r.body.projects as any[]).map((p) => [p.name, p]));
+};
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`pvc_admin_${Date.now()}`, PW, undefined, "Admin");
+  expect(a.ok).toBe(true);
+  U.admin = { token: a.token!, id: a.user!.user_id };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [U.admin.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+
+  const mk = async (username: string, role: string) => {
+    expect((await send(U.admin.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role })).status).toBe(200);
+    const login = await send("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string };
+  };
+  const stamp = Date.now();
+  U.alice = await mk(`pvc_alice_${stamp}`, "member");
+  U.carol = await mk(`pvc_carol_${stamp}`, "member");
+  U.vic = await mk(`pvc_vic_${stamp}`, "viewer");
+  db.run("UPDATE network_members SET task_access = 'all' WHERE network_id = ?1 AND user_id = ?2", [NET, U.carol.id]);
+
+  for (const name of ["pvc-P1", "pvc-P2", "pvc-P3", "pvc-P4"]) {
+    const r = await send(U.admin.token, "POST", "/api/requirements/projects", { network_id: NET, name });
+    expect(r.status).toBe(201);
+    P[name] = r.body.project.id;
+  }
+  expect((await send(U.admin.token, "PATCH", `/api/requirements/projects/${P["pvc-P4"]}?network_id=${NET}`, { archived: true })).status).toBe(200);
+  expect((await send(U.admin.token, "PUT", `/api/networks/${NET}/members/${U.alice.id}/task-grants`, { task_access: "scoped", project_grants: [{ project_id: P["pvc-P1"] }, { project_id: P["pvc-P2"], can_edit: true }] })).status).toBe(200);
+  expect((await send(U.admin.token, "PUT", `/api/networks/${NET}/members/${U.vic.id}/task-grants`, { task_access: "scoped", project_grants: [P["pvc-P3"]] })).status).toBe(200);
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/requirements/projects 的 viewer_can.edit", () => {
+  test("每个调用者的取值", async () => {
+    const edit = (rows: Record<string, any>) => Object.fromEntries(Object.entries(rows).map(([n, p]) => [n, p.viewer_can?.edit]));
+    expect(edit(await projects("admin"))).toEqual({ "pvc-P1": true, "pvc-P2": true, "pvc-P3": true, "pvc-P4": false });
+    expect(edit(await projects("carol"))).toEqual({ "pvc-P1": true, "pvc-P2": true, "pvc-P3": true, "pvc-P4": false });
+    expect(edit(await projects("alice"))).toEqual({ "pvc-P1": false, "pvc-P2": true });
+    expect(edit(await projects("vic"))).toEqual({ "pvc-P3": false });
+  });
+
+  test("只加字段:其余键与之前逐字相同", async () => {
+    const row = (await projects("alice"))["pvc-P2"];
+    expect(Object.keys(row).sort()).toEqual(["archived", "color", "createdAt", "id", "name", "sort", "viewer_can"]);
+    expect(Object.keys(row.viewer_can)).toEqual(["edit"]);
+  });
+
+  test("与真写卡一致:edit === 往这个项目建卡成功", async () => {
+    let checked = 0;
+    for (const who of ["admin", "carol", "alice", "vic"]) {
+      for (const [name, p] of Object.entries(await projects(who))) {
+        const r = await send(U[who].token, "POST", "/api/requirements", { network_id: NET, name: `pvc-card-${who}-${name}`, project_id: p.id });
+        expect({ who, name, created: r.status === 201 }).toEqual({ who, name, created: p.viewer_can.edit });
+        checked++;
+      }
+    }
+    expect(checked).toBe(11);
+  });
+
+  test("授权改成可编辑后立即反映", async () => {
+    expect((await send(U.admin.token, "PUT", `/api/networks/${NET}/members/${U.alice.id}/task-grants`, { project_grants: [{ project_id: P["pvc-P1"], can_edit: true }, { project_id: P["pvc-P2"], can_edit: true }] })).status).toBe(200);
+    expect((await projects("alice"))["pvc-P1"].viewer_can.edit).toBe(true);
+  });
+});

package/src/requirements.ts

@@ -9,7 +9,7 @@ import { aggregateStats, parseStatsQuery, type StatsRow } from "./requirements-s
 import { addHumanNetworkScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, resolveRestWriteNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { isAgentRestricted, restrictedNetworkIds, visibleAgents } from "./agent-access.js";
 import {
-  addProjectVisibilityScope, addTaskVisibilityScope, canDeleteTask, canEditTask, canParticipantEditTask, canSeeTask, canUseProject, deleteTaskGrantsForProject,
+  addProjectVisibilityScope, addTaskVisibilityScope, canDeleteTask, canEditTask, canParticipantEditTask, canSeeTask, canUseProject, deleteTaskGrantsForProject, projectUseResolver,
   isTaskScoped, PARTICIPANT_EDIT_FIELDS, shouldAuditDenied, taskPermissionsResolver, type TaskCaller,
 } from "./task-access.js";
 import { notifyParticipantChange } from "./requirement-notify.js";
@@ -278,7 +278,11 @@ async function handleProjects(ctx: RequirementsRequestContext): Promise<Response
     const projectParams: unknown[] = [networkId];
     const projectSql = addProjectVisibilityScope(`SELECT ${PROJECT_SELECT} FROM requirement_projects WHERE network_id = ?1`, projectParams, taskCaller(ctx), networkId);
     const rows = db.all<ProjectRow>(`${projectSql} ORDER BY sort, created_at`, ...projectParams);
-    return Response.json({ ok: true, projects: rows.map(projectPublic) });
+    // viewer_can.edit:调用者能不能把卡建进 / 挪进这个项目 —— 与 POST / PATCH 卡片同一套判据
+    // (canWrite + projectRef 拒归档 + canUseProject)。只加字段;客户端据此只列能编辑的项目(app 任务页审计 L13)。
+    const writable = canWrite(ctx, networkId);
+    const canUse = projectUseResolver(taskCaller(ctx), networkId);
+    return Response.json({ ok: true, projects: rows.map((row) => ({ ...projectPublic(row), viewer_can: { edit: writable && !row.archived && canUse(row.project_id) } })) });
   }
   if (!canWrite(ctx, networkId)) return jsonError("permission_denied", 403);
   // 项目管理(建 / 改名 / 归档 / 删)只给不受任务范围限制的人。

package/src/server.ts

@@ -1,5 +1,6 @@
 import { buildServeErrorResponse } from "./serve-error.js";
 import { maybeGzipResponse, trimLightTask } from "./http-gzip";
+import { statusAliasResolverRead } from "./status-alias-resolver.js";
 import { redactMessageRow } from "./redact-tokens.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
@@ -2207,11 +2208,19 @@ return Bun.serve({
       // take 12s+ on flaky cellular (Vincent tg, #220 PWA). Default response
       // is unchanged so the dashboard / scripts that read full telemetry are
       // unaffected.
-      const isLight = url.searchParams.get("light") === "1";
       const nodeIdFilter = url.searchParams.get("node_id")?.trim();
+      // agent-node < 2.5.0-preview.93 resolves its own alias every 30 s with the WHOLE network's full projection
+      // (~93 KB gzip on production) and reads only sessions[].node_id / .alias — under a hard 2.5 s abort. Over the
+      // RELAY frp tunnel to a China-side machine (~50 KB/s per connection) the body often isn't done in 2.5 s: the
+      // node aborts, the Hub has already pushed the body into the tunnel and frps drops it (~60% of the tunnel,
+      // 2026-10-01). That caller has an exact signature no other client sends (statusAliasResolverRead): give it
+      // the light projection + node_id (~28 KB gzip), which is all it reads. `?full=1` always gets the full body.
+      const aliasResolverRead = statusAliasResolverRead(url.searchParams, requestToken(req), req.headers.get("accept"));
+      const isLight = url.searchParams.get("light") === "1" || aliasResolverRead;
+      const withNodeId = !!nodeIdFilter || aliasResolverRead;
       const params: any[] = [];
       let sql = isLight
-        ? `SELECT alias, status, agent, task, server, updated_at, network_id${nodeIdFilter ? ", node_id" : ""} FROM sessions WHERE 1=1`
+        ? `SELECT alias, status, agent, task, server, updated_at, network_id${withNodeId ? ", node_id" : ""} FROM sessions WHERE 1=1`
         : `SELECT ${SESSION_REST_SELECT} FROM sessions WHERE 1=1`;
       sql = addAgentNetworkScope(sql, params, restScope, { alias: "alias", nodeId: "node_id" });
       // `?alias=<name>` narrows to that one agent's rows (same projection, same scope). The app's
@@ -2249,8 +2258,9 @@ return Bun.serve({
             updated_at: s.updated_at ?? null,
             runtime: normalizeRuntime(s.agent),
             network_id: s.network_id ?? null,
-            // Only when filtering by node_id, so the unfiltered light response keeps its exact bytes.
-            ...(nodeIdFilter ? { node_id: s.node_id ?? null } : {}),
+            // Only when filtering by node_id (or for the old alias resolver), so the unfiltered light response
+            // keeps its exact bytes.
+            ...(withNodeId ? { node_id: s.node_id ?? null } : {}),
           };
         }
         const externalSchedules = (() => {
@@ -2296,7 +2306,9 @@ return Bun.serve({
         else acc.idle++;
         return acc;
       }, { idle: 0, working: 0, offline: 0, total: sessions.length });
-      return withCors(req, Response.json({ ok: true, sessions, summary }));
+      const res = Response.json({ ok: true, sessions, summary });
+      if (aliasResolverRead) res.headers.set("X-Status-Projection", "alias-resolver");
+      return withCors(req, res);
     }
 
     // ── REST: aggregate agents by physical server ──

package/src/status-alias-resolver-http.test.ts

@@ -0,0 +1,163 @@
+// 旧版 agent-node(< 2.5.0-preview.93)找自己别名的全量 /api/status 读法 → light 投影 + node_id。
+//
+// 背景(2026-10-01,app「连接较慢」#431):生产上约 2.3 次/秒的全量状态读(~93 KB gzip)几乎都来自旧节点的
+// CurrentAliasResolver,它只读 sessions[].node_id / .alias,且 2.5 s 硬超时。经 RELAY frp 隧道到国内机器时常常
+// 读不完就中止,Hub 已经推进隧道的字节被丢掉(约占隧道 60%)。这里钉住:
+//   - 签名只认「节点令牌 + Accept 恰好 application/json + 只有 network_id」(statusAliasResolverRead);
+//   - 命中时回 light + node_id,旧解析器照旧解析出别名(含改名之后);
+//   - 不命中的(用户令牌 / CLI 不带 Accept / 浏览器 */* / light / node_id / alias / full=1 / 多值 Accept)字节不变;
+//   - 量体积:同一批行,完整投影 vs 这条读法的 gzip 字节。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { gzipSync } from "zlib";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+import { statusAliasResolverRead } from "./status-alias-resolver.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-status-alias-resolver-"));
+let BASE = "";
+let hub: any = null;
+const PW = "StatusAliasResolverPassw0rd!";
+let userToken = "", userId = "", NET = "";
+let nodeToken = "";
+const ROWS = 120;
+
+function seed(i: number) {
+  const node = `node_sar_${i}`, alias = `sar-${i}`;
+  db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id) VALUES (?1, ?2, ?2, ?3, ?4)`, [node, alias, NET, userId]);
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, node_id, status, network_id, task, output, project_dir, config_path, hostname, ip, server, agent, version,
+       cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb,
+       process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, updated_at, last_seen_at, registered_at)
+     VALUES (?1, ?2, ?3, 'idle', ?4, ?5, ?6, ?7, ?8, ?9, '10.0.0.' || ?10, ?9, 'agent-node:codex-app-server', '2.5.0-preview.88',
+       '1.5', '8', '61.4', '26.9', '34.5', '491.8', '442.2', '29.4', 121868288, 116.2, 0.2, 292866, 0,
+       datetime('now', '-' || ?10 || ' seconds'), datetime('now'), datetime('now', '-30 days'))`,
+    [`r_${node}`, alias, node, NET, `示例任务 ${i}:`.repeat(12), `示例输出 ${i} `.repeat(20), `/home/user/project-${i}`,
+      `/home/user/project-${i}/.anet/nodes/${alias}/config.json`, `sample-host-${i % 4}`, i],
+  );
+}
+
+async function req(path: string, headers: Record<string, string>) {
+  const res = await fetch(`${BASE}${path}`, { headers: { "Accept-Encoding": "gzip", ...headers } });
+  const text = await res.text();
+  return { status: res.status, text, body: JSON.parse(text) as any, projection: res.headers.get("x-status-projection") };
+}
+const asNode = (accept?: string) => ({ Authorization: `Bearer ${nodeToken}`, ...(accept !== undefined ? { Accept: accept } : {}) });
+const gz = (s: string) => gzipSync(Buffer.from(s)).length;
+
+// The exact call agent-node 2.5.0-preview.32 … .90 makes (dist/cli.js CurrentAliasResolver.fetchCanonicalAlias).
+async function oldResolver(nodeId: string, token: string, networkId: string): Promise<string | null> {
+  try {
+    const headers: Record<string, string> = { Accept: "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const url = `${BASE}/api/status${networkId ? `?network_id=${encodeURIComponent(networkId)}` : ""}`;
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), 2500);
+    try {
+      const res = await fetch(url, { headers, signal: ctl.signal });
+      if (!res.ok) return null;
+      const body = (await res.json()) as { sessions?: Array<{ node_id?: string; alias?: string }> };
+      return body.sessions?.find((s) => s.node_id === nodeId)?.alias ?? null;
+    } finally { clearTimeout(timer); }
+  } catch { return null; }
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`sar_owner_${Date.now()}`, PW);
+  userToken = a.token!; userId = a.user!.user_id; NET = a.network_id!;
+  for (let i = 0; i < ROWS; i++) seed(i);
+  nodeToken = createNetworkTokenForNode(userId, NET, "sar-7", "node_sar_7").token!;
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("statusAliasResolverRead (signature)", () => {
+  const p = (q: string) => new URLSearchParams(q);
+  test("matches only node token + Accept exactly application/json + at most network_id", () => {
+    expect(statusAliasResolverRead(p(""), "ntok_x", "application/json")).toBe(true);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", "application/json")).toBe(true);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", " Application/JSON ")).toBe(true);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "utok_x", "application/json")).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "legacy-global-token", "application/json")).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", null)).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", "*/*")).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", "application/json, text/plain, */*")).toBe(false);
+    for (const q of ["light=1", "node_id=n", "alias=a", "full=1", "network_id=n&full=1", "network_id=n&light=0"]) {
+      expect(statusAliasResolverRead(p(q), "ntok_x", "application/json")).toBe(false);
+    }
+  });
+});
+
+describe("GET /api/status for the old alias resolver", () => {
+  test("old resolver still resolves its alias from the light body", async () => {
+    expect(await oldResolver("node_sar_7", nodeToken, NET)).toBe("sar-7");
+    expect(await oldResolver("node_sar_7", nodeToken, "")).toBe("sar-7");
+    // other rows are resolvable too (the resolver can be asked about a renamed peer id) and an unknown id is null
+    expect(await oldResolver("node_sar_42", nodeToken, NET)).toBe("sar-42");
+    expect(await oldResolver("node_nobody", nodeToken, NET)).toBeNull();
+  });
+
+  test("…and follows a rename (the reason the resolver exists)", async () => {
+    db.run("UPDATE sessions SET alias = 'sar-7-renamed' WHERE node_id = 'node_sar_7'");
+    try {
+      expect(await oldResolver("node_sar_7", nodeToken, NET)).toBe("sar-7-renamed");
+    } finally {
+      db.run("UPDATE sessions SET alias = 'sar-7' WHERE node_id = 'node_sar_7'");
+    }
+  });
+
+  test("the body is the light projection plus node_id, marked by a header", async () => {
+    const r = await req(`/api/status?network_id=${NET}`, asNode("application/json"));
+    expect(r.status).toBe(200);
+    expect(r.projection).toBe("alias-resolver");
+    expect(r.body.sessions).toHaveLength(ROWS);
+    expect(Object.keys(r.body.sessions[0]).sort()).toEqual(["agent", "alias", "network_id", "node_id", "runtime", "server", "status", "task", "updated_at"]);
+    expect(r.body.summary.total).toBe(ROWS);
+  });
+
+  test("everything else is byte-identical to the full projection", async () => {
+    const full = await req(`/api/status?network_id=${NET}&full=1`, asNode("application/json"));
+    expect(full.projection).toBeNull();
+    expect(full.body.sessions[0].host).toBeDefined();
+    const same = [
+      await req(`/api/status?network_id=${NET}`, { Authorization: `Bearer ${userToken}`, Accept: "application/json" }), // user token (app / dashboard)
+      await req(`/api/status?network_id=${NET}`, asNode()),                                                          // anet CLI: authHeaders() only
+      await req(`/api/status?network_id=${NET}`, asNode("*/*")),                                                     // browser / undici / bun default
+      await req(`/api/status?network_id=${NET}`, asNode("application/json, text/plain, */*")),
+    ];
+    for (const r of same) {
+      expect(r.projection).toBeNull();
+      expect(r.body.sessions[0].host).toBeDefined();
+      expect(r.text).toBe(full.text);
+    }
+  });
+
+  test("light / node_id reads keep their own exact shape", async () => {
+    const light = await req(`/api/status?network_id=${NET}&light=1`, asNode("application/json"));
+    expect(light.projection).toBeNull();
+    expect(light.body.sessions[0].node_id).toBeUndefined();
+    const one = await req(`/api/status?network_id=${NET}&node_id=node_sar_7&light=1`, asNode("application/json"));
+    expect(one.body.sessions).toHaveLength(1);
+    expect(one.body.sessions[0].node_id).toBe("node_sar_7");
+  });
+
+  test("size: full projection vs the alias-resolver body (gzip)", async () => {
+    const full = await req(`/api/status?network_id=${NET}&full=1`, asNode("application/json"));
+    const slim = await req(`/api/status?network_id=${NET}`, asNode("application/json"));
+    const f = gz(full.text), s = gz(slim.text);
+    console.log(`[size] ${ROWS} rows: full ${full.text.length} B raw / ${f} B gzip → alias-resolver ${slim.text.length} B raw / ${s} B gzip (${Math.round(100 - (100 * s) / f)}% smaller)`);
+    expect(s).toBeLessThan(f / 2);
+  });
+});

package/src/status-alias-resolver.ts

@@ -0,0 +1,19 @@
+// GET /api/status 的「旧版 agent-node 找自己别名」读法识别(纯函数,可单测)。
+//
+// agent-node < 2.5.0-preview.93 的 CurrentAliasResolver 每 30 s 读一次全网完整 /api/status,只用
+// sessions[].node_id / .alias,并且 2.5 s 硬超时。它的请求有一个别的客户端都不发的签名(2026-10-01 逐个核过
+// 线上在用的 agent-node .32–.93 包、agent-network CLI 2.2.21 / 2.3.0-preview.76–.120 源码、dashboard、
+// claude-code 节点的 .anet/node-server.js):
+//   - 节点令牌(ntok_);
+//   - Accept 恰好是 `application/json`(CLI 的 authHeaders 只带 Authorization;浏览器 / undici / bun 默认 `*/*`);
+//   - 查询串里除了 network_id 什么都没有(不带 light / node_id / alias / full)。
+// 命中 ⇒ 回 light 投影 + node_id(它读的就这两列)。`?full=1` 永远拿完整投影。
+
+const ALLOWED_PARAMS = new Set(["network_id"]);
+
+export function statusAliasResolverRead(params: URLSearchParams, token: string, accept: string | null): boolean {
+  if (!token.startsWith("ntok_")) return false;
+  if ((accept ?? "").trim().toLowerCase() !== "application/json") return false;
+  for (const key of params.keys()) if (!ALLOWED_PARAMS.has(key)) return false;
+  return true;
+}

package/src/task-access.ts

@@ -192,6 +192,16 @@ export function taskPermissionsResolver(caller: TaskCaller): (row: CardRow) => T
   };
 }
 
+/**
+ * 项目列表的 viewer_can.edit 用:与 canUseProject 同一判据,但一个请求里只读一次授权表(列表最多 200 个项目)。
+ * 不受任务范围限制的调用者(节点 / Hub 管理员 / owner / admin / task_access='all')⇒ 每个项目都 true。
+ */
+export function projectUseResolver(caller: TaskCaller, networkId: string): (projectId: string) => boolean {
+  if (!caller || !isTaskScoped(caller.userId, networkId)) return () => true;
+  const editable = new Set(listProjectGrants(networkId, caller.userId).filter((g) => g.can_edit).map((g) => g.project_id));
+  return (projectId) => editable.has(projectId);
+}
+
 /** 新建 / 挪卡时的目标项目:scoped 成员只能放进自己 can_edit 的项目(null = 不放项目,总是可以)。 */
 export function canUseProject(caller: TaskCaller, networkId: string, projectId: string | null): boolean {
   if (!caller || !projectId) return true;