@sleep2agi/commhub-server 0.9.0-preview.81 → 0.9.0-preview.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.81",
+  "version": "0.9.0-preview.83",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/agent-access.ts

@@ -475,4 +475,9 @@ export const RESTRICTED_MEMBER_TOOLS: ReadonlySet<string> = new Set([
   "requirements_checklist_toggle",
   "requirements_upsert_by_external_ref",
   "projects_list",
+  // 2026-10-02(app 任务页审计 M3):和 app「管理项目」/「动态」同一个 REST 处理,权限也同一套 —— 项目管理对仅相关任务的
+  // 成员和 viewer 一律 403;动态按任务可见性过滤,受限成员看不见的节点在里面隐去(listEvents 的 hiddenNodeFilter)。
+  "projects_create",
+  "projects_update",
+  "requirements_events",
 ]);

package/src/mcp-projects-events-http.test.ts

@@ -0,0 +1,162 @@
+// MCP projects_create / projects_update / requirements_events(app 任务页审计 2026-10-02 M3:Agent 能做人能做的)。
+// HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。三个工具都走 app 用的同一套 REST 处理(handleRequirementsRequest),
+// 所以这里不另抄一份权限规则:对每类调用者(网络 owner、全部任务成员、仅相关任务成员、viewer、节点令牌)都同时调
+// MCP 和 REST,断言状态码 / 结果逐项一致。再钉住正向行为(建 / 改名 / 归档 / 取消归档、读流水、"#N")和工具出现在 tools/list 里。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-mcp-projects-events-"));
+let BASE = "";
+let hub: any = null;
+const PW = "McpProjectsEventsPassw0rd!x";
+let NET = "";
+const U: Record<string, { token: string; id: string }> = {};
+
+async function rest(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, { method, headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body) });
+  const text = await res.text();
+  let json: any = null;
+  try { json = JSON.parse(text); } catch {}
+  return { status: res.status, body: json };
+}
+async function rpc(token: string, method: string, params?: unknown): Promise<any> {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, ...(params === undefined ? {} : { params }) }),
+  });
+  const raw = await res.text();
+  const lines = raw.split("\n").filter(x => x.startsWith("data:"));
+  return lines.length ? JSON.parse(lines.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+}
+async function mcp(token: string, name: string, args: Record<string, unknown>): Promise<any> {
+  const out = await rpc(token, "tools/call", { name, arguments: args });
+  return JSON.parse(out.result.content[0].text);
+}
+// MCP error bodies from the REST handler carry its status (requirementsCall). Anything else that isn't ok (e.g. a tool-level
+// gate) is NOT a success — a body without `status` must never be read as the 2xx (that hid a gate in the first draft).
+const mcpStatus = (r: any, okStatus: number) => (r?.ok === true || (r && r.ok === undefined && (r.project || r.events)) ? okStatus : typeof r?.status === "number" ? r.status : -1);
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`mpe_owner_${Date.now()}`, PW, undefined, "Owner");
+  expect(a.ok).toBe(true);
+  U.owner = { token: a.token!, id: a.user!.user_id };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [U.owner.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  const mk = async (username: string, role: string) => {
+    expect((await rest(U.owner.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role })).status).toBe(200);
+    const login = await rest("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string };
+  };
+  const stamp = Date.now();
+  U.member = await mk(`mpe_member_${stamp}`, "member");
+  U.scoped = await mk(`mpe_scoped_${stamp}`, "member");
+  U.viewer = await mk(`mpe_viewer_${stamp}`, "viewer");
+  db.run("UPDATE network_members SET task_access = 'all' WHERE network_id = ?1 AND user_id = ?2", [NET, U.member.id]);
+  expect((await rest(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.scoped.id}/task-grants`, { task_access: "scoped", project_grants: [] })).status).toBe(200);
+  const node = createNetworkTokenForNode(U.owner.id, NET, "mpe-node", "node_mpe");
+  U.node = { token: node.token!, id: "node_mpe" };
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("discoverable", () => {
+  test("tools/list carries the three tools with descriptions", async () => {
+    const list = await rpc(U.owner.token, "tools/list");
+    const byName = new Map((list.result.tools as any[]).map(t => [t.name, t]));
+    for (const n of ["projects_create", "projects_update", "requirements_events"]) {
+      expect(byName.has(n)).toBe(true);
+      expect(String(byName.get(n).description).length).toBeGreaterThan(40);
+    }
+    expect(String(byName.get("projects_list").description)).toContain("projects_create");
+  });
+});
+
+describe("projects_create / projects_update", () => {
+  test("owner: create, rename, recolour, archive, unarchive — same rows the app sees", async () => {
+    const created = await mcp(U.owner.token, "projects_create", { network_id: NET, name: "mpe-项目甲" });
+    expect(created.ok).toBe(true);
+    const id = created.project.id as string;
+    expect(created.project.name).toBe("mpe-项目甲");
+    const renamed = await mcp(U.owner.token, "projects_update", { network_id: NET, id, name: "mpe-项目乙", color: "#16a34a" });
+    expect(renamed.project.name).toBe("mpe-项目乙");
+    expect(renamed.project.color).toBe("#16a34a");
+    expect((await mcp(U.owner.token, "projects_update", { network_id: NET, id, archived: true })).project.archived).toBe(true);
+    const seen = await rest(U.owner.token, "GET", `/api/requirements/projects?network_id=${NET}`);
+    expect(seen.body.projects.find((p: any) => p.id === id).archived).toBe(true);
+    expect((await mcp(U.owner.token, "projects_update", { network_id: NET, id, archived: false })).project.archived).toBe(false);
+  });
+
+  test("validation comes from the REST handler: duplicate name 409, unknown id 404", async () => {
+    await mcp(U.owner.token, "projects_create", { network_id: NET, name: "mpe-重名" });
+    const dup = await mcp(U.owner.token, "projects_create", { network_id: NET, name: "mpe-重名" });
+    expect(dup.ok).toBe(false);
+    expect(dup.status).toBe(409);
+    const missing = await mcp(U.owner.token, "projects_update", { network_id: NET, id: "proj_nobody", name: "x" });
+    expect(missing.status).toBe(404);
+  });
+
+  test("permission parity with the app's REST path, for every kind of caller", async () => {
+    const results: Record<string, { mcp: number; rest: number }> = {};
+    for (const who of ["owner", "member", "scoped", "viewer", "node"]) {
+      const name = `mpe-parity-${who}`;
+      const viaMcp = await mcp(U[who].token, "projects_create", { network_id: NET, name: `${name}-mcp` });
+      const viaRest = await rest(U[who].token, "POST", `/api/requirements/projects?network_id=${NET}`, { name: `${name}-rest` });
+      results[who] = { mcp: mcpStatus(viaMcp, 201), rest: viaRest.status };
+    }
+    for (const r of Object.values(results)) expect(r.mcp).toBe(r.rest);
+    // the rule itself (RFC-038 §9): task-scoped members and viewers can't manage projects; the others can
+    expect(results.owner.rest).toBe(201);
+    expect(results.member.rest).toBe(201);
+    expect(results.scoped.rest).toBe(403);
+    expect(results.viewer.rest).toBe(403);
+  });
+});
+
+describe("requirements_events", () => {
+  test("one task's timeline by id and by #N, same rows as GET /api/requirements/events", async () => {
+    const card = await rest(U.owner.token, "POST", "/api/requirements", { network_id: NET, name: "mpe-流水示例" });
+    expect(card.status).toBe(201);
+    const id = card.body.requirement.id as string, seq = card.body.requirement.seq as number;
+    expect((await rest(U.owner.token, "PATCH", `/api/requirements/${id}?network_id=${NET}`, { priority: "high" })).status).toBe(200);
+    const viaMcp = await mcp(U.owner.token, "requirements_events", { network_id: NET, requirement_id: id });
+    const viaRest = await rest(U.owner.token, "GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`);
+    expect(viaMcp.ok).toBe(true);
+    expect(viaMcp.events.length).toBeGreaterThan(0);
+    expect(viaMcp.events.map((e: any) => e.id)).toEqual(viaRest.body.events.map((e: any) => e.id));
+    expect(viaMcp.events.every((e: any) => e.requirement_id === id)).toBe(true);
+    const bySeq = await mcp(U.owner.token, "requirements_events", { network_id: NET, requirement_id: `#${seq}` });
+    expect(bySeq.events.map((e: any) => e.id)).toEqual(viaMcp.events.map((e: any) => e.id));
+    // paging / bad input come from the REST handler too
+    expect((await mcp(U.owner.token, "requirements_events", { network_id: NET, since: "not-a-date" })).status).toBe(400);
+    expect((await mcp(U.owner.token, "requirements_events", { network_id: NET, requirement_id: "#999999" })).status).toBe(404);
+  });
+
+  test("visibility parity: a task-scoped member doesn't get events for a task they can't see", async () => {
+    const hidden = await rest(U.owner.token, "POST", "/api/requirements", { network_id: NET, name: "mpe-看不见的" });
+    const id = hidden.body.requirement.id as string;
+    await rest(U.owner.token, "PATCH", `/api/requirements/${id}?network_id=${NET}`, { priority: "low" });
+    for (const who of ["scoped", "member", "node"]) {
+      const viaMcp = await mcp(U[who].token, "requirements_events", { network_id: NET, requirement_id: id });
+      const viaRest = await rest(U[who].token, "GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`);
+      expect((viaMcp.events ?? []).map((e: any) => e.id)).toEqual((viaRest.body?.events ?? []).map((e: any) => e.id));
+    }
+    expect((await mcp(U.scoped.token, "requirements_events", { network_id: NET, requirement_id: id })).events ?? []).toHaveLength(0);
+    expect((await mcp(U.member.token, "requirements_events", { network_id: NET, requirement_id: id })).events.length).toBeGreaterThan(0);
+  });
+});

package/src/server.ts

@@ -1,5 +1,6 @@
 import { buildServeErrorResponse } from "./serve-error.js";
 import { maybeGzipResponse, trimLightTask } from "./http-gzip";
+import { statusAliasResolverRead } from "./status-alias-resolver.js";
 import { redactMessageRow } from "./redact-tokens.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
@@ -2207,11 +2208,19 @@ return Bun.serve({
       // take 12s+ on flaky cellular (Vincent tg, #220 PWA). Default response
       // is unchanged so the dashboard / scripts that read full telemetry are
       // unaffected.
-      const isLight = url.searchParams.get("light") === "1";
       const nodeIdFilter = url.searchParams.get("node_id")?.trim();
+      // agent-node < 2.5.0-preview.93 resolves its own alias every 30 s with the WHOLE network's full projection
+      // (~93 KB gzip on production) and reads only sessions[].node_id / .alias — under a hard 2.5 s abort. Over the
+      // RELAY frp tunnel to a China-side machine (~50 KB/s per connection) the body often isn't done in 2.5 s: the
+      // node aborts, the Hub has already pushed the body into the tunnel and frps drops it (~60% of the tunnel,
+      // 2026-10-01). That caller has an exact signature no other client sends (statusAliasResolverRead): give it
+      // the light projection + node_id (~28 KB gzip), which is all it reads. `?full=1` always gets the full body.
+      const aliasResolverRead = statusAliasResolverRead(url.searchParams, requestToken(req), req.headers.get("accept"));
+      const isLight = url.searchParams.get("light") === "1" || aliasResolverRead;
+      const withNodeId = !!nodeIdFilter || aliasResolverRead;
       const params: any[] = [];
       let sql = isLight
-        ? `SELECT alias, status, agent, task, server, updated_at, network_id${nodeIdFilter ? ", node_id" : ""} FROM sessions WHERE 1=1`
+        ? `SELECT alias, status, agent, task, server, updated_at, network_id${withNodeId ? ", node_id" : ""} FROM sessions WHERE 1=1`
         : `SELECT ${SESSION_REST_SELECT} FROM sessions WHERE 1=1`;
       sql = addAgentNetworkScope(sql, params, restScope, { alias: "alias", nodeId: "node_id" });
       // `?alias=<name>` narrows to that one agent's rows (same projection, same scope). The app's
@@ -2249,8 +2258,9 @@ return Bun.serve({
             updated_at: s.updated_at ?? null,
             runtime: normalizeRuntime(s.agent),
             network_id: s.network_id ?? null,
-            // Only when filtering by node_id, so the unfiltered light response keeps its exact bytes.
-            ...(nodeIdFilter ? { node_id: s.node_id ?? null } : {}),
+            // Only when filtering by node_id (or for the old alias resolver), so the unfiltered light response
+            // keeps its exact bytes.
+            ...(withNodeId ? { node_id: s.node_id ?? null } : {}),
           };
         }
         const externalSchedules = (() => {
@@ -2296,7 +2306,9 @@ return Bun.serve({
         else acc.idle++;
         return acc;
       }, { idle: 0, working: 0, offline: 0, total: sessions.length });
-      return withCors(req, Response.json({ ok: true, sessions, summary }));
+      const res = Response.json({ ok: true, sessions, summary });
+      if (aliasResolverRead) res.headers.set("X-Status-Projection", "alias-resolver");
+      return withCors(req, res);
     }
 
     // ── REST: aggregate agents by physical server ──

package/src/status-alias-resolver-http.test.ts

@@ -0,0 +1,163 @@
+// 旧版 agent-node(< 2.5.0-preview.93)找自己别名的全量 /api/status 读法 → light 投影 + node_id。
+//
+// 背景(2026-10-01,app「连接较慢」#431):生产上约 2.3 次/秒的全量状态读(~93 KB gzip)几乎都来自旧节点的
+// CurrentAliasResolver,它只读 sessions[].node_id / .alias,且 2.5 s 硬超时。经 RELAY frp 隧道到国内机器时常常
+// 读不完就中止,Hub 已经推进隧道的字节被丢掉(约占隧道 60%)。这里钉住:
+//   - 签名只认「节点令牌 + Accept 恰好 application/json + 只有 network_id」(statusAliasResolverRead);
+//   - 命中时回 light + node_id,旧解析器照旧解析出别名(含改名之后);
+//   - 不命中的(用户令牌 / CLI 不带 Accept / 浏览器 */* / light / node_id / alias / full=1 / 多值 Accept)字节不变;
+//   - 量体积:同一批行,完整投影 vs 这条读法的 gzip 字节。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { gzipSync } from "zlib";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+import { statusAliasResolverRead } from "./status-alias-resolver.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-status-alias-resolver-"));
+let BASE = "";
+let hub: any = null;
+const PW = "StatusAliasResolverPassw0rd!";
+let userToken = "", userId = "", NET = "";
+let nodeToken = "";
+const ROWS = 120;
+
+function seed(i: number) {
+  const node = `node_sar_${i}`, alias = `sar-${i}`;
+  db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id) VALUES (?1, ?2, ?2, ?3, ?4)`, [node, alias, NET, userId]);
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, node_id, status, network_id, task, output, project_dir, config_path, hostname, ip, server, agent, version,
+       cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb,
+       process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, updated_at, last_seen_at, registered_at)
+     VALUES (?1, ?2, ?3, 'idle', ?4, ?5, ?6, ?7, ?8, ?9, '10.0.0.' || ?10, ?9, 'agent-node:codex-app-server', '2.5.0-preview.88',
+       '1.5', '8', '61.4', '26.9', '34.5', '491.8', '442.2', '29.4', 121868288, 116.2, 0.2, 292866, 0,
+       datetime('now', '-' || ?10 || ' seconds'), datetime('now'), datetime('now', '-30 days'))`,
+    [`r_${node}`, alias, node, NET, `示例任务 ${i}:`.repeat(12), `示例输出 ${i} `.repeat(20), `/home/user/project-${i}`,
+      `/home/user/project-${i}/.anet/nodes/${alias}/config.json`, `sample-host-${i % 4}`, i],
+  );
+}
+
+async function req(path: string, headers: Record<string, string>) {
+  const res = await fetch(`${BASE}${path}`, { headers: { "Accept-Encoding": "gzip", ...headers } });
+  const text = await res.text();
+  return { status: res.status, text, body: JSON.parse(text) as any, projection: res.headers.get("x-status-projection") };
+}
+const asNode = (accept?: string) => ({ Authorization: `Bearer ${nodeToken}`, ...(accept !== undefined ? { Accept: accept } : {}) });
+const gz = (s: string) => gzipSync(Buffer.from(s)).length;
+
+// The exact call agent-node 2.5.0-preview.32 … .90 makes (dist/cli.js CurrentAliasResolver.fetchCanonicalAlias).
+async function oldResolver(nodeId: string, token: string, networkId: string): Promise<string | null> {
+  try {
+    const headers: Record<string, string> = { Accept: "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const url = `${BASE}/api/status${networkId ? `?network_id=${encodeURIComponent(networkId)}` : ""}`;
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), 2500);
+    try {
+      const res = await fetch(url, { headers, signal: ctl.signal });
+      if (!res.ok) return null;
+      const body = (await res.json()) as { sessions?: Array<{ node_id?: string; alias?: string }> };
+      return body.sessions?.find((s) => s.node_id === nodeId)?.alias ?? null;
+    } finally { clearTimeout(timer); }
+  } catch { return null; }
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`sar_owner_${Date.now()}`, PW);
+  userToken = a.token!; userId = a.user!.user_id; NET = a.network_id!;
+  for (let i = 0; i < ROWS; i++) seed(i);
+  nodeToken = createNetworkTokenForNode(userId, NET, "sar-7", "node_sar_7").token!;
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("statusAliasResolverRead (signature)", () => {
+  const p = (q: string) => new URLSearchParams(q);
+  test("matches only node token + Accept exactly application/json + at most network_id", () => {
+    expect(statusAliasResolverRead(p(""), "ntok_x", "application/json")).toBe(true);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", "application/json")).toBe(true);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", " Application/JSON ")).toBe(true);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "utok_x", "application/json")).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "legacy-global-token", "application/json")).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", null)).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", "*/*")).toBe(false);
+    expect(statusAliasResolverRead(p("network_id=net_1"), "ntok_x", "application/json, text/plain, */*")).toBe(false);
+    for (const q of ["light=1", "node_id=n", "alias=a", "full=1", "network_id=n&full=1", "network_id=n&light=0"]) {
+      expect(statusAliasResolverRead(p(q), "ntok_x", "application/json")).toBe(false);
+    }
+  });
+});
+
+describe("GET /api/status for the old alias resolver", () => {
+  test("old resolver still resolves its alias from the light body", async () => {
+    expect(await oldResolver("node_sar_7", nodeToken, NET)).toBe("sar-7");
+    expect(await oldResolver("node_sar_7", nodeToken, "")).toBe("sar-7");
+    // other rows are resolvable too (the resolver can be asked about a renamed peer id) and an unknown id is null
+    expect(await oldResolver("node_sar_42", nodeToken, NET)).toBe("sar-42");
+    expect(await oldResolver("node_nobody", nodeToken, NET)).toBeNull();
+  });
+
+  test("…and follows a rename (the reason the resolver exists)", async () => {
+    db.run("UPDATE sessions SET alias = 'sar-7-renamed' WHERE node_id = 'node_sar_7'");
+    try {
+      expect(await oldResolver("node_sar_7", nodeToken, NET)).toBe("sar-7-renamed");
+    } finally {
+      db.run("UPDATE sessions SET alias = 'sar-7' WHERE node_id = 'node_sar_7'");
+    }
+  });
+
+  test("the body is the light projection plus node_id, marked by a header", async () => {
+    const r = await req(`/api/status?network_id=${NET}`, asNode("application/json"));
+    expect(r.status).toBe(200);
+    expect(r.projection).toBe("alias-resolver");
+    expect(r.body.sessions).toHaveLength(ROWS);
+    expect(Object.keys(r.body.sessions[0]).sort()).toEqual(["agent", "alias", "network_id", "node_id", "runtime", "server", "status", "task", "updated_at"]);
+    expect(r.body.summary.total).toBe(ROWS);
+  });
+
+  test("everything else is byte-identical to the full projection", async () => {
+    const full = await req(`/api/status?network_id=${NET}&full=1`, asNode("application/json"));
+    expect(full.projection).toBeNull();
+    expect(full.body.sessions[0].host).toBeDefined();
+    const same = [
+      await req(`/api/status?network_id=${NET}`, { Authorization: `Bearer ${userToken}`, Accept: "application/json" }), // user token (app / dashboard)
+      await req(`/api/status?network_id=${NET}`, asNode()),                                                          // anet CLI: authHeaders() only
+      await req(`/api/status?network_id=${NET}`, asNode("*/*")),                                                     // browser / undici / bun default
+      await req(`/api/status?network_id=${NET}`, asNode("application/json, text/plain, */*")),
+    ];
+    for (const r of same) {
+      expect(r.projection).toBeNull();
+      expect(r.body.sessions[0].host).toBeDefined();
+      expect(r.text).toBe(full.text);
+    }
+  });
+
+  test("light / node_id reads keep their own exact shape", async () => {
+    const light = await req(`/api/status?network_id=${NET}&light=1`, asNode("application/json"));
+    expect(light.projection).toBeNull();
+    expect(light.body.sessions[0].node_id).toBeUndefined();
+    const one = await req(`/api/status?network_id=${NET}&node_id=node_sar_7&light=1`, asNode("application/json"));
+    expect(one.body.sessions).toHaveLength(1);
+    expect(one.body.sessions[0].node_id).toBe("node_sar_7");
+  });
+
+  test("size: full projection vs the alias-resolver body (gzip)", async () => {
+    const full = await req(`/api/status?network_id=${NET}&full=1`, asNode("application/json"));
+    const slim = await req(`/api/status?network_id=${NET}`, asNode("application/json"));
+    const f = gz(full.text), s = gz(slim.text);
+    console.log(`[size] ${ROWS} rows: full ${full.text.length} B raw / ${f} B gzip → alias-resolver ${slim.text.length} B raw / ${s} B gzip (${Math.round(100 - (100 * s) / f)}% smaller)`);
+    expect(s).toBeLessThan(f / 2);
+  });
+});

package/src/status-alias-resolver.ts

@@ -0,0 +1,19 @@
+// GET /api/status 的「旧版 agent-node 找自己别名」读法识别(纯函数,可单测)。
+//
+// agent-node < 2.5.0-preview.93 的 CurrentAliasResolver 每 30 s 读一次全网完整 /api/status,只用
+// sessions[].node_id / .alias,并且 2.5 s 硬超时。它的请求有一个别的客户端都不发的签名(2026-10-01 逐个核过
+// 线上在用的 agent-node .32–.93 包、agent-network CLI 2.2.21 / 2.3.0-preview.76–.120 源码、dashboard、
+// claude-code 节点的 .anet/node-server.js):
+//   - 节点令牌(ntok_);
+//   - Accept 恰好是 `application/json`(CLI 的 authHeaders 只带 Authorization;浏览器 / undici / bun 默认 `*/*`);
+//   - 查询串里除了 network_id 什么都没有(不带 light / node_id / alias / full)。
+// 命中 ⇒ 回 light 投影 + node_id(它读的就这两列)。`?full=1` 永远拿完整投影。
+
+const ALLOWED_PARAMS = new Set(["network_id"]);
+
+export function statusAliasResolverRead(params: URLSearchParams, token: string, accept: string | null): boolean {
+  if (!token.startsWith("ntok_")) return false;
+  if ((accept ?? "").trim().toLowerCase() !== "application/json") return false;
+  for (const key of params.keys()) if (!ALLOWED_PARAMS.has(key)) return false;
+  return true;
+}

package/src/tools.ts

@@ -5888,10 +5888,67 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "projects_list",
-    "List requirement projects in your network (id, name, color, sort, archived).",
+    "List requirement projects in your network (id, name, color, sort, archived). Manage them with projects_create / projects_update.",
     { network_id: z.string().max(200).optional() },
     async ({ network_id }) => requirementsCall("GET", "/api/requirements/projects", network_id),
   );
+
+  // Agent parity (app task audit 2026-10-02 M3): what people do under 管理项目 and the task 动态 timeline. Both go
+  // through the same REST handlers as the app, so every permission check is the app's own: project management needs
+  // write access and is refused to 「仅相关任务」(task-scoped) members; events use the task list's visibility.
+  server.tool(
+    "projects_create",
+    "Create a requirement project in your network (same as 管理项目 → 新建 in the app). name 1–40 characters, unique in the network; color #RRGGBB (default: next palette colour); sort integer. Returns { project }. Refused (403) for task-scoped members and read-only roles.",
+    {
+      network_id: z.string().max(200).optional(),
+      name: z.string().min(1).max(40),
+      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+      sort: z.number().int().optional(),
+    },
+    async (args) => requirementsCall("POST", "/api/requirements/projects", args.network_id, pick(args, ["name", "color", "sort"])),
+  );
+
+  server.tool(
+    "projects_update",
+    "Rename, recolour, reorder, archive or unarchive a requirement project (same as 管理项目 in the app). Only the fields you pass change. archived=true hides it from pickers (its tasks keep project_id); archived=false brings it back. Returns { project }. Refused (403) for task-scoped members and read-only roles.",
+    {
+      network_id: z.string().max(200).optional(),
+      id: z.string().min(1).max(200).describe("project id (proj_…), from projects_list"),
+      name: z.string().min(1).max(40).optional(),
+      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+      sort: z.number().int().optional(),
+      archived: z.boolean().optional(),
+    },
+    async (args) => requirementsCall("PATCH", `/api/requirements/projects/${encodeURIComponent(args.id)}`, args.network_id, pick(args, ["name", "color", "sort", "archived"])),
+  );
+
+  server.tool(
+    "requirements_events",
+    "Read the task activity timeline (the app's 动态): field-level changes — who, when, old → new — newest first. Pass requirement_id (req_… or \"#N\") for one task, or omit it for the whole network. since (ISO) = only changes after it; limit 1–500 (default 200); next_cursor → pass as cursor for the next page; server_time → use as the next since. Same visibility as requirements_list: tasks you can't see (and hidden Agents) are left out.",
+    {
+      network_id: z.string().max(200).optional(),
+      requirement_id: z.string().min(1).max(200).optional(),
+      since: z.string().max(40).optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+      cursor: z.string().max(20).optional(),
+    },
+    async (args) => {
+      let card = args.requirement_id;
+      // "#N" → the card's id, resolved exactly like requirements_get (same scope; a card you can't see is a 404 here too).
+      if (card && /^#\d+$/.test(card)) {
+        const got = await requirementsCall("GET", `/api/requirements/${encodeURIComponent(card)}`, args.network_id);
+        const parsed = JSON.parse(got.content[0].text) as { requirement?: { id?: string } };
+        if (!parsed.requirement?.id) return got;
+        card = parsed.requirement.id;
+      }
+      const q = new URLSearchParams();
+      if (card) q.set("requirement_id", card);
+      if (args.since) q.set("since", args.since);
+      if (args.limit !== undefined) q.set("limit", String(args.limit));
+      if (args.cursor) q.set("cursor", args.cursor);
+      return requirementsCall("GET", `/api/requirements/events${q.size ? `?${q}` : ""}`, args.network_id);
+    },
+  );
 }
 
 // ────────────────────────────────────────────────────────────────────