@sleep2agi/commhub-server 0.9.0-preview.82 → 0.9.0-preview.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.82",
+  "version": "0.9.0-preview.83",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/agent-access.ts

@@ -475,4 +475,9 @@ export const RESTRICTED_MEMBER_TOOLS: ReadonlySet<string> = new Set([
   "requirements_checklist_toggle",
   "requirements_upsert_by_external_ref",
   "projects_list",
+  // 2026-10-02(app 任务页审计 M3):和 app「管理项目」/「动态」同一个 REST 处理,权限也同一套 —— 项目管理对仅相关任务的
+  // 成员和 viewer 一律 403;动态按任务可见性过滤,受限成员看不见的节点在里面隐去(listEvents 的 hiddenNodeFilter)。
+  "projects_create",
+  "projects_update",
+  "requirements_events",
 ]);

package/src/mcp-projects-events-http.test.ts

@@ -0,0 +1,162 @@
+// MCP projects_create / projects_update / requirements_events(app 任务页审计 2026-10-02 M3:Agent 能做人能做的)。
+// HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。三个工具都走 app 用的同一套 REST 处理(handleRequirementsRequest),
+// 所以这里不另抄一份权限规则:对每类调用者(网络 owner、全部任务成员、仅相关任务成员、viewer、节点令牌)都同时调
+// MCP 和 REST,断言状态码 / 结果逐项一致。再钉住正向行为(建 / 改名 / 归档 / 取消归档、读流水、"#N")和工具出现在 tools/list 里。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-mcp-projects-events-"));
+let BASE = "";
+let hub: any = null;
+const PW = "McpProjectsEventsPassw0rd!x";
+let NET = "";
+const U: Record<string, { token: string; id: string }> = {};
+
+async function rest(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, { method, headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body) });
+  const text = await res.text();
+  let json: any = null;
+  try { json = JSON.parse(text); } catch {}
+  return { status: res.status, body: json };
+}
+async function rpc(token: string, method: string, params?: unknown): Promise<any> {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, ...(params === undefined ? {} : { params }) }),
+  });
+  const raw = await res.text();
+  const lines = raw.split("\n").filter(x => x.startsWith("data:"));
+  return lines.length ? JSON.parse(lines.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+}
+async function mcp(token: string, name: string, args: Record<string, unknown>): Promise<any> {
+  const out = await rpc(token, "tools/call", { name, arguments: args });
+  return JSON.parse(out.result.content[0].text);
+}
+// MCP error bodies from the REST handler carry its status (requirementsCall). Anything else that isn't ok (e.g. a tool-level
+// gate) is NOT a success — a body without `status` must never be read as the 2xx (that hid a gate in the first draft).
+const mcpStatus = (r: any, okStatus: number) => (r?.ok === true || (r && r.ok === undefined && (r.project || r.events)) ? okStatus : typeof r?.status === "number" ? r.status : -1);
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`mpe_owner_${Date.now()}`, PW, undefined, "Owner");
+  expect(a.ok).toBe(true);
+  U.owner = { token: a.token!, id: a.user!.user_id };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [U.owner.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  const mk = async (username: string, role: string) => {
+    expect((await rest(U.owner.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role })).status).toBe(200);
+    const login = await rest("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string };
+  };
+  const stamp = Date.now();
+  U.member = await mk(`mpe_member_${stamp}`, "member");
+  U.scoped = await mk(`mpe_scoped_${stamp}`, "member");
+  U.viewer = await mk(`mpe_viewer_${stamp}`, "viewer");
+  db.run("UPDATE network_members SET task_access = 'all' WHERE network_id = ?1 AND user_id = ?2", [NET, U.member.id]);
+  expect((await rest(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.scoped.id}/task-grants`, { task_access: "scoped", project_grants: [] })).status).toBe(200);
+  const node = createNetworkTokenForNode(U.owner.id, NET, "mpe-node", "node_mpe");
+  U.node = { token: node.token!, id: "node_mpe" };
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("discoverable", () => {
+  test("tools/list carries the three tools with descriptions", async () => {
+    const list = await rpc(U.owner.token, "tools/list");
+    const byName = new Map((list.result.tools as any[]).map(t => [t.name, t]));
+    for (const n of ["projects_create", "projects_update", "requirements_events"]) {
+      expect(byName.has(n)).toBe(true);
+      expect(String(byName.get(n).description).length).toBeGreaterThan(40);
+    }
+    expect(String(byName.get("projects_list").description)).toContain("projects_create");
+  });
+});
+
+describe("projects_create / projects_update", () => {
+  test("owner: create, rename, recolour, archive, unarchive — same rows the app sees", async () => {
+    const created = await mcp(U.owner.token, "projects_create", { network_id: NET, name: "mpe-项目甲" });
+    expect(created.ok).toBe(true);
+    const id = created.project.id as string;
+    expect(created.project.name).toBe("mpe-项目甲");
+    const renamed = await mcp(U.owner.token, "projects_update", { network_id: NET, id, name: "mpe-项目乙", color: "#16a34a" });
+    expect(renamed.project.name).toBe("mpe-项目乙");
+    expect(renamed.project.color).toBe("#16a34a");
+    expect((await mcp(U.owner.token, "projects_update", { network_id: NET, id, archived: true })).project.archived).toBe(true);
+    const seen = await rest(U.owner.token, "GET", `/api/requirements/projects?network_id=${NET}`);
+    expect(seen.body.projects.find((p: any) => p.id === id).archived).toBe(true);
+    expect((await mcp(U.owner.token, "projects_update", { network_id: NET, id, archived: false })).project.archived).toBe(false);
+  });
+
+  test("validation comes from the REST handler: duplicate name 409, unknown id 404", async () => {
+    await mcp(U.owner.token, "projects_create", { network_id: NET, name: "mpe-重名" });
+    const dup = await mcp(U.owner.token, "projects_create", { network_id: NET, name: "mpe-重名" });
+    expect(dup.ok).toBe(false);
+    expect(dup.status).toBe(409);
+    const missing = await mcp(U.owner.token, "projects_update", { network_id: NET, id: "proj_nobody", name: "x" });
+    expect(missing.status).toBe(404);
+  });
+
+  test("permission parity with the app's REST path, for every kind of caller", async () => {
+    const results: Record<string, { mcp: number; rest: number }> = {};
+    for (const who of ["owner", "member", "scoped", "viewer", "node"]) {
+      const name = `mpe-parity-${who}`;
+      const viaMcp = await mcp(U[who].token, "projects_create", { network_id: NET, name: `${name}-mcp` });
+      const viaRest = await rest(U[who].token, "POST", `/api/requirements/projects?network_id=${NET}`, { name: `${name}-rest` });
+      results[who] = { mcp: mcpStatus(viaMcp, 201), rest: viaRest.status };
+    }
+    for (const r of Object.values(results)) expect(r.mcp).toBe(r.rest);
+    // the rule itself (RFC-038 §9): task-scoped members and viewers can't manage projects; the others can
+    expect(results.owner.rest).toBe(201);
+    expect(results.member.rest).toBe(201);
+    expect(results.scoped.rest).toBe(403);
+    expect(results.viewer.rest).toBe(403);
+  });
+});
+
+describe("requirements_events", () => {
+  test("one task's timeline by id and by #N, same rows as GET /api/requirements/events", async () => {
+    const card = await rest(U.owner.token, "POST", "/api/requirements", { network_id: NET, name: "mpe-流水示例" });
+    expect(card.status).toBe(201);
+    const id = card.body.requirement.id as string, seq = card.body.requirement.seq as number;
+    expect((await rest(U.owner.token, "PATCH", `/api/requirements/${id}?network_id=${NET}`, { priority: "high" })).status).toBe(200);
+    const viaMcp = await mcp(U.owner.token, "requirements_events", { network_id: NET, requirement_id: id });
+    const viaRest = await rest(U.owner.token, "GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`);
+    expect(viaMcp.ok).toBe(true);
+    expect(viaMcp.events.length).toBeGreaterThan(0);
+    expect(viaMcp.events.map((e: any) => e.id)).toEqual(viaRest.body.events.map((e: any) => e.id));
+    expect(viaMcp.events.every((e: any) => e.requirement_id === id)).toBe(true);
+    const bySeq = await mcp(U.owner.token, "requirements_events", { network_id: NET, requirement_id: `#${seq}` });
+    expect(bySeq.events.map((e: any) => e.id)).toEqual(viaMcp.events.map((e: any) => e.id));
+    // paging / bad input come from the REST handler too
+    expect((await mcp(U.owner.token, "requirements_events", { network_id: NET, since: "not-a-date" })).status).toBe(400);
+    expect((await mcp(U.owner.token, "requirements_events", { network_id: NET, requirement_id: "#999999" })).status).toBe(404);
+  });
+
+  test("visibility parity: a task-scoped member doesn't get events for a task they can't see", async () => {
+    const hidden = await rest(U.owner.token, "POST", "/api/requirements", { network_id: NET, name: "mpe-看不见的" });
+    const id = hidden.body.requirement.id as string;
+    await rest(U.owner.token, "PATCH", `/api/requirements/${id}?network_id=${NET}`, { priority: "low" });
+    for (const who of ["scoped", "member", "node"]) {
+      const viaMcp = await mcp(U[who].token, "requirements_events", { network_id: NET, requirement_id: id });
+      const viaRest = await rest(U[who].token, "GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`);
+      expect((viaMcp.events ?? []).map((e: any) => e.id)).toEqual((viaRest.body?.events ?? []).map((e: any) => e.id));
+    }
+    expect((await mcp(U.scoped.token, "requirements_events", { network_id: NET, requirement_id: id })).events ?? []).toHaveLength(0);
+    expect((await mcp(U.member.token, "requirements_events", { network_id: NET, requirement_id: id })).events.length).toBeGreaterThan(0);
+  });
+});

package/src/tools.ts

@@ -5888,10 +5888,67 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "projects_list",
-    "List requirement projects in your network (id, name, color, sort, archived).",
+    "List requirement projects in your network (id, name, color, sort, archived). Manage them with projects_create / projects_update.",
     { network_id: z.string().max(200).optional() },
     async ({ network_id }) => requirementsCall("GET", "/api/requirements/projects", network_id),
   );
+
+  // Agent parity (app task audit 2026-10-02 M3): what people do under 管理项目 and the task 动态 timeline. Both go
+  // through the same REST handlers as the app, so every permission check is the app's own: project management needs
+  // write access and is refused to 「仅相关任务」(task-scoped) members; events use the task list's visibility.
+  server.tool(
+    "projects_create",
+    "Create a requirement project in your network (same as 管理项目 → 新建 in the app). name 1–40 characters, unique in the network; color #RRGGBB (default: next palette colour); sort integer. Returns { project }. Refused (403) for task-scoped members and read-only roles.",
+    {
+      network_id: z.string().max(200).optional(),
+      name: z.string().min(1).max(40),
+      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+      sort: z.number().int().optional(),
+    },
+    async (args) => requirementsCall("POST", "/api/requirements/projects", args.network_id, pick(args, ["name", "color", "sort"])),
+  );
+
+  server.tool(
+    "projects_update",
+    "Rename, recolour, reorder, archive or unarchive a requirement project (same as 管理项目 in the app). Only the fields you pass change. archived=true hides it from pickers (its tasks keep project_id); archived=false brings it back. Returns { project }. Refused (403) for task-scoped members and read-only roles.",
+    {
+      network_id: z.string().max(200).optional(),
+      id: z.string().min(1).max(200).describe("project id (proj_…), from projects_list"),
+      name: z.string().min(1).max(40).optional(),
+      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+      sort: z.number().int().optional(),
+      archived: z.boolean().optional(),
+    },
+    async (args) => requirementsCall("PATCH", `/api/requirements/projects/${encodeURIComponent(args.id)}`, args.network_id, pick(args, ["name", "color", "sort", "archived"])),
+  );
+
+  server.tool(
+    "requirements_events",
+    "Read the task activity timeline (the app's 动态): field-level changes — who, when, old → new — newest first. Pass requirement_id (req_… or \"#N\") for one task, or omit it for the whole network. since (ISO) = only changes after it; limit 1–500 (default 200); next_cursor → pass as cursor for the next page; server_time → use as the next since. Same visibility as requirements_list: tasks you can't see (and hidden Agents) are left out.",
+    {
+      network_id: z.string().max(200).optional(),
+      requirement_id: z.string().min(1).max(200).optional(),
+      since: z.string().max(40).optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+      cursor: z.string().max(20).optional(),
+    },
+    async (args) => {
+      let card = args.requirement_id;
+      // "#N" → the card's id, resolved exactly like requirements_get (same scope; a card you can't see is a 404 here too).
+      if (card && /^#\d+$/.test(card)) {
+        const got = await requirementsCall("GET", `/api/requirements/${encodeURIComponent(card)}`, args.network_id);
+        const parsed = JSON.parse(got.content[0].text) as { requirement?: { id?: string } };
+        if (!parsed.requirement?.id) return got;
+        card = parsed.requirement.id;
+      }
+      const q = new URLSearchParams();
+      if (card) q.set("requirement_id", card);
+      if (args.since) q.set("since", args.since);
+      if (args.limit !== undefined) q.set("limit", String(args.limit));
+      if (args.cursor) q.set("cursor", args.cursor);
+      return requirementsCall("GET", `/api/requirements/events${q.size ? `?${q}` : ""}`, args.network_id);
+    },
+  );
 }
 
 // ────────────────────────────────────────────────────────────────────