@sleep2agi/commhub-server 0.9.0-preview.83 → 0.9.0-preview.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.83",
+  "version": "0.9.0-preview.84",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/node-health-passthrough.test.ts

@@ -0,0 +1,115 @@
+// #448 — report_status.health passthrough (layered node health, report-only).
+//
+// Hub-side contract verified here:
+//   1. A well-formed `health` from the node's own token is kept (memory-only) and readable.
+//   2. Malformed `health` never rejects the report — the node stays online, health reads as null.
+//   3. Another node / a user login cannot speak for this node's health.
+//   4. Stale (> TTL) health reads as null, never as "healthy".
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/node-health.db bun test src/node-health-passthrough.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { clearNodeHealthStore, NODE_HEALTH_TTL_MS, readNodeHealth, recordNodeHealth } from "./node-health-store.js";
+
+const NET = "net_health_t";
+const OWNER = "u_health_owner";
+const NODE_A = "health-node-a";
+const NODE_B = "health-node-b";
+const NODE_A_ID = "node_health_a";
+const NODE_B_ID = "node_health_b";
+const T_A = "tok_health_node_a";
+const T_B = "tok_health_node_b";
+
+function cleanup() {
+  for (const t of ["sessions", "nodes", "api_tokens", "network_members", "networks"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [OWNER]); } catch {}
+  clearNodeHealthStore();
+}
+function seed() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [OWNER, OWNER]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET, NET, OWNER]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [OWNER, NET]);
+  for (const [id, alias, tok] of [[NODE_A_ID, NODE_A, T_A], [NODE_B_ID, NODE_B, T_B]]) {
+    db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'))`, [id, alias, alias, NET, OWNER]);
+    db.run(`INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at, bound_node_id) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL, ?6)`, [tok, OWNER, NET, `node:${alias}`, `hash_${tok}`, id]);
+  }
+}
+
+async function connectAs(alias: string, tokenId: string) {
+  const server = new McpServer({ name: "health-test", version: "1" });
+  registerTools(server, undefined, NET, OWNER, alias, true, tokenId);
+  const client = new Client({ name: "health-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name: "report_status", arguments: args });
+    return { isError: r.isError === true, body: JSON.parse(r.content?.[0]?.text ?? "null") };
+  };
+  return { call, close: async () => { await client.close(); await server.close(); } };
+}
+
+const HEALTH = {
+  bridge: "ok",
+  app_server: { ok: false, rtt_ms: null, last_error: "connection refused" },
+  tui: { ok: false, reason: "sleep-placeholder" },
+  model_auth: "revoked",
+};
+
+beforeEach(() => { cleanup(); seed(); });
+afterAll(cleanup);
+
+describe("#448 report_status.health passthrough", () => {
+  test("node's own token: stored and readable as reported", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      const r = await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: HEALTH });
+      expect(r.isError).toBe(false);
+      expect(r.body.ok).not.toBe(false);
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health).toEqual(HEALTH as any);
+  });
+
+  test("malformed health never rejects the report (node stays online); it reads as not reported", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      for (const bad of [42, "ok", { app_server: { ok: "yes" }, model_auth: "weird", tui: [] }, { app_server: { ok: true, rtt_ms: NaN, last_error: 5 } }]) {
+        const r = await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: bad });
+        expect(r.isError).toBe(false);
+      }
+    } finally { await a.close(); }
+    expect(db.get<{ s: string }>("SELECT status AS s FROM sessions WHERE alias = ?1 AND network_id = ?2", NODE_A, NET)?.s).toBe("idle");
+    // 最后一份里 app_server.ok 合法、其余两格降级成 null —— 留下的是能证实的部分,不是编出来的。
+    expect(readNodeHealth(NET, NODE_A)?.health.app_server).toEqual({ ok: true, rtt_ms: null, last_error: null });
+  });
+
+  test("another node's token cannot speak for this node", async () => {
+    const b = await connectAs(NODE_B, T_B);
+    try {
+      await b.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: HEALTH });
+    } finally { await b.close(); }
+    expect(readNodeHealth(NET, NODE_A)).toBeNull();
+  });
+
+  test("stale health reads as null, never as healthy", () => {
+    const t0 = 1_000_000;
+    recordNodeHealth(NET, NODE_A, { bridge: "ok", model_auth: "ok" }, t0);
+    expect(readNodeHealth(NET, NODE_A, t0 + 1_000)?.observed_ms_ago).toBe(1_000);
+    expect(readNodeHealth(NET, NODE_A, t0 + NODE_HEALTH_TTL_MS + 1)).toBeNull();
+  });
+
+  test("a report without health leaves the last one (heartbeats from older code paths do not erase it)", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: HEALTH });
+      await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "working", node_id: NODE_A_ID });
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.model_auth).toBe("revoked");
+  });
+});

package/src/node-health-store.ts

@@ -0,0 +1,57 @@
+// #448 —— agent-node 上报的分层健康(`report_status.health`)的 Hub 侧透传。
+//
+// 「在线」只说明桥进程还活着:现场 ~40 台 codex 共存节点里,有的在 Hub 上 idle / in_flight=0,
+// 实际 app-server 端口没人监听、TUI pane 变成 `sleep infinity`、或登录态 "refresh token revoked"。
+// 节点把这几层分开报上来;这里只负责**收下、按节点存最新一份、在 /api/status 和 status_update 里带出去**。
+//
+// 刻意只放内存,不加列:它是**几秒钟一变的观测值**,不是需要跨重启保留的状态 —— Hub 重启后下一次
+// 心跳(≤3 分钟,翻转时立即)就会补上;持久化一份旧观测值反而会在节点死掉后继续说「app_server ok」。
+// 同理,超过 TTL 的那份按「没报」处理(null),不按「健康」处理。
+
+import { z } from "zod/v4";
+
+export const NODE_HEALTH_TTL_MS = 10 * 60_000;
+
+// 🔴 `.catch(undefined)`:这一格是纯诊断信息,**任何形状都不许拒掉整份 report_status**
+//    (zod 对象里一个已知字段验证失败 = 整份被拒 = 节点在 Hub 上失联,#1225 的形状)。
+//    合法的透传,其余一律当没报。子对象不 strict:新节点多报的键丢掉即可。
+export const nodeHealthSchema = z.object({
+  bridge: z.literal("ok").optional(),
+  app_server: z.object({
+    ok: z.boolean(),
+    rtt_ms: z.number().nullable().catch(null),
+    last_error: z.string().max(200).nullable().catch(null),
+  }).optional().catch(undefined),
+  tui: z.object({
+    ok: z.boolean(),
+    reason: z.string().max(40),
+  }).optional().catch(undefined),
+  model_auth: z.enum(["ok", "revoked", "expired", "unknown"]).optional().catch(undefined),
+}).optional().catch(undefined);
+
+export type NodeHealth = NonNullable<z.infer<typeof nodeHealthSchema>>;
+
+const store = new Map<string, { health: NodeHealth; at: number }>();
+const keyOf = (networkId: string | null | undefined, alias: string) => `${networkId ?? "default"}\0${alias}`;
+
+export function recordNodeHealth(networkId: string | null | undefined, alias: string, health: NodeHealth, now = Date.now()): void {
+  store.set(keyOf(networkId, alias), { health, at: now });
+  // 有界:按 TTL 顺手清掉过期的,别让改过名/删掉的节点在内存里攒着。
+  if (store.size > 256) {
+    for (const [k, v] of store) if (now - v.at > NODE_HEALTH_TTL_MS) store.delete(k);
+  }
+}
+
+/** 最新一份;没有或已过 TTL → null(读的人必须把它当「不知道」,而不是「健康」)。 */
+export function readNodeHealth(
+  networkId: string | null | undefined, alias: string, now = Date.now(),
+): { health: NodeHealth; observed_ms_ago: number } | null {
+  const hit = store.get(keyOf(networkId, alias));
+  if (!hit) return null;
+  const age = now - hit.at;
+  if (age > NODE_HEALTH_TTL_MS) { store.delete(keyOf(networkId, alias)); return null; }
+  return { health: hit.health, observed_ms_ago: Math.max(0, age) };
+}
+
+/** 测试用。 */
+export function clearNodeHealthStore(): void { store.clear(); }

package/src/rest-explicit-columns-http.test.ts

@@ -46,6 +46,8 @@ const GOLDEN_RESPONSE_KEYS = {
     "process_in_flight_count", "network_id", "registered_at", "updated_at",
     "node_id", "session_id", "config_path", "channels", "last_seen_at", "model",
     "external_schedules", "rules_file_capable", "skills_capable", "files_capable", "logs_capable", "runtime", "host", "process_telemetry",
+    // #448 — layered node health (memory-only; null when not reported or stale).
+    "health", "health_observed_ms_ago",
   ],
   task: [
     "task_id", "from_node_id", "from_name", "to_node_id", "to_name", "priority",

package/src/server.ts

@@ -1,6 +1,7 @@
 import { buildServeErrorResponse } from "./serve-error.js";
 import { maybeGzipResponse, trimLightTask } from "./http-gzip";
 import { statusAliasResolverRead } from "./status-alias-resolver.js";
+import { readNodeHealth } from "./node-health-store.js";
 import { redactMessageRow } from "./redact-tokens.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
@@ -2297,6 +2298,12 @@ return Bun.serve({
             uptime_seconds: s.process_uptime_seconds ?? null,
             in_flight_count: s.process_in_flight_count ?? null,
           },
+          // #448 — latest layered health the node reported (memory-only, 10 min TTL);
+          // null = not reported / stale / older agent-node — never "healthy".
+          ...(() => {
+            const h = readNodeHealth(s.network_id, s.alias);
+            return { health: h?.health ?? null, health_observed_ms_ago: h?.observed_ms_ago ?? null };
+          })(),
         };
       });
       const summary = sessions.reduce((acc: any, session: any) => {

package/src/tools.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
+import { nodeHealthSchema, recordNodeHealth } from "./node-health-store.js";
 import { parseAliasFilter } from "./alias-filter.js";
 import { createHash } from "node:crypto";
 import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
@@ -827,8 +828,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       files_capable: z.literal(true).optional(),
       // Node run-log view — same doorbell, op logs_tail.
       logs_capable: z.literal(true).optional(),
+      // #448 — layered node health (bridge / app_server / tui / model_auth).
+      // Report-only, memory-only; any malformed shape degrades to "not reported"
+      // instead of rejecting the whole report (see node-health-store.ts).
+      health: nodeHealthSchema,
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable, health: nodeHealth }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -1051,6 +1056,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           );
         }
       });
+      // #448 — only the node token bound to this alias may speak for its health
+      // (same rule as the *_capable flags above).
+      const acceptedHealth = nodeHealth && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias
+        ? nodeHealth
+        : undefined;
+      if (acceptedHealth) recordNodeHealth(sessionNetId, effectiveAlias, acceptedHealth);
       pushEvent(effectiveAlias, {
         type: "status_update",
         alias: effectiveAlias,
@@ -1059,6 +1070,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         progress: progress ?? null,
         host: statusHostTelemetry,
         process_telemetry: statusProcessTelemetry,
+        ...(acceptedHealth ? { health: acceptedHealth } : {}),
       }, sessionNetId);
 
       // V2: sync tasks table — report_status(working) → tasks.running