@sleep2agi/commhub-server 0.9.0-preview.93 → 0.9.0-preview.94

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.93",
+  "version": "0.9.0-preview.94",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.ts

@@ -1,7 +1,7 @@
 /**
  * V3 Auth module — user registration, login, token management
  */
-import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js"; import { deleteDepartmentsForNetwork, removeMemberFromChatGroups } from "./departments.js"; // #419: also ensures network_members.department_id exists (same line on purpose: docs pin auth.ts line numbers)
+import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js"; import { deleteDepartmentsForNetwork, groupTx, removeMemberFromChatGroups } from "./departments.js"; // #419: also ensures network_members.department_id exists (same line on purpose: docs pin auth.ts line numbers)
 import { WEAK_PASSWORDS } from "./password-dict.js";
 import { NETWORK_REST_COLUMNS, NETWORK_REST_SELECT, sqlColumns } from "./rest-projections.js";
 import { deleteAgentGrants, isAgentRestricted } from "./agent-access.js"; import { deleteTaskGrantsForMember, NEW_MEMBER_TASK_ACCESS, type TaskAccessMode } from "./task-access.js"; // 一行两个 import:文档钉着 auth.ts 的行号
@@ -682,7 +682,7 @@ export function removeNetworkMember(networkId: string, userId: string): { ok: bo
   const member = db.get<any>("SELECT role FROM network_members WHERE network_id = ?1 AND user_id = ?2", networkId, userId);
   if (!member) return { ok: false, error: "not a member" };
   if (member.role === "owner") return { ok: false, error: "cannot remove owner" };
-  db.transaction(() => {
+  groupTx(() => { // RFC-042 §9.3:同 db.transaction,另在提交后推 group_membership_changed(移出网络 → 他所在每个群)
     db.run("DELETE FROM network_members WHERE network_id = ?1 AND user_id = ?2", [networkId, userId]);
     // #488 —— 他在这个网络里的令牌(节点令牌 / 邀请码令牌)一起吊销;resolveToken 也会拒非成员的令牌,这里让库里的状态如实。
     db.run("UPDATE api_tokens SET revoked_at = datetime('now') WHERE network_id = ?1 AND user_id = ?2 AND revoked_at IS NULL", [networkId, userId]);

package/src/department-groups.ts

@@ -17,9 +17,14 @@
 //   source='manual' 永远不动(手动拉的人后来进了部门也保持 manual —— 宁可多留一个人,不静默踢人)。
 //   调人 / 建部门(带负责人)/ 改上级 / 换负责人 / 删部门 都在各自的事务里调它一次;移出网络删他在本网络的全部群成员行。
 // - 读一个挂部门的群时顺手对账一次(兜底:修掉第 1 个 PR 上线到第 2 个 PR 上线之间的漂移)。
+//
+// RFC-042 §9.3 补口:入群 / 退群实时事件 group_membership_changed。成员行在事务里变,事件只在**最外层事务提交之后**推:
+// 写路径一律走 groupTx()(代替 db.transaction),事务里每一处增删成员行都 recordMembershipChange() 记一笔;
+// groupTx 正常返回且已回到最外层 → flush;抛错(整个回滚,或内层 savepoint 回滚)→ 丢掉这一层记下的那些。
 
 import { db, uuidv4 } from "./db.js";
 import { departmentSubtree, membersIn } from "./department-heads.js";
+import { pushUserEvent } from "./push.js";
 
 db.exec(`
   CREATE TABLE IF NOT EXISTS chat_groups (
@@ -70,6 +75,66 @@ db.exec(`
 
 export const GROUP_SOURCE_DEPARTMENT = "department";
 export const GROUP_SOURCE_MANUAL = "manual";
+
+// ── 入群 / 退群事件(RFC-042 §9.3 补口)──
+
+export const GROUP_MEMBERSHIP_EVENT = "group_membership_changed";
+/** 事件里的 source = 这次变化的起因:manual(手动拉 / 移)、department(部门同步,含建群播种)、network_removal(移出网络)。 */
+export type MembershipChangeSource = "manual" | "department" | "network_removal";
+export type MembershipChange = { network_id: string; group_id: string; user_id: string; change: "added" | "removed"; source: MembershipChangeSource; at: string };
+
+let txDepth = 0;
+let pending: MembershipChange[] = [];
+
+/** 事务里记一笔成员变化。不在 groupTx 里(单条自动提交的写)→ 这条语句已经提交了,立刻推。 */
+function recordMembershipChange(c: Omit<MembershipChange, "at">): void {
+  const change = { ...c, at: new Date().toISOString() };
+  if (txDepth > 0) pending.push(change);
+  else flushMembershipChanges([change]);
+}
+
+/**
+ * 代替 db.transaction:可嵌套(内层是 savepoint)。内层抛错 → 只丢掉内层记下的变化(内层 savepoint 回滚了,外层可能照常提交);
+ * 最外层正常返回(= 已提交)→ 推;最外层抛错(= 回滚)→ 一条不推。
+ */
+export function groupTx<T>(fn: () => T): T {
+  const mark = pending.length;
+  txDepth++;
+  let ok = false;
+  try {
+    const out = db.transaction(fn);
+    ok = true;
+    return out;
+  } finally {
+    txDepth--;
+    if (!ok) pending.length = mark;
+    else if (txDepth === 0) {
+      const batch = pending;
+      pending = [];
+      flushMembershipChanges(batch);
+    }
+  }
+}
+
+/**
+ * 推 group_membership_changed:每一笔发给「被加 / 被移的那个人」和「提交后这个群的当前成员」。
+ * pushUserEvent 的信封里 user_id 是**收件人**(所有用户事件同一口径),所以被加 / 被移的人放在 member_user_id。
+ */
+function flushMembershipChanges(batch: MembershipChange[]): void {
+  if (!batch.length) return;
+  const membersOf = new Map<string, string[]>();
+  for (const c of batch) {
+    let current = membersOf.get(c.group_id);
+    if (!current) {
+      current = db.all<{ user_id: string }>("SELECT user_id FROM chat_group_members WHERE group_id = ?1", c.group_id).map((r) => r.user_id);
+      membersOf.set(c.group_id, current);
+    }
+    const event = { type: GROUP_MEMBERSHIP_EVENT, group_id: c.group_id, member_user_id: c.user_id, change: c.change, source: c.source, at: c.at };
+    for (const uid of new Set([c.user_id, ...current])) {
+      try { pushUserEvent(c.network_id, uid, event); } catch {}
+    }
+  }
+}
 const NAME_MAX = 40;
 
 type GroupRow = { group_id: string; network_id: string; name: string; department_id: string | null; created_by: string | null; created_at: string; updated_at: string };
@@ -153,7 +218,7 @@ export function createDepartmentGroup(networkId: string, departmentId: string, a
   const groupId = `grp_${uuidv4().replace(/-/g, "").slice(0, 20)}`;
   const roster = departmentGroupRoster(networkId, departmentId);
   try {
-    db.transaction(() => {
+    groupTx(() => {
       db.run(
         "INSERT INTO chat_groups (group_id, network_id, name, department_id, created_by) VALUES (?1, ?2, ?3, ?4, ?5)",
         [groupId, networkId, name, departmentId, actorUserId],
@@ -163,6 +228,7 @@ export function createDepartmentGroup(networkId: string, departmentId: string, a
           "INSERT INTO chat_group_members (group_id, user_id, network_id, source) VALUES (?1, ?2, ?3, ?4) ON CONFLICT(group_id, user_id) DO NOTHING",
           [groupId, uid, networkId, GROUP_SOURCE_DEPARTMENT],
         );
+        recordMembershipChange({ network_id: networkId, group_id: groupId, user_id: uid, change: "added", source: "department" });
       }
     });
   } catch (err) {
@@ -212,7 +278,7 @@ export function listVisibleGroups(networkId: string, userId: string | null, canM
 export function readGroup(networkId: string, groupId: string, userId: string | null, canManage: boolean, managedDepartments: ReadonlySet<string> = new Set()): { group: ChatGroup & { viewer_can: GroupViewerCan }; members: ChatGroupMember[]; is_member: boolean } | null {
   const r = groupRow(networkId, groupId);
   if (!r) return null;
-  if (r.department_id !== null) db.transaction(() => { syncDepartmentGroups(networkId, groupId); });
+  if (r.department_id !== null) groupTx(() => { syncDepartmentGroups(networkId, groupId); });
   const member = !!userId && isGroupMember(groupId, userId);
   if (!member && !canManageGroup(r, canManage, managedDepartments)) return null;
   return { group: { ...toPublic(r), viewer_can: groupViewerCan(r, member, canManage, managedDepartments) }, members: listGroupMembers(groupId), is_member: member };
@@ -291,11 +357,13 @@ export function syncDepartmentGroups(networkId: string, onlyGroupId?: string): S
         "INSERT INTO chat_group_members (group_id, user_id, network_id, source) VALUES (?1, ?2, ?3, ?4) ON CONFLICT(group_id, user_id) DO NOTHING",
         [g.group_id, uid, networkId, GROUP_SOURCE_DEPARTMENT],
       );
+      recordMembershipChange({ network_id: networkId, group_id: g.group_id, user_id: uid, change: "added", source: "department" });
       added++;
     }
     for (const r of current) {
       if (r.source !== GROUP_SOURCE_DEPARTMENT || roster.has(r.user_id)) continue;
       db.run("DELETE FROM chat_group_members WHERE group_id = ?1 AND user_id = ?2 AND source = ?3", [g.group_id, r.user_id, GROUP_SOURCE_DEPARTMENT]);
+      recordMembershipChange({ network_id: networkId, group_id: g.group_id, user_id: r.user_id, change: "removed", source: "department" });
       removed++;
     }
   }
@@ -304,7 +372,9 @@ export function syncDepartmentGroups(networkId: string, onlyGroupId?: string): S
 
 /** 移出网络时调用(和删 network_members 同一事务):他在本网络所有群里的行都删,不论来源。 */
 export function removeMemberFromChatGroups(networkId: string, userId: string): void {
+  const groups = db.all<{ group_id: string }>("SELECT group_id FROM chat_group_members WHERE network_id = ?1 AND user_id = ?2", networkId, userId);
   db.run("DELETE FROM chat_group_members WHERE network_id = ?1 AND user_id = ?2", [networkId, userId]);
+  for (const g of groups) recordMembershipChange({ network_id: networkId, group_id: g.group_id, user_id: userId, change: "removed", source: "network_removal" });
 }
 
 /**
@@ -335,10 +405,13 @@ export function addManualMember(networkId: string, groupId: string, userId: unkn
   if (typeof userId !== "string" || !userId) return fail(400, "user_id_required");
   if (!db.get("SELECT 1 AS x FROM network_members WHERE network_id = ?1 AND user_id = ?2", networkId, userId)) return fail(400, "not_network_member");
   if (isGroupMember(groupId, userId)) return fail(409, "already_group_member");
-  db.run(
-    "INSERT INTO chat_group_members (group_id, user_id, network_id, source) VALUES (?1, ?2, ?3, ?4) ON CONFLICT(group_id, user_id) DO NOTHING",
-    [groupId, userId, networkId, GROUP_SOURCE_MANUAL],
-  );
+  groupTx(() => {
+    const r = db.run(
+      "INSERT INTO chat_group_members (group_id, user_id, network_id, source) VALUES (?1, ?2, ?3, ?4) ON CONFLICT(group_id, user_id) DO NOTHING",
+      [groupId, userId, networkId, GROUP_SOURCE_MANUAL],
+    );
+    if (r.changes > 0) recordMembershipChange({ network_id: networkId, group_id: groupId, user_id: userId, change: "added", source: "manual" });
+  });
   const member = toMember(db.get<MemberRow>(`${MEMBER_SELECT} WHERE m.group_id = ?1 AND m.user_id = ?2`, groupId, userId)!);
   return { ok: true, member };
 }
@@ -353,6 +426,9 @@ export function removeManualMember(networkId: string, groupId: string, userId: s
   const row = db.get<{ source: string }>("SELECT source FROM chat_group_members WHERE group_id = ?1 AND user_id = ?2", groupId, userId);
   if (!row) return fail(404, "group_member_not_found");
   if (row.source === GROUP_SOURCE_DEPARTMENT && group.department_id !== null) return fail(409, "department_member");
-  db.run("DELETE FROM chat_group_members WHERE group_id = ?1 AND user_id = ?2", [groupId, userId]);
+  groupTx(() => {
+    const r = db.run("DELETE FROM chat_group_members WHERE group_id = ?1 AND user_id = ?2", [groupId, userId]);
+    if (r.changes > 0) recordMembershipChange({ network_id: networkId, group_id: groupId, user_id: userId, change: "removed", source: "manual" });
+  });
   return { ok: true, user_id: userId };
 }

package/src/departments.ts

@@ -12,10 +12,10 @@
 
 import { db, logAudit } from "./db.js";
 import { deleteDepartmentGrants, deleteDepartmentGrantsForNetwork } from "./department-heads.js";
-import { deleteChatGroupsForNetwork, removeMemberFromChatGroups, syncDepartmentGroups, unlinkDepartmentGroup } from "./department-groups.js";
+import { deleteChatGroupsForNetwork, groupTx, removeMemberFromChatGroups, syncDepartmentGroups, unlinkDepartmentGroup } from "./department-groups.js";
 
 // auth.ts 的 removeNetworkMember 从这里拿(auth.ts 只 import departments.js 一行,文档钉着它的行号)。
-export { removeMemberFromChatGroups };
+export { groupTx, removeMemberFromChatGroups };
 
 try { db.exec("ALTER TABLE network_members ADD COLUMN department_id TEXT"); } catch {}
 db.exec(`
@@ -164,7 +164,7 @@ export function createDepartment(networkId: string, actor: string, body: Record<
       ...(parentId === null ? [networkId] : [networkId, parentId]),
     )?.n ?? 0)
     : body.sort as number;
-  db.transaction(() => {
+  groupTx(() => {
     db.run(
       "INSERT INTO network_departments (network_id, department_id, name, parent_id, leader_user_id, sort, created_by) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
       [networkId, id, name, parentId, leader, sort, actor],
@@ -206,7 +206,7 @@ export function updateDepartment(networkId: string, id: string, body: Record<str
   }
   if (!touched) return fail(400, "empty_patch");
   if ((name !== cur.name || parentId !== cur.parent_id) && siblingNameTaken(networkId, parentId, name, id)) return fail(409, "department_name_taken");
-  db.transaction(() => {
+  groupTx(() => {
     db.run(
       "UPDATE network_departments SET name = ?3, parent_id = ?4, leader_user_id = ?5, sort = ?6, updated_at = datetime('now') WHERE network_id = ?1 AND department_id = ?2",
       [networkId, id, name, parentId, leader, sort],
@@ -224,7 +224,7 @@ export function deleteDepartment(networkId: string, id: string): Ok<{ deleted: s
   const members = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM network_members WHERE network_id = ?1 AND department_id = ?2", networkId, id)?.n ?? 0;
   if (children || members) return { ...fail(409, "department_not_empty"), children, members };
   // RFC-040:部门的项目授权(network_department_project_grants)和部门同一事务删掉。
-  db.transaction(() => {
+  groupTx(() => {
     db.run("DELETE FROM network_departments WHERE network_id = ?1 AND department_id = ?2", [networkId, id]);
     deleteDepartmentGrants(networkId, id);
     // RFC-042:部门群解除关联(群和成员、以后的聊天记录都留着),不删。
@@ -240,7 +240,7 @@ export function setMemberDepartment(networkId: string, userId: string, departmen
   if (!isMember(networkId, userId)) return fail(404, "member_not_found");
   const dept = departmentId === null || departmentId === "" ? null : departmentId;
   if (dept !== null && (typeof dept !== "string" || !one(networkId, dept))) return fail(400, "department_not_found");
-  db.transaction(() => {
+  groupTx(() => {
     db.run("UPDATE network_members SET department_id = ?3 WHERE network_id = ?1 AND user_id = ?2", [networkId, userId, dept]);
     // RFC-042 §4:调进 / 调出 → 同一事务对账部门群(manual 行不动)。
     syncDepartmentGroups(networkId);

package/src/group-membership-events-http.test.ts

@@ -0,0 +1,264 @@
+// RFC-042 §9.3 补口(看板 #457):入群 / 退群实时事件 group_membership_changed。
+// HTTP 集成测试(真实 Bun.serve,私有端口,临时库;PostgreSQL 由 test2123 梯子用 COMMHUB_TEST_PG_URL 跑同一个文件)。
+// 钉住:手动拉人 / 移人、调进 / 调出部门、换负责人、移出网络 → 被加 / 被移的人和提交后的当前群成员各收到一条;
+// 不相干的人收不到;事件只在提交之后推 —— 整个事务回滚一条不推,内层 savepoint 回滚只丢内层那几笔。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+import { groupTx, syncDepartmentGroups, isGroupMember } from "./department-groups.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-group-membership-ev-"));
+let BASE = "";
+let hub: any = null;
+const PW = "GroupMembershipEvPassw0rd!x";
+let NET = "";
+const U: Record<string, { token: string; id: string; username: string }> = {};
+const DEPT: Record<string, string> = {};
+const GRP: Record<string, string> = {};
+const S: Record<string, { events: any[]; close: () => void }> = {};
+
+async function send(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, { method, headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body) });
+  const text = await res.text();
+  let json: any = null;
+  try { json = JSON.parse(text); } catch {}
+  return { status: res.status, body: json };
+}
+const CG = (suffix = "") => `/api/networks/${NET}/chat-groups${suffix}`;
+const place = async (who: string, dept: string | null) =>
+  expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U[who].id}/department`, { department_id: dept })).status).toBe(200);
+
+async function subscribe(who: string) {
+  const ctrl = new AbortController();
+  const res = await fetch(`${BASE}/events/users/me?network_id=${NET}`, { headers: { Authorization: `Bearer ${U[who].token}` }, signal: ctrl.signal });
+  expect(res.status).toBe(200);
+  const events: any[] = [];
+  const reader = res.body!.getReader();
+  const dec = new TextDecoder();
+  let buf = "";
+  void (async () => {
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buf += dec.decode(value);
+        let i: number;
+        while ((i = buf.indexOf("\n\n")) >= 0) {
+          const frame = buf.slice(0, i); buf = buf.slice(i + 2);
+          for (const line of frame.split("\n")) if (line.startsWith("data: ")) { try { events.push(JSON.parse(line.slice(6))); } catch {} }
+        }
+      }
+    } catch {}
+  })();
+  await until(() => events.some((e) => e.type === "connected"));
+  return { events, close: () => ctrl.abort() };
+}
+const until = async (cond: () => boolean, tries = 150) => { for (let k = 0; k < tries && !cond(); k++) await new Promise((r) => setTimeout(r, 20)); };
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** 只看成员事件;清空所有订阅者已收到的,便于每个用例从零数。 */
+const mev = (who: string) => S[who].events.filter((e) => e.type === "group_membership_changed");
+// 先等上一个用例里没被等的收件人(比如 hank)的事件落地,再清空 —— 否则它会串到下一个用例里。
+const reset = async () => { await sleep(150); for (const k of Object.keys(S)) S[k].events.length = 0; };
+const match = (who: string, group: string, member: string, change: string, source: string) =>
+  mev(who).filter((e) => e.group_id === GRP[group] && e.member_user_id === U[member].id && e.change === change && e.source === source);
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const stamp = Date.now();
+  const a = register(`gme_owner_${stamp}`, PW, undefined, "Owner");
+  expect(a.ok).toBe(true);
+  U.owner = { token: a.token!, id: a.user!.user_id, username: a.user!.username };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [U.owner.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  const add = async (username: string, role: string) => {
+    expect((await send(U.owner.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role })).status).toBe(200);
+    const login = await send("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string, username };
+  };
+  U.alice = await add(`gme_alice_${stamp}`, "member"); // 研发部(旁观的当前成员)
+  U.carol = await add(`gme_carol_${stamp}`, "member"); // 研发部,之后被调去市场部
+  U.dave = await add(`gme_dave_${stamp}`, "member");   // 市场部,被手动拉进 / 移出研发部群
+  U.erin = await add(`gme_erin_${stamp}`, "member");   // 未分配,之后调进研发部
+  U.frank = await add(`gme_frank_${stamp}`, "member"); // 未分配:回滚用例的对象
+  U.gina = await add(`gme_gina_${stamp}`, "member");   // 未分配:不相干的人 / 负责人用例
+  U.hank = await add(`gme_hank_${stamp}`, "member");   // 研发部,之后被移出网络
+
+  const mk = async (name: string, extra: Record<string, unknown> = {}) => {
+    const r = await send(U.owner.token, "POST", `/api/networks/${NET}/departments`, { name, ...extra });
+    expect(r.status).toBe(201);
+    return r.body.department.id as string;
+  };
+  DEPT.rd = await mk("研发部");
+  DEPT.market = await mk("市场部");
+  for (const w of ["alice", "carol", "hank"]) await place(w, DEPT.rd);
+  await place("dave", DEPT.market);
+  for (const key of ["rd", "market"]) {
+    const r = await send(U.owner.token, "POST", `/api/networks/${NET}/departments/${DEPT[key]}/group`, {});
+    expect(r.status).toBe(201);
+    GRP[key] = r.body.group.id;
+  }
+  for (const w of ["owner", "alice", "carol", "dave", "erin", "frank", "gina", "hank"]) S[w] = await subscribe(w);
+}, 30_000);
+
+afterAll(() => {
+  for (const s of Object.values(S)) try { s.close(); } catch {}
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("manual add / remove", () => {
+  test("manual add: the added user and current members get one `added` event; outsiders get nothing", async () => {
+    await reset();
+    const r = await send(U.owner.token, "POST", CG(`/${GRP.rd}/members`), { user_id: U.dave.id });
+    expect(r.status).toBe(201);
+    await until(() => ["dave", "alice", "carol"].every((w) => match(w, "rd", "dave", "added", "manual").length > 0));
+    expect(match("dave", "rd", "dave", "added", "manual")).toHaveLength(1);
+    expect(match("alice", "rd", "dave", "added", "manual")).toHaveLength(1);
+    expect(match("carol", "rd", "dave", "added", "manual")).toHaveLength(1);
+    const ev = match("dave", "rd", "dave", "added", "manual")[0];
+    expect(ev).toMatchObject({ type: "group_membership_changed", network_id: NET, group_id: GRP.rd, member_user_id: U.dave.id, change: "added", source: "manual", scope: "user" });
+    expect(ev.user_id).toBe(U.dave.id); // 信封 user_id = 收件人
+    expect(match("alice", "rd", "dave", "added", "manual")[0].user_id).toBe(U.alice.id);
+    expect(new Date(ev.at).toISOString()).toBe(ev.at);
+    await sleep(100);
+    expect(mev("gina")).toHaveLength(0);
+    expect(mev("erin")).toHaveLength(0);
+  });
+
+  test("manual remove: the removed user and the remaining members get one `removed` event", async () => {
+    await reset();
+    const r = await send(U.owner.token, "DELETE", CG(`/${GRP.rd}/members/${U.dave.id}`));
+    expect(r.status).toBe(200);
+    await until(() => ["dave", "alice"].every((w) => match(w, "rd", "dave", "removed", "manual").length > 0));
+    expect(match("dave", "rd", "dave", "removed", "manual")).toHaveLength(1);
+    expect(match("alice", "rd", "dave", "removed", "manual")).toHaveLength(1);
+    await sleep(100);
+    expect(mev("gina")).toHaveLength(0);
+  });
+
+  test("a refused write (409 already_group_member) emits nothing", async () => {
+    await reset();
+    expect((await send(U.owner.token, "POST", CG(`/${GRP.rd}/members`), { user_id: U.alice.id })).status).toBe(409);
+    await sleep(150);
+    for (const w of Object.keys(S)) expect(mev(w)).toHaveLength(0);
+  });
+});
+
+describe("department sync", () => {
+  test("move-in: erin into 研发部 → `added`/department to erin and the 研发部 group's members", async () => {
+    await reset();
+    await place("erin", DEPT.rd);
+    await until(() => ["erin", "alice"].every((w) => match(w, "rd", "erin", "added", "department").length > 0));
+    expect(match("erin", "rd", "erin", "added", "department")).toHaveLength(1);
+    expect(match("alice", "rd", "erin", "added", "department")).toHaveLength(1);
+    await sleep(100);
+    expect(mev("dave")).toHaveLength(0); // 市场部群没变
+    expect(isGroupMember(GRP.rd, U.erin.id)).toBe(true);
+  });
+
+  test("move-out: carol 研发部 → 市场部 → removed from 研发部 group, added to 市场部 group", async () => {
+    await reset();
+    await place("carol", DEPT.market);
+    await until(() => ["carol", "alice"].every((w) => match(w, "rd", "carol", "removed", "department").length > 0) && ["carol", "dave"].every((w) => match(w, "market", "carol", "added", "department").length > 0));
+    expect(match("carol", "rd", "carol", "removed", "department")).toHaveLength(1);
+    expect(match("alice", "rd", "carol", "removed", "department")).toHaveLength(1);
+    expect(match("carol", "market", "carol", "added", "department")).toHaveLength(1);
+    expect(match("dave", "market", "carol", "added", "department")).toHaveLength(1);
+    // alice 不在市场部群:不该收到市场部群的变化
+    await sleep(100);
+    expect(mev("alice").filter((e) => e.group_id === GRP.market)).toHaveLength(0);
+  });
+
+  test("head change: gina made 研发部 leader joins the group; unsetting removes her", async () => {
+    await reset();
+    expect((await send(U.owner.token, "PATCH", `/api/networks/${NET}/departments/${DEPT.rd}`, { leader_user_id: U.gina.id })).status).toBe(200);
+    await until(() => ["gina", "alice"].every((w) => match(w, "rd", "gina", "added", "department").length > 0));
+    expect(match("gina", "rd", "gina", "added", "department")).toHaveLength(1);
+    expect(match("alice", "rd", "gina", "added", "department")).toHaveLength(1);
+    // 部门写会踢掉负责人的用户流(RFC-040,权限变了要重连重新鉴权)—— App 会重连;这里同样重订阅一次。
+    S.gina.close();
+    S.gina = await subscribe("gina");
+    await reset();
+    expect((await send(U.owner.token, "PATCH", `/api/networks/${NET}/departments/${DEPT.rd}`, { leader_user_id: null })).status).toBe(200);
+    await until(() => ["gina", "alice"].every((w) => match(w, "rd", "gina", "removed", "department").length > 0));
+    expect(match("gina", "rd", "gina", "removed", "department")).toHaveLength(1);
+    expect(match("alice", "rd", "gina", "removed", "department")).toHaveLength(1);
+  });
+
+  test("rename-only PATCH (no roster change) emits nothing", async () => {
+    await reset();
+    expect((await send(U.owner.token, "PATCH", `/api/networks/${NET}/departments/${DEPT.rd}`, { name: "研发中心" })).status).toBe(200);
+    await sleep(150);
+    for (const w of Object.keys(S)) expect(mev(w)).toHaveLength(0);
+  });
+});
+
+describe("post-commit only", () => {
+  test("a rolled-back write emits nothing and changes nothing", async () => {
+    await reset();
+    expect(() => groupTx(() => {
+      db.run("UPDATE network_members SET department_id = ?3 WHERE network_id = ?1 AND user_id = ?2", [NET, U.frank.id, DEPT.rd]);
+      syncDepartmentGroups(NET);
+      expect(isGroupMember(GRP.rd, U.frank.id)).toBe(true); // 事务里确实对过账
+      throw new Error("boom");
+    })).toThrow("boom");
+    expect(isGroupMember(GRP.rd, U.frank.id)).toBe(false);
+    await sleep(200);
+    for (const w of Object.keys(S)) expect(mev(w)).toHaveLength(0);
+    // 下一次提交的写也不会把回滚掉的那笔捎带出去
+    await place("erin", DEPT.rd); // 无变化的调人(erin 已在研发部)
+    await sleep(150);
+    for (const w of Object.keys(S)) expect(mev(w).filter((e) => e.member_user_id === U.frank.id)).toHaveLength(0);
+  });
+
+  test("an inner savepoint rollback drops only its own changes; the outer commit still emits", async () => {
+    await reset();
+    groupTx(() => {
+      db.run("UPDATE network_members SET department_id = ?3 WHERE network_id = ?1 AND user_id = ?2", [NET, U.gina.id, DEPT.rd]);
+      syncDepartmentGroups(NET);
+      try {
+        groupTx(() => {
+          db.run("UPDATE network_members SET department_id = ?3 WHERE network_id = ?1 AND user_id = ?2", [NET, U.frank.id, DEPT.rd]);
+          syncDepartmentGroups(NET);
+          throw new Error("inner");
+        });
+      } catch {}
+      // 事务还没提交:这时一条都不该推出去
+      expect(mev("alice")).toHaveLength(0);
+    });
+    expect(isGroupMember(GRP.rd, U.gina.id)).toBe(true);
+    expect(isGroupMember(GRP.rd, U.frank.id)).toBe(false);
+    await until(() => match("alice", "rd", "gina", "added", "department").length > 0);
+    expect(match("alice", "rd", "gina", "added", "department")).toHaveLength(1);
+    await sleep(100);
+    for (const w of Object.keys(S)) expect(mev(w).filter((e) => e.member_user_id === U.frank.id)).toHaveLength(0);
+  });
+});
+
+describe("network member removal", () => {
+  test("removing hank from the network → remaining 研发部 members get `removed`/network_removal", async () => {
+    // 调部门 / 换负责人会踢掉当事人的用户流(RFC-040,App 会重连):erin、gina 先重订阅。
+    for (const w of ["erin", "gina"]) { S[w].close(); S[w] = await subscribe(w); }
+    await reset();
+    const r = await send(U.owner.token, "DELETE", `/api/networks/${NET}/members/${U.hank.id}`);
+    expect(r.status).toBe(200);
+    await until(() => ["alice", "erin", "gina"].every((w) => match(w, "rd", "hank", "removed", "network_removal").length > 0));
+    expect(match("alice", "rd", "hank", "removed", "network_removal")).toHaveLength(1);
+    expect(match("erin", "rd", "hank", "removed", "network_removal")).toHaveLength(1);
+    expect(match("gina", "rd", "hank", "removed", "network_removal")).toHaveLength(1);
+    // 不能再有一条 department 来源的重复移出(移出网络已经删了所有行,对账没东西可删)
+    expect(match("alice", "rd", "hank", "removed", "department")).toHaveLength(0);
+    expect(isGroupMember(GRP.rd, U.hank.id)).toBe(false);
+  });
+});

package/src/node-identity-mismatch.test.ts

@@ -0,0 +1,74 @@
+// report_status must not relabel a nodes row that belongs to another node.
+//
+// Shape seen in production: node A's config carries a node_id that another
+// node B reported first (a copied config / a colliding hand-backfilled id).
+// The row is B's alias + B's config_path, unowned (pre-RFC-036). When A starts
+// reporting node_id, upsertNodeWithSec1Guard's COALESCE would overwrite the
+// alias with A's — B's row silently becomes A's. identity_mismatch refuses it.
+//
+// Run with: COMMHUB_DB=/tmp/identity-mismatch.db bun test src/node-identity-mismatch.test.ts
+
+import { beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { upsertNodeWithSec1Guard } from "./tools.js";
+
+const NET = "net_identity";
+
+function row(node_id: string, alias: string, config_path: string | null, owner: string | null = null) {
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, runtime, config_path, network_id, owner_user_id) VALUES (?1, ?2, ?2, 'codex-app-server-sdk', ?3, ?4, ?5)`,
+    [node_id, alias, config_path, NET, owner],
+  );
+}
+const read = (id: string) => db.get<{ alias: string; runtime: string | null; config_path: string | null }>(
+  "SELECT alias, runtime, config_path FROM nodes WHERE node_id = ?1", id,
+)!;
+
+beforeEach(() => { db.run("DELETE FROM nodes"); });
+
+describe("upsertNodeWithSec1Guard — identity_mismatch", () => {
+  test("different alias + different config_path ⇒ refused, row untouched", () => {
+    row("n_shared01", "node-b", "/work/b/.anet/nodes/node-b/config.json");
+    const out = upsertNodeWithSec1Guard({
+      node_id: "n_shared01", callerNetworkId: NET, alias: "node-a", runtime: "claude-code",
+      config_path: "/work/a/.anet/nodes/node-a/config.json",
+    });
+    expect(out).toMatchObject({ result: "refused", reason: "identity_mismatch" });
+    expect(read("n_shared01")).toEqual({ alias: "node-b", runtime: "codex-app-server-sdk", config_path: "/work/b/.anet/nodes/node-b/config.json" });
+  });
+
+  test("same alias, different config_path (the node moved dirs) ⇒ updated", () => {
+    row("n_moved01", "node-a", "/old/.anet/nodes/node-a/config.json");
+    const out = upsertNodeWithSec1Guard({ node_id: "n_moved01", callerNetworkId: NET, alias: "node-a", config_path: "/new/.anet/nodes/node-a/config.json" });
+    expect(out.result).toBe("updated");
+    expect(read("n_moved01").config_path).toBe("/new/.anet/nodes/node-a/config.json");
+  });
+
+  test("different alias, same config_path ⇒ updated (not the collision shape)", () => {
+    row("n_same01", "old-name", "/w/.anet/nodes/x/config.json");
+    expect(upsertNodeWithSec1Guard({ node_id: "n_same01", callerNetworkId: NET, alias: "new-name", config_path: "/w/.anet/nodes/x/config.json" }).result).toBe("updated");
+    expect(read("n_same01").alias).toBe("new-name");
+  });
+
+  test("row without config_path (token-mint row) ⇒ first reporter fills it in", () => {
+    row("n_mint01", "node-a", null);
+    expect(upsertNodeWithSec1Guard({ node_id: "n_mint01", callerNetworkId: NET, alias: "node-a", config_path: "/w/a/config.json" }).result).toBe("updated");
+    expect(read("n_mint01").config_path).toBe("/w/a/config.json");
+  });
+
+  test("reporter without config_path ⇒ no evidence, legacy behaviour kept", () => {
+    row("n_nocfg01", "node-b", "/w/b/config.json");
+    expect(upsertNodeWithSec1Guard({ node_id: "n_nocfg01", callerNetworkId: NET, alias: "node-a" }).result).toBe("updated");
+  });
+
+  test("new node_id ⇒ inserted", () => {
+    expect(upsertNodeWithSec1Guard({ node_id: "n_fresh01", callerNetworkId: NET, alias: "node-a", config_path: "/w/a/config.json" }).result).toBe("inserted");
+    expect(read("n_fresh01").alias).toBe("node-a");
+  });
+
+  test("owner mismatch still wins first (existing gate unchanged)", () => {
+    row("n_owned01", "node-b", "/w/b/config.json", "usr_b");
+    expect(upsertNodeWithSec1Guard({ node_id: "n_owned01", callerNetworkId: NET, callerUserId: "usr_a", alias: "node-a", config_path: "/w/a/config.json" }))
+      .toMatchObject({ result: "refused", reason: "owner_mismatch" });
+  });
+});