@mmmbuto/nexuscrew 0.7.7 → 0.8.0

package/lib/server.js

@@ -13,7 +13,7 @@ const { createPreviewSampler } = require('./tmux/preview.js');
 const { openAttach } = require('./pty/attach.js');
 const { bindWs } = require('./ws/bridge.js');
 const { loadOrCreateToken, verify } = require('./auth/token.js');
-const { requireToken } = require('./auth/middleware.js');
+const { requireToken, bearerFrom } = require('./auth/middleware.js');
 const { filesRoutes } = require('./files/routes.js');
 const { createOutboxWatcher } = require('./files/watcher.js');
 const VERSION = require('../package.json').version;
@@ -21,6 +21,17 @@ const { transcribe } = require('./voice/transcribe.js');
 const { selectProvider } = require('./fleet/provider.js');
 const { fleetRoutes } = require('./fleet/routes.js');
 const { fsRoutes } = require('./fs/routes.js');
+const nodesStore = require('./nodes/store.js');
+const nodesTunnel = require('./nodes/tunnel.js');
+const { createNodeProxy, handleNodeUpgrade } = require('./proxy/node-proxy.js');
+const { settingsRoutes } = require('./settings/routes.js');
+const decksStore = require('./decks/store.js');
+const { decksRoutes } = require('./decks/routes.js');
+const { createEventsHub } = require('./notify/events.js');
+const { createPushService } = require('./notify/push.js');
+const { createAsksStore } = require('./notify/asks.js');
+const { createNotifier } = require('./notify/notifier.js');
+const { notifyRoutes } = require('./notify/routes.js');
 
 function sessionExists(tmuxBin, name) {
   if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name)) return false;
@@ -28,18 +39,90 @@ function sessionExists(tmuxBin, name) {
   catch (_) { return false; }
 }
 
+function uiBuildVersion(distDir) {
+  try {
+    const x = JSON.parse(require('node:fs').readFileSync(path.join(distDir, 'version.json'), 'utf8'));
+    return typeof x.version === 'string' ? x.version : null;
+  } catch (_) { return null; }
+}
+
 function createServer(opts = {}) {
   const cfg = loadConfig(opts);
   assertLoopback(cfg.bind);
-  const token = loadOrCreateToken(cfg.tokenPath);
+  // Token holder LIVE (audit F7 / §4b(3)): requireToken/verify leggono tokenStore.get()
+  // ad ogni richiesta, cosi' una rotazione via Settings API invalida il VECCHIO token
+  // (401) e attiva il NUOVO (200) SENZA restart. Prima il token era catturato una volta
+  // allo startup e restava valido fino al restart manuale.
+  const tokenHolder = { value: loadOrCreateToken(cfg.tokenPath) };
+  const tokenStore = {
+    get: () => tokenHolder.value,
+    reload: () => { tokenHolder.value = loadOrCreateToken(cfg.tokenPath); return tokenHolder.value; },
+  };
+  const proxySockets = new Set();
+  // wss viene creato piu' sotto; closeSessions lo raggiunge a request-time (mai durante
+  // createServer) per chiudere le sessioni WS attive sulla rotazione token (§4b(3)).
+  let wss = null;
+  const closeSessions = () => {
+    if (wss) {
+      for (const ws of wss.clients) { try { ws.close(4001, 'token rotated'); } catch (_) { /* best-effort */ } }
+    }
+    for (const socket of proxySockets) { try { socket.destroy(); } catch (_) {} }
+    proxySockets.clear();
+  };
   const watcher = createOutboxWatcher({ root: cfg.filesRoot });
   const previews = createPreviewSampler(cfg.tmuxBin);
+  // MCP bridge (notify/ask/push): lo stato vive accanto al token (dirname del
+  // tokenPath = ~/.nexuscrew di default) cosi' le istanze isolate via opts/env
+  // nei test NON scrivono mai nella home reale. Tutto lazy: vapid.json/asks.json
+  // nascono al primo uso, non allo startup.
+  const notifyDir = cfg.notifyDir || path.dirname(cfg.tokenPath);
+  // READONLY come floor anche dentro il push service (F3): niente generazione
+  // VAPID ne' cleanup subscription quando il server e' readonly.
+  const bridgeReadonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  const eventsHub = createEventsHub();
+  const pushSvc = createPushService({
+    dir: notifyDir, webpushImpl: cfg.webpushImpl,
+    readonly: bridgeReadonly, maxSubs: cfg.pushMaxSubs, lookupImpl: cfg.pushLookupImpl,
+  });
+  const asksStore = createAsksStore({ dir: notifyDir });
+  const notifier = createNotifier({ hub: eventsHub, push: pushSvc });
   const attachedWs = new Map(); // ws -> session (per il push dei frame files)
   // selectProvider sceglie UNA volta (startup) il provider external|builtin|disabled
   // (design §4b/§9b/§9g) e ritorna {mode,reason,fleet}; routes consumano il .fleet,
   // quindi fleetP resta una Promise<Fleet> (createServer non diventa async).
   const fleetP = selectProvider(cfg).then((p) => p.fleet);
 
+  // Multi-node (B1): nodes.json e' la fonte dati (B0). Il proxy risolve <name>
+  // -> {localPort, token} leggendo lo store ad ogni richiesta (fresh: rotazione
+  // token / add-remove nodi visibili senza restart). token MAI redatto qui: e'
+  // il valore che il proxy inietta upstream, non esce mai verso il browser.
+  const nodesPath = cfg.nodesPath || nodesStore.defaultNodesPath(cfg.home || os.homedir());
+  const decksPath = cfg.decksPath || decksStore.defaultDecksPath(cfg.home || os.homedir());
+  const proxyReadonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  function resolveNode(name) {
+    const st = nodesStore.loadStore(nodesPath);
+    if (!st) return null;
+    const node = nodesStore.getNode(st, name);
+    if (!node) return null;
+    return { localPort: node.localPort, token: node.token || null };
+  }
+
+  // A node-role installation must republish itself after service/reboot. The
+  // detached supervisor is idempotent and owns retry/backoff independently.
+  if (cfg.roles && cfg.roles.node === true) {
+    const st = nodesStore.loadStore(nodesPath);
+    if (st && st.rendezvous) {
+      const tr = nodesTunnel.startReverse({
+        home: cfg.home || os.homedir(), rendezvous: st.rendezvous,
+        spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
+        sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
+      });
+      if (!tr.started && tr.reason !== 'already running') {
+        process.stderr.write(`[nexuscrew] reverse tunnel autostart failed: ${tr.reason || 'unknown'}\n`);
+      }
+    }
+  }
+
   const app = express();
   const distDir = path.join(__dirname, '..', 'frontend', 'dist');
   // no-store on everything (HTML+assets+API): this is a local, token-adjacent tool.
@@ -48,7 +131,7 @@ function createServer(opts = {}) {
   // Tutte le /api dietro Bearer: sul loopback il gate vero è il tunnel,
   // ma il token chiude anche altri processi locali della stessa macchina.
   const api = express.Router();
-  api.use(requireToken(token));
+  api.use(requireToken(tokenStore));
   api.get('/sessions', async (_req, res) => {
     try {
       const sessions = await listSessions(cfg.tmuxBin);
@@ -82,7 +165,7 @@ function createServer(opts = {}) {
     } catch (e) { res.status(e.status || 500).json({ error: String(e.message || e) }); }
   });
   api.get('/config', (_req, res) => res.json({
-    readonlyDefault: cfg.readonlyDefault, version: VERSION,
+    readonlyDefault: cfg.readonlyDefault, version: VERSION, uiVersion: uiBuildVersion(distDir),
     bind: cfg.bind, port: cfg.port,
     presets: ['shell', 'claude', 'codex-vl', 'pi', ...Object.keys(cfg.sessionPresets || {})],
   }));
@@ -90,9 +173,38 @@ function createServer(opts = {}) {
     cfg,
     sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
     paste: (session, text) => pasteToSession(cfg.tmuxBin, session, text),
+    notifier,
+  }));
+  // MCP bridge (design §2): /notify, /push/*, /asks — dietro lo stesso Bearer
+  // del router /api; gate READONLY sui mutanti dentro notifyRoutes.
+  api.use(notifyRoutes({
+    cfg,
+    notifier,
+    push: pushSvc,
+    asks: asksStore,
+    paste: (session, text) => pasteToSession(cfg.tmuxBin, session, text),
+    sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
   }));
   api.use('/fleet', fleetRoutes(fleetP, cfg));
+  api.use('/decks', decksRoutes({ cfg, decksPath }));
   api.use('/fs', fsRoutes({ home: os.homedir() }));  // folder-picker del dialog new session
+  // /nodes (read-only, per la settings UI B2): stesso formato di `nodes list --json`
+  // (token SEMPRE redatti via redactStore) + stato tunnel per-nodo.
+  api.get('/nodes', (_req, res) => {
+    try {
+      const st = nodesStore.loadStore(nodesPath);
+      if (!st) return res.json({ nodeId: null, nodes: [] });
+      const view = nodesStore.redactStore(st);
+      const nodes = view.nodes.map((n) => ({ ...n, tunnel: nodesTunnel.readTunnelState(os.homedir(), n.name) }));
+      const out = { nodeId: view.nodeId, nodes };
+      if (view.rendezvous) out.rendezvous = view.rendezvous;
+      res.json(out);
+    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
+  });
+  // Settings API B2 (design §4b(6)): read-only GET + mutanti lista chiusa per il
+  // wizard/settings UI. Dietro lo stesso requireToken del router /api; il gate
+  // READONLY route-level e la redazione token vivono dentro settingsRoutes.
+  api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions }));
   api.get('/voice/status', (_req, res) => res.json({ serverSttConfigured: !!cfg.voiceUrl }));
   api.post('/voice/transcribe',
     express.raw({ type: () => true, limit: '25mb' }),
@@ -102,21 +214,99 @@ function createServer(opts = {}) {
         res.json({ text: out.text || '' });
       } catch (e) { res.status(e.status || 502).json({ error: e.message }); }
     });
+  // SSE eventi UI (notify/ask, MCP bridge §2a): EventSource non puo' settare
+  // header -> il token e' accettato anche in query, SOLO perche' il bind e'
+  // loopback-only (stesso pattern dell'upgrade WS del proxy /node). Montata
+  // PRIMA del router /api (che e' Bearer-only) e sempre sul token live.
+  app.get('/api/events', (req, res) => {
+    const given = bearerFrom(req) || String(req.query.token || '');
+    if (!verify(tokenHolder.value, given)) {
+      return res.status(401).json({ error: 'unauthorized' });
+    }
+    eventsHub.handle(req, res);
+  });
+
   app.use('/api', api);
 
+  // Reverse-proxy single-origin /node/<name>/… (design §4b(2)). Auth locale PRIMA
+  // di risolvere <name>: requireToken(token) davanti al router, nessuna route
+  // proxy montata prima del middleware auth. Montato PRIMA dello static/catch-all.
+  app.use('/node', requireToken(tokenStore), createNodeProxy({ resolveNode, readonly: proxyReadonly }));
+
   app.use(express.static(distDir));
+  // Deck multi-finestra (§5b): /deck/<name> serve la STESSA SPA (stesso origin,
+  // stesso token via fragment). <name> e' una chiave strict client-side, mai usata
+  // per costruire path: validazione ^[a-z0-9-]{1,32}$, nome invalido → 404 secco
+  // (niente traversal, niente fallback silenzioso alla SPA su nomi sporchi).
+  const DECK_NAME_RE = /^[a-z0-9-]{1,32}$/;
+  // Cattura TUTTO cio' che sta sotto /deck/ (anche slash/segmenti extra o encoded)
+  // e valida il remainder: qualunque cosa non sia un nome deck strict → 404,
+  // senza mai cadere nel catch-all SPA con un nome sporco.
+  app.get(/^\/deck\/(.*)$/, (req, res) => {
+    // parita' col client: deckFromPath accetta UN trailing slash (/deck/main/),
+    // il server deve fare lo stesso; piu' di uno resta 404 (regex strict).
+    const name = req.params[0].replace(/\/$/, '');
+    if (!DECK_NAME_RE.test(name)) {
+      return res.status(404).type('text/plain').send('invalid deck name');
+    }
+    return res.sendFile(path.join(distDir, 'index.html'));
+  });
   app.get('*', (_req, res) => res.sendFile(path.join(distDir, 'index.html')));
 
   const server = http.createServer(app);
   // Close the watcher when the HTTP server closes. Registered HERE (inside
   // createServer) — not in start() — so every createServer consumer is covered,
   // not only the start() path. watcher.close() is idempotent.
-  server.on('close', () => { watcher.close(); previews.close(); });
-  const wss = new WebSocketServer({ server, path: '/ws', maxPayload: 1 << 20 });
-  wss.on('connection', (ws) => {
+  server.on('close', () => { watcher.close(); previews.close(); eventsHub.closeAll(); });
+  // noServer: gestiamo l'upgrade a mano per instradare /ws (locale) e /node/*
+  // (proxy). Il WS locale resta identico; il proxy WS applica gli STESSI check
+  // dell'HTTP (auth locale -> name strict -> inject token) prima del piping.
+  wss = new WebSocketServer({ noServer: true, maxPayload: 1 << 20 });
+  // Browser/mobile/tunnel possono lasciare TCP half-open senza un close event.
+  // Il ping applicativo fa emergere il guasto; terminate genera un close 1006
+  // lato browser, che il client riconnette senza richiedere refresh pagina.
+  const heartbeat = setInterval(() => {
+    for (const client of wss.clients) {
+      if (client.isAlive === false) { try { client.terminate(); } catch (_) {} continue; }
+      client.isAlive = false;
+      try { client.ping(); } catch (_) { try { client.terminate(); } catch (_e) {} }
+    }
+  }, opts.wsHeartbeatMs || 30000);
+  if (typeof heartbeat.unref === 'function') heartbeat.unref();
+  server.on('close', () => clearInterval(heartbeat));
+  server.on('upgrade', (req, socket, head) => {
+    let pathname;
+    try { pathname = new URL(req.url, 'http://127.0.0.1').pathname; }
+    catch (_) { try { socket.destroy(); } catch (_e) {} return; }
+    if (pathname === '/ws') {
+      wss.handleUpgrade(req, socket, head, (ws) => wss.emit('connection', ws, req));
+      return;
+    }
+    if (pathname === '/node' || pathname.startsWith('/node/')) {
+      handleNodeUpgrade({
+        req, socket, head, resolveNode,
+        verifyToken: (t) => verify(tokenHolder.value, t),
+        readonly: proxyReadonly,
+        activeSockets: proxySockets,
+      });
+      return;
+    }
+    try { socket.destroy(); } catch (_) {}
+  });
+  wss.on('connection', (ws, req) => {
+    ws.isAlive = true;
+    ws.on('pong', () => { ws.isAlive = true; });
+    // Preauth via header (B2 attach remoto): quando l'upgrade arriva dal proxy
+    // /node/<name> di un hub, il proxy ha gia' iniettato `Authorization: Bearer
+    // <token di QUESTO nodo>` (§4b(2)#3) mentre il frame attach porta il token
+    // del hub. Un Bearer valido sull'upgrade vale come auth: e' lo STESSO
+    // verify dello stesso token locale, solo su un canale diverso. I browser
+    // non possono settare header sui WS -> il flusso locale resta identico
+    // (token nel frame attach, mai in URL).
+    const preauth = req ? verify(tokenHolder.value, bearerFrom(req)) : false;
     bindWs(ws, {
       openAttach,
-      verifyToken: (t) => verify(token, t),
+      verifyToken: (t) => preauth || verify(tokenHolder.value, t),
       isValidSession: (name) => sessionExists(cfg.tmuxBin, name),
       runAction: (sess, action) => runAction(cfg.tmuxBin, sess, action),
       countClients: (sess) => attachedClients(cfg.tmuxBin, sess),
@@ -134,14 +324,18 @@ function createServer(opts = {}) {
     }
   });
 
-  return { app, server, wss, cfg, token, watcher, fleetP };
+  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP };
 }
 
 function start(opts = {}) {
-  const { server, cfg, token } = createServer(opts);
+  const { server, cfg } = createServer(opts);
+  const log = opts.log || console.log;
   server.listen(cfg.port, cfg.bind, () => {
-    console.log(`nexuscrew on http://${cfg.bind}:${cfg.port}  (token: ${token})`);
-    console.log('localhost-only — reach it via SSH/autossh/VPN tunnel.');
+    // Il token NON si stampa allo startup: finirebbe nei log del servizio
+    // (journalctl/logfile), che `nexuscrew logs` espone — contratto A2
+    // "token mai nei log". Per l'URL completo: `nexuscrew url` (o --qr).
+    log(`nexuscrew on http://${cfg.bind}:${cfg.port}  (token: usa \`nexuscrew url\`)`);
+    log('localhost-only — reach it via SSH/autossh/VPN tunnel.');
   });
   return server;
 }