@mmmbuto/nexuscrew 0.8.22 → 0.8.24

package/lib/settings/routes.js

@@ -71,8 +71,8 @@ const EDIT_KEYS = new Set(['label', 'ssh', 'sshPort', 'autostart', 'visibility',
 // NON usa ciecamente hostname: se l'hostname e' vuoto o 'localhost' (tipico di
 // chiavi di test / host dietro tunnel) propone un fallback neutro. L'utente puo'
 // sempre sovrascriverlo: questo e' solo il valore iniziale del campo.
-function defaultDeviceName() {
-  const h = String(os.hostname() || '').trim();
+function defaultDeviceName(hostname = os.hostname()) {
+  const h = String(hostname || '').trim();
   if (!h || /^localhost$/i.test(h)) return 'NexusCrew';
   return h.slice(0, nodesStore.LABEL_MAX);
 }
@@ -143,6 +143,7 @@ function readConfigFile(p) {
 function settingsRoutes(deps = {}) {
   const cfg = deps.cfg || {};
   const seams = cfg.settingsSeams || {};
+  const localHostname = typeof seams.hostname === 'function' ? seams.hostname : os.hostname;
   // tokenStore/closeSessions iniettati da server.js per la semantica di invalidazione
   // live (audit F7 / §4b(3)). Assenti nei test unitari puri su routes -> la rotazione
   // scrive solo il file (come prima), senza reload in-memory.
@@ -217,6 +218,10 @@ function settingsRoutes(deps = {}) {
         boot: bootState({ platform, execImpl: seams.execImpl, uid: seams.uid, home }).enabled,
       };
       const updateStatus = updater && typeof updater.status === 'function' ? updater.status() : null;
+      const localStore = nodesStore.loadStore(nodesPath);
+      const localNodeId = localStore && nodesStore.NODE_ID_RE.test(localStore.nodeId)
+        ? localStore.nodeId : null;
+      const deviceName = defaultDeviceName(localHostname());
       const out = {
         roles: readRoles(configPath),
         firstRun,
@@ -227,7 +232,11 @@ function settingsRoutes(deps = {}) {
         autoUpdate: updateStatus ? updateStatus.enabled : fileCfg.autoUpdate !== false,
         // Nome dispositivo proposto per i form di pairing (etichetta umana, non
         // lo slug). La UI lo precompila e lascia editing libero.
-        deviceName: defaultDeviceName(),
+        deviceName,
+        nodeId: localNodeId,
+        localName: localNodeId
+          ? nodesStore.deriveNodeHandle(deviceName, localHostname(), localNodeId)
+          : null,
       };
       if (updateStatus) out.update = updateStatus;
       send(res, 200, out);
@@ -385,8 +394,8 @@ function settingsRoutes(deps = {}) {
   // prima di paired:true. Qui resta solo la registrazione dietro mutGate;
   // token/credenziali MAI nel payload (redazione nel handler estratto).
   r.post('/nodes/pair', mutGate, createPairHandler({
-    send, validName, defaultDeviceName,
-    nodesPath, configPath, home, seams, runtimePort,
+    send, validName, defaultDeviceName: () => defaultDeviceName(localHostname()),
+    localHostname, nodesPath, configPath, home, seams, runtimePort,
   }));
 
   // --- POST /nodes — nodes add (riusa nodesCmds.nodesAdd) --------------------

package/lib/tmux/lifecycle.js

@@ -51,7 +51,8 @@ function buildCreateArgs(name, realCwd, preset, extraPresets) {
 
 function httpError(status, msg) { const e = new Error(msg); e.status = status; return e; }
 
-function createSession(tmuxBin, { name, cwd, preset }, { home, presets } = {}) {
+async function createSession(tmuxBin, { name, cwd, preset }, { home, presets, ensureProtection } = {}) {
+  if (typeof ensureProtection === 'function') await ensureProtection();
   return new Promise((resolve, reject) => {
     if (!validSessionName(name)) return reject(httpError(400, 'nome sessione non valido'));
     // Il namespace cloud-* e' delle celle fleet (audit finale #1): una generica
@@ -71,7 +72,8 @@ function createSession(tmuxBin, { name, cwd, preset }, { home, presets } = {}) {
   });
 }
 
-function killSession(tmuxBin, name) {
+async function killSession(tmuxBin, name, { ensureProtection } = {}) {
+  if (typeof ensureProtection === 'function') await ensureProtection();
   return new Promise((resolve, reject) => {
     execFile(tmuxBin, ['kill-session', '-t', `=${name}`], (err, _o, stderr) => {
       if (err) {

package/lib/tmux/shared-server.js

@@ -0,0 +1,60 @@
+'use strict';
+
+const os = require('node:os');
+const { execFile } = require('node:child_process');
+const { minimalRuntimeEnv } = require('../runtime/env.js');
+
+// Operational guard for NexusCrew's shared tmux server.  tmux command aliases
+// are not a security boundary against another process running as the same UID,
+// but they neutralize accidental `tmux kill-server` calls while exit-empty=off
+// keeps the server alive when the last managed session is intentionally stopped.
+const KILL_SERVER_ALIAS_INDEX = 'command-alias[100]';
+const KILL_SERVER_ALIAS = 'kill-server=display-message "DENIED: kill-server disabled by NexusCrew"';
+
+function protectionArgs() {
+  return [
+    'start-server',
+    ';', 'set-option', '-s', 'exit-empty', 'off',
+    ';', 'set-option', '-s', KILL_SERVER_ALIAS_INDEX, KILL_SERVER_ALIAS,
+  ];
+}
+
+function protectSharedTmuxServer(tmuxBin = 'tmux', opts = {}) {
+  if (opts.enabled === false) return Promise.resolve({ ok: true, protected: false, reason: 'disabled' });
+  const execFileImpl = opts.execFileImpl || execFile;
+  const env = opts.env || minimalRuntimeEnv(process.env, { home: opts.home || os.homedir() });
+  return new Promise((resolve) => {
+    try {
+      execFileImpl(tmuxBin, protectionArgs(), { env, timeout: opts.timeoutMs || 5000 }, (err, _stdout, stderr) => {
+        if (err) {
+          return resolve({
+            ok: false,
+            protected: false,
+            reason: String(stderr || err.message || 'tmux protection failed').trim(),
+          });
+        }
+        resolve({ ok: true, protected: true, reason: 'kill-server guarded; exit-empty off' });
+      });
+    } catch (error) {
+      resolve({ ok: false, protected: false, reason: String(error && error.message || error) });
+    }
+  });
+}
+
+async function requireSharedTmuxProtection(tmuxBin, opts = {}) {
+  const result = await protectSharedTmuxServer(tmuxBin, opts);
+  if (!result.ok) {
+    const error = new Error(`tmux shared-server protection failed: ${result.reason || 'unknown error'}`);
+    error.status = 500;
+    throw error;
+  }
+  return result;
+}
+
+module.exports = {
+  KILL_SERVER_ALIAS_INDEX,
+  KILL_SERVER_ALIAS,
+  protectionArgs,
+  protectSharedTmuxServer,
+  requireSharedTmuxProtection,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.22",
+  "version": "0.8.24",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {