@mmmbuto/nexuscrew 0.8.25 → 0.8.27

package/lib/fleet/managed.js

@@ -7,6 +7,7 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { execFile } = require('node:child_process');
 const { ENV_KEY_RE } = require('./env-key.js');
+const { termuxRuntimePaths } = require('../runtime/env.js');
 const { readCredentialStore, safePrivateDir } = require('./credentials.js');
 
 const OLLAMA_CLOUD_MODELS = Object.freeze([
@@ -274,8 +275,15 @@ function findBinary(client, home) {
 // client starts.  Detect only that explicit Node shebang and invoke it through
 // the already-running trusted Node executable.  Native and shell binaries keep
 // their original direct-exec path.
-function needsExplicitNode(binary, platform = process.platform) {
-  if (platform !== 'android') return false;
+//
+// Detection uses both process.platform AND the runtime Termux layout (PREFIX /
+// files/home) so that a Node build that reports `linux` while actually running
+// under Termux (proot / custom build) still gets the shebang workaround. The
+// optional `env` argument lets tests inject a synthetic environment; the public
+// two-argument call form is unchanged.
+function needsExplicitNode(binary, platform = process.platform, env = process.env) {
+  const termux = platform === 'android' || termuxRuntimePaths(env, { platform }) !== null;
+  if (!termux) return false;
   try {
     const fd = fs.openSync(binary, 'r');
     try {
@@ -702,7 +710,7 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
   }
   if (cell?.prompt) args.push(cell.prompt);
   let command = info.binary;
-  if (needsExplicitNode(info.binary, cfg.platform || process.platform)) {
+  if (needsExplicitNode(info.binary, cfg.platform || process.platform, cfg.env || process.env)) {
     command = cfg.nodeExecPath || process.execPath;
     args.unshift(info.binary);
   }

package/lib/fleet/routes.js

@@ -29,6 +29,14 @@ function fleetRoutes(fleetP, cfg = {}) {
   r.use((req, res, next) => (req.path === '/restore-cells' || req.path === '/restore-engines' ? restoreJson : smallJson)(req, res, next));
 
   const readonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  const diagnostics = cfg.diagnostics || null;
+  const safeCell = (body) => {
+    const value = body && typeof body.cell === 'string' ? body.cell : '';
+    return /^[A-Za-z0-9._-]{1,32}$/.test(value) ? value : '';
+  };
+  const emit = (level, code, message, meta) => {
+    if (diagnostics && typeof diagnostics.record === 'function') diagnostics.record(level, 'fleet', code, message, meta);
+  };
 
   const guard = (fn, opts = {}) => async (req, res) => {
     try {
@@ -36,8 +44,25 @@ function fleetRoutes(fleetP, cfg = {}) {
       if (opts.mutate && readonly()) return res.status(403).json({ error: 'READONLY: mutazione fleet bloccata' });
       const fleet = await fleetP;
       if (!fleet.available) return res.status(404).json({ error: 'fleet non disponibile' });
-      res.json(await fn(fleet, req.body || {}));
+      const body = req.body || {};
+      if (opts.action) emit('info', 'FLEET_ACTION_STARTED', 'Fleet action started', {
+        action: opts.action, cell: safeCell(body), state: 'starting',
+      });
+      const result = await fn(fleet, body);
+      if (opts.action) emit('info', 'FLEET_ACTION_COMPLETED', 'Fleet action completed', {
+        action: opts.action, cell: safeCell(body), state: opts.action === 'down' ? 'stopped' : 'ready',
+      });
+      res.json(result);
     } catch (e) {
+      if (opts.action) {
+        const match = String(e && e.message || '').match(/cell spawn failed:\s+([A-Z][A-Z0-9_]{0,31})\s+([A-Za-z0-9._+-]{1,128})/);
+        if (match) emit('error', 'CELL_SPAWN_FAILED', 'Cell client spawn failed', {
+          action: opts.action, cell: safeCell(req.body), errno: match[1], client: match[2], status: e.status || 500,
+        });
+        else emit('warn', 'FLEET_ACTION_FAILED', 'Fleet action failed', {
+          action: opts.action, cell: safeCell(req.body), state: 'failed', status: e.status || 500,
+        });
+      }
       res.status(e.status || 500).json({ error: String(e.message || e), ...(e.data || {}) });
     }
   };
@@ -82,13 +107,13 @@ function fleetRoutes(fleetP, cfg = {}) {
       await f.boot(cell, b.boot === true);
     }
     return f.up(cell, { engine: b.engine, boot: !!b.boot });
-  }, { mutate: true }));
+  }, { mutate: true, action: 'up' }));
   r.post('/down', guard(async (f, b) => {
     const cell = String(b.cell || '');
     if (b.boot === true && capList(f).includes('edit') && capList(f).includes('boot')) await f.boot(cell, false);
     return f.down(cell, { boot: !!b.boot });
-  }, { mutate: true }));
-  r.post('/restart', guard((f, b) => { requireCap(f, 'restart'); return f.restart(String(b.cell || '')); }, { mutate: true }));
+  }, { mutate: true, action: 'down' }));
+  r.post('/restart', guard((f, b) => { requireCap(f, 'restart'); return f.restart(String(b.cell || '')); }, { mutate: true, action: 'restart' }));
   r.post('/engine', guard((f, b) => {
     const opts = { model: typeof b.model === 'string' ? b.model : '' };
     if (typeof b.permissionPolicy === 'string') opts.permissionPolicy = b.permissionPolicy;

package/lib/mcp/server.js

@@ -25,7 +25,7 @@ const { loadConfig } = require('../config.js');
 const { readTokenSafe } = require('../auth/token.js');
 const { isValidSession } = require('../files/store.js');
 const VERSION = require('../../package.json').version;
-const { TOOLS } = require('./tools.js');
+const { TOOLS, IDENTITY_CODE, IDENTITY_REMEDIATION } = require('./tools.js');
 const cells = require('./cells.js');
 
 // Versione protocollo di fallback se il client non ne dichiara una valida.
@@ -39,27 +39,83 @@ const METHOD_NOT_FOUND = -32601;
 const INVALID_PARAMS = -32602;
 
 // --- identita' cella mittente ------------------------------------------------
-// Ordine (design §1): $TMUX presente -> `tmux display-message -p '#S'` (nome
-// sessione reale); fallback env NEXUSCREW_MCP_SESSION; altrimenti null (i tool
-// che RICHIEDONO la sessione falliscono con errore chiaro, nc_notify degrada
-// a sender sconosciuto). execFile argv diretto: mai shell.
-function resolveSession({ env, tmuxBin, execFileImpl }) {
-  const fallback = () => {
-    const s = env.NEXUSCREW_MCP_SESSION;
-    return (typeof s === 'string' && isValidSession(s.trim())) ? s.trim() : null;
+// Ordine (design §1, INVARIATO): $TMUX presente -> `tmux display-message -p '#S'`
+// (nome sessione reale); se fallisce/invalida -> fallback env NEXUSCREW_MCP_SESSION;
+// altrimenti null. I tool che RICHIEDONO la sessione restano fail-closed.
+// execFile argv diretto: mai shell.
+//
+// `resolveIdentity` rende OSSERVABILE la sorgente della risoluzione (P0):
+// ritorna { session, source, code, envPresence, requiredEnvVars, remediation }
+// senza cambiare la precedenza e senza esporre valori/segreti. `resolveSession`
+// resta il wrapper pubblico Promise<string|null> invariato (compatibilita').
+const IDENTITY_REQUIRED_ENV_VARS = Object.freeze(['TMUX', 'TMUX_PANE', 'NEXUSCREW_MCP_SESSION']);
+
+function envPresenceOf(env) {
+  return {
+    TMUX: !!env.TMUX,
+    TMUX_PANE: !!env.TMUX_PANE,
+    NEXUSCREW_MCP_SESSION: !!(typeof env.NEXUSCREW_MCP_SESSION === 'string' && env.NEXUSCREW_MCP_SESSION.trim()),
+  };
+}
+
+function resolveIdentity({ env, tmuxBin, execFileImpl }) {
+  const e = env || {};
+  const envPresence = envPresenceOf(e);
+  const fallbackRaw = e.NEXUSCREW_MCP_SESSION;
+  const fallbackPresent = typeof fallbackRaw === 'string' && fallbackRaw.trim().length > 0;
+  const tmuxPresent = !!e.TMUX;
+
+  // Prova il fallback NEXUSCREW_MCP_SESSION: ritorna la sessione normalizzata se
+  // valida, `false` se presente ma invalida, `null` se assente.
+  const tryFallback = () => {
+    if (!fallbackPresent) return null;
+    const s = fallbackRaw.trim();
+    return isValidSession(s) ? s : false;
   };
-  if (!env.TMUX) return Promise.resolve(fallback());
+
+  // code quando NON identificati: INVALID se c'e' un segnale di identita'
+  // (TMUX o NEXUSCREW_MCP_SESSION presente), MISSING altrimenti.
+  const codeWhenMissing = () => ((tmuxPresent || fallbackPresent)
+    ? IDENTITY_CODE.INVALID : IDENTITY_CODE.MISSING);
+
+  const ok = (session, source) => ({
+    session, source, code: IDENTITY_CODE.OK,
+    envPresence, requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+  });
+  const missing = () => ({
+    session: null, source: 'missing', code: codeWhenMissing(),
+    envPresence, requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+  });
+
   return new Promise((resolve) => {
+    if (!tmuxPresent) {
+      const fb = tryFallback();
+      return resolve(typeof fb === 'string' ? ok(fb, 'NEXUSCREW_MCP_SESSION') : missing());
+    }
     try {
       execFileImpl(tmuxBin, ['display-message', '-p', '#S'], { timeout: 3000 }, (err, stdout) => {
-        if (err) return resolve(fallback());
-        const name = String(stdout || '').trim();
-        resolve(isValidSession(name) ? name : fallback());
+        if (!err) {
+          const name = String(stdout || '').trim();
+          if (isValidSession(name)) return resolve(ok(name, 'tmux'));
+        }
+        // tmux fallito/invalido -> precedenza preservata: fallback env.
+        const fb = tryFallback();
+        resolve(typeof fb === 'string' ? ok(fb, 'NEXUSCREW_MCP_SESSION') : missing());
       });
-    } catch (_) { resolve(fallback()); }
+    } catch (_) {
+      const fb = tryFallback();
+      resolve(typeof fb === 'string' ? ok(fb, 'NEXUSCREW_MCP_SESSION') : missing());
+    }
   });
 }
 
+// Wrapper pubblico STORICO: stessi parametri, stesso return Promise<string|null>.
+// Mantiene i test esistenti e ogni chiamante esterno che dipende solo dal nome
+// della sessione (o null). La diagnostica source/code vive in resolveIdentity.
+function resolveSession(opts) {
+  return resolveIdentity(opts).then((i) => i.session);
+}
+
 // --- server --------------------------------------------------------------------
 function createMcpServer(opts = {}) {
   const input = opts.input || process.stdin;
@@ -75,11 +131,15 @@ function createMcpServer(opts = {}) {
   const baseUrl = `http://127.0.0.1:${cfg.port}`;
 
   // Identita' risolta una volta e cacheata (la sessione tmux non cambia a runtime).
-  let sessionP = null;
-  const session = () => {
-    if (!sessionP) sessionP = resolveSession({ env, tmuxBin: cfg.tmuxBin || 'tmux', execFileImpl });
-    return sessionP;
+  // Una sola risoluzione condivisa: `identity()` per la diagnostica completa
+  // (source/code/presence), `session()` estrae solo il nome per gli handler
+  // storici (compatibilita'). Nessuna API/token coinvolta qui.
+  let identityP = null;
+  const identity = () => {
+    if (!identityP) identityP = resolveIdentity({ env, tmuxBin: cfg.tmuxBin || 'tmux', execFileImpl });
+    return identityP;
   };
+  const session = () => identity().then((i) => i.session);
 
   // Token letto ad OGNI chiamata (rotazione-friendly), MAI incluso negli errori.
   function readToken() {
@@ -113,6 +173,7 @@ function createMcpServer(opts = {}) {
 
   const ctx = {
     session,
+    identity,
     api,
     home: () => env.HOME || os.homedir(),
     fileExists: (p) => { try { return require('node:fs').statSync(p).isFile(); } catch (_) { return false; } },
@@ -252,7 +313,7 @@ function startMcp(opts = {}) {
 }
 
 module.exports = {
-  createMcpServer, startMcp, resolveSession, TOOLS,
+  createMcpServer, startMcp, resolveSession, resolveIdentity, TOOLS,
   parseCellTarget: cells.parseCellTarget,
   normalizeCellPayload: cells.normalizeCellPayload,
   readCellDirectory: cells.readCellDirectory,

package/lib/mcp/tools.js

@@ -27,10 +27,33 @@ function argString(args, key, { required = false, max = 4096 } = {}) {
   return v;
 }
 
-function requireSession(session, tool) {
+// Codici stabili di identita' MCP (contratto P0). Valori EXACT, non sensibili,
+// usati sia nella diagnostica read-only (`nc_identity`) sia nel messaggio umano
+// dei tool identity-gated (isError=true preservato dal server). Non espongono
+// valori/env/sessioni: solo la categoria del problema.
+const IDENTITY_CODE = Object.freeze({
+  OK: 'OK',
+  MISSING: 'NEXUSCREW_MCP_IDENTITY_MISSING',
+  INVALID: 'NEXUSCREW_MCP_IDENTITY_INVALID',
+});
+
+// Remediation senza segreti/valori: nomi soltanto, compatibile con
+// `codex-vl mcp add --env-var` (allowlist di nomi, nessun valore persistito).
+const IDENTITY_REMEDIATION =
+  'Nei client che ripuliscono l\'ambiente, allowlista i nomi delle variabili di identita nel server MCP stdio '
+  + '(codex-vl mcp add ... --env-var NEXUSCREW_MCP_SESSION --env-var TMUX --env-var TMUX_PANE) '
+  + 'oppure assicurati che il client MCP inoltri il contesto tmux al processo child: nessun valore '
+  + 'viene copiato nella CLI o nel file di configurazione.';
+
+function requireSession(session, tool, code = IDENTITY_CODE.MISSING) {
   if (session) return session;
+  const stableCode = code === IDENTITY_CODE.INVALID ? IDENTITY_CODE.INVALID : IDENTITY_CODE.MISSING;
+  // Errore umano per il modello: messaggio chiaro + codice stabile fra parentesi
+  // quadre. isError=true e' impostato dal server (toolsCall); qui si propaga
+  // solo il testo. La regex storica /NEXUSCREW_MCP_SESSION/ resta soddisfatta.
   throw new Error(
-    `${tool}: sessione tmux non identificata — serve $TMUX (dentro tmux) o NEXUSCREW_MCP_SESSION`,
+    `${tool}: sessione tmux non identificata — serve $TMUX (dentro tmux) o `
+    + `NEXUSCREW_MCP_SESSION [${stableCode}]`,
   );
 }
 
@@ -79,7 +102,8 @@ const TOOLS = [
       if (args.options !== undefined && !Array.isArray(args.options)) {
         throw new Error('options deve essere un array di stringhe');
       }
-      const session = requireSession(await ctx.session(), 'nc_ask');
+      const identity = await ctx.identity();
+      const session = requireSession(identity.session, 'nc_ask', identity.code);
       const j = await ctx.api('POST', '/api/asks', {
         question, ...(args.options ? { options: args.options } : {}), session,
       });
@@ -109,7 +133,8 @@ const TOOLS = [
       if (!ctx.fileExists(p)) throw new Error(`file inesistente: ${p}`);
       const home = ctx.home();
       if (p !== home && !p.startsWith(home + path.sep)) throw new Error('path fuori da HOME');
-      const session = requireSession(await ctx.session(), 'nc_send_file');
+      const identity = await ctx.identity();
+      const session = requireSession(identity.session, 'nc_send_file', identity.code);
       const j = await ctx.api('POST', '/api/files/outbox', {
         session, path: p, ...(caption ? { caption } : {}),
       });
@@ -145,7 +170,8 @@ const TOOLS = [
     inputSchema: { type: 'object', properties: {} },
     annotations: { readOnlyHint: true },
     async handler(_args, ctx) {
-      const tmuxSession = requireSession(await ctx.session(), 'nc_deck');
+      const identity = await ctx.identity();
+      const tmuxSession = requireSession(identity.session, 'nc_deck', identity.code);
       const [config, topology, localDecks] = await Promise.all([
         ctx.api('GET', '/api/config'), ctx.api('GET', '/api/topology'), ctx.api('GET', '/api/decks'),
       ]);
@@ -257,7 +283,8 @@ const TOOLS = [
         if (code === 9 || code === 10 || code === 13) continue;
         if (code < 32 || code === 127) throw new Error('message contiene caratteri di controllo non ammessi');
       }
-      const callerSession = requireSession(await ctx.session(), 'nc_send_cell');
+      const identity = await ctx.identity();
+      const callerSession = requireSession(identity.session, 'nc_send_cell', identity.code);
       const directory = await readCellDirectory(ctx, callerSession);
       const sender = directory.cells.find((cell) => cell.self && cell.active);
       if (!sender) throw new Error('nc_send_cell: la sessione chiamante non e\' una cella Fleet attiva locale');
@@ -290,11 +317,33 @@ const TOOLS = [
     inputSchema: { type: 'object', properties: {} },
     annotations: { readOnlyHint: true },
     async handler(_args, ctx) {
-      const session = requireSession(await ctx.session(), 'nc_inbox');
+      const identity = await ctx.identity();
+      const session = requireSession(identity.session, 'nc_inbox', identity.code);
       const j = await ctx.api('GET', `/api/files?session=${encodeURIComponent(session)}`);
       return { inbox: Array.isArray(j.inbox) ? j.inbox : [] };
     },
   },
+  {
+    name: 'nc_identity',
+    description: 'Diagnostica read-only dell\'identita\' del chiamante MCP. Utilizzabile anche senza sessione tmux e senza token: restituisce SOLO dati non sensibili (presence delle env var, sorgente della risoluzione, codice stabile). Non chiama API HTTP e non legge il token. Usa questo tool quando gli altri tool nc_* falliscono con NEXUSCREW_MCP_IDENTITY_* per capire cosa manca.',
+    inputSchema: { type: 'object', properties: {} },
+    annotations: { readOnlyHint: true },
+    async handler(_args, ctx) {
+      const id = await ctx.identity();
+      // Output bounded e non sensibile: nessun valore/env, solo presence e codice.
+      // `session` solo se validata; `source` sempre fra i tre valori ammessi.
+      const out = {
+        identified: !!id.session,
+        source: id.source,
+        envPresence: id.envPresence,
+        requiredEnvVars: id.requiredEnvVars,
+        code: id.code,
+        remediation: id.remediation,
+      };
+      if (id.session) out.session = id.session;
+      return out;
+    },
+  },
 ];
 
-module.exports = { TOOLS, argString, requireSession };
+module.exports = { TOOLS, argString, requireSession, IDENTITY_CODE, IDENTITY_REMEDIATION };

package/lib/nodes/aliases.js

@@ -0,0 +1,122 @@
+'use strict';
+// Alias locali del viewer per nodi routed. Questo store non partecipa mai a
+// topology, routing, ACL o federation: associa soltanto uno stable instanceId a
+// un'etichetta di display scelta sul dispositivo che ospita la PWA.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const SCHEMA_VERSION = 1;
+const INSTANCE_ID_RE = /^[a-f0-9]{16,64}$/;
+const ALIAS_MAX = 64;
+const MAX_ALIASES = 128;
+const MAX_FILE_BYTES = 16 * 1024;
+
+function defaultAliasesPath(home = os.homedir()) {
+  return path.join(home, '.nexuscrew', 'node-aliases.json');
+}
+
+function normalizeAlias(value) {
+  if (typeof value !== 'string') return null;
+  const alias = value.normalize('NFC').trim();
+  if (!alias || alias.length > ALIAS_MAX) return null;
+  // Cc/Cf includes newlines, NUL, bidi controls and invisible format chars.
+  if (/[\p{Cc}\p{Cf}]/u.test(alias)) return null;
+  return alias;
+}
+
+function emptyStore() {
+  return { version: SCHEMA_VERSION, aliasesByInstanceId: {} };
+}
+
+function parseStore(raw) {
+  let value;
+  try { value = typeof raw === 'string' ? JSON.parse(raw) : raw; } catch (_) { return null; }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (Object.keys(value).some((key) => !['version', 'aliasesByInstanceId'].includes(key))) return null;
+  if (value.version !== SCHEMA_VERSION) return null;
+  const aliases = value.aliasesByInstanceId;
+  if (!aliases || typeof aliases !== 'object' || Array.isArray(aliases)) return null;
+  const entries = Object.entries(aliases);
+  if (entries.length > MAX_ALIASES) return null;
+  const out = {};
+  for (const [instanceId, rawAlias] of entries) {
+    const alias = normalizeAlias(rawAlias);
+    if (!INSTANCE_ID_RE.test(instanceId) || alias === null || alias !== rawAlias) return null;
+    out[instanceId] = alias;
+  }
+  return { version: SCHEMA_VERSION, aliasesByInstanceId: out };
+}
+
+function assertSafeTarget(filePath) {
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error('node alias store must be a regular file');
+    if ((stat.mode & 0o077) !== 0) throw new Error('node alias store permissions must be 0600');
+    if (stat.size > MAX_FILE_BYTES) throw new Error('node alias store exceeds size limit');
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return false;
+    throw error;
+  }
+  return true;
+}
+
+function loadStore(filePath = defaultAliasesPath()) {
+  if (!assertSafeTarget(filePath)) return emptyStore();
+  const raw = fs.readFileSync(filePath, { encoding: 'utf8', flag: 'r' });
+  if (Buffer.byteLength(raw) > MAX_FILE_BYTES) throw new Error('node alias store exceeds size limit');
+  const parsed = parseStore(raw);
+  if (!parsed) throw new Error('invalid node alias store');
+  return parsed;
+}
+
+function atomicWriteStore(filePath, store) {
+  const parsed = parseStore(store);
+  if (!parsed) throw new Error('invalid node alias store');
+  const payload = `${JSON.stringify(parsed, null, 2)}\n`;
+  if (Buffer.byteLength(payload) > MAX_FILE_BYTES) throw new Error('node alias store exceeds size limit');
+  assertSafeTarget(filePath);
+  const dir = path.dirname(filePath);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const dirStat = fs.lstatSync(dir);
+  if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) throw new Error('node alias directory must be a regular directory');
+  fs.chmodSync(dir, 0o700);
+  const tmp = path.join(dir, `.${path.basename(filePath)}.${crypto.randomBytes(8).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, payload, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, filePath);
+    fs.chmodSync(filePath, 0o600);
+  } catch (error) {
+    try { fs.unlinkSync(tmp); } catch (_) { /* best effort */ }
+    throw error;
+  }
+  return parsed;
+}
+
+function setAlias(store, instanceId, value) {
+  if (!INSTANCE_ID_RE.test(String(instanceId || ''))) throw new Error('instanceId non valido');
+  const alias = normalizeAlias(value);
+  if (alias === null) throw new Error('alias non valido (max 64 char, niente controlli)');
+  const current = parseStore(store);
+  if (!current) throw new Error('invalid node alias store');
+  const aliasesByInstanceId = { ...current.aliasesByInstanceId, [instanceId]: alias };
+  if (Object.keys(aliasesByInstanceId).length > MAX_ALIASES) throw new Error('troppi alias nodo');
+  return { version: SCHEMA_VERSION, aliasesByInstanceId };
+}
+
+function deleteAlias(store, instanceId) {
+  if (!INSTANCE_ID_RE.test(String(instanceId || ''))) throw new Error('instanceId non valido');
+  const current = parseStore(store);
+  if (!current) throw new Error('invalid node alias store');
+  const aliasesByInstanceId = { ...current.aliasesByInstanceId };
+  delete aliasesByInstanceId[instanceId];
+  return { version: SCHEMA_VERSION, aliasesByInstanceId };
+}
+
+module.exports = {
+  SCHEMA_VERSION, INSTANCE_ID_RE, ALIAS_MAX, MAX_ALIASES, MAX_FILE_BYTES,
+  defaultAliasesPath, normalizeAlias, emptyStore, parseStore, loadStore,
+  atomicWriteStore, setAlias, deleteAlias,
+};

package/lib/proxy/federation.js

@@ -63,6 +63,9 @@ function knownResource(resource) {
     || resource === '/decks'
     || /^\/decks\/[a-z0-9-]{1,32}$/.test(resource)
     || resource === '/topology'
+    || resource === '/diagnostics/status'
+    || resource === '/diagnostics/logs'
+    || resource === '/diagnostics/verbose'
     // A connected client may ask its hub to mint a hub-owned, one-time
     // pairing invite. This is the only settings mutation exposed through
     // Hydra: the rest of /settings stays unreachable.
@@ -87,6 +90,9 @@ function allowedResource(resource, method = 'GET') {
     return method === 'PUT' || method === 'PATCH' || method === 'DELETE';
   }
   if (resource === '/topology') return method === 'GET';
+  if (resource === '/diagnostics/status') return method === 'GET';
+  if (resource === '/diagnostics/logs') return method === 'GET' || method === 'DELETE';
+  if (resource === '/diagnostics/verbose') return method === 'PATCH';
   if (resource === '/settings/peering/invite') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
   if (/^\/fleet\/(status|schema|definitions|credentials\/status)$/.test(resource)) return method === 'GET';
@@ -94,6 +100,23 @@ function allowedResource(resource, method = 'GET') {
   return false;
 }
 
+function allowedQuery(resource, method, rawUrl) {
+  if (!resource.startsWith('/diagnostics/')) return true;
+  const index = String(rawUrl || '').indexOf('?');
+  if (index < 0) return true;
+  const raw = String(rawUrl).slice(index + 1);
+  if (!raw) return true;
+  if (resource !== '/diagnostics/logs' || method !== 'GET') return false;
+  const params = new URLSearchParams(raw);
+  const keys = [...params.keys()];
+  if (keys.some((key) => !['after', 'limit'].includes(key))) return false;
+  if (params.getAll('after').length > 1 || params.getAll('limit').length > 1) return false;
+  const after = params.get('after'); const limit = params.get('limit');
+  if (after !== null && (!/^\d{1,16}$/.test(after) || !Number.isSafeInteger(Number(after)))) return false;
+  if (limit !== null && (!/^\d{1,3}$/.test(limit) || Number(limit) < 1 || Number(limit) > 200)) return false;
+  return true;
+}
+
 function cleanHeaders(headers, credential, visited = null) {
   const out = sanitizeRequestHeaders(headers, credential);
   for (const key of Object.keys(out)) {
@@ -115,7 +138,8 @@ function proxyHttp(req, res, { port, path, credential, visited = null }) {
 function routeHandler({ nodesPath, localPort, localCredential, ingress = null, readonly = () => false }) {
   return (req, res) => {
     const parsed = parseRoute(req.url);
-    if (!parsed || !allowedResource(parsed.resource, req.method)) return res.status(404).json({ error: 'not found' });
+    if (!parsed || !allowedResource(parsed.resource, req.method)
+      || !allowedQuery(parsed.resource, req.method, req.url)) return res.status(404).json({ error: 'not found' });
     if (readonly() && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) return res.status(403).json({ error: 'READONLY: federated mutation blocked' });
     const st = store.loadStore(nodesPath);
     if (!st) return res.status(503).json({ error: 'node store unavailable' });
@@ -539,7 +563,7 @@ function reject(socket, code) { try { socket.end(`HTTP/1.1 ${code} Error\r\nConn
 
 module.exports = {
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS,
-  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource,
+  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource, allowedQuery,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade,
   probeHealth, waitForHealthyPeer, notifyHubShare, reconcilePeerShare,
 };

package/lib/runtime/env.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
@@ -77,11 +78,69 @@ function minimalRuntimeEnv(source = process.env, opts = {}) {
     if (!selected.PREFIX) selected.PREFIX = termux.prefix;
     if (!selected.TMPDIR) selected.TMPDIR = termux.tmpdir;
     if (!selected.TMUX_TMPDIR) selected.TMUX_TMPDIR = termux.tmuxTmpdir;
+    // Termux Google Play (targetSdk >= 29) runs under the SELinux `untrusted_app`
+    // domain, which forbids execve() of files in the app's data directory unless
+    // libtermux-exec is preloaded (it redirects those execs to the system linker).
+    // The shared tmux server and every pane are launched with this minimal env,
+    // so without the preload every command pane dies at execve. Preserve ONLY the
+    // validated trusted preload; every other LD_*/provider/credential value stays
+    // dropped as before. Fail-closed: any doubt -> drop, never pass through.
+    const trusted = trustedTermuxPreload(source, opts);
+    if (trusted) selected.LD_PRELOAD = trusted;
   }
   return withUtf8Locale(selected, opts);
 }
 
+// Basenames of the trusted termux-exec preload library shipped by Termux.
+// Modern builds ship `libtermux-exec-ld-preload.so`; older ones shipped
+// `libtermux-exec.so`. The optional numeric segment accepts a versioned
+// variant; every other name is rejected. This IS the allowlist: adding a new
+// trusted entry requires extending this regex (after a device-specific proof).
+const TERMUX_EXEC_BASENAME_RE = /^libtermux-exec(?:-ld-preload)?(?:-\d+(?:\.\d+)*)?\.so$/;
+
+// Pure validator for the single Termux LD_PRELOAD entry minimalRuntimeEnv may
+// preserve. Returns the canonical realpath of the trusted library, or null when
+// the value is absent, non-Termux, relative, a list/mixed value, outside the
+// active Termux PREFIX/lib, missing, non-regular, world/group-writable, or not
+// owned by the running user (or root). Never throws, never logs.
+//
+// Security model: the preload must come from the already-trusted service env
+// (the attacker who controls that env is already inside the trust domain). We
+// only make sure it cannot escape that domain: a relative path, a foreign
+// library, or a path planted outside PREFIX/lib is dropped as if absent.
+function trustedTermuxPreload(source = process.env, opts = {}) {
+  const raw = source && source.LD_PRELOAD;
+  if (typeof raw !== 'string' || raw === '') return null;
+  // Reject list-shaped / ambiguous / mixed values: LD_PRELOAD accepts a
+  // colon-(or space-)separated list; we only ever preserve a single entry.
+  if (/[ \t\r\n:]/.test(raw)) return null;
+  if (raw.includes('\0')) return null;
+  if (!path.isAbsolute(raw)) return null;
+  // Only when the runtime is genuinely Termux (PREFIX or files/home layout).
+  const termux = termuxRuntimePaths(source, opts);
+  if (!termux || !termux.prefix) return null;
+  let realPrefix;
+  let realRaw;
+  try {
+    realPrefix = fs.realpathSync(termux.prefix);
+    realRaw = fs.realpathSync(raw);
+  } catch (_) { return null; }
+  // Resolve the canonical trusted directory and require the library to live in
+  // it directly (no nested paths, no elsewhere). Both sides are realpath'd so a
+  // symlinked PREFIX or a planted symlink cannot escape.
+  const trustedDir = path.join(realPrefix, 'lib');
+  if (path.dirname(realRaw) !== trustedDir) return null;
+  const base = path.basename(realRaw);
+  if (!TERMUX_EXEC_BASENAME_RE.test(base)) return null;
+  let st;
+  try { st = fs.lstatSync(realRaw); } catch (_) { return null; }
+  if (!st.isFile()) return null;                  // regular file only (realpath already resolved symlinks)
+  if (st.mode & 0o022) return null;               // not group/world-writable
+  if (typeof process.getuid === 'function' && st.uid !== process.getuid() && st.uid !== 0) return null;
+  return realRaw;
+}
+
 module.exports = {
   MINIMAL_ENV_KEYS, UTF8_RE, localeDefaults, withUtf8Locale,
-  termuxRuntimePaths, minimalRuntimeEnv,
+  termuxRuntimePaths, minimalRuntimeEnv, trustedTermuxPreload, TERMUX_EXEC_BASENAME_RE,
 };