@mmmbuto/nexuscrew 0.8.26 → 0.8.27

package/lib/fleet/routes.js

@@ -29,6 +29,14 @@ function fleetRoutes(fleetP, cfg = {}) {
   r.use((req, res, next) => (req.path === '/restore-cells' || req.path === '/restore-engines' ? restoreJson : smallJson)(req, res, next));
 
   const readonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  const diagnostics = cfg.diagnostics || null;
+  const safeCell = (body) => {
+    const value = body && typeof body.cell === 'string' ? body.cell : '';
+    return /^[A-Za-z0-9._-]{1,32}$/.test(value) ? value : '';
+  };
+  const emit = (level, code, message, meta) => {
+    if (diagnostics && typeof diagnostics.record === 'function') diagnostics.record(level, 'fleet', code, message, meta);
+  };
 
   const guard = (fn, opts = {}) => async (req, res) => {
     try {
@@ -36,8 +44,25 @@ function fleetRoutes(fleetP, cfg = {}) {
       if (opts.mutate && readonly()) return res.status(403).json({ error: 'READONLY: mutazione fleet bloccata' });
       const fleet = await fleetP;
       if (!fleet.available) return res.status(404).json({ error: 'fleet non disponibile' });
-      res.json(await fn(fleet, req.body || {}));
+      const body = req.body || {};
+      if (opts.action) emit('info', 'FLEET_ACTION_STARTED', 'Fleet action started', {
+        action: opts.action, cell: safeCell(body), state: 'starting',
+      });
+      const result = await fn(fleet, body);
+      if (opts.action) emit('info', 'FLEET_ACTION_COMPLETED', 'Fleet action completed', {
+        action: opts.action, cell: safeCell(body), state: opts.action === 'down' ? 'stopped' : 'ready',
+      });
+      res.json(result);
     } catch (e) {
+      if (opts.action) {
+        const match = String(e && e.message || '').match(/cell spawn failed:\s+([A-Z][A-Z0-9_]{0,31})\s+([A-Za-z0-9._+-]{1,128})/);
+        if (match) emit('error', 'CELL_SPAWN_FAILED', 'Cell client spawn failed', {
+          action: opts.action, cell: safeCell(req.body), errno: match[1], client: match[2], status: e.status || 500,
+        });
+        else emit('warn', 'FLEET_ACTION_FAILED', 'Fleet action failed', {
+          action: opts.action, cell: safeCell(req.body), state: 'failed', status: e.status || 500,
+        });
+      }
       res.status(e.status || 500).json({ error: String(e.message || e), ...(e.data || {}) });
     }
   };
@@ -82,13 +107,13 @@ function fleetRoutes(fleetP, cfg = {}) {
       await f.boot(cell, b.boot === true);
     }
     return f.up(cell, { engine: b.engine, boot: !!b.boot });
-  }, { mutate: true }));
+  }, { mutate: true, action: 'up' }));
   r.post('/down', guard(async (f, b) => {
     const cell = String(b.cell || '');
     if (b.boot === true && capList(f).includes('edit') && capList(f).includes('boot')) await f.boot(cell, false);
     return f.down(cell, { boot: !!b.boot });
-  }, { mutate: true }));
-  r.post('/restart', guard((f, b) => { requireCap(f, 'restart'); return f.restart(String(b.cell || '')); }, { mutate: true }));
+  }, { mutate: true, action: 'down' }));
+  r.post('/restart', guard((f, b) => { requireCap(f, 'restart'); return f.restart(String(b.cell || '')); }, { mutate: true, action: 'restart' }));
   r.post('/engine', guard((f, b) => {
     const opts = { model: typeof b.model === 'string' ? b.model : '' };
     if (typeof b.permissionPolicy === 'string') opts.permissionPolicy = b.permissionPolicy;

package/lib/nodes/aliases.js

@@ -0,0 +1,122 @@
+'use strict';
+// Alias locali del viewer per nodi routed. Questo store non partecipa mai a
+// topology, routing, ACL o federation: associa soltanto uno stable instanceId a
+// un'etichetta di display scelta sul dispositivo che ospita la PWA.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const SCHEMA_VERSION = 1;
+const INSTANCE_ID_RE = /^[a-f0-9]{16,64}$/;
+const ALIAS_MAX = 64;
+const MAX_ALIASES = 128;
+const MAX_FILE_BYTES = 16 * 1024;
+
+function defaultAliasesPath(home = os.homedir()) {
+  return path.join(home, '.nexuscrew', 'node-aliases.json');
+}
+
+function normalizeAlias(value) {
+  if (typeof value !== 'string') return null;
+  const alias = value.normalize('NFC').trim();
+  if (!alias || alias.length > ALIAS_MAX) return null;
+  // Cc/Cf includes newlines, NUL, bidi controls and invisible format chars.
+  if (/[\p{Cc}\p{Cf}]/u.test(alias)) return null;
+  return alias;
+}
+
+function emptyStore() {
+  return { version: SCHEMA_VERSION, aliasesByInstanceId: {} };
+}
+
+function parseStore(raw) {
+  let value;
+  try { value = typeof raw === 'string' ? JSON.parse(raw) : raw; } catch (_) { return null; }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (Object.keys(value).some((key) => !['version', 'aliasesByInstanceId'].includes(key))) return null;
+  if (value.version !== SCHEMA_VERSION) return null;
+  const aliases = value.aliasesByInstanceId;
+  if (!aliases || typeof aliases !== 'object' || Array.isArray(aliases)) return null;
+  const entries = Object.entries(aliases);
+  if (entries.length > MAX_ALIASES) return null;
+  const out = {};
+  for (const [instanceId, rawAlias] of entries) {
+    const alias = normalizeAlias(rawAlias);
+    if (!INSTANCE_ID_RE.test(instanceId) || alias === null || alias !== rawAlias) return null;
+    out[instanceId] = alias;
+  }
+  return { version: SCHEMA_VERSION, aliasesByInstanceId: out };
+}
+
+function assertSafeTarget(filePath) {
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error('node alias store must be a regular file');
+    if ((stat.mode & 0o077) !== 0) throw new Error('node alias store permissions must be 0600');
+    if (stat.size > MAX_FILE_BYTES) throw new Error('node alias store exceeds size limit');
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return false;
+    throw error;
+  }
+  return true;
+}
+
+function loadStore(filePath = defaultAliasesPath()) {
+  if (!assertSafeTarget(filePath)) return emptyStore();
+  const raw = fs.readFileSync(filePath, { encoding: 'utf8', flag: 'r' });
+  if (Buffer.byteLength(raw) > MAX_FILE_BYTES) throw new Error('node alias store exceeds size limit');
+  const parsed = parseStore(raw);
+  if (!parsed) throw new Error('invalid node alias store');
+  return parsed;
+}
+
+function atomicWriteStore(filePath, store) {
+  const parsed = parseStore(store);
+  if (!parsed) throw new Error('invalid node alias store');
+  const payload = `${JSON.stringify(parsed, null, 2)}\n`;
+  if (Buffer.byteLength(payload) > MAX_FILE_BYTES) throw new Error('node alias store exceeds size limit');
+  assertSafeTarget(filePath);
+  const dir = path.dirname(filePath);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const dirStat = fs.lstatSync(dir);
+  if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) throw new Error('node alias directory must be a regular directory');
+  fs.chmodSync(dir, 0o700);
+  const tmp = path.join(dir, `.${path.basename(filePath)}.${crypto.randomBytes(8).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, payload, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, filePath);
+    fs.chmodSync(filePath, 0o600);
+  } catch (error) {
+    try { fs.unlinkSync(tmp); } catch (_) { /* best effort */ }
+    throw error;
+  }
+  return parsed;
+}
+
+function setAlias(store, instanceId, value) {
+  if (!INSTANCE_ID_RE.test(String(instanceId || ''))) throw new Error('instanceId non valido');
+  const alias = normalizeAlias(value);
+  if (alias === null) throw new Error('alias non valido (max 64 char, niente controlli)');
+  const current = parseStore(store);
+  if (!current) throw new Error('invalid node alias store');
+  const aliasesByInstanceId = { ...current.aliasesByInstanceId, [instanceId]: alias };
+  if (Object.keys(aliasesByInstanceId).length > MAX_ALIASES) throw new Error('troppi alias nodo');
+  return { version: SCHEMA_VERSION, aliasesByInstanceId };
+}
+
+function deleteAlias(store, instanceId) {
+  if (!INSTANCE_ID_RE.test(String(instanceId || ''))) throw new Error('instanceId non valido');
+  const current = parseStore(store);
+  if (!current) throw new Error('invalid node alias store');
+  const aliasesByInstanceId = { ...current.aliasesByInstanceId };
+  delete aliasesByInstanceId[instanceId];
+  return { version: SCHEMA_VERSION, aliasesByInstanceId };
+}
+
+module.exports = {
+  SCHEMA_VERSION, INSTANCE_ID_RE, ALIAS_MAX, MAX_ALIASES, MAX_FILE_BYTES,
+  defaultAliasesPath, normalizeAlias, emptyStore, parseStore, loadStore,
+  atomicWriteStore, setAlias, deleteAlias,
+};

package/lib/proxy/federation.js

@@ -63,6 +63,9 @@ function knownResource(resource) {
     || resource === '/decks'
     || /^\/decks\/[a-z0-9-]{1,32}$/.test(resource)
     || resource === '/topology'
+    || resource === '/diagnostics/status'
+    || resource === '/diagnostics/logs'
+    || resource === '/diagnostics/verbose'
     // A connected client may ask its hub to mint a hub-owned, one-time
     // pairing invite. This is the only settings mutation exposed through
     // Hydra: the rest of /settings stays unreachable.
@@ -87,6 +90,9 @@ function allowedResource(resource, method = 'GET') {
     return method === 'PUT' || method === 'PATCH' || method === 'DELETE';
   }
   if (resource === '/topology') return method === 'GET';
+  if (resource === '/diagnostics/status') return method === 'GET';
+  if (resource === '/diagnostics/logs') return method === 'GET' || method === 'DELETE';
+  if (resource === '/diagnostics/verbose') return method === 'PATCH';
   if (resource === '/settings/peering/invite') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
   if (/^\/fleet\/(status|schema|definitions|credentials\/status)$/.test(resource)) return method === 'GET';
@@ -94,6 +100,23 @@ function allowedResource(resource, method = 'GET') {
   return false;
 }
 
+function allowedQuery(resource, method, rawUrl) {
+  if (!resource.startsWith('/diagnostics/')) return true;
+  const index = String(rawUrl || '').indexOf('?');
+  if (index < 0) return true;
+  const raw = String(rawUrl).slice(index + 1);
+  if (!raw) return true;
+  if (resource !== '/diagnostics/logs' || method !== 'GET') return false;
+  const params = new URLSearchParams(raw);
+  const keys = [...params.keys()];
+  if (keys.some((key) => !['after', 'limit'].includes(key))) return false;
+  if (params.getAll('after').length > 1 || params.getAll('limit').length > 1) return false;
+  const after = params.get('after'); const limit = params.get('limit');
+  if (after !== null && (!/^\d{1,16}$/.test(after) || !Number.isSafeInteger(Number(after)))) return false;
+  if (limit !== null && (!/^\d{1,3}$/.test(limit) || Number(limit) < 1 || Number(limit) > 200)) return false;
+  return true;
+}
+
 function cleanHeaders(headers, credential, visited = null) {
   const out = sanitizeRequestHeaders(headers, credential);
   for (const key of Object.keys(out)) {
@@ -115,7 +138,8 @@ function proxyHttp(req, res, { port, path, credential, visited = null }) {
 function routeHandler({ nodesPath, localPort, localCredential, ingress = null, readonly = () => false }) {
   return (req, res) => {
     const parsed = parseRoute(req.url);
-    if (!parsed || !allowedResource(parsed.resource, req.method)) return res.status(404).json({ error: 'not found' });
+    if (!parsed || !allowedResource(parsed.resource, req.method)
+      || !allowedQuery(parsed.resource, req.method, req.url)) return res.status(404).json({ error: 'not found' });
     if (readonly() && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) return res.status(403).json({ error: 'READONLY: federated mutation blocked' });
     const st = store.loadStore(nodesPath);
     if (!st) return res.status(503).json({ error: 'node store unavailable' });
@@ -539,7 +563,7 @@ function reject(socket, code) { try { socket.end(`HTTP/1.1 ${code} Error\r\nConn
 
 module.exports = {
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS,
-  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource,
+  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource, allowedQuery,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade,
   probeHealth, waitForHealthyPeer, notifyHubShare, reconcilePeerShare,
 };

package/lib/runtime/env.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
@@ -77,11 +78,69 @@ function minimalRuntimeEnv(source = process.env, opts = {}) {
     if (!selected.PREFIX) selected.PREFIX = termux.prefix;
     if (!selected.TMPDIR) selected.TMPDIR = termux.tmpdir;
     if (!selected.TMUX_TMPDIR) selected.TMUX_TMPDIR = termux.tmuxTmpdir;
+    // Termux Google Play (targetSdk >= 29) runs under the SELinux `untrusted_app`
+    // domain, which forbids execve() of files in the app's data directory unless
+    // libtermux-exec is preloaded (it redirects those execs to the system linker).
+    // The shared tmux server and every pane are launched with this minimal env,
+    // so without the preload every command pane dies at execve. Preserve ONLY the
+    // validated trusted preload; every other LD_*/provider/credential value stays
+    // dropped as before. Fail-closed: any doubt -> drop, never pass through.
+    const trusted = trustedTermuxPreload(source, opts);
+    if (trusted) selected.LD_PRELOAD = trusted;
   }
   return withUtf8Locale(selected, opts);
 }
 
+// Basenames of the trusted termux-exec preload library shipped by Termux.
+// Modern builds ship `libtermux-exec-ld-preload.so`; older ones shipped
+// `libtermux-exec.so`. The optional numeric segment accepts a versioned
+// variant; every other name is rejected. This IS the allowlist: adding a new
+// trusted entry requires extending this regex (after a device-specific proof).
+const TERMUX_EXEC_BASENAME_RE = /^libtermux-exec(?:-ld-preload)?(?:-\d+(?:\.\d+)*)?\.so$/;
+
+// Pure validator for the single Termux LD_PRELOAD entry minimalRuntimeEnv may
+// preserve. Returns the canonical realpath of the trusted library, or null when
+// the value is absent, non-Termux, relative, a list/mixed value, outside the
+// active Termux PREFIX/lib, missing, non-regular, world/group-writable, or not
+// owned by the running user (or root). Never throws, never logs.
+//
+// Security model: the preload must come from the already-trusted service env
+// (the attacker who controls that env is already inside the trust domain). We
+// only make sure it cannot escape that domain: a relative path, a foreign
+// library, or a path planted outside PREFIX/lib is dropped as if absent.
+function trustedTermuxPreload(source = process.env, opts = {}) {
+  const raw = source && source.LD_PRELOAD;
+  if (typeof raw !== 'string' || raw === '') return null;
+  // Reject list-shaped / ambiguous / mixed values: LD_PRELOAD accepts a
+  // colon-(or space-)separated list; we only ever preserve a single entry.
+  if (/[ \t\r\n:]/.test(raw)) return null;
+  if (raw.includes('\0')) return null;
+  if (!path.isAbsolute(raw)) return null;
+  // Only when the runtime is genuinely Termux (PREFIX or files/home layout).
+  const termux = termuxRuntimePaths(source, opts);
+  if (!termux || !termux.prefix) return null;
+  let realPrefix;
+  let realRaw;
+  try {
+    realPrefix = fs.realpathSync(termux.prefix);
+    realRaw = fs.realpathSync(raw);
+  } catch (_) { return null; }
+  // Resolve the canonical trusted directory and require the library to live in
+  // it directly (no nested paths, no elsewhere). Both sides are realpath'd so a
+  // symlinked PREFIX or a planted symlink cannot escape.
+  const trustedDir = path.join(realPrefix, 'lib');
+  if (path.dirname(realRaw) !== trustedDir) return null;
+  const base = path.basename(realRaw);
+  if (!TERMUX_EXEC_BASENAME_RE.test(base)) return null;
+  let st;
+  try { st = fs.lstatSync(realRaw); } catch (_) { return null; }
+  if (!st.isFile()) return null;                  // regular file only (realpath already resolved symlinks)
+  if (st.mode & 0o022) return null;               // not group/world-writable
+  if (typeof process.getuid === 'function' && st.uid !== process.getuid() && st.uid !== 0) return null;
+  return realRaw;
+}
+
 module.exports = {
   MINIMAL_ENV_KEYS, UTF8_RE, localeDefaults, withUtf8Locale,
-  termuxRuntimePaths, minimalRuntimeEnv,
+  termuxRuntimePaths, minimalRuntimeEnv, trustedTermuxPreload, TERMUX_EXEC_BASENAME_RE,
 };

package/lib/server.js

@@ -41,6 +41,8 @@ const { createAsksStore } = require('./notify/asks.js');
 const { createNotifier } = require('./notify/notifier.js');
 const { notifyRoutes } = require('./notify/routes.js');
 const { createNpmUpdater } = require('./update/manager.js');
+const { createDiagnostics } = require('./diagnostics/store.js');
+const { diagnosticsRoutes } = require('./diagnostics/routes.js');
 
 function sessionExists(tmuxBin, name) {
   if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name)) return false;
@@ -102,11 +104,13 @@ function createServer(opts = {}) {
   });
   const asksStore = createAsksStore({ dir: notifyDir });
   const notifier = createNotifier({ hub: eventsHub, push: pushSvc });
+  const diagnostics = opts.diagnostics || createDiagnostics();
   const updater = opts.updateManager || createNpmUpdater({
     currentVersion: VERSION,
     home: cfg.home || os.homedir(),
     enabled: cfg.autoUpdate !== false,
     readonly: bridgeReadonly(),
+    diagnostics,
     ...(cfg.updateSeams || {}),
   });
   const attachedWs = new Map(); // ws -> session (per il push dei frame files)
@@ -150,6 +154,9 @@ function createServer(opts = {}) {
     const recovered = reconcile({ home: cfg.home || os.homedir(), configuredNames: configured });
     for (const failure of recovered.failed || []) {
       process.stderr.write(`[nexuscrew] orphan tunnel cleanup failed for ${failure.name}: ${failure.reason}\n`);
+      diagnostics.record('warn', 'tunnel', 'TUNNEL_CLEANUP_FAILED', 'Tunnel cleanup failed', {
+        node: failure.name, state: 'cleanup-failed',
+      });
     }
     // Exactly one connection per configured hub. Legacy `roles.node` /
     // rendezvous data is migration-only and never starts a second hidden SSH
@@ -163,7 +170,14 @@ function createServer(opts = {}) {
         });
         if (!tr.started && tr.reason !== 'already running') {
           process.stderr.write(`[nexuscrew] peer ${node.name} autostart failed: ${tr.reason || 'unknown'}\n`);
-        } else if (node.token && node.acceptToken && node.nodeId) {
+          diagnostics.record('warn', 'tunnel', 'TUNNEL_AUTOSTART_FAILED', 'Tunnel autostart failed', {
+            node: node.name, state: 'failed', transport: node.transport || 'auto',
+          });
+        } else {
+          diagnostics.record('info', 'tunnel', 'TUNNEL_READY', 'Tunnel is ready', {
+            node: node.name, state: tr.reason === 'already running' ? 'existing' : 'started', transport: node.transport || 'auto',
+          });
+          if (!(node.token && node.acceptToken && node.nodeId)) continue;
           // `shared` in nodes.json e' lo stato desiderato. Una riconciliazione
           // asincrona chiude la finestra di crash tra write locale e ACK hub
           // senza ritardare il listen del server.
@@ -268,7 +282,7 @@ function createServer(opts = {}) {
     paste: (session, text) => pasteToSession(cfg.tmuxBin, session, text),
     sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
   }));
-  api.use('/fleet', fleetRoutes(fleetP, cfg));
+  api.use('/fleet', fleetRoutes(fleetP, { ...cfg, diagnostics }));
   api.use('/cells', cellsRoutes({
     fleetP,
     instanceId: () => (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
@@ -330,6 +344,7 @@ function createServer(opts = {}) {
   // wizard/settings UI. Dietro lo stesso requireToken del router /api; il gate
   // READONLY route-level e la redazione token vivono dentro settingsRoutes.
   api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions, updater, runtimePort }));
+  api.use('/diagnostics', diagnosticsRoutes({ diagnostics, readonly: proxyReadonly }));
   api.get('/topology', async (_req, res) => {
     try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -398,8 +413,16 @@ function createServer(opts = {}) {
   // Close the watcher when the HTTP server closes. Registered HERE (inside
   // createServer) — not in start() — so every createServer consumer is covered,
   // not only the start() path. watcher.close() is idempotent.
-  server.on('listening', () => { updater.start(); startManagedTunnels(); });
-  server.on('close', () => { watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); });
+  server.on('listening', () => {
+    diagnostics.record('info', 'server', 'SERVER_STARTED', 'NexusCrew server started', {
+      port: runtimePort(), platform: cfg.platform || process.platform,
+    });
+    updater.start(); startManagedTunnels();
+  });
+  server.on('close', () => {
+    diagnostics.record('info', 'server', 'SERVER_STOPPED', 'NexusCrew server stopped', { reason: 'close' });
+    watcher.close(); previews.close(); eventsHub.closeAll(); updater.close();
+  });
   // noServer: gestiamo l'upgrade a mano per instradare /ws (locale) e /node/*
   // (proxy). Il WS locale resta identico; il proxy WS applica gli STESSI check
   // dell'HTTP (auth locale -> name strict -> inject token) prima del piping.
@@ -483,7 +506,7 @@ function createServer(opts = {}) {
     fleetP.then((fleet) => (typeof fleet.close === 'function' ? fleet.close() : null)).catch(() => {});
   });
 
-  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater };
+  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater, diagnostics };
 }
 
 function start(opts = {}) {

package/lib/settings/routes.js

@@ -44,6 +44,7 @@ const crypto = require('node:crypto');
 const express = require('express');
 
 const nodesStore = require('../nodes/store.js');
+const nodeAliases = require('../nodes/aliases.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
@@ -158,6 +159,7 @@ function settingsRoutes(deps = {}) {
   // isolate via env (bug trovato in audit: smoke test che scrivono la config reale).
   const configPath = cfg.configPath || configJsonPath();
   const nodesPath = deps.nodesPath || cfg.nodesPath || nodesStore.defaultNodesPath(home);
+  const aliasesPath = deps.aliasesPath || cfg.aliasesPath || nodeAliases.defaultAliasesPath(home);
   const tokenPath = cfg.tokenPath || path.join(configDir, 'token');
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
@@ -661,6 +663,36 @@ function settingsRoutes(deps = {}) {
     return applyNodeEdit(res, name, { label });
   });
 
+  // Viewer-local aliases for routed nodes. These routes are local-only and do
+  // not mutate the peer identity, route, label, or federated topology.
+  r.get('/node-aliases', (_req, res) => {
+    try { send(res, 200, nodeAliases.loadStore(aliasesPath)); }
+    catch (e) { send(res, 500, { error: String(e.message || e) }); }
+  });
+
+  r.patch('/node-aliases/:instanceId', mutGate, (req, res) => {
+    try {
+      const instanceId = String(req.params.instanceId || '');
+      const raw = req.body && req.body.alias;
+      let store = nodeAliases.loadStore(aliasesPath);
+      store = typeof raw === 'string' && raw.trim() === ''
+        ? nodeAliases.deleteAlias(store, instanceId)
+        : nodeAliases.setAlias(store, instanceId, raw);
+      store = nodeAliases.atomicWriteStore(aliasesPath, store);
+      send(res, 200, { saved: true, instanceId, alias: store.aliasesByInstanceId[instanceId] || null });
+    } catch (e) { send(res, 400, { error: String(e.message || e) }); }
+  });
+
+  r.delete('/node-aliases/:instanceId', mutGate, (req, res) => {
+    try {
+      const instanceId = String(req.params.instanceId || '');
+      let store = nodeAliases.loadStore(aliasesPath);
+      store = nodeAliases.deleteAlias(store, instanceId);
+      nodeAliases.atomicWriteStore(aliasesPath, store);
+      send(res, 200, { saved: true, instanceId, alias: null });
+    } catch (e) { send(res, 400, { error: String(e.message || e) }); }
+  });
+
   // Legacy compatibility endpoint: the old node-role/rendezvous flow opened a
   // second SSH process and is intentionally retired. Existing data is kept for
   // migration, but all new publication goes through pairing + Share on the

package/lib/update/manager.js

@@ -54,6 +54,7 @@ function createNpmUpdater(opts = {}) {
   const initialDelayMs = opts.initialDelayMs === undefined ? DEFAULT_INITIAL_DELAY_MS : opts.initialDelayMs;
   const intervalMs = opts.intervalMs === undefined ? DEFAULT_INTERVAL_MS : opts.intervalMs;
   const maxLogBytes = opts.maxLogBytes === undefined ? DEFAULT_MAX_LOG_BYTES : opts.maxLogBytes;
+  const diagnostics = opts.diagnostics || null;
   let enabled = opts.enabled !== false && !readonly;
   let checking = null;
   let timer = null;
@@ -81,8 +82,15 @@ function createNpmUpdater(opts = {}) {
   }
 
   const persist = (patch) => {
+    const previousPhase = state.phase || 'idle';
     state = { ...state, ...patch };
     writeState(statusPath, state);
+    const phase = state.phase || 'idle';
+    if (diagnostics && typeof diagnostics.record === 'function' && phase !== previousPhase) {
+      diagnostics.record(phase === 'error' ? 'warn' : 'info', 'updater', 'UPDATE_PHASE', 'Updater phase changed', {
+        phase, version: state.targetVersion || state.latest || currentVersion,
+      });
+    }
     return status();
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.26",
+  "version": "0.8.27",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {