@mmmbuto/nexuscrew 0.8.26 → 0.8.28

package/lib/runtime/env.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
@@ -77,11 +78,69 @@ function minimalRuntimeEnv(source = process.env, opts = {}) {
     if (!selected.PREFIX) selected.PREFIX = termux.prefix;
     if (!selected.TMPDIR) selected.TMPDIR = termux.tmpdir;
     if (!selected.TMUX_TMPDIR) selected.TMUX_TMPDIR = termux.tmuxTmpdir;
+    // Termux Google Play (targetSdk >= 29) runs under the SELinux `untrusted_app`
+    // domain, which forbids execve() of files in the app's data directory unless
+    // libtermux-exec is preloaded (it redirects those execs to the system linker).
+    // The shared tmux server and every pane are launched with this minimal env,
+    // so without the preload every command pane dies at execve. Preserve ONLY the
+    // validated trusted preload; every other LD_*/provider/credential value stays
+    // dropped as before. Fail-closed: any doubt -> drop, never pass through.
+    const trusted = trustedTermuxPreload(source, opts);
+    if (trusted) selected.LD_PRELOAD = trusted;
   }
   return withUtf8Locale(selected, opts);
 }
 
+// Basenames of the trusted termux-exec preload library shipped by Termux.
+// Modern builds ship `libtermux-exec-ld-preload.so`; older ones shipped
+// `libtermux-exec.so`. The optional numeric segment accepts a versioned
+// variant; every other name is rejected. This IS the allowlist: adding a new
+// trusted entry requires extending this regex (after a device-specific proof).
+const TERMUX_EXEC_BASENAME_RE = /^libtermux-exec(?:-ld-preload)?(?:-\d+(?:\.\d+)*)?\.so$/;
+
+// Pure validator for the single Termux LD_PRELOAD entry minimalRuntimeEnv may
+// preserve. Returns the canonical realpath of the trusted library, or null when
+// the value is absent, non-Termux, relative, a list/mixed value, outside the
+// active Termux PREFIX/lib, missing, non-regular, world/group-writable, or not
+// owned by the running user (or root). Never throws, never logs.
+//
+// Security model: the preload must come from the already-trusted service env
+// (the attacker who controls that env is already inside the trust domain). We
+// only make sure it cannot escape that domain: a relative path, a foreign
+// library, or a path planted outside PREFIX/lib is dropped as if absent.
+function trustedTermuxPreload(source = process.env, opts = {}) {
+  const raw = source && source.LD_PRELOAD;
+  if (typeof raw !== 'string' || raw === '') return null;
+  // Reject list-shaped / ambiguous / mixed values: LD_PRELOAD accepts a
+  // colon-(or space-)separated list; we only ever preserve a single entry.
+  if (/[ \t\r\n:]/.test(raw)) return null;
+  if (raw.includes('\0')) return null;
+  if (!path.isAbsolute(raw)) return null;
+  // Only when the runtime is genuinely Termux (PREFIX or files/home layout).
+  const termux = termuxRuntimePaths(source, opts);
+  if (!termux || !termux.prefix) return null;
+  let realPrefix;
+  let realRaw;
+  try {
+    realPrefix = fs.realpathSync(termux.prefix);
+    realRaw = fs.realpathSync(raw);
+  } catch (_) { return null; }
+  // Resolve the canonical trusted directory and require the library to live in
+  // it directly (no nested paths, no elsewhere). Both sides are realpath'd so a
+  // symlinked PREFIX or a planted symlink cannot escape.
+  const trustedDir = path.join(realPrefix, 'lib');
+  if (path.dirname(realRaw) !== trustedDir) return null;
+  const base = path.basename(realRaw);
+  if (!TERMUX_EXEC_BASENAME_RE.test(base)) return null;
+  let st;
+  try { st = fs.lstatSync(realRaw); } catch (_) { return null; }
+  if (!st.isFile()) return null;                  // regular file only (realpath already resolved symlinks)
+  if (st.mode & 0o022) return null;               // not group/world-writable
+  if (typeof process.getuid === 'function' && st.uid !== process.getuid() && st.uid !== 0) return null;
+  return realRaw;
+}
+
 module.exports = {
   MINIMAL_ENV_KEYS, UTF8_RE, localeDefaults, withUtf8Locale,
-  termuxRuntimePaths, minimalRuntimeEnv,
+  termuxRuntimePaths, minimalRuntimeEnv, trustedTermuxPreload, TERMUX_EXEC_BASENAME_RE,
 };

package/lib/server.js

@@ -41,6 +41,8 @@ const { createAsksStore } = require('./notify/asks.js');
 const { createNotifier } = require('./notify/notifier.js');
 const { notifyRoutes } = require('./notify/routes.js');
 const { createNpmUpdater } = require('./update/manager.js');
+const { createDiagnostics } = require('./diagnostics/store.js');
+const { diagnosticsRoutes } = require('./diagnostics/routes.js');
 
 function sessionExists(tmuxBin, name) {
   if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name)) return false;
@@ -102,11 +104,13 @@ function createServer(opts = {}) {
   });
   const asksStore = createAsksStore({ dir: notifyDir });
   const notifier = createNotifier({ hub: eventsHub, push: pushSvc });
+  const diagnostics = opts.diagnostics || createDiagnostics();
   const updater = opts.updateManager || createNpmUpdater({
     currentVersion: VERSION,
     home: cfg.home || os.homedir(),
     enabled: cfg.autoUpdate !== false,
     readonly: bridgeReadonly(),
+    diagnostics,
     ...(cfg.updateSeams || {}),
   });
   const attachedWs = new Map(); // ws -> session (per il push dei frame files)
@@ -150,6 +154,9 @@ function createServer(opts = {}) {
     const recovered = reconcile({ home: cfg.home || os.homedir(), configuredNames: configured });
     for (const failure of recovered.failed || []) {
       process.stderr.write(`[nexuscrew] orphan tunnel cleanup failed for ${failure.name}: ${failure.reason}\n`);
+      diagnostics.record('warn', 'tunnel', 'TUNNEL_CLEANUP_FAILED', 'Tunnel cleanup failed', {
+        node: failure.name, state: 'cleanup-failed',
+      });
     }
     // Exactly one connection per configured hub. Legacy `roles.node` /
     // rendezvous data is migration-only and never starts a second hidden SSH
@@ -163,7 +170,14 @@ function createServer(opts = {}) {
         });
         if (!tr.started && tr.reason !== 'already running') {
           process.stderr.write(`[nexuscrew] peer ${node.name} autostart failed: ${tr.reason || 'unknown'}\n`);
-        } else if (node.token && node.acceptToken && node.nodeId) {
+          diagnostics.record('warn', 'tunnel', 'TUNNEL_AUTOSTART_FAILED', 'Tunnel autostart failed', {
+            node: node.name, state: 'failed', transport: node.transport || 'auto',
+          });
+        } else {
+          diagnostics.record('info', 'tunnel', 'TUNNEL_READY', 'Tunnel is ready', {
+            node: node.name, state: tr.reason === 'already running' ? 'existing' : 'started', transport: node.transport || 'auto',
+          });
+          if (!(node.token && node.acceptToken && node.nodeId)) continue;
           // `shared` in nodes.json e' lo stato desiderato. Una riconciliazione
           // asincrona chiude la finestra di crash tra write locale e ACK hub
           // senza ritardare il listen del server.
@@ -268,7 +282,7 @@ function createServer(opts = {}) {
     paste: (session, text) => pasteToSession(cfg.tmuxBin, session, text),
     sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
   }));
-  api.use('/fleet', fleetRoutes(fleetP, cfg));
+  api.use('/fleet', fleetRoutes(fleetP, { ...cfg, diagnostics }));
   api.use('/cells', cellsRoutes({
     fleetP,
     instanceId: () => (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
@@ -330,6 +344,7 @@ function createServer(opts = {}) {
   // wizard/settings UI. Dietro lo stesso requireToken del router /api; il gate
   // READONLY route-level e la redazione token vivono dentro settingsRoutes.
   api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions, updater, runtimePort }));
+  api.use('/diagnostics', diagnosticsRoutes({ diagnostics, readonly: proxyReadonly }));
   api.get('/topology', async (_req, res) => {
     try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -398,8 +413,16 @@ function createServer(opts = {}) {
   // Close the watcher when the HTTP server closes. Registered HERE (inside
   // createServer) — not in start() — so every createServer consumer is covered,
   // not only the start() path. watcher.close() is idempotent.
-  server.on('listening', () => { updater.start(); startManagedTunnels(); });
-  server.on('close', () => { watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); });
+  server.on('listening', () => {
+    diagnostics.record('info', 'server', 'SERVER_STARTED', 'NexusCrew server started', {
+      port: runtimePort(), platform: cfg.platform || process.platform,
+    });
+    updater.start(); startManagedTunnels();
+  });
+  server.on('close', () => {
+    diagnostics.record('info', 'server', 'SERVER_STOPPED', 'NexusCrew server stopped', { reason: 'close' });
+    watcher.close(); previews.close(); eventsHub.closeAll(); updater.close();
+  });
   // noServer: gestiamo l'upgrade a mano per instradare /ws (locale) e /node/*
   // (proxy). Il WS locale resta identico; il proxy WS applica gli STESSI check
   // dell'HTTP (auth locale -> name strict -> inject token) prima del piping.
@@ -483,7 +506,7 @@ function createServer(opts = {}) {
     fleetP.then((fleet) => (typeof fleet.close === 'function' ? fleet.close() : null)).catch(() => {});
   });
 
-  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater };
+  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater, diagnostics };
 }
 
 function start(opts = {}) {

package/lib/settings/routes.js

@@ -44,6 +44,7 @@ const crypto = require('node:crypto');
 const express = require('express');
 
 const nodesStore = require('../nodes/store.js');
+const nodeAliases = require('../nodes/aliases.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
@@ -158,6 +159,7 @@ function settingsRoutes(deps = {}) {
   // isolate via env (bug trovato in audit: smoke test che scrivono la config reale).
   const configPath = cfg.configPath || configJsonPath();
   const nodesPath = deps.nodesPath || cfg.nodesPath || nodesStore.defaultNodesPath(home);
+  const aliasesPath = deps.aliasesPath || cfg.aliasesPath || nodeAliases.defaultAliasesPath(home);
   const tokenPath = cfg.tokenPath || path.join(configDir, 'token');
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
@@ -661,6 +663,36 @@ function settingsRoutes(deps = {}) {
     return applyNodeEdit(res, name, { label });
   });
 
+  // Viewer-local aliases for routed nodes. These routes are local-only and do
+  // not mutate the peer identity, route, label, or federated topology.
+  r.get('/node-aliases', (_req, res) => {
+    try { send(res, 200, nodeAliases.loadStore(aliasesPath)); }
+    catch (e) { send(res, 500, { error: String(e.message || e) }); }
+  });
+
+  r.patch('/node-aliases/:instanceId', mutGate, (req, res) => {
+    try {
+      const instanceId = String(req.params.instanceId || '');
+      const raw = req.body && req.body.alias;
+      let store = nodeAliases.loadStore(aliasesPath);
+      store = typeof raw === 'string' && raw.trim() === ''
+        ? nodeAliases.deleteAlias(store, instanceId)
+        : nodeAliases.setAlias(store, instanceId, raw);
+      store = nodeAliases.atomicWriteStore(aliasesPath, store);
+      send(res, 200, { saved: true, instanceId, alias: store.aliasesByInstanceId[instanceId] || null });
+    } catch (e) { send(res, 400, { error: String(e.message || e) }); }
+  });
+
+  r.delete('/node-aliases/:instanceId', mutGate, (req, res) => {
+    try {
+      const instanceId = String(req.params.instanceId || '');
+      let store = nodeAliases.loadStore(aliasesPath);
+      store = nodeAliases.deleteAlias(store, instanceId);
+      nodeAliases.atomicWriteStore(aliasesPath, store);
+      send(res, 200, { saved: true, instanceId, alias: null });
+    } catch (e) { send(res, 400, { error: String(e.message || e) }); }
+  });
+
   // Legacy compatibility endpoint: the old node-role/rendezvous flow opened a
   // second SSH process and is intentionally retired. Existing data is kept for
   // migration, but all new publication goes through pairing + Share on the

package/lib/update/manager.js

@@ -54,6 +54,7 @@ function createNpmUpdater(opts = {}) {
   const initialDelayMs = opts.initialDelayMs === undefined ? DEFAULT_INITIAL_DELAY_MS : opts.initialDelayMs;
   const intervalMs = opts.intervalMs === undefined ? DEFAULT_INTERVAL_MS : opts.intervalMs;
   const maxLogBytes = opts.maxLogBytes === undefined ? DEFAULT_MAX_LOG_BYTES : opts.maxLogBytes;
+  const diagnostics = opts.diagnostics || null;
   let enabled = opts.enabled !== false && !readonly;
   let checking = null;
   let timer = null;
@@ -81,8 +82,15 @@ function createNpmUpdater(opts = {}) {
   }
 
   const persist = (patch) => {
+    const previousPhase = state.phase || 'idle';
     state = { ...state, ...patch };
     writeState(statusPath, state);
+    const phase = state.phase || 'idle';
+    if (diagnostics && typeof diagnostics.record === 'function' && phase !== previousPhase) {
+      diagnostics.record(phase === 'error' ? 'warn' : 'info', 'updater', 'UPDATE_PHASE', 'Updater phase changed', {
+        phase, version: state.targetVersion || state.latest || currentVersion,
+      });
+    }
     return status();
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.26",
+  "version": "0.8.28",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {