@mmmbuto/nexuscrew 0.8.38 → 0.8.40

package/lib/server.js

@@ -32,6 +32,17 @@ const nodesInventory = require('./nodes/inventory.js');
 const topologyCache = require('./nodes/topology-cache.js');
 const { createNodeProxy, handleNodeUpgrade } = require('./proxy/node-proxy.js');
 const federation = require('./proxy/federation.js');
+const { audioRoutes } = require('./audio/routes.js');
+const { isConsent: isAudioConsent } = require('./audio/consent.js');
+const { createOriginResolver } = require('./audio/origin.js');
+const { createAudioAcl } = require('./audio/acl.js');
+const { createDispatcher } = require('./audio/dispatch.js');
+const { createSpeakQueue } = require('./audio/queue.js');
+const { createReceiptStore } = require('./audio/receipt.js');
+const audioAdapters = require('./audio/adapters.js');
+const audioGroups = require('./audio/groups.js');
+const { bridgeSecretPath, loadOrCreateBridgeSecret, createNonceCache } = require('./audio/bridge-auth.js');
+const { createHopSecret } = require('./proxy/hop-proof.js');
 const { settingsRoutes, publicPeeringRoutes } = require('./settings/routes.js');
 const decksStore = require('./decks/store.js');
 const { decksRoutes } = require('./decks/routes.js');
@@ -133,6 +144,22 @@ function createServer(opts = {}) {
   const topologyCachePath = cfg.topologyCachePath || topologyCache.defaultPath(cfg.home || os.homedir());
   const decksPath = cfg.decksPath || decksStore.defaultDecksPath(cfg.home || os.homedir());
   const proxyReadonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  const audioHome = cfg.home || os.homedir();
+  // Stato audio ancorato alla directory del token (come notifyDir): server,
+  // Settings e bridge MCP devono guardare gli stessi file anche quando un test
+  // isola l'istanza fuori dalla home reale.
+  const audioCfg = {
+    home: audioHome,
+    tokenPath: cfg.tokenPath,
+    audioConsentPath: cfg.audioConsentPath,
+    audioGroupsPath: cfg.audioGroupsPath,
+    audioBridgeSecretPath: cfg.audioBridgeSecretPath || path.join(notifyDir, 'audio-bridge.key'),
+  };
+  // Segreto per-processo della prova di hop federata: vive solo in memoria, non
+  // e' su disco e nessuna API lo espone. Serve a distinguere l'ultimo hop di una
+  // route federata da un POST diretto di chi possiede il token della UI.
+  const hopSecret = createHopSecret();
+  const audioNonceCache = createNonceCache();
   function resolveNode(name) {
     const st = nodesStore.loadStore(nodesPath);
     if (!st) return null;
@@ -299,6 +326,64 @@ function createServer(opts = {}) {
     sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
   }));
   api.use('/fleet', fleetRoutes(fleetP, { ...cfg, diagnostics }));
+  // Audio Share. L'identita' del nodo NON e' un campo di cfg: si legge dal node
+  // store, la stessa fonte usata da /api/cells e /api/peers. Lo stato Fleet e'
+  // asincrono e va atteso: leggerlo come se fosse sincrono lascerebbe la
+  // risoluzione dell'origine sempre vuota e la feature morta senza che un test
+  // sul router se ne accorga.
+  const audioNodeId = () => (nodesStore.loadStore(nodesPath) || {}).nodeId || null;
+  // Seam di test per l'adapter: permette di esercitare il percorso completo
+  // (route -> gate -> coda -> receipt) sul server REALE senza emettere suono.
+  // In produzione resta il probe locale.
+  const audioAdapter = cfg.audioAdapterSeam
+    || audioAdapters.createAdapter(audioAdapters.detectAdapter({ env: cfg.env || process.env }));
+  const audioReceipts = createReceiptStore();
+  const audioQueue = createSpeakQueue({
+    adapter: audioAdapter,
+    // La coda e' l'unica a sapere com'e' finito davvero un enunciato: e' lei ad
+    // aggiornare il receipt da `accepted` a spoken/refused/unknown.
+    onStatus: (utteranceId, status, reason) => { try { audioReceipts.update(utteranceId, status, reason); } catch (_) {} },
+  });
+  api.use('/audio', audioRoutes({
+    readonly: proxyReadonly,
+    localNodeId: audioNodeId,
+    receiptStore: audioReceipts,
+    adapter: audioAdapter,
+    queue: audioQueue,
+    acl: createAudioAcl({ nodesPath }),
+    consent: () => { try { return isAudioConsent(audioCfg, audioHome); } catch (_) { return false; } },
+    originResolver: createOriginResolver({
+      localNodeId: audioNodeId,
+      // Celle Fleet ATTIVE in questo momento, attese davvero.
+      activeCells: async () => {
+        const fleet = await fleetP;
+        if (!fleet || fleet.available !== true || typeof fleet.status !== 'function') return [];
+        const st = await fleet.status();
+        return Array.isArray(st && st.cells) ? st.cells.map((c) => ({
+          cell: c && c.cell, tmuxSession: c && c.tmuxSession,
+          active: c && c.active === true && c.tmux !== false,
+        })) : [];
+      },
+      bridgeSecret: () => { try { return loadOrCreateBridgeSecret(bridgeSecretPath(audioCfg, audioHome)); } catch (_) { return null; } },
+      hopSecret: () => hopSecret,
+      nonceCache: audioNonceCache,
+    }),
+    dispatcher: createDispatcher({
+      localNodeId: audioNodeId,
+      peers: async () => {
+        const st = nodesStore.loadStore(nodesPath);
+        if (!st) return [];
+        const topology = await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath, fetchImpl: healthFetch });
+        return nodesInventory.buildInventory({
+          direct: nodesStore.redactStore(st).nodes,
+          topology: topology && Array.isArray(topology.nodes) ? topology.nodes : [],
+        });
+      },
+      localPort: () => (server && server.address() ? server.address().port : cfg.port),
+      localToken: () => tokenHolder.value,
+    }),
+    getGroup: (name) => audioGroups.getGroup(audioCfg, name, audioHome),
+  }));
   api.use('/cells', cellsRoutes({
     fleetP,
     instanceId: () => (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
@@ -359,7 +444,12 @@ function createServer(opts = {}) {
   // Settings API B2 (design §4b(6)): read-only GET + mutanti lista chiusa per il
   // wizard/settings UI. Dietro lo stesso requireToken del router /api; il gate
   // READONLY route-level e la redazione token vivono dentro settingsRoutes.
-  api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions, updater, runtimePort }));
+  api.use('/settings', settingsRoutes({
+    cfg, nodesPath, tokenStore, closeSessions, updater, runtimePort,
+    // Stesso adapter/coda dell'API Audio: Settings puo' fare solo la prova
+    // locale a frase fissa e lo stop sovrano, mai una seconda sintesi parallela.
+    audio: { adapter: audioAdapter, queue: audioQueue },
+  }));
   api.use('/diagnostics', diagnosticsRoutes({ diagnostics, readonly: proxyReadonly }));
   api.get('/topology', async (_req, res) => {
     try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
@@ -367,6 +457,7 @@ function createServer(opts = {}) {
   });
   api.use('/route', federation.localRouter({
     nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    hopSecret: () => hopSecret,
   }));
   api.get('/voice/status', (_req, res) => res.json({ serverSttConfigured: !!cfg.voiceUrl }));
   api.post('/voice/transcribe',
@@ -392,7 +483,7 @@ function createServer(opts = {}) {
   app.use('/api', api);
   app.use('/federation', federation.peerRouter({
     nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
-    fetchImpl: healthFetch,
+    fetchImpl: healthFetch, hopSecret: () => hopSecret,
     roles: () => require('./cli/commands.js').readRoles(cfg.configPath || configJsonPath()),
   }));
 

package/lib/settings/routes.js

@@ -45,6 +45,10 @@ const express = require('express');
 
 const nodesStore = require('../nodes/store.js');
 const nodeAliases = require('../nodes/aliases.js');
+const { setConsent: setAudioConsent, isConsent: isAudioConsent } = require('../audio/consent.js');
+const { describeCapability } = require('../audio/capability.js');
+const audioAdapters = require('../audio/adapters.js');
+const audioGroups = require('../audio/groups.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
@@ -67,6 +71,7 @@ const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone', 'autoUpdate']);
 const ROLE_KEYS = new Set(['client', 'node']);
 const ADD_KEYS = new Set(['name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'label']);
 const EDIT_KEYS = new Set(['label', 'ssh', 'sshPort', 'autostart', 'visibility', 'selected']);
+const LOCAL_AUDIO_TEST_TEXT = 'NexusCrew audio test.';
 
 // Default sensato per il "nome dispositivo" proposto nei form (pairing/invite).
 // NON usa ciecamente hostname: se l'hostname e' vuoto o 'localhost' (tipico di
@@ -165,6 +170,10 @@ function settingsRoutes(deps = {}) {
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
   const platform = seams.platform || detectPlatform();
   const runtimePort = typeof deps.runtimePort === 'function' ? deps.runtimePort : () => cfg.port;
+  // Il server passa qui l'adapter e la coda REALI. Il fallback serve solo ai
+  // test unitari di Settings costruiti senza il server: non deve creare una
+  // seconda coda che dichiara un test riuscito ma non parla sul nodo vero.
+  const audioService = deps.audio && typeof deps.audio === 'object' ? deps.audio : null;
 
   const r = express.Router();
   r.use(express.json({ limit: '8kb' }));
@@ -184,7 +193,8 @@ function settingsRoutes(deps = {}) {
     home, configDir, configPath, nodesPath, log: cap.log,
     keygen: seams.keygen, execFileImpl: seams.execFileImpl,
     spawnImpl: seams.spawnImpl, sshBin: seams.sshBin, logFd: seams.logFd,
-    httpProbe: seams.httpProbe, sshVersion: seams.sshVersion,
+    httpProbe: seams.httpProbe, federationProbe: seams.federationProbe,
+    fetchImpl: seams.fetchImpl, sshVersion: seams.sshVersion,
     spawnSyncImpl: seams.spawnSyncImpl,
     localAppPort: runtimePort(),
   });
@@ -649,6 +659,23 @@ function settingsRoutes(deps = {}) {
         // the store/UI says private. Same-state OFF revokes first, then enters
         // the spec-aware start path without rewriting nodes.json.
         if (body.shared) {
+          // A same-state Share ON may target a supervisor stuck in "degraded"
+          // (reverse channel retrying on a fixed cadence after the initial
+          // budget). Accelerate ONLY a degraded supervisor that readTunnelState
+          // confirms we own (owned live pidfile + sidecar): force a local
+          // restart so the -R is retried immediately instead of waiting for the
+          // steady retry. A healthy tunnel stays idempotent, and we never revoke
+          // on the hub nor change the persisted shared intent in this branch.
+          const liveState = nodesTunnel.readTunnelState(home, name);
+          if (liveState && liveState.phase === 'degraded') {
+            // Reuse the normal restart transaction: it fails closed on a local
+            // spawn error and waits for the authenticated -L health probe before
+            // publishing Share again.  A process restart alone is never proof
+            // that the reverse channel is ready.
+            await ensureLocal({ restart: true });
+            await notifyHub(true);
+            return send(res, 200, { name, shared: true, unchanged: true, accelerated: true });
+          }
           await ensureLocal();
           await notifyHub(true);
           return send(res, 200, { name, shared: true, unchanged: true, reconciled: true });
@@ -708,6 +735,111 @@ function settingsRoutes(deps = {}) {
     if (!nodesStore.validLabel(label)) return send(res, 400, { error: 'label non valida (max 64 char, niente a capo)' });
     return applyNodeEdit(res, name, { label });
   });
+  // Consenso audio: proprieta' del nodo LOCALE, cioe' della macchina che
+  // suonerebbe, non di un record peer. Vive in un file dedicato e si muta solo
+  // da qui: `/audio/consent` non compare nella whitelist federation, quindi
+  // nessun peer puo' concedersi da remoto il permesso di far parlare un
+  // computer altrui. E' il terzo asse, separato da `shared` (pubblicazione) e da
+  // `visibility` (routing): nessuno dei due autorizza un suono fisico.
+  const audioCfg = {
+    home,
+    tokenPath: cfg && cfg.tokenPath,
+    audioConsentPath: cfg && cfg.audioConsentPath,
+    audioGroupsPath: cfg && cfg.audioGroupsPath,
+  };
+  const localAudioAdapter = () => {
+    if (audioService) return audioService.adapter || null;
+    return audioAdapters.createAdapter(audioAdapters.detectAdapter({}));
+  };
+  const localAudioQueue = () => (audioService ? audioService.queue || null : null);
+  const localAudioCapability = () => {
+    const consent = isAudioConsent(audioCfg, home) === true;
+    return describeCapability({ adapter: localAudioAdapter(), consent });
+  };
+  const emptyBody = (body) => body === undefined
+    || (body && typeof body === 'object' && !Array.isArray(body) && Object.keys(body).length === 0);
+  r.get('/audio', (_req, res) => {
+    try {
+      // Capability redatta: id logico dell'adapter e limiti dichiarati, mai il
+      // path del binario e mai l'elenco delle voci di sistema.
+      return send(res, 200, localAudioCapability());
+    } catch (_) {
+      return send(res, 500, { error: 'stato audio non leggibile' });
+    }
+  });
+  r.patch('/audio/consent', mutGate, (req, res) => {
+    const consent = req.body && req.body.consent;
+    if (typeof consent !== 'boolean') {
+      return send(res, 400, { error: 'body non valido: atteso {consent:boolean}' });
+    }
+    try {
+      setAudioConsent(audioCfg, consent, home);
+      return send(res, 200, localAudioCapability());
+    } catch (_) {
+      return send(res, 500, { error: 'scrittura consenso audio non riuscita' });
+    }
+  });
+  // Prova esplicita dal pannello Settings. Non e' `nc_speak`: non accetta testo,
+  // target, cella o origine dal browser e non e' inoltrabile via federazione.
+  // Usa solo una frase fissa, il consenso del nodo e la sua coda reale; un 200
+  // descrive l'esito onesto dell'azione, NON prova che qualcuno abbia sentito.
+  r.post('/audio/test', mutGate, (req, res) => {
+    if (!emptyBody(req.body)) return send(res, 400, { error: 'body non valido: nessun campo ammesso' });
+    try {
+      const capability = localAudioCapability();
+      if (capability.consent !== true) return send(res, 200, { status: 'refused', reason: 'consent' });
+      const queue = localAudioQueue();
+      if (capability.installed !== true || !queue || typeof queue.enqueue !== 'function') {
+        return send(res, 200, { status: 'refused', reason: 'no-adapter' });
+      }
+      const result = queue.enqueue({
+        utteranceId: `settings-${crypto.randomUUID()}`,
+        text: LOCAL_AUDIO_TEST_TEXT,
+        urgency: 'normal',
+      });
+      return send(res, 200, {
+        status: result && result.status === 'accepted' ? 'accepted' : 'refused',
+        ...(result && result.reason ? { reason: String(result.reason).slice(0, 64) } : {}),
+      });
+    } catch (_) {
+      return send(res, 500, { error: 'prova audio locale non riuscita' });
+    }
+  });
+  // Stop locale sovrano: resta disponibile anche in READONLY. Non richiede rete,
+  // origin MCP o receipt, perche' zittire il dispositivo non deve dipendere da
+  // chi l'aveva fatto parlare. Ferma tutti i test/enunciati ancora in coda.
+  r.post('/audio/stop', (req, res) => {
+    if (!emptyBody(req.body)) return send(res, 400, { error: 'body non valido: nessun campo ammesso' });
+    try {
+      const queue = localAudioQueue();
+      const stopped = !!(queue && typeof queue.stopAll === 'function' && queue.stopAll());
+      return send(res, 200, { status: 'accepted', stopped });
+    } catch (_) {
+      return send(res, 500, { error: 'stop audio locale non riuscito' });
+    }
+  });
+  // Gruppi dell'ORIGINE: configurazione locale, separata dal consenso di ogni
+  // endpoint. Non e' nella whitelist federation e una lista non puo' far
+  // parlare un nodo senza il suo consenso/liveness al momento della consegna.
+  r.get('/audio/groups', (_req, res) => {
+    try { return send(res, 200, { groups: audioGroups.listGroups(audioCfg, home) }); }
+    catch (_) { return send(res, 500, { error: 'gruppi audio non leggibili' }); }
+  });
+  r.put('/audio/groups/:name', mutGate, (req, res) => {
+    const body = req.body;
+    if (!body || typeof body !== 'object' || Array.isArray(body)
+      || Object.keys(body).some((key) => !['targets', 'mode'].includes(key))) {
+      return send(res, 400, { error: 'body non valido: attesi targets e mode' });
+    }
+    try { return send(res, 200, { group: audioGroups.saveGroup(audioCfg, String(req.params.name || ''), body, home) }); }
+    catch (_) { return send(res, 400, { error: 'gruppo audio non valido' }); }
+  });
+  r.delete('/audio/groups/:name', mutGate, (req, res) => {
+    try {
+      const removed = audioGroups.removeGroup(audioCfg, String(req.params.name || ''), home);
+      return removed ? send(res, 200, { removed: true }) : send(res, 404, { error: 'gruppo audio non trovato' });
+    } catch (_) { return send(res, 400, { error: 'nome gruppo audio non valido' }); }
+  });
 
   // Viewer-local aliases for routed nodes. These routes are local-only and do
   // not mutate the peer identity, route, label, or federated topology.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.38",
+  "version": "0.8.40",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {