@mmmbuto/nexuscrew 0.9.24 → 0.9.25

package/lib/mcp/identity-provider.js

@@ -15,6 +15,7 @@ const { readTokenSafe } = require('../auth/token.js');
 const { cellIdFromTmuxSession, tmuxSessionForCell } = require('../fleet/definitions.js');
 const {
   identityContextError, IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE,
+  IDENTITY_CONTEXT_VERIFIED_ENV_INVALID,
 } = require('./identity-schema.js');
 
 const INTROSPECT_TIMEOUT_MS = 8000;
@@ -27,6 +28,40 @@ function identityChannelPath({ tokenPath, session }) {
   return path.join(identityChannelDir(tokenPath), `${session}.json`);
 }
 
+// i metadati verified consegnati dal launcher VL al figlio MCP
+// (solo su sessione bound). La fonte e' PRESENTE se la version key esiste:
+// presence parziale o valori incompleti = fonte invalida (fail-closed), mai
+// assenza. Nessun valore torna al chiamante: solo coerenza booleana.
+const VERIFIED_ENV_VERSION_KEY = 'NEXUSCREW_VERIFIED_ENV_VERSION';
+const VERIFIED_ENV_FIELDS = Object.freeze({
+  ownerInstanceId: 'NEXUSCREW_VERIFIED_OWNER_INSTANCE_ID',
+  cellId: 'NEXUSCREW_VERIFIED_CELL_ID',
+  incarnationId: 'NEXUSCREW_VERIFIED_INCARNATION_ID',
+  bindingId: 'NEXUSCREW_VERIFIED_BINDING_ID',
+  origin: 'NEXUSCREW_VERIFIED_ORIGIN',
+  threadId: 'NEXUSCREW_VERIFIED_THREAD_ID',
+});
+
+function readVerifiedEnv(env) {
+  const raw = env && env[VERIFIED_ENV_VERSION_KEY];
+  if (typeof raw !== 'string') return null; // del tutto assente -> percorso legacy
+  const fields = {};
+  for (const [key, name] of Object.entries(VERIFIED_ENV_FIELDS)) {
+    const value = env[name];
+    fields[key] = typeof value === 'string' && value.trim() ? value.trim() : null;
+  }
+  return { present: true, version: raw.trim(), ...fields };
+}
+
+function verifiedEnvFault(verified, { localInstanceId } = {}) {
+  if (verified.version !== '1') return 'version';
+  if (!verified.ownerInstanceId) return 'owner';
+  if (localInstanceId && verified.ownerInstanceId !== localInstanceId) return 'owner';
+  if (!verified.cellId) return 'cell';
+  if (!verified.incarnationId) return 'incarnation';
+  return null;
+}
+
 function readIdentityChannel(filePath) {
   let raw;
   try { raw = JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch (_) { return null; }
@@ -75,13 +110,100 @@ function createMcpIdentityProvider({ config, env = process.env, fetchImpl = fetc
   const cfg = config || require('../config.js').loadConfig();
   const tokenPath = cfg && cfg.tokenPath;
   const port = cfg && cfg.port;
-  const session = env && env.NEXUSCREW_MCP_SESSION;
-  if (!tokenPath || !Number.isSafeInteger(port) || !session) return null;
-  const channelPath = identityChannelPath({ tokenPath, session });
-  if (!readIdentityChannel(channelPath)) return null;
+  const verified = readVerifiedEnv(env);
+  const legacySession = env && env.NEXUSCREW_MCP_SESSION;
+
+  // la fonte verified ha PRECEDENZA ASSOLUTA. Se i metadati verified
+  // sono presenti il provider esiste SEMPRE (anche con metadati incompleti):
+  // la validazione completa e' per-richiesta e fallisce closed con
+  // VERIFIED_ENV_INVALID. Mai un ritorno a null che riaprirebbe il percorso
+  // legacy accanto a metadati verified di provenienza non dimostrata.
+  let mode = null;
+  let channelSession = null;
+  if (verified && verified.present) {
+    mode = 'verified-env';
+    // (c) cellId -> tmuxSession con la stessa mappatura deterministica del
+    // launcher (definitions.tmuxSessionForCell): il canale identity di quella
+    // sessione e' l'unico archivo condiviso della cella su questo nodo.
+    channelSession = verified.cellId ? tmuxSessionForCell(verified.cellId) : null;
+  } else if (legacySession) {
+    mode = 'legacy-session';
+    channelSession = legacySession;
+  }
+  if (!tokenPath || !Number.isSafeInteger(port) || !mode) return null;
+  if (mode === 'legacy-session' && !channelSession) return null;
+  // In verified mode un canale sessione non derivabile NON degrada a null:
+  // il provider resta in piedi e fallisce closed per-richiesta.
+  const channelPath = identityChannelPath({ tokenPath, session: channelSession || '__unverified__' });
+  if (mode === 'legacy-session' && !readIdentityChannel(channelPath)) return null;
   const baseUrl = `http://127.0.0.1:${port}`;
 
-  async function introspectChannel() {
+  // l'ownerInstanceId dichiarato deve coincidere con l'instanceId
+  // locale del nodo. Fonte: config.injectabile (test) oppure nodes.json.
+  function localInstanceId() {
+    if (typeof cfg.identityOwnerInstanceId === 'string' && cfg.identityOwnerInstanceId) {
+      return cfg.identityOwnerInstanceId;
+    }
+    try {
+      const nodesStore = require('../nodes/store.js');
+      const nodesPath = cfg.nodesPath
+        || nodesStore.defaultNodesPath(cfg.home || require('node:os').homedir());
+      const store = nodesStore.loadStore(nodesPath);
+      return (store && store.nodeId) || null;
+    } catch (_) {
+      return null;
+    }
+  }
+
+  function verifiedFault() {
+    const fault = verifiedEnvFault(verified, { localInstanceId: localInstanceId() });
+    if (fault) return fault;
+    if (!channelSession) return 'cell';
+    if (!readIdentityChannel(channelPath)) return 'channel';
+    return null;
+  }
+
+  async function introspectVerified() {
+    const fault = verifiedFault();
+    if (fault) {
+      throw identityContextError(IDENTITY_CONTEXT_VERIFIED_ENV_INVALID,
+        `NEXUSCREW_MCP_IDENTITY_VERIFIED_ENV_INVALID: verified env incoerente (${fault})`);
+    }
+    let response;
+    try {
+      const token = readTokenSafe(tokenPath);
+      response = await fetchImpl(`${baseUrl}/api/lease/introspect`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+        body: JSON.stringify({ proof: readIdentityChannel(channelPath).proof }),
+        signal: AbortSignal.timeout(INTROSPECT_TIMEOUT_MS),
+      });
+    } catch (_) {
+      throw identityContextError(IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE,
+        'NEXUSCREW_MCP_IDENTITY_AUTHORITY_UNAVAILABLE: authority non raggiungibile');
+    }
+    if (response.status >= 500) {
+      throw identityContextError(IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE,
+        'NEXUSCREW_MCP_IDENTITY_AUTHORITY_UNAVAILABLE: authority non raggiungibile');
+    }
+    if (!response.ok) {
+      throw identityContextError(IDENTITY_CONTEXT_VERIFIED_ENV_INVALID,
+        'NEXUSCREW_MCP_IDENTITY_VERIFIED_ENV_INVALID: introspezione rifiutata dall\'authority');
+    }
+    const out = await response.json().catch(() => null);
+    const coherent = out && out.status === 'live' && out.identityMode === 'authority'
+      && out.cellId === verified.cellId && out.tmuxSession === channelSession
+      && typeof out.instanceId === 'string' && out.instanceId === verified.ownerInstanceId
+      && Number.isSafeInteger(Number(out.expiresAt)) && Number(out.expiresAt) > now()
+      && typeof out.incarnationId === 'string' && out.incarnationId === verified.incarnationId;
+    if (!coherent) {
+      throw identityContextError(IDENTITY_CONTEXT_VERIFIED_ENV_INVALID,
+        'NEXUSCREW_MCP_IDENTITY_VERIFIED_ENV_INVALID: introspezione non coerente coi metadati verified');
+    }
+    return { context: sharedContextFromIntrospection({ ...out, expiresAt: Number(out.expiresAt) }, now()), proof: readIdentityChannel(channelPath).proof };
+  }
+
+  async function introspectLegacy() {
     const channel = readIdentityChannel(channelPath);
     if (!channel) return { verified: false, mode: 'shared' };
     let response;
@@ -113,11 +235,16 @@ function createMcpIdentityProvider({ config, env = process.env, fetchImpl = fetc
     return { context: sharedContextFromIntrospection({ ...out, expiresAt: Number(out.expiresAt) }, now()), proof: channel.proof };
   }
 
+  const introspectChannel = mode === 'verified-env' ? introspectVerified : introspectLegacy;
+
   async function provider({ tool } = {}) {
     void tool; // il canale lease è per-connessione cella, non per-tool
     const out = await introspectChannel();
     return out.context ? out.context : out;
   }
+  // il server espone `source: 'verified-env'` in nc_identity quando la
+  // fonte dei metadati e' il launcher verified e non la sessione legacy.
+  provider.identitySource = mode === 'verified-env' ? 'verified-env' : 'online';
   provider.currentProof = () => {
     const channel = readIdentityChannel(channelPath);
     return channel ? channel.proof : null;
@@ -129,4 +256,5 @@ module.exports = {
   createMcpIdentityProvider,
   persistIdentityChannel,
   identityChannelPath,
+  readVerifiedEnv,
 };

package/lib/mcp/identity-schema.js

@@ -9,6 +9,7 @@ const IDENTITY_CONTEXT_MISSING = 'NEXUSCREW_MCP_IDENTITY_CONTEXT_MISSING';
 const IDENTITY_CONTEXT_UNVERIFIED = 'NEXUSCREW_MCP_IDENTITY_CONTEXT_UNVERIFIED';
 const IDENTITY_CONTEXT_FROM_MISMATCH = 'NEXUSCREW_MCP_IDENTITY_CONTEXT_FROM_MISMATCH';
 const IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE = 'NEXUSCREW_MCP_IDENTITY_AUTHORITY_UNAVAILABLE';
+const IDENTITY_CONTEXT_VERIFIED_ENV_INVALID = 'NEXUSCREW_MCP_IDENTITY_VERIFIED_ENV_INVALID';
 
 function identityContextError(code, message) {
   const error = new Error(message);
@@ -163,6 +164,7 @@ module.exports = {
   IDENTITY_CONTEXT_UNVERIFIED,
   IDENTITY_CONTEXT_FROM_MISMATCH,
   IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE,
+  IDENTITY_CONTEXT_VERIFIED_ENV_INVALID,
   identityContextError,
   normalizeIdentityContext,
 };

package/lib/mcp/server.js

@@ -32,6 +32,7 @@ const { TOOLS, IDENTITY_CODE, IDENTITY_REMEDIATION } = require('./tools.js');
 const cells = require('./cells.js');
 const {
   normalizeIdentityContext, IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE,
+  IDENTITY_CONTEXT_VERIFIED_ENV_INVALID,
 } = require('./identity-schema.js');
 const { persistIdentityChannel } = require('./identity-provider.js');
 
@@ -99,18 +100,55 @@ function companionInstructions() {
 // senza cambiare la precedenza e senza esporre valori/segreti. `resolveSession`
 // resta il wrapper pubblico Promise<string|null> invariato (compatibilita').
 const IDENTITY_REQUIRED_ENV_VARS = Object.freeze(['TMUX', 'TMUX_PANE', 'NEXUSCREW_MCP_SESSION']);
+// i nomi dei metadati verified consegnati dal launcher VL (solo su
+// sessione bound). Presence only: mai i valori.
+const IDENTITY_VERIFIED_ENV_VARS = Object.freeze([
+  'NEXUSCREW_VERIFIED_ENV_VERSION',
+  'NEXUSCREW_VERIFIED_OWNER_INSTANCE_ID',
+  'NEXUSCREW_VERIFIED_CELL_ID',
+  'NEXUSCREW_VERIFIED_INCARNATION_ID',
+  'NEXUSCREW_VERIFIED_BINDING_ID',
+  'NEXUSCREW_VERIFIED_ORIGIN',
+  'NEXUSCREW_VERIFIED_THREAD_ID',
+]);
+const IDENTITY_ALL_REQUIRED_ENV_VARS = Object.freeze([
+  ...IDENTITY_REQUIRED_ENV_VARS, ...IDENTITY_VERIFIED_ENV_VARS,
+]);
 
 function envPresenceOf(env) {
-  return {
+  const presence = {
     TMUX: !!env.TMUX,
     TMUX_PANE: !!env.TMUX_PANE,
     NEXUSCREW_MCP_SESSION: !!(typeof env.NEXUSCREW_MCP_SESSION === 'string' && env.NEXUSCREW_MCP_SESSION.trim()),
   };
+  for (const name of IDENTITY_VERIFIED_ENV_VARS) {
+    presence[name] = !!(typeof env[name] === 'string' && env[name].trim());
+  }
+  return presence;
+}
+
+// la fonte verified esiste se ANY dei nomi verified e' presente.
+// Presence parziale = fonte presente ma invalida (fail-closed), non assenza.
+function verifiedEnvPresent(envPresence) {
+  return IDENTITY_VERIFIED_ENV_VARS.some((name) => envPresence[name] === true);
 }
 
 function resolveIdentity({ env, tmuxBin, execFileImpl }) {
   const e = env || {};
   const envPresence = envPresenceOf(e);
+  // se una qualunque variabile verified e' presente, il percorso
+  // legacy e' VETATO (non e' un fallback, e' un percorso alternativo usato
+  // solo in assenza totale della verified). La verifica completa (introspezione
+  // live/coerente) vive nel provider online; qui il chiamante senza provider
+  // riceve comunque un fail-closed nominato invece di un'identita' legacy
+  // fabbricata accanto a metadati verified di cui non si puo' garantire la
+  // coerenza.
+  if (verifiedEnvPresent(envPresence)) {
+    return {
+      session: null, source: 'verified-env', code: IDENTITY_CODE.VERIFIED_ENV_INVALID,
+      envPresence, requiredEnvVars: IDENTITY_ALL_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+    };
+  }
   const fallbackRaw = e.NEXUSCREW_MCP_SESSION;
   const fallbackPresent = typeof fallbackRaw === 'string' && fallbackRaw.trim().length > 0;
   const tmuxPresent = !!e.TMUX;
@@ -130,24 +168,24 @@ function resolveIdentity({ env, tmuxBin, execFileImpl }) {
 
   const ok = (session, source) => ({
     session, source, code: IDENTITY_CODE.OK,
-    envPresence, requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+    envPresence, requiredEnvVars: IDENTITY_ALL_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
   });
   const missing = () => ({
     session: null, source: 'missing', code: codeWhenMissing(),
-    envPresence, requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+    envPresence, requiredEnvVars: IDENTITY_ALL_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
   });
   // P0: pane stantio o non verificabile -> NON attribuire. source 'stale-pane'
   // nomina il problema; code STALE_PANE (tools.js).
   const stalePane = () => ({
     session: null, source: 'stale-pane', code: IDENTITY_CODE.STALE_PANE,
-    envPresence, requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+    envPresence, requiredEnvVars: IDENTITY_ALL_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
   });
   // P0/R2: tmux e fallback env dicono sessioni DIVERSE entrambe valide:
   // identità ambigua -> NON attribuire (nemmeno il fallback: è parte del
   // conflitto). Il code nomina il mismatch, che INVALID non direbbe.
   const sessionMismatch = () => ({
     session: null, source: 'session-mismatch', code: IDENTITY_CODE.SESSION_MISMATCH,
-    envPresence, requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
+    envPresence, requiredEnvVars: IDENTITY_ALL_REQUIRED_ENV_VARS, remediation: IDENTITY_REMEDIATION,
   });
 
   return new Promise((resolve) => {
@@ -273,7 +311,8 @@ function createMcpServer(opts = {}) {
     try {
       raw = await identityContextProvider({ tool });
     } catch (e) {
-      if (e && e.code === IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE) throw e;
+      if (e && (e.code === IDENTITY_CONTEXT_AUTHORITY_UNAVAILABLE
+        || e.code === IDENTITY_CONTEXT_VERIFIED_ENV_INVALID)) throw e;
       throw identityContextError(IDENTITY_CONTEXT_MISSING,
         'contesto identita online non disponibile: binding condiviso rifiutato');
     }
@@ -284,7 +323,7 @@ function createMcpServer(opts = {}) {
     if (!identityContextProvider) return localIdentity();
     return identityContext({ tool, sharedRequired: true }).then((context) => ({
       session: context.tmuxSession,
-      source: 'online',
+      source: identityContextProvider.identitySource === 'verified-env' ? 'verified-env' : 'online',
       code: IDENTITY_CODE.OK,
       envPresence: envPresenceOf(env),
       requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS,
@@ -442,9 +481,11 @@ function createMcpServer(opts = {}) {
         ? identityContextProvider.currentProof() : null;
       const sharedIdentity = sharedContext ? Object.freeze({
         session: sharedContext.tmuxSession,
-        source: 'online', code: IDENTITY_CODE.OK,
+        source: identityContextProvider.identitySource === 'verified-env'
+          ? 'verified-env' : 'online',
+        code: IDENTITY_CODE.OK,
         envPresence: envPresenceOf(env),
-        requiredEnvVars: IDENTITY_REQUIRED_ENV_VARS,
+        requiredEnvVars: IDENTITY_ALL_REQUIRED_ENV_VARS,
         remediation: IDENTITY_REMEDIATION,
         context: sharedContext,
         ...(sharedProof ? { proof: sharedProof } : {}),

package/lib/mcp/tools.js

@@ -44,15 +44,26 @@ const IDENTITY_CODE = Object.freeze({
   // P0/R2: tmux e NEXUSCREW_MCP_SESSION sono entrambi validi ma dicono sessioni
   // diverse: identità ambigua, non si attribuisce nessuna delle due.
   SESSION_MISMATCH: 'NEXUSCREW_MCP_IDENTITY_SESSION_MISMATCH',
+  // una fonte verified (NEXUSCREW_VERIFIED_*) presente ma non
+  // coerente (versione, owner, cella, canale, introspezione) e' fail-closed:
+  // MAI fallback alle variabili legacy quando la fonte verified esiste.
+  VERIFIED_ENV_INVALID: 'NEXUSCREW_MCP_IDENTITY_VERIFIED_ENV_INVALID',
 });
 
 // Remediation senza segreti/valori: nomi soltanto, compatibile con
 // `codex-vl mcp add --env-var` (allowlist di nomi, nessun valore persistito).
+// la remediation NON consiglia piu' di allowlistare TMUX/TMUX_PANE/
+// NEXUSCREW_MCP_SESSION in env_vars: sul percorso shared verified quel permesso
+// fa fallire lo spawn (rmcp-client utils: nomi riservati rifiutati). Le strade
+// sono due: sessione verified (codex-vl >= 0.154.0-vl.3 + NexusCrew >= 0.9.25
+// con authority mode provisionato) oppure sessione legacy con le tre variabili
+// ereditate dal client MCP.
 const IDENTITY_REMEDIATION =
-  'Nei client che ripuliscono l\'ambiente, allowlista i nomi delle variabili di identita nel server MCP stdio '
-  + '(codex-vl mcp add ... --env-var NEXUSCREW_MCP_SESSION --env-var TMUX --env-var TMUX_PANE) '
-  + 'oppure assicurati che il client MCP inoltri il contesto tmux al processo child: nessun valore '
-  + 'viene copiato nella CLI o nel file di configurazione.';
+  'Due percorsi validi: (1) sessione verified — serve codex-vl >= 0.154.0-vl.3 e NexusCrew >= 0.9.25 '
+  + 'con authority mode provisionato (nexuscrew identity provision): il launcher consegna i metadati '
+  + 'NEXUSCREW_VERIFIED_* al figlio MCP, non serve allowlistare nulla; (2) sessione legacy — il client '
+  + 'MCP deve ereditare TMUX/TMUX_PANE/NEXUSCREW_MCP_SESSION (niente allowlist in env_vars del server '
+  + 'MCP: con codex-vl >= 0.154.0-vl.3 i nomi sono riservati e lo spawn fallisce).';
 
 // Perche' una ricerca fallita non e' una sola cosa.
 //

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.24",
-  "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
+  "version": "0.9.25",
+  "description": "Faithful browser tmux client \u2014 attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
     "nexuscrew": "bin/nexuscrew.js"