@mmmbuto/nexuscrew 0.9.4 → 0.9.6

package/CHANGELOG.md

@@ -2,6 +2,144 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.9.6 — 2026-08-18 — "Causes With Names"
+
+The previous release fixed a blank panel, a service that hung on a terminal, and
+a message that named the wrong cause. They were three symptoms of one defect: a
+value that collapsed different states into `null`, and a low level composing
+sentences about facts it could not know. This release fixes the defect itself.
+
+- **Resolving a public key now has five distinct outcomes instead of one
+  `null`**: derived, no identity configured, identity present but the actual key
+  unknown, the tool itself missing, and encrypted-or-unreadable. They are data,
+  not prose — nothing downstream has to parse a sentence to learn what happened.
+  The pairing response carries the outcome beside the text, so a consumer has
+  the fact rather than an interpretation of it.
+
+  Previously all five answered `null`, and the message that followed had to
+  guess: "I cannot derive the public key" was shown for a missing file, a
+  missing binary and an encrypted key alike, and only one of the three had
+  anything to do with a passphrase.
+
+- **The sentences are now composed in one place.** A single formatter turns each
+  outcome into a cause and an action. Success stays silent — there is nothing to
+  say when a thing works — and an outcome the formatter does not recognise is
+  **named** rather than swallowed, because a silent default rebuilds exactly the
+  collapse this removes.
+
+- **The boot service no longer points at a path that expires.** The generated
+  unit and launch agent recorded the interpreter path of the moment, which on
+  package managers that version their install directory disappears at the next
+  upgrade — and the entry point was versioned too, so fixing only the first
+  produced a service that looked repaired and failed identically. Both are now
+  resolved to a stable alias when one exists and points at the very same file;
+  when none exists the current path is written **and the fact is declared**,
+  because a path that will expire silently is worse than a warning.
+
+- **Unreachable peers are no longer polled at a fixed rate forever.** Three
+  stopped peers used to fill the console until the service worker gave up. The
+  interval now backs off with a ceiling and recovers as soon as the peer answers
+  — the recovery is what the test pins, because a backoff that never resets is a
+  sentence rather than a protection.
+
+  And three different answers stopped looking alike: a peer that is absent, one
+  that is present and refuses, and one missing that route each say so, with the
+  action they imply — wait, grant the permission **on the remote node**, update
+  that node.
+
+- **The panel window can be moved and resized**, remembers where it was, and
+  can be recentred when it gets lost. Below the mobile breakpoint it stays full
+  screen and dragging is genuinely disabled rather than merely hidden.
+
+- **The panel no longer reports "ready" and then stops watching.** It now
+  distinguishes a frame that loaded from one that failed, using the events the
+  element actually emits — with the limit stated where it matters: a `load`
+  event fires for an error page too, so it means "a response arrived", never
+  "the panel is alive".
+
+## 0.9.5 — 2026-08-17 — "Measured From Where It Breaks"
+
+Almost everything in this release was already broken before it, and none of it
+was found by the tests that were supposed to cover it. The pattern repeats often
+enough to be worth naming: a check that runs from a convenient place reports
+success for a mechanism it never actually crossed. The panel tunnel was declared
+ready by measuring a local bind and never a request through it. A public key was
+called valid by our own parser rather than by the program that would authenticate
+with it. A test that promised "leaves no orphans" left one. Each of them was
+green for weeks.
+
+- **The per-cell panel could not load, and the interface said it was ready.**
+  The viewing cookie was issued with `Path=/api/panel/<cell>`, but the dedicated
+  panel port serves `/panel/<cell>` — the control-plane prefix is not there. A
+  browser stores that cookie and never sends it back: the first request enters
+  with its ticket, and every sub-resource of the panel is refused, as is the
+  WebSocket upgrade, which looks for exactly that cookie. The panel stays blank.
+
+  The cookie path now follows the mount the request actually entered through,
+  taken from the router rather than from a constant, with a strict allow-list —
+  an unrecognised mount fails closed instead of guessing a scope, and it is
+  checked *before* the single-use ticket is spent, so a misconfiguration cannot
+  burn a ticket belonging to someone who did nothing wrong.
+
+  Present since the panel port was separated. It survived because a neighbouring
+  function in the same file already handled *both* prefixes: someone had thought
+  of the case, in one place out of two.
+
+- **Deriving a public key could hang the foreground service for five seconds.**
+  Reading a key ran `ssh-keygen -y -f`, with stdin closed and the askpass helper
+  disabled. Neither matters: OpenSSH does not read a passphrase from stdin, it
+  opens `/dev/tty`. Against an encrypted key on a terminal, the call waited out
+  its whole timeout — and the pairing path calls it synchronously, so the event
+  loop stopped with it.
+
+  Now the prompt is forced away from the terminal and onto a helper that cannot
+  run, so the attempt fails in a tenth of a second instead of five seconds.
+  Below OpenSSH 8.4 that control does not exist and the timeout remains the net:
+  slow, but never stuck. The limit is stated in the code rather than assumed.
+
+  This one was invisible by construction: automated runs have no controlling
+  terminal, so `/dev/tty` does not exist and the defect cannot appear. The test
+  now **brings its own** terminal rather than skipping, and the probe *measures*
+  whether it got one instead of trusting that it did.
+
+- **The panel tunnel was authorised to fail.** The generated `authorized_keys`
+  line restricted forwarding to the node port and never listed the panel port,
+  which had been separated in an earlier release — so pairing negotiated the
+  port, reserved the local side, wrote the line, and the server refused the
+  channel. "Forward ready" was reported after checking the local bind only,
+  which is the half that always succeeds. The channel is now exercised, the
+  probe gives up on a budget instead of retrying forever, and when a key cannot
+  be determined the product no longer promises a line it cannot produce.
+
+- **A public key is now derived from the private one, not read from beside it.**
+  Three rounds of hardening had gone into validating the `.pub` file, which
+  proves that a file contains *a* valid key — never that it is *the* key for
+  that identity. Deriving it removes the question. Relatedly, whether a key is
+  acceptable is now decided by the program that will use it, not by our parser.
+
+- **Replacing a degraded forwarding channel no longer leaves stray processes.**
+  Stopping and waiting now happen at a single point before any replacement.
+  The test that certified this used to leave an orphan of its own, and its
+  guard identified processes by number rather than by what they were — a
+  recycled id could satisfy it.
+
+- **A pidfile declares its identity at birth**, its schema marker is one-way,
+  and an obstacle to writing that marker now closes the window instead of
+  holding it open forever. A refusal that was uniform across two different
+  causes used to break updates; the two are separated.
+
+- **A remote cell's row resolves against its own node's sessions.** Both the
+  sidebar row and the popup could show data from a same-named local session.
+
+### Notes for anyone reading the tests
+
+Several fixes here are in tests that were passing while proving nothing: a guard
+that matched too loosely to ever fail, a timing assertion that measured a
+stopwatch instead of the signal it cared about, a cleanup check that read a file
+it had already deleted, and one that could not fail because the shell it relied
+on rejected the syntax it used. If a test has never been seen red for the right
+reason, it has not been seen at all.
+
 ## 0.9.4 — 2026-08-17 — "The Interface Was Last Week's"
 
 - **The published interface is the one this version was built from.** 0.9.3