@mmmbuto/nexuscrew 0.9.56 → 0.9.58

package/lib/proxy/federation.js

@@ -1,11 +1,13 @@
 'use strict';
 
+const { createAskSlotVerifier, askSlotVerifier, binding: askSlotBinding } = require('../nodes/ask-slot-verifier.js');
 const http = require('node:http');
 const net = require('node:net');
 const crypto = require('node:crypto');
 const express = require('express');
 const { WebSocketServer } = require('ws');
 const store = require('../nodes/store.js');
+const accessPresets = require('../nodes/access-presets.js');
 const topologyCache = require('../nodes/topology-cache.js');
 const { allowedByClass, classifyResource } = require('./resource-acl.js');
 const reverseRotation = require('../nodes/reverse-rotation.js');
@@ -223,7 +225,7 @@ function knownResource(resource) {
     || resource === '/event-feed'
     || resource === '/event-feed/snapshot'
     // Federated ask write-back: answer, dismiss, attempt status.
-    || /^\/event-feed\/asks\/[a-f0-9]{8}(?:\/answer|\/requests\/[0-9a-f-]{16,64})?$/.test(resource)
+    || /^\/event-feed\/asks\/[a-f0-9]{8}(?:\/answer|\/capability|\/requests\/[0-9a-f-]{16,64})?$/.test(resource)
     || /^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)
     || /^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)
     || isPanelResource(resource)
@@ -330,6 +332,7 @@ function allowedResource(resource, method = 'GET') {
   if (/^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/answer$/.test(resource)) return method === 'POST';
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/capability$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return method === 'DELETE';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return method === 'GET';
   if (resource === '/asks') return method === 'POST';
@@ -477,19 +480,23 @@ function liveHostLedgerCapture({ ledger, ownerId, resource }) {
 const SSE_IDLE_TIMEOUT_MS = 90000;
 const SSE_CONTENT_TYPE_RE = /^text\/event-stream/i;
 
-function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS }) {
+function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS, onForwardFailure = null, abortWithClient = false }) {
   // A body a local middleware has already read is no longer in the stream: the
   // headers would announce bytes that nothing sends, and the peer would wait for
   // a body that never arrives. Say it at once, with a name, instead of letting
   // the forward sit until the upstream timeout expires.
   if (Number(req.headers['content-length'] || 0) > 0 && req.readableEnded) {
+    if (onForwardFailure) onForwardFailure();
     return res.status(502).json({ error: 'request body already read by a local middleware', reason: 'federation-body-consumed' });
   }
+  const failed = () => { if (onForwardFailure) onForwardFailure(); };
   let streamWatchdog = null;
   const clearStreamWatchdog = () => {
     if (streamWatchdog) { clearTimeout(streamWatchdog); streamWatchdog = null; }
   };
   const up = http.request({ host: '127.0.0.1', port, method: req.method, path, headers: cleanHeaders(req.headers, credential, visited, hopProof, panelCookie) }, (r) => {
+    if (r.statusCode < 200 || r.statusCode >= 300) failed();
+    r.once('aborted', failed); r.once('error', failed);
     const headers = setCookiePrefix ? rewriteSetCookiePath(r.headers, setCookiePrefix) : r.headers;
     if (!capture) {
       res.writeHead(r.statusCode, sanitizeResponseHeaders(headers));
@@ -534,8 +541,13 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
   // quando il tunnel del peer è «su a metà» (socket aperto, nessuna risposta):
   // 10 s e 504 — prima era un unico 30 s che chiudeva con 502. Gli altri
   // metodi mantengono il tetto largo di prima.
+  if (abortWithClient) {
+    req.once('aborted', () => { failed(); up.destroy(); });
+    res.once('close', () => { if (!res.writableFinished) { failed(); up.destroy(); } });
+  }
   const FORWARD_TIMEOUT_MS = req.method === 'GET' ? getTimeoutMs : 30000;
   up.setTimeout(FORWARD_TIMEOUT_MS, () => {
+    failed();
     if (!res.headersSent) {
       res.status(504).json({ error: 'peer non risponde entro il timeout', reason: 'federation-peer-timeout' });
       up.destroy();
@@ -545,6 +557,7 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
   });
   up.on('close', clearStreamWatchdog);
   up.on('error', () => {
+    failed();
     clearStreamWatchdog();
     if (!res.headersSent) res.status(502).json({ error: 'peer non raggiungibile', reason: 'federation-peer-unreachable' });
     else res.destroy();
@@ -552,9 +565,20 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
   req.pipe(up);
 }
 
-function routeHandler({ nodesPath, localPort, localCredential, ingress = null, readonly = () => false, hopSecret = null, liveHostLedger = null, forwardGetTimeoutMs = 10000, forwardSseIdleMs = SSE_IDLE_TIMEOUT_MS }) {
-  return (req, res) => {
+function routeHandler({ nodesPath, localPort, localCredential, ingress = null, readonly = () => false, hopSecret = null, liveHostLedger = null, forwardGetTimeoutMs = 10000, forwardSseIdleMs = SSE_IDLE_TIMEOUT_MS, askProofNow = null, slotVerifier = null }) {
+  const verifier = slotVerifier || (askProofNow ? createAskSlotVerifier({ now: askProofNow }) : askSlotVerifier);
+  return async (req, res) => {
     const parsed = parseRoute(req.url);
+    const rejectAskRequest = (status, body) => {
+      if (parsed && classifyResource(parsed.resource, req.method) === 'ask-action') {
+        const current = store.loadStore(nodesPath);
+        verifier.sync(current, nodesPath);
+        const peer = current && store.getNode(current, parsed.route[0]);
+        const selected = askSlotBinding(current, peer);
+        verifier.invalidate(selected && selected.key);
+      }
+      return res.status(status).json(body);
+    };
     // Prima dell'allowlist: un peer senza permesso non deve nemmeno sapere se la
     // risorsa esiste per una cella o per un'altra.
     if (parsed && isPanelResource(parsed.resource) && !panelAllowedFor(ingress)) {
@@ -571,7 +595,7 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     if (parsed && allowedResource(parsed.resource, req.method)) {
       const gate = classGateCheck(parsed.resource, req.method, ingress);
       if (!gate.ok) {
-        return res.status(gate.status).json({
+        return rejectAskRequest(gate.status, {
           error: gate.status === 404 ? 'not found' : 'risorsa non concessa a questo nodo',
           reason: gate.reason,
         });
@@ -579,9 +603,11 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     }
     if (!parsed || !allowedResource(parsed.resource, req.method)
       || !allowedQuery(parsed.resource, req.method, req.url)) return res.status(404).json({ error: 'not found' });
-    if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) return res.status(403).json({ error: 'READONLY: federated mutation blocked' });
+    if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) return rejectAskRequest(403, { error: 'READONLY: federated mutation blocked' });
     const st = store.loadStore(nodesPath);
     if (!st) return res.status(503).json({ error: 'node store unavailable' });
+    const isAskAction = classifyResource(parsed.resource, req.method) === 'ask-action';
+    if (isAskAction) verifier.sync(st, nodesPath);
     const visited = controlledVisited(req, ingress, st.nodeId);
     if (!visited) return res.status(409).json({ error: 'federation cycle rejected' });
     // Vale per l'ultimo hop come per il transito: se si fermasse al primo, una
@@ -602,11 +628,18 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
         panelCookie,
         getTimeoutMs: forwardGetTimeoutMs,
         sseIdleMs: forwardSseIdleMs,
+        abortWithClient: isAskAction,
       });
     }
     const next = st && store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
-    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return res.status(403).json({ error: 'route non consentita' });
+    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return rejectAskRequest(403, { error: 'route non consentita' });
+    if (parsed.resource === '/asks' && req.method === 'POST') {
+      const view = accessPresets.grantsOf(next);
+      if (!view.configured || view.label !== 'admin') {
+        return res.status(403).json({ error: 'ASK target is not an admin peer', reason: 'ask-target-not-admin' });
+      }
+    }
     const rest = parsed.route.slice(1);
     const path = `/federation/route/${rest.length ? `${rest.join('/')}/` : ''}${ROUTE_DELIMITER}${parsed.resource}${queryOf(req.url)}`;
     // Verso il browser di questo nodo (ingress nullo) il cookie di visione del
@@ -622,7 +655,68 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     const capture = liveHostLedger && (parsed.resource === '/live-host/designate' || parsed.resource === '/live-host/clear')
       ? liveHostLedgerCapture({ ledger: liveHostLedger, ownerId: next.nodeId, resource: parsed.resource })
       : null;
-    proxyHttp(req, res, { port: next.localPort, path, credential: next.token, visited, setCookiePrefix, panelCookie, capture, getTimeoutMs: forwardGetTimeoutMs, sseIdleMs: forwardSseIdleMs });
+    let forwardPort = next.localPort;
+    let proofKey = null;
+    if (next.direction === 'inbound' && classifyResource(parsed.resource, req.method) === 'ask-action') {
+      const rejectForward = (status, body) => { verifier.invalidate(proofKey); return res.status(status).json(body); };
+      const unverified = () => rejectForward(404, { error: 'not found', reason: 'reverse-slot-unverified' });
+      const channel = (peer) => {
+        const pool = peer && peer.reversePool;
+        const slot = pool && Array.isArray(pool.slots) && pool.slots[pool.activeSlot];
+        if (!slot || slot.state !== 'active' || !Number.isInteger(slot.port) || slot.port < 1 || slot.port > 65535
+          || !Number.isSafeInteger(pool.activeGeneration) || pool.activeGeneration < 1
+          || slot.generation !== pool.activeGeneration || !peer.token || !peer.nodeId) return null;
+        return { token: peer.token, nodeId: peer.nodeId, localPort: peer.localPort,
+          activeSlot: pool.activeSlot, port: slot.port, generation: pool.activeGeneration };
+      };
+      const selected = channel(next);
+      if (!selected) return unverified();
+      let disconnected = req.aborted || res.destroyed;
+      const controller = new AbortController();
+      const onDisconnect = () => { disconnected = true; controller.abort(); };
+      req.once('aborted', onDisconnect);
+      res.once('close', onDisconnect);
+      let proof;
+      try {
+        proof = await verifier.verify({ store: st, peer: next, loadStore: () => store.loadStore(nodesPath),
+          scope: nodesPath, signal: controller.signal });
+      } catch (_) { proof = null; }
+      finally {
+        req.removeListener('aborted', onDisconnect);
+        res.removeListener('close', onDisconnect);
+      }
+      proofKey = proof && proof.key;
+      if (disconnected || req.aborted || res.destroyed) { verifier.invalidate(proofKey); return; }
+      if (!proof || !proof.owned) return unverified();
+
+      const current = store.loadStore(nodesPath);
+      const currentNext = current && store.getNode(current, parsed.route[0]);
+      if (!current || current.nodeId !== st.nodeId || !currentNext || currentNext.direction !== 'inbound'
+        || JSON.stringify(channel(currentNext)) !== JSON.stringify(selected)) return unverified();
+      // The proof awaited remote I/O: none of the authorization held above is
+      // retained across that wait. Recheck the ingress credential and grants.
+      const currentIngress = ingress ? peerFromToken(nodesPath, bearerFrom(req)) : null;
+      if (ingress && (!currentIngress || currentIngress.name !== ingress.name || currentIngress.nodeId !== ingress.nodeId)) {
+        return rejectForward(401, { error: 'unauthorized peer' });
+      }
+      const gate = classGateCheck(parsed.resource, req.method, currentIngress);
+      if (!gate.ok) return rejectForward(gate.status, { error: 'risorsa non concessa a questo nodo', reason: gate.reason });
+      if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) {
+        return rejectForward(403, { error: 'READONLY: federated mutation blocked' });
+      }
+      if (!currentNext.token || currentNext.shared !== true || (currentIngress && !canTransit(currentIngress, currentNext))) {
+        return rejectForward(403, { error: 'route non consentita' });
+      }
+      if (!controlledVisited(req, currentIngress, current.nodeId)) return rejectForward(409, { error: 'federation cycle rejected' });
+      forwardPort = selected.port;
+    }
+    const invalidateProof = () => verifier.invalidate(proofKey);
+    const actionCapture = isAskAction ? (status, text) => {
+      if (status < 200 || status >= 300) invalidateProof();
+      try { JSON.parse(text); } catch (_) { invalidateProof(); }
+    } : capture;
+    proxyHttp(req, res, { port: forwardPort, path, credential: next.token, visited, setCookiePrefix, panelCookie, capture: actionCapture,
+      onForwardFailure: isAskAction ? invalidateProof : null, abortWithClient: isAskAction, getTimeoutMs: forwardGetTimeoutMs, sseIdleMs: forwardSseIdleMs });
   };
 }
 
@@ -1251,7 +1345,8 @@ async function probeReverseOwner(peer, fetchImpl = fetch) {
   });
 }
 
-function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly = () => false, version = null, roles = null, hopSecret = null, diagnostics = null }) {
+function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly = () => false, version = null, roles = null, hopSecret = null, diagnostics = null, askProofNow = null, slotVerifier = null }) {
+  slotVerifier = slotVerifier || (askProofNow ? createAskSlotVerifier({ now: askProofNow }) : askSlotVerifier);
   const r = express.Router();
   r.use((req, res, next) => {
     const peer = peerFromToken(nodesPath, bearerFrom(req));
@@ -1532,13 +1627,18 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
       return res.status(e.status || 500).json({ error: String(e && e.message || e), ...(e.code ? { code: e.code } : {}) });
     }
   });
-  r.use('/route', (req, res) => routeHandler({ nodesPath, localPort, localCredential, ingress: req.peer, readonly, hopSecret })(req, res));
+  r.use('/route', (req, res, next) => {
+    routeHandler({ nodesPath, localPort, localCredential, ingress: req.peer, readonly, hopSecret, slotVerifier })(req, res).catch(next);
+  });
   return r;
 }
 
-function localRouter({ nodesPath, localPort, localCredential, readonly, hopSecret = null, liveHostLedger = null }) {
+function localRouter({ nodesPath, localPort, localCredential, readonly, hopSecret = null, liveHostLedger = null, askProofNow = null, slotVerifier = null }) {
+  slotVerifier = slotVerifier || (askProofNow ? createAskSlotVerifier({ now: askProofNow }) : askSlotVerifier);
   const r = express.Router();
-  r.use((req, res) => routeHandler({ nodesPath, localPort, localCredential, readonly, hopSecret, liveHostLedger })(req, res));
+  r.use((req, res, next) => {
+    routeHandler({ nodesPath, localPort, localCredential, readonly, hopSecret, liveHostLedger, slotVerifier })(req, res).catch(next);
+  });
   return r;
 }
 

package/lib/proxy/resource-acl.js

@@ -55,6 +55,7 @@ function classifyResource(resource, method = 'GET') {
   // attempt id a UUID. The routes live UNDER /event-feed because they are the
   // feed's own write-back path; the class is the same ask-action.
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/answer$/.test(resource)) return m === 'POST' ? 'ask-action' : null;
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/capability$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
   if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return m === 'DELETE' ? 'ask-action' : null;
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
 

package/lib/server.js

@@ -26,7 +26,7 @@ const { transcribe } = require('./voice/transcribe.js');
 const { selectProvider } = require('./fleet/provider.js');
 const { fleetRoutes } = require('./fleet/routes.js');
 const { leaseRoutes } = require('./fleet/lease-routes.js');
-const { cellsRoutes } = require('./cells/routes.js');
+const { cellsRoutes, publicCells } = require('./cells/routes.js');
 const { liveHostRoutes } = require('./live-host/routes.js');
 const { createLiveHostStore, liveHostPath } = require('./live-host/store.js');
 const { createLiveBridge } = require('./live-host/bridge.js');
@@ -85,6 +85,7 @@ const { createAskReceipts } = require('./notify/ask-receipts.js');
 const { createAskAnswerService } = require('./notify/ask-answer-service.js');
 const { createEventFeedAsksRoutes } = require('./notify/event-feed-asks-routes.js');
 const { createAskRelay } = require('./notify/ask-relay.js');
+const { createAskSlotVerifier } = require('./nodes/ask-slot-verifier.js');
 const { readFederationEventsEnabled } = require('./config.js');
 
 function sanitizeReplyLabel(raw) {
@@ -127,6 +128,7 @@ function wsBridgeDefaults(cfg = {}) {
 }
 
 function createServer(opts = {}) {
+  const askReverseVerifier = createAskSlotVerifier();
   const cfg = loadConfig(opts);
   // UNA istanza per server: trattiene le attach federate quando il client cade,
   // cosi' chi torna con la stessa identita' riprende dal buffer. I parametri
@@ -234,7 +236,27 @@ function createServer(opts = {}) {
   let closureRetry = null;
   const askAnswerService = createAskAnswerService({
     asks: asksStore,
-    paste: cfg.pasteSeam || ((session, text) => pasteToSession(cfg.tmuxBin, session, text)),
+    submit: opts.askSubmit || (async (session, text) => {
+      let cell;
+      try {
+        const fleet = await fleetP;
+        const statusFn = fleet && (typeof fleet.cellStatus === 'function' ? fleet.cellStatus : fleet.status);
+        const status = fleet && fleet.available === true && typeof statusFn === 'function' ? await statusFn.call(fleet) : null;
+        if (!status || status.available !== true || !Array.isArray(status.cells)) {
+          return { outcome: 'failed-pre-paste', submitted: false, reason: 'fleet-unavailable' };
+        }
+        cell = publicCells(status, apiNodeId()).find(entry => entry.tmuxSession === session);
+      } catch (_) { return { outcome: 'failed-pre-paste', submitted: false, reason: 'fleet-unavailable' }; }
+      if (!cell) {
+        if (!sessionExistsImpl(session)) return { outcome: 'failed-pre-paste', submitted: false, reason: 'session-unavailable' };
+        // Manual tmux sessions keep the existing paste-only answer contract.
+        const pasted = await pasteToSession(cfg.tmuxBin, session, text);
+        return { outcome: pasted ? 'pasted-not-submitted' : 'delivery-unknown', submitted: false };
+      }
+      if (!cell.active || !cell.engine) return { outcome: 'failed-pre-paste', submitted: false, reason: 'cell-unavailable' };
+      // Same submission as cell messages; operator draft in the composer may be submitted.
+      return submitToSession(cfg.tmuxBin, session, text, { engine: cell.engine });
+    }),
     receipts: askReceipts,
     // La chiusura esce da QUI: e' il punto in cui OGNI transizione autorevole
     // passa — risposta e scarto, rotta locale e rotta federata. Emetterla dalle
@@ -920,7 +942,7 @@ function createServer(opts = {}) {
   // abbia mai preso un ticket). Resta della PWA autenticata l'EMISSIONE: il POST
   // .../panel/<cella>/ticket transita di sotto, col Bearer, come ogni altra /api.
   const panelFederatoRouter = federation.localRouter({
-    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    nodesPath, slotVerifier: askReverseVerifier, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
     hopSecret: () => hopSecret,
   });
   api.use('/route', (req, res, next) => {
@@ -1139,7 +1161,10 @@ function createServer(opts = {}) {
   });
   const askPeerTargets = async () => {
     const list = await federatedPeers();
-    return (Array.isArray(list) ? list : []).map((p) => p && (p.nodeId || p.instanceId)).filter(Boolean);
+    const current = nodesStore.loadStoreStrict(nodesPath);
+    return (Array.isArray(list) ? list : []).map(peer => ({ ...peer,
+      firstHop: current && current.nodes.find(node => node.name === peer.route?.[0]),
+    }));
   };
   // Riconciliazione del RICEVENTE: per ogni alias ancora aperto si chiede
   // all'owner quali domande sono ancora aperte. Se l'alias non c'e' piu' la'
@@ -1252,15 +1277,6 @@ function createServer(opts = {}) {
     federatedRate: createSpeakRateLimiter(),
     answerService: askAnswerService,
     receipts: askReceipts,
-    // Elenco dei peer autorizzati per il fan-out di default della domanda
-    // (nessun `target` → tutti i nodi dell'owner). Il
-    // dispatcher resta a target esatto: l'enumerazione la fa la route.
-    peerTargets: async () => {
-      const list = await federatedPeers();
-      return (Array.isArray(list) ? list : [])
-        .map((p) => p && (p.nodeId || p.instanceId))
-        .filter(Boolean);
-    },
     log: opts.log || console.log,
   }));
   // Event feed: the closed SSE/JSON surface, mounted inside the
@@ -1305,7 +1321,11 @@ function createServer(opts = {}) {
   // resolves the owner from the authorized store and forwards with the peer's
   // own pair token. Uncertain outcomes are parked, never retried silently.
   const askRelay = createAskRelay({
+    nodesPath, slotVerifier: askReverseVerifier,
     loadStore: () => nodesStore.loadStore(nodesPath),
+    peers: federatedPeers,
+    localPort: () => (server && server.address() ? server.address().port : cfg.port),
+    localToken: () => tokenHolder.value,
     log: opts.log || console.log,
   });
   // Il body va parsato QUI: il router `api` non monta un parser globale, ogni
@@ -1326,23 +1346,30 @@ function createServer(opts = {}) {
         if (out.ok && typeof eventFeedClient.dismissConfirmed === 'function') {
           eventFeedClient.dismissConfirmed(b.ownerId, b.askId);
         }
-        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { dismissed: true } : { error: out.error || 'unknown' });
+        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { dismissed: true } : { error: out.error || 'unknown', reason: out.reason });
       }
       if (b.action === 'verify') {
         const out = await askRelay.verifyStatus({ ownerId: b.ownerId, askId: b.askId, requestId: b.requestId });
-        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { state: out.state } : { error: out.error || 'unknown', reason: out.reason });
+        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { state: out.state, ownerId: out.ownerId, askId: out.askId, actor: out.actor, receipt: out.receipt } : { error: out.error || 'unknown', reason: out.reason });
       }
-      const out = await askRelay.relayAnswer({ ownerId: b.ownerId, askId: b.askId, text: b.text });
+      const out = await askRelay.relayAnswer({ ownerId: b.ownerId, askId: b.askId, text: b.text, rid: b.requestId });
       return res.status(out.ok ? 200 : out.code || 500).json({
-        ...(out.ok ? { status: out.status } : {}),
+        ...(out.ok ? { status: out.status, ownerId: out.ownerId, askId: out.askId, actor: out.actor, receipt: out.receipt } : {}),
         requestId: out.requestId || b.requestId,
-        ...(out.uncertain ? { uncertain: true, reason: out.reason } : {}),
+        ...(out.uncertain ? { uncertain: true, reason: out.reason, originalRequestId: out.originalRequestId } : {}),
         ...(!out.ok && !out.uncertain ? { error: out.error, reason: out.reason } : {}),
       });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   // Riconciliazione dopo refresh: gli esiti incerti noti al relay (solo
   // contatori/ID, mai testo) per ricostruire lo stato «verifica» senza reinvii.
+  api.get('/asks-relay/capability', async (req, res) => {
+    const ownerId = typeof req.query.ownerId === 'string' ? req.query.ownerId : '';
+    const askId = typeof req.query.askId === 'string' ? req.query.askId : '';
+    if (!/^[a-f0-9]{32}$/.test(ownerId) || !/^[a-f0-9]{8}$/.test(askId)) return res.status(400).json({ error: 'ownerId e askId richiesti' });
+    try { res.json(await askRelay.replyCapability({ ownerId, askId })); }
+    catch (_) { res.json({ ownerId, askId, canReply: false, status: 'unreachable' }); }
+  });
   api.get('/asks-relay/state', (_req, res) => {
     try { res.json({ attempts: askRelay.state() }); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -1358,6 +1385,12 @@ function createServer(opts = {}) {
       if (!bridgeReadonly()) pushRelay.considerImported(event);
     },
   };
+  try { nodesStore.migrateAdminReception({ filePath: nodesPath, readonly: bridgeReadonly() }); }
+  catch (error) {
+    if (error?.code !== 'NODES_STORE_MISSING') {
+      (opts.log || console.log)(`Admin reception migration skipped: ${error?.code || 'NODES_STORE_UNAVAILABLE'}`);
+    }
+  }
   const eventFeedClient = createEventFeedClient({
     loadStore: () => nodesStore.loadStore(nodesPath),
     token: () => tokenHolder.value,
@@ -1640,7 +1673,7 @@ function createServer(opts = {}) {
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   api.use('/route', federation.localRouter({
-    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    nodesPath, slotVerifier: askReverseVerifier, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
     hopSecret: () => hopSecret,
     // A designation forwarded from here to a peer is recorded by the answer
     // the peer gives, not by a local guess: see liveHostLedgerCapture.
@@ -1672,7 +1705,7 @@ function createServer(opts = {}) {
 
   app.use('/api', api);
   app.use('/federation', federation.peerRouter({
-    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
+    nodesPath, slotVerifier: askReverseVerifier, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
     fetchImpl: healthFetch, hopSecret: () => hopSecret,
     roles: () => require('./cli/commands.js').readRoles(cfg.configPath || configJsonPath()),
     diagnostics,

package/lib/tmux/actions.js

@@ -118,8 +118,10 @@ function execTmux(execFileImpl, tmuxBin, args, timeout = 5000) {
 // risolto prima del paste e verificato di nuovo prima dell'Enter, evitando
 // prefix match e il riuso del solo nome sessione.
 async function submitToSession(tmuxBin, session, text, opts = {}) {
+  let pasteAttempted = false;
+  const failed = reason => ({ submitted: false, outcome: pasteAttempted ? 'delivery-unknown' : 'failed-pre-paste', reason });
   if (!isValidSession(session) || !submitTextOk(text)) {
-    return { submitted: false, reason: 'input non valido' };
+    return failed('input non valido');
   }
   const execFileImpl = opts.execFileImpl || execFile;
   const fsImpl = opts.fsImpl || fs;
@@ -128,7 +130,7 @@ async function submitToSession(tmuxBin, session, text, opts = {}) {
     ? opts.delay : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
   const codexComposer = /^(?:codex|codex-vl)(?:\.|$)/.test(String(opts.engine || ''));
   const nonce = (opts.nonce || crypto.randomBytes(8).toString('hex')).replace(/[^a-f0-9]/g, '').slice(0, 32);
-  if (!nonce) return { submitted: false, reason: 'invio non disponibile' };
+  if (!nonce) return failed('invio non disponibile');
   const buffer = `ncmsg-${nonce}`;
   const tmp = path.join(tmpRoot, `.nexuscrew-message-${nonce}.txt`);
   let loaded = false;
@@ -139,14 +141,15 @@ async function submitToSession(tmuxBin, session, text, opts = {}) {
       ['display-message', '-p', '-t', `=${session}:`, '#{pane_id}']);
     const paneId = pane.stdout.trim();
     if (!pane.ok || !/^%[0-9]+$/.test(paneId)) {
-      return { submitted: false, reason: 'sessione non raggiungibile' };
+      return failed('sessione non raggiungibile');
     }
     const load = await execTmux(execFileImpl, tmuxBin, ['load-buffer', '-b', buffer, tmp]);
-    if (!load.ok) return { submitted: false, reason: 'buffer non disponibile' };
+    if (!load.ok) return failed('buffer non disponibile');
     loaded = true;
+    pasteAttempted = true;
     const paste = await execTmux(execFileImpl, tmuxBin,
       ['paste-buffer', '-p', '-t', paneId, '-b', buffer]);
-    if (!paste.ok) return { submitted: false, reason: 'consegna non riuscita' };
+    if (!paste.ok) return failed('consegna non riuscita');
     const paneAlive = async () => {
       const verify = await execTmux(execFileImpl, tmuxBin,
         ['display-message', '-p', '-t', paneId, '#{session_name}\t#{pane_dead}\t#{pane_id}']);
@@ -190,20 +193,20 @@ async function submitToSession(tmuxBin, session, text, opts = {}) {
     // messaggio lungo conviene verificare che la cella si sia mossa.
     const attesaBase = codexComposer ? 400 : 150;
     await delay(attesaBase + Math.floor(text.length / 500) * 150);
-    if (!(await paneAlive())) return { submitted: false, reason: 'sessione terminata durante la consegna' };
+    if (!(await paneAlive())) return failed('sessione terminata durante la consegna');
     if (codexComposer) {
       const flush = await execTmux(execFileImpl, tmuxBin, ['send-keys', '-t', paneId, 'C-e']);
-      if (!flush.ok) return { submitted: false, reason: 'testo consegnato ma flush composer non riuscito' };
+      if (!flush.ok) return failed('testo consegnato ma flush composer non riuscito');
       await delay(300);
-      if (!(await paneAlive())) return { submitted: false, reason: 'sessione terminata durante la consegna' };
+      if (!(await paneAlive())) return failed('sessione terminata durante la consegna');
     }
     const enter = await execTmux(execFileImpl, tmuxBin, ['send-keys', '-t', paneId, 'Enter']);
-    if (!enter.ok) return { submitted: false, reason: 'testo consegnato ma invio non riuscito' };
-    return { submitted: true, reason: codexComposer
+    if (!enter.ok) return failed('testo consegnato ma invio non riuscito');
+    return { submitted: true, outcome: 'submitted', reason: codexComposer
       ? 'bracketed paste + burst flush + Enter separati'
       : 'bracketed paste + Enter separato' };
   } catch (_) {
-    return { submitted: false, reason: 'consegna non riuscita' };
+    return failed('consegna non riuscita');
   } finally {
     if (loaded) await execTmux(execFileImpl, tmuxBin, ['delete-buffer', '-b', buffer]);
     try { fsImpl.unlinkSync(tmp); } catch (_) { /* cleanup best-effort */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.56",
+  "version": "0.9.58",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {