@mmmbuto/nexuscrew 0.9.57 → 0.9.59

package/frontend/dist/index.html

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-CAgxp3qK.js"></script>
+  <script type="module" crossorigin src="/assets/index-CZFJnks_.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-fCIoVxeq.css">
 </head>
 <body>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.57"}
+{"version":"0.9.59"}

package/lib/fleet/managed.js

@@ -2285,6 +2285,42 @@ function customCatalogFor(spec, model, declaredModels, home) {
   return { catalogPath: target, contextWindow: entry.contextWindow || 128000 };
 }
 
+// Only this runtime version has a verified embedded MCP contract here. The
+// option is also probed on the resolved launch path: npm Node shims on Termux
+// must not accidentally interrogate a different executable through PATH.
+const CODEX_DAEMON_MIN_VERSION = '0.131.0-alpha.12';
+const CODEX_PROBE_TIMEOUT_MS = 10000;
+const codexCapabilityCache = new Map();
+const CODEX_MCP_CONTEXT_ENV = ['MCP_DEVICE', 'NEXUSCREW_MCP_SESSION', 'TMUX', 'TMUX_PANE'];
+function codexEmbeddedGate(binary, cfg) {
+  const { spawnSync } = require('node:child_process');
+  const { compareVersions, parseVersion } = require('../update/core.js');
+  const unsupported = { ok: false, reason: 'Codex Termux embedded identity isolation is unsupported: runtime capability could not be verified' };
+  let resolved, stat;
+  try { resolved = fs.realpathSync(binary); stat = fs.statSync(resolved); } catch (_) { return unsupported; }
+  const cached = codexCapabilityCache.get(resolved);
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return cached.result;
+  const remember = result => {
+    codexCapabilityCache.set(resolved, { mtimeMs: stat.mtimeMs, size: stat.size, result });
+    return result;
+  };
+  const explicitNode = needsExplicitNode(binary, cfg.platform || process.platform, cfg.env || process.env);
+  const command = explicitNode ? cfg.nodeExecPath || process.execPath : binary;
+  const probe = flag => {
+    const result = spawnSync(command, [...(explicitNode ? [binary] : []), flag], {
+      encoding: 'utf8', timeout: CODEX_PROBE_TIMEOUT_MS, maxBuffer: 256 * 1024,
+    });
+    return result.error || result.status !== 0 ? null : `${result.stdout || ''}${result.stderr || ''}`;
+  };
+  const version = probe('--version')?.match(/\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?=\s|$)/)?.[1];
+  if (!version || !parseVersion(version)) return unsupported;
+  if (compareVersions(version, CODEX_DAEMON_MIN_VERSION) < 0) return remember({ ok: true, embedded: false });
+  const help = probe('--help');
+  if (help === null) return unsupported;
+  if (!/(?:^|\s)--no-daemon(?:\s|$)/.test(help)) return remember(unsupported);
+  return remember({ ok: true, embedded: true });
+}
+
 function resolveManagedEngine(engine, cell, cfg = {}) {
   // `extraModels` DEVE arrivare fin qui. Threadarlo al chiamante e alla vista
   // non basta: la normalizzazione che decide se la cella PARTE e' questa, e
@@ -2511,6 +2547,27 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
       if (attivita) args.push(`--settings=${JSON.stringify({ hooks: attivita.hooks })}`);
     }
   } else if (spec.client === 'codex' || spec.client === 'codex-vl') {
+    const termux = (cfg.platform || process.platform) === 'android'
+      || termuxRuntimePaths(cfg.env || process.env, { platform: cfg.platform || process.platform, home }) !== null;
+    if (spec.client === 'codex' && termux) {
+      const gate = codexEmbeddedGate(info.binary, cfg);
+      if (!gate.ok) return { ok: false, info, reason: gate.reason };
+      if (gate.embedded) args.push('--no-daemon');
+      if (gate.embedded) try {
+        const { servers } = codexSurfaceTables(readCodexUserToml(path.join(home, '.codex')));
+        const bridge = servers.get('nexuscrew');
+        if (bridge && bridge.enabled !== false) {
+          if (bridge.env && CODEX_MCP_CONTEXT_ENV.some(name => Object.prototype.hasOwnProperty.call(bridge.env, name))) {
+            return { ok: false, info, reason: 'Codex embedded MCP identity cannot use static context overrides: remove the NexusCrew identity keys from mcp_servers.nexuscrew.env' };
+          }
+          const names = [...new Set([...(Array.isArray(bridge.env_vars) ? bridge.env_vars : []), ...CODEX_MCP_CONTEXT_ENV])];
+          args.push('-c', `mcp_servers.nexuscrew.env_vars=${JSON.stringify(names)}`);
+        }
+      } catch (_) {
+        return { ok: false, info, reason: 'Codex embedded MCP identity requires a readable, valid MCP configuration' };
+      }
+    }
+
     // Canale di attivita' per le celle codex: gli stessi eventi che le celle
     // Claude pubblicano via `--settings`, qui come hook `-c` con la fiducia che
     // il client pretende (senza, apre un dialogo di revisione e la cella resta

package/lib/nodes/access-presets.js

@@ -201,6 +201,7 @@ function applyPreset(peer, name) {
   if (preset.cellVisibility === 'selected') out.cells = [...(preset.cells || [])];
   else delete out.cells;
   for (const key of BOOLEAN_GRANTS) out[key] = preset[key];
+  if (name === 'admin') out.eventsReceive = true;
   return out;
 }
 

package/lib/nodes/ask-slot-verifier.js

@@ -0,0 +1,72 @@
+'use strict';
+const crypto = require('node:crypto');
+const { performance } = require('node:perf_hooks');
+const { probeReverseSlot } = require('./reverse-slot-proof.js');
+
+const PROOF_TTL_MS = 10000;
+const MAX_PROOFS = 256;
+
+function channel(peer) {
+  const pool = peer && peer.reversePool;
+  const slot = pool && Array.isArray(pool.slots) && pool.slots[pool.activeSlot];
+  if (!peer || peer.direction !== 'inbound' || peer.shared !== true || !peer.token || !peer.nodeId
+    || !slot || slot.state !== 'active' || !Number.isInteger(slot.port) || slot.port < 1 || slot.port > 65535
+    || !Number.isSafeInteger(pool.activeGeneration) || pool.activeGeneration < 1
+    || slot.generation !== pool.activeGeneration) return null;
+  return { port: slot.port, generation: pool.activeGeneration, instanceId: peer.nodeId };
+}
+function binding(store, peer) {
+  const selected = channel(peer);
+  if (!store || !selected) return null;
+  const key = JSON.stringify([store.nodeId, peer.name, peer.nodeId, selected.port, selected.generation]);
+  // The whole peer includes pool, credential, direction, sharing and ACL.
+  // Only an in-process fingerprint is retained; it never enters responses/logs.
+  const fingerprint = crypto.createHash('sha256').update(JSON.stringify([store.nodeId, peer])).digest('hex');
+  return { key, fingerprint, selected };
+}
+
+function createAskSlotVerifier({ now = () => performance.now() } = {}) {
+  const entries = new Map();
+  function sync(store, scope = store && store.nodeId) {
+    const at = now();
+    for (const [key, entry] of entries) {
+      if (entry.expiresAt <= at) { entries.delete(key); continue; }
+      if (entry.scope !== scope) continue;
+      const peer = store && (store.nodes || []).find(node => node.name === entry.name);
+      const current = binding(store, peer);
+      if (!current || current.key !== key || current.fingerprint !== entry.fingerprint) entries.delete(key);
+    }
+  }
+  function invalidate(key) { if (key) entries.delete(key); }
+  async function verify({ store, peer, loadStore, signal, scope = store && store.nodeId, probeImpl = probeReverseSlot } = {}) {
+    sync(store, scope);
+    const selected = binding(store, peer);
+    if (!selected || (signal && signal.aborted)) return { owned: false, code: 'reverse-slot-proof-unavailable' };
+    const cached = entries.get(selected.key);
+    if (cached && cached.fingerprint === selected.fingerprint) {
+      entries.delete(selected.key); entries.set(selected.key, cached); // LRU only: expiry never slides.
+      return { owned: true, key: selected.key, code: 'reverse-slot-owned' };
+    }
+    invalidate(selected.key);
+    let proof;
+    try { proof = await probeImpl({ port: selected.selected.port, secret: peer.token,
+      expected: { remotePort: selected.selected.port, generation: selected.selected.generation, instanceId: peer.nodeId },
+      timeoutMs: 6000, signal }); }
+    catch (_) { proof = { owned: false, code: 'reverse-slot-proof-unavailable' }; }
+    const freshStore = typeof loadStore === 'function' ? loadStore() : store;
+    sync(freshStore, scope);
+    const freshPeer = freshStore && (freshStore.nodes || []).find(node => node.name === peer.name);
+    const fresh = binding(freshStore, freshPeer);
+    if ((signal && signal.aborted) || !fresh || fresh.key !== selected.key || fresh.fingerprint !== selected.fingerprint
+      || !proof || proof.owned !== true) {
+      invalidate(selected.key);
+      return { owned: false, code: proof && proof.code || 'reverse-slot-proof-unavailable' };
+    }
+    entries.set(selected.key, { scope, name: peer.name, fingerprint: selected.fingerprint, expiresAt: now() + PROOF_TTL_MS });
+    while (entries.size > MAX_PROOFS) entries.delete(entries.keys().next().value);
+    return { owned: true, key: selected.key, code: 'reverse-slot-owned' };
+  }
+  return { verify, invalidate, sync };
+}
+const askSlotVerifier = createAskSlotVerifier();
+module.exports = { channel, binding, createAskSlotVerifier, askSlotVerifier };

package/lib/nodes/commands.js

@@ -467,6 +467,10 @@ function nodesEdit(opts) {
         log(`nodes edit: access-role non valido (atteso: ${accessPresets.PRESET_NAMES.join('|')})`);
         return { code: 1, reason: 'invalid-access-role' };
       }
+      if (supplied.accessRole === 'admin' && supplied.eventsReceive === false) {
+        log('nodes edit: admin conflicts with eventsReceive=false');
+        return { code: 1, reason: 'admin-reception-conflict' };
+      }
       accessVector = { ...accessPresets.PRESETS[supplied.accessRole] };
     } else if (!accessRequested && touchesVector) {
       // Panel/live/scope edit on a configured peer: same vector, same rules.
@@ -496,9 +500,9 @@ function nodesEdit(opts) {
     const expected = Number.isInteger(opts.expectedRevision) ? opts.expectedRevision : store.accessRevisionOf(st);
     let res;
     try {
-      res = store.setPeerAccessGrantsCas({
-        filePath: nodesPath, name: node.name, grants: accessVector, expectedRevision: expected, extraPatch: patch,
-      });
+      res = Object.hasOwn(supplied, 'accessRole')
+        ? store.setPeerAccessPresetCas({ filePath: nodesPath, name: node.name, presetName: supplied.accessRole, expectedRevision: expected, extraPatch: patch })
+        : store.setPeerAccessGrantsCas({ filePath: nodesPath, name: node.name, grants: accessVector, expectedRevision: expected, extraPatch: patch });
     } catch (e) { log(`nodes edit: ${e.message}`); return { code: 1, reason: 'invalid-patch' }; }
     if (!res.ok) {
       log(`nodes edit: revision delle concessioni superata (attuale ${res.revision}) — rileggi e riprova`);

package/lib/nodes/reverse-slot-proof.js

@@ -86,31 +86,43 @@ function newProbe(expected, randomBytes = crypto.randomBytes) {
   };
 }
 
-async function probeReverseSlot({ port, secret, expected, fetchImpl = fetch, timeoutMs = 1500, randomBytes } = {}) {
+async function probeReverseSlot({ port, secret, expected, fetchImpl = fetch, timeoutMs = 1500, randomBytes, signal } = {}) {
   if (!isPort(port) || typeof secret !== 'string' || !secret) return { owned: false, code: 'reverse-slot-proof-invalid-input' };
   const probe = newProbe(expected, randomBytes);
   if (!probe) return { owned: false, code: 'reverse-slot-proof-invalid-input' };
   const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), Math.max(1, Math.min(timeoutMs, 5000)));
+  let rejectAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    rejectAbort = () => reject(new Error('reverse slot proof aborted'));
+    ctrl.signal.addEventListener('abort', rejectAbort, { once: true });
+  });
+  const onAbort = () => ctrl.abort();
+  if (signal) signal.addEventListener('abort', onAbort, { once: true });
+  const timer = setTimeout(onAbort, Math.max(1, Math.min(timeoutMs, 6000)));
+  if (signal && signal.aborted) onAbort();
   try {
-    const response = await fetchImpl(`http://127.0.0.1:${port}/reverse-slot-proof`, {
+    const response = await Promise.race([fetchImpl(`http://127.0.0.1:${port}/reverse-slot-proof`, {
       method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(probe), signal: ctrl.signal,
-    });
+    }), aborted]);
     // Un 409 e' la RISPOSTA di un listener corretto che ha valutato la tupla e
     // l'ha rifiutata: e' un esito, non un'assenza. Collassarlo in
     // "non ottenuta" lo renderebbe indistinguibile da un timeout, e chi
     // classifica gli errori tratterebbe come transitorio un mismatch reale.
     if (response && response.status === 409) {
-      const failure = await response.json().catch(() => null);
+      const failure = await Promise.race([response.json().catch(() => null), aborted]);
       const code = failure && typeof failure.code === 'string' && /^[a-z0-9-]{1,64}$/.test(failure.code)
         ? failure.code : 'reverse-slot-proof-mismatch';
       return { owned: false, code };
     }
     if (!response || response.status !== 200) return { owned: false, code: 'reverse-slot-proof-unavailable' };
-    const body = await response.json().catch(() => null);
+    const body = await Promise.race([response.json().catch(() => null), aborted]);
     return verifySlotProof({ secret, expected, challenge: probe, response: body });
   } catch (_) { return { owned: false, code: 'reverse-slot-proof-unavailable' }; }
-  finally { clearTimeout(timer); }
+  finally {
+    clearTimeout(timer);
+    ctrl.signal.removeEventListener('abort', rejectAbort);
+    if (signal) signal.removeEventListener('abort', onAbort);
+  }
 }
 
 module.exports = {

package/lib/nodes/store.js

@@ -109,7 +109,7 @@ const LABEL_MAX = 64;
 const NODE_KEYS = new Set([
   'name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'identityFile',
   'roles', 'rolesKnown', 'token', 'acceptToken', 'nodeId', 'transport', 'autostart', 'visibility', 'selected',
-  'direction', 'reversePort', 'shared', 'label', 'reversePool',
+  'direction', 'reversePort', 'shared', 'label', 'reversePool', 'pairingRevision',
   // Quali CELLE di questo nodo il peer puo' vedere. Distinto da `visibility`,
   // che governa il TRANSITO (attraverso chi passa il traffico) e non l'accesso.
   'cellVisibility', 'cells',
@@ -392,6 +392,11 @@ function parseNode(n, schemaVersion = SCHEMA_VERSION) {
     if (!validToken(n.acceptToken)) return null;
     out.acceptToken = n.acceptToken;
   }
+  // Public rotation counter, independent of the credential bytes.
+  if (n.pairingRevision !== undefined) {
+    if (!Number.isSafeInteger(n.pairingRevision) || n.pairingRevision < 0) return null;
+    out.pairingRevision = n.pairingRevision;
+  }
   if (n.nodeId !== undefined) {
     if (typeof n.nodeId !== 'string' || !NODE_ID_RE.test(n.nodeId)) return null;
     out.nodeId = n.nodeId;
@@ -461,8 +466,8 @@ function parseStore(raw) {
 
     if (![SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION].includes(d.schemaVersion)) return null;
     const rootKeys = d.schemaVersion === SCHEMA_VERSION
-      ? new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'reversePoolAnchor', 'reversePoolLedgerInitialized', 'accessRevision'])
-      : new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous']);
+      ? new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'reversePoolAnchor', 'reversePoolLedgerInitialized', 'accessRevision', 'adminReceptionMigration'])
+      : new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'adminReceptionMigration']);
     if (Object.keys(d).some((key) => !rootKeys.has(key))) return null;
     if (typeof d.nodeId !== 'string' || !NODE_ID_RE.test(d.nodeId)) return null;
     if (!Array.isArray(d.nodes) || d.nodes.length > MAX_NODES) return null;
@@ -494,6 +499,10 @@ function parseStore(raw) {
     }
 
     const out = { schemaVersion: d.schemaVersion, nodeId: d.nodeId, nodes };
+    if (d.adminReceptionMigration !== undefined) {
+      if (d.adminReceptionMigration !== 1) return null;
+      out.adminReceptionMigration = d.adminReceptionMigration;
+    }
 
     // Revision of the peer access policy. Absent means 0: a store written
     // before this field existed is at revision 0 and the first explicit write
@@ -566,6 +575,19 @@ function atomicWriteStore(p, data) {
   const parsed = parseStore(data);
   if (!parsed) throw new Error('nodes.json non valido: validazione fallita (schema strict)');
 
+  // Count rotations at the durable write boundary, including pairing paths
+  // that replace tokens directly. Never export a hash of the credentials.
+  const previous = loadStore(p);
+  for (const peer of parsed.nodes) {
+    const old = previous && previous.nodes.find(node => node.name === peer.name && node.nodeId === peer.nodeId);
+    if (!old) continue;
+    const revision = old.pairingRevision || 0;
+    const rotated = old.token !== peer.token || old.acceptToken !== peer.acceptToken;
+    if (rotated && revision === Number.MAX_SAFE_INTEGER) throw new Error('pairing rotation revision exhausted');
+    if (rotated || old.pairingRevision !== undefined) peer.pairingRevision = revision + (rotated ? 1 : 0);
+    else delete peer.pairingRevision;
+  }
+
   const dir = path.dirname(p);
   fs.mkdirSync(dir, { recursive: true });
   const tmp = path.join(dir, `.${path.basename(p)}.${crypto.randomBytes(6).toString('hex')}.tmp`);
@@ -727,7 +749,9 @@ function setPeerAccessPreset(store, name, presetName) {
   const vector = { cellVisibility: applied.cellVisibility };
   if (applied.cells !== undefined) vector.cells = applied.cells;
   for (const key of accessPresets.BOOLEAN_GRANTS) vector[key] = applied[key];
-  return setPeerAccessGrants(store, name, vector);
+  const out = setPeerAccessGrants(store, name, vector);
+  out.nodes[idx].eventsReceive = applied.eventsReceive === true;
+  return out;
 }
 
 // Read-only inventory: what every peer is allowed to do on THIS node, with the
@@ -778,12 +802,36 @@ function setPeerAccessPresetCas({ filePath, name, presetName, expectedRevision,
   if (!Number.isInteger(expectedRevision) || accessRevisionOf(current) !== expectedRevision) {
     return { ok: false, conflict: true, revision: accessRevisionOf(current) };
   }
+  if (presetName === 'admin' && extraPatch?.eventsReceive === false) {
+    throw new Error('admin preset conflicts with eventsReceive=false');
+  }
   let next = current;
   if (extraPatch && Object.keys(extraPatch).length > 0) next = updateNode(next, name, extraPatch);
   next = setPeerAccessPreset(next, name, presetName);
   const written = atomicWriteStore(filePath, next);
   const view = accessPresets.grantsOf(written.nodes.find((n) => n.name === name));
-  return { ok: true, name, revision: accessRevisionOf(written), grants: view.grants, label: view.label };
+  return { ok: true, name, revision: accessRevisionOf(written), grants: view.grants, label: view.label,
+    eventsReceive: written.nodes.find((n) => n.name === name).eventsReceive === true };
+}
+
+// One startup migration; later operational reception edits remain authoritative.
+function migrateAdminReception({ filePath, readonly = false }) {
+  if (readonly || process.env.NEXUSCREW_READONLY === '1') return { migrated: false };
+  const current = loadStoreStrict(filePath);
+  if (current.adminReceptionMigration === 1) return { migrated: false };
+  let next = current;
+  let changed = 0;
+  for (const peer of current.nodes) {
+    const view = accessPresets.grantsOf(peer);
+    if (view.configured && view.label === 'admin' && peer.eventsReceive !== true) {
+      next = updateNode(next, peer.name, { eventsReceive: true });
+      changed += 1;
+    }
+  }
+  if (changed) next = { ...next, schemaVersion: SCHEMA_VERSION,
+    accessRevision: accessRevisionOf(current) + 1 };
+  atomicWriteStore(filePath, { ...next, adminReceptionMigration: 1 });
+  return { migrated: true, changed };
 }
 
 // The upgrade is explicit: normal legacy pairing remains schema v2 and keeps
@@ -1026,7 +1074,7 @@ module.exports = {
   // mutazioni
   getNode, addNode, removeNode, setNodeToken, updateNode, upgradeToReversePoolSchema, setNodeReversePool,
   // concessioni federate (preset, CAS, inventario)
-  accessRevisionOf, setPeerAccessGrants, setPeerAccessPreset, accessInventory,
+  accessRevisionOf, setPeerAccessGrants, setPeerAccessPreset, accessInventory, migrateAdminReception,
   setPeerAccessGrantsCas, setPeerAccessPresetCas,
   // redazione
   redactNode, redactStore, hasPairedPeers,

package/lib/notify/ask-answer-service.js

@@ -15,8 +15,8 @@ const crypto = require('node:crypto');
 
 const REQUEST_ID_RE = /^[0-9a-f-]{16,64}$/i;
 
-function createAskAnswerService({ asks, paste, receipts, onClosure, labelPrefix = 'reply' } = {}) {
-  if (!asks || !paste) throw new Error('createAskAnswerService: asks e paste richiesti');
+function createAskAnswerService({ asks, submit, receipts, onClosure, labelPrefix = 'reply' } = {}) {
+  if (!asks || typeof submit !== 'function') throw new Error('createAskAnswerService: asks and submit required');
   const emitClosure = typeof onClosure === 'function' ? onClosure : () => {};
 
   function pasteText(askId, text, label) {
@@ -50,14 +50,21 @@ function createAskAnswerService({ asks, paste, receipts, onClosure, labelPrefix
       if (claim.reason === 'answering') return { ok: false, code: 409, error: 'risposta gia\' in corso da un\'altra richiesta', reason: 'answering' };
       return { ok: false, code: 409, error: 'ask gia\' risposto', reason: 'answered' };
     }
-    let pasted = false;
+    let submission;
     try {
-      pasted = await paste(claim.ask.session, pasteText(askId, text, labelPrefix));
-    } catch (_) { pasted = false; }
-    if (!pasted) {
-      asks.release(askId); // rollback: the ask stays open and contestable
-      if (request && receipts) receipts.finalize(request.peerId, askId, request.requestId, 'failed', 'paste-failed');
-      return { ok: false, code: 502, error: `paste fallito: sessione "${claim.ask.session}" non raggiungibile`, reason: 'paste-failed' };
+      const payload = pasteText(askId, text, labelPrefix);
+      submission = await submit(claim.ask.session, payload);
+    } catch (_) { submission = { outcome: 'delivery-unknown' }; }
+    if (!submission || !['submitted', 'pasted-not-submitted'].includes(submission.outcome)) {
+      const prePaste = submission && submission.outcome === 'failed-pre-paste';
+      if (request && receipts) {
+        receipts.finalize(request.peerId, askId, request.requestId,
+          prePaste ? 'failed' : 'delivery-unknown', submission && submission.reason);
+      }
+      // An uncertain attempt is durably blocked before the claim is released.
+      if (prePaste || (request && receipts)) asks.release(askId);
+      return { ok: false, code: 502, error: prePaste ? 'submission failed before paste' : 'submission outcome is unknown',
+        reason: prePaste ? 'paste-failed' : 'delivery-unknown' };
     }
     const committed = asks.commit(askId, text);
     if (request && receipts) receipts.finalize(request.peerId, askId, request.requestId, 'committed', null);
@@ -72,7 +79,12 @@ function createAskAnswerService({ asks, paste, receipts, onClosure, labelPrefix
 
   // LOCAL answer: validation and binding already happened in the route.
   async function answerLocal({ askId, text }) {
-    return runAnswer({ askId, text });
+    if (!receipts) return runAnswer({ askId, text });
+    if (receipts.isBlocked(askId) || ['committed', 'delivered'].includes(receipts.answerStateFor(askId))) return runAnswer({ askId, text });
+    const request = { peerId: 'local', requestId: crypto.randomUUID() };
+    const receipt = receipts.attempt({ ...request, askId, text });
+    if (!receipt.ok) return { ok: false, code: 409, reason: 'delivery-unknown-block', error: 'answer attempt refused' };
+    return runAnswer({ askId, text, request });
   }
 
   // FEDERATED answer: the receipt lifecycle wraps the same core.
@@ -103,7 +115,7 @@ function createAskAnswerService({ asks, paste, receipts, onClosure, labelPrefix
       return { ok: false, code: 429, error: 'receipt store al cap', reason: 'receipt-cap' };
     }
     const out = await runAnswer({ askId, text, request: { peerId, requestId } });
-    if (out.ok) return { ok: true, state: 'committed' };
+    if (out.ok) return { ok: true, state: 'committed', closure: out.closure };
     // Every refusal is answered as it is: a rejection BEFORE the paste (claim
     // lost, ask closed, locked) finalizes the attempt as failed, and a transport
     // failure does the same — the peer re-checks the status instead of blindly

package/lib/notify/ask-receipts.js

@@ -100,6 +100,7 @@ function createAskReceipts({ filePath, now = Date.now } = {}) {
     if (!entry) return false;
     if (entry.state !== 'pending') { entry.replayedAt = now(); return true; }
     entry.state = finalState;
+    if (finalState === 'delivery-unknown') state.blockedAsks[askId] = true;
     entry.receipt = receipt === undefined ? null : receipt;
     entry.updatedAt = now();
     persist(state);