@mmmbuto/nexuscrew 0.9.63 → 0.9.65

package/lib/server.js

@@ -31,6 +31,9 @@ const { cellsRoutes, publicCells } = require('./cells/routes.js');
 const { liveHostRoutes } = require('./live-host/routes.js');
 const { createLiveHostStore, liveHostPath } = require('./live-host/store.js');
 const { createLiveBridge } = require('./live-host/bridge.js');
+const { createLiveThreadRegistry, liveThreadsPath } = require('./live-host/registry.js');
+const { createLiveAttestation } = require('./live-host/attest.js');
+const { buildLiveEntry } = require('./live-host/entry.js');
 const { createLiveHostFederation } = require('./live-host/federation.js');
 const { fsRoutes } = require('./fs/routes.js');
 const nodesStore = require('./nodes/store.js');
@@ -88,7 +91,11 @@ const { createEventFeedClient } = require('./notify/event-feed-client.js');
 const { createAskReceipts } = require('./notify/ask-receipts.js');
 const { createAskAnswerService } = require('./notify/ask-answer-service.js');
 const { createEventFeedAsksRoutes } = require('./notify/event-feed-asks-routes.js');
+const { createEventFeedNoticesRoutes } = require('./notify/event-feed-notices-routes.js');
+const { createNoticeDismissals } = require('./notify/notice-dismissals.js');
 const { createAskRelay } = require('./notify/ask-relay.js');
+const { createNoticeRelay } = require('./notify/notice-relay.js');
+const { createNoticeDismissalQueue, createNoticeDismissalDrainer } = require('./notify/notice-dismissal-queue.js');
 const { createImportedDismissalDrainer } = require('./notify/imported-dismissals.js');
 const { createAskSlotVerifier } = require('./nodes/ask-slot-verifier.js');
 const { readFederationEventsEnabled } = require('./config.js');
@@ -218,6 +225,12 @@ function createServer(opts = {}) {
   const feedHistory = createEventFeedHistory({
     filePath: path.join(notifyDir, 'event-feed-history.json'),
   });
+  // Notices the OWNER cleared: ids and timestamps only, expiring with the
+  // history they filter. This is what makes a cleanup true on every device —
+  // the owner's snapshot stops carrying the entry, so a reload cannot revive it.
+  const noticeDismissals = createNoticeDismissals({
+    filePath: path.join(notifyDir, 'notice-dismissals.json'),
+  });
   // Kill switch: strict boolean, read FRESH on every use so flipping it in
   // config.json acts on live streams without a restart.
   const eventsEnabled = () => readFederationEventsEnabled({ configJsonPath: cfg.configPath, federationEventsEnabled: cfg.federationEventsEnabled });
@@ -1017,7 +1030,7 @@ function createServer(opts = {}) {
       return cellScoper.resolve({ trust: 'federated', visited: [] });
     }
   };
-  // Scope celle (NC-E): un punto solo decide cosa un peer federato vede e puo'
+  // Scope celle: un punto solo decide cosa un peer federato vede e puo'
   // toccare. Sta qui, prima di ogni route, perche' i canali da cui una cella
   // trapela sono molti e crescono: filtrarli uno per uno significa dimenticarne
   // uno, e un permesso che vale su quasi tutti i canali non e' un permesso.
@@ -1337,6 +1350,33 @@ function createServer(opts = {}) {
     cellForSession: ownerAskScope.cellForSession,
     readonly: proxyReadonly,
   }));
+  // Owner-side notice dismissals: the same action gate and the same chain as
+  // the ask write-back, with its own rate instance. Mounted beside the asks,
+  // before the feed router, because it is a write-back path of the feed.
+  api.use('/event-feed/notices', createEventFeedNoticesRoutes({
+    nodesPath,
+    localNodeId: federatedNodeId,
+    originResolver: createOriginResolver({
+      localNodeId: federatedNodeId,
+      hopSecret: () => hopSecret,
+    }),
+    eventsEnabled,
+    history: feedHistory,
+    dismissals: noticeDismissals,
+    // The closure inherits scope and cell of the original notice, so it is
+    // delivered to exactly the peers that could see it. It enters the history
+    // too: a peer that missed the live frame recovers it from the snapshot,
+    // where toRemoteNotice drops it by type.
+    closeNotice: ({ scope, cellId, eventId }) => {
+      recordAndPublish({
+        producer: scope === 'node' ? 'notify-closed-node' : 'notify-closed',
+        cellId: scope === 'node' ? null : cellId,
+        payload: { eventId, ts: Date.now() },
+      });
+    },
+    readonly: proxyReadonly,
+    log: opts.log || console.log,
+  }));
   api.use('/event-feed', createEventFeedRoutes({
     nodesPath,
     localNodeId: federatedNodeId,
@@ -1346,6 +1386,7 @@ function createServer(opts = {}) {
     }),
     eventFeed,
     history: feedHistory,
+    noticeDismissals,
     asksStore,
     fleetP,
     cellForSession: ownerAskScope.cellForSession,
@@ -1374,6 +1415,60 @@ function createServer(opts = {}) {
   // Il body va parsato QUI: il router `api` non monta un parser globale, ogni
   // rotta porta il suo (`express.json`) — vedi /sessions, /notify, /asks.
   // Senza, `req.body` e' undefined, il relay legge un body vuoto e risponde
+  // Notice dismissals, client half: the relay that carries a dismissal to the
+  // owner, the durable queue of the intents that could not be delivered yet, and
+  // the drainer that retries them. Same channel as the ask answers (one
+  // implementation of the chain), same binding as the imported dismissals: a
+  // refusal stays blocked until the pairing to that owner changes.
+  const noticeRelay = createNoticeRelay({
+    nodesPath, slotVerifier: askReverseVerifier,
+    loadStore: () => nodesStore.loadStore(nodesPath),
+    peers: federatedPeers,
+    localPort: () => (server && server.address() ? server.address().port : cfg.port),
+    localToken: () => tokenHolder.value,
+    log: opts.log || console.log,
+  });
+  const noticeDismissalQueue = createNoticeDismissalQueue({
+    filePath: path.join(notifyDir, 'notice-dismissal-queue.json'),
+  });
+  // Durability signal for the operator's answer: the queue honours the intent
+  // in memory when the disk refuses the write (that policy stands), but a
+  // record that will not survive a restart is NOT the normal durable success,
+  // so queued answers declare it instead of looking healthy. Empty = healthy.
+  const queueDurability = () => {
+    try {
+      const st = noticeDismissalQueue.status();
+      return st && st.degraded ? { durable: false, degraded: st.degraded } : {};
+    } catch (_) { return {}; }
+  };
+  // One durable record per cleared notice. A refused write keeps the in-memory
+  // truth (the intent was honoured here anyway) and only loses durability; a
+  // refused enqueue means the intent was NOT recorded, so nothing is left behind.
+  function enqueueNoticeDismissals(ownerId, eventIds, syncState) {
+    const added = [];
+    for (const eventId of eventIds) {
+      const queued = noticeDismissalQueue.enqueue({ ownerId, eventId });
+      if (!queued.ok) {
+        for (const done of added) noticeDismissalQueue.confirm(ownerId, done);
+        return false;
+      }
+      added.push(eventId);
+    }
+    if (syncState === 'blocked') {
+      for (const eventId of eventIds) noticeDismissalQueue.update(ownerId, eventId, { syncState: 'blocked', lastReason: 'unsupported' });
+    }
+    return true;
+  }
+  const noticeDismissalDrainer = createNoticeDismissalDrainer({
+    queue: noticeDismissalQueue, relay: noticeRelay,
+    readonly: proxyReadonly, bindingForOwner: dismissalBinding,
+    // Same seam as the feed client's poll: a test (or an installation with its
+    // own rhythm) can shorten the retry interval without touching the policy.
+    ...(Number.isInteger(cfg.noticeDismissalDrainMs) && cfg.noticeDismissalDrainMs > 0
+      ? { intervalMs: cfg.noticeDismissalDrainMs } : {}),
+    log: opts.log || console.log,
+  });
+
   // 400 «ownerId, askId e text richiesti» a OGNI richiesta: la risposta
   // federata non ha mai potuto attraversare, e nessun test copriva questa
   // rotta. Difetto preesistente, trovato scrivendo il test del ritorno federato.
@@ -1517,6 +1612,106 @@ function createServer(opts = {}) {
     try { res.json({ attempts: askRelay.state() }); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
+  // Operator surface for the notice dismissals. LOCAL and authenticated, never in
+  // the federation allowlist: the remote surface is the owner's (the routes under
+  // /event-feed/notices). The intent is honoured HERE first — the card leaves this
+  // node's view — and the owner's copy is either delivered or queued, with the
+  // answer saying which.
+  api.post('/notices-relay', express.json({ limit: '8kb' }), async (req, res) => {
+    try {
+      const b = req.body || {};
+      if (proxyReadonly()) return res.status(403).json({ error: 'READONLY: mutation blocked' });
+      if (req.headers[HOP_HEADER]) return res.status(403).json({ error: 'local operator required' });
+      if (!b || Array.isArray(b) || typeof b.action !== 'string') return res.status(400).json({ error: 'invalid notices body' });
+      if (b.action === 'dismiss') {
+        if (Object.keys(b).some((key) => !['action', 'ownerId', 'eventId'].includes(key))
+          || !/^[a-f0-9]{32}$/.test(String(b.ownerId || ''))
+          || !/^[0-9a-f-]{36}$/.test(String(b.eventId || ''))
+          || b.ownerId === federatedNodeId()) {
+          return res.status(400).json({ error: 'invalid local dismissal body' });
+        }
+        const out = await noticeRelay.relayNoticeDismiss({ ownerId: b.ownerId, eventId: b.eventId });
+        if (out.ok) {
+          if (typeof eventFeedClient.dismissNoticeConfirmed === 'function') eventFeedClient.dismissNoticeConfirmed(b.ownerId, b.eventId);
+          return res.json({ dismissed: true, ...(out.idempotent ? { idempotent: true } : {}), ...(out.gone ? { gone: true } : {}) });
+        }
+        // The owner is not reachable NOW (or has no such surface at all): the
+        // local intent stands, and the queue carries the rest. A reachable owner
+        // that REFUSES is never queued — its answer is the decision.
+        if (out.transient === true || out.reason === 'unsupported') {
+          const queued = noticeDismissalQueue.enqueue({ ownerId: b.ownerId, eventId: b.eventId });
+          if (!queued.ok) return res.status(503).json({ error: 'dismissal queue unavailable', reason: queued.reason });
+          if (out.reason === 'unsupported') noticeDismissalQueue.update(b.ownerId, b.eventId, { syncState: 'blocked', lastReason: 'unsupported' });
+          if (typeof eventFeedClient.dismissNoticeConfirmed === 'function') eventFeedClient.dismissNoticeConfirmed(b.ownerId, b.eventId);
+          res.json({ dismissed: true, scope: 'local', ownerSync: out.reason === 'unsupported' ? 'blocked' : 'pending', ...queueDurability() });
+          noticeDismissalDrainer.nudge();
+          return;
+        }
+        return res.status(out.code || 500).json({ error: out.error || 'unknown', reason: out.reason });
+      }
+      if (b.action === 'dismiss-all') {
+        if (Object.keys(b).some((key) => !['action', 'owners'].includes(key))
+          || !Array.isArray(b.owners) || b.owners.length === 0 || b.owners.length > 100
+          || b.owners.some((owner) => !/^[a-f0-9]{32}$/.test(String(owner || '')) || owner === federatedNodeId())) {
+          return res.status(400).json({ error: 'invalid dismiss-all body' });
+        }
+        const results = {};
+        for (const ownerId of [...new Set(b.owners)]) {
+          // What this node is SHOWING for that owner: the whole visible set is
+          // what the operator asked to clear, and it is the set whose local
+          // intent has to outlive a reload or a restart of this node.
+          const view = (eventFeedClient.state().views || []).find((v) => v.ownerId === ownerId);
+          const affected = ((view && view.notifications) || [])
+            .map((n) => n && n.eventId).filter((eventId) => typeof eventId === 'string' && eventId !== '');
+          const out = await noticeRelay.relayNoticeDismissAll({ ownerId });
+          if (out.ok) {
+            // The owner took it: its own store stops serving these notices, so
+            // the view forgets them here as well, exactly like the single route.
+            for (const eventId of affected) eventFeedClient.dismissNoticeConfirmed(ownerId, eventId);
+            results[ownerId] = { ok: true, dismissed: out.dismissed || 0 };
+            continue;
+          }
+          // The owner is not reachable NOW (`pending`) or has no notices surface
+          // at all (`blocked`): the local intent stands, durably — one queue
+          // record per cleared notice is what keeps them out of the view on the
+          // next snapshot — and the owner's copy is carried later, or never.
+          const localSync = out.reason === 'unsupported' ? 'blocked' : (out.transient === true ? 'pending' : null);
+          if (localSync === null) { results[ownerId] = { failed: out.reason || 'refused' }; continue; }
+          if (!enqueueNoticeDismissals(ownerId, affected, localSync)) {
+            results[ownerId] = { failed: 'queue-unavailable' };
+            continue;
+          }
+          for (const eventId of affected) eventFeedClient.dismissNoticeConfirmed(ownerId, eventId);
+          // Queued answers depend on the durable write: a queue that cannot
+          // persist says so per owner, instead of looking like the healthy
+          // pending/blocked that survives a restart.
+          results[ownerId] = localSync === 'blocked'
+            ? { blocked: 'unsupported', ...queueDurability() }
+            : { pending: affected.length, ...queueDurability() };
+          if (localSync === 'pending') noticeDismissalDrainer.nudge();
+        }
+        return res.json({ results });
+      }
+      return res.status(400).json({ error: 'azione non riconosciuta' });
+    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
+  });
+  api.get('/notices-relay/capability', (req, res) => {
+    const ownerId = typeof req.query.ownerId === 'string' ? req.query.ownerId : '';
+    if (!/^[a-f0-9]{32}$/.test(ownerId)) return res.status(400).json({ error: 'ownerId richiesto' });
+    let canDismiss = false;
+    try {
+      const st = nodesStore.loadStore(nodesPath);
+      const peer = st && (st.nodes || []).find((node) => node && node.nodeId === ownerId);
+      const slot = peer && peer.reversePool && Array.isArray(peer.reversePool.slots)
+        ? peer.reversePool.slots[peer.reversePool.activeSlot] : null;
+      canDismiss = !proxyReadonly() && !req.headers[HOP_HEADER] && !!peer && (
+        (peer.direction === 'outbound' && !!peer.token && !!peer.localPort)
+        || (peer.direction === 'inbound' && peer.shared === true && peer.askReplyAccess === true
+          && peer.eventsAccess === true && peer.cellVisibility !== 'none'
+          && !!slot && Number.isInteger(slot.port)));
+    } catch (_) { canDismiss = false; }
+    res.json({ ownerId, canDismiss });
+  });
   // The client re-emits imported events into the local hub (deliverOnly: the
   // notifier is bypassed on purpose). The alert relay hangs off that same call,
   // so ONLY an imported notify can ring this device, and never through the
@@ -1545,6 +1740,13 @@ function createServer(opts = {}) {
       if (!bridgeReadonly()) for (const ask of asks) askAlertRegistry.adopt(ownerId, ask, ask.ownerAskTs === undefined ? ask.ts : ask.ownerAskTs);
     },
     isAskDismissed: (ownerId, ask) => asksStore.isImportedDismissed(ownerId, ask),
+    // A notice this node cleared locally but could not hand to the owner (queued
+    // as pending, or blocked for good) must not return to the view: the record in
+    // the queue is the node's intent, and it is what survives a restart. The
+    // read is the same one the operator's answer is built from.
+    isNoticeDismissed: (ownerId, eventId) => {
+      try { return noticeDismissalQueue.get(ownerId, eventId) !== null; } catch (_) { return false; }
+    },
     onAskClosed: (ownerId, ownerAskId, outcome, ownerAskTs) => asksStore.closeImported({ ownerId, ownerAskId, outcome, ownerAskTs }),
     loadStore: () => nodesStore.loadStore(nodesPath),
     token: () => tokenHolder.value,
@@ -1691,6 +1893,23 @@ function createServer(opts = {}) {
     }),
     getGroup: (name) => audioGroups.getGroup(audioCfg, name, audioHome),
   }));
+  // One store and one bridge serve the cell directory (the Live entry and the
+  // verified label), the live-host routes and the federation forwarder. The
+  // registry of Live threads is persisted next to the designation so a restart
+  // does not make a living Live look absent.
+  const liveHostStore = createLiveHostStore({ filePath: liveHostPath(cfg) });
+  const liveRegistry = createLiveThreadRegistry({ filePath: liveThreadsPath(cfg) });
+  const liveBridge = createLiveBridge({
+    cfg,
+    fleetP,
+    tokenGet: () => tokenHolder.value,
+    filesRoot: cfg.filesRoot,
+    log: opts.log || console.log,
+    registry: liveRegistry,
+  });
+  // Startup reconciliation never blocks the server and never throws: it only
+  // drops entries the daemon definitely reports as gone.
+  Promise.resolve().then(() => liveBridge.reconcile()).catch(() => {});
   api.use('/cells', cellsRoutes({
     fleetP,
     diagnostics,
@@ -1700,6 +1919,10 @@ function createServer(opts = {}) {
       engine: meta && meta.engine,
     })),
     readonly: proxyReadonly,
+    liveEntry: ({ instanceId: id, now: clock }) => buildLiveEntry({
+      store: liveHostStore, bridge: liveBridge, fleetP, instanceId: id, now: clock,
+    }),
+    liveAttest: createLiveAttestation({ registry: liveRegistry, bridge: liveBridge }),
   }));
   // Live host cell: one hostCell per node with CAS. The store
   // lives next to the token (same isolated dir in tests); the proxy refuses
@@ -1707,22 +1930,15 @@ function createServer(opts = {}) {
   // behind a per-peer permission denied by default (liveHostAccess).
   // Fetta 3: il ponte risolve il puntamento all'avvio di una Live (POST /bridge
   // nello stesso gruppo, stessa auth, stesso local-only). Isolabile da cfg
-  // (rev5): spento non crea connessioni e la Live resta standard.
+  // Spento non crea connessioni e la Live resta standard.
   // One store instance serves both sides of a remote designation: the routes
   // (owner side) and the forwarder that records the pointer to a peer (client
   // side). Two instances over the same file would work, one is honest.
-  const liveHostStore = createLiveHostStore({ filePath: liveHostPath(cfg) });
   api.use('/live-host', liveHostRoutes({
     fleetP,
     store: liveHostStore,
     readonly: proxyReadonly,
-    bridge: createLiveBridge({
-      cfg,
-      fleetP,
-      tokenGet: () => tokenHolder.value,
-      filesRoot: cfg.filesRoot,
-      log: opts.log || console.log,
-    }),
+    bridge: liveBridge,
     // Client side: read the owner's state and forward the bridge resolution to
     // the node the designation points at. Owner side: accept a forwarded
     // resolution behind the same per-peer gate and the same rate limiting as
@@ -1777,6 +1993,7 @@ function createServer(opts = {}) {
       // Store-root revision of the peer access policy: the CAS value the UI
       // must send back with every preset write (stale revision -> 409).
       importedDismissalDrainer.nudge();
+      noticeDismissalDrainer.nudge();
       res.json({ nodeId: view.nodeId, nodes, accessRevision: nodesStore.accessRevisionOf(st) });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
@@ -1908,14 +2125,14 @@ function createServer(opts = {}) {
     diagnostics.record('info', 'server', 'SERVER_STARTED', 'NexusCrew server started', {
       port: runtimePort(), platform: cfg.platform || process.platform,
     });
-    updater.start(); startManagedTunnels(); importedDismissalDrainer.start();
+    updater.start(); startManagedTunnels(); importedDismissalDrainer.start(); noticeDismissalDrainer.start();
   });
   server.on('close', () => {
     diagnostics.record('info', 'server', 'SERVER_STOPPED', 'NexusCrew server stopped', { reason: 'close' });
     watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); ptyGrace.close();
     // Nessun timer di ritentativo sopravvive alla chiusura del server.
     if (closureRetry) { try { closureRetry.stop(); } catch (_) {} }
-    importedDismissalDrainer.stop(); eventFeedClient.stop();
+    importedDismissalDrainer.stop(); noticeDismissalDrainer.stop(); eventFeedClient.stop();
     for (const timer of reverseWatchers.values()) clearInterval(timer);
     reverseWatchers.clear(); rotatableReverse.clear(); void reverseSlotListeners?.closeAll();
     // Il pannello non sopravvive al control plane: senza requireToken sopra,

package/lib/tmux/actions.js

@@ -161,7 +161,7 @@ async function submitToSession(tmuxBin, session, text, opts = {}) {
     // then the pane is revalidated before the separate Enter. Other clients
     // still receive a short separation between paste and submit.
     //
-    // NC-Q: L'ATTESA SCALA COL PAYLOAD, e prima era una costante. Il tempo che
+    // L'ATTESA SCALA COL PAYLOAD, e prima era una costante. Il tempo che
     // un TUI impiega a ingerire un bracketed paste cresce con la lunghezza —
     // Claude Code sopra una certa taglia lo COLLASSA («paste again to expand»)
     // — mentre l'attesa era fissa. Oltre quella soglia l'Enter arriva mentre il

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.63",
-  "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
+  "version": "0.9.65",
+  "description": "Faithful browser tmux client \u2014 attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
     "nexuscrew": "bin/nexuscrew.js"