@mmmbuto/nexuscrew 0.9.64 → 0.9.66

package/lib/server.js

@@ -58,6 +58,7 @@ const { createCellScopeGuard } = require('./cells/scope-guard.js');
 const { createCellScope } = require('./cells/scope.js');
 const { cellIdFromTmuxSession } = require('./fleet/definitions.js');
 const { createOwnerAskScope } = require('./notify/owner-ask-scope.js');
+const askCell = require('./notify/ask-cell.js');
 // Budget a tre finestre, riusato dalle notifiche federate: e' gia' scritto per
 // limitare il danno di un nodo che mente sulla propria cella (il tetto per
 // target si calcola sul NODO, che la catena visited verifica).
@@ -91,7 +92,11 @@ const { createEventFeedClient } = require('./notify/event-feed-client.js');
 const { createAskReceipts } = require('./notify/ask-receipts.js');
 const { createAskAnswerService } = require('./notify/ask-answer-service.js');
 const { createEventFeedAsksRoutes } = require('./notify/event-feed-asks-routes.js');
+const { createEventFeedNoticesRoutes } = require('./notify/event-feed-notices-routes.js');
+const { createNoticeDismissals } = require('./notify/notice-dismissals.js');
 const { createAskRelay } = require('./notify/ask-relay.js');
+const { createNoticeRelay } = require('./notify/notice-relay.js');
+const { createNoticeDismissalQueue, createNoticeDismissalDrainer } = require('./notify/notice-dismissal-queue.js');
 const { createImportedDismissalDrainer } = require('./notify/imported-dismissals.js');
 const { createAskSlotVerifier } = require('./nodes/ask-slot-verifier.js');
 const { readFederationEventsEnabled } = require('./config.js');
@@ -221,6 +226,12 @@ function createServer(opts = {}) {
   const feedHistory = createEventFeedHistory({
     filePath: path.join(notifyDir, 'event-feed-history.json'),
   });
+  // Notices the OWNER cleared: ids and timestamps only, expiring with the
+  // history they filter. This is what makes a cleanup true on every device —
+  // the owner's snapshot stops carrying the entry, so a reload cannot revive it.
+  const noticeDismissals = createNoticeDismissals({
+    filePath: path.join(notifyDir, 'notice-dismissals.json'),
+  });
   // Kill switch: strict boolean, read FRESH on every use so flipping it in
   // config.json acts on live streams without a restart.
   const eventsEnabled = () => readFederationEventsEnabled({ configJsonPath: cfg.configPath, federationEventsEnabled: cfg.federationEventsEnabled });
@@ -1340,6 +1351,33 @@ function createServer(opts = {}) {
     cellForSession: ownerAskScope.cellForSession,
     readonly: proxyReadonly,
   }));
+  // Owner-side notice dismissals: the same action gate and the same chain as
+  // the ask write-back, with its own rate instance. Mounted beside the asks,
+  // before the feed router, because it is a write-back path of the feed.
+  api.use('/event-feed/notices', createEventFeedNoticesRoutes({
+    nodesPath,
+    localNodeId: federatedNodeId,
+    originResolver: createOriginResolver({
+      localNodeId: federatedNodeId,
+      hopSecret: () => hopSecret,
+    }),
+    eventsEnabled,
+    history: feedHistory,
+    dismissals: noticeDismissals,
+    // The closure inherits scope and cell of the original notice, so it is
+    // delivered to exactly the peers that could see it. It enters the history
+    // too: a peer that missed the live frame recovers it from the snapshot,
+    // where toRemoteNotice drops it by type.
+    closeNotice: ({ scope, cellId, eventId }) => {
+      recordAndPublish({
+        producer: scope === 'node' ? 'notify-closed-node' : 'notify-closed',
+        cellId: scope === 'node' ? null : cellId,
+        payload: { eventId, ts: Date.now() },
+      });
+    },
+    readonly: proxyReadonly,
+    log: opts.log || console.log,
+  }));
   api.use('/event-feed', createEventFeedRoutes({
     nodesPath,
     localNodeId: federatedNodeId,
@@ -1349,6 +1387,7 @@ function createServer(opts = {}) {
     }),
     eventFeed,
     history: feedHistory,
+    noticeDismissals,
     asksStore,
     fleetP,
     cellForSession: ownerAskScope.cellForSession,
@@ -1377,6 +1416,60 @@ function createServer(opts = {}) {
   // Il body va parsato QUI: il router `api` non monta un parser globale, ogni
   // rotta porta il suo (`express.json`) — vedi /sessions, /notify, /asks.
   // Senza, `req.body` e' undefined, il relay legge un body vuoto e risponde
+  // Notice dismissals, client half: the relay that carries a dismissal to the
+  // owner, the durable queue of the intents that could not be delivered yet, and
+  // the drainer that retries them. Same channel as the ask answers (one
+  // implementation of the chain), same binding as the imported dismissals: a
+  // refusal stays blocked until the pairing to that owner changes.
+  const noticeRelay = createNoticeRelay({
+    nodesPath, slotVerifier: askReverseVerifier,
+    loadStore: () => nodesStore.loadStore(nodesPath),
+    peers: federatedPeers,
+    localPort: () => (server && server.address() ? server.address().port : cfg.port),
+    localToken: () => tokenHolder.value,
+    log: opts.log || console.log,
+  });
+  const noticeDismissalQueue = createNoticeDismissalQueue({
+    filePath: path.join(notifyDir, 'notice-dismissal-queue.json'),
+  });
+  // Durability signal for the operator's answer: the queue honours the intent
+  // in memory when the disk refuses the write (that policy stands), but a
+  // record that will not survive a restart is NOT the normal durable success,
+  // so queued answers declare it instead of looking healthy. Empty = healthy.
+  const queueDurability = () => {
+    try {
+      const st = noticeDismissalQueue.status();
+      return st && st.degraded ? { durable: false, degraded: st.degraded } : {};
+    } catch (_) { return {}; }
+  };
+  // One durable record per cleared notice. A refused write keeps the in-memory
+  // truth (the intent was honoured here anyway) and only loses durability; a
+  // refused enqueue means the intent was NOT recorded, so nothing is left behind.
+  function enqueueNoticeDismissals(ownerId, eventIds, syncState) {
+    const added = [];
+    for (const eventId of eventIds) {
+      const queued = noticeDismissalQueue.enqueue({ ownerId, eventId });
+      if (!queued.ok) {
+        for (const done of added) noticeDismissalQueue.confirm(ownerId, done);
+        return false;
+      }
+      added.push(eventId);
+    }
+    if (syncState === 'blocked') {
+      for (const eventId of eventIds) noticeDismissalQueue.update(ownerId, eventId, { syncState: 'blocked', lastReason: 'unsupported' });
+    }
+    return true;
+  }
+  const noticeDismissalDrainer = createNoticeDismissalDrainer({
+    queue: noticeDismissalQueue, relay: noticeRelay,
+    readonly: proxyReadonly, bindingForOwner: dismissalBinding,
+    // Same seam as the feed client's poll: a test (or an installation with its
+    // own rhythm) can shorten the retry interval without touching the policy.
+    ...(Number.isInteger(cfg.noticeDismissalDrainMs) && cfg.noticeDismissalDrainMs > 0
+      ? { intervalMs: cfg.noticeDismissalDrainMs } : {}),
+    log: opts.log || console.log,
+  });
+
   // 400 «ownerId, askId e text richiesti» a OGNI richiesta: la risposta
   // federata non ha mai potuto attraversare, e nessun test copriva questa
   // rotta. Difetto preesistente, trovato scrivendo il test del ritorno federato.
@@ -1427,15 +1520,32 @@ function createServer(opts = {}) {
     // Guards and alias mutation belong only to the selected generation.
     const alias = storedAlias && ask && asksStore.sameImportedGeneration(storedAlias, ask) ? storedAlias : null;
     const grants = peer && accessPresets.grantsOf(peer);
-    const cellId = ask ? cellIdFromTmuxSession(ask.session) : previous && previous.cellId;
-    const visible = !!((ask || previous) && cellId && grants && grants.configured && grants.grants.eventsAccess === true
+    // The cell comes from what the OWNER resolved (feed or attested origin) and,
+    // only for canonical names, from the session; see lib/notify/ask-cell.js. A
+    // body field is never consulted: the dismissal request carries no cell.
+    // The selected ask keeps its OWN cell. The other source (alias <-> feed card)
+    // lends its cell only when it is bound to the same generation by an explicit,
+    // equal owner timestamp and the same content: a generation that is unknown
+    // on either side is not "the same" for a cell (sameImportedGeneration stays
+    // permissive about it, because guards and alias mutation want that). If both
+    // sources are authenticated and disagree there is no cell at all.
+    const boundToSelected = item => item === ask || (tsOf(item) !== null && tsOf(item) === tsOf(ask)
+      && asksStore.askFingerprint(item) === asksStore.askFingerprint(ask));
+    const sameAsk = ask && [storedAlias, feedAsk].filter(item => item && boundToSelected(item));
+    const cellId = ask ? askCell.resolveAskCellFrom(sameAsk).cellId : previous && previous.cellId;
+    const grantsAllowFeed = !!(grants && grants.configured && grants.grants.eventsAccess === true);
+    const visible = !!((ask || previous) && cellId && grantsAllowFeed
       && eventFeedAcl.visibilityAllows(grants.grants, cellId));
+    // The ask is known and this node may read the owner's feed, but no
+    // authenticated source tells which cell it belongs to (a card persisted by an
+    // older release, an owner that does not publish the cell): said, not guessed.
+    const cellUnresolved = !!(ask && !cellId && grantsAllowFeed);
     const blocked = !!((ask && ask.answered) || (alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
       || askRelay.state().some(attempt => attempt.ownerId === ownerId && attempt.askId === askId && ['sent', 'uncertain'].includes(attempt.state)));
     const slot = peer && peer.reversePool && peer.reversePool.slots && peer.reversePool.slots[peer.reversePool.activeSlot];
     const unavailable = !!(peer && peer.direction === 'inbound' && (!peer.shared || !slot || !Number.isInteger(slot.port)))
       || askRelay.channelState(ownerId).unavailable;
-    return { peer, alias, previous, ask, grants, cellId, visible, blocked: blocked || ambiguous, unavailable, ambiguous };
+    return { peer, alias, previous, ask, grants, cellId, visible, cellUnresolved, blocked: blocked || ambiguous, unavailable, ambiguous };
   }
   api.post('/asks-relay', express.json({ limit: '8kb' }), async (req, res) => {
     try {
@@ -1449,8 +1559,13 @@ function createServer(opts = {}) {
         }
         try { if (!asksStore.health().readable) return res.status(503).json({ error: 'dismissal store unavailable' }); }
         catch (_) { return res.status(503).json({ error: 'dismissal store unavailable' }); }
-        const { peer, alias, previous, ask, grants, cellId, visible, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
-        if (!visible) return res.status(404).json({ error: 'unknown or invisible ask' });
+        const { peer, alias, previous, ask, grants, cellId, visible, cellUnresolved, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
+        if (!visible) {
+          if (cellUnresolved) {
+            return res.status(409).json({ error: 'the cell of this ask is not known from an authenticated owner source; refresh the owner view', reason: 'cell-unresolved' });
+          }
+          return res.status(404).json({ error: 'unknown or invisible ask' });
+        }
         if (ambiguous) return res.status(409).json({ error: 'ask generation is ambiguous; refresh the owner view', reason: 'generation-ambiguous' });
         if (ask && ask.answered) return res.status(409).json({ error: 'ask already answered', reason: 'answered' });
         if ((alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
@@ -1520,6 +1635,106 @@ function createServer(opts = {}) {
     try { res.json({ attempts: askRelay.state() }); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
+  // Operator surface for the notice dismissals. LOCAL and authenticated, never in
+  // the federation allowlist: the remote surface is the owner's (the routes under
+  // /event-feed/notices). The intent is honoured HERE first — the card leaves this
+  // node's view — and the owner's copy is either delivered or queued, with the
+  // answer saying which.
+  api.post('/notices-relay', express.json({ limit: '8kb' }), async (req, res) => {
+    try {
+      const b = req.body || {};
+      if (proxyReadonly()) return res.status(403).json({ error: 'READONLY: mutation blocked' });
+      if (req.headers[HOP_HEADER]) return res.status(403).json({ error: 'local operator required' });
+      if (!b || Array.isArray(b) || typeof b.action !== 'string') return res.status(400).json({ error: 'invalid notices body' });
+      if (b.action === 'dismiss') {
+        if (Object.keys(b).some((key) => !['action', 'ownerId', 'eventId'].includes(key))
+          || !/^[a-f0-9]{32}$/.test(String(b.ownerId || ''))
+          || !/^[0-9a-f-]{36}$/.test(String(b.eventId || ''))
+          || b.ownerId === federatedNodeId()) {
+          return res.status(400).json({ error: 'invalid local dismissal body' });
+        }
+        const out = await noticeRelay.relayNoticeDismiss({ ownerId: b.ownerId, eventId: b.eventId });
+        if (out.ok) {
+          if (typeof eventFeedClient.dismissNoticeConfirmed === 'function') eventFeedClient.dismissNoticeConfirmed(b.ownerId, b.eventId);
+          return res.json({ dismissed: true, ...(out.idempotent ? { idempotent: true } : {}), ...(out.gone ? { gone: true } : {}) });
+        }
+        // The owner is not reachable NOW (or has no such surface at all): the
+        // local intent stands, and the queue carries the rest. A reachable owner
+        // that REFUSES is never queued — its answer is the decision.
+        if (out.transient === true || out.reason === 'unsupported') {
+          const queued = noticeDismissalQueue.enqueue({ ownerId: b.ownerId, eventId: b.eventId });
+          if (!queued.ok) return res.status(503).json({ error: 'dismissal queue unavailable', reason: queued.reason });
+          if (out.reason === 'unsupported') noticeDismissalQueue.update(b.ownerId, b.eventId, { syncState: 'blocked', lastReason: 'unsupported' });
+          if (typeof eventFeedClient.dismissNoticeConfirmed === 'function') eventFeedClient.dismissNoticeConfirmed(b.ownerId, b.eventId);
+          res.json({ dismissed: true, scope: 'local', ownerSync: out.reason === 'unsupported' ? 'blocked' : 'pending', ...queueDurability() });
+          noticeDismissalDrainer.nudge();
+          return;
+        }
+        return res.status(out.code || 500).json({ error: out.error || 'unknown', reason: out.reason });
+      }
+      if (b.action === 'dismiss-all') {
+        if (Object.keys(b).some((key) => !['action', 'owners'].includes(key))
+          || !Array.isArray(b.owners) || b.owners.length === 0 || b.owners.length > 100
+          || b.owners.some((owner) => !/^[a-f0-9]{32}$/.test(String(owner || '')) || owner === federatedNodeId())) {
+          return res.status(400).json({ error: 'invalid dismiss-all body' });
+        }
+        const results = {};
+        for (const ownerId of [...new Set(b.owners)]) {
+          // What this node is SHOWING for that owner: the whole visible set is
+          // what the operator asked to clear, and it is the set whose local
+          // intent has to outlive a reload or a restart of this node.
+          const view = (eventFeedClient.state().views || []).find((v) => v.ownerId === ownerId);
+          const affected = ((view && view.notifications) || [])
+            .map((n) => n && n.eventId).filter((eventId) => typeof eventId === 'string' && eventId !== '');
+          const out = await noticeRelay.relayNoticeDismissAll({ ownerId });
+          if (out.ok) {
+            // The owner took it: its own store stops serving these notices, so
+            // the view forgets them here as well, exactly like the single route.
+            for (const eventId of affected) eventFeedClient.dismissNoticeConfirmed(ownerId, eventId);
+            results[ownerId] = { ok: true, dismissed: out.dismissed || 0 };
+            continue;
+          }
+          // The owner is not reachable NOW (`pending`) or has no notices surface
+          // at all (`blocked`): the local intent stands, durably — one queue
+          // record per cleared notice is what keeps them out of the view on the
+          // next snapshot — and the owner's copy is carried later, or never.
+          const localSync = out.reason === 'unsupported' ? 'blocked' : (out.transient === true ? 'pending' : null);
+          if (localSync === null) { results[ownerId] = { failed: out.reason || 'refused' }; continue; }
+          if (!enqueueNoticeDismissals(ownerId, affected, localSync)) {
+            results[ownerId] = { failed: 'queue-unavailable' };
+            continue;
+          }
+          for (const eventId of affected) eventFeedClient.dismissNoticeConfirmed(ownerId, eventId);
+          // Queued answers depend on the durable write: a queue that cannot
+          // persist says so per owner, instead of looking like the healthy
+          // pending/blocked that survives a restart.
+          results[ownerId] = localSync === 'blocked'
+            ? { blocked: 'unsupported', ...queueDurability() }
+            : { pending: affected.length, ...queueDurability() };
+          if (localSync === 'pending') noticeDismissalDrainer.nudge();
+        }
+        return res.json({ results });
+      }
+      return res.status(400).json({ error: 'azione non riconosciuta' });
+    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
+  });
+  api.get('/notices-relay/capability', (req, res) => {
+    const ownerId = typeof req.query.ownerId === 'string' ? req.query.ownerId : '';
+    if (!/^[a-f0-9]{32}$/.test(ownerId)) return res.status(400).json({ error: 'ownerId richiesto' });
+    let canDismiss = false;
+    try {
+      const st = nodesStore.loadStore(nodesPath);
+      const peer = st && (st.nodes || []).find((node) => node && node.nodeId === ownerId);
+      const slot = peer && peer.reversePool && Array.isArray(peer.reversePool.slots)
+        ? peer.reversePool.slots[peer.reversePool.activeSlot] : null;
+      canDismiss = !proxyReadonly() && !req.headers[HOP_HEADER] && !!peer && (
+        (peer.direction === 'outbound' && !!peer.token && !!peer.localPort)
+        || (peer.direction === 'inbound' && peer.shared === true && peer.askReplyAccess === true
+          && peer.eventsAccess === true && peer.cellVisibility !== 'none'
+          && !!slot && Number.isInteger(slot.port)));
+    } catch (_) { canDismiss = false; }
+    res.json({ ownerId, canDismiss });
+  });
   // The client re-emits imported events into the local hub (deliverOnly: the
   // notifier is bypassed on purpose). The alert relay hangs off that same call,
   // so ONLY an imported notify can ring this device, and never through the
@@ -1548,6 +1763,13 @@ function createServer(opts = {}) {
       if (!bridgeReadonly()) for (const ask of asks) askAlertRegistry.adopt(ownerId, ask, ask.ownerAskTs === undefined ? ask.ts : ask.ownerAskTs);
     },
     isAskDismissed: (ownerId, ask) => asksStore.isImportedDismissed(ownerId, ask),
+    // A notice this node cleared locally but could not hand to the owner (queued
+    // as pending, or blocked for good) must not return to the view: the record in
+    // the queue is the node's intent, and it is what survives a restart. The
+    // read is the same one the operator's answer is built from.
+    isNoticeDismissed: (ownerId, eventId) => {
+      try { return noticeDismissalQueue.get(ownerId, eventId) !== null; } catch (_) { return false; }
+    },
     onAskClosed: (ownerId, ownerAskId, outcome, ownerAskTs) => asksStore.closeImported({ ownerId, ownerAskId, outcome, ownerAskTs }),
     loadStore: () => nodesStore.loadStore(nodesPath),
     token: () => tokenHolder.value,
@@ -1794,6 +2016,7 @@ function createServer(opts = {}) {
       // Store-root revision of the peer access policy: the CAS value the UI
       // must send back with every preset write (stale revision -> 409).
       importedDismissalDrainer.nudge();
+      noticeDismissalDrainer.nudge();
       res.json({ nodeId: view.nodeId, nodes, accessRevision: nodesStore.accessRevisionOf(st) });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
@@ -1925,14 +2148,14 @@ function createServer(opts = {}) {
     diagnostics.record('info', 'server', 'SERVER_STARTED', 'NexusCrew server started', {
       port: runtimePort(), platform: cfg.platform || process.platform,
     });
-    updater.start(); startManagedTunnels(); importedDismissalDrainer.start();
+    updater.start(); startManagedTunnels(); importedDismissalDrainer.start(); noticeDismissalDrainer.start();
   });
   server.on('close', () => {
     diagnostics.record('info', 'server', 'SERVER_STOPPED', 'NexusCrew server stopped', { reason: 'close' });
     watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); ptyGrace.close();
     // Nessun timer di ritentativo sopravvive alla chiusura del server.
     if (closureRetry) { try { closureRetry.stop(); } catch (_) {} }
-    importedDismissalDrainer.stop(); eventFeedClient.stop();
+    importedDismissalDrainer.stop(); noticeDismissalDrainer.stop(); eventFeedClient.stop();
     for (const timer of reverseWatchers.values()) clearInterval(timer);
     reverseWatchers.clear(); rotatableReverse.clear(); void reverseSlotListeners?.closeAll();
     // Il pannello non sopravvive al control plane: senza requireToken sopra,

package/lib/settings/routes.js

@@ -710,6 +710,12 @@ function settingsRoutes(deps = {}) {
     if (!node) return send(res, 404, { error: `nodo sconosciuto "${name}"` });
     if (node.direction !== 'outbound') return send(res, 409, { error: 'Share si attiva sul dispositivo che possiede la connessione SSH' });
     if (!node.token || !node.nodeId) return send(res, 409, { error: 'nodo non associato: ripeti il pairing' });
+    // A host-only peer (publish-remote) is published ONE WAY to our own admin
+    // nodes; Share would publish THIS node on it. Refuse before any SSH restart
+    // or reverse negotiation is attempted (turning Share off stays possible).
+    if (node.publishRemote === true && body.shared) {
+      return send(res, 409, { error: 'publish-remote attivo su questo peer: Share resta spento (spegni prima publish-remote)', reason: 'publish-remote-active' });
+    }
     if (body.shared && !nodesStore.isPort(node.reversePort)) {
       return send(res, 409, { error: 'canale share non negoziato: ripeti il pairing' });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.64",
+  "version": "0.9.66",
   "description": "Faithful browser tmux client \u2014 attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {