@mmmbuto/nexuscrew 0.9.65 → 0.9.66

package/frontend/dist/index.html

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-DkYRC1vV.js"></script>
+  <script type="module" crossorigin src="/assets/index-DhZOap1-.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-Dwd37Z_R.css">
 </head>
 <body>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.65"}
+{"version":"0.9.66"}

package/lib/cli/commands.js

@@ -85,6 +85,8 @@ Usage:
   nexuscrew nodes cells <name|nodeId> all|none|Cella1,Cella2
                          [--selected NODE_ID,...]
   nexuscrew nodes share <name|nodeId> on|off [--json]
+  nexuscrew nodes publish-remote <name|nodeId> on --audience <instanceId,...> [--json]
+  nexuscrew nodes publish-remote <name|nodeId> off|status [--json]
   nexuscrew nodes panel <name|nodeId> on|off
   nexuscrew nodes live-host <name|nodeId> on|off
   nexuscrew nodes edit <name|nodeId> --access-role admin|user|nexushost
@@ -118,6 +120,7 @@ const CLI_VALUE_FLAGS = new Set([
   'name', 'local-name', 'local-label', 'identity-file', 'port', 'dir', 'events-receive',
   'access-role', 'access-revision',
   'events-access', 'node-events-access', 'ask-reply-access', 'files-read-access', 'peer-operator-access',
+  'audience',
 ]);
 
 // valueFlags (Set|array opzionale): flag che consumano il token successivo nella
@@ -1367,6 +1370,34 @@ async function dispatchNodes(rest, flags, opts = {}) {
       return { code: 0 };
     } catch (error) { log(`nodes share: ${error.message}`); return { code: 1 }; }
   }
+  // Host-only publication of a remote peer, one way, to an explicit audience of
+  // our own admin nodes. NOT Share: it never calls the share path.
+  if (sub === 'publish-remote') {
+    const arg = rest[3];
+    if (arg !== undefined && arg !== 'on' && arg !== 'off' && arg !== 'status') {
+      log('nodes publish-remote: uso `nodes publish-remote <nodo> on --audience <id,id>|off|status`');
+      return { code: 1 };
+    }
+    if (arg === 'on') {
+      if (typeof flags.audience !== 'string' || !flags.audience.trim()) {
+        log('nodes publish-remote: `on` richiede --audience <instanceId,instanceId,...> (gli id dei nodi admin che vedranno il peer)');
+        return { code: 1 };
+      }
+    } else if (flags.audience !== undefined) {
+      log('nodes publish-remote: --audience si usa solo con `on`');
+      return { code: 1 };
+    }
+    const audience = arg === 'on' ? String(flags.audience).split(',').map((x) => x.trim()).filter(Boolean) : undefined;
+    const expectedRevision = flags['access-revision'] === undefined ? undefined : Number(flags['access-revision']);
+    if (expectedRevision !== undefined && !Number.isInteger(expectedRevision)) {
+      log('nodes publish-remote: --access-revision vuole un intero (la revision letta da `nodes access`)');
+      return { code: 1 };
+    }
+    return { code: nodesCmds.nodesPublishRemote({
+      ...opts, log, ref, json: flags.json === true, audience, expectedRevision,
+      enabled: arg === 'on' ? true : (arg === 'off' ? false : undefined),
+    }).code };
+  }
   if (sub === 'invite') {
     const body = {
       ...(flags.ssh !== undefined ? { ssh: flags.ssh } : {}),

package/lib/nodes/access-presets.js

@@ -225,15 +225,34 @@ function grantsOf(peer) {
 }
 
 
-// Read view of ONE peer for listing endpoints and the settings UI: the
-// derived label, the configured marker and the EFFECTIVE grant vector. The
-// vector is flat and always complete (denied for records that are not
-// configured), so a caller never has to guess defaults and no token or
-// secret is ever included: grants are decisions, not credentials.
+// The vector the resource gate APPLIES to a record: the stored booleans and the
+// cell scope, read exactly the way resource-acl.allowedByClass reads them — no
+// `accessConfigured` marker, no coherence check. This is what a VIEW must show.
+// `grantsOf` is different on purpose: it answers "was this vector set
+// deliberately?" and feeds decisions that demand a configured record (the event
+// stream, the ASK target check); it must keep denying for a legacy record.
+// An absent scope is `all`: that is what the parser stores and what the gate
+// sees (it only closes the cell-scoped classes on an explicit `none`).
+function effectiveGrants(peer) {
+  const p = isPlainObject(peer) ? peer : {};
+  const grants = { cellVisibility: CELL_VISIBILITY.includes(p.cellVisibility) ? p.cellVisibility : 'all' };
+  if (grants.cellVisibility === 'selected') grants.cells = Array.isArray(p.cells) ? [...p.cells] : [];
+  for (const key of BOOLEAN_GRANTS) grants[key] = p[key] === true;
+  return grants;
+}
+
+// Read view of ONE peer for listing endpoints and the settings UI: the derived
+// label and the configured marker (PROVENANCE: how the vector was set) and the
+// EFFECTIVE grant vector (what the gate applies, see effectiveGrants). The
+// vector is flat and always complete, so a caller never has to guess defaults,
+// and no token or secret is ever included: grants are decisions, not
+// credentials. A legacy record with a grant and no marker reads "unconfigured"
+// AND shows the grant on, because both are true.
 function accessView(peer) {
   const view = grantsOf(peer);
-  const access = { cellVisibility: view.grants.cellVisibility };
-  for (const key of BOOLEAN_GRANTS) access[key] = view.grants[key] === true;
+  const effective = effectiveGrants(peer);
+  const access = { cellVisibility: effective.cellVisibility };
+  for (const key of BOOLEAN_GRANTS) access[key] = effective[key];
   return { accessLabel: view.label, accessConfigured: view.configured, access };
 }
 
@@ -252,6 +271,7 @@ module.exports = {
   accessView,
   applyPreset,
   deriveLabel,
+  effectiveGrants,
   grantsOf,
   isCompleteAdminVector,
   isConfigured,

package/lib/nodes/commands.js

@@ -336,9 +336,22 @@ function nodesInspect(opts) {
     // inferred from defaults.
     if (peer.kind === 'direct') {
       const view = accessPresets.grantsOf(peer);
+      // The label says how the vector was set; the vector is what the resource
+      // gate applies, so it is shown as stored even for a legacy record.
+      const effective = accessPresets.effectiveGrants(peer);
       log(`accesso:   ${view.label}`);
-      log(`grant:     ${ACCESS_GRANT_KEYS.map((key) => `${key}=${view.grants[key] ? 'on' : 'off'}`).join(' ')}`);
-      log(`scope:     celle ${view.grants.cellVisibility}`);
+      log(`grant:     ${ACCESS_VIEW_KEYS.map((key) => `${key}=${effective[key] ? 'on' : 'off'}`).join(' ')}`);
+      log(`scope:     celle ${effective.cellVisibility}`);
+      if (!view.configured) {
+        log('nota:      record non configurato: i grant mostrati sono quelli che il gate delle risorse applica; il feed eventi richiede un vettore configurato');
+      }
+      if (peer.publishRemote === true) {
+        const names = (peer.publishRemoteAudience || []).map((id) => {
+          const reader = out.nodes.find((n) => n.nodeId === id);
+          return reader ? `${reader.name} (${id})` : id;
+        });
+        log(`pubblicato: solo-host, audience: ${names.join(', ')}`);
+      }
       for (const line of feedLinesFor(opts.feedDiagnostics, peer.nodeId)) log(line);
     }
     log(`azioni:    ${Object.keys(peer.actions || {}).filter((key) => peer.actions[key]).join(', ')}`);
@@ -351,6 +364,8 @@ function nodesInspect(opts) {
 // validated write. The label (admin/user/nexushost/custom) is derived from the
 // grants; nothing here stores or reads a role.
 const ACCESS_GRANT_KEYS = ['eventsAccess', 'nodeEventsAccess', 'askReplyAccess', 'filesReadAccess', 'peerOperatorAccess'];
+// What the views print: the five grant flags of the edit commands plus the two the panel and live-host classes read.
+const ACCESS_VIEW_KEYS = [...ACCESS_GRANT_KEYS, 'panelAccess', 'liveHostAccess'];
 const ACCESS_EDIT_KEYS = new Set(['accessRole', ...ACCESS_GRANT_KEYS]);
 
 const ACCESS_VECTOR_FIELDS = ['cellVisibility', 'cells', 'panelAccess', 'liveHostAccess'];
@@ -545,6 +560,50 @@ function nodesEdit(opts) {
   return { code: 0, name: node.name, node: edited, restarted: wasUp };
 }
 
+// --- nodes publish-remote ---------------------------------------------------
+// Host-only publication of a REMOTE peer: `nodes publish-remote <peer> on
+// --audience <instanceId,...>` / `off`. Separate from Share on purpose: it
+// never calls the share path, never restarts the tunnel and never touches the
+// reverse pool. It edits the store (one validated, compare-and-set write, after
+// a full backup on `on`); the running server reads the store per request.
+function nodesPublishRemote(opts) {
+  const log = opts.log || console.log;
+  const { nodesPath } = resolveNodePaths(opts);
+  let st;
+  try { st = store.loadStoreStrict(nodesPath); }
+  catch (e) { log(`nodes publish-remote: ${e.message}`); return { code: 1, reason: 'store invalido', status: e.status || 500, errorCode: e.code || null }; }
+  const node = resolveStoredNode(st, opts.ref || opts.name);
+  if (!node) { log(`nodes publish-remote: nodo sconosciuto "${opts.ref || opts.name || ''}"`); return { code: 1, reason: 'unknown-node' }; }
+  if (opts.enabled === undefined) {
+    // Read-only status.
+    const state = node.publishRemote === true
+      ? { name: node.name, enabled: true, audience: [...node.publishRemoteAudience] }
+      : { name: node.name, enabled: false, audience: [] };
+    if (opts.json) log(JSON.stringify(state, null, 2));
+    else log(`nodes publish-remote [${node.name}]: ${state.enabled ? `on · audience ${state.audience.join(', ')}` : 'off'}`);
+    return { code: 0, ...state };
+  }
+  if (isReadonly(opts)) { log('nodes publish-remote: READONLY, mutazione bloccata'); return { code: 1, reason: 'readonly' }; }
+  let res;
+  try {
+    res = store.setPublishRemoteCas({
+      filePath: nodesPath, name: node.name, enabled: opts.enabled === true,
+      audience: opts.audience, expectedRevision: opts.expectedRevision,
+    });
+  } catch (e) { log(`nodes publish-remote: ${e.message}`); return { code: 1, reason: 'refused', error: e.message }; }
+  if (!res.ok) {
+    log(`nodes publish-remote: revision delle concessioni superata (attuale ${res.revision}) — rileggi e riprova`);
+    return { code: 1, reason: 'revision-conflict', revision: res.revision };
+  }
+  if (opts.json) log(JSON.stringify(res, null, 2));
+  else if (res.enabled) {
+    log(`nodes publish-remote [${res.name}]: on · audience ${res.audience.join(', ')}`);
+    log('  grant verso il peer azzerati (celle none, eventi/file/ask/operatore/pannello/live host off, eventsReceive off); store a schema 4');
+    if (res.backup) log(`  backup dello store: ${res.backup.path} (sha256 ${res.backup.sha256})`);
+  } else log(`nodes publish-remote [${res.name}]: off${res.unchanged ? ' (era gia\' spento)' : ' · i grant restano azzerati'}`);
+  return { code: 0, ...res };
+}
+
 // --- nodes access: read-only inventory --------------------------------------
 // Shows what every peer may currently do on this node, with the revision of
 // the policy. Peers whose grants were never configured are listed as such:
@@ -566,7 +625,7 @@ function nodesAccess(opts = {}) {
   if (view.peers.length === 0) log('nessun peer diretto');
   for (const peer of view.peers) {
     log(`${peer.name}${peer.nodeId ? ` (${peer.nodeId})` : ''}: ${peer.label}`);
-    log(`  ${ACCESS_GRANT_KEYS.map((key) => `${key}=${peer.grants[key] ? 'on' : 'off'}`).join(' ')} · celle ${peer.grants.cellVisibility}`);
+    log(`  ${ACCESS_VIEW_KEYS.map((key) => `${key}=${peer.grants[key] ? 'on' : 'off'}`).join(' ')} · celle ${peer.grants.cellVisibility}`);
   }
   if (legacy.length > 0) log(`da configurare esplicitamente (${legacy.length}): ${legacy.map((p) => p.name).join(', ')}`);
   return { code: 0, ...view, unconfigured: legacy.map((p) => p.name) };
@@ -880,7 +939,7 @@ function nodesSetToken(opts) {
 module.exports = {
   fetchFeedDiagnostics, feedLinesFor,
 
-  nodesAccess, ACCESS_GRANT_KEYS,
+  nodesAccess, nodesPublishRemote, ACCESS_GRANT_KEYS,
   nodesAdd, nodesList, nodesInspect, nodesEdit, nodesRemove, nodesTest, nodesTestAll,
   nodesUp, nodesDown, nodesRestart, nodesSetToken,
   // helper esposti per test/riuso

package/lib/nodes/store.js

@@ -20,8 +20,16 @@ const crypto = require('node:crypto');
 const reversePool = require('./reverse-pool.js');
 const identity = require('./identity.js');
 const accessPresets = require('./access-presets.js');
+const { allowedByClass } = require('../proxy/resource-acl.js');
 
 const SCHEMA_VERSION = 3;
+// Schema 4 = schema 3 + the host-only publication fields of a peer
+// (`publishRemote`, `publishRemoteAudience`). It is written ONLY when that
+// mode is first enabled, after a full backup of the store: until then every
+// store stays at the schema it already has, and a 0.9.65 binary keeps reading
+// it. A 0.9.65 binary cannot read a schema 4 store (closed schema): going back
+// means restoring the backup taken at the opt-in, never a silent downgrade.
+const HOST_ONLY_SCHEMA_VERSION = 4;
 const PREVIOUS_SCHEMA_VERSION = 2;
 const LEGACY_SCHEMA_VERSION = 1;
 const MAX_NODES = 64;
@@ -156,6 +164,11 @@ const NODE_KEYS = new Set([
   // coherent "custom" preset instead of "not configured". It is provenance,
   // not a permission — it grants nothing and handlers never read it as a role.
   'accessConfigured',
+  // Host-only publication of a REMOTE peer (schema 4). Not Share: Share
+  // publishes THIS node on the peer's hub through a reverse (-R) channel; this
+  // publishes the peer to an explicit audience of our own admin nodes, over the
+  // existing private -L, one way only (see hostOnlyViolation).
+  'publishRemote', 'publishRemoteAudience',
 ]);
 
 // Nome di cella: stessa forma usata da fleet/definitions.js, cells/routes.js e
@@ -247,6 +260,28 @@ function reversePoolDefault(base, { verification = 'unverifiable', generation =
   };
 }
 
+// Invariants of a host-only peer, on a node with its defaults applied.
+// Returns the first violation as text, or null. This is the single source of
+// truth: parseNode refuses a record that breaks it (so no write path can
+// persist one) and the mutators use it to explain WHY they refuse.
+// The vector is the one the authorization code reads: allowedByClass looks at
+// these exact fields, never at a label.
+function hostOnlyViolation(node) {
+  if (!node || node.publishRemote !== true) return null;
+  if (node.direction !== 'outbound') return 'vale solo per un peer in uscita (outbound)';
+  if (node.shared === true) return 'e\' incompatibile con Share acceso su questo peer';
+  const audience = node.publishRemoteAudience;
+  if (!Array.isArray(audience) || audience.length === 0) return 'l\'audience non puo\' essere vuota';
+  if (node.nodeId && audience.includes(node.nodeId)) return 'l\'audience non puo\' contenere il peer pubblicato';
+  if (node.eventsReceive === true) return 'eventsReceive deve restare spento';
+  if (node.cellVisibility !== 'none' || (Array.isArray(node.cells) && node.cells.length > 0)) {
+    return 'le celle di questo nodo devono restare invisibili al peer (cellVisibility none)';
+  }
+  const open = accessPresets.BOOLEAN_GRANTS.filter((key) => node[key] === true);
+  if (open.length > 0) return `i grant verso il peer devono restare tutti a zero (aperti: ${open.join(', ')})`;
+  return null;
+}
+
 function parseNode(n, schemaVersion = SCHEMA_VERSION) {
   if (!n || typeof n !== 'object' || Array.isArray(n)) return null;
   for (const k of Object.keys(n)) { if (!NODE_KEYS.has(k)) return null; } // schema chiuso
@@ -434,6 +469,28 @@ function parseNode(n, schemaVersion = SCHEMA_VERSION) {
     out.keyConflict = { seen: c.seen, at: c.at, source: c.source };
   }
   if (label) out.label = label;
+  if (n.publishRemote !== undefined || n.publishRemoteAudience !== undefined) {
+    // Only a schema 4 store may carry the fields: a store written at 1-3 with
+    // them is not something this code ever produced.
+    if (schemaVersion < HOST_ONLY_SCHEMA_VERSION) return null;
+    if (n.publishRemote !== undefined && typeof n.publishRemote !== 'boolean') return null;
+    let audience;
+    if (n.publishRemoteAudience !== undefined) {
+      if (!Array.isArray(n.publishRemoteAudience) || n.publishRemoteAudience.length > MAX_NODES) return null;
+      audience = [...new Set(n.publishRemoteAudience)];
+      if (audience.some((id) => typeof id !== 'string' || !NODE_ID_RE.test(id))) return null;
+      audience.sort();
+    }
+    if (n.publishRemote === true) {
+      out.publishRemote = true;
+      out.publishRemoteAudience = audience || [];
+      if (hostOnlyViolation(out) !== null) return null;
+    } else {
+      // Off: no audience may linger (a stale list would read as a grant).
+      if (audience && audience.length > 0) return null;
+      if (n.publishRemote === false) out.publishRemote = false;
+    }
+  }
   return out;
 }
 
@@ -464,8 +521,8 @@ function parseStore(raw) {
       return null;
     }
 
-    if (![SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION].includes(d.schemaVersion)) return null;
-    const rootKeys = d.schemaVersion === SCHEMA_VERSION
+    if (![HOST_ONLY_SCHEMA_VERSION, SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION].includes(d.schemaVersion)) return null;
+    const rootKeys = d.schemaVersion >= SCHEMA_VERSION
       ? new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'reversePoolAnchor', 'reversePoolLedgerInitialized', 'accessRevision', 'adminReceptionMigration'])
       : new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'adminReceptionMigration']);
     if (Object.keys(d).some((key) => !rootKeys.has(key))) return null;
@@ -509,7 +566,7 @@ function parseStore(raw) {
     // advances it to 1. It is kept out of the parsed object when absent so a
     // plain load never rewrites the file with a field nobody set.
     if (d.accessRevision !== undefined) {
-      if (d.schemaVersion !== SCHEMA_VERSION) return null;
+      if (d.schemaVersion < SCHEMA_VERSION) return null;
       if (!Number.isInteger(d.accessRevision) || d.accessRevision < 0) return null;
       out.accessRevision = d.accessRevision;
     }
@@ -519,7 +576,7 @@ function parseStore(raw) {
       if (!rdv) return null;
       out.rendezvous = rdv;
     }
-    if (d.schemaVersion === SCHEMA_VERSION) {
+    if (d.schemaVersion >= SCHEMA_VERSION) {
       // This marker distinguishes a fresh v3 peer (which may have received a
       // pool from another hub) from a hub that has once owned allocations. If
       // the latter loses its anchor, it must not silently start a new ledger.
@@ -665,7 +722,14 @@ function getNode(store, name) {
 }
 
 function mutationSchemaVersion(store) {
-  return store && store.schemaVersion === SCHEMA_VERSION ? SCHEMA_VERSION : PREVIOUS_SCHEMA_VERSION;
+  // A schema 3 or 4 store keeps ITS schema: writing 3 over a 4 store would
+  // silently drop the host-only fields (and parse would refuse the record).
+  return store && store.schemaVersion >= SCHEMA_VERSION ? store.schemaVersion : PREVIOUS_SCHEMA_VERSION;
+}
+
+// The schema a write that needs at least v3 must keep: never lower than the store's own.
+function atLeastV3(store) {
+  return store && store.schemaVersion > SCHEMA_VERSION ? store.schemaVersion : SCHEMA_VERSION;
 }
 
 function addNode(store, entry) {
@@ -706,7 +770,12 @@ function setNodeToken(store, name, token) {
 function updateNode(store, name, patch) {
   const idx = store.nodes.findIndex((n) => n.name === name);
   if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
-  const parsed = parseNode({ ...store.nodes[idx], ...patch }, mutationSchemaVersion(store));
+  const probe = { ...store.nodes[idx], ...patch };
+  // While the host-only mode is on, an edit that would break its invariants is
+  // refused WITH the reason (parseNode alone would only say "invalid").
+  const why = hostOnlyViolation(probe);
+  if (why) throw new Error(`publish-remote attivo su "${name}": ${why}`);
+  const parsed = parseNode(probe, mutationSchemaVersion(store));
   if (!parsed) throw new Error('aggiornamento nodo non valido');
   const nodes = store.nodes.slice();
   nodes[idx] = parsed;
@@ -728,6 +797,9 @@ function setPeerAccessGrants(store, name, grants) {
   if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
   const check = accessPresets.validateGrants(grants);
   if (!check.ok) throw new Error(`concessioni non valide: ${check.errors.join('; ')}`);
+  if (store.nodes[idx].publishRemote === true) {
+    throw new Error(`publish-remote attivo su "${name}": i grant verso questo nodo restano azzerati finche' la modalita' e' accesa (spegnila con \`nodes publish-remote ${name} off\`)`);
+  }
   const next = { ...store.nodes[idx] };
   next.cellVisibility = grants.cellVisibility;
   if (grants.cellVisibility === 'selected') next.cells = [...(grants.cells || [])];
@@ -736,7 +808,7 @@ function setPeerAccessGrants(store, name, grants) {
   next.accessConfigured = true;
   const nodes = store.nodes.slice();
   nodes[idx] = next;
-  const out = { ...store, schemaVersion: SCHEMA_VERSION, nodes };
+  const out = { ...store, schemaVersion: atLeastV3(store), nodes };
   out.accessRevision = accessRevisionOf(store) + 1;
   return out;
 }
@@ -765,9 +837,12 @@ function accessInventory(store) {
       name: peer.name,
       nodeId: peer.nodeId || null,
       direction: peer.direction,
+      // Provenance: was the vector set on purpose? Not what is granted.
       configured: view.configured,
       label: view.label,
-      grants: view.grants,
+      // What the resource gate applies, also for a legacy record (see
+      // accessPresets.effectiveGrants).
+      grants: accessPresets.effectiveGrants(peer),
     };
   });
   return { revision: accessRevisionOf(store), peers };
@@ -814,6 +889,100 @@ function setPeerAccessPresetCas({ filePath, name, presetName, expectedRevision,
     eventsReceive: written.nodes.find((n) => n.name === name).eventsReceive === true };
 }
 
+// --- Host-only publication of a remote peer ---------------------------------
+// `nodes publish-remote <peer> on --audience <ids>|off`. NOT Share: nothing
+// here touches the tunnel, the reverse pool or the peer's SSH session.
+//
+// The audience is an explicit list of instanceIds of OUR direct peers that
+// already hold the operator grant (the same predicate the authorization code
+// uses: allowedByClass('operator', peer)). Unknown ids, ids of peers without
+// that grant and the published peer itself are refused.
+function enablePublishRemote(st, name, audience) {
+  const idx = st.nodes.findIndex((n) => n.name === name);
+  if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
+  const node = st.nodes[idx];
+  if (node.direction !== 'outbound') throw new Error(`"${name}" non e' un peer in uscita: publish-remote vale solo per quelli`);
+  if (!node.token) throw new Error(`"${name}" non e' accoppiato (manca il token): niente da pubblicare`);
+  if (node.shared === true) throw new Error(`Share e' acceso su "${name}": publish-remote e' un'altra cosa, spegni prima Share`);
+  if (node.publishRemote === true) throw new Error(`publish-remote e' gia' acceso su "${name}": spegnilo per cambiare l'audience`);
+  if (!Array.isArray(audience) || audience.length === 0) {
+    throw new Error('audience vuota: indica gli instanceId dei nodi admin che possono vedere il peer (--audience id,id,...)');
+  }
+  const ids = [...new Set(audience)];
+  if (ids.length > MAX_NODES) throw new Error('audience troppo lunga');
+  for (const id of ids) {
+    if (typeof id !== 'string' || !NODE_ID_RE.test(id)) throw new Error(`instanceId non valido nell'audience: "${String(id).slice(0, 40)}"`);
+    if (id === node.nodeId) throw new Error(`l'audience non puo' contenere il peer pubblicato (${name})`);
+    const reader = st.nodes.find((n) => n.nodeId === id);
+    if (!reader) throw new Error(`instanceId sconosciuto nell'audience: ${id} (non e' un peer diretto di questo nodo)`);
+    if (reader.publishRemote === true) throw new Error(`"${reader.name}" e' a sua volta un peer solo-host: non puo' stare nell'audience`);
+    if (!allowedByClass('operator', reader)) {
+      throw new Error(`"${reader.name}" (${id}) non e' un nodo admin: manca peerOperatorAccess`);
+    }
+  }
+  // ONE record, ONE save: the publication and the zeroed vector travel together,
+  // so there is no instant at which the peer is published with open grants.
+  const next = { ...node, cellVisibility: 'none', eventsReceive: false, accessConfigured: true,
+    publishRemote: true, publishRemoteAudience: ids.sort() };
+  delete next.cells;
+  for (const key of accessPresets.BOOLEAN_GRANTS) next[key] = false;
+  const nodes = st.nodes.slice();
+  nodes[idx] = next;
+  const out = parseStore({ ...st, schemaVersion: Math.max(HOST_ONLY_SCHEMA_VERSION, st.schemaVersion), nodes,
+    accessRevision: accessRevisionOf(st) + 1 });
+  if (!out) throw new Error('publish-remote: lo store risultante non e\' valido (schema strict)');
+  return out;
+}
+
+// Off: the publication ends at once; the grants stay at zero (they are NOT
+// restored to whatever they were before: re-opening anything is an explicit act).
+function disablePublishRemote(st, name) {
+  const idx = st.nodes.findIndex((n) => n.name === name);
+  if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
+  const node = st.nodes[idx];
+  if (node.publishRemote !== true) return st;
+  const next = { ...node, publishRemote: false };
+  delete next.publishRemoteAudience;
+  const nodes = st.nodes.slice();
+  nodes[idx] = next;
+  const out = parseStore({ ...st, nodes, accessRevision: accessRevisionOf(st) + 1 });
+  if (!out) throw new Error('publish-remote: lo store risultante non e\' valido (schema strict)');
+  return out;
+}
+
+// Full, protected copy of the store taken right before the opt-in write. It is
+// the rollback path: a 0.9.65 binary cannot read a schema 4 store.
+function backupStoreFile(filePath, now = new Date()) {
+  const st = fs.lstatSync(filePath);
+  if (st.isSymbolicLink() || !st.isFile()) throw new Error('backup rifiutato: nodes.json non e\' un file regolare');
+  const data = fs.readFileSync(filePath);
+  const sha256 = crypto.createHash('sha256').update(data).digest('hex');
+  const stamp = now.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+  const target = `${filePath}.pre-publish-remote-${stamp}-${sha256.slice(0, 8)}.bak`;
+  fs.writeFileSync(target, data, { mode: 0o600, flag: 'wx' });   // wx: never overwrite a previous backup
+  fs.chmodSync(target, 0o600);
+  return { path: target, sha256 };
+}
+
+// Compare-and-set write of the mode, keyed on the same revision as the access
+// grants (turning it on changes them). `on` takes the backup BEFORE writing.
+function setPublishRemoteCas({ filePath, name, enabled, audience, expectedRevision }) {
+  const current = loadStoreStrict(filePath);
+  if (expectedRevision !== undefined && (!Number.isInteger(expectedRevision) || accessRevisionOf(current) !== expectedRevision)) {
+    return { ok: false, conflict: true, revision: accessRevisionOf(current) };
+  }
+  const next = enabled ? enablePublishRemote(current, name, audience) : disablePublishRemote(current, name);
+  if (next === current) return { ok: true, name, enabled: false, unchanged: true, revision: accessRevisionOf(current), schemaVersion: current.schemaVersion };
+  const backup = enabled ? backupStoreFile(filePath) : null;
+  const written = atomicWriteStore(filePath, next);
+  const node = written.nodes.find((n) => n.name === name);
+  return {
+    ok: true, name, enabled: node.publishRemote === true,
+    audience: node.publishRemote === true ? [...node.publishRemoteAudience] : [],
+    revision: accessRevisionOf(written), schemaVersion: written.schemaVersion, backup,
+  };
+}
+
 // One startup migration; later operational reception edits remain authoritative.
 function migrateAdminReception({ filePath, readonly = false }) {
   if (readonly || process.env.NEXUSCREW_READONLY === '1') return { migrated: false };
@@ -828,7 +997,7 @@ function migrateAdminReception({ filePath, readonly = false }) {
       changed += 1;
     }
   }
-  if (changed) next = { ...next, schemaVersion: SCHEMA_VERSION,
+  if (changed) next = { ...next, schemaVersion: atLeastV3(current),
     accessRevision: accessRevisionOf(current) + 1 };
   atomicWriteStore(filePath, { ...next, adminReceptionMigration: 1 });
   return { migrated: true, changed };
@@ -845,7 +1014,7 @@ function upgradeToReversePoolSchema(store, anchor = undefined) {
   if (anchor !== undefined && !parsedAnchor) throw new Error('reverse pool anchor non valida');
   const next = {
     ...current,
-    schemaVersion: SCHEMA_VERSION,
+    schemaVersion: atLeastV3(current),
     ...(parsedAnchor ? { reversePoolLedgerInitialized: true, reversePoolAnchor: parsedAnchor } : {}),
   };
   const parsed = parseStore(next);
@@ -855,7 +1024,7 @@ function upgradeToReversePoolSchema(store, anchor = undefined) {
 
 function setNodeReversePool(store, name, value) {
   const current = store && getNode(store, name);
-  if (!store || store.schemaVersion !== SCHEMA_VERSION || !current) {
+  if (!store || store.schemaVersion < SCHEMA_VERSION || !current) {
     throw new Error('reverse pool richiede schema v3');
   }
   if (current.direction === 'inbound' && !parseReversePoolAnchor(store.reversePoolAnchor)) {
@@ -883,10 +1052,24 @@ function redactNode(n) {
     panelAccess: n.panelAccess === true,
     liveHostAccess: n.liveHostAccess === true,
     visibility: n.visibility || 'network',
+    // The grants this node concedes to the peer. They are decisions, not
+    // credentials, and consumers (the CLI `nodes inspect`, the inventory) derive
+    // the label and the effective vector from THESE fields: leaving them out made
+    // `inspect` read an "unconfigured" peer and print every grant as off.
+    accessConfigured: n.accessConfigured === true,
+    eventsAccess: n.eventsAccess === true,
+    nodeEventsAccess: n.nodeEventsAccess === true,
+    askReplyAccess: n.askReplyAccess === true,
+    filesReadAccess: n.filesReadAccess === true,
+    peerOperatorAccess: n.peerOperatorAccess === true,
     hasToken: !!n.token, // presenza, non il valore
     paired: !!(n.token && n.acceptToken),
   };
   if (n.identityFile || n.keyPath) out.hasIdentity = true;
+  if (n.publishRemote === true) {
+    out.publishRemote = true;
+    out.publishRemoteAudience = [...(n.publishRemoteAudience || [])];
+  }
   if (n.visibility === 'selected') out.selected = [...(n.selected || [])];
   // Lo scope celle non e' un segreto: e' una decisione dell'operatore e va
   // mostrata, come `selected`. La Settings UI deve poterla leggere per dirla.
@@ -1076,6 +1259,8 @@ module.exports = {
   // concessioni federate (preset, CAS, inventario)
   accessRevisionOf, setPeerAccessGrants, setPeerAccessPreset, accessInventory, migrateAdminReception,
   setPeerAccessGrantsCas, setPeerAccessPresetCas,
+  // host-only publication of a remote peer (schema 4, opt-in)
+  hostOnlyViolation, enablePublishRemote, disablePublishRemote, setPublishRemoteCas, backupStoreFile,
   // redazione
   redactNode, redactStore, hasPairedPeers,
   // migrazione
@@ -1083,5 +1268,5 @@ module.exports = {
   // label / slug
   nodeLabel, validLabel, sanitizeLabel, toSlug, deriveNodeHandle, suggestNodeName, LABEL_MAX,
   // costanti
-  SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
+  SCHEMA_VERSION, HOST_ONLY_SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
 };

package/lib/notify/ask-cell.js

@@ -0,0 +1,53 @@
+'use strict';
+// lib/notify/ask-cell.js — which cell an IMPORTED ask belongs to.
+//
+// The owner of an ask is the only node that knows its cell: it resolves the
+// ask's tmux session through its own cell definitions (a cell may declare a
+// custom tmux session, so the name is not always `cloud-<cell>`). Decoding the
+// session name here is therefore only a FALLBACK for the canonical names; for
+// any other name the cell has to come from the owner.
+//
+// Two authenticated sources carry what the owner resolved, and nothing else is
+// trusted:
+//   - `ownerCellId`: set by the event-feed client from the owner's authenticated
+//     snapshot item or live envelope (never copied from a wire field of that name);
+//   - `originCell`: the cell the origin resolver attested for an ask pushed by the
+//     owner (written by the server when the alias is created).
+// Never derived by stripping a prefix from a string, never from the local cell
+// definitions (those describe THIS node, not the owner), never from a request body.
+const { cellIdFromTmuxSession } = require('../fleet/definitions.js');
+
+const CELL_ID_RE = /^[A-Za-z0-9._-]{1,32}$/;
+function isCellId(value) { return typeof value === 'string' && CELL_ID_RE.test(value); }
+
+// -> { cellId, source, conflict? }. `source` is 'owner-feed' | 'origin-attested' |
+// 'canonical-session' | null. Two authenticated sources that disagree resolve to
+// nothing (fail closed): there is no way to tell which one is stale.
+function resolveAskCell(ask) {
+  if (!ask || typeof ask !== 'object') return { cellId: null, source: null };
+  const fromFeed = isCellId(ask.ownerCellId) ? ask.ownerCellId : null;
+  const attested = isCellId(ask.originCell) ? ask.originCell : null;
+  if (fromFeed && attested && fromFeed !== attested) return { cellId: null, source: null, conflict: true };
+  if (fromFeed) return { cellId: fromFeed, source: 'owner-feed' };
+  if (attested) return { cellId: attested, source: 'origin-attested' };
+  const decoded = cellIdFromTmuxSession(ask.session);
+  return decoded ? { cellId: decoded, source: 'canonical-session' } : { cellId: null, source: null };
+}
+
+// The same ask can be known from two places at once (the alias created when the
+// owner pushed it, the card of the owner's feed). Call this with the candidates
+// that are the SAME generation of the SAME ask. Authenticated sources outrank the
+// session decode; two authenticated sources that disagree resolve to nothing; a
+// source that knows the cell completes one that does not.
+function resolveAskCellFrom(asks) {
+  const results = asks.filter(Boolean).map(resolveAskCell);
+  const authenticated = results.filter((r) => r.cellId && r.source !== 'canonical-session');
+  const ids = new Set(authenticated.map((r) => r.cellId));
+  if (results.some((r) => r.conflict) || ids.size > 1) return { cellId: null, source: null, conflict: true };
+  if (ids.size === 1) return authenticated[0];
+  const decoded = new Set(results.filter((r) => r.cellId).map((r) => r.cellId));
+  if (decoded.size === 1) return results.find((r) => r.cellId);
+  return decoded.size > 1 ? { cellId: null, source: null, conflict: true } : { cellId: null, source: null };
+}
+
+module.exports = { resolveAskCell, resolveAskCellFrom, isCellId, CELL_ID_RE };