@mmmbuto/nexuscrew 0.9.65 → 0.9.66

package/lib/notify/event-feed-client.js

@@ -11,6 +11,8 @@
 // dies by construction. Transport failures back off with jitter 5→60 s; a
 // stream silent for 60 s is aborted and resynced.
 
+const askCell = require('./ask-cell.js');
+
 const BACKOFF_MIN_MS = 5000;
 const BACKOFF_MAX_MS = 60000;
 const IDLE_TIMEOUT_MS = 60000;
@@ -259,6 +261,28 @@ function createEventFeedClient(opts = {}) {
     }
   }
 
+  // An ask of a snapshot, attributed to its owner, with the cell the OWNER
+  // resolved for it. `cellId` on the wire becomes `ownerCellId` here (validated by
+  // the schema check) and any `ownerCellId`/`originCell` the wire carried is
+  // dropped: those two names are ours, set only by authenticated ingress. When the
+  // snapshot has no cell for the ask, the cell the view already held for the SAME
+  // generation (same owner timestamp and content) is kept; a new generation never
+  // inherits it.
+  function withOwnerCell(wire, ownerId, knownCells) {
+    const { cellId, ownerCellId: _forged, originCell: _forgedOrigin, ...ask } = wire;
+    const out = { ...ask, ownerId };
+    if (askCell.isCellId(cellId)) return { ...out, ownerCellId: cellId };
+    const hit = knownCells.get(out.ownerAskId || out.id);
+    if (hit) {
+      const { askFingerprint } = require('./asks.js');
+      const priorTs = Object.hasOwn(hit.prior, 'ownerAskTs') ? hit.prior.ownerAskTs : hit.prior.ts;
+      const nextTs = Object.hasOwn(out, 'ownerAskTs') ? out.ownerAskTs : out.ts;
+      if (Number.isSafeInteger(priorTs) && priorTs > 0 && priorTs === nextTs
+        && askFingerprint(hit.prior) === askFingerprint(out)) return { ...out, ownerCellId: hit.cellId };
+    }
+    return out;
+  }
+
   // Apply a fetched snapshot ONLY if it belongs to the current generation:
   // an obsolete fetch must never overwrite a newer view (the snapshot
   // WINS over the previous view of the same owner).
@@ -268,10 +292,18 @@ function createEventFeedClient(opts = {}) {
     view.cursor = snap.cursor || null;
     // A snapshot taken before the owner processed a dismiss still carries the
     // ask: the tombstone is what keeps it from coming back.
+    // What this view already knows about the cell of each ask, taken BEFORE the
+    // view is replaced: an owner that does not publish the cell in its snapshot
+    // (older release) must not make a card forget what its live frame said.
+    const knownCells = new Map();
+    for (const prior of [...view.asks, ...(view.alertAsks ? view.alertAsks.values() : [])]) {
+      const resolved = askCell.resolveAskCell({ ownerCellId: prior.ownerCellId, originCell: prior.originCell });
+      if (resolved.cellId) knownCells.set(prior.ownerAskId || prior.id, { prior, cellId: resolved.cellId });
+    }
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
         .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch, a) && !isAskDismissed(ownerId, a))
-        .map((a) => ({ ...a, ownerId }))
+        .map((a) => withOwnerCell(a, ownerId, knownCells))
       : [];
     view.alertAsks = new Map(); // fresh snapshot replaces all live-only alert sources
     // A snapshot taken before the owner processed the dismissal still carries
@@ -405,7 +437,10 @@ function createEventFeedClient(opts = {}) {
       if (historicalAsk && typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
     } else if (f.type === 'ask') {
       const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
-        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
+        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId,
+        // The envelope of an ask frame is scoped to the cell the owner resolved;
+        // it is the owner's statement, carried on the authenticated stream.
+        ...(envelope.scope === 'cell' && askCell.isCellId(envelope.cellId) ? { ownerCellId: envelope.cellId } : {}) };
       if (!rememberLiveAsk(envelope.ownerId, ask)) return false;
       if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [ask]);
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
@@ -712,6 +747,9 @@ function createEventFeedClient(opts = {}) {
       && (a.question === undefined || typeof a.question === 'string')
       && (a.options === undefined || Array.isArray(a.options))
       && (a.session === undefined || typeof a.session === 'string')
+      // The cell the OWNER resolved for the ask: absent (an older owner, or a
+      // session the owner could not resolve) or a well-formed cell id, never anything else.
+      && (a.cellId === undefined || askCell.isCellId(a.cellId))
       && (a.ts === undefined || typeof a.ts === 'number');
     if (!snap.asks.every(askFieldsOk)) return schema('asks');
     return { ok: true };

package/lib/notify/event-feed-routes.js

@@ -14,6 +14,7 @@
 const express = require('express');
 const nodesStore = require('../nodes/store.js');
 const eventFeedAcl = require('./event-feed-acl.js');
+const askCell = require('./ask-cell.js');
 
 const SNAPSHOT_MAX_BYTES = 3 * 1024 * 1024;
 const SNAPSHOT_MAX_ASKS = 100;
@@ -241,8 +242,13 @@ function createEventFeedRoutes(deps) {
         // guardia e' esplicita sui campi di provenienza, non dedotta dalla
         // visibilita' della cella.
         .filter((a) => !a.originNode && !(a.ownerId && self && a.ownerId !== self))
-        .map((a) => ({ id: a.id, question: a.question, options: a.options, session: a.session, ts: a.ts }))
-        .filter((a) => peer.allows({ scope: 'cell', cellId: cellForSession(a.session) }));
+        // The cell is resolved ONCE, by this owner, through its own definitions, and
+        // it travels with the ask: a session with a custom tmux name does not decode
+        // to a cell on the receiving side, and the receiver must not guess it. Only
+        // a well-formed id is published; an unresolved one is simply absent.
+        .map((a) => ({ id: a.id, question: a.question, options: a.options, session: a.session, ts: a.ts, cell: cellForSession(a.session) }))
+        .filter((a) => peer.allows({ scope: 'cell', cellId: a.cell }))
+        .map(({ cell, ...ask }) => (askCell.isCellId(cell) ? { ...ask, cellId: cell } : ask));
       askSourceCount = visible.length;
       asks = visible.slice(0, SNAPSHOT_MAX_ASKS);
     } catch (e) {

package/lib/proxy/federation.js

@@ -113,8 +113,31 @@ function peerAllows(peer, otherId) {
   return Array.isArray(peer.selected) && peer.selected.includes(otherId);
 }
 
+// A host-only peer (publishRemote, schema 4) is a REMOTE node this installation
+// publishes to an explicit audience of its own admin nodes. The boundary is
+// one-way and does not depend on the peer's own claims or grants:
+//   audience -> peer : yes, while the reader is in the audience AND still holds
+//                      the operator grant (re-read on every call);
+//   peer -> anyone   : never (not another peer, not a topology, not a route);
+//   everyone else    : no, whatever `visibility` or `shared` say.
+function isHostOnlyPeer(peer) {
+  return !!peer && peer.publishRemote === true;
+}
+
+function audienceAllows(reader, hostOnly) {
+  return Array.isArray(hostOnly.publishRemoteAudience)
+    && typeof reader.nodeId === 'string'
+    && hostOnly.publishRemoteAudience.includes(reader.nodeId)
+    && !isHostOnlyPeer(reader)
+    && allowedByClass('operator', reader);
+}
+
 function canTransit(ingress, egress) {
   if (!ingress || !egress || ingress.name === egress.name) return !ingress;
+  // The ingress is the AUTHENTICATED peer record (looked up by its token), never
+  // something read from the query, a header or the visited chain.
+  if (isHostOnlyPeer(ingress)) return false;
+  if (isHostOnlyPeer(egress)) return audienceAllows(ingress, egress);
   // `shared` is the explicit publication gate. Visibility remains the hub ACL,
   // but it cannot make a private peer routable on its own.
   return egress.shared === true
@@ -274,6 +297,9 @@ function liveHostAllowedFor(ingress) {
 // WebSocket upgrade. A resource whose class is unknown, or whose grants the
 // owner has not conceded, is refused before anything is dispatched.
 function classGateCheck(resource, method, ingress) {
+  // A host-only peer reaches nothing of ours, whatever grants its record carries
+  // or gains: the zeroed vector is the first lock, this is the second.
+  if (isHostOnlyPeer(ingress)) return { ok: false, status: 403, reason: 'host-only-peer' };
   const cls = classifyResource(resource, method);
   if (!cls) return { ok: false, status: 404, reason: 'resource-not-classified' };
   if (!allowedByClass(cls, ingress)) return { ok: false, status: 403, reason: `grant-required:${cls}` };
@@ -1209,7 +1235,9 @@ async function collectTopologyDetailed({
       instanceId: n.nodeId, name: n.name, route: [n.name], direct: true,
       label: store.validLabel(n.label) ? n.label.trim() : '',
     });
-    if (ttl <= 1 || !n.token) continue;
+    // A host-only peer is published as a LEAF: whatever it says about its own
+    // children is never asked for, so it cannot announce nodes to our readers.
+    if (ttl <= 1 || !n.token || isHostOnlyPeer(n)) continue;
     probes.push({ n, pending: fetchPeerTopology({ node: n, ttl, seen, fetchImpl, timeoutMs: childBudget }) });
   }
   const results = await Promise.all(probes.map(async ({ n, pending }) => {
@@ -1286,7 +1314,9 @@ async function collectLocalTopology({
   const live = await collectTopologyDetailed({ nodesPath, fetchImpl, timeoutMs, childSnapshots: false });
   const st = store.loadStore(nodesPath);
   const directNames = new Set(((st && st.nodes) || [])
-    .filter((n) => n.direction !== 'inbound' || n.shared === true)
+    // A host-only peer is a leaf: nothing cached "behind" it survives (entries
+    // written before the mode was turned on included).
+    .filter((n) => (n.direction !== 'inbound' || n.shared === true) && !isHostOnlyPeer(n))
     .map((n) => n.name));
   const authoritative = new Set(live.authoritative);
   const liveIds = new Set(live.nodes.map((n) => n.instanceId));
@@ -1362,6 +1392,15 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
     if (!peer) return res.status(401).json({ error: 'unauthorized peer' });
     req.peer = peer; next();
   });
+  // A host-only peer (publish-remote) reaches NOTHING of ours over the protocol:
+  // the only thing it may do is the authenticated health probe. Share, topology,
+  // reverse-pool and routes are all refused here, before their handlers run.
+  r.use((req, res, next) => {
+    if (isHostOnlyPeer(req.peer) && !(req.method === 'GET' && req.path === '/health')) {
+      return res.status(403).json({ error: 'non concesso a questo nodo', reason: 'host-only-peer' });
+    }
+    return next();
+  });
   // Health federato: il peer autenticato (acceptToken matchato sopra) ottiene un
   // 200 esplicito con instanceId/version. Serve da target di probeHealth() lato
   // Initiator: distingue transport (porta aperta) da auth (200 vs 401) da
@@ -2072,9 +2111,9 @@ function acceptWsThenClose(socket, req, code, reason) {
 
 
 module.exports = {
-  isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, routeHandler,
+  isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, classGateCheck, routeHandler,
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS, SHARE_NOT_READY_CODE, classifyShareFailure, activeReversePort,
-  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
+  peerFromToken, peerAllows, canTransit, isHostOnlyPeer, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade, createHubAttachStore,
   probeHealth, waitForHealthyPeer, canListenLoopback, preflightHubReverse, notifyHubShare, reconcilePeerShare, runShareRevokeBoot, probeReverseOwner,
   hubPoolRequest, verifyHubPoolSlot, reserveHubPoolSlot, commitHubPoolSlot, settleHubPoolSlot, abortHubPoolSlot, getHubPoolStatus,

package/lib/server.js

@@ -58,6 +58,7 @@ const { createCellScopeGuard } = require('./cells/scope-guard.js');
 const { createCellScope } = require('./cells/scope.js');
 const { cellIdFromTmuxSession } = require('./fleet/definitions.js');
 const { createOwnerAskScope } = require('./notify/owner-ask-scope.js');
+const askCell = require('./notify/ask-cell.js');
 // Budget a tre finestre, riusato dalle notifiche federate: e' gia' scritto per
 // limitare il danno di un nodo che mente sulla propria cella (il tetto per
 // target si calcola sul NODO, che la catena visited verifica).
@@ -1519,15 +1520,32 @@ function createServer(opts = {}) {
     // Guards and alias mutation belong only to the selected generation.
     const alias = storedAlias && ask && asksStore.sameImportedGeneration(storedAlias, ask) ? storedAlias : null;
     const grants = peer && accessPresets.grantsOf(peer);
-    const cellId = ask ? cellIdFromTmuxSession(ask.session) : previous && previous.cellId;
-    const visible = !!((ask || previous) && cellId && grants && grants.configured && grants.grants.eventsAccess === true
+    // The cell comes from what the OWNER resolved (feed or attested origin) and,
+    // only for canonical names, from the session; see lib/notify/ask-cell.js. A
+    // body field is never consulted: the dismissal request carries no cell.
+    // The selected ask keeps its OWN cell. The other source (alias <-> feed card)
+    // lends its cell only when it is bound to the same generation by an explicit,
+    // equal owner timestamp and the same content: a generation that is unknown
+    // on either side is not "the same" for a cell (sameImportedGeneration stays
+    // permissive about it, because guards and alias mutation want that). If both
+    // sources are authenticated and disagree there is no cell at all.
+    const boundToSelected = item => item === ask || (tsOf(item) !== null && tsOf(item) === tsOf(ask)
+      && asksStore.askFingerprint(item) === asksStore.askFingerprint(ask));
+    const sameAsk = ask && [storedAlias, feedAsk].filter(item => item && boundToSelected(item));
+    const cellId = ask ? askCell.resolveAskCellFrom(sameAsk).cellId : previous && previous.cellId;
+    const grantsAllowFeed = !!(grants && grants.configured && grants.grants.eventsAccess === true);
+    const visible = !!((ask || previous) && cellId && grantsAllowFeed
       && eventFeedAcl.visibilityAllows(grants.grants, cellId));
+    // The ask is known and this node may read the owner's feed, but no
+    // authenticated source tells which cell it belongs to (a card persisted by an
+    // older release, an owner that does not publish the cell): said, not guessed.
+    const cellUnresolved = !!(ask && !cellId && grantsAllowFeed);
     const blocked = !!((ask && ask.answered) || (alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
       || askRelay.state().some(attempt => attempt.ownerId === ownerId && attempt.askId === askId && ['sent', 'uncertain'].includes(attempt.state)));
     const slot = peer && peer.reversePool && peer.reversePool.slots && peer.reversePool.slots[peer.reversePool.activeSlot];
     const unavailable = !!(peer && peer.direction === 'inbound' && (!peer.shared || !slot || !Number.isInteger(slot.port)))
       || askRelay.channelState(ownerId).unavailable;
-    return { peer, alias, previous, ask, grants, cellId, visible, blocked: blocked || ambiguous, unavailable, ambiguous };
+    return { peer, alias, previous, ask, grants, cellId, visible, cellUnresolved, blocked: blocked || ambiguous, unavailable, ambiguous };
   }
   api.post('/asks-relay', express.json({ limit: '8kb' }), async (req, res) => {
     try {
@@ -1541,8 +1559,13 @@ function createServer(opts = {}) {
         }
         try { if (!asksStore.health().readable) return res.status(503).json({ error: 'dismissal store unavailable' }); }
         catch (_) { return res.status(503).json({ error: 'dismissal store unavailable' }); }
-        const { peer, alias, previous, ask, grants, cellId, visible, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
-        if (!visible) return res.status(404).json({ error: 'unknown or invisible ask' });
+        const { peer, alias, previous, ask, grants, cellId, visible, cellUnresolved, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
+        if (!visible) {
+          if (cellUnresolved) {
+            return res.status(409).json({ error: 'the cell of this ask is not known from an authenticated owner source; refresh the owner view', reason: 'cell-unresolved' });
+          }
+          return res.status(404).json({ error: 'unknown or invisible ask' });
+        }
         if (ambiguous) return res.status(409).json({ error: 'ask generation is ambiguous; refresh the owner view', reason: 'generation-ambiguous' });
         if (ask && ask.answered) return res.status(409).json({ error: 'ask already answered', reason: 'answered' });
         if ((alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))

package/lib/settings/routes.js

@@ -710,6 +710,12 @@ function settingsRoutes(deps = {}) {
     if (!node) return send(res, 404, { error: `nodo sconosciuto "${name}"` });
     if (node.direction !== 'outbound') return send(res, 409, { error: 'Share si attiva sul dispositivo che possiede la connessione SSH' });
     if (!node.token || !node.nodeId) return send(res, 409, { error: 'nodo non associato: ripeti il pairing' });
+    // A host-only peer (publish-remote) is published ONE WAY to our own admin
+    // nodes; Share would publish THIS node on it. Refuse before any SSH restart
+    // or reverse negotiation is attempted (turning Share off stays possible).
+    if (node.publishRemote === true && body.shared) {
+      return send(res, 409, { error: 'publish-remote attivo su questo peer: Share resta spento (spegni prima publish-remote)', reason: 'publish-remote-active' });
+    }
     if (body.shared && !nodesStore.isPort(node.reversePort)) {
       return send(res, 409, { error: 'canale share non negoziato: ripeti il pairing' });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.65",
+  "version": "0.9.66",
   "description": "Faithful browser tmux client \u2014 attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {