@mmmbuto/nexuscrew 0.9.65 → 0.9.67

package/frontend/dist/index.html

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-DkYRC1vV.js"></script>
+  <script type="module" crossorigin src="/assets/index-D__76yWR.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-Dwd37Z_R.css">
 </head>
 <body>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.65"}
+{"version":"0.9.67"}

package/lib/audio/dispatch.js

@@ -30,6 +30,10 @@ function createDispatcher(opts = {}) {
   // stesso percorso e rispondono `delivered`. Il default resta quello audio,
   // cosi' nessun chiamante esistente cambia comportamento.
   const statuses = opts.statuses instanceof Set ? opts.statuses : PER_ENDPOINT_STATUS;
+  // Policy for requests that arrived FEDERATED and terminate here: re-read on the
+  // resolution used for the I/O, just before the request leaves. Local callers are
+  // never subject to it.
+  const federatedGuard = typeof opts.federatedGuard === 'function' ? opts.federatedGuard : null;
 
   function isLocal(target) {
     const self = localNodeId();
@@ -143,10 +147,19 @@ function createDispatcher(opts = {}) {
     resolveRoute,
     probeCapability,
     // dispatch(): unico ingresso per un target remoto.
-    async dispatch({ resource, target, origin, payload }) {
+    async dispatch({ resource, target, origin, payload, federated = false }) {
+      // What the policy says when the request begins counts too: a publication that ends while the topology is
+      // awaited does not turn the request into an allowed one.
+      let deniedBefore = false;
+      if (federated && federatedGuard) { try { deniedBefore = federatedGuard({ target, route: [] }) !== false; } catch (_) { deniedBefore = true; } }
       const resolved = await resolveRoute(target);
       if (resolved.error === 'invalid-target') return { status: 'refused', reason: 'invalid-target' };
       if (resolved.error) return { status: 'unreachable', reason: resolved.error };
+      if (federated && federatedGuard) {
+        let denied = true;
+        try { denied = federatedGuard({ target, route: resolved.route, peer: resolved.peer }) !== false; } catch (_) { denied = true; }
+        if (denied || deniedBefore) return { status: 'refused', reason: 'host-only-target' };
+      }
       return forward(resource, resolved.route, {
         ...payload,
         target,

package/lib/audio/routes.js

@@ -251,7 +251,7 @@ function audioRoutes(deps = {}) {
         origin, target, status: 'accepted', utteranceId, attested: trust === 'federated',
       });
       const out = await dispatcher.dispatch({
-        resource: '/audio/speak', target, origin,
+        resource: '/audio/speak', target, origin, federated: trust === 'federated',
         payload: {
           text: parsed.text, lang: parsed.lang, voice: parsed.voice, urgency: parsed.urgency,
           utteranceId: local.utteranceId,
@@ -285,7 +285,7 @@ function audioRoutes(deps = {}) {
     const { target } = parsed;
     if (dispatcher && isValidInstance(target) && !dispatcher.isLocal(target)) {
       const out = await dispatcher.dispatch({
-        resource: '/audio/stop', target, origin,
+        resource: '/audio/stop', target, origin, federated: resolved.trust === 'federated',
         payload: { ...(parsed.utteranceId ? { utteranceId: parsed.utteranceId } : {}) },
       });
       return send(res, out.status === 'accepted' ? 200 : out.status === 'unreachable' ? 503 : 422, out);

package/lib/cli/commands.js

@@ -85,6 +85,8 @@ Usage:
   nexuscrew nodes cells <name|nodeId> all|none|Cella1,Cella2
                          [--selected NODE_ID,...]
   nexuscrew nodes share <name|nodeId> on|off [--json]
+  nexuscrew nodes publish-remote <name|nodeId> on --audience <instanceId,...> [--json]
+  nexuscrew nodes publish-remote <name|nodeId> off|status [--json]
   nexuscrew nodes panel <name|nodeId> on|off
   nexuscrew nodes live-host <name|nodeId> on|off
   nexuscrew nodes edit <name|nodeId> --access-role admin|user|nexushost
@@ -118,6 +120,7 @@ const CLI_VALUE_FLAGS = new Set([
   'name', 'local-name', 'local-label', 'identity-file', 'port', 'dir', 'events-receive',
   'access-role', 'access-revision',
   'events-access', 'node-events-access', 'ask-reply-access', 'files-read-access', 'peer-operator-access',
+  'audience',
 ]);
 
 // valueFlags (Set|array opzionale): flag che consumano il token successivo nella
@@ -1367,6 +1370,34 @@ async function dispatchNodes(rest, flags, opts = {}) {
       return { code: 0 };
     } catch (error) { log(`nodes share: ${error.message}`); return { code: 1 }; }
   }
+  // Host-only publication of a remote peer, one way, to an explicit audience of
+  // our own admin nodes. NOT Share: it never calls the share path.
+  if (sub === 'publish-remote') {
+    const arg = rest[3];
+    if (arg !== undefined && arg !== 'on' && arg !== 'off' && arg !== 'status') {
+      log('nodes publish-remote: uso `nodes publish-remote <nodo> on --audience <id,id>|off|status`');
+      return { code: 1 };
+    }
+    if (arg === 'on') {
+      if (typeof flags.audience !== 'string' || !flags.audience.trim()) {
+        log('nodes publish-remote: `on` richiede --audience <instanceId,instanceId,...> (gli id dei nodi admin che vedranno il peer)');
+        return { code: 1 };
+      }
+    } else if (flags.audience !== undefined) {
+      log('nodes publish-remote: --audience si usa solo con `on`');
+      return { code: 1 };
+    }
+    const audience = arg === 'on' ? String(flags.audience).split(',').map((x) => x.trim()).filter(Boolean) : undefined;
+    const expectedRevision = flags['access-revision'] === undefined ? undefined : Number(flags['access-revision']);
+    if (expectedRevision !== undefined && !Number.isInteger(expectedRevision)) {
+      log('nodes publish-remote: --access-revision vuole un intero (la revision letta da `nodes access`)');
+      return { code: 1 };
+    }
+    return { code: nodesCmds.nodesPublishRemote({
+      ...opts, log, ref, json: flags.json === true, audience, expectedRevision,
+      enabled: arg === 'on' ? true : (arg === 'off' ? false : undefined),
+    }).code };
+  }
   if (sub === 'invite') {
     const body = {
       ...(flags.ssh !== undefined ? { ssh: flags.ssh } : {}),

package/lib/live-host/federation.js

@@ -30,6 +30,9 @@ function createLiveHostFederation({
   localToken = () => '',
   fetchImpl = fetch,
   timeoutMs = FED_TIMEOUT_MS,
+  // Refuses an owner that is (or routes through) a host-only peer. Read on the
+  // resolution used for the I/O, just before the request leaves.
+  ownerGuard = null,
 } = {}) {
   async function resolveRoute(target) {
     if (!INSTANCE_ID_RE.test(String(target || ''))) return { error: 'invalid-target' };
@@ -48,11 +51,18 @@ function createLiveHostFederation({
   }
 
   async function forward(target, resource, method, body) {
+    let deniedBefore = false;
+    if (typeof ownerGuard === 'function') { try { deniedBefore = ownerGuard({ target, route: [] }) !== false; } catch (_) { deniedBefore = true; } }
     const resolved = await resolveRoute(target);
     if (resolved.error) return { ok: false, reason: resolved.error === 'invalid-target' ? 'invalid-target' : 'live-host-owner-unreachable' };
     const port = localPort();
     const token = localToken();
     if (!port || !token) return { ok: false, reason: 'live-host-owner-unreachable' };
+    if (typeof ownerGuard === 'function') {
+      let denied = true;
+      try { denied = ownerGuard({ target, route: resolved.route }) !== false; } catch (_) { denied = true; }
+      if (denied || deniedBefore) return { ok: false, reason: 'live-host-owner-unreachable' };
+    }
     const url = `http://127.0.0.1:${port}/api/route/${resolved.route.join('/')}/_${resource}`;
     let res;
     try {

package/lib/live-host/routes.js

@@ -95,7 +95,10 @@ function liveHostRoutes({ fleetP, store, readonly = () => false, now = () => Dat
   // verifica (prova di hop + catena `visited` costruita dal server), e il budget
   // del ponte si applica per NODO mittente ATTESTATO — stessa regola e stessi
   // limiti dell'audio (lib/audio/rate-limit.js).
-  federation = null, originResolver = null, federatedRate = null }) {
+  federation = null, originResolver = null, federatedRate = null,
+  // (req, ownerId) => true when this reader must not learn that the designation
+  // points at a host-only peer.
+  ownerHiddenFor = null }) {
   const r = express.Router();
 
   // Una designazione con `ownerId` e' REMOTA: il puntamento vive qui,
@@ -124,11 +127,18 @@ function liveHostRoutes({ fleetP, store, readonly = () => false, now = () => Dat
   // hostCell e revision vengono dallo store (preservato); eligible e' la verita'
   // COMPOSTA roster+lease (si veda hostLeaseState sopra); host.lease espone lo
   // stato del lease della cella designata, distinto, perche' chi legge distingue.
-  r.get('/', async (_req, res) => {
+  r.get('/', async (req, res) => {
     try {
       const snap = store.snapshot();
+      if (snap.hostCell != null && snap.ownerId && ownerHiddenFor && ownerHiddenFor(req, snap.ownerId)) {
+        return res.json({ hostCell: null, revision: snap.revision, eligible: false, threadStatus: 'absent', host: { lease: null }, at: now() });
+      }
       if (snap.hostCell != null && snap.ownerId) {
         const remote = await remoteOwnerState(snap);
+        // the reader is judged again after the wait: a publication that changed meanwhile must not name the owner
+        if (ownerHiddenFor && ownerHiddenFor(req, snap.ownerId)) {
+          return res.json({ hostCell: null, revision: snap.revision, eligible: false, threadStatus: 'absent', host: { lease: null }, at: now() });
+        }
         return res.json({
           hostCell: snap.hostCell, revision: snap.revision, ownerId: snap.ownerId, remote: true,
           eligible: remote.state ? remote.state.eligible : false,

package/lib/nodes/access-presets.js

@@ -225,15 +225,34 @@ function grantsOf(peer) {
 }
 
 
-// Read view of ONE peer for listing endpoints and the settings UI: the
-// derived label, the configured marker and the EFFECTIVE grant vector. The
-// vector is flat and always complete (denied for records that are not
-// configured), so a caller never has to guess defaults and no token or
-// secret is ever included: grants are decisions, not credentials.
+// The vector the resource gate APPLIES to a record: the stored booleans and the
+// cell scope, read exactly the way resource-acl.allowedByClass reads them — no
+// `accessConfigured` marker, no coherence check. This is what a VIEW must show.
+// `grantsOf` is different on purpose: it answers "was this vector set
+// deliberately?" and feeds decisions that demand a configured record (the event
+// stream, the ASK target check); it must keep denying for a legacy record.
+// An absent scope is `all`: that is what the parser stores and what the gate
+// sees (it only closes the cell-scoped classes on an explicit `none`).
+function effectiveGrants(peer) {
+  const p = isPlainObject(peer) ? peer : {};
+  const grants = { cellVisibility: CELL_VISIBILITY.includes(p.cellVisibility) ? p.cellVisibility : 'all' };
+  if (grants.cellVisibility === 'selected') grants.cells = Array.isArray(p.cells) ? [...p.cells] : [];
+  for (const key of BOOLEAN_GRANTS) grants[key] = p[key] === true;
+  return grants;
+}
+
+// Read view of ONE peer for listing endpoints and the settings UI: the derived
+// label and the configured marker (PROVENANCE: how the vector was set) and the
+// EFFECTIVE grant vector (what the gate applies, see effectiveGrants). The
+// vector is flat and always complete, so a caller never has to guess defaults,
+// and no token or secret is ever included: grants are decisions, not
+// credentials. A legacy record with a grant and no marker reads "unconfigured"
+// AND shows the grant on, because both are true.
 function accessView(peer) {
   const view = grantsOf(peer);
-  const access = { cellVisibility: view.grants.cellVisibility };
-  for (const key of BOOLEAN_GRANTS) access[key] = view.grants[key] === true;
+  const effective = effectiveGrants(peer);
+  const access = { cellVisibility: effective.cellVisibility };
+  for (const key of BOOLEAN_GRANTS) access[key] = effective[key];
   return { accessLabel: view.label, accessConfigured: view.configured, access };
 }
 
@@ -252,6 +271,7 @@ module.exports = {
   accessView,
   applyPreset,
   deriveLabel,
+  effectiveGrants,
   grantsOf,
   isCompleteAdminVector,
   isConfigured,

package/lib/nodes/commands.js

@@ -336,9 +336,22 @@ function nodesInspect(opts) {
     // inferred from defaults.
     if (peer.kind === 'direct') {
       const view = accessPresets.grantsOf(peer);
+      // The label says how the vector was set; the vector is what the resource
+      // gate applies, so it is shown as stored even for a legacy record.
+      const effective = accessPresets.effectiveGrants(peer);
       log(`accesso:   ${view.label}`);
-      log(`grant:     ${ACCESS_GRANT_KEYS.map((key) => `${key}=${view.grants[key] ? 'on' : 'off'}`).join(' ')}`);
-      log(`scope:     celle ${view.grants.cellVisibility}`);
+      log(`grant:     ${ACCESS_VIEW_KEYS.map((key) => `${key}=${effective[key] ? 'on' : 'off'}`).join(' ')}`);
+      log(`scope:     celle ${effective.cellVisibility}`);
+      if (!view.configured) {
+        log('nota:      record non configurato: i grant mostrati sono quelli che il gate delle risorse applica; il feed eventi richiede un vettore configurato');
+      }
+      if (peer.publishRemote === true) {
+        const names = (peer.publishRemoteAudience || []).map((id) => {
+          const reader = out.nodes.find((n) => n.nodeId === id);
+          return reader ? `${reader.name} (${id})` : id;
+        });
+        log(`pubblicato: solo-host, audience: ${names.join(', ')}`);
+      }
       for (const line of feedLinesFor(opts.feedDiagnostics, peer.nodeId)) log(line);
     }
     log(`azioni:    ${Object.keys(peer.actions || {}).filter((key) => peer.actions[key]).join(', ')}`);
@@ -351,6 +364,8 @@ function nodesInspect(opts) {
 // validated write. The label (admin/user/nexushost/custom) is derived from the
 // grants; nothing here stores or reads a role.
 const ACCESS_GRANT_KEYS = ['eventsAccess', 'nodeEventsAccess', 'askReplyAccess', 'filesReadAccess', 'peerOperatorAccess'];
+// What the views print: the five grant flags of the edit commands plus the two the panel and live-host classes read.
+const ACCESS_VIEW_KEYS = [...ACCESS_GRANT_KEYS, 'panelAccess', 'liveHostAccess'];
 const ACCESS_EDIT_KEYS = new Set(['accessRole', ...ACCESS_GRANT_KEYS]);
 
 const ACCESS_VECTOR_FIELDS = ['cellVisibility', 'cells', 'panelAccess', 'liveHostAccess'];
@@ -545,6 +560,50 @@ function nodesEdit(opts) {
   return { code: 0, name: node.name, node: edited, restarted: wasUp };
 }
 
+// --- nodes publish-remote ---------------------------------------------------
+// Host-only publication of a REMOTE peer: `nodes publish-remote <peer> on
+// --audience <instanceId,...>` / `off`. Separate from Share on purpose: it
+// never calls the share path, never restarts the tunnel and never touches the
+// reverse pool. It edits the store (one validated, compare-and-set write, after
+// a full backup on `on`); the running server reads the store per request.
+function nodesPublishRemote(opts) {
+  const log = opts.log || console.log;
+  const { nodesPath } = resolveNodePaths(opts);
+  let st;
+  try { st = store.loadStoreStrict(nodesPath); }
+  catch (e) { log(`nodes publish-remote: ${e.message}`); return { code: 1, reason: 'store invalido', status: e.status || 500, errorCode: e.code || null }; }
+  const node = resolveStoredNode(st, opts.ref || opts.name);
+  if (!node) { log(`nodes publish-remote: nodo sconosciuto "${opts.ref || opts.name || ''}"`); return { code: 1, reason: 'unknown-node' }; }
+  if (opts.enabled === undefined) {
+    // Read-only status.
+    const state = node.publishRemote === true
+      ? { name: node.name, enabled: true, audience: [...node.publishRemoteAudience] }
+      : { name: node.name, enabled: false, audience: [] };
+    if (opts.json) log(JSON.stringify(state, null, 2));
+    else log(`nodes publish-remote [${node.name}]: ${state.enabled ? `on · audience ${state.audience.join(', ')}` : 'off'}`);
+    return { code: 0, ...state };
+  }
+  if (isReadonly(opts)) { log('nodes publish-remote: READONLY, mutazione bloccata'); return { code: 1, reason: 'readonly' }; }
+  let res;
+  try {
+    res = store.setPublishRemoteCas({
+      filePath: nodesPath, name: node.name, enabled: opts.enabled === true,
+      audience: opts.audience, expectedRevision: opts.expectedRevision,
+    });
+  } catch (e) { log(`nodes publish-remote: ${e.message}`); return { code: 1, reason: 'refused', error: e.message }; }
+  if (!res.ok) {
+    log(`nodes publish-remote: revision delle concessioni superata (attuale ${res.revision}) — rileggi e riprova`);
+    return { code: 1, reason: 'revision-conflict', revision: res.revision };
+  }
+  if (opts.json) log(JSON.stringify(res, null, 2));
+  else if (res.enabled) {
+    log(`nodes publish-remote [${res.name}]: on · audience ${res.audience.join(', ')}`);
+    log('  grant verso il peer azzerati (celle none, eventi/file/ask/operatore/pannello/live host off, eventsReceive off); store a schema 4');
+    if (res.backup) log(`  backup dello store: ${res.backup.path} (sha256 ${res.backup.sha256})`);
+  } else log(`nodes publish-remote [${res.name}]: off${res.unchanged ? ' (era gia\' spento)' : ' · i grant restano azzerati'}`);
+  return { code: 0, ...res };
+}
+
 // --- nodes access: read-only inventory --------------------------------------
 // Shows what every peer may currently do on this node, with the revision of
 // the policy. Peers whose grants were never configured are listed as such:
@@ -566,7 +625,7 @@ function nodesAccess(opts = {}) {
   if (view.peers.length === 0) log('nessun peer diretto');
   for (const peer of view.peers) {
     log(`${peer.name}${peer.nodeId ? ` (${peer.nodeId})` : ''}: ${peer.label}`);
-    log(`  ${ACCESS_GRANT_KEYS.map((key) => `${key}=${peer.grants[key] ? 'on' : 'off'}`).join(' ')} · celle ${peer.grants.cellVisibility}`);
+    log(`  ${ACCESS_VIEW_KEYS.map((key) => `${key}=${peer.grants[key] ? 'on' : 'off'}`).join(' ')} · celle ${peer.grants.cellVisibility}`);
   }
   if (legacy.length > 0) log(`da configurare esplicitamente (${legacy.length}): ${legacy.map((p) => p.name).join(', ')}`);
   return { code: 0, ...view, unconfigured: legacy.map((p) => p.name) };
@@ -880,7 +939,7 @@ function nodesSetToken(opts) {
 module.exports = {
   fetchFeedDiagnostics, feedLinesFor,
 
-  nodesAccess, ACCESS_GRANT_KEYS,
+  nodesAccess, nodesPublishRemote, ACCESS_GRANT_KEYS,
   nodesAdd, nodesList, nodesInspect, nodesEdit, nodesRemove, nodesTest, nodesTestAll,
   nodesUp, nodesDown, nodesRestart, nodesSetToken,
   // helper esposti per test/riuso

package/lib/nodes/reverse-slot-listeners.js

@@ -83,7 +83,10 @@ function createReverseSlotListeners({ app, createServerImpl = http.createServer,
     return true;
   }
 
-  return { open, closePort, closeAll, respond, size: () => listeners.size };
+  // A request that arrived on one of these listeners comes from a peer's channel,
+  // never from this machine's own browser: callers use it to tell the two apart.
+  const isSlotPort = (localPort) => listeners.has(localPort);
+  return { open, closePort, closeAll, respond, isSlotPort, size: () => listeners.size };
 }
 
 module.exports = { createReverseSlotListeners };