@mmmbuto/nexuscrew 0.9.65 → 0.9.67

package/lib/nodes/store.js

@@ -20,8 +20,16 @@ const crypto = require('node:crypto');
 const reversePool = require('./reverse-pool.js');
 const identity = require('./identity.js');
 const accessPresets = require('./access-presets.js');
+const { allowedByClass } = require('../proxy/resource-acl.js');
 
 const SCHEMA_VERSION = 3;
+// Schema 4 = schema 3 + the host-only publication fields of a peer
+// (`publishRemote`, `publishRemoteAudience`). It is written ONLY when that
+// mode is first enabled, after a full backup of the store: until then every
+// store stays at the schema it already has, and a 0.9.65 binary keeps reading
+// it. A 0.9.65 binary cannot read a schema 4 store (closed schema): going back
+// means restoring the backup taken at the opt-in, never a silent downgrade.
+const HOST_ONLY_SCHEMA_VERSION = 4;
 const PREVIOUS_SCHEMA_VERSION = 2;
 const LEGACY_SCHEMA_VERSION = 1;
 const MAX_NODES = 64;
@@ -156,6 +164,11 @@ const NODE_KEYS = new Set([
   // coherent "custom" preset instead of "not configured". It is provenance,
   // not a permission — it grants nothing and handlers never read it as a role.
   'accessConfigured',
+  // Host-only publication of a REMOTE peer (schema 4). Not Share: Share
+  // publishes THIS node on the peer's hub through a reverse (-R) channel; this
+  // publishes the peer to an explicit audience of our own admin nodes, over the
+  // existing private -L, one way only (see hostOnlyViolation).
+  'publishRemote', 'publishRemoteAudience',
 ]);
 
 // Nome di cella: stessa forma usata da fleet/definitions.js, cells/routes.js e
@@ -247,6 +260,28 @@ function reversePoolDefault(base, { verification = 'unverifiable', generation =
   };
 }
 
+// Invariants of a host-only peer, on a node with its defaults applied.
+// Returns the first violation as text, or null. This is the single source of
+// truth: parseNode refuses a record that breaks it (so no write path can
+// persist one) and the mutators use it to explain WHY they refuse.
+// The vector is the one the authorization code reads: allowedByClass looks at
+// these exact fields, never at a label.
+function hostOnlyViolation(node) {
+  if (!node || node.publishRemote !== true) return null;
+  if (node.direction !== 'outbound') return 'vale solo per un peer in uscita (outbound)';
+  if (node.shared === true) return 'e\' incompatibile con Share acceso su questo peer';
+  const audience = node.publishRemoteAudience;
+  if (!Array.isArray(audience) || audience.length === 0) return 'l\'audience non puo\' essere vuota';
+  if (node.nodeId && audience.includes(node.nodeId)) return 'l\'audience non puo\' contenere il peer pubblicato';
+  if (node.eventsReceive === true) return 'eventsReceive deve restare spento';
+  if (node.cellVisibility !== 'none' || (Array.isArray(node.cells) && node.cells.length > 0)) {
+    return 'le celle di questo nodo devono restare invisibili al peer (cellVisibility none)';
+  }
+  const open = accessPresets.BOOLEAN_GRANTS.filter((key) => node[key] === true);
+  if (open.length > 0) return `i grant verso il peer devono restare tutti a zero (aperti: ${open.join(', ')})`;
+  return null;
+}
+
 function parseNode(n, schemaVersion = SCHEMA_VERSION) {
   if (!n || typeof n !== 'object' || Array.isArray(n)) return null;
   for (const k of Object.keys(n)) { if (!NODE_KEYS.has(k)) return null; } // schema chiuso
@@ -434,6 +469,28 @@ function parseNode(n, schemaVersion = SCHEMA_VERSION) {
     out.keyConflict = { seen: c.seen, at: c.at, source: c.source };
   }
   if (label) out.label = label;
+  if (n.publishRemote !== undefined || n.publishRemoteAudience !== undefined) {
+    // Only a schema 4 store may carry the fields: a store written at 1-3 with
+    // them is not something this code ever produced.
+    if (schemaVersion < HOST_ONLY_SCHEMA_VERSION) return null;
+    if (n.publishRemote !== undefined && typeof n.publishRemote !== 'boolean') return null;
+    let audience;
+    if (n.publishRemoteAudience !== undefined) {
+      if (!Array.isArray(n.publishRemoteAudience) || n.publishRemoteAudience.length > MAX_NODES) return null;
+      audience = [...new Set(n.publishRemoteAudience)];
+      if (audience.some((id) => typeof id !== 'string' || !NODE_ID_RE.test(id))) return null;
+      audience.sort();
+    }
+    if (n.publishRemote === true) {
+      out.publishRemote = true;
+      out.publishRemoteAudience = audience || [];
+      if (hostOnlyViolation(out) !== null) return null;
+    } else {
+      // Off: no audience may linger (a stale list would read as a grant).
+      if (audience && audience.length > 0) return null;
+      if (n.publishRemote === false) out.publishRemote = false;
+    }
+  }
   return out;
 }
 
@@ -464,8 +521,8 @@ function parseStore(raw) {
       return null;
     }
 
-    if (![SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION].includes(d.schemaVersion)) return null;
-    const rootKeys = d.schemaVersion === SCHEMA_VERSION
+    if (![HOST_ONLY_SCHEMA_VERSION, SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION].includes(d.schemaVersion)) return null;
+    const rootKeys = d.schemaVersion >= SCHEMA_VERSION
       ? new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'reversePoolAnchor', 'reversePoolLedgerInitialized', 'accessRevision', 'adminReceptionMigration'])
       : new Set(['schemaVersion', 'nodeId', 'nodes', 'rendezvous', 'adminReceptionMigration']);
     if (Object.keys(d).some((key) => !rootKeys.has(key))) return null;
@@ -509,7 +566,7 @@ function parseStore(raw) {
     // advances it to 1. It is kept out of the parsed object when absent so a
     // plain load never rewrites the file with a field nobody set.
     if (d.accessRevision !== undefined) {
-      if (d.schemaVersion !== SCHEMA_VERSION) return null;
+      if (d.schemaVersion < SCHEMA_VERSION) return null;
       if (!Number.isInteger(d.accessRevision) || d.accessRevision < 0) return null;
       out.accessRevision = d.accessRevision;
     }
@@ -519,7 +576,7 @@ function parseStore(raw) {
       if (!rdv) return null;
       out.rendezvous = rdv;
     }
-    if (d.schemaVersion === SCHEMA_VERSION) {
+    if (d.schemaVersion >= SCHEMA_VERSION) {
       // This marker distinguishes a fresh v3 peer (which may have received a
       // pool from another hub) from a hub that has once owned allocations. If
       // the latter loses its anchor, it must not silently start a new ledger.
@@ -665,7 +722,14 @@ function getNode(store, name) {
 }
 
 function mutationSchemaVersion(store) {
-  return store && store.schemaVersion === SCHEMA_VERSION ? SCHEMA_VERSION : PREVIOUS_SCHEMA_VERSION;
+  // A schema 3 or 4 store keeps ITS schema: writing 3 over a 4 store would
+  // silently drop the host-only fields (and parse would refuse the record).
+  return store && store.schemaVersion >= SCHEMA_VERSION ? store.schemaVersion : PREVIOUS_SCHEMA_VERSION;
+}
+
+// The schema a write that needs at least v3 must keep: never lower than the store's own.
+function atLeastV3(store) {
+  return store && store.schemaVersion > SCHEMA_VERSION ? store.schemaVersion : SCHEMA_VERSION;
 }
 
 function addNode(store, entry) {
@@ -706,7 +770,12 @@ function setNodeToken(store, name, token) {
 function updateNode(store, name, patch) {
   const idx = store.nodes.findIndex((n) => n.name === name);
   if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
-  const parsed = parseNode({ ...store.nodes[idx], ...patch }, mutationSchemaVersion(store));
+  const probe = { ...store.nodes[idx], ...patch };
+  // While the host-only mode is on, an edit that would break its invariants is
+  // refused WITH the reason (parseNode alone would only say "invalid").
+  const why = hostOnlyViolation(probe);
+  if (why) throw new Error(`publish-remote attivo su "${name}": ${why}`);
+  const parsed = parseNode(probe, mutationSchemaVersion(store));
   if (!parsed) throw new Error('aggiornamento nodo non valido');
   const nodes = store.nodes.slice();
   nodes[idx] = parsed;
@@ -728,6 +797,9 @@ function setPeerAccessGrants(store, name, grants) {
   if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
   const check = accessPresets.validateGrants(grants);
   if (!check.ok) throw new Error(`concessioni non valide: ${check.errors.join('; ')}`);
+  if (store.nodes[idx].publishRemote === true) {
+    throw new Error(`publish-remote attivo su "${name}": i grant verso questo nodo restano azzerati finche' la modalita' e' accesa (spegnila con \`nodes publish-remote ${name} off\`)`);
+  }
   const next = { ...store.nodes[idx] };
   next.cellVisibility = grants.cellVisibility;
   if (grants.cellVisibility === 'selected') next.cells = [...(grants.cells || [])];
@@ -736,7 +808,7 @@ function setPeerAccessGrants(store, name, grants) {
   next.accessConfigured = true;
   const nodes = store.nodes.slice();
   nodes[idx] = next;
-  const out = { ...store, schemaVersion: SCHEMA_VERSION, nodes };
+  const out = { ...store, schemaVersion: atLeastV3(store), nodes };
   out.accessRevision = accessRevisionOf(store) + 1;
   return out;
 }
@@ -765,9 +837,12 @@ function accessInventory(store) {
       name: peer.name,
       nodeId: peer.nodeId || null,
       direction: peer.direction,
+      // Provenance: was the vector set on purpose? Not what is granted.
       configured: view.configured,
       label: view.label,
-      grants: view.grants,
+      // What the resource gate applies, also for a legacy record (see
+      // accessPresets.effectiveGrants).
+      grants: accessPresets.effectiveGrants(peer),
     };
   });
   return { revision: accessRevisionOf(store), peers };
@@ -814,6 +889,108 @@ function setPeerAccessPresetCas({ filePath, name, presetName, expectedRevision,
     eventsReceive: written.nodes.find((n) => n.name === name).eventsReceive === true };
 }
 
+// --- Host-only publication of a remote peer ---------------------------------
+// `nodes publish-remote <peer> on --audience <ids>|off`. NOT Share: nothing
+// here touches the tunnel, the reverse pool or the peer's SSH session.
+//
+// The audience is an explicit list of instanceIds of OUR direct peers that
+// already hold the operator grant (the same predicate the authorization code
+// uses: allowedByClass('operator', peer)). Unknown ids, ids of peers without
+// that grant and the published peer itself are refused.
+function enablePublishRemote(st, name, audience) {
+  const idx = st.nodes.findIndex((n) => n.name === name);
+  if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
+  const node = st.nodes[idx];
+  if (node.direction !== 'outbound') throw new Error(`"${name}" non e' un peer in uscita: publish-remote vale solo per quelli`);
+  if (!node.token) throw new Error(`"${name}" non e' accoppiato (manca il token): niente da pubblicare`);
+  if (node.shared === true) throw new Error(`Share e' acceso su "${name}": publish-remote e' un'altra cosa, spegni prima Share`);
+  if (node.publishRemote === true) throw new Error(`publish-remote e' gia' acceso su "${name}": spegnilo per cambiare l'audience`);
+  if (!Array.isArray(audience) || audience.length === 0) {
+    throw new Error('audience vuota: indica gli instanceId dei nodi admin che possono vedere il peer (--audience id,id,...)');
+  }
+  const ids = [...new Set(audience)];
+  if (ids.length > MAX_NODES) throw new Error('audience troppo lunga');
+  for (const id of ids) {
+    if (typeof id !== 'string' || !NODE_ID_RE.test(id)) throw new Error(`instanceId non valido nell'audience: "${String(id).slice(0, 40)}"`);
+    if (id === node.nodeId) throw new Error(`l'audience non puo' contenere il peer pubblicato (${name})`);
+    const reader = st.nodes.find((n) => n.nodeId === id);
+    if (!reader) throw new Error(`instanceId sconosciuto nell'audience: ${id} (non e' un peer diretto di questo nodo)`);
+    if (reader.publishRemote === true) throw new Error(`"${reader.name}" e' a sua volta un peer solo-host: non puo' stare nell'audience`);
+    if (!allowedByClass('operator', reader)) {
+      throw new Error(`"${reader.name}" (${id}) non e' un nodo admin: manca peerOperatorAccess`);
+    }
+  }
+  // ONE record, ONE save: the publication and the zeroed vector travel together,
+  // so there is no instant at which the peer is published with open grants.
+  const next = { ...node, cellVisibility: 'none', eventsReceive: false, accessConfigured: true,
+    publishRemote: true, publishRemoteAudience: ids.sort() };
+  delete next.cells;
+  for (const key of accessPresets.BOOLEAN_GRANTS) next[key] = false;
+  const nodes = st.nodes.slice();
+  nodes[idx] = next;
+  const out = parseStore({ ...st, schemaVersion: Math.max(HOST_ONLY_SCHEMA_VERSION, st.schemaVersion), nodes,
+    accessRevision: accessRevisionOf(st) + 1 });
+  if (!out) throw new Error('publish-remote: lo store risultante non e\' valido (schema strict)');
+  return out;
+}
+
+// Off: the publication ends at once; the grants stay at zero (they are NOT
+// restored to whatever they were before: re-opening anything is an explicit act).
+function disablePublishRemote(st, name) {
+  const idx = st.nodes.findIndex((n) => n.name === name);
+  if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
+  const node = st.nodes[idx];
+  if (node.publishRemote !== true) return st;
+  const next = { ...node, publishRemote: false };
+  delete next.publishRemoteAudience;
+  const nodes = st.nodes.slice();
+  nodes[idx] = next;
+  const out = parseStore({ ...st, nodes, accessRevision: accessRevisionOf(st) + 1 });
+  if (!out) throw new Error('publish-remote: lo store risultante non e\' valido (schema strict)');
+  return out;
+}
+
+// Full, protected copy of the store taken right before the opt-in write. It is
+// the rollback path: a 0.9.65 binary cannot read a schema 4 store.
+function backupStoreFile(filePath, now = new Date()) {
+  const st = fs.lstatSync(filePath);
+  if (st.isSymbolicLink() || !st.isFile()) throw new Error('backup rifiutato: nodes.json non e\' un file regolare');
+  const data = fs.readFileSync(filePath);
+  const sha256 = crypto.createHash('sha256').update(data).digest('hex');
+  const stamp = now.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+  // wx: never overwrite a previous backup. Two backups of the same bytes in the same second get distinct names
+  // (a numeric suffix) instead of failing the opt-in.
+  let target = '';
+  for (let n = 0; ; n += 1) {
+    target = `${filePath}.pre-publish-remote-${stamp}-${sha256.slice(0, 8)}${n ? `-${n}` : ''}.bak`;
+    try { fs.writeFileSync(target, data, { mode: 0o600, flag: 'wx' }); break; } catch (e) {
+      if (e && e.code === 'EEXIST' && n < 1000) continue;
+      throw e;
+    }
+  }
+  fs.chmodSync(target, 0o600);
+  return { path: target, sha256 };
+}
+
+// Compare-and-set write of the mode, keyed on the same revision as the access
+// grants (turning it on changes them). `on` takes the backup BEFORE writing.
+function setPublishRemoteCas({ filePath, name, enabled, audience, expectedRevision }) {
+  const current = loadStoreStrict(filePath);
+  if (expectedRevision !== undefined && (!Number.isInteger(expectedRevision) || accessRevisionOf(current) !== expectedRevision)) {
+    return { ok: false, conflict: true, revision: accessRevisionOf(current) };
+  }
+  const next = enabled ? enablePublishRemote(current, name, audience) : disablePublishRemote(current, name);
+  if (next === current) return { ok: true, name, enabled: false, unchanged: true, revision: accessRevisionOf(current), schemaVersion: current.schemaVersion };
+  const backup = enabled ? backupStoreFile(filePath) : null;
+  const written = atomicWriteStore(filePath, next);
+  const node = written.nodes.find((n) => n.name === name);
+  return {
+    ok: true, name, enabled: node.publishRemote === true,
+    audience: node.publishRemote === true ? [...node.publishRemoteAudience] : [],
+    revision: accessRevisionOf(written), schemaVersion: written.schemaVersion, backup,
+  };
+}
+
 // One startup migration; later operational reception edits remain authoritative.
 function migrateAdminReception({ filePath, readonly = false }) {
   if (readonly || process.env.NEXUSCREW_READONLY === '1') return { migrated: false };
@@ -828,7 +1005,7 @@ function migrateAdminReception({ filePath, readonly = false }) {
       changed += 1;
     }
   }
-  if (changed) next = { ...next, schemaVersion: SCHEMA_VERSION,
+  if (changed) next = { ...next, schemaVersion: atLeastV3(current),
     accessRevision: accessRevisionOf(current) + 1 };
   atomicWriteStore(filePath, { ...next, adminReceptionMigration: 1 });
   return { migrated: true, changed };
@@ -845,7 +1022,7 @@ function upgradeToReversePoolSchema(store, anchor = undefined) {
   if (anchor !== undefined && !parsedAnchor) throw new Error('reverse pool anchor non valida');
   const next = {
     ...current,
-    schemaVersion: SCHEMA_VERSION,
+    schemaVersion: atLeastV3(current),
     ...(parsedAnchor ? { reversePoolLedgerInitialized: true, reversePoolAnchor: parsedAnchor } : {}),
   };
   const parsed = parseStore(next);
@@ -855,7 +1032,7 @@ function upgradeToReversePoolSchema(store, anchor = undefined) {
 
 function setNodeReversePool(store, name, value) {
   const current = store && getNode(store, name);
-  if (!store || store.schemaVersion !== SCHEMA_VERSION || !current) {
+  if (!store || store.schemaVersion < SCHEMA_VERSION || !current) {
     throw new Error('reverse pool richiede schema v3');
   }
   if (current.direction === 'inbound' && !parseReversePoolAnchor(store.reversePoolAnchor)) {
@@ -883,10 +1060,24 @@ function redactNode(n) {
     panelAccess: n.panelAccess === true,
     liveHostAccess: n.liveHostAccess === true,
     visibility: n.visibility || 'network',
+    // The grants this node concedes to the peer. They are decisions, not
+    // credentials, and consumers (the CLI `nodes inspect`, the inventory) derive
+    // the label and the effective vector from THESE fields: leaving them out made
+    // `inspect` read an "unconfigured" peer and print every grant as off.
+    accessConfigured: n.accessConfigured === true,
+    eventsAccess: n.eventsAccess === true,
+    nodeEventsAccess: n.nodeEventsAccess === true,
+    askReplyAccess: n.askReplyAccess === true,
+    filesReadAccess: n.filesReadAccess === true,
+    peerOperatorAccess: n.peerOperatorAccess === true,
     hasToken: !!n.token, // presenza, non il valore
     paired: !!(n.token && n.acceptToken),
   };
   if (n.identityFile || n.keyPath) out.hasIdentity = true;
+  if (n.publishRemote === true) {
+    out.publishRemote = true;
+    out.publishRemoteAudience = [...(n.publishRemoteAudience || [])];
+  }
   if (n.visibility === 'selected') out.selected = [...(n.selected || [])];
   // Lo scope celle non e' un segreto: e' una decisione dell'operatore e va
   // mostrata, come `selected`. La Settings UI deve poterla leggere per dirla.
@@ -1076,6 +1267,8 @@ module.exports = {
   // concessioni federate (preset, CAS, inventario)
   accessRevisionOf, setPeerAccessGrants, setPeerAccessPreset, accessInventory, migrateAdminReception,
   setPeerAccessGrantsCas, setPeerAccessPresetCas,
+  // host-only publication of a remote peer (schema 4, opt-in)
+  hostOnlyViolation, enablePublishRemote, disablePublishRemote, setPublishRemoteCas, backupStoreFile,
   // redazione
   redactNode, redactStore, hasPairedPeers,
   // migrazione
@@ -1083,5 +1276,5 @@ module.exports = {
   // label / slug
   nodeLabel, validLabel, sanitizeLabel, toSlug, deriveNodeHandle, suggestNodeName, LABEL_MAX,
   // costanti
-  SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
+  SCHEMA_VERSION, HOST_ONLY_SCHEMA_VERSION, PREVIOUS_SCHEMA_VERSION, LEGACY_SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
 };

package/lib/notify/ask-cell.js

@@ -0,0 +1,53 @@
+'use strict';
+// lib/notify/ask-cell.js — which cell an IMPORTED ask belongs to.
+//
+// The owner of an ask is the only node that knows its cell: it resolves the
+// ask's tmux session through its own cell definitions (a cell may declare a
+// custom tmux session, so the name is not always `cloud-<cell>`). Decoding the
+// session name here is therefore only a FALLBACK for the canonical names; for
+// any other name the cell has to come from the owner.
+//
+// Two authenticated sources carry what the owner resolved, and nothing else is
+// trusted:
+//   - `ownerCellId`: set by the event-feed client from the owner's authenticated
+//     snapshot item or live envelope (never copied from a wire field of that name);
+//   - `originCell`: the cell the origin resolver attested for an ask pushed by the
+//     owner (written by the server when the alias is created).
+// Never derived by stripping a prefix from a string, never from the local cell
+// definitions (those describe THIS node, not the owner), never from a request body.
+const { cellIdFromTmuxSession } = require('../fleet/definitions.js');
+
+const CELL_ID_RE = /^[A-Za-z0-9._-]{1,32}$/;
+function isCellId(value) { return typeof value === 'string' && CELL_ID_RE.test(value); }
+
+// -> { cellId, source, conflict? }. `source` is 'owner-feed' | 'origin-attested' |
+// 'canonical-session' | null. Two authenticated sources that disagree resolve to
+// nothing (fail closed): there is no way to tell which one is stale.
+function resolveAskCell(ask) {
+  if (!ask || typeof ask !== 'object') return { cellId: null, source: null };
+  const fromFeed = isCellId(ask.ownerCellId) ? ask.ownerCellId : null;
+  const attested = isCellId(ask.originCell) ? ask.originCell : null;
+  if (fromFeed && attested && fromFeed !== attested) return { cellId: null, source: null, conflict: true };
+  if (fromFeed) return { cellId: fromFeed, source: 'owner-feed' };
+  if (attested) return { cellId: attested, source: 'origin-attested' };
+  const decoded = cellIdFromTmuxSession(ask.session);
+  return decoded ? { cellId: decoded, source: 'canonical-session' } : { cellId: null, source: null };
+}
+
+// The same ask can be known from two places at once (the alias created when the
+// owner pushed it, the card of the owner's feed). Call this with the candidates
+// that are the SAME generation of the SAME ask. Authenticated sources outrank the
+// session decode; two authenticated sources that disagree resolve to nothing; a
+// source that knows the cell completes one that does not.
+function resolveAskCellFrom(asks) {
+  const results = asks.filter(Boolean).map(resolveAskCell);
+  const authenticated = results.filter((r) => r.cellId && r.source !== 'canonical-session');
+  const ids = new Set(authenticated.map((r) => r.cellId));
+  if (results.some((r) => r.conflict) || ids.size > 1) return { cellId: null, source: null, conflict: true };
+  if (ids.size === 1) return authenticated[0];
+  const decoded = new Set(results.filter((r) => r.cellId).map((r) => r.cellId));
+  if (decoded.size === 1) return results.find((r) => r.cellId);
+  return decoded.size > 1 ? { cellId: null, source: null, conflict: true } : { cellId: null, source: null };
+}
+
+module.exports = { resolveAskCell, resolveAskCellFrom, isCellId, CELL_ID_RE };

package/lib/notify/event-feed-client.js

@@ -11,6 +11,8 @@
 // dies by construction. Transport failures back off with jitter 5→60 s; a
 // stream silent for 60 s is aborted and resynced.
 
+const askCell = require('./ask-cell.js');
+
 const BACKOFF_MIN_MS = 5000;
 const BACKOFF_MAX_MS = 60000;
 const IDLE_TIMEOUT_MS = 60000;
@@ -259,6 +261,28 @@ function createEventFeedClient(opts = {}) {
     }
   }
 
+  // An ask of a snapshot, attributed to its owner, with the cell the OWNER
+  // resolved for it. `cellId` on the wire becomes `ownerCellId` here (validated by
+  // the schema check) and any `ownerCellId`/`originCell` the wire carried is
+  // dropped: those two names are ours, set only by authenticated ingress. When the
+  // snapshot has no cell for the ask, the cell the view already held for the SAME
+  // generation (same owner timestamp and content) is kept; a new generation never
+  // inherits it.
+  function withOwnerCell(wire, ownerId, knownCells) {
+    const { cellId, ownerCellId: _forged, originCell: _forgedOrigin, ...ask } = wire;
+    const out = { ...ask, ownerId };
+    if (askCell.isCellId(cellId)) return { ...out, ownerCellId: cellId };
+    const hit = knownCells.get(out.ownerAskId || out.id);
+    if (hit) {
+      const { askFingerprint } = require('./asks.js');
+      const priorTs = Object.hasOwn(hit.prior, 'ownerAskTs') ? hit.prior.ownerAskTs : hit.prior.ts;
+      const nextTs = Object.hasOwn(out, 'ownerAskTs') ? out.ownerAskTs : out.ts;
+      if (Number.isSafeInteger(priorTs) && priorTs > 0 && priorTs === nextTs
+        && askFingerprint(hit.prior) === askFingerprint(out)) return { ...out, ownerCellId: hit.cellId };
+    }
+    return out;
+  }
+
   // Apply a fetched snapshot ONLY if it belongs to the current generation:
   // an obsolete fetch must never overwrite a newer view (the snapshot
   // WINS over the previous view of the same owner).
@@ -268,10 +292,18 @@ function createEventFeedClient(opts = {}) {
     view.cursor = snap.cursor || null;
     // A snapshot taken before the owner processed a dismiss still carries the
     // ask: the tombstone is what keeps it from coming back.
+    // What this view already knows about the cell of each ask, taken BEFORE the
+    // view is replaced: an owner that does not publish the cell in its snapshot
+    // (older release) must not make a card forget what its live frame said.
+    const knownCells = new Map();
+    for (const prior of [...view.asks, ...(view.alertAsks ? view.alertAsks.values() : [])]) {
+      const resolved = askCell.resolveAskCell({ ownerCellId: prior.ownerCellId, originCell: prior.originCell });
+      if (resolved.cellId) knownCells.set(prior.ownerAskId || prior.id, { prior, cellId: resolved.cellId });
+    }
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
         .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch, a) && !isAskDismissed(ownerId, a))
-        .map((a) => ({ ...a, ownerId }))
+        .map((a) => withOwnerCell(a, ownerId, knownCells))
       : [];
     view.alertAsks = new Map(); // fresh snapshot replaces all live-only alert sources
     // A snapshot taken before the owner processed the dismissal still carries
@@ -405,7 +437,10 @@ function createEventFeedClient(opts = {}) {
       if (historicalAsk && typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
     } else if (f.type === 'ask') {
       const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
-        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
+        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId,
+        // The envelope of an ask frame is scoped to the cell the owner resolved;
+        // it is the owner's statement, carried on the authenticated stream.
+        ...(envelope.scope === 'cell' && askCell.isCellId(envelope.cellId) ? { ownerCellId: envelope.cellId } : {}) };
       if (!rememberLiveAsk(envelope.ownerId, ask)) return false;
       if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [ask]);
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
@@ -712,6 +747,9 @@ function createEventFeedClient(opts = {}) {
       && (a.question === undefined || typeof a.question === 'string')
       && (a.options === undefined || Array.isArray(a.options))
       && (a.session === undefined || typeof a.session === 'string')
+      // The cell the OWNER resolved for the ask: absent (an older owner, or a
+      // session the owner could not resolve) or a well-formed cell id, never anything else.
+      && (a.cellId === undefined || askCell.isCellId(a.cellId))
       && (a.ts === undefined || typeof a.ts === 'number');
     if (!snap.asks.every(askFieldsOk)) return schema('asks');
     return { ok: true };

package/lib/notify/event-feed-routes.js

@@ -14,6 +14,7 @@
 const express = require('express');
 const nodesStore = require('../nodes/store.js');
 const eventFeedAcl = require('./event-feed-acl.js');
+const askCell = require('./ask-cell.js');
 
 const SNAPSHOT_MAX_BYTES = 3 * 1024 * 1024;
 const SNAPSHOT_MAX_ASKS = 100;
@@ -241,8 +242,13 @@ function createEventFeedRoutes(deps) {
         // guardia e' esplicita sui campi di provenienza, non dedotta dalla
         // visibilita' della cella.
         .filter((a) => !a.originNode && !(a.ownerId && self && a.ownerId !== self))
-        .map((a) => ({ id: a.id, question: a.question, options: a.options, session: a.session, ts: a.ts }))
-        .filter((a) => peer.allows({ scope: 'cell', cellId: cellForSession(a.session) }));
+        // The cell is resolved ONCE, by this owner, through its own definitions, and
+        // it travels with the ask: a session with a custom tmux name does not decode
+        // to a cell on the receiving side, and the receiver must not guess it. Only
+        // a well-formed id is published; an unresolved one is simply absent.
+        .map((a) => ({ id: a.id, question: a.question, options: a.options, session: a.session, ts: a.ts, cell: cellForSession(a.session) }))
+        .filter((a) => peer.allows({ scope: 'cell', cellId: a.cell }))
+        .map(({ cell, ...ask }) => (askCell.isCellId(cell) ? { ...ask, cellId: cell } : ask));
       askSourceCount = visible.length;
       asks = visible.slice(0, SNAPSHOT_MAX_ASKS);
     } catch (e) {