@mmmbuto/nexuscrew 0.9.65 → 0.9.67

package/lib/server.js

@@ -58,6 +58,7 @@ const { createCellScopeGuard } = require('./cells/scope-guard.js');
 const { createCellScope } = require('./cells/scope.js');
 const { cellIdFromTmuxSession } = require('./fleet/definitions.js');
 const { createOwnerAskScope } = require('./notify/owner-ask-scope.js');
+const askCell = require('./notify/ask-cell.js');
 // Budget a tre finestre, riusato dalle notifiche federate: e' gia' scritto per
 // limitare il danno di un nodo che mente sulla propria cella (il tetto per
 // target si calcola sul NODO, che la catena visited verifica).
@@ -500,7 +501,7 @@ function createServer(opts = {}) {
     if (!st) return null;
     const node = nodesStore.getNode(st, name);
     if (!node) return null;
-    return { localPort: node.localPort, token: node.token || null };
+    return { localPort: node.localPort, token: node.token || null, hostOnly: node.publishRemote === true };
   }
 
   const runtimePort = () => (server && server.address() ? server.address().port : cfg.port);
@@ -993,6 +994,15 @@ function createServer(opts = {}) {
     const resource = req.url.slice(i + 2);
     if (!/^\/panel\/[A-Za-z0-9._-]{1,32}(?:\/.*)?$/.test(resource)) return next();
     if (req.method === 'POST' && /^\/panel\/[A-Za-z0-9._-]{1,32}\/ticket\/?$/.test(resource)) return next();
+    // The unauthenticated door exists only for a browser frame, which carries no
+    // header and arrives on this machine's own listener. It never opens for: a
+    // request with ANY Authorization (the local token goes through requireToken like
+    // every other /api call; a peer's token is not the owner's); a request that came
+    // in on a peer-bound reverse listener; a route that names a host-only peer at
+    // any hop. Those fall through to requireToken, whatever the first hop is.
+    const onPeerListener = reverseSlotListeners && reverseSlotListeners.isSlotPort(req.socket && req.socket.localPort);
+    if (bearerFrom(req) || onPeerListener
+      || federation.touchesHostOnly(nodesPath, { route: federation.routeNamesOf(req.url) })) return next();
     panelFederatoRouter(req, res, next);
   });
   api.use(requireToken(tokenStore));
@@ -1160,12 +1170,28 @@ function createServer(opts = {}) {
     }
     return out;
   };
-  api.get('/config', (_req, res) => res.json({
+  // A host-only peer is named only to the readers it is published to; a federated
+  // reader is identified by the verified hop proof, never by the bare header.
+  const hostOnlyNodesFor = (req) => {
+    const st = nodesStore.loadStore(nodesPath);
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    if (!st || vis.unreadable) return [];
+    return st.nodes.filter((n) => n.publishRemote === true && !vis.hiddenNames.has(n.name)).map((n) => n.name);
+  };
+  const nodePanelPortsFor = (req) => {
+    const out = nodePanelPorts();
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    for (const name of vis.hiddenNames) delete out[name];
+    if (vis.unreadable) return {};
+    return out;
+  };
+  api.get('/config', (req, res) => res.json({
     readonlyDefault: cfg.readonlyDefault, version: VERSION, uiVersion: uiBuildVersion(distDir),
     bind: cfg.bind, port: cfg.port, panelPort: cfg.panelPort,
     protectSharedTmuxServer: cfg.protectSharedTmuxServer !== false,
     instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
-    nodePanelPorts: nodePanelPorts(),
+    nodePanelPorts: nodePanelPortsFor(req),
+    hostOnlyNodes: hostOnlyNodesFor(req),
     presets: ['shell', 'claude', 'codex-vl', 'pi', ...Object.keys(cfg.sessionPresets || {})],
     // i parametri del terminale sono configurabili dal server e leggibili
     // dal client (che ne ha comunque i default iniettabili).
@@ -1519,15 +1545,32 @@ function createServer(opts = {}) {
     // Guards and alias mutation belong only to the selected generation.
     const alias = storedAlias && ask && asksStore.sameImportedGeneration(storedAlias, ask) ? storedAlias : null;
     const grants = peer && accessPresets.grantsOf(peer);
-    const cellId = ask ? cellIdFromTmuxSession(ask.session) : previous && previous.cellId;
-    const visible = !!((ask || previous) && cellId && grants && grants.configured && grants.grants.eventsAccess === true
+    // The cell comes from what the OWNER resolved (feed or attested origin) and,
+    // only for canonical names, from the session; see lib/notify/ask-cell.js. A
+    // body field is never consulted: the dismissal request carries no cell.
+    // The selected ask keeps its OWN cell. The other source (alias <-> feed card)
+    // lends its cell only when it is bound to the same generation by an explicit,
+    // equal owner timestamp and the same content: a generation that is unknown
+    // on either side is not "the same" for a cell (sameImportedGeneration stays
+    // permissive about it, because guards and alias mutation want that). If both
+    // sources are authenticated and disagree there is no cell at all.
+    const boundToSelected = item => item === ask || (tsOf(item) !== null && tsOf(item) === tsOf(ask)
+      && asksStore.askFingerprint(item) === asksStore.askFingerprint(ask));
+    const sameAsk = ask && [storedAlias, feedAsk].filter(item => item && boundToSelected(item));
+    const cellId = ask ? askCell.resolveAskCellFrom(sameAsk).cellId : previous && previous.cellId;
+    const grantsAllowFeed = !!(grants && grants.configured && grants.grants.eventsAccess === true);
+    const visible = !!((ask || previous) && cellId && grantsAllowFeed
       && eventFeedAcl.visibilityAllows(grants.grants, cellId));
+    // The ask is known and this node may read the owner's feed, but no
+    // authenticated source tells which cell it belongs to (a card persisted by an
+    // older release, an owner that does not publish the cell): said, not guessed.
+    const cellUnresolved = !!(ask && !cellId && grantsAllowFeed);
     const blocked = !!((ask && ask.answered) || (alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
       || askRelay.state().some(attempt => attempt.ownerId === ownerId && attempt.askId === askId && ['sent', 'uncertain'].includes(attempt.state)));
     const slot = peer && peer.reversePool && peer.reversePool.slots && peer.reversePool.slots[peer.reversePool.activeSlot];
     const unavailable = !!(peer && peer.direction === 'inbound' && (!peer.shared || !slot || !Number.isInteger(slot.port)))
       || askRelay.channelState(ownerId).unavailable;
-    return { peer, alias, previous, ask, grants, cellId, visible, blocked: blocked || ambiguous, unavailable, ambiguous };
+    return { peer, alias, previous, ask, grants, cellId, visible, cellUnresolved, blocked: blocked || ambiguous, unavailable, ambiguous };
   }
   api.post('/asks-relay', express.json({ limit: '8kb' }), async (req, res) => {
     try {
@@ -1541,8 +1584,13 @@ function createServer(opts = {}) {
         }
         try { if (!asksStore.health().readable) return res.status(503).json({ error: 'dismissal store unavailable' }); }
         catch (_) { return res.status(503).json({ error: 'dismissal store unavailable' }); }
-        const { peer, alias, previous, ask, grants, cellId, visible, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
-        if (!visible) return res.status(404).json({ error: 'unknown or invisible ask' });
+        const { peer, alias, previous, ask, grants, cellId, visible, cellUnresolved, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
+        if (!visible) {
+          if (cellUnresolved) {
+            return res.status(409).json({ error: 'the cell of this ask is not known from an authenticated owner source; refresh the owner view', reason: 'cell-unresolved' });
+          }
+          return res.status(404).json({ error: 'unknown or invisible ask' });
+        }
         if (ambiguous) return res.status(409).json({ error: 'ask generation is ambiguous; refresh the owner view', reason: 'generation-ambiguous' });
         if (ask && ask.answered) return res.status(409).json({ error: 'ask already answered', reason: 'answered' });
         if ((alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
@@ -1890,6 +1938,9 @@ function createServer(opts = {}) {
       },
       localPort: () => (server && server.address() ? server.address().port : cfg.port),
       localToken: () => tokenHolder.value,
+      // A federated request that terminates here is never re-sent to a host-only
+      // peer (checked on the target and route actually resolved, store read now).
+      federatedGuard: ({ target, route }) => federation.touchesHostOnly(nodesPath, { target, route }),
     }),
     getGroup: (name) => audioGroups.getGroup(audioCfg, name, audioHome),
   }));
@@ -1948,7 +1999,15 @@ function createServer(opts = {}) {
       peers: federatedPeers,
       localPort: () => (server && server.address() ? server.address().port : cfg.port),
       localToken: () => tokenHolder.value,
+      // Never designate, query or bridge to a host-only peer, whatever the route.
+      ownerGuard: ({ target, route }) => federation.touchesHostOnly(nodesPath, { target, route }),
     }),
+    // A designation that already points at a host-only peer is not shown to a
+    // federated reader outside its audience (it would name the peer).
+    ownerHiddenFor: (req, ownerId) => {
+      const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+      return vis.unreadable || vis.hiddenIds.has(ownerId);
+    },
     originResolver: createOriginResolver({ localNodeId: federatedNodeId, hopSecret: () => hopSecret }),
     federatedRate: createSpeakRateLimiter(),
   }));
@@ -1958,6 +2017,30 @@ function createServer(opts = {}) {
   api.use('/vl-nodes', vlNodeApiRoutes({
     storePath: vlNodesPath, broker: vlNodeBroker, ownerId: vlOwnerId, readonly: proxyReadonly,
   }));
+  // A deck keeps references to nodes (tiles, floating windows): those that point at a host-only peer are not
+  // served to a federated reader outside its audience, in any answer (the 409 carries the current deck too).
+  api.use('/decks', (req, res, next) => {
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    if (!vis.hiddenNames.size && !vis.hiddenIds.size && !vis.unreadable) return next();
+    // A reader served a filtered deck must not be able to save it back and erase what it was not shown:
+    // changing a deck that carries references it cannot see is refused (and says nothing about them).
+    if (req.method !== 'GET' && req.method !== 'HEAD' && req.method !== 'OPTIONS') {
+      const first = String(req.url || '').split('?')[0].split('/').filter(Boolean)[0];
+      let target = null; try { target = first ? decodeURIComponent(first) : null; } catch (_) { target = ''; }
+      if (vis.unreadable) return res.status(503).json({ error: 'non disponibile' });
+      let hiddenContent = false;
+      try {
+        // creating a deck (no name in the path) overwrites nothing: only the deck being changed is looked at
+        const st = target === null ? null : decksStore.loadStore(decksPath);
+        const touched = (st ? st.decks : []).filter((d) => d.name === target);
+        hiddenContent = touched.some((d) => JSON.stringify(federation.redactHostOnlyReferences(d, vis)) !== JSON.stringify(d));
+      } catch (_) { return res.status(503).json({ error: 'non disponibile' }); }
+      if (hiddenContent) return res.status(403).json({ error: 'deck non modificabile da questo nodo', reason: 'deck-has-hidden-content' });
+    }
+    const json = res.json.bind(res);
+    res.json = (body) => json(vis.unreadable ? { error: 'non disponibile' } : federation.redactHostOnlyReferences(body, vis));
+    return next();
+  });
   api.use('/decks', decksRoutes({ cfg, decksPath }));
   api.use('/prefs', prefsRoutes({ cfg, prefsPath }));
   api.use('/fs', fsRoutes({ home: os.homedir() }));  // folder-picker del dialog new session
@@ -2044,9 +2127,37 @@ function createServer(opts = {}) {
     audio: { adapter: audioAdapter, queue: audioQueue },
     reverseSlots: { ensure: startRotatableReverse, close: stopRotatableReverse, verify: verifyRotatablePool },
   }));
+  // Records that name a host-only peer are served only to the readers it is
+  // published to. The WHOLE record is inspected (name or id anywhere in it).
+  api.use('/diagnostics', (req, res, next) => {
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    if (!vis.hiddenNames.size && !vis.hiddenIds.size && !vis.unreadable) return next();
+    const esc = (v) => String(v).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const names = [...vis.hiddenNames].map((n) => new RegExp(`(^|[^A-Za-z0-9_-])${esc(n)}([^A-Za-z0-9_-]|$)`));
+    const ids = [...vis.hiddenIds];
+    const mentions = (rec) => { const t = JSON.stringify(rec); return ids.some((id) => t.includes(id)) || names.some((re) => re.test(t)); };
+    const json = res.json.bind(res);
+    res.json = (body) => {
+      if (vis.unreadable) return json({ error: 'non disponibile' });
+      if (body && Array.isArray(body.records)) return json({ ...body, records: body.records.filter((r) => !mentions(r)) });
+      return json(body);
+    };
+    return next();
+  });
   api.use('/diagnostics', diagnosticsRoutes({ diagnostics, readonly: proxyReadonly }));
-  api.get('/topology', async (_req, res) => {
-    try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
+  api.get('/topology', async (req, res) => {
+    try {
+      // What was hidden when the request began stays hidden: a publication that ends during the wait does not
+      // hand its leaf to a reader that was not allowed to see it when it asked.
+      const visBefore = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+      const topo = await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath });
+      // Decided AFTER the fan-out wait and on the final result, cache and stale
+      // entries included: the policy is read again now, not before the await.
+      const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+      if (vis.unreadable || visBefore.unreadable) return res.json({ instanceId: topo && topo.instanceId, nodes: [] });
+      const merged = { hiddenNames: new Set([...visBefore.hiddenNames, ...vis.hiddenNames]), hiddenIds: new Set([...visBefore.hiddenIds, ...vis.hiddenIds]) };
+      res.json({ ...topo, nodes: federation.hideHostOnlyEntries(topo && topo.nodes, merged) });
+    }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   api.use('/route', federation.localRouter({
@@ -2185,7 +2296,10 @@ function createServer(opts = {}) {
       // emesso): transita e decide il proprietario, gate panelAccess compreso
       // — stessa forma del bypass HTTP sulle panel-resource federate.
       const panelFederato = /^\/api\/route\/[^?#]*\/_\/panel\/[A-Za-z0-9._-]{1,32}(?:\/.*)?$/.test(pathname)
-        && /(?:^|;\s*)npanel=/.test(String(req.headers.cookie || ''));
+        && /(?:^|;\s*)npanel=/.test(String(req.headers.cookie || ''))
+        && !bearerFrom(req) && !u.searchParams.get('token')
+        && !(reverseSlotListeners && reverseSlotListeners.isSlotPort(req.socket && req.socket.localPort))
+        && !federation.touchesHostOnly(nodesPath, { route: federation.routeNamesOf(pathname.slice('/api/route'.length)) });
       if (!panelFederato && !verify(tokenHolder.value, given)) return socket.destroy();
       federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: runtimePort, localCredential: () => tokenHolder.value, ingress: null, readonly: proxyReadonly, activeSockets: proxySockets, hopSecret: () => hopSecret, hubAttaches });
       return;
@@ -2273,7 +2387,7 @@ function createServer(opts = {}) {
 
   return {
     app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater, diagnostics,
-    panelApp, panelServer, panelServerV6,
+    panelApp, panelServer, panelServerV6, reverseSlotListeners,
     // Test/observability seam: publish a normalized state event through the
     // same per-peer projection the local producers use.
     notify: { publishState: notifier.publishState },

package/lib/settings/routes.js

@@ -710,6 +710,12 @@ function settingsRoutes(deps = {}) {
     if (!node) return send(res, 404, { error: `nodo sconosciuto "${name}"` });
     if (node.direction !== 'outbound') return send(res, 409, { error: 'Share si attiva sul dispositivo che possiede la connessione SSH' });
     if (!node.token || !node.nodeId) return send(res, 409, { error: 'nodo non associato: ripeti il pairing' });
+    // A host-only peer (publish-remote) is published ONE WAY to our own admin
+    // nodes; Share would publish THIS node on it. Refuse before any SSH restart
+    // or reverse negotiation is attempted (turning Share off stays possible).
+    if (node.publishRemote === true && body.shared) {
+      return send(res, 409, { error: 'publish-remote attivo su questo peer: Share resta spento (spegni prima publish-remote)', reason: 'publish-remote-active' });
+    }
     if (body.shared && !nodesStore.isPort(node.reversePort)) {
       return send(res, 409, { error: 'canale share non negoziato: ripeti il pairing' });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.65",
+  "version": "0.9.67",
   "description": "Faithful browser tmux client \u2014 attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {