@mmmbuto/nexuscrew 0.9.66 → 0.9.67

package/frontend/dist/index.html

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-DhZOap1-.js"></script>
+  <script type="module" crossorigin src="/assets/index-D__76yWR.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-Dwd37Z_R.css">
 </head>
 <body>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.66"}
+{"version":"0.9.67"}

package/lib/audio/dispatch.js

@@ -30,6 +30,10 @@ function createDispatcher(opts = {}) {
   // stesso percorso e rispondono `delivered`. Il default resta quello audio,
   // cosi' nessun chiamante esistente cambia comportamento.
   const statuses = opts.statuses instanceof Set ? opts.statuses : PER_ENDPOINT_STATUS;
+  // Policy for requests that arrived FEDERATED and terminate here: re-read on the
+  // resolution used for the I/O, just before the request leaves. Local callers are
+  // never subject to it.
+  const federatedGuard = typeof opts.federatedGuard === 'function' ? opts.federatedGuard : null;
 
   function isLocal(target) {
     const self = localNodeId();
@@ -143,10 +147,19 @@ function createDispatcher(opts = {}) {
     resolveRoute,
     probeCapability,
     // dispatch(): unico ingresso per un target remoto.
-    async dispatch({ resource, target, origin, payload }) {
+    async dispatch({ resource, target, origin, payload, federated = false }) {
+      // What the policy says when the request begins counts too: a publication that ends while the topology is
+      // awaited does not turn the request into an allowed one.
+      let deniedBefore = false;
+      if (federated && federatedGuard) { try { deniedBefore = federatedGuard({ target, route: [] }) !== false; } catch (_) { deniedBefore = true; } }
       const resolved = await resolveRoute(target);
       if (resolved.error === 'invalid-target') return { status: 'refused', reason: 'invalid-target' };
       if (resolved.error) return { status: 'unreachable', reason: resolved.error };
+      if (federated && federatedGuard) {
+        let denied = true;
+        try { denied = federatedGuard({ target, route: resolved.route, peer: resolved.peer }) !== false; } catch (_) { denied = true; }
+        if (denied || deniedBefore) return { status: 'refused', reason: 'host-only-target' };
+      }
       return forward(resource, resolved.route, {
         ...payload,
         target,

package/lib/audio/routes.js

@@ -251,7 +251,7 @@ function audioRoutes(deps = {}) {
         origin, target, status: 'accepted', utteranceId, attested: trust === 'federated',
       });
       const out = await dispatcher.dispatch({
-        resource: '/audio/speak', target, origin,
+        resource: '/audio/speak', target, origin, federated: trust === 'federated',
         payload: {
           text: parsed.text, lang: parsed.lang, voice: parsed.voice, urgency: parsed.urgency,
           utteranceId: local.utteranceId,
@@ -285,7 +285,7 @@ function audioRoutes(deps = {}) {
     const { target } = parsed;
     if (dispatcher && isValidInstance(target) && !dispatcher.isLocal(target)) {
       const out = await dispatcher.dispatch({
-        resource: '/audio/stop', target, origin,
+        resource: '/audio/stop', target, origin, federated: resolved.trust === 'federated',
         payload: { ...(parsed.utteranceId ? { utteranceId: parsed.utteranceId } : {}) },
       });
       return send(res, out.status === 'accepted' ? 200 : out.status === 'unreachable' ? 503 : 422, out);

package/lib/live-host/federation.js

@@ -30,6 +30,9 @@ function createLiveHostFederation({
   localToken = () => '',
   fetchImpl = fetch,
   timeoutMs = FED_TIMEOUT_MS,
+  // Refuses an owner that is (or routes through) a host-only peer. Read on the
+  // resolution used for the I/O, just before the request leaves.
+  ownerGuard = null,
 } = {}) {
   async function resolveRoute(target) {
     if (!INSTANCE_ID_RE.test(String(target || ''))) return { error: 'invalid-target' };
@@ -48,11 +51,18 @@ function createLiveHostFederation({
   }
 
   async function forward(target, resource, method, body) {
+    let deniedBefore = false;
+    if (typeof ownerGuard === 'function') { try { deniedBefore = ownerGuard({ target, route: [] }) !== false; } catch (_) { deniedBefore = true; } }
     const resolved = await resolveRoute(target);
     if (resolved.error) return { ok: false, reason: resolved.error === 'invalid-target' ? 'invalid-target' : 'live-host-owner-unreachable' };
     const port = localPort();
     const token = localToken();
     if (!port || !token) return { ok: false, reason: 'live-host-owner-unreachable' };
+    if (typeof ownerGuard === 'function') {
+      let denied = true;
+      try { denied = ownerGuard({ target, route: resolved.route }) !== false; } catch (_) { denied = true; }
+      if (denied || deniedBefore) return { ok: false, reason: 'live-host-owner-unreachable' };
+    }
     const url = `http://127.0.0.1:${port}/api/route/${resolved.route.join('/')}/_${resource}`;
     let res;
     try {

package/lib/live-host/routes.js

@@ -95,7 +95,10 @@ function liveHostRoutes({ fleetP, store, readonly = () => false, now = () => Dat
   // verifica (prova di hop + catena `visited` costruita dal server), e il budget
   // del ponte si applica per NODO mittente ATTESTATO — stessa regola e stessi
   // limiti dell'audio (lib/audio/rate-limit.js).
-  federation = null, originResolver = null, federatedRate = null }) {
+  federation = null, originResolver = null, federatedRate = null,
+  // (req, ownerId) => true when this reader must not learn that the designation
+  // points at a host-only peer.
+  ownerHiddenFor = null }) {
   const r = express.Router();
 
   // Una designazione con `ownerId` e' REMOTA: il puntamento vive qui,
@@ -124,11 +127,18 @@ function liveHostRoutes({ fleetP, store, readonly = () => false, now = () => Dat
   // hostCell e revision vengono dallo store (preservato); eligible e' la verita'
   // COMPOSTA roster+lease (si veda hostLeaseState sopra); host.lease espone lo
   // stato del lease della cella designata, distinto, perche' chi legge distingue.
-  r.get('/', async (_req, res) => {
+  r.get('/', async (req, res) => {
     try {
       const snap = store.snapshot();
+      if (snap.hostCell != null && snap.ownerId && ownerHiddenFor && ownerHiddenFor(req, snap.ownerId)) {
+        return res.json({ hostCell: null, revision: snap.revision, eligible: false, threadStatus: 'absent', host: { lease: null }, at: now() });
+      }
       if (snap.hostCell != null && snap.ownerId) {
         const remote = await remoteOwnerState(snap);
+        // the reader is judged again after the wait: a publication that changed meanwhile must not name the owner
+        if (ownerHiddenFor && ownerHiddenFor(req, snap.ownerId)) {
+          return res.json({ hostCell: null, revision: snap.revision, eligible: false, threadStatus: 'absent', host: { lease: null }, at: now() });
+        }
         return res.json({
           hostCell: snap.hostCell, revision: snap.revision, ownerId: snap.ownerId, remote: true,
           eligible: remote.state ? remote.state.eligible : false,

package/lib/nodes/reverse-slot-listeners.js

@@ -83,7 +83,10 @@ function createReverseSlotListeners({ app, createServerImpl = http.createServer,
     return true;
   }
 
-  return { open, closePort, closeAll, respond, size: () => listeners.size };
+  // A request that arrived on one of these listeners comes from a peer's channel,
+  // never from this machine's own browser: callers use it to tell the two apart.
+  const isSlotPort = (localPort) => listeners.has(localPort);
+  return { open, closePort, closeAll, respond, isSlotPort, size: () => listeners.size };
 }
 
 module.exports = { createReverseSlotListeners };

package/lib/nodes/store.js

@@ -958,8 +958,16 @@ function backupStoreFile(filePath, now = new Date()) {
   const data = fs.readFileSync(filePath);
   const sha256 = crypto.createHash('sha256').update(data).digest('hex');
   const stamp = now.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
-  const target = `${filePath}.pre-publish-remote-${stamp}-${sha256.slice(0, 8)}.bak`;
-  fs.writeFileSync(target, data, { mode: 0o600, flag: 'wx' });   // wx: never overwrite a previous backup
+  // wx: never overwrite a previous backup. Two backups of the same bytes in the same second get distinct names
+  // (a numeric suffix) instead of failing the opt-in.
+  let target = '';
+  for (let n = 0; ; n += 1) {
+    target = `${filePath}.pre-publish-remote-${stamp}-${sha256.slice(0, 8)}${n ? `-${n}` : ''}.bak`;
+    try { fs.writeFileSync(target, data, { mode: 0o600, flag: 'wx' }); break; } catch (e) {
+      if (e && e.code === 'EEXIST' && n < 1000) continue;
+      throw e;
+    }
+  }
   fs.chmodSync(target, 0o600);
   return { path: target, sha256 };
 }

package/lib/proxy/federation.js

@@ -3,6 +3,8 @@
 const { createAskSlotVerifier, askSlotVerifier, binding: askSlotBinding } = require('../nodes/ask-slot-verifier.js');
 const http = require('node:http');
 const net = require('node:net');
+const fs = require('node:fs');
+const path = require('node:path');
 const crypto = require('node:crypto');
 const express = require('express');
 const { WebSocketServer } = require('ws');
@@ -15,9 +17,9 @@ const { bearerFrom } = require('../auth/middleware.js');
 const { safeEqual } = require('../nodes/peering.js');
 const { probeReverseSlot } = require('../nodes/reverse-slot-proof.js');
 const {
-  sanitizeRequestHeaders, sanitizeResponseHeaders, stripLocalTokenQuery,
+  sanitizeRequestHeaders, sanitizeResponseHeaders, sanitizeHostOnlyResponseHeaders, hostOnlyHeadFilter, stripLocalTokenQuery,
 } = require('./node-proxy.js');
-const { signHop, HOP_HEADER } = require('./hop-proof.js');
+const { signHop, verifyHop, HOP_HEADER } = require('./hop-proof.js');
 const { COOKIE_NAME: PANEL_COOKIE_NAME } = require('./panel-auth.js');
 
 const MAX_HOPS = 4;
@@ -144,6 +146,175 @@ function canTransit(ingress, egress) {
     && peerAllows(ingress, egress.nodeId) && peerAllows(egress, ingress.nodeId);
 }
 
+// The audience decision for a CHAIN, not only for the last hop. A host-only peer
+// is published to its audience: every node that took part in the request (the
+// ones in `visited`, this node excluded) must be an audience member that still
+// holds the operator grant. An id this node does not know is refused — the chain
+// is what the peers declared, so only what the local store can vouch for counts.
+function chainInAudience(st, chain, egress) {
+  if (!isHostOnlyPeer(egress)) return true;
+  if (!st || !Array.isArray(st.nodes) || !Array.isArray(chain)) return false;
+  for (const id of chain) {
+    if (id === st.nodeId) continue;
+    const reader = st.nodes.find((n) => n && n.nodeId === id);
+    if (!reader || !audienceAllows(reader, egress)) return false;
+  }
+  return true;
+}
+
+// Does this target, or any hop of the route to it, resolve to a host-only peer
+// of THIS node? Read from the store at the time of the call, never from a cache.
+function touchesHostOnly(nodesPath, { target = null, route = [] } = {}) {
+  const st = store.loadStore(nodesPath);
+  if (!st) return true; // fail closed: an unreadable store vouches for nothing
+  const names = Array.isArray(route) ? route : [];
+  return st.nodes.some((n) => isHostOnlyPeer(n) && ((target && n.nodeId === target) || names.includes(n.name)));
+}
+
+// The first segments of `/<hop>/<hop>/_/...` (what is left after the /route mount).
+function routeNamesOf(rest) {
+  const parts = String(rest || '').split('?')[0].split('/').filter(Boolean);
+  const idx = parts.indexOf(ROUTE_DELIMITER);
+  return idx < 0 ? [] : parts.slice(0, idx);
+}
+
+// The identity of the caller of a LOCAL API handler that is the last hop of a
+// federated route. It exists only when the hop header verifies (HMAC over method,
+// path and chain, the same proof audio/origin.js reads); the bare presence of the
+// header proves nothing. Returns the verified chain, or null.
+function verifiedHopChain(req, st, hopSecret) {
+  const headers = (req && req.headers) || {};
+  const proof = headers[HOP_HEADER];
+  const secret = typeof hopSecret === 'function' ? hopSecret() : hopSecret;
+  const visited = String(headers['x-nexuscrew-visited'] || '').split(',').filter(Boolean);
+  if (!secret || !st || typeof proof !== 'string' || visited.length < 2 || visited.length > MAX_HOPS + 1) return null;
+  if (visited.some((id) => !store.NODE_ID_RE.test(id)) || new Set(visited).size !== visited.length) return null;
+  if (visited.at(-1) !== st.nodeId) return null;
+  if (!verifyHop(secret, { method: req.method || 'GET', path: req.originalUrl || req.url, visited }, proof)) return null;
+  return visited;
+}
+
+// Which host-only peers a local API caller must NOT learn about. The owner (a
+// request without the hop header) sees everything; a federated caller sees only
+// the peers whose audience contains its whole verified chain; any header that
+// does not verify, or an unknown id, hides all of them. Read fresh each time.
+function hostOnlyVisibility(nodesPath, req, hopSecret) {
+  const hiddenNames = new Set(); const hiddenIds = new Set();
+  const federated = Boolean(req && req.headers && req.headers[HOP_HEADER] !== undefined);
+  // The owner (no hop header) is never filtered, whatever the state of the store.
+  if (!federated) return { hiddenNames, hiddenIds, unreadable: false };
+  const st = store.loadStore(nodesPath);
+  if (!st) return { hiddenNames, hiddenIds, unreadable: true };
+  const chain = verifiedHopChain(req, st, hopSecret);
+  for (const n of st.nodes) {
+    if (!isHostOnlyPeer(n)) continue;
+    const visible = chain !== null && chainInAudience(st, chain, n);
+    if (!visible) { hiddenNames.add(n.name); if (n.nodeId) hiddenIds.add(n.nodeId); }
+  }
+  return { hiddenNames, hiddenIds, unreadable: false };
+}
+
+// Topology entries of hidden host-only peers, and anything announced behind one.
+function hideHostOnlyEntries(nodes, vis) {
+  if (!Array.isArray(nodes) || (!vis.hiddenNames.size && !vis.hiddenIds.size)) return nodes;
+  return nodes.filter((e) => !vis.hiddenIds.has(e && e.instanceId)
+    && !(e && Array.isArray(e.route) && e.route.some((name) => vis.hiddenNames.has(name))));
+}
+
+// Removes, from any JSON value, the objects that point at a hidden host-only peer: by route name (`node`, a path of
+// names, or `route`), or by instance id (`ownerId`, `nodeId`, `instanceId`). Used on the answers of handlers that
+// store references to nodes (decks).
+function redactHostOnlyReferences(value, vis) {
+  if (!vis || (!vis.hiddenNames.size && !vis.hiddenIds.size)) return value;
+  const points = (o) => o && typeof o === 'object' && !Array.isArray(o) && (
+    (typeof o.node === 'string' && o.node.split('/').some((n) => vis.hiddenNames.has(n)))
+    || ['ownerId', 'nodeId', 'instanceId'].some((k) => typeof o[k] === 'string' && vis.hiddenIds.has(o[k]))
+    || (Array.isArray(o.route) && o.route.some((n) => vis.hiddenNames.has(n))));
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.filter((e) => !points(e)).map(walk);
+    if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)]));
+    return v;
+  };
+  return walk(value);
+}
+
+// Streams (SSE, WebSocket) opened towards a host-only peer for a peer caller:
+// the authorization is re-read about every second and a stream that no longer
+// passes (audience, operator grant, mode off, peer or reader removed, store
+// unreadable) is closed. Owner streams are not tracked.
+const HOST_ONLY_RECHECK_MS = 1000;
+const hostOnlyStreams = new Set();
+let hostOnlyTimer = null;
+const credentialFingerprint = (v) => crypto.createHash('sha256').update(String(v || '')).digest('hex');
+// The generation of the publication a stream was opened under. Every opt-in takes its
+// own full backup next to the store (never overwritten), so the SET of those backups
+// changes whenever the mode is turned on again — even with the same audience, even
+// within the same second (names are not ordered in time, so the whole set is read, not
+// the "newest"). A removed backup changes it too. Unreadable directory: a value that
+// never matches (fail closed).
+function publicationGeneration(nodesPath) {
+  try {
+    const base = `${path.basename(nodesPath)}.pre-publish-remote-`;
+    const names = fs.readdirSync(path.dirname(nodesPath)).filter((n) => n.startsWith(base) && n.endsWith('.bak')).sort();
+    return crypto.createHash('sha256').update(names.join('\n')).digest('hex');
+  } catch (_) { return `unreadable:${Date.now()}:${Math.random()}`; }
+}
+const audienceFingerprint = (egress) => crypto.createHash('sha256').update(JSON.stringify([...(egress.publishRemoteAudience || [])].sort())).digest('hex');
+function hostOnlyGuardFor(nodesPath, ingress, egress, visited) {
+  return {
+    nodesPath, ingressNodeId: ingress.nodeId, ingressFp: credentialFingerprint(ingress.acceptToken),
+    egressName: egress.name, egressNodeId: egress.nodeId, egressPort: egress.localPort,
+    egressFp: credentialFingerprint(egress.token),
+    audienceFp: audienceFingerprint(egress), generation: publicationGeneration(nodesPath), visited,
+  };
+}
+// A stream opened through a peer that was NOT host-only keeps the behaviour it always had, with one exception: when
+// the publication is turned ON for that peer, every federated stream in flight through it ends.
+function plainStreamGuardFor(nodesPath, egress) {
+  return { plain: true, nodesPath, egressName: egress.name, egressNodeId: egress.nodeId };
+}
+function streamGuardFor(nodesPath, ingress, egress, visited) {
+  return isHostOnlyPeer(egress) ? hostOnlyGuardFor(nodesPath, ingress, egress, visited) : plainStreamGuardFor(nodesPath, egress);
+}
+function hostOnlyStreamAllowed(guard, loaded) {
+  const st = loaded === undefined ? store.loadStore(guard.nodesPath) : loaded;
+  if (guard.plain) {
+    if (!st) return true;                                  // a plain stream is not judged on an unreadable store
+    return !st.nodes.some((n) => n && n.nodeId === guard.egressNodeId && isHostOnlyPeer(n));
+  }
+  if (!st) return false;
+  const egress = store.getNode(st, guard.egressName);
+  const reader = st.nodes.find((n) => n && n.nodeId === guard.ingressNodeId);
+  if (!egress || !reader || !egress.token || !canTransit(reader, egress)) return false;
+  // The stream was opened under a host-only publication: it lives only while THAT publication
+  // is what authorizes it. Legacy sharing (shared=true after an off) is a different authorization.
+  if (!isHostOnlyPeer(egress)) return false;
+  if (audienceFingerprint(egress) !== guard.audienceFp || publicationGeneration(guard.nodesPath) !== guard.generation) return false;
+  // Same identities and credentials that were authenticated when the stream opened.
+  if (credentialFingerprint(reader.acceptToken) !== guard.ingressFp || credentialFingerprint(egress.token) !== guard.egressFp
+    || egress.nodeId !== guard.egressNodeId || egress.localPort !== guard.egressPort) return false;
+  return chainInAudience(st, guard.visited, egress);
+}
+function trackHostOnlyStream(guard, close) {
+  if (!guard) return () => {};
+  const entry = { guard, close };
+  hostOnlyStreams.add(entry);
+  if (!hostOnlyTimer) {
+    hostOnlyTimer = setInterval(() => {
+      const loaded = new Map();                            // the store is read once per file per tick
+      const load = (p) => { if (!loaded.has(p)) { let v = null; try { v = store.loadStore(p); } catch (_) { v = null; } loaded.set(p, v); } return loaded.get(p); };
+      for (const e of [...hostOnlyStreams]) {
+        let ok = false;
+        try { ok = hostOnlyStreamAllowed(e.guard, load(e.guard.nodesPath)); } catch (_) { ok = e.guard.plain === true; }
+        if (!ok) { hostOnlyStreams.delete(e); try { e.close(); } catch (_) { /* gone */ } }
+      }
+      if (!hostOnlyStreams.size) { clearInterval(hostOnlyTimer); hostOnlyTimer = null; }
+    }, HOST_ONLY_RECHECK_MS);
+    if (typeof hostOnlyTimer.unref === 'function') hostOnlyTimer.unref();
+  }
+  return () => { hostOnlyStreams.delete(entry); };
+}
+
 function parseRoute(raw) {
   const parts = String(raw || '').split('?')[0].split('/').filter(Boolean);
   const idx = parts.indexOf(ROUTE_DELIMITER);
@@ -515,7 +686,7 @@ function liveHostLedgerCapture({ ledger, ownerId, resource }) {
 const SSE_IDLE_TIMEOUT_MS = 90000;
 const SSE_CONTENT_TYPE_RE = /^text\/event-stream/i;
 
-function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS, onForwardFailure = null, abortWithClient = false }) {
+function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, hostOnlyEgress = false, streamGuard = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS, onForwardFailure = null, abortWithClient = false }) {
   // A body a local middleware has already read is no longer in the stream: the
   // headers would announce bytes that nothing sends, and the peer would wait for
   // a body that never arrives. Say it at once, with a name, instead of letting
@@ -533,8 +704,23 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
     if (r.statusCode < 200 || r.statusCode >= 300) failed();
     r.once('aborted', failed); r.once('error', failed);
     const headers = setCookiePrefix ? rewriteSetCookiePath(r.headers, setCookiePrefix) : r.headers;
+    const cleanResponse = hostOnlyEgress ? sanitizeHostOnlyResponseHeaders : sanitizeResponseHeaders;
+    if (hostOnlyEgress && r.statusCode >= 300 && r.statusCode < 400) {
+      // A redirect from a host-only peer would be followed by the browser WITH the owner's Authorization,
+      // towards any route of this node or of a trusted peer: it is never passed along.
+      r.resume();
+      return res.status(502).json({ error: 'redirect refused', reason: 'host-only-redirect' });
+    }
+    // host-only: every answer; a plain peer: only the long-lived (event streams)
+    if (streamGuard && (!streamGuard.plain || SSE_CONTENT_TYPE_RE.test(String(r.headers['content-type'] || '')))) {
+      const untrack = trackHostOnlyStream(streamGuard, () => {
+        try { up.destroy(); } catch (_) { /* gone */ }
+        try { res.destroy(); } catch (_) { /* gone */ }
+      });
+      res.once('close', untrack); up.once('close', untrack);
+    }
     if (!capture) {
-      res.writeHead(r.statusCode, sanitizeResponseHeaders(headers));
+      res.writeHead(r.statusCode, cleanResponse(headers));
       if (SSE_CONTENT_TYPE_RE.test(String(r.headers['content-type'] || ''))) {
         // The response is open: no inactivity timeout any more (the 504 below
         // still covers a peer that never answers), and the watchdog is rearmed
@@ -568,7 +754,7 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
       const body = Buffer.concat(chunks);
       try { capture(r.statusCode, body.toString('utf8')); } catch (_) { /* the ledger never breaks the forward */ }
       if (res.writableEnded) return;
-      res.writeHead(r.statusCode, sanitizeResponseHeaders(headers));
+      res.writeHead(r.statusCode, cleanResponse(headers));
       res.end(body);
     });
   });
@@ -668,7 +854,16 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     }
     const next = st && store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
-    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return rejectAskRequest(403, { error: 'route non consentita' });
+    // A host-only peer has no panel and no Live host to offer: refused for the
+    // owner as well, and before any other decision.
+    if (next && isHostOnlyPeer(next) && (isPanelResource(parsed.resource) || isLiveHostResource(parsed.resource))) {
+      return res.status(403).json({
+        error: 'risorsa non disponibile verso un nodo solo-host',
+        reason: isPanelResource(parsed.resource) ? 'host-only-no-panel' : 'host-only-no-live-host',
+      });
+    }
+    if (!next || !next.token || privateInbound
+      || (ingress && (!canTransit(ingress, next) || !chainInAudience(st, visited, next)))) return rejectAskRequest(403, { error: 'route non consentita' });
     if (parsed.resource === '/asks' && req.method === 'POST') {
       const view = accessPresets.grantsOf(next);
       if (!view.configured || view.label !== 'admin') {
@@ -739,7 +934,7 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
       if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) {
         return rejectForward(403, { error: 'READONLY: federated mutation blocked' });
       }
-      if (!currentNext.token || currentNext.shared !== true || (currentIngress && !canTransit(currentIngress, currentNext))) {
+      if (!currentNext.token || currentNext.shared !== true || (currentIngress && (!canTransit(currentIngress, currentNext) || !chainInAudience(current, visited, currentNext)))) {
         return rejectForward(403, { error: 'route non consentita' });
       }
       if (!controlledVisited(req, currentIngress, current.nodeId)) return rejectForward(409, { error: 'federation cycle rejected' });
@@ -751,6 +946,8 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
       try { JSON.parse(text); } catch (_) { invalidateProof(); }
     } : capture;
     proxyHttp(req, res, { port: forwardPort, path, credential: next.token, visited, setCookiePrefix, panelCookie, capture: actionCapture,
+      hostOnlyEgress: isHostOnlyPeer(next),
+      streamGuard: ingress ? streamGuardFor(nodesPath, ingress, next, visited) : null,
       onForwardFailure: isAskAction ? invalidateProof : null, abortWithClient: isAskAction, getTimeoutMs: forwardGetTimeoutMs, sseIdleMs: forwardSseIdleMs });
   };
 }
@@ -1226,7 +1423,7 @@ async function collectTopologyDetailed({
     // clients become part of Hydra only after their explicit Share toggle.
     if (!n.nodeId || seen.has(n.nodeId)
       || (!ingress && n.direction === 'inbound' && n.shared !== true)
-      || (ingress && !canTransit(ingress, n))) continue;
+      || (ingress && (!canTransit(ingress, n) || !chainInAudience(st, [...seen, ingress.nodeId], n)))) continue;
     // `name` e' lo slug locale con cui si indirizza; `label` e' il nome
     // leggibile. Senza quest'ultimo un nodo raggiunto in transito arriva agli
     // altri come uno slug scelto da qualcun altro, e cinque installazioni
@@ -1289,12 +1486,38 @@ async function collectTopologyDetailed({
       });
     }
   }
-  const ids = new Set(); const routes = new Set(); const unique = [];
+  const ids = new Set(); const routes = new Set(); let unique = [];
   for (const n of out.sort((a, b) => a.route.length - b.route.length)) {
     const routeKey = n.route.join('/');
     if (ids.has(n.instanceId) || routes.has(routeKey)) continue;
     ids.add(n.instanceId); routes.add(routeKey); unique.push(n);
   }
+  if (ingress) {
+    // The fan-out above waited: whatever authorized the reader at the start is read AGAIN now, before the
+    // answer leaves. A host-only peer stays only if the SAME reader (same credential) still passes.
+    const now = store.loadStore(nodesPath);
+    const reader = now && now.nodes.find((n) => n && n.nodeId === ingress.nodeId
+      && credentialFingerprint(n.acceptToken) === credentialFingerprint(ingress.acceptToken));
+    const chain = [...seen, ingress.nodeId];
+    // A peer is judged by the FULL rule NOW if it was host-only when the walk started or is host-only now: one that
+    // stopped being host-only meanwhile (the publication ended during the wait) does not keep its leaf, and neither
+    // does one whose mode, audience or chain no longer passes. Unreadable store: nothing is vouched for.
+    const wasHostOnly = new Map(st.nodes.filter((n) => isHostOnlyPeer(n)).map((n) => [n.nodeId, audienceFingerprint(n)]));
+    const candidates = new Map();
+    for (const n of st.nodes) if (isHostOnlyPeer(n)) candidates.set(n.nodeId, n);
+    for (const n of (now ? now.nodes : [])) if (isHostOnlyPeer(n)) candidates.set(n.nodeId, n);
+    const closed = [...candidates.values()].filter((n) => {
+      if (!now || !reader) return true;
+      const cur = now.nodes.find((x) => x.nodeId === n.nodeId);
+      if (!cur || !isHostOnlyPeer(cur)) return true;                                   // the publication ended (or the peer is gone)
+      if (wasHostOnly.has(n.nodeId) && wasHostOnly.get(n.nodeId) !== audienceFingerprint(cur)) return true;   // another audience
+      return !(canTransit(reader, cur) && chainInAudience(now, chain, cur));
+    });
+    if (closed.length) {
+      const closedIds = new Set(closed.map((n) => n.nodeId)); const closedNames = new Set(closed.map((n) => n.name));
+      unique = unique.filter((e) => !closedIds.has(e.instanceId) && !(e.direct && closedNames.has(e.name)) && !e.route.some((name, i) => i === 0 && closedNames.has(name)));
+    }
+  }
   return { instanceId: st.nodeId, nodes: unique, authoritative };
 }
 
@@ -1722,10 +1945,15 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
   let port = typeof localPort === 'function' ? localPort() : localPort; let credential = localCredential();
   // Ultimo hop: `/ws` entra com'e', il pannello rientra nell'API locale.
   let path = parsed.resource === '/ws' ? '/ws' : `/api${parsed.resource}`;
+  let hostOnlyEgress = false; let hostOnlyGuard = null;
   if (parsed.route.length) {
     const next = store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
-    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return reject(socket, 403);
+    if (next && isHostOnlyPeer(next) && isPanelResource(parsed.resource)) return reject(socket, 403);
+    if (!next || !next.token || privateInbound
+      || (ingress && (!canTransit(ingress, next) || !chainInAudience(st, visited, next)))) return reject(socket, 403);
+    hostOnlyEgress = isHostOnlyPeer(next);
+    if (ingress) hostOnlyGuard = streamGuardFor(nodesPath, ingress, next, visited);
     port = next.localPort; credential = next.token;
     const rest = parsed.route.slice(1);
     path = `/federation/route/${rest.length ? `${rest.join('/')}/` : ''}${ROUTE_DELIMITER}${parsed.resource}`;
@@ -1746,6 +1974,13 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
       // cambiare), l'output va scritto grezzo (i frame li ha gia' incorniciati
       // l'upstream).
       try { socket.write(handshake); } catch (_) { /* morto */ }
+      if (hostOnlyGuard) {
+        const untrackTaken = trackHostOnlyStream(hostOnlyGuard, () => {
+          try { socket.destroy(); } catch (_) { /* gone */ }
+          try { record.up.destroy(); } catch (_) { /* gone */ }
+        });
+        record.up.once('close', untrackTaken);
+      }
       // Gli eventuali byte gia' arrivati dopo la richiesta di upgrade vanno
       // inoltrati come nel ramo normale, non persi.
       if (head && head.length) { try { record.up.write(head); } catch (_) { /* morto */ } }
@@ -1768,6 +2003,14 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
     }
   }
   const up = net.connect({ host: '127.0.0.1', port });
+  // What we read from the peer: for a host-only peer the head of its answer is
+  // filtered like its HTTP answers.
+  let upRead = up;
+  if (hostOnlyEgress) {
+    const headFilter = hostOnlyHeadFilter();
+    headFilter.on('error', () => { try { up.destroy(); } catch (_) { /* gone */ } });   // refused head: upstreamGone() answers the client with our own bytes
+    upRead = up.pipe(headFilter);
+  }
   // ECONNREFUSED sull'hop locale (tunnel che si riavvia) arriva PRIMA del
   // 'connect': nel ramo hubMode il listener 'error' era registrato solo dentro
   // up.once('connect', …) e l'evento restava senza gestore → Unhandled 'error'
@@ -1791,7 +2034,7 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
   let saw101 = false;
   let headBuf = Buffer.alloc(0);
   let gone = false;
-  up.on('data', (chunk) => {
+  upRead.on('data', (chunk) => {
     if (saw101 || headBuf.length >= 1024) return;
     headBuf = Buffer.concat([headBuf, chunk.subarray(0, Math.max(0, 1024 - headBuf.length))]);
     if (headBuf.includes(' 101')) saw101 = true;
@@ -1837,6 +2080,15 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
       const remove = () => { activeSockets.delete(socket); activeSockets.delete(up); };
       socket.once('close', remove); up.once('close', remove);
     }
+    if (hostOnlyGuard) {
+      // Released when the UPSTREAM goes: a held attach keeps `up` after the
+      // client has gone, and it must still be closed on revocation.
+      const untrack = trackHostOnlyStream(hostOnlyGuard, () => {
+        try { socket.destroy(); } catch (_) { /* gone */ }
+        try { up.destroy(); } catch (_) { /* gone */ }
+      });
+      up.once('close', untrack);
+    }
     if (hubMode) {
       // Attach trattenuta: l'output passa dal ring quando il client non c'è,
       // e il record entra nello store sotto la sua identità.
@@ -1844,7 +2096,7 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
         attachId, tokenHash: tokenFingerprint(attachToken), route: attachRoute, session: attachSession, up,
       });
       heldRecord = record;
-      up.on('data', (chunk) => hubAttaches.feed(record, chunk));
+      upRead.on('data', (chunk) => hubAttaches.feed(record, chunk));
       up.on('close', () => hubAttaches.destroy(record));
       up.on('error', () => hubAttaches.destroy(record));
       // end:false: la caduta del CLIENT non deve chiudere l'upstream — è
@@ -1870,7 +2122,7 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
     socket.pipe(up);
     // end:false: la chiusura verso il browser la governiamo noi, o la pipe
     // chiuderebbe il socket PRIMA che il frame di close 4402 possa partire.
-    up.pipe(socket, { end: false });
+    upRead.pipe(socket, { end: false });
   });
   if (!hubMode) {
     // Nel ramo trattenuto la morte dell'upstream la governa lo store (destroy
@@ -2113,7 +2365,7 @@ function acceptWsThenClose(socket, req, code, reason) {
 module.exports = {
   isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, classGateCheck, routeHandler,
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS, SHARE_NOT_READY_CODE, classifyShareFailure, activeReversePort,
-  peerFromToken, peerAllows, canTransit, isHostOnlyPeer, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
+  peerFromToken, peerAllows, canTransit, isHostOnlyPeer, chainInAudience, touchesHostOnly, routeNamesOf, hostOnlyVisibility, hideHostOnlyEntries, redactHostOnlyReferences, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade, createHubAttachStore,
   probeHealth, waitForHealthyPeer, canListenLoopback, preflightHubReverse, notifyHubShare, reconcilePeerShare, runShareRevokeBoot, probeReverseOwner,
   hubPoolRequest, verifyHubPoolSlot, reserveHubPoolSlot, commitHubPoolSlot, settleHubPoolSlot, abortHubPoolSlot, getHubPoolStatus,