@mmmbuto/nexuscrew 0.9.66 → 0.9.67

package/lib/proxy/node-proxy.js

@@ -22,6 +22,7 @@
 // raw socket TCP (upgrade WS). resolveNode/httpRequest/connect iniettabili (test).
 const http = require('node:http');
 const net = require('node:net');
+const { Transform } = require('node:stream');
 const { NODE_NAME_RE } = require('../nodes/store.js');
 const { bearerFrom } = require('../auth/middleware.js');
 
@@ -142,6 +143,77 @@ function sanitizeResponseHeaders(headers) {
   return out;
 }
 
+// Answers of a host-only peer: the peer is published one way, so nothing it says
+// may act on the origin of the PWA. Its cookies, its Clear-Site-Data and its CSP
+// are dropped; the body is served sandboxed and without MIME sniffing.
+const HOST_ONLY_STRIPPED_HEADERS = new Set([
+  'set-cookie', 'set-cookie2', 'clear-site-data', 'content-security-policy', 'content-security-policy-report-only',
+  'x-content-type-options', 'cross-origin-opener-policy', 'cross-origin-embedder-policy', 'cross-origin-resource-policy',
+  'location', 'content-location', 'refresh',
+]);
+function sanitizeHostOnlyResponseHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(sanitizeResponseHeaders(headers))) {
+    if (HOST_ONLY_STRIPPED_HEADERS.has(k.toLowerCase())) continue;
+    out[k] = v;
+  }
+  out['content-security-policy'] = "sandbox; default-src 'none'";
+  out['x-content-type-options'] = 'nosniff';
+  return out;
+}
+
+// The head of an upgrade answer from a host-only peer: the same headers dropped as on the HTTP
+// answers (cookies, Clear-Site-Data, CSP). The head is parsed the way the most lenient consumer
+// would read it, so what is dropped here cannot reappear there: the end of the head is the first
+// empty line (CRLF or bare LF), lines end with CRLF or bare LF, folded (continuation) lines are
+// unfolded, a header name is a strict token. Anything that does not parse that way — a bare CR, a
+// NUL, a line without a colon or with a malformed name, a first line that is not a status line, a
+// head over 16 KB — is refused (the stream errors, the connection is closed) instead of passed
+// along. Bytes after the head pass as they are.
+const HOST_ONLY_HEAD_DROPPED = new Set(['set-cookie', 'set-cookie2', 'clear-site-data', 'content-security-policy', 'content-security-policy-report-only']);
+const HOST_ONLY_HEAD_MAX = 16384;
+function sanitizeUpgradeHead(headText) {
+  if (/\0/.test(headText) || /\r(?!\n)/.test(headText)) throw new Error('upgrade head with a NUL or a bare CR');
+  const raw = headText.split(/\r?\n/);
+  // The ONLY answer to an upgrade that is passed along is a 101: a refusal, a 100 Continue (an interim answer
+  // that would let a second head slip through) or anything else is refused here.
+  if (!/^HTTP\/1\.[01] 101(?: [^\r\n]*)?$/.test(raw[0])) throw new Error('upgrade answer of a host-only peer is not a 101');
+  const logical = [];
+  for (const line of raw.slice(1)) {
+    if (/^[ \t]/.test(line)) {                        // obs-fold: continuation of the previous header
+      if (!logical.length) throw new Error('upgrade head with a continuation before any header');
+      logical[logical.length - 1] += ` ${line.trim()}`;
+    } else logical.push(line);
+  }
+  const kept = [raw[0]];
+  for (const line of logical) {
+    const i = line.indexOf(':');
+    if (i <= 0) throw new Error('upgrade head with a malformed header line');
+    const name = line.slice(0, i).trim();
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) throw new Error('upgrade head with a malformed header name');
+    if (HOST_ONLY_HEAD_DROPPED.has(name.toLowerCase())) continue;
+    kept.push(`${name}:${line.slice(i + 1)}`);
+  }
+  return `${kept.join('\r\n')}\r\n\r\n`;
+}
+function hostOnlyHeadFilter() {
+  let buf = Buffer.alloc(0); let done = false;
+  return new Transform({
+    transform(chunk, _enc, cb) {
+      if (done) return cb(null, chunk);
+      buf = Buffer.concat([buf, chunk]);
+      const window = buf.toString('latin1', 0, Math.min(buf.length, HOST_ONLY_HEAD_MAX + 4));
+      const m = /\r?\n\r?\n/.exec(window);
+      if (!m || m.index > HOST_ONLY_HEAD_MAX) return buf.length > HOST_ONLY_HEAD_MAX ? cb(new Error('upgrade head too large')) : cb();
+      let head;
+      try { head = sanitizeUpgradeHead(window.slice(0, m.index)); } catch (e) { return cb(e); }
+      const rest = buf.subarray(m.index + m[0].length);
+      done = true; buf = null;
+      return cb(null, Buffer.concat([Buffer.from(head, 'latin1'), rest]));
+    },
+  });
+}
+
 function notFound(res) { res.status(404).json({ error: 'not found' }); }
 
 // --- HTTP proxy middleware --------------------------------------------------
@@ -186,7 +258,12 @@ function proxyHttp(req, res, node, rest, search, httpRequest, timeoutMs) {
   let upstream;
   try {
     upstream = httpRequest(options, (up) => {
-      res.writeHead(up.statusCode, sanitizeResponseHeaders(up.headers));
+      if (node.hostOnly === true && up.statusCode >= 300 && up.statusCode < 400) {
+        // A redirect from a host-only peer would be followed by the browser WITH the owner's Authorization.
+        up.resume();
+        return res.status(502).json({ error: 'redirect refused', reason: 'host-only-redirect' });
+      }
+      res.writeHead(up.statusCode, (node.hostOnly === true ? sanitizeHostOnlyResponseHeaders : sanitizeResponseHeaders)(up.headers));
       up.pipe(res);
     });
   } catch (_) {
@@ -327,7 +404,13 @@ function handleNodeUpgrade(ctx) {
     socket.on('error', () => { try { upstream.destroy(); } catch (_) {} });
     upstream.on('error', () => { try { socket.destroy(); } catch (_) {} });
     socket.pipe(upstream);
-    upstream.pipe(socket);
+    let down = upstream;
+    if (node.hostOnly === true) {
+      const filter = hostOnlyHeadFilter();
+      filter.on('error', () => { try { upstream.destroy(); } catch (_) {} abortUpgrade(socket, 502); });
+      down = upstream.pipe(filter);
+    }
+    down.pipe(socket);
   });
   upstream.on('error', () => { clearTimeout(timer); fail(502); });
 }
@@ -340,7 +423,7 @@ module.exports = {
   createNodeProxy,
   handleNodeUpgrade,
   // esposti per i test
-  splitNodePath, isTransitiveRest, sanitizeRequestHeaders, sanitizeResponseHeaders,
+  splitNodePath, isTransitiveRest, sanitizeRequestHeaders, sanitizeResponseHeaders, sanitizeHostOnlyResponseHeaders, hostOnlyHeadFilter,
   buildUpgradeRequest, stripLocalTokenQuery, isStrippedRequestHeader, connectionOptions, bearerFromUpgrade,
   MUTATING, HOP_BY_HOP, PROXY_TIMEOUT_MS,
 };

package/lib/server.js

@@ -501,7 +501,7 @@ function createServer(opts = {}) {
     if (!st) return null;
     const node = nodesStore.getNode(st, name);
     if (!node) return null;
-    return { localPort: node.localPort, token: node.token || null };
+    return { localPort: node.localPort, token: node.token || null, hostOnly: node.publishRemote === true };
   }
 
   const runtimePort = () => (server && server.address() ? server.address().port : cfg.port);
@@ -994,6 +994,15 @@ function createServer(opts = {}) {
     const resource = req.url.slice(i + 2);
     if (!/^\/panel\/[A-Za-z0-9._-]{1,32}(?:\/.*)?$/.test(resource)) return next();
     if (req.method === 'POST' && /^\/panel\/[A-Za-z0-9._-]{1,32}\/ticket\/?$/.test(resource)) return next();
+    // The unauthenticated door exists only for a browser frame, which carries no
+    // header and arrives on this machine's own listener. It never opens for: a
+    // request with ANY Authorization (the local token goes through requireToken like
+    // every other /api call; a peer's token is not the owner's); a request that came
+    // in on a peer-bound reverse listener; a route that names a host-only peer at
+    // any hop. Those fall through to requireToken, whatever the first hop is.
+    const onPeerListener = reverseSlotListeners && reverseSlotListeners.isSlotPort(req.socket && req.socket.localPort);
+    if (bearerFrom(req) || onPeerListener
+      || federation.touchesHostOnly(nodesPath, { route: federation.routeNamesOf(req.url) })) return next();
     panelFederatoRouter(req, res, next);
   });
   api.use(requireToken(tokenStore));
@@ -1161,12 +1170,28 @@ function createServer(opts = {}) {
     }
     return out;
   };
-  api.get('/config', (_req, res) => res.json({
+  // A host-only peer is named only to the readers it is published to; a federated
+  // reader is identified by the verified hop proof, never by the bare header.
+  const hostOnlyNodesFor = (req) => {
+    const st = nodesStore.loadStore(nodesPath);
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    if (!st || vis.unreadable) return [];
+    return st.nodes.filter((n) => n.publishRemote === true && !vis.hiddenNames.has(n.name)).map((n) => n.name);
+  };
+  const nodePanelPortsFor = (req) => {
+    const out = nodePanelPorts();
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    for (const name of vis.hiddenNames) delete out[name];
+    if (vis.unreadable) return {};
+    return out;
+  };
+  api.get('/config', (req, res) => res.json({
     readonlyDefault: cfg.readonlyDefault, version: VERSION, uiVersion: uiBuildVersion(distDir),
     bind: cfg.bind, port: cfg.port, panelPort: cfg.panelPort,
     protectSharedTmuxServer: cfg.protectSharedTmuxServer !== false,
     instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
-    nodePanelPorts: nodePanelPorts(),
+    nodePanelPorts: nodePanelPortsFor(req),
+    hostOnlyNodes: hostOnlyNodesFor(req),
     presets: ['shell', 'claude', 'codex-vl', 'pi', ...Object.keys(cfg.sessionPresets || {})],
     // i parametri del terminale sono configurabili dal server e leggibili
     // dal client (che ne ha comunque i default iniettabili).
@@ -1913,6 +1938,9 @@ function createServer(opts = {}) {
       },
       localPort: () => (server && server.address() ? server.address().port : cfg.port),
       localToken: () => tokenHolder.value,
+      // A federated request that terminates here is never re-sent to a host-only
+      // peer (checked on the target and route actually resolved, store read now).
+      federatedGuard: ({ target, route }) => federation.touchesHostOnly(nodesPath, { target, route }),
     }),
     getGroup: (name) => audioGroups.getGroup(audioCfg, name, audioHome),
   }));
@@ -1971,7 +1999,15 @@ function createServer(opts = {}) {
       peers: federatedPeers,
       localPort: () => (server && server.address() ? server.address().port : cfg.port),
       localToken: () => tokenHolder.value,
+      // Never designate, query or bridge to a host-only peer, whatever the route.
+      ownerGuard: ({ target, route }) => federation.touchesHostOnly(nodesPath, { target, route }),
     }),
+    // A designation that already points at a host-only peer is not shown to a
+    // federated reader outside its audience (it would name the peer).
+    ownerHiddenFor: (req, ownerId) => {
+      const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+      return vis.unreadable || vis.hiddenIds.has(ownerId);
+    },
     originResolver: createOriginResolver({ localNodeId: federatedNodeId, hopSecret: () => hopSecret }),
     federatedRate: createSpeakRateLimiter(),
   }));
@@ -1981,6 +2017,30 @@ function createServer(opts = {}) {
   api.use('/vl-nodes', vlNodeApiRoutes({
     storePath: vlNodesPath, broker: vlNodeBroker, ownerId: vlOwnerId, readonly: proxyReadonly,
   }));
+  // A deck keeps references to nodes (tiles, floating windows): those that point at a host-only peer are not
+  // served to a federated reader outside its audience, in any answer (the 409 carries the current deck too).
+  api.use('/decks', (req, res, next) => {
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    if (!vis.hiddenNames.size && !vis.hiddenIds.size && !vis.unreadable) return next();
+    // A reader served a filtered deck must not be able to save it back and erase what it was not shown:
+    // changing a deck that carries references it cannot see is refused (and says nothing about them).
+    if (req.method !== 'GET' && req.method !== 'HEAD' && req.method !== 'OPTIONS') {
+      const first = String(req.url || '').split('?')[0].split('/').filter(Boolean)[0];
+      let target = null; try { target = first ? decodeURIComponent(first) : null; } catch (_) { target = ''; }
+      if (vis.unreadable) return res.status(503).json({ error: 'non disponibile' });
+      let hiddenContent = false;
+      try {
+        // creating a deck (no name in the path) overwrites nothing: only the deck being changed is looked at
+        const st = target === null ? null : decksStore.loadStore(decksPath);
+        const touched = (st ? st.decks : []).filter((d) => d.name === target);
+        hiddenContent = touched.some((d) => JSON.stringify(federation.redactHostOnlyReferences(d, vis)) !== JSON.stringify(d));
+      } catch (_) { return res.status(503).json({ error: 'non disponibile' }); }
+      if (hiddenContent) return res.status(403).json({ error: 'deck non modificabile da questo nodo', reason: 'deck-has-hidden-content' });
+    }
+    const json = res.json.bind(res);
+    res.json = (body) => json(vis.unreadable ? { error: 'non disponibile' } : federation.redactHostOnlyReferences(body, vis));
+    return next();
+  });
   api.use('/decks', decksRoutes({ cfg, decksPath }));
   api.use('/prefs', prefsRoutes({ cfg, prefsPath }));
   api.use('/fs', fsRoutes({ home: os.homedir() }));  // folder-picker del dialog new session
@@ -2067,9 +2127,37 @@ function createServer(opts = {}) {
     audio: { adapter: audioAdapter, queue: audioQueue },
     reverseSlots: { ensure: startRotatableReverse, close: stopRotatableReverse, verify: verifyRotatablePool },
   }));
+  // Records that name a host-only peer are served only to the readers it is
+  // published to. The WHOLE record is inspected (name or id anywhere in it).
+  api.use('/diagnostics', (req, res, next) => {
+    const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+    if (!vis.hiddenNames.size && !vis.hiddenIds.size && !vis.unreadable) return next();
+    const esc = (v) => String(v).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const names = [...vis.hiddenNames].map((n) => new RegExp(`(^|[^A-Za-z0-9_-])${esc(n)}([^A-Za-z0-9_-]|$)`));
+    const ids = [...vis.hiddenIds];
+    const mentions = (rec) => { const t = JSON.stringify(rec); return ids.some((id) => t.includes(id)) || names.some((re) => re.test(t)); };
+    const json = res.json.bind(res);
+    res.json = (body) => {
+      if (vis.unreadable) return json({ error: 'non disponibile' });
+      if (body && Array.isArray(body.records)) return json({ ...body, records: body.records.filter((r) => !mentions(r)) });
+      return json(body);
+    };
+    return next();
+  });
   api.use('/diagnostics', diagnosticsRoutes({ diagnostics, readonly: proxyReadonly }));
-  api.get('/topology', async (_req, res) => {
-    try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
+  api.get('/topology', async (req, res) => {
+    try {
+      // What was hidden when the request began stays hidden: a publication that ends during the wait does not
+      // hand its leaf to a reader that was not allowed to see it when it asked.
+      const visBefore = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+      const topo = await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath });
+      // Decided AFTER the fan-out wait and on the final result, cache and stale
+      // entries included: the policy is read again now, not before the await.
+      const vis = federation.hostOnlyVisibility(nodesPath, req, () => hopSecret);
+      if (vis.unreadable || visBefore.unreadable) return res.json({ instanceId: topo && topo.instanceId, nodes: [] });
+      const merged = { hiddenNames: new Set([...visBefore.hiddenNames, ...vis.hiddenNames]), hiddenIds: new Set([...visBefore.hiddenIds, ...vis.hiddenIds]) };
+      res.json({ ...topo, nodes: federation.hideHostOnlyEntries(topo && topo.nodes, merged) });
+    }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   api.use('/route', federation.localRouter({
@@ -2208,7 +2296,10 @@ function createServer(opts = {}) {
       // emesso): transita e decide il proprietario, gate panelAccess compreso
       // — stessa forma del bypass HTTP sulle panel-resource federate.
       const panelFederato = /^\/api\/route\/[^?#]*\/_\/panel\/[A-Za-z0-9._-]{1,32}(?:\/.*)?$/.test(pathname)
-        && /(?:^|;\s*)npanel=/.test(String(req.headers.cookie || ''));
+        && /(?:^|;\s*)npanel=/.test(String(req.headers.cookie || ''))
+        && !bearerFrom(req) && !u.searchParams.get('token')
+        && !(reverseSlotListeners && reverseSlotListeners.isSlotPort(req.socket && req.socket.localPort))
+        && !federation.touchesHostOnly(nodesPath, { route: federation.routeNamesOf(pathname.slice('/api/route'.length)) });
       if (!panelFederato && !verify(tokenHolder.value, given)) return socket.destroy();
       federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: runtimePort, localCredential: () => tokenHolder.value, ingress: null, readonly: proxyReadonly, activeSockets: proxySockets, hopSecret: () => hopSecret, hubAttaches });
       return;
@@ -2296,7 +2387,7 @@ function createServer(opts = {}) {
 
   return {
     app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater, diagnostics,
-    panelApp, panelServer, panelServerV6,
+    panelApp, panelServer, panelServerV6, reverseSlotListeners,
     // Test/observability seam: publish a normalized state event through the
     // same per-peer projection the local producers use.
     notify: { publishState: notifier.publishState },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.66",
+  "version": "0.9.67",
   "description": "Faithful browser tmux client \u2014 attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {