querysub 0.699.0 → 0.700.0

package/.claude/settings.local.json

@@ -35,7 +35,8 @@
       "PowerShell(yarn upreal *)",
       "PowerShell($env:COMPUTERNAME; $env:USERNAME)",
       "PowerShell($env:COMPUTERNAME)",
-      "PowerShell($env:USERNAME)"
+      "PowerShell($env:USERNAME)",
+      "Read(//d/repos/socket-function/src/**)"
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.699.0",
+  "version": "0.700.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",

package/src/-d-trust/NetworkTrust2.ts

@@ -1,5 +1,5 @@
 import { measureWrap } from "socket-function/src/profiling/measure";
-import { getIdentityCA, getMachineId, getOwnMachineId } from "sliftutils/misc/https/certs";
+import { getCommonName, getIdentityCA, getMachineId, getOwnMachineId } from "sliftutils/misc/https/certs";
 import { getArchives2 } from "../-a-archives/archives2";
 import { isNode, throttleFunction, timeInHour, timeInSecond } from "socket-function/src/misc";
 import { SocketFunctionHook } from "socket-function/SocketFunctionTypes";
@@ -44,7 +44,6 @@ export const requiresNetworkTrustHook: SocketFunctionHook = async config => {
     let machineId = IdentityController_getMachineId(caller);
     let trusted = await isTrusted(machineId);
     if (!trusted) {
-        devDebugbreak();
         let machineId = IdentityController_getMachineId(caller);
         throw new Error(`Calling machine is not trusted. Caller ${machineId} is not trusted by ${SocketFunction.mountedNodeId} to make call ${config.call.classGuid}.${config.call.functionName}. To gain trust add backblaze permissions (see hasBackblazePermissions) or set --nonetwork.`);
     }
@@ -128,6 +127,19 @@ export const loadServerCert = cache(async (machineId: string) => {
     trustCertificate(certFile);
 });
 
+export async function trustMachineCertificate(config: { machineId: string; cert: Buffer }): Promise<boolean> {
+    let { machineId, cert } = config;
+    let certMachineId = getMachineId(getCommonName(cert), getDomain());
+    if (certMachineId !== machineId) {
+        throw new Error(`Expected the certificate to be for ${machineId}, it is for ${certMachineId}`);
+    }
+    if (await archives().get(machineId)) {
+        return false;
+    }
+    await archives().set(machineId, cert, { fallbacks: true });
+    return true;
+}
+
 export const ensureWeAreTrusted = lazy(measureWrap(async () => {
     let machineKeyCert = getIdentityCA(getDomain());
     let machineId = getOwnMachineId(getDomain());

package/src/-g-core-values/NodeCapabilities.ts

@@ -175,15 +175,16 @@ class NodeCapabilitiesControllerBase {
         return getMeasureBreakdown(range);
     }
 
-    public async getInspectURL() {
-        assertAssistedDebugConnectionAllowed();
+    public async getInspectURL(): Promise<string | undefined> {
+        if (!isAssistedDebugConnectionAllowed()) return undefined;
         return await getDebuggerUrl();
     }
 
     public async exposeExternalDebugPortOnce(forExternalIP: string) {
-        assertAssistedDebugConnectionAllowed();
+        if (!isAssistedDebugConnectionAllowed()) return undefined;
         // https://notdevtools.com/devtools/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:62448/22895aed-f8da-4dfb-8d50-e432a9c2d827
         let debugURL = await this.getInspectURL();
+        if (!debugURL) return undefined;
 
         const outerUrl = new URL(debugURL);
         const wsParam = outerUrl.searchParams.get("ws");
@@ -206,10 +207,8 @@ class NodeCapabilitiesControllerBase {
 let lastExposed: (() => void) | undefined;
 
 /** The assisted debug connection (opening the inspector, forwarding the port externally, TLS proxying) only exists because public servers can't be reached directly - on a non-public server the debugger can be attached directly, and the forwarding machinery would only add attack surface. */
-export function assertAssistedDebugConnectionAllowed() {
-    if (!isPublic()) {
-        throw new Error(`Non-public server, connect directly. Don't use this assisted connection code.`);
-    }
+export function isAssistedDebugConnectionAllowed() {
+    return isPublic();
 }
 
 

package/src/deployManager/components/MachineDetailPage.tsx

@@ -1,6 +1,7 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, getMachineIdList, getMachineInfoLive } from "../machineSchema";
+import { MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, getMachineIdList, getMachineInfoLive, getMachineNameLive, setMachineNameLive } from "../machineSchema";
+import { InputLabel } from "../../library-components/InputLabel";
 import { css } from "typesafecss";
 import { currentViewParam, selectedMachineIdParam, selectedServiceIdParam } from "../urlParams";
 import { formatNumber, formatVeryNiceDateTime } from "socket-function/src/formatting/format";
@@ -29,6 +30,7 @@ export class MachineDetailPage extends qreact.Component {
 
         const machine = machineInfo;
         const isDisabled = machineConfig?.disabled || false;
+        const machineName = getMachineNameLive(selectedMachineId);
 
         // Get all service configs that target this machine
         let relevantServiceConfigs = new Map<string, ServiceConfig>();
@@ -65,7 +67,19 @@ export class MachineDetailPage extends qreact.Component {
 
         return <div className={css.vbox(16)}>
             <div className={css.hbox(12).pad2(16).bord2(0, 0, 20) + backgroundColor}>
-                <h2 className={css.flexGrow(1)}>{selectedMachineId}</h2>
+                <div className={css.vbox(4).flexGrow(1)}>
+                    <InputLabel
+                        label="Name"
+                        edit
+                        fontSize={28}
+                        value={machineName}
+                        editValue={machineName || "(unnamed machine)"}
+                        editClass={css.fontSize(28).fontWeight("bold") + (!machineName && css.colorhsl(0, 0, 45))}
+                        tooltip="Click to name this machine"
+                        onChangeValue={value => setMachineNameLive(selectedMachineId, value)}
+                    />
+                    <div className={css.fontSize(13).colorhsl(0, 0, 35)}>{selectedMachineId}</div>
+                </div>
                 {isMachineDead && <div className={css.colorhsl(0, 80, 60)}>
                     ⚠️ Machine is likely dead
                 </div>}
@@ -120,7 +134,7 @@ export class MachineDetailPage extends qreact.Component {
                                 <ShowMore className={css.whiteSpace("pre-wrap")} maxHeight={80}>
                                     {(() => {
                                         if (typeof value === "object") {
-                                            return <UsageBar label={value.type} value={value.value} max={value.max} {...getUsageThresholds(value.type)} />;
+                                            return <UsageBar label={value.label || value.type} value={value.value} max={value.max} {...getUsageThresholds(value.type)} />;
                                         }
                                         return value;
                                     })()}

package/src/deployManager/components/MachinePicker.tsx

@@ -6,7 +6,7 @@ import { isDefined } from "../../misc";
 import { formatTime } from "socket-function/src/formatting/format";
 import { css } from "typesafecss";
 import { Querysub } from "../../4-querysub/Querysub";
-import { MachineServiceController, getLiveServiceParameters, getMachineTargets, applyCommandTemplate, getMachineInfoLive } from "../machineSchema";
+import { MachineServiceController, getLiveServiceParameters, getMachineTargets, applyCommandTemplate, getMachineInfoLive, getMachineNameLive } from "../machineSchema";
 import { FUNCTION_RUNNER_COMMAND_PREFIX } from "../serviceCategories";
 
 module.hotreload = true;
@@ -69,6 +69,7 @@ export class MachinePicker extends qreact.Component<{
                     if (typeof ip !== "string") {
                         ip = "";
                     }
+                    let name = getMachineNameLive(machineId);
                     let sinceHeartbeat = now - machine.heartbeat;
                     let isLikelyDead = sinceHeartbeat > DEAD_HEARTBEAT_THRESHOLD;
                     let networks = networksPerMachine.get(machineId) || [];
@@ -86,10 +87,13 @@ export class MachinePicker extends qreact.Component<{
                             }
                         }}
                     >
-                        <div className={css.fontSize(17).fontWeight("bold")}>
-                            {ip || machineId}
+                        <div className={css.fontSize(17).fontWeight("bold") + (!name && css.colorhsl(0, 0, 45))}>
+                            {name || ip || machineId}
                         </div>
-                        {ip && <div className={css.fontSize(11).colorhsl(0, 0, 40)}>
+                        {name && ip && <div className={css.fontSize(12).colorhsl(0, 0, 30)}>
+                            {ip}
+                        </div>}
+                        {(name || ip) && <div className={css.fontSize(11).colorhsl(0, 0, 40)}>
                             {machineId}
                         </div>}
                         {networks.length > 0 && <div className={css.fontSize(11).colorhsl(220, 60, 40)}>

package/src/deployManager/components/MachinesListPage.tsx

@@ -1,6 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { MACHINE_RESYNC_INTERVAL, MachineServiceController, getMachineInfoLive } from "../machineSchema";
+import { MACHINE_RESYNC_INTERVAL, MachineServiceController, getMachineInfoLive, getMachineNameLive } from "../machineSchema";
 import { css } from "typesafecss";
 import { t } from "../../2-proxy/schema2";
 import { Querysub } from "../../4-querysub/Querysub";
@@ -78,8 +78,11 @@ export class MachinesListPage extends qreact.Component {
                             onClick={() => {
                                 if (!hasSelectedMachines) return;
 
-                                const machineNames = selectedMachineIds.join(", ");
-                                const confirmed = confirm(`⚠️ WARNING: This will permanently delete ${selectedMachineIds.length} machine(s):\n\n${machineNames}\n\nThis will remove all machine data and cannot be undone. Are you sure?`);
+                                const machineDescriptions = selectedMachineIds.map(id => {
+                                    let name = getMachineNameLive(id);
+                                    return name && `${name} (${id})` || id;
+                                }).join(", ");
+                                const confirmed = confirm(`⚠️ WARNING: This will permanently delete ${selectedMachineIds.length} machine(s):\n\n${machineDescriptions}\n\nThis will remove all machine data and cannot be undone. Are you sure?`);
                                 if (!confirmed) return;
 
                                 Querysub.commit(() => {
@@ -125,6 +128,7 @@ export class MachinesListPage extends qreact.Component {
                     const isSelected = this.state.selectedForDeletion[machineId];
                     const machineConfig = machineConfigs?.find(x => x.machineId === machineId);
                     const isDisabled = machineConfig?.disabled || false;
+                    const machineName = getMachineNameLive(machineId);
 
                     let failingServices = Object.keys(machineInfo.services).filter(serviceId => {
                         return machineInfo.services[serviceId].errorFromLastRun;
@@ -183,11 +187,14 @@ export class MachinesListPage extends qreact.Component {
                                     <RenderGitRefInfo gitRef={machineInfo.gitRef} />
                                     {Object.values(machineInfo.info).map(value => {
                                         if (typeof value === "string") return undefined;
-                                        return <UsageBar label={value.type} value={value.value} max={value.max} {...getUsageThresholds(value.type)} />;
+                                        return <UsageBar label={value.label || value.type} value={value.value} max={value.max} {...getUsageThresholds(value.type)} />;
                                     })}
                                 </div>
                                 <div className={css.vbox(4).flexGrow(1)}>
-                                    <div>
+                                    <div className={css.fontSize(22).fontWeight("bold") + (!machineName && css.colorhsl(0, 0, 45))}>
+                                        {machineName || "(unnamed machine)"}
+                                    </div>
+                                    <div className={css.fontSize(12).colorhsl(0, 0, 35)}>
                                         {machineId}
                                     </div>
                                     <div>

package/src/deployManager/components/ServiceDetailPage.tsx

@@ -1,6 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { qreact } from "../../4-dom/qreact";
-import { DEFAULT_OVERLAP_TIME, MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, ServiceParameters, applyCommandTemplate, getCommandTemplateVariables, getLiveServiceParameters, getMachineInfoLive, getMachineTargets, setMachineTargets, stripReleaseState } from "../machineSchema";
+import { DEFAULT_OVERLAP_TIME, MACHINE_RESYNC_INTERVAL, MachineServiceController, ServiceConfig, ServiceParameters, applyCommandTemplate, getCommandTemplateVariables, getLiveServiceParameters, getMachineInfoLive, getMachineNameLive, getMachineTargets, setMachineTargets, stripReleaseState } from "../machineSchema";
 import { css } from "typesafecss";
 import { t } from "../../2-proxy/schema2";
 import { Querysub } from "../../4-querysub/Querysub";
@@ -126,10 +126,12 @@ export class ServiceDetailPage extends qreact.Component {
                     ip = "";
                 }
                 let networks = networksPerMachine.get(machineId) || [];
+                let name = getMachineNameLive(machineId);
                 return <div key={machineId} className={css.vbox(6).fillWidth.pad2(8, 6).hsl(0, 0, 94)}>
                     <div className={css.hbox(10).alignItems("baseline")}>
-                        <div className={css.boldStyle.fontSize(15)}>{ip || machineId}</div>
-                        {ip && <div className={css.fontSize(11).colorhsl(0, 0, 40)}>{machineId}</div>}
+                        <div className={css.boldStyle.fontSize(20) + (!name && css.colorhsl(0, 0, 45))}>{name || ip || machineId}</div>
+                        {name && ip && <div className={css.fontSize(13)}>{ip}</div>}
+                        {(name || ip) && <div className={css.fontSize(11).colorhsl(0, 0, 40)}>{machineId}</div>}
                         {networks.length > 0 && <div className={css.fontSize(11).colorhsl(220, 60, 40)}>
                             {networks.join(", ")}
                         </div>}
@@ -237,6 +239,7 @@ export class ServiceDetailPage extends qreact.Component {
 
             return {
                 machineId,
+                machineName: getMachineNameLive(machineId),
                 variables,
                 machineInfo,
                 serviceInfo,
@@ -355,7 +358,7 @@ export class ServiceDetailPage extends qreact.Component {
                 {/* The machines are notified on every config change and poll as a fallback, so forcing a resync had no use in practice. Kept in case that changes.
                 <ResyncMachinesButton applyNodeIds={machineStatuses.map(x => x.machineInfo?.applyNodeId || "")} /> */}
                 <div className={css.vbox(4).fillWidth}>
-                    {machineStatuses.map(({ machineId, variables, machineInfo, serviceInfo, isMachineDead, hasError, isDisabled, index }) => {
+                    {machineStatuses.map(({ machineId, machineName, variables, machineInfo, serviceInfo, isMachineDead, hasError, isDisabled, index }) => {
                         if (!machineInfo) return <div key={machineId}>Loading {machineId}...</div>;
 
                         let backgroundColor = css.hsl(0, 0, 100); // Default: white
@@ -378,7 +381,10 @@ export class ServiceDetailPage extends qreact.Component {
                             <div
                                 className={css.hbox(12)}
                             >
-                                <div className={css.hbox(5).wrap}>
+                                <div className={css.hbox(5).wrap.alignItems("baseline")}>
+                                    <div className={css.fontSize(20).boldStyle + (!machineName && css.colorhsl(0, 0, 45))}>
+                                        {machineName || "(unnamed machine)"}
+                                    </div>
                                     <div>
                                         {screenName}
                                     </div>

package/src/deployManager/machineApplyMainCode.ts

@@ -63,29 +63,46 @@ const getMemoryInfo = measureWrap(async function getMemoryInfo(): Promise<{ memo
 });
 
 
-const getDiskInfo = measureWrap(async function getDiskInfo(): Promise<{ value: number; max: number } | undefined> {
+const LARGE_DISK_MIN_BYTES = 100 * 1024 * 1024 * 1024;
+const DF_LINE_REGEX = /^(\S+)\s+(\d+)\s+(\d+)\s+\d+\s+\S+\s+(.+?)\s*$/;
+
+type DiskInfo = { device: string; mountPoint: string; value: number; max: number };
+
+const getDiskInfos = measureWrap(async function getDiskInfos(): Promise<DiskInfo[]> {
     if (os.platform() === "win32") {
         throw new Error("Windows is not supported for machine resource monitoring");
     }
 
     try {
-        // Linux: Get disk usage for root filesystem
-        let result = await runPromise("df -B1 /", { quiet: true });
-        let lines = result.split("\n");
-        if (lines.length >= 2) {
-            let parts = lines[1].split(/\s+/);
-            if (parts.length >= 4) {
-                let total = parseInt(parts[1]);
-                let used = parseInt(parts[2]);
-                if (total && used >= 0) {
-                    return { value: used, max: total };
+        let result = await runPromise("df -B1 -P", { quiet: true });
+        let disks: DiskInfo[] = [];
+        for (let line of result.split("\n").slice(1)) {
+            let match = DF_LINE_REGEX.exec(line);
+            if (!match) continue;
+            let [, device, totalText, usedText, mountPoint] = match;
+            if (!device.startsWith("/dev/") || device.startsWith("/dev/loop")) continue;
+            let max = parseInt(totalText);
+            let value = parseInt(usedText);
+            if (!max || !(value >= 0)) continue;
+            let existing = disks.find(disk => disk.device === device);
+            if (existing) {
+                if (mountPoint.length < existing.mountPoint.length) {
+                    existing.mountPoint = mountPoint;
                 }
+                continue;
             }
+            disks.push({ device, mountPoint, value, max });
         }
+        let large = disks.filter(disk => disk.max >= LARGE_DISK_MIN_BYTES);
+        if (large.length > 0) {
+            disks = large;
+        }
+        sort(disks, disk => -disk.max);
+        return disks;
     } catch (e: any) {
-        console.warn(`Error getting disk info: ${e.message}`);
+        console.warn(`Error getting disk info: ${e.stack}`);
     }
-    return undefined;
+    return [];
 });
 
 const getLiveMachineInfo = measureWrap(async function getLiveMachineInfo() {
@@ -100,9 +117,9 @@ const getLiveMachineInfo = measureWrap(async function getLiveMachineInfo() {
     };
 
     // Get system resource information
-    let [memoryInfo, diskInfo] = await Promise.all([
+    let [memoryInfo, diskInfos] = await Promise.all([
         getMemoryInfo(),
-        getDiskInfo()
+        getDiskInfos()
     ]);
 
     if (memoryInfo?.memory) {
@@ -121,9 +138,10 @@ const getLiveMachineInfo = measureWrap(async function getLiveMachineInfo() {
         };
     }
 
-    if (diskInfo) {
-        machineInfo.info.disk = {
+    for (let diskInfo of diskInfos) {
+        machineInfo.info[`disk ${diskInfo.mountPoint}`] = {
             type: "DISK",
+            label: `DISK ${diskInfo.mountPoint} (${diskInfo.device})`,
             value: diskInfo.value,
             max: diskInfo.max,
         };

package/src/deployManager/machineSchema.ts

@@ -38,6 +38,12 @@ export type MachineConfig = {
 export const machineInfos = archiveJSONT<MachineInfo>(() => getArchives2("machines/machine-heartbeats/"), { setFallbacks: true, findFallbacks: true });
 export const serviceConfigs = archiveJSONT<ServiceConfig>(() => getArchives2("machines/service-configs/"), { setFallbacks: true, findFallbacks: true });
 export const machineConfigs = archiveJSONT<MachineConfig>(() => getArchives2("machines/machine-configs/"), { setFallbacks: true, findFallbacks: true });
+export const machineNames = archiveJSONT<MachineName>(() => getArchives2("machines/machine-names/"), { setFallbacks: true, findFallbacks: true });
+
+export type MachineName = {
+    machineId: string;
+    name: string;
+};
 
 export type MachineInfo = {
     machineId: string;
@@ -57,6 +63,7 @@ export type MachineInfo = {
         type: string;
         value: number;
         max: number;
+        label?: string;
     }>;
 
     repoUrl: string;
@@ -292,7 +299,19 @@ export class MachineServiceControllerBase {
     public async deleteMachineIds(machineIds: string[]) {
         for (let machineId of machineIds) {
             await machineInfos.delete(machineId);
+            await machineNames.delete(machineId);
+        }
+    }
+    public async getMachineNameList(): Promise<MachineName[]> {
+        return await machineNames.values();
+    }
+    public async setMachineName(machineId: string, name: string) {
+        name = name.trim();
+        if (!name) {
+            await machineNames.delete(machineId);
+            return;
         }
+        await machineNames.set(machineId, { machineId, name });
     }
     public async getMachineInfo(machineId: string): Promise<MachineInfo | undefined> {
         return await machineInfos.get(machineId);
@@ -641,6 +660,8 @@ export const MachineServiceController = getSyncedController(
             getMachineConfigList: {},
             getMachineConfig: {},
             setMachineConfig: {},
+            getMachineNameList: {},
+            setMachineName: {},
             addServiceConfig: {},
             setServiceConfigs: {},
             getServiceConfigType: {},
@@ -661,7 +682,8 @@ export const MachineServiceController = getSyncedController(
     ),
     {
         writes: {
-            deleteMachineIds: ["MachineInfo", "MachineInfoList"],
+            deleteMachineIds: ["MachineInfo", "MachineInfoList", "MachineName"],
+            setMachineName: ["MachineName"],
             addMachineInfo: ["MachineInfo", "MachineInfoList"],
             setMachineInfo: ["MachineInfo"],
             setMachineConfig: ["MachineConfig", "MachineConfigList"],
@@ -677,6 +699,7 @@ export const MachineServiceController = getSyncedController(
             getMachineInfo: ["MachineInfo"],
             getMachineConfigList: ["MachineConfigList"],
             getMachineConfig: ["MachineConfig"],
+            getMachineNameList: ["MachineName"],
             getServiceList: ["ServiceConfigList"],
             getServiceConfig: ["ServiceConfig"],
             getGitInfo: ["gitInfo"],
@@ -703,3 +726,14 @@ export function getMachineInfoLive(machineId: string): MachineInfo | undefined {
     startMachineInfoRefreshLoop();
     return MachineServiceController(SocketFunction.browserNodeId()).getMachineInfo(machineId);
 }
+
+export function getMachineNameLive(machineId: string): string {
+    let names = MachineServiceController(SocketFunction.browserNodeId()).getMachineNameList();
+    return names?.find(x => x.machineId === machineId)?.name || "";
+}
+export function setMachineNameLive(machineId: string, name: string) {
+    let controller = MachineServiceController(SocketFunction.browserNodeId());
+    Querysub.onCommitFinished(async () => {
+        await controller.setMachineName.promise(machineId, name);
+    });
+}

package/src/deployManager/setupMachineMain.ts

@@ -7,6 +7,11 @@ import { fsExistsAsync } from "../fs";
 import { delay } from "socket-function/src/batching";
 import { SERVICE_NAME, SERVICE_UNIT_NAME } from "./machineDaemonShared";
 import { addDeployKeyToGitHub, askQuestion } from "./githubRepoAccess";
+import { getOrCreateRemoteMachineId } from "sliftutils/security/machines/machines";
+import { readRemoteFile, runOverSSH, SUDO_PREAMBLE } from "sliftutils/security/helpers/remoteSSH";
+import { DEV_getIdentityFilePath, getMachineId, IdentityStorageType } from "sliftutils/misc/https/certs";
+import { trustMachineCertificate } from "../-d-trust/NetworkTrust2";
+import { getDomain } from "../config";
 // Import querysub, to fix missing dependencies
 Querysub;
 
@@ -142,6 +147,34 @@ async function installUnofficialNode(sshRemote: string, major: number): Promise<
     }
 }
 
+async function setupMachineIdentity(sshRemote: string): Promise<string> {
+    let domain = getDomain();
+    let machineId = await getOrCreateRemoteMachineId(sshRemote, domain);
+    let home = await sshValue(sshRemote, "echo $HOME");
+    let identityPath = `${home}/${path.basename(DEV_getIdentityFilePath(domain))}`;
+    await runOverSSH({
+        host: sshRemote,
+        script: `${SUDO_PREAMBLE}\n$SUDO chown "$(id -u):$(id -g)" "${identityPath}"`,
+        allowFailure: true,
+    });
+    let contents = await readRemoteFile({ host: sshRemote, filePath: identityPath });
+    if (!contents) {
+        throw new Error(`Expected an identity at ${identityPath} on ${sshRemote} after creating one, there is none`);
+    }
+    let stored = JSON.parse(contents) as IdentityStorageType;
+    let storedMachineId = getMachineId(stored.domain, domain);
+    if (storedMachineId !== machineId) {
+        throw new Error(`Expected ${identityPath} on ${sshRemote} to hold ${machineId}, it holds ${storedMachineId}. Something else wrote an identity at the same time, so re-run setup.`);
+    }
+    let published = await trustMachineCertificate({ machineId, cert: Buffer.from(stored.certB64, "base64") });
+    if (published) {
+        console.log(`✅ Machine ${machineId} identified and added to the trust archive`);
+    } else {
+        console.log(`✅ Machine ${machineId} identified, and was already in the trust archive`);
+    }
+    return machineId;
+}
+
 async function setupRepositoryOnRemote(sshRemote: string, gitURLLive: string, gitRefLive: string): Promise<void> {
     // Create git folder on remote
     await runPromise(`ssh ${sshRemote} "mkdir -p ~/machine-alwaysup"`);
@@ -282,6 +315,9 @@ async function main() {
         console.warn("⚠️  Backblaze file not found at:", backblazePath);
     }
 
+    console.log("Setting up the machine's identity and trust...");
+    let machineId = await setupMachineIdentity(sshRemote);
+
     // 2. Ensure git is installed on remote server
     console.log("Ensuring git is installed...");
     try {
@@ -293,15 +329,31 @@ async function main() {
         console.log("✅ Git installed");
     }
 
-    // 3. Ensure build tools are installed (needed for native modules)
     console.log("Ensuring build tools are installed...");
-    try {
-        await runPromise(`ssh ${sshRemote} "which make"`);
-        console.log("✅ Build tools already installed");
-    } catch {
-        console.log("Installing build tools...");
+    let buildTools = ["make", "g++", "cc"];
+    let missingBuildTools: string[] = [];
+    for (let tool of buildTools) {
+        let found = await runPromise(`ssh ${sshRemote} "command -v ${tool} || true"`, { nothrow: true });
+        if (!found.trim()) {
+            missingBuildTools.push(tool);
+        }
+    }
+    if (missingBuildTools.length === 0) {
+        console.log(`✅ Build tools already installed (${buildTools.join(", ")})`);
+    } else {
+        console.log(`Installing build tools (missing: ${missingBuildTools.join(", ")})...`);
         await runPromise(`ssh ${sshRemote} "sudo apt install -y build-essential"`);
-        console.log("✅ Build tools installed");
+        let stillMissing: string[] = [];
+        for (let tool of missingBuildTools) {
+            let found = await runPromise(`ssh ${sshRemote} "command -v ${tool} || true"`, { nothrow: true });
+            if (!found.trim()) {
+                stillMissing.push(tool);
+            }
+        }
+        if (stillMissing.length > 0) {
+            throw new Error(`Installed build-essential on ${sshRemote}, but ${stillMissing.join(", ")} is still not on the PATH. Native modules (fs-ext, and everything else node-gyp builds) cannot compile without it - check what "sudo apt install -y build-essential" reports on that machine.`);
+        }
+        console.log(`✅ Build tools installed (${buildTools.join(", ")})`);
     }
 
     // The daemon runs everything in tmux screens, so setup cannot get by without it
@@ -488,6 +540,7 @@ sudo systemctl start ${SERVICE_UNIT_NAME}
     }
 
     console.log("✅ Machine service started!");
+    console.log(`   Machine: ${machineId}`);
     console.log(`   Screen:  ssh ${sshRemote} -t "tmux attach -t ${SERVICE_NAME}"`);
     console.log(`   Status:  ssh ${sshRemote} "systemctl status ${SERVICE_UNIT_NAME}"`);
 

package/src/diagnostics/MachineThreadInfo.tsx

@@ -45,6 +45,10 @@ export class MachineThreadInfo extends qreact.Component<{
     handleAttach = async (threadInfo: NodeSpecialInfo | undefined) => {
         Querysub.onCommitFinished(async () => {
             const url = await NodeViewerController.nodes[SocketFunction.getBrowserNodeId()].getExternalInspectURL(threadInfo?.nodeId || "");
+            if (!url) {
+                console.log(`No assisted inspect URL for ${threadInfo?.nodeId}, connect to the debugger directly.`);
+                return;
+            }
             window.open(url, "_blank");
         });
     };

package/src/diagnostics/NodeViewer.tsx

@@ -5,7 +5,7 @@ import { getAllNodeIds, getBrowserUrlNode, syncNodesNow } from "../../src/-f-nod
 import { errorToUndefined, errorToUndefinedSilent, logErrors, timeoutToError } from "../../src/errors";
 import { QuerysubController } from "../../src/4-querysub/QuerysubController";
 import { Querysub } from "../../src/4-querysub/Querysub";
-import { NodeCapabilitiesController, assertAssistedDebugConnectionAllowed, getControllerNodeIdList } from "../../src/-g-core-values/NodeCapabilities";
+import { NodeCapabilitiesController, isAssistedDebugConnectionAllowed, getControllerNodeIdList } from "../../src/-g-core-values/NodeCapabilities";
 import { lazy } from "socket-function/src/caching";
 import { atomicObjectWrite } from "../../src/2-proxy/PathValueProxyWatcher";
 import { Button } from "../../src/library-components/Button";
@@ -274,6 +274,10 @@ export class NodeViewer extends qreact.Component {
                                             <button onClick={async () => {
                                                 const controller = NodeViewerController.nodes[getBrowserUrlNode()];
                                                 let url = await controller.getExternalInspectURL(str);
+                                                if (!url) {
+                                                    console.log(`No assisted inspect URL for ${str}, connect to the debugger directly.`);
+                                                    return;
+                                                }
                                                 console.log(url);
                                                 console.log(url.replace("https://notdevtools.com/devtools", "devtools://devtools/bundled"));
                                                 // devtools://devtools/bundled/inspector.html?experiments=true&v8only=true&wss=99-250-124-91.querysub.com:2058/cc5b76b2-549f-4a66-8026-021811e9edd3
@@ -354,8 +358,8 @@ class NodeViewerControllerBase {
         return (await dns.promises.lookup(callerIP)).address;
     }
 
-    public async getExternalInspectURL(nodeId: string) {
-        assertAssistedDebugConnectionAllowed();
+    public async getExternalInspectURL(nodeId: string): Promise<string | undefined> {
+        if (!isAssistedDebugConnectionAllowed()) return undefined;
         // TODO: Replace this with a an HTTPS => HTTP proxy, adding a secret time based key
         //  - Needs to run in another process
         //  - Key will use machine hash(secret key + time mod interval). Will last for 2X interval, so at
@@ -365,7 +369,9 @@ class NodeViewerControllerBase {
 
         let callerIP = getNodeIdIP(SocketFunction.getCaller().nodeId);
         let ourIP = await getExternalIP();
-        let { externalPort, internalPort, internalInspectURL } = await NodeCapabilitiesController.nodes[nodeId].exposeExternalDebugPortOnce(ourIP);
+        let exposed = await NodeCapabilitiesController.nodes[nodeId].exposeExternalDebugPortOnce(ourIP);
+        if (!exposed) return undefined;
+        let { externalPort, internalPort, internalInspectURL } = exposed;
 
         const forwardCode = ((config: {
             callerIP: string;
@@ -482,8 +488,8 @@ class NodeViewerControllerBase {
         return internalInspectURL.replace(`ws=127.0.0.1:${internalPort}`, `wss=${ourDomain}:${finalPort}`);
     }
 
-    public async getInspectURL(nodeId: string) {
-        assertAssistedDebugConnectionAllowed();
+    public async getInspectURL(nodeId: string): Promise<string | undefined> {
+        if (!isAssistedDebugConnectionAllowed()) return undefined;
         return await NodeCapabilitiesController.nodes[nodeId].getInspectURL();
     }
 

package/src/diagnostics/debugger/mcp-server.ts

@@ -297,6 +297,9 @@ async function attachToNode(nodeId: string): Promise<AttachNodeResult> {
         // Same machine — the inspector is reachable directly on localhost.
         mode = "local";
         const inspectUrl = await NodeCapabilitiesController.nodes[nodeId].getInspectURL();
+        if (!inspectUrl) {
+            throw new Error(`Node ${nodeId} is not public, so it has no assisted inspect URL. Connect to its debugger directly.`);
+        }
         const { host, port, uuidPath } = parseInspectWs(inspectUrl);
         wsUrl = `ws://${host}:${port}${uuidPath}`;
         detail =
@@ -306,8 +309,11 @@ async function attachToNode(nodeId: string): Promise<AttachNodeResult> {
         // Remote machine — have the node forward its inspector port to a
         // one-time external port locked to our IP.
         mode = "remote";
-        const { externalPort, internalPort, internalInspectURL } =
-            await NodeCapabilitiesController.nodes[nodeId].exposeExternalDebugPortOnce(ourIP);
+        const exposed = await NodeCapabilitiesController.nodes[nodeId].exposeExternalDebugPortOnce(ourIP);
+        if (!exposed) {
+            throw new Error(`Node ${nodeId} is not public, so it cannot expose an external debug port. Connect to its debugger directly.`);
+        }
+        const { externalPort, internalPort, internalInspectURL } = exposed;
         const { uuidPath } = parseInspectWs(internalInspectURL);
         wsUrl = `ws://${nodeIP}:${externalPort}${uuidPath}`;
         detail =