@mmmbuto/nexuscrew 0.8.0 → 0.8.2

package/lib/mcp/server.js

@@ -340,10 +340,28 @@ function createMcpServer(opts = {}) {
   }
 
   let rl = null;
+  const inFlight = new Set();
+  let inputClosed = false;
+  let drainResolve;
+  const drained = new Promise((resolve) => { drainResolve = resolve; });
+  const maybeDrained = () => {
+    if (inputClosed && inFlight.size === 0) drainResolve();
+  };
   function start() {
     rl = readline.createInterface({ input, crlfDelay: Infinity });
-    rl.on('line', (line) => { handleLine(line); });
-    return { close: () => { try { rl.close(); } catch (_) {} } };
+    rl.on('line', (line) => {
+      const pending = handleLine(line);
+      inFlight.add(pending);
+      pending.finally(() => {
+        inFlight.delete(pending);
+        maybeDrained();
+      });
+    });
+    rl.on('close', () => {
+      inputClosed = true;
+      maybeDrained();
+    });
+    return { close: () => { try { rl.close(); } catch (_) {} }, drained };
   }
 
   return { start, handleLine, toolsList, ctx, cfg: { port: cfg.port, tmuxBin: cfg.tmuxBin } };
@@ -353,9 +371,10 @@ function createMcpServer(opts = {}) {
 // e' aperto (il client MCP chiude la pipe per terminare il server).
 function startMcp(opts = {}) {
   const srv = createMcpServer(opts);
-  srv.start();
-  // Quando il client chiude stdin il processo esce pulito.
-  (opts.input || process.stdin).on('end', () => process.exit(0));
+  const lifecycle = srv.start();
+  // Non forzare process.exit su EOF: una tools/call asincrona puo' essere
+  // ancora in volo. Una volta drenate le richieste, Node termina naturalmente.
+  srv.drained = lifecycle.drained;
   return srv;
 }
 

package/lib/nodes/commands.js

@@ -93,19 +93,31 @@ function nodesAdd(opts) {
   const { home, nodesPath } = resolveNodePaths(opts);
   const name = opts.name;
   const ssh = opts.ssh;
-  if (!name) { log('usage: nexuscrew nodes add <name> --ssh user@host [--remote-port N] [--key path] [--local-port N]'); return { code: 1, reason: 'name mancante' }; }
+  if (!name) { log('usage: nexuscrew nodes add <name> --ssh user@host [--ssh-port N] [--remote-port N] [--key path] [--local-port N]'); return { code: 1, reason: 'name mancante' }; }
   if (!ssh) { log('nodes add: --ssh user@host obbligatorio'); return { code: 1, reason: 'ssh mancante' }; }
 
   const remotePort = opts.remotePort ? Number(opts.remotePort) : DEFAULT_PORT;
+  const sshPort = opts.sshPort === undefined ? undefined : Number(opts.sshPort);
 
   let st;
   try { st = store.loadOrInitStore(nodesPath); }
   catch (e) { log(`nodes add: ${e.message}`); return { code: 1, reason: 'store invalido' }; }
 
   const localPort = opts.localPort ? Number(opts.localPort) : assignLocalPort(st);
-  const keyPath = opts.key || defaultKeyPath(home, name);
-
-  const entry = { name, ssh, remotePort, localPort, keyPath, roles: { client: true, node: false } };
+  const keyPath = opts.identityFile || opts.key || (typeof opts.keygen === 'function' ? defaultKeyPath(home, name) : undefined);
+
+  const entry = {
+    name, ssh, remotePort, localPort,
+    direction: opts.direction || 'outbound',
+    transport: opts.transport || 'auto',
+    autostart: opts.autostart !== false,
+    visibility: opts.visibility || 'network',
+    roles: { client: true, node: false },
+  };
+  if (keyPath) entry.identityFile = keyPath;
+  if (opts.token) entry.token = opts.token;
+  if (opts.reversePort) entry.reversePort = Number(opts.reversePort);
+  if (sshPort !== undefined) entry.sshPort = sshPort;
   if (opts.nodeId) entry.nodeId = opts.nodeId;
 
   // Valida + inserisci in memoria (dup name/id, self-reference, schema) PRIMA di
@@ -115,18 +127,20 @@ function nodesAdd(opts) {
   catch (e) { log(`nodes add: ${e.message}`); return { code: 1, reason: 'add rifiutato' }; }
 
   // chiave dedicata per-tunnel (genera o riusa)
-  let pub;
-  try { pub = ensureKey(keyPath, name, opts); }
-  catch (e) { log(`nodes add: generazione chiave fallita (${e.message}) — nodo NON salvato`); return { code: 1, reason: 'keygen fallita' }; }
+  let pub = null;
+  if (keyPath && typeof opts.keygen === 'function') {
+    try { pub = ensureKey(keyPath, name, opts); }
+    catch (e) { log(`nodes add: generazione chiave fallita (${e.message}) — nodo NON salvato`); return { code: 1, reason: 'keygen fallita' }; }
+  }
 
   try { store.atomicWriteStore(nodesPath, next); }
   catch (e) { log(`nodes add: scrittura nodes.json fallita: ${e.message}`); return { code: 1, reason: 'write fallita' }; }
 
-  log(`nodes add: nodo "${name}" aggiunto (ssh ${ssh}, remote ${remotePort} -> local ${localPort})`);
+  log(`nodes add: nodo "${name}" aggiunto (ssh ${ssh}${sshPort ? `:${sshPort}` : ''}, nexus remoto ${remotePort} -> locale ${localPort})`);
   log('Incolla nel ~/.ssh/authorized_keys del NODO (lato forward, chiave dedicata):');
   // permitopen vincola i -L alla SOLA porta nexus remota; command=/bin/false + restrict.
-  log(`restrict,port-forwarding,permitopen="127.0.0.1:${remotePort}",command="/bin/false" ${pub}`);
-  return { code: 0, name, localPort, remotePort };
+  if (pub) log(`restrict,port-forwarding,permitopen="127.0.0.1:${remotePort}",command="/bin/false" ${pub}`);
+  return { code: 0, name, sshPort, localPort, remotePort, transport: entry.transport };
 }
 
 // --- nodes list ------------------------------------------------------------
@@ -150,7 +164,7 @@ function nodesList(opts) {
   if (opts.json) { log(JSON.stringify(out, null, 2)); return { code: 0, nodes }; }
   if (nodes.length === 0) { log('nodes: (nessun nodo)'); return { code: 0, nodes }; }
   for (const n of nodes) {
-    log(`${n.name}\t${n.ssh}\tlocal:${n.localPort} -> remote:${n.remotePort}\ttunnel:${n.tunnel.status}\ttoken:${n.hasToken ? 'set' : 'unset'}`);
+    log(`${n.name}\t${n.ssh}${n.sshPort ? `:${n.sshPort}` : ''}\tlocal:${n.localPort} -> nexus:${n.remotePort}\ttunnel:${n.tunnel.status}\ttoken:${n.hasToken ? 'set' : 'unset'}`);
   }
   return { code: 0, nodes };
 }
@@ -253,7 +267,8 @@ function nodesUp(opts) {
   const log = opts.log || console.log;
   const ctx = loadNodeOrFail(opts, log);
   if (!ctx) return { code: 1 };
-  const r = tunnel.startForward({ home: ctx.home, node: ctx.node, spawnImpl: opts.spawnImpl, spawnSyncImpl: opts.spawnSyncImpl, sshBin: opts.sshBin, logFd: opts.logFd });
+  if (ctx.node.direction === 'inbound') return { code: 0, started: false, inbound: true };
+  const r = tunnel.startForward({ home: ctx.home, node: ctx.node, localAppPort: opts.localAppPort, spawnImpl: opts.spawnImpl, spawnSyncImpl: opts.spawnSyncImpl, sshBin: opts.sshBin, logFd: opts.logFd });
   if (r.started) {
     log(`nodes up [${ctx.node.name}]: tunnel avviato (pid ${r.pid}, local ${ctx.node.localPort})`);
     return { code: 0, started: true, pid: r.pid };

package/lib/nodes/peering.js

@@ -0,0 +1,116 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const store = require('./store.js');
+
+const INVITE_TTL_MS = 10 * 60 * 1000;
+const REVERSE_PORT_BASE = 44001;
+
+function defaultInvitesPath(home) { return path.join(home, '.nexuscrew', 'invites.json'); }
+function defaultPendingPath(home) { return path.join(home, '.nexuscrew', 'pairing-pending.json'); }
+
+function safeEqual(a, b) {
+  const aa = Buffer.from(String(a || ''));
+  const bb = Buffer.from(String(b || ''));
+  return aa.length === bb.length && crypto.timingSafeEqual(aa, bb);
+}
+
+function readInvites(p, now = Date.now()) {
+  try {
+    const st = fs.lstatSync(p);
+    if (!st.isFile() || st.isSymbolicLink()) return [];
+    const rows = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return Array.isArray(rows) ? rows.filter((x) => x && x.expiresAt > now && !x.usedAt) : [];
+  } catch (_) { return []; }
+}
+
+function writeInvites(p, rows) {
+  try { if (fs.lstatSync(p).isSymbolicLink()) throw new Error('invites target is symlink'); }
+  catch (e) { if (e.code !== 'ENOENT') throw e; }
+  fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+  const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(rows)}\n`, { mode: 0o600 });
+  fs.chmodSync(tmp, 0o600);
+  fs.renameSync(tmp, p);
+}
+
+function encodePairing(data) {
+  return Buffer.from(JSON.stringify(data)).toString('base64url');
+}
+
+function decodePairing(value) {
+  try {
+    const x = JSON.parse(Buffer.from(String(value || ''), 'base64url').toString('utf8'));
+    if (!x || x.v !== 1 || !store.NODE_ID_RE.test(x.instanceId) || !store.isPort(x.port)
+      || !store.validToken(x.invite) || typeof x.label !== 'string') return null;
+    return x;
+  } catch (_) { return null; }
+}
+
+function parsePairingUrl(value) {
+  try {
+    const u = new URL(String(value));
+    const payload = new URLSearchParams(u.hash.replace(/^#/, '')).get('pair');
+    return decodePairing(payload);
+  } catch (_) { return null; }
+}
+
+function createInvite({ invitesPath, instanceId, port, label = 'NexusCrew', now = Date.now(), randomBytes = crypto.randomBytes }) {
+  const invite = randomBytes(32).toString('base64url');
+  const expiresAt = now + INVITE_TTL_MS;
+  const rows = readInvites(invitesPath, now);
+  rows.push({ hash: crypto.createHash('sha256').update(invite).digest('hex'), expiresAt, usedAt: null });
+  writeInvites(invitesPath, rows.slice(-32));
+  const pair = encodePairing({ v: 1, instanceId, port, label: String(label).slice(0, 64), invite });
+  return { pairingUrl: `http://127.0.0.1:${port}/#pair=${pair}`, expiresAt };
+}
+
+function consumeInvite({ invitesPath, invite, now = Date.now() }) {
+  const all = readInvites(invitesPath, 0);
+  const hash = crypto.createHash('sha256').update(String(invite || '')).digest('hex');
+  const idx = all.findIndex((x) => !x.usedAt && x.expiresAt > now && safeEqual(x.hash, hash));
+  if (idx < 0) return false;
+  all[idx] = { ...all[idx], usedAt: now };
+  writeInvites(invitesPath, all.slice(-32));
+  return true;
+}
+
+function allocateReversePort(nodes) {
+  const used = new Set();
+  for (const n of nodes || []) {
+    if (store.isPort(n.localPort)) used.add(n.localPort);
+    if (store.isPort(n.reversePort)) used.add(n.reversePort);
+  }
+  let p = REVERSE_PORT_BASE;
+  while (used.has(p) && p < 65535) p += 1;
+  if (p >= 65535) throw new Error('no reverse port available');
+  return p;
+}
+
+function createPending({ pendingPath, data, now = Date.now() }) {
+  const rows = readInvites(pendingPath, now);
+  const credential = crypto.randomBytes(32).toString('base64url');
+  rows.push({ ...data, hash: crypto.createHash('sha256').update(credential).digest('hex'), expiresAt: now + INVITE_TTL_MS, usedAt: null });
+  writeInvites(pendingPath, rows.slice(-32));
+  return credential;
+}
+
+function consumePending({ pendingPath, credential, now = Date.now() }) {
+  const rows = readInvites(pendingPath, 0);
+  const hash = crypto.createHash('sha256').update(String(credential || '')).digest('hex');
+  const idx = rows.findIndex((x) => !x.usedAt && x.expiresAt > now && safeEqual(x.hash, hash));
+  if (idx < 0) return null;
+  const found = { ...rows[idx] };
+  rows.splice(idx, 1);
+  writeInvites(pendingPath, rows.slice(-32));
+  delete found.hash; delete found.expiresAt; delete found.usedAt;
+  return found;
+}
+
+module.exports = {
+  INVITE_TTL_MS, REVERSE_PORT_BASE, defaultInvitesPath, defaultPendingPath, safeEqual,
+  readInvites, writeInvites, encodePairing, decodePairing, parsePairingUrl,
+  createInvite, consumeInvite, allocateReversePort, createPending, consumePending,
+};

package/lib/nodes/store.js

@@ -17,7 +17,8 @@ const os = require('node:os');
 const path = require('node:path');
 const crypto = require('node:crypto');
 
-const SCHEMA_VERSION = 1;
+const SCHEMA_VERSION = 2;
+const LEGACY_SCHEMA_VERSION = 1;
 const MAX_NODES = 64;
 const MAX_TOKEN_LEN = 4096;
 const MAX_KEYPATH_LEN = 4096;
@@ -54,6 +55,17 @@ function parseSsh(s) {
   return { user, host, value: `${user}@${host}` };
 }
 
+// OpenSSH target/Host alias. It is passed as one argv item (never through a
+// shell), therefore the safety boundary is: non-empty, no whitespace/control
+// characters and no leading '-'. user@host remains accepted as a subset.
+function parseSshTarget(s) {
+  if (typeof s !== 'string' || !s || s.length > MAX_SSH_LEN) return null;
+  if (s.startsWith('-') || /[\0-\x20\x7f]/.test(s)) return null;
+  if (s.includes('@')) return parseSsh(s);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,254}$/.test(s)) return null;
+  return { value: s };
+}
+
 // keyPath: path assoluto, no null/newline (la chiave potrebbe non esistere ancora
 // al momento dell'add: viene generata dopo). L'esistenza si verifica al lancio ssh.
 function isAbsPath(p) {
@@ -83,31 +95,70 @@ function parseRoles(r) {
 
 // parseNode(n) -> nodo normalizzato | null (fail-closed). Nessun campo extra
 // tollerato oltre a quelli noti (schema chiuso: garbage -> null, non guess).
-const NODE_KEYS = new Set(['name', 'ssh', 'remotePort', 'localPort', 'keyPath', 'roles', 'token', 'nodeId']);
-function parseNode(n) {
+const NODE_KEYS = new Set([
+  'name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'identityFile',
+  'roles', 'token', 'acceptToken', 'nodeId', 'transport', 'autostart', 'visibility', 'selected',
+  'direction', 'reversePort',
+]);
+function parseNode(n, schemaVersion = SCHEMA_VERSION) {
   if (!n || typeof n !== 'object' || Array.isArray(n)) return null;
   for (const k of Object.keys(n)) { if (!NODE_KEYS.has(k)) return null; } // schema chiuso
   if (typeof n.name !== 'string' || !NODE_NAME_RE.test(n.name)) return null;
-  const ssh = parseSsh(n.ssh);
-  if (!ssh) return null;
+  const direction = n.direction || 'outbound';
+  if (!['outbound', 'inbound'].includes(direction)) return null;
+  const ssh = n.ssh === undefined && direction === 'inbound' ? null
+    : (schemaVersion === LEGACY_SCHEMA_VERSION ? parseSsh(n.ssh) : parseSshTarget(n.ssh));
+  if (direction === 'outbound' && !ssh) return null;
+  if (n.sshPort !== undefined && !isPort(n.sshPort)) return null;
   if (!isPort(n.remotePort)) return null;
   if (!isPort(n.localPort)) return null;
-  if (!isAbsPath(n.keyPath)) return null;
+  const identityFile = n.identityFile || n.keyPath;
+  if (identityFile !== undefined && !isAbsPath(identityFile)) return null;
+  if (schemaVersion === LEGACY_SCHEMA_VERSION && !identityFile) return null;
   const roles = parseRoles(n.roles);
   if (!roles) return null;
 
   const out = {
     name: n.name,
-    ssh: ssh.value,
+    ...(ssh ? { ssh: ssh.value } : {}),
     remotePort: n.remotePort,
     localPort: n.localPort,
-    keyPath: n.keyPath,
     roles,
+    direction,
+    transport: n.transport || (direction === 'inbound' ? 'inbound' : (schemaVersion === LEGACY_SCHEMA_VERSION ? 'ssh' : 'auto')),
+    autostart: n.autostart === undefined ? schemaVersion !== LEGACY_SCHEMA_VERSION : n.autostart,
+    visibility: n.visibility || 'network',
   };
+  if (!['auto', 'ssh', 'autossh', 'inbound'].includes(out.transport)) return null;
+  if (direction === 'inbound' && out.transport !== 'inbound') return null;
+  if (direction === 'outbound' && out.transport === 'inbound') return null;
+  if (typeof out.autostart !== 'boolean') return null;
+  if (!['network', 'relay-only', 'selected'].includes(out.visibility)) return null;
+  if (identityFile) out.identityFile = identityFile;
+  // Keep the old public field while reading v1 so old callers/tests and a
+  // running 0.8.1 service can coexist during the atomic upgrade.
+  if (n.keyPath) out.keyPath = n.keyPath;
+  if (n.reversePort !== undefined) {
+    if (!isPort(n.reversePort)) return null;
+    out.reversePort = n.reversePort;
+  }
+  if (n.selected !== undefined) {
+    if (!Array.isArray(n.selected) || n.selected.length > MAX_NODES) return null;
+    const selected = [...new Set(n.selected)];
+    if (selected.some((id) => typeof id !== 'string' || !NODE_ID_RE.test(id))) return null;
+    out.selected = selected;
+  }
+  // Campo opzionale per compatibilita' con gli store 0.8.0: se assente, ssh
+  // continua a usare la porta risolta da ~/.ssh/config o il default OpenSSH.
+  if (n.sshPort !== undefined) out.sshPort = n.sshPort;
   if (n.token !== undefined) {
     if (!validToken(n.token)) return null;
     out.token = n.token;
   }
+  if (n.acceptToken !== undefined) {
+    if (!validToken(n.acceptToken)) return null;
+    out.acceptToken = n.acceptToken;
+  }
   if (n.nodeId !== undefined) {
     if (typeof n.nodeId !== 'string' || !NODE_ID_RE.test(n.nodeId)) return null;
     out.nodeId = n.nodeId;
@@ -140,7 +191,7 @@ function parseStore(raw) {
       return null;
     }
 
-    if (d.schemaVersion !== SCHEMA_VERSION) return null;
+    if (d.schemaVersion !== SCHEMA_VERSION && d.schemaVersion !== LEGACY_SCHEMA_VERSION) return null;
     if (typeof d.nodeId !== 'string' || !NODE_ID_RE.test(d.nodeId)) return null;
     if (!Array.isArray(d.nodes) || d.nodes.length > MAX_NODES) return null;
 
@@ -148,7 +199,7 @@ function parseStore(raw) {
     const ids = new Set();
     const nodes = [];
     for (const raw2 of d.nodes) {
-      const node = parseNode(raw2);
+      const node = parseNode(raw2, d.schemaVersion);
       if (!node) return null;
       if (names.has(node.name)) return null;             // name univoco
       names.add(node.name);
@@ -160,7 +211,7 @@ function parseStore(raw) {
       nodes.push(node);
     }
 
-    const out = { schemaVersion: SCHEMA_VERSION, nodeId: d.nodeId, nodes };
+    const out = { schemaVersion: d.schemaVersion, nodeId: d.nodeId, nodes };
 
     if (d.rendezvous !== undefined && d.rendezvous !== null) {
       const rdv = parseRendezvous(d.rendezvous);
@@ -248,8 +299,8 @@ function getNode(store, name) {
 }
 
 function addNode(store, entry) {
-  const node = parseNode(entry);
-  if (!node) throw new Error('nodo non valido (schema strict): controlla name/ssh/remotePort/localPort/keyPath');
+  const node = parseNode(entry, SCHEMA_VERSION);
+  if (!node) throw new Error('nodo non valido (schema strict): controlla name/ssh/remotePort/localPort');
   if (store.nodes.some((n) => n.name === node.name)) {
     throw new Error(`nodo duplicato: name "${node.name}" gia' presente`);
   }
@@ -259,7 +310,7 @@ function addNode(store, entry) {
       throw new Error(`nodo duplicato: nodeId "${node.nodeId}" gia' presente`);
     }
   }
-  return { ...store, nodes: store.nodes.concat([node]) };
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes: store.nodes.concat([node]) };
 }
 
 function removeNode(store, name) {
@@ -267,7 +318,7 @@ function removeNode(store, name) {
   if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
   const nodes = store.nodes.slice();
   nodes.splice(idx, 1);
-  return { ...store, nodes };
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
 }
 
 function setNodeToken(store, name, token) {
@@ -276,17 +327,27 @@ function setNodeToken(store, name, token) {
   if (!validToken(token)) throw new Error('token non valido (vuoto, multilinea o troppo lungo)');
   const nodes = store.nodes.slice();
   nodes[idx] = { ...nodes[idx], token };
-  return { ...store, nodes };
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
+}
+
+function updateNode(store, name, patch) {
+  const idx = store.nodes.findIndex((n) => n.name === name);
+  if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
+  const parsed = parseNode({ ...store.nodes[idx], ...patch }, SCHEMA_VERSION);
+  if (!parsed) throw new Error('aggiornamento nodo non valido');
+  const nodes = store.nodes.slice();
+  nodes[idx] = parsed;
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
 }
 
 function setRendezvous(store, rdv) {
   const parsed = parseRendezvous(rdv);
   if (!parsed) throw new Error('rendezvous non valido: controlla ssh/publishedPort/localPort/keyPath');
-  return { ...store, rendezvous: parsed };
+  return { ...store, schemaVersion: SCHEMA_VERSION, rendezvous: parsed };
 }
 
 function clearRendezvous(store) {
-  const out = { ...store };
+  const out = { ...store, schemaVersion: SCHEMA_VERSION };
   delete out.rendezvous;
   return out;
 }
@@ -296,13 +357,19 @@ function clearRendezvous(store) {
 function redactNode(n) {
   const out = {
     name: n.name,
-    ssh: n.ssh,
+    ...(n.ssh ? { ssh: n.ssh } : {}),
     remotePort: n.remotePort,
     localPort: n.localPort,
-    keyPath: n.keyPath,
-    roles: n.roles,
+    direction: n.direction || 'outbound',
+    transport: n.transport || 'ssh',
+    autostart: !!n.autostart,
+    visibility: n.visibility || 'network',
     hasToken: !!n.token, // presenza, non il valore
+    paired: !!(n.token && n.acceptToken),
   };
+  if (n.identityFile || n.keyPath) out.hasIdentity = true;
+  if (n.visibility === 'selected') out.selected = [...(n.selected || [])];
+  if (n.sshPort !== undefined) out.sshPort = n.sshPort;
   if (n.nodeId) out.nodeId = n.nodeId;
   return out;
 }
@@ -344,15 +411,15 @@ function migrateLegacyNodes(configPath, nodesPath) {
 
 module.exports = {
   // parse/validate
-  parseStore, parseNode, parseRendezvous, parseSsh, isPort, isAbsPath, validToken,
+  parseStore, parseNode, parseRendezvous, parseSsh, parseSshTarget, isPort, isAbsPath, validToken,
   // I/O
   defaultNodesPath, loadStore, atomicWriteStore, loadOrInitStore, emptyStore, newNodeId,
   // mutazioni
-  getNode, addNode, removeNode, setNodeToken, setRendezvous, clearRendezvous,
+  getNode, addNode, removeNode, setNodeToken, updateNode, setRendezvous, clearRendezvous,
   // redazione
   redactNode, redactStore,
   // migrazione
   migrateLegacyNodes,
   // costanti
-  SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
+  SCHEMA_VERSION, LEGACY_SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
 };

package/lib/nodes/tunnel.js

@@ -33,8 +33,10 @@ function assertForwardSpec(node) {
   if (!node || typeof node !== 'object') throw new Error('tunnel: spec mancante');
   if (!store.isPort(node.localPort)) throw new Error('tunnel: localPort non valida');
   if (!store.isPort(node.remotePort)) throw new Error('tunnel: remotePort non valida');
-  if (!store.isAbsPath(node.keyPath)) throw new Error('tunnel: keyPath non valido');
-  if (!store.parseSsh(node.ssh)) throw new Error('tunnel: ssh (user@host) non valido');
+  if (node.sshPort !== undefined && !store.isPort(node.sshPort)) throw new Error('tunnel: sshPort non valida');
+  if (node.identityFile !== undefined && !store.isAbsPath(node.identityFile)) throw new Error('tunnel: identityFile non valido');
+  if (node.keyPath !== undefined && !store.isAbsPath(node.keyPath)) throw new Error('tunnel: keyPath non valido');
+  if (!store.parseSshTarget(node.ssh)) throw new Error('tunnel: target ssh non valido');
 }
 
 function assertReverseSpec(rdv) {
@@ -51,9 +53,14 @@ function assertReverseSpec(rdv) {
 //       -L 127.0.0.1:<locale>:127.0.0.1:<remota> user@host
 function buildForwardArgs(node) {
   assertForwardSpec(node);
-  return SSH_BASE_OPTS.concat([
-    '-i', node.keyPath,
+  const transport = node.sshPort === undefined ? [] : ['-p', String(node.sshPort)];
+  const identity = node.identityFile || node.keyPath;
+  const reverse = node.reversePort === undefined ? [] : [
+    '-R', `127.0.0.1:${node.reversePort}:127.0.0.1:${node.localAppPort || node.remotePort}`,
+  ];
+  return SSH_BASE_OPTS.concat(transport, identity ? ['-i', identity] : [], [
     '-L', `127.0.0.1:${node.localPort}:127.0.0.1:${node.remotePort}`,
+    ...reverse,
     node.ssh,
   ]);
 }
@@ -195,7 +202,7 @@ function startTunnel(opts) {
     child = spawnImpl(process.execPath, supervisorArgs, {
       detached: true,
       stdio: ['ignore', logFd, logFd],
-      env: { ...process.env, NEXUSCREW_TUNNEL_STATE: statePath },
+      env: { ...process.env, AUTOSSH_GATETIME: '0', NEXUSCREW_TUNNEL_STATE: statePath },
     });
   } catch (e) {
     closeOwnedFd();
@@ -257,8 +264,16 @@ function restartTunnel(opts) {
 // Helper di alto livello: costruisce args dal nodo e avvia il forward.
 function startForward(opts) {
   const node = opts.node;
-  const args = buildForwardArgs(node);
-  return startTunnel({ ...opts, name: node.name, args });
+  let sshBin = opts.sshBin;
+  let args = buildForwardArgs({ ...node, localAppPort: opts.localAppPort });
+  const wanted = node.transport || (node.keyPath ? 'ssh' : 'auto');
+  if (!sshBin && (wanted === 'auto' || wanted === 'autossh') && sshBinaryAvailable('autossh', opts.spawnSyncImpl)) {
+    sshBin = 'autossh';
+    args = ['-M', '0', ...args];
+  } else if (!sshBin) {
+    sshBin = 'ssh';
+  }
+  return startTunnel({ ...opts, sshBin, name: node.name, args });
 }
 
 // Helper di alto livello: reverse verso il rendezvous.