@mmmbuto/nexuscrew 0.8.0 → 0.8.3

package/lib/nodes/peering.js

@@ -0,0 +1,116 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const store = require('./store.js');
+
+const INVITE_TTL_MS = 10 * 60 * 1000;
+const REVERSE_PORT_BASE = 44001;
+
+function defaultInvitesPath(home) { return path.join(home, '.nexuscrew', 'invites.json'); }
+function defaultPendingPath(home) { return path.join(home, '.nexuscrew', 'pairing-pending.json'); }
+
+function safeEqual(a, b) {
+  const aa = Buffer.from(String(a || ''));
+  const bb = Buffer.from(String(b || ''));
+  return aa.length === bb.length && crypto.timingSafeEqual(aa, bb);
+}
+
+function readInvites(p, now = Date.now()) {
+  try {
+    const st = fs.lstatSync(p);
+    if (!st.isFile() || st.isSymbolicLink()) return [];
+    const rows = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return Array.isArray(rows) ? rows.filter((x) => x && x.expiresAt > now && !x.usedAt) : [];
+  } catch (_) { return []; }
+}
+
+function writeInvites(p, rows) {
+  try { if (fs.lstatSync(p).isSymbolicLink()) throw new Error('invites target is symlink'); }
+  catch (e) { if (e.code !== 'ENOENT') throw e; }
+  fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+  const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(rows)}\n`, { mode: 0o600 });
+  fs.chmodSync(tmp, 0o600);
+  fs.renameSync(tmp, p);
+}
+
+function encodePairing(data) {
+  return Buffer.from(JSON.stringify(data)).toString('base64url');
+}
+
+function decodePairing(value) {
+  try {
+    const x = JSON.parse(Buffer.from(String(value || ''), 'base64url').toString('utf8'));
+    if (!x || x.v !== 1 || !store.NODE_ID_RE.test(x.instanceId) || !store.isPort(x.port)
+      || !store.validToken(x.invite) || typeof x.label !== 'string') return null;
+    return x;
+  } catch (_) { return null; }
+}
+
+function parsePairingUrl(value) {
+  try {
+    const u = new URL(String(value));
+    const payload = new URLSearchParams(u.hash.replace(/^#/, '')).get('pair');
+    return decodePairing(payload);
+  } catch (_) { return null; }
+}
+
+function createInvite({ invitesPath, instanceId, port, label = 'NexusCrew', now = Date.now(), randomBytes = crypto.randomBytes }) {
+  const invite = randomBytes(32).toString('base64url');
+  const expiresAt = now + INVITE_TTL_MS;
+  const rows = readInvites(invitesPath, now);
+  rows.push({ hash: crypto.createHash('sha256').update(invite).digest('hex'), expiresAt, usedAt: null });
+  writeInvites(invitesPath, rows.slice(-32));
+  const pair = encodePairing({ v: 1, instanceId, port, label: String(label).slice(0, 64), invite });
+  return { pairingUrl: `http://127.0.0.1:${port}/#pair=${pair}`, expiresAt };
+}
+
+function consumeInvite({ invitesPath, invite, now = Date.now() }) {
+  const all = readInvites(invitesPath, 0);
+  const hash = crypto.createHash('sha256').update(String(invite || '')).digest('hex');
+  const idx = all.findIndex((x) => !x.usedAt && x.expiresAt > now && safeEqual(x.hash, hash));
+  if (idx < 0) return false;
+  all[idx] = { ...all[idx], usedAt: now };
+  writeInvites(invitesPath, all.slice(-32));
+  return true;
+}
+
+function allocateReversePort(nodes) {
+  const used = new Set();
+  for (const n of nodes || []) {
+    if (store.isPort(n.localPort)) used.add(n.localPort);
+    if (store.isPort(n.reversePort)) used.add(n.reversePort);
+  }
+  let p = REVERSE_PORT_BASE;
+  while (used.has(p) && p < 65535) p += 1;
+  if (p >= 65535) throw new Error('no reverse port available');
+  return p;
+}
+
+function createPending({ pendingPath, data, now = Date.now() }) {
+  const rows = readInvites(pendingPath, now);
+  const credential = crypto.randomBytes(32).toString('base64url');
+  rows.push({ ...data, hash: crypto.createHash('sha256').update(credential).digest('hex'), expiresAt: now + INVITE_TTL_MS, usedAt: null });
+  writeInvites(pendingPath, rows.slice(-32));
+  return credential;
+}
+
+function consumePending({ pendingPath, credential, now = Date.now() }) {
+  const rows = readInvites(pendingPath, 0);
+  const hash = crypto.createHash('sha256').update(String(credential || '')).digest('hex');
+  const idx = rows.findIndex((x) => !x.usedAt && x.expiresAt > now && safeEqual(x.hash, hash));
+  if (idx < 0) return null;
+  const found = { ...rows[idx] };
+  rows.splice(idx, 1);
+  writeInvites(pendingPath, rows.slice(-32));
+  delete found.hash; delete found.expiresAt; delete found.usedAt;
+  return found;
+}
+
+module.exports = {
+  INVITE_TTL_MS, REVERSE_PORT_BASE, defaultInvitesPath, defaultPendingPath, safeEqual,
+  readInvites, writeInvites, encodePairing, decodePairing, parsePairingUrl,
+  createInvite, consumeInvite, allocateReversePort, createPending, consumePending,
+};

package/lib/nodes/store.js

@@ -17,7 +17,8 @@ const os = require('node:os');
 const path = require('node:path');
 const crypto = require('node:crypto');
 
-const SCHEMA_VERSION = 1;
+const SCHEMA_VERSION = 2;
+const LEGACY_SCHEMA_VERSION = 1;
 const MAX_NODES = 64;
 const MAX_TOKEN_LEN = 4096;
 const MAX_KEYPATH_LEN = 4096;
@@ -54,6 +55,17 @@ function parseSsh(s) {
   return { user, host, value: `${user}@${host}` };
 }
 
+// OpenSSH target/Host alias. It is passed as one argv item (never through a
+// shell), therefore the safety boundary is: non-empty, no whitespace/control
+// characters and no leading '-'. user@host remains accepted as a subset.
+function parseSshTarget(s) {
+  if (typeof s !== 'string' || !s || s.length > MAX_SSH_LEN) return null;
+  if (s.startsWith('-') || /[\0-\x20\x7f]/.test(s)) return null;
+  if (s.includes('@')) return parseSsh(s);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,254}$/.test(s)) return null;
+  return { value: s };
+}
+
 // keyPath: path assoluto, no null/newline (la chiave potrebbe non esistere ancora
 // al momento dell'add: viene generata dopo). L'esistenza si verifica al lancio ssh.
 function isAbsPath(p) {
@@ -83,31 +95,70 @@ function parseRoles(r) {
 
 // parseNode(n) -> nodo normalizzato | null (fail-closed). Nessun campo extra
 // tollerato oltre a quelli noti (schema chiuso: garbage -> null, non guess).
-const NODE_KEYS = new Set(['name', 'ssh', 'remotePort', 'localPort', 'keyPath', 'roles', 'token', 'nodeId']);
-function parseNode(n) {
+const NODE_KEYS = new Set([
+  'name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'identityFile',
+  'roles', 'token', 'acceptToken', 'nodeId', 'transport', 'autostart', 'visibility', 'selected',
+  'direction', 'reversePort',
+]);
+function parseNode(n, schemaVersion = SCHEMA_VERSION) {
   if (!n || typeof n !== 'object' || Array.isArray(n)) return null;
   for (const k of Object.keys(n)) { if (!NODE_KEYS.has(k)) return null; } // schema chiuso
   if (typeof n.name !== 'string' || !NODE_NAME_RE.test(n.name)) return null;
-  const ssh = parseSsh(n.ssh);
-  if (!ssh) return null;
+  const direction = n.direction || 'outbound';
+  if (!['outbound', 'inbound'].includes(direction)) return null;
+  const ssh = n.ssh === undefined && direction === 'inbound' ? null
+    : (schemaVersion === LEGACY_SCHEMA_VERSION ? parseSsh(n.ssh) : parseSshTarget(n.ssh));
+  if (direction === 'outbound' && !ssh) return null;
+  if (n.sshPort !== undefined && !isPort(n.sshPort)) return null;
   if (!isPort(n.remotePort)) return null;
   if (!isPort(n.localPort)) return null;
-  if (!isAbsPath(n.keyPath)) return null;
+  const identityFile = n.identityFile || n.keyPath;
+  if (identityFile !== undefined && !isAbsPath(identityFile)) return null;
+  if (schemaVersion === LEGACY_SCHEMA_VERSION && !identityFile) return null;
   const roles = parseRoles(n.roles);
   if (!roles) return null;
 
   const out = {
     name: n.name,
-    ssh: ssh.value,
+    ...(ssh ? { ssh: ssh.value } : {}),
     remotePort: n.remotePort,
     localPort: n.localPort,
-    keyPath: n.keyPath,
     roles,
+    direction,
+    transport: n.transport || (direction === 'inbound' ? 'inbound' : (schemaVersion === LEGACY_SCHEMA_VERSION ? 'ssh' : 'auto')),
+    autostart: n.autostart === undefined ? schemaVersion !== LEGACY_SCHEMA_VERSION : n.autostart,
+    visibility: n.visibility || 'network',
   };
+  if (!['auto', 'ssh', 'autossh', 'inbound'].includes(out.transport)) return null;
+  if (direction === 'inbound' && out.transport !== 'inbound') return null;
+  if (direction === 'outbound' && out.transport === 'inbound') return null;
+  if (typeof out.autostart !== 'boolean') return null;
+  if (!['network', 'relay-only', 'selected'].includes(out.visibility)) return null;
+  if (identityFile) out.identityFile = identityFile;
+  // Keep the old public field while reading v1 so old callers/tests and a
+  // running 0.8.1 service can coexist during the atomic upgrade.
+  if (n.keyPath) out.keyPath = n.keyPath;
+  if (n.reversePort !== undefined) {
+    if (!isPort(n.reversePort)) return null;
+    out.reversePort = n.reversePort;
+  }
+  if (n.selected !== undefined) {
+    if (!Array.isArray(n.selected) || n.selected.length > MAX_NODES) return null;
+    const selected = [...new Set(n.selected)];
+    if (selected.some((id) => typeof id !== 'string' || !NODE_ID_RE.test(id))) return null;
+    out.selected = selected;
+  }
+  // Campo opzionale per compatibilita' con gli store 0.8.0: se assente, ssh
+  // continua a usare la porta risolta da ~/.ssh/config o il default OpenSSH.
+  if (n.sshPort !== undefined) out.sshPort = n.sshPort;
   if (n.token !== undefined) {
     if (!validToken(n.token)) return null;
     out.token = n.token;
   }
+  if (n.acceptToken !== undefined) {
+    if (!validToken(n.acceptToken)) return null;
+    out.acceptToken = n.acceptToken;
+  }
   if (n.nodeId !== undefined) {
     if (typeof n.nodeId !== 'string' || !NODE_ID_RE.test(n.nodeId)) return null;
     out.nodeId = n.nodeId;
@@ -140,7 +191,7 @@ function parseStore(raw) {
       return null;
     }
 
-    if (d.schemaVersion !== SCHEMA_VERSION) return null;
+    if (d.schemaVersion !== SCHEMA_VERSION && d.schemaVersion !== LEGACY_SCHEMA_VERSION) return null;
     if (typeof d.nodeId !== 'string' || !NODE_ID_RE.test(d.nodeId)) return null;
     if (!Array.isArray(d.nodes) || d.nodes.length > MAX_NODES) return null;
 
@@ -148,7 +199,7 @@ function parseStore(raw) {
     const ids = new Set();
     const nodes = [];
     for (const raw2 of d.nodes) {
-      const node = parseNode(raw2);
+      const node = parseNode(raw2, d.schemaVersion);
       if (!node) return null;
       if (names.has(node.name)) return null;             // name univoco
       names.add(node.name);
@@ -160,7 +211,7 @@ function parseStore(raw) {
       nodes.push(node);
     }
 
-    const out = { schemaVersion: SCHEMA_VERSION, nodeId: d.nodeId, nodes };
+    const out = { schemaVersion: d.schemaVersion, nodeId: d.nodeId, nodes };
 
     if (d.rendezvous !== undefined && d.rendezvous !== null) {
       const rdv = parseRendezvous(d.rendezvous);
@@ -248,8 +299,8 @@ function getNode(store, name) {
 }
 
 function addNode(store, entry) {
-  const node = parseNode(entry);
-  if (!node) throw new Error('nodo non valido (schema strict): controlla name/ssh/remotePort/localPort/keyPath');
+  const node = parseNode(entry, SCHEMA_VERSION);
+  if (!node) throw new Error('nodo non valido (schema strict): controlla name/ssh/remotePort/localPort');
   if (store.nodes.some((n) => n.name === node.name)) {
     throw new Error(`nodo duplicato: name "${node.name}" gia' presente`);
   }
@@ -259,7 +310,7 @@ function addNode(store, entry) {
       throw new Error(`nodo duplicato: nodeId "${node.nodeId}" gia' presente`);
     }
   }
-  return { ...store, nodes: store.nodes.concat([node]) };
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes: store.nodes.concat([node]) };
 }
 
 function removeNode(store, name) {
@@ -267,7 +318,7 @@ function removeNode(store, name) {
   if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
   const nodes = store.nodes.slice();
   nodes.splice(idx, 1);
-  return { ...store, nodes };
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
 }
 
 function setNodeToken(store, name, token) {
@@ -276,17 +327,27 @@ function setNodeToken(store, name, token) {
   if (!validToken(token)) throw new Error('token non valido (vuoto, multilinea o troppo lungo)');
   const nodes = store.nodes.slice();
   nodes[idx] = { ...nodes[idx], token };
-  return { ...store, nodes };
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
+}
+
+function updateNode(store, name, patch) {
+  const idx = store.nodes.findIndex((n) => n.name === name);
+  if (idx < 0) throw new Error(`nodo sconosciuto: "${name}"`);
+  const parsed = parseNode({ ...store.nodes[idx], ...patch }, SCHEMA_VERSION);
+  if (!parsed) throw new Error('aggiornamento nodo non valido');
+  const nodes = store.nodes.slice();
+  nodes[idx] = parsed;
+  return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
 }
 
 function setRendezvous(store, rdv) {
   const parsed = parseRendezvous(rdv);
   if (!parsed) throw new Error('rendezvous non valido: controlla ssh/publishedPort/localPort/keyPath');
-  return { ...store, rendezvous: parsed };
+  return { ...store, schemaVersion: SCHEMA_VERSION, rendezvous: parsed };
 }
 
 function clearRendezvous(store) {
-  const out = { ...store };
+  const out = { ...store, schemaVersion: SCHEMA_VERSION };
   delete out.rendezvous;
   return out;
 }
@@ -296,13 +357,19 @@ function clearRendezvous(store) {
 function redactNode(n) {
   const out = {
     name: n.name,
-    ssh: n.ssh,
+    ...(n.ssh ? { ssh: n.ssh } : {}),
     remotePort: n.remotePort,
     localPort: n.localPort,
-    keyPath: n.keyPath,
-    roles: n.roles,
+    direction: n.direction || 'outbound',
+    transport: n.transport || 'ssh',
+    autostart: !!n.autostart,
+    visibility: n.visibility || 'network',
     hasToken: !!n.token, // presenza, non il valore
+    paired: !!(n.token && n.acceptToken),
   };
+  if (n.identityFile || n.keyPath) out.hasIdentity = true;
+  if (n.visibility === 'selected') out.selected = [...(n.selected || [])];
+  if (n.sshPort !== undefined) out.sshPort = n.sshPort;
   if (n.nodeId) out.nodeId = n.nodeId;
   return out;
 }
@@ -344,15 +411,15 @@ function migrateLegacyNodes(configPath, nodesPath) {
 
 module.exports = {
   // parse/validate
-  parseStore, parseNode, parseRendezvous, parseSsh, isPort, isAbsPath, validToken,
+  parseStore, parseNode, parseRendezvous, parseSsh, parseSshTarget, isPort, isAbsPath, validToken,
   // I/O
   defaultNodesPath, loadStore, atomicWriteStore, loadOrInitStore, emptyStore, newNodeId,
   // mutazioni
-  getNode, addNode, removeNode, setNodeToken, setRendezvous, clearRendezvous,
+  getNode, addNode, removeNode, setNodeToken, updateNode, setRendezvous, clearRendezvous,
   // redazione
   redactNode, redactStore,
   // migrazione
   migrateLegacyNodes,
   // costanti
-  SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
+  SCHEMA_VERSION, LEGACY_SCHEMA_VERSION, MAX_NODES, MAX_TOKEN_LEN, NODE_NAME_RE, NODE_ID_RE,
 };

package/lib/nodes/topology-cache.js

@@ -0,0 +1,75 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { NODE_ID_RE, NODE_NAME_RE } = require('./store.js');
+
+const SCHEMA_VERSION = 1;
+const MAX_ENTRIES = 256;
+const MAX_HOPS = 4;
+
+function defaultPath(home = os.homedir()) {
+  return path.join(home, '.nexuscrew', 'topology-cache.json');
+}
+
+function parseEntry(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const keys = Object.keys(raw).sort();
+  if (keys.some((k) => !['instanceId', 'lastSeen', 'name', 'route'].includes(k))) return null;
+  if (!NODE_ID_RE.test(raw.instanceId) || !NODE_NAME_RE.test(raw.name)) return null;
+  if (!Array.isArray(raw.route) || raw.route.length < 2 || raw.route.length > MAX_HOPS) return null;
+  if (raw.route.some((x) => !NODE_NAME_RE.test(x)) || new Set(raw.route).size !== raw.route.length) return null;
+  if (raw.name !== raw.route[raw.route.length - 1]) return null;
+  if (!Number.isInteger(raw.lastSeen) || raw.lastSeen < 0) return null;
+  return { instanceId: raw.instanceId, name: raw.name, route: [...raw.route], lastSeen: raw.lastSeen };
+}
+
+function parseCache(raw) {
+  let value = raw;
+  if (typeof value === 'string') {
+    try { value = JSON.parse(value); } catch (_) { return null; }
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (value.schemaVersion !== SCHEMA_VERSION || !Array.isArray(value.nodes) || value.nodes.length > MAX_ENTRIES) return null;
+  if (Object.keys(value).some((k) => !['schemaVersion', 'nodes'].includes(k))) return null;
+  const nodes = value.nodes.map(parseEntry);
+  if (nodes.some((x) => !x)) return null;
+  if (new Set(nodes.map((x) => x.instanceId)).size !== nodes.length) return null;
+  if (new Set(nodes.map((x) => x.route.join('/'))).size !== nodes.length) return null;
+  return { schemaVersion: SCHEMA_VERSION, nodes };
+}
+
+function emptyCache() { return { schemaVersion: SCHEMA_VERSION, nodes: [] }; }
+
+function loadCache(file = defaultPath()) {
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return null;
+    return parseCache(fs.readFileSync(file, 'utf8'));
+  } catch (e) {
+    return e.code === 'ENOENT' ? emptyCache() : null;
+  }
+}
+
+function atomicWriteCache(file, value) {
+  const parsed = parseCache(value);
+  if (!parsed) throw new Error('topology cache non valida');
+  try {
+    if (fs.lstatSync(file).isSymbolicLink()) throw new Error('refusing symlink topology cache target');
+  } catch (e) { if (e.code !== 'ENOENT') throw e; }
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+  return parsed;
+}
+
+module.exports = { SCHEMA_VERSION, MAX_ENTRIES, MAX_HOPS, defaultPath, parseEntry, parseCache, emptyCache, loadCache, atomicWriteCache };

package/lib/nodes/tunnel.js

@@ -33,8 +33,10 @@ function assertForwardSpec(node) {
   if (!node || typeof node !== 'object') throw new Error('tunnel: spec mancante');
   if (!store.isPort(node.localPort)) throw new Error('tunnel: localPort non valida');
   if (!store.isPort(node.remotePort)) throw new Error('tunnel: remotePort non valida');
-  if (!store.isAbsPath(node.keyPath)) throw new Error('tunnel: keyPath non valido');
-  if (!store.parseSsh(node.ssh)) throw new Error('tunnel: ssh (user@host) non valido');
+  if (node.sshPort !== undefined && !store.isPort(node.sshPort)) throw new Error('tunnel: sshPort non valida');
+  if (node.identityFile !== undefined && !store.isAbsPath(node.identityFile)) throw new Error('tunnel: identityFile non valido');
+  if (node.keyPath !== undefined && !store.isAbsPath(node.keyPath)) throw new Error('tunnel: keyPath non valido');
+  if (!store.parseSshTarget(node.ssh)) throw new Error('tunnel: target ssh non valido');
 }
 
 function assertReverseSpec(rdv) {
@@ -51,9 +53,14 @@ function assertReverseSpec(rdv) {
 //       -L 127.0.0.1:<locale>:127.0.0.1:<remota> user@host
 function buildForwardArgs(node) {
   assertForwardSpec(node);
-  return SSH_BASE_OPTS.concat([
-    '-i', node.keyPath,
+  const transport = node.sshPort === undefined ? [] : ['-p', String(node.sshPort)];
+  const identity = node.identityFile || node.keyPath;
+  const reverse = node.reversePort === undefined ? [] : [
+    '-R', `127.0.0.1:${node.reversePort}:127.0.0.1:${node.localAppPort || node.remotePort}`,
+  ];
+  return SSH_BASE_OPTS.concat(transport, identity ? ['-i', identity] : [], [
     '-L', `127.0.0.1:${node.localPort}:127.0.0.1:${node.remotePort}`,
+    ...reverse,
     node.ssh,
   ]);
 }
@@ -195,7 +202,7 @@ function startTunnel(opts) {
     child = spawnImpl(process.execPath, supervisorArgs, {
       detached: true,
       stdio: ['ignore', logFd, logFd],
-      env: { ...process.env, NEXUSCREW_TUNNEL_STATE: statePath },
+      env: { ...process.env, AUTOSSH_GATETIME: '0', NEXUSCREW_TUNNEL_STATE: statePath },
     });
   } catch (e) {
     closeOwnedFd();
@@ -257,8 +264,16 @@ function restartTunnel(opts) {
 // Helper di alto livello: costruisce args dal nodo e avvia il forward.
 function startForward(opts) {
   const node = opts.node;
-  const args = buildForwardArgs(node);
-  return startTunnel({ ...opts, name: node.name, args });
+  let sshBin = opts.sshBin;
+  let args = buildForwardArgs({ ...node, localAppPort: opts.localAppPort });
+  const wanted = node.transport || (node.keyPath ? 'ssh' : 'auto');
+  if (!sshBin && (wanted === 'auto' || wanted === 'autossh') && sshBinaryAvailable('autossh', opts.spawnSyncImpl)) {
+    sshBin = 'autossh';
+    args = ['-M', '0', ...args];
+  } else if (!sshBin) {
+    sshBin = 'ssh';
+  }
+  return startTunnel({ ...opts, sshBin, name: node.name, args });
 }
 
 // Helper di alto livello: reverse verso il rendezvous.