@mmmbuto/nexuscrew 0.8.16 → 0.8.17

package/lib/settings/routes.js

@@ -47,7 +47,7 @@ const nodesStore = require('../nodes/store.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
-const { probeHealth, waitForHealthyPeer } = require('../proxy/federation.js');
+const { waitForHealthyPeer } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
@@ -56,6 +56,11 @@ const { configJsonPath } = require('../config.js');
 const VERSION = require('../../package.json').version;
 const { scrubError } = require('../update/core.js');
 
+// Sottomoduli estratti da questo file (modularizzazione behavior-preserving):
+// il transaction handler di /nodes/pair e la superficie pubblica di peering.
+const { createPairHandler } = require('./pairing-coordinator.js');
+const { publicPeeringRoutes } = require('./public-peering-routes.js');
+
 // Whitelist chiavi scrivibili di config.json via API (lista chiusa dal task B2).
 const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone', 'autoUpdate']);
 const ROLE_KEYS = new Set(['client', 'node']);
@@ -357,292 +362,16 @@ function settingsRoutes(deps = {}) {
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
-  // Hydra join in stadi espliciti: la PWA riceve un contratto strutturato
-  // {error, code, stage, detail?, hint?, retryable?} — MAI credenziali, token,
-  // header Authorization o contenuto di chiavi nel payload. Stadi distinti:
-  //   validation | conflict | ssh-start | ssh-ready | join | tunnel-final |
-  //   confirm | health   (+ internal per gli inattesi)
-  // Lo sleep fisso 900ms e' sostituito da un probe di readiness bounded
-  // (peering.probeTransportReady) eseguito PRIMA di consumare l'invite one-time;
-  // una risposta join ambigua (rete morta dopo l'invio) non viene mai rigiocata.
-  // Su qualunque fallimento post-provisioning il rollback locale/remoto gira
-  // esattamente una volta e lo stage fallito arriva al client.
-  r.post('/nodes/pair', mutGate, async (req, res) => {
-    const b = req.body || {};
-    const redactSecrets = (s) => String(s || '')
-      .replace(/Bearer\s+\S+/gi, 'Bearer ***')
-      .replace(/[A-Za-z0-9_-]{40,}/g, '***');
-    const fail = (status, stage, code, detail, extra = {}) => send(res, status, {
-      error: redactSecrets(detail), stage, code, detail: redactSecrets(detail), retryable: false, ...extra,
-    });
-    if (!validName(b.name)) return fail(400, 'validation', 'bad-name', 'name non valido (slug a-z, 0-9, -, max 32)', { retryable: true });
-    if (!nodesStore.parseSshTarget(b.ssh)) return fail(400, 'validation', 'bad-ssh', 'alias SSH non valido (atteso user@host o Host alias)', { retryable: true });
-    const pair = peering.parsePairingUrl(b.pairingUrl);
-    if (!pair) return fail(400, 'validation', 'bad-link', 'link di pairing non valido o corrotto', { retryable: true, hint: 'rigenera il link sul dispositivo che invita' });
-    if (b.sshPort !== undefined && !nodesStore.isPort(b.sshPort)) return fail(400, 'validation', 'bad-ssh-port', 'sshPort non valida (1..65535)', { retryable: true });
-    if (b.identityFile !== undefined && !nodesStore.isAbsPath(b.identityFile)) return fail(400, 'validation', 'bad-identity-file', 'identityFile non valido (path assoluto)', { retryable: true });
-    if (b.label !== undefined && !nodesStore.validLabel(b.label)) return fail(400, 'validation', 'bad-label', 'label non valida (max 64 char, niente a capo)', { retryable: true });
-    if (b.localLabel !== undefined && !nodesStore.validLabel(b.localLabel)) return fail(400, 'validation', 'bad-label', 'localLabel non valida (max 64 char, niente a capo)', { retryable: true });
-    // label umana del peer come lo vedro' io (display); se assente usa lo slug.
-    const peerLabel = nodesStore.sanitizeLabel(b.label, b.name);
-    // etichetta umana con cui il peer vedra' questo dispositivo; default sensato.
-    const localLabel = nodesStore.sanitizeLabel(b.localLabel, defaultDeviceName());
-    const fetchImpl = seams.fetchImpl || fetch;
-    const sleep = typeof seams.pairDelay === 'function' ? seams.pairDelay : undefined;
-    const transportProbe = typeof seams.probeTransportReady === 'function'
-      ? seams.probeTransportReady : peering.probeTransportReady;
-    const requestTimeoutMs = Number.isInteger(seams.pairRequestTimeoutMs) && seams.pairRequestTimeoutMs > 0
-      ? seams.pairRequestTimeoutMs : 6000;
-    // Every protocol request must terminate. Readiness and federation health
-    // already have their own bounded probes; join/confirm/cancel use this
-    // wrapper so a half-open peer cannot leave the PWA waiting forever.
-    const pairFetch = async (url, opts = {}, timeoutMs = requestTimeoutMs) => {
-      const ctrl = new AbortController();
-      const timer = setTimeout(() => ctrl.abort(), timeoutMs);
-      try { return await fetchImpl(url, { ...opts, signal: ctrl.signal }); }
-      finally { clearTimeout(timer); }
-    };
-
-    let provisionalPort = null;
-    let portReservation = null;
-    let rollbackCredential = null;
-    let created = false;
-    let rolledBack = false;
-    // Rollback locale/remoto ESATTAMENTE una volta, best-effort: cancella la
-    // credenziale provvisoria sul peer (se emessa) e rimuove nodo+tunnel locali.
-    const rollback = async () => {
-      if (rolledBack) return; rolledBack = true;
-      if (portReservation) {
-        try { await portReservation.release(); } catch (_) { /* best-effort */ }
-        portReservation = null;
-      }
-      if (rollbackCredential && provisionalPort) {
-        try {
-          await pairFetch(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
-            method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId, credential: rollbackCredential }),
-          }, Math.min(requestTimeoutMs, 3000));
-        } catch (_) { /* best-effort */ }
-      }
-      try {
-        const st = nodesStore.loadStore(nodesPath);
-        const n = st && nodesStore.getNode(st, b.name);
-        if (n && created) {
-          nodesTunnel.stopTunnel({ home, name: b.name });
-          nodesStore.atomicWriteStore(nodesPath, nodesStore.removeNode(st, b.name));
-        }
-      } catch (_) { /* best-effort */ }
-    };
-    const failRolledBack = async (status, stage, code, detail, extra = {}) => {
-      await rollback();
-      return fail(status, stage, code, detail, extra);
-    };
-
-    try {
-      // --- conflict: il nome non deve gia' esistere --------------------------
-      let st = nodesStore.loadOrInitStore(nodesPath);
-      if (st.nodes.some((n) => n.name === b.name)) {
-        return fail(409, 'conflict', 'name-exists', `nodo "${b.name}" gia' presente`, {
-          retryable: true, hint: 'scegli un altro nome nelle opzioni avanzate e riprova',
-        });
-      }
-      if (st.nodeId === pair.instanceId) {
-        return fail(409, 'conflict', 'self-pairing', 'il link appartiene a questa stessa installazione', {
-          hint: 'genera il link sul nodo remoto che vuoi collegare',
-        });
-      }
-      const knownPeer = st.nodes.find((n) => n.nodeId === pair.instanceId);
-      if (knownPeer) {
-        return fail(409, 'conflict', 'peer-exists', `questa installazione e' gia' collegata come "${knownPeer.name}"`, {
-          hint: 'usa il nodo esistente oppure rimuovilo prima di rifare il pairing',
-        });
-      }
-      let localPort;
-      try {
-        portReservation = await nodesCmds.reserveLocalPort(st, {
-          createServerImpl: seams.createPortServer,
-        });
-        localPort = portReservation.port;
-      } catch (e) {
-        return fail(502, 'ssh-start', 'local-port-unavailable',
-          `nessuna porta locale disponibile per il tunnel: ${String((e && e.message) || e)}`, {
-            retryable: true, hint: 'chiudi il processo che occupa le porte locali e riprova',
-          });
-      }
-      provisionalPort = localPort;
-      const acceptToken = crypto.randomBytes(32).toString('base64url');
-      try {
-        st = nodesStore.addNode(st, {
-          name: b.name, ssh: b.ssh, sshPort: b.sshPort,
-          remotePort: pair.port, localPort, identityFile: b.identityFile,
-          transport: 'auto', autostart: true, visibility: 'network',
-          direction: 'outbound', acceptToken, label: peerLabel,
-        });
-      } catch (e) {
-        const msg = String((e && e.message) || e);
-        const isDup = msg.includes('duplicato') || msg.includes('self-reference');
-        return failRolledBack(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
-      }
-      nodesStore.atomicWriteStore(nodesPath, st);
-      created = true;
-      const node = nodesStore.getNode(st, b.name);
-
-      // --- ssh-start: supervisor del tunnel -L provvisorio --------------------
-      // Il bind OS-aware ha protetto la scelta fino a questo punto. SSH deve
-      // prendere la stessa porta, quindi rilasciamo immediatamente prima dello
-      // spawn (eventuali race residue emergono come local-forward-bind).
-      await portReservation.release();
-      portReservation = null;
-      const started = nodesTunnel.startForward({
-        home, node, localAppPort: runtimePort(),
-        spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
-        sshBin: seams.sshBin, logFd: seams.logFd,
-      });
-      if (!started.started && started.reason !== 'already running') {
-        return failRolledBack(502, 'ssh-start', 'tunnel-start-failed', started.reason || 'avvio del tunnel SSH fallito', {
-          retryable: true,
-          hint: 'verifica ssh e target/alias su questo dispositivo; il link NON e\' stato consumato e puoi riprovare',
-        });
-      }
-
-      // --- ssh-ready: readiness bounded PRIMA di consumare l'invite -----------
-      const ready = await transportProbe({
-        port: localPort, capability: pair.invite, expectedInstanceId: pair.instanceId,
-        fetchImpl, sleep,
-      });
-      if (!ready.ready) {
-        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, b.name, pair.port);
-        return failRolledBack(502, 'ssh-ready', (diagnosis && diagnosis.code) || ready.code || 'transport-not-ready',
-          (diagnosis && diagnosis.detail)
-            || `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
-          retryable: true,
-          hint: (diagnosis && diagnosis.hint)
-            || 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
-        });
-      }
-
-      // --- join: consuma l'invite one-time (UNA volta, mai replay) ------------
-      let jr;
-      try {
-        jr = await pairFetch(`http://127.0.0.1:${localPort}/pair/join`, {
-          method: 'POST', headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({
-            invite: pair.invite,
-            instanceId: st.nodeId,
-            name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
-            label: localLabel,
-            port: runtimePort(),
-            acceptToken,
-            // Pairing establishes a private client-to-hub connection. Sharing
-            // this device back through the hub is a separate explicit action.
-            shared: false,
-            roles: readRoles(configPath),
-          }),
-        });
-      } catch (e) {
-        // Risposta persa DOPO l'invio: l'invite potrebbe essere stato consumato.
-        // Un join ambiguo non si rigioca mai.
-        return failRolledBack(502, 'join', 'join-ambiguous',
-          'risposta di join persa: l\'invito potrebbe essere gia\' stato consumato', {
-            hint: 'rigenera un nuovo link sul dispositivo che invita e riprova',
-          });
-      }
-      const joined = await jr.json().catch(() => ({}));
-      if (jr.status === 410) {
-        return failRolledBack(502, 'join', 'invite-expired', 'invito scaduto o gia\' usato (one-time)', {
-          hint: 'rigenera un nuovo link sul dispositivo che invita',
-        });
-      }
-      if (!jr.ok) {
-        return failRolledBack(502, 'join', 'join-rejected', joined.error || `join rifiutato dal peer (HTTP ${jr.status})`, {
-          hint: 'rigenera un nuovo link e riprova',
-        });
-      }
-      const joinedRoles = joined.roles === undefined ? null : nodesStore.parseRoles(joined.roles);
-      if (!nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
-        || !nodesStore.NODE_ID_RE.test(joined.instanceId) || (joined.roles !== undefined && !joinedRoles)) {
-        return failRolledBack(502, 'join', 'join-invalid-response', 'risposta di join non valida dal peer', {
-          hint: 'versioni NexusCrew incompatibili? aggiorna entrambi i nodi',
-        });
-      }
-      rollbackCredential = joined.credential;
-      if (joined.instanceId !== pair.instanceId) {
-        return failRolledBack(502, 'join', 'peer-identity-mismatch',
-          'l\'identita\' del peer raggiunto non coincide con quella contenuta nel link', {
-            hint: 'controlla che il target SSH punti al nodo che ha generato il link',
-          });
-      }
-
-      // --- tunnel-final: connessione privata, solo -L -------------------------
-      // reversePort resta negoziata per un futuro Share opt-in, ma il builder
-      // non emette -R finche' shared non diventa true.
-      st = nodesStore.loadOrInitStore(nodesPath);
-      st = nodesStore.updateNode(st, b.name, {
-        token: joined.credential, nodeId: joined.instanceId, reversePort: joined.reversePort,
-        shared: false,
-        ...(joinedRoles ? { roles: joinedRoles, rolesKnown: true } : {}),
-      });
-      nodesStore.atomicWriteStore(nodesPath, st);
-      nodesTunnel.stopTunnel({ home, name: b.name });
-      const finalStart = nodesTunnel.startForward({
-        home, node: nodesStore.getNode(st, b.name), localAppPort: runtimePort(),
-        spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
-        sshBin: seams.sshBin, logFd: seams.logFd,
-      });
-      if (!finalStart.started && finalStart.reason !== 'already running') {
-        return failRolledBack(502, 'tunnel-final', 'tunnel-restart-failed', finalStart.reason || 'riavvio del tunnel negoziato fallito', {});
-      }
-      const readyFinal = await transportProbe({
-        port: localPort, capability: joined.credential, expectedInstanceId: joined.instanceId,
-        fetchImpl, sleep,
-      });
-      if (!readyFinal.ready) {
-        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, b.name, pair.port);
-        return failRolledBack(502, 'tunnel-final', (diagnosis && diagnosis.code) || readyFinal.code || 'transport-not-ready',
-          (diagnosis && diagnosis.detail)
-            || `il tunnel negoziato non risponde o non corrisponde al peer atteso (${readyFinal.attempts} tentativi)`, {
-            hint: (diagnosis && diagnosis.hint) || 'verifica il target SSH e riprova con un nuovo link',
-          });
-      }
-
-      // --- confirm: idempotente lato peer -> bounded retry ---------------------
-      let confirmed = null;
-      for (let attempt = 0; attempt < 3; attempt += 1) {
-        try {
-          confirmed = await pairFetch(`http://127.0.0.1:${localPort}/pair/confirm`, {
-            method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ credential: joined.credential }),
-          }, Math.min(requestTimeoutMs, 3500));
-          if (confirmed.ok) break;
-        } catch (_) { /* retry: confirm e' idempotente lato peer */ }
-        if (attempt < 2) await (sleep ? sleep() : new Promise((resolve) => setTimeout(resolve, 400 * (attempt + 1))));
-      }
-      if (!confirmed || !confirmed.ok) {
-        const x = confirmed ? await confirmed.json().catch(() => ({})) : {};
-        return failRolledBack(502, 'confirm', 'confirm-failed',
-          x.error || `conferma pairing fallita (HTTP ${confirmed ? confirmed.status : 'irraggiungibile'})`, {
-            hint: 'rigenera un nuovo link e riprova',
-          });
-      }
-
-      // --- health: federazione AUTENTICATA verificata prima di paired:true ----
-      const health = await probeHealth({
-        port: localPort, token: joined.credential, expectedInstanceId: joined.instanceId,
-        fetchImpl, now: Date.now(),
-      });
-      if (!health || health.status !== 'healthy') {
-        return failRolledBack(502, 'health', 'federation-health-failed',
-          (health && health.detail) || 'health federato non verificabile dopo la conferma', {
-            hint: 'pairing annullato e ripulito: rigenera il link e riprova',
-          });
-      }
-
-      send(res, 200, { paired: true, name: b.name, instanceId: joined.instanceId, transport: 'auto', health: { status: health.status } });
-    } catch (e) {
-      await rollback();
-      fail(502, 'internal', 'unexpected', String((e && e.message) || e), {});
-    }
-  });
+  // --- POST /nodes/pair — hydra join in stadi espliciti ---------------------
+  // Transaction handler estratto in lib/settings/pairing-coordinator.js
+  // (createPairHandler): probe di readiness bounded, consumo one-time dell'invite,
+  // rollback locale/remoto esattamente una volta, health federato autenticato
+  // prima di paired:true. Qui resta solo la registrazione dietro mutGate;
+  // token/credenziali MAI nel payload (redazione nel handler estratto).
+  r.post('/nodes/pair', mutGate, createPairHandler({
+    send, validName, defaultDeviceName,
+    nodesPath, configPath, home, seams, runtimePort,
+  }));
 
   // --- POST /nodes — nodes add (riusa nodesCmds.nodesAdd) --------------------
   r.post('/nodes', mutGate, (req, res) => {
@@ -941,113 +670,4 @@ function settingsRoutes(deps = {}) {
   return r;
 }
 
-// Public only because the one-time invite itself is the capability. The route
-// exposes no generic API and creates a scoped peer credential, never a UI token.
-function publicPeeringRoutes(deps = {}) {
-  const cfg = deps.cfg || {};
-  const home = cfg.home || os.homedir();
-  const configPath = cfg.configPath || configJsonPath();
-  const nodesPath = deps.nodesPath || cfg.nodesPath || nodesStore.defaultNodesPath(home);
-  const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
-  const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
-  const r = express.Router();
-  const attempts = new Map();
-  r.use(express.json({ limit: '8kb' }));
-  // Identity proof non consuma la capability e non riceve mai invite/token in
-  // chiaro. Serve a impedire che un qualunque listener HTTP sulla porta -L
-  // venga scambiato per il nodo contenuto nel link.
-  r.post('/identity', (req, res) => {
-    const key = `identity:${String(req.socket && req.socket.remoteAddress || 'local')}`;
-    const now = Date.now();
-    const recent = (attempts.get(key) || []).filter((x) => now - x < 60_000);
-    recent.push(now); attempts.set(key, recent);
-    if (recent.length > 30) return res.status(429).json({ error: 'troppi tentativi' });
-    const b = req.body || {};
-    const proof = peering.capabilityIdentity({
-      invitesPath, pendingPath, capabilityId: b.capabilityId, challenge: b.challenge, now,
-    });
-    if (!proof) return res.status(404).json({ error: 'capability non valida' });
-    const st = nodesStore.loadStore(nodesPath);
-    if (!st || !nodesStore.NODE_ID_RE.test(st.nodeId)) return res.status(503).json({ error: 'identita nodo non disponibile' });
-    return res.json({ ok: true, instanceId: st.nodeId, proof });
-  });
-  r.post('/join', (req, res) => {
-    const key = `join:${String(req.socket && req.socket.remoteAddress || 'local')}`;
-    const now = Date.now();
-    const recent = (attempts.get(key) || []).filter((x) => now - x < 60_000);
-    recent.push(now); attempts.set(key, recent);
-    if (recent.length > 10) return res.status(429).json({ error: 'troppi tentativi di pairing' });
-    const b = req.body || {};
-    const peerRoles = b.roles === undefined ? null : nodesStore.parseRoles(b.roles);
-    if (!nodesStore.validToken(b.invite) || !nodesStore.NODE_ID_RE.test(b.instanceId)
-      || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)
-      || (b.roles !== undefined && !peerRoles)
-      // Pairing is always private. Publishing is a separate authenticated
-      // action after the reverse channel is live and health-checked.
-      || (b.shared !== undefined && b.shared !== false)) {
-      return res.status(400).json({ error: 'pairing request non valida' });
-    }
-    if (b.label !== undefined && !nodesStore.validLabel(b.label)) {
-      return res.status(400).json({ error: 'label non valida' });
-    }
-    if (!peering.consumeInvite({ invitesPath, invite: b.invite })) return res.status(410).json({ error: 'invito scaduto o gia usato' });
-    try {
-      const st = nodesStore.loadOrInitStore(nodesPath);
-      if (st.nodeId === b.instanceId || st.nodes.some((n) => n.nodeId === b.instanceId)) return res.status(409).json({ error: 'peer duplicato' });
-      let name = b.name;
-      for (let i = 2; nodesStore.getNode(st, name); i += 1) name = `${b.name.slice(0, 28)}-${i}`;
-      const reversePort = peering.allocateReversePort(st.nodes);
-      const credential = peering.createPending({ pendingPath, data: {
-        name, remotePort: b.port, reversePort, instanceId: b.instanceId, acceptToken: b.acceptToken,
-        shared: false,
-        label: nodesStore.sanitizeLabel(b.label, name),
-        ...(peerRoles ? { roles: { ...peerRoles, node: false }, rolesKnown: true } : { rolesKnown: false }),
-      } });
-      res.json({ paired: true, instanceId: st.nodeId, reversePort, credential, roles: readRoles(configPath) });
-    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
-  });
-  r.post('/confirm', (req, res) => {
-    const b = req.body || {};
-    if (!nodesStore.validToken(b.credential)) return res.status(400).json({ error: 'confirm non valido' });
-    const pending = peering.consumePending({ pendingPath, credential: b.credential });
-    if (!pending) {
-      const st = nodesStore.loadStore(nodesPath);
-      if (st && st.nodes.some((n) => n.acceptToken && peering.safeEqual(n.acceptToken, b.credential))) return res.json({ confirmed: true, idempotent: true });
-      return res.status(410).json({ error: 'pairing pending scaduto o gia usato' });
-    }
-    try {
-      let st = nodesStore.loadOrInitStore(nodesPath);
-      if (st.nodeId === pending.instanceId || st.nodes.some((n) => n.nodeId === pending.instanceId)) return res.status(409).json({ error: 'peer duplicato' });
-      st = nodesStore.addNode(st, {
-        name: pending.name, remotePort: pending.remotePort, localPort: pending.reversePort,
-        direction: 'inbound', transport: 'inbound', autostart: true,
-        visibility: 'network', shared: pending.shared === true, nodeId: pending.instanceId,
-        token: pending.acceptToken, acceptToken: b.credential,
-        ...(pending.roles ? { roles: pending.roles } : {}),
-        rolesKnown: pending.rolesKnown === true,
-        ...(pending.label ? { label: pending.label } : {}),
-      });
-      nodesStore.atomicWriteStore(nodesPath, st);
-      res.json({ confirmed: true });
-    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
-  });
-  r.post('/cancel', (req, res) => {
-    const b = req.body || {};
-    if (!nodesStore.NODE_ID_RE.test(b.instanceId) || !nodesStore.validToken(b.credential)) return res.status(400).json({ error: 'cancel non valido' });
-    try {
-      const pending = peering.consumePending({ pendingPath, credential: b.credential });
-      if (!pending || pending.instanceId !== b.instanceId) {
-        const st = nodesStore.loadStore(nodesPath);
-        const peer = st && st.nodes.find((n) => n.nodeId === b.instanceId && n.acceptToken && peering.safeEqual(n.acceptToken, b.credential));
-        if (!peer) return res.status(404).json({ error: 'pair non trovato' });
-        nodesStore.atomicWriteStore(nodesPath, nodesStore.removeNode(st, peer.name));
-      }
-      res.json({ cancelled: true });
-    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
-  });
-  return r;
-}
-
-function validPeerName(name) { return typeof name === 'string' && nodesStore.NODE_NAME_RE.test(name); }
-
 module.exports = { settingsRoutes, publicPeeringRoutes, deepScrubTokens };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {