@mmmbuto/nexuscrew 0.8.2 → 0.8.4

package/lib/nodes/topology-cache.js

@@ -0,0 +1,75 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { NODE_ID_RE, NODE_NAME_RE } = require('./store.js');
+
+const SCHEMA_VERSION = 1;
+const MAX_ENTRIES = 256;
+const MAX_HOPS = 4;
+
+function defaultPath(home = os.homedir()) {
+  return path.join(home, '.nexuscrew', 'topology-cache.json');
+}
+
+function parseEntry(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const keys = Object.keys(raw).sort();
+  if (keys.some((k) => !['instanceId', 'lastSeen', 'name', 'route'].includes(k))) return null;
+  if (!NODE_ID_RE.test(raw.instanceId) || !NODE_NAME_RE.test(raw.name)) return null;
+  if (!Array.isArray(raw.route) || raw.route.length < 2 || raw.route.length > MAX_HOPS) return null;
+  if (raw.route.some((x) => !NODE_NAME_RE.test(x)) || new Set(raw.route).size !== raw.route.length) return null;
+  if (raw.name !== raw.route[raw.route.length - 1]) return null;
+  if (!Number.isInteger(raw.lastSeen) || raw.lastSeen < 0) return null;
+  return { instanceId: raw.instanceId, name: raw.name, route: [...raw.route], lastSeen: raw.lastSeen };
+}
+
+function parseCache(raw) {
+  let value = raw;
+  if (typeof value === 'string') {
+    try { value = JSON.parse(value); } catch (_) { return null; }
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (value.schemaVersion !== SCHEMA_VERSION || !Array.isArray(value.nodes) || value.nodes.length > MAX_ENTRIES) return null;
+  if (Object.keys(value).some((k) => !['schemaVersion', 'nodes'].includes(k))) return null;
+  const nodes = value.nodes.map(parseEntry);
+  if (nodes.some((x) => !x)) return null;
+  if (new Set(nodes.map((x) => x.instanceId)).size !== nodes.length) return null;
+  if (new Set(nodes.map((x) => x.route.join('/'))).size !== nodes.length) return null;
+  return { schemaVersion: SCHEMA_VERSION, nodes };
+}
+
+function emptyCache() { return { schemaVersion: SCHEMA_VERSION, nodes: [] }; }
+
+function loadCache(file = defaultPath()) {
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return null;
+    return parseCache(fs.readFileSync(file, 'utf8'));
+  } catch (e) {
+    return e.code === 'ENOENT' ? emptyCache() : null;
+  }
+}
+
+function atomicWriteCache(file, value) {
+  const parsed = parseCache(value);
+  if (!parsed) throw new Error('topology cache non valida');
+  try {
+    if (fs.lstatSync(file).isSymbolicLink()) throw new Error('refusing symlink topology cache target');
+  } catch (e) { if (e.code !== 'ENOENT') throw e; }
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+  return parsed;
+}
+
+module.exports = { SCHEMA_VERSION, MAX_ENTRIES, MAX_HOPS, defaultPath, parseEntry, parseCache, emptyCache, loadCache, atomicWriteCache };

package/lib/proxy/federation.js

@@ -4,6 +4,7 @@ const http = require('node:http');
 const net = require('node:net');
 const express = require('express');
 const store = require('../nodes/store.js');
+const topologyCache = require('../nodes/topology-cache.js');
 const { bearerFrom } = require('../auth/middleware.js');
 const { safeEqual } = require('../nodes/peering.js');
 const {
@@ -53,7 +54,8 @@ function knownResource(resource) {
     || resource === '/files'
     || resource === '/files/download'
     || resource === '/files/upload'
-    || resource === '/ws';
+    || resource === '/ws'
+    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell)$/.test(resource);
 }
 
 function allowedResource(resource, method = 'GET') {
@@ -65,6 +67,8 @@ function allowedResource(resource, method = 'GET') {
   if (resource === '/files/download') return method === 'GET';
   if (resource === '/files/upload') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
+  if (/^\/fleet\/(status|schema|definitions)$/.test(resource)) return method === 'GET';
+  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell)$/.test(resource)) return method === 'POST';
   return false;
 }
 
@@ -111,6 +115,62 @@ function queryOf(url) {
   return i < 0 ? '' : stripLocalTokenQuery(String(url).slice(i));
 }
 
+// probeHealth: probe federato di un peer verso la sua porta forward locale
+// (127.0.0.1:port) autenticato con il token del nodo (Bearer accettato dal
+// peerRouter via acceptToken). Modella 3 dimensioni invece di un boolean "up":
+//   transport    — la porta TCP risponde (qualcuno e' in ascolto)
+//   auth         — la federation accetta la credenziale (200 vs 401)
+//   reachability — l'API risponde con payload comprensibile (200 vs 5xx)
+// Mai lancia: ogni guasto (refused/timeout/abort) -> {transport:'down',...}.
+// Questo e' il cuore del fix "peer localhost risponde in porta ma federation 401":
+// il 401 emerge come auth:'failed' con diagnostica esplicita invece di essere
+// mascherato da uno stato verde hardcoded.
+async function probeHealth({ port, token, expectedInstanceId = null, fetchImpl = fetch, timeoutMs = 1500, now = Date.now() }) {
+  const out = { transport: 'unknown', auth: 'unknown', reachability: 'unknown', status: 'unknown', detail: '', httpStatus: null, at: now };
+  let r;
+  let timer;
+  try {
+    const ctrl = new AbortController();
+    timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    r = await fetchImpl(`http://127.0.0.1:${port}/federation/health`, {
+      headers: { authorization: `Bearer ${token}` }, signal: ctrl.signal,
+    });
+  } catch (e) {
+    out.transport = 'down';
+    out.status = 'down';
+    out.detail = (e && (e.name === 'AbortError' || e.code === 'ETIMEDOUT'))
+      ? `peer non raggiungibile (timeout ${timeoutMs}ms)` : 'peer non raggiungibile (tcp refused/down)';
+    return out;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+  out.transport = 'up';
+  out.httpStatus = r.status;
+  if (r.status === 200) {
+    out.auth = 'ok';
+    let body;
+    try { body = await r.json(); } catch (_) { body = null; }
+    if (!body || body.ok !== true || typeof body.instanceId !== 'string') {
+      out.reachability = 'failed'; out.status = 'degraded'; out.detail = 'health payload non valido';
+    } else if (expectedInstanceId && body.instanceId !== expectedInstanceId) {
+      out.reachability = 'failed'; out.status = 'degraded'; out.detail = 'peer instanceId inatteso — tunnel/porta punta al nodo sbagliato';
+    } else {
+      out.reachability = 'ok'; out.status = 'healthy'; out.detail = 'ok';
+    }
+  } else if (r.status === 401) {
+    out.auth = 'failed'; out.reachability = 'ok'; out.status = 'degraded';
+    out.detail = 'federation 401 — acceptToken non valido, re-pair richiesto';
+  } else if (r.status === 403) {
+    out.auth = 'ok'; out.reachability = 'ok'; out.status = 'degraded';
+    out.detail = 'peer in READONLY o transito negato (403)';
+  } else if (r.status >= 500) {
+    out.reachability = 'failed'; out.status = 'degraded'; out.detail = `peer HTTP ${r.status}`;
+  } else {
+    out.reachability = 'failed'; out.status = 'degraded'; out.detail = `peer HTTP ${r.status}`;
+  }
+  return out;
+}
+
 function controlledVisited(req, ingress, instanceId) {
   const raw = ingress ? String(req.headers['x-nexuscrew-visited'] || '') : '';
   const seen = raw ? raw.split(',').filter(Boolean) : [];
@@ -118,12 +178,13 @@ function controlledVisited(req, ingress, instanceId) {
   return [...seen, instanceId];
 }
 
-async function collectTopology({ nodesPath, ingress = null, ttl = MAX_HOPS, visited = [], fetchImpl = fetch }) {
+async function collectTopologyDetailed({ nodesPath, ingress = null, ttl = MAX_HOPS, visited = [], fetchImpl = fetch }) {
   const st = store.loadStore(nodesPath);
-  if (!st) return { instanceId: null, nodes: [] };
+  if (!st) return { instanceId: null, nodes: [], authoritative: [] };
   const seen = new Set(visited.filter((x) => store.NODE_ID_RE.test(x)));
   seen.add(st.nodeId);
   const out = [];
+  const authoritative = [];
   for (const n of st.nodes) {
     if (!n.nodeId || seen.has(n.nodeId) || (ingress && !canTransit(ingress, n))) continue;
     out.push({ instanceId: n.nodeId, name: n.name, route: [n.name], direct: true });
@@ -133,6 +194,7 @@ async function collectTopology({ nodesPath, ingress = null, ttl = MAX_HOPS, visi
       const r = await fetchImpl(u, { headers: { authorization: `Bearer ${n.token}` } });
       const j = await r.json();
       if (!r.ok || j.instanceId !== n.nodeId || !Array.isArray(j.nodes)) continue;
+      authoritative.push(n.name);
       for (const child of j.nodes) {
         if (!child || !store.NODE_ID_RE.test(child.instanceId) || child.instanceId === n.nodeId || seen.has(child.instanceId)
           || !store.NODE_NAME_RE.test(child.name)
@@ -151,16 +213,64 @@ async function collectTopology({ nodesPath, ingress = null, ttl = MAX_HOPS, visi
     if (ids.has(n.instanceId) || routes.has(routeKey)) continue;
     ids.add(n.instanceId); routes.add(routeKey); unique.push(n);
   }
-  return { instanceId: st.nodeId, nodes: unique };
+  return { instanceId: st.nodeId, nodes: unique, authoritative };
+}
+
+async function collectTopology(opts) {
+  const out = await collectTopologyDetailed(opts);
+  return { instanceId: out.instanceId, nodes: out.nodes };
 }
 
-function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly }) {
+// Local roster: live topology plus a credential-free cache of previously seen
+// transitive nodes. Stale entries are never returned by the peer endpoint.
+async function collectLocalTopology({ nodesPath, cachePath, fetchImpl = fetch, now = Math.floor(Date.now() / 1000) }) {
+  const live = await collectTopologyDetailed({ nodesPath, fetchImpl });
+  const st = store.loadStore(nodesPath);
+  const directNames = new Set(((st && st.nodes) || []).map((n) => n.name));
+  const authoritative = new Set(live.authoritative);
+  const liveIds = new Set(live.nodes.map((n) => n.instanceId));
+  const liveRoutes = new Set(live.nodes.map((n) => n.route.join('/')));
+  const cacheFile = cachePath || topologyCache.defaultPath();
+  const old = topologyCache.loadCache(cacheFile) || topologyCache.emptyCache();
+  const next = new Map();
+
+  for (const entry of old.nodes) {
+    const first = entry.route[0];
+    if (!directNames.has(first)) continue;
+    if (authoritative.has(first) && !liveIds.has(entry.instanceId) && !liveRoutes.has(entry.route.join('/'))) continue;
+    next.set(entry.instanceId, entry);
+  }
+  for (const n of live.nodes) {
+    if (n.route.length > 1) next.set(n.instanceId, { instanceId: n.instanceId, name: n.name, route: [...n.route], lastSeen: now });
+  }
+  const cached = [...next.values()].sort((a, b) => a.route.join('/').localeCompare(b.route.join('/'))).slice(0, topologyCache.MAX_ENTRIES);
+  const serialized = { schemaVersion: topologyCache.SCHEMA_VERSION, nodes: cached };
+  if (JSON.stringify(serialized) !== JSON.stringify(old)) {
+    try { topologyCache.atomicWriteCache(cacheFile, serialized); } catch (_) {}
+  }
+
+  const nodes = live.nodes.map((n) => ({ ...n, stale: false, lastSeen: now }));
+  for (const n of cached) {
+    if (!liveIds.has(n.instanceId) && !liveRoutes.has(n.route.join('/'))) nodes.push({ ...n, direct: false, stale: true });
+  }
+  return { instanceId: live.instanceId, nodes };
+}
+
+function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly, version = null }) {
   const r = express.Router();
   r.use((req, res, next) => {
     const peer = peerFromToken(nodesPath, bearerFrom(req));
     if (!peer) return res.status(401).json({ error: 'unauthorized peer' });
     req.peer = peer; next();
   });
+  // Health federato: il peer autenticato (acceptToken matchato sopra) ottiene un
+  // 200 esplicito con instanceId/version. Serve da target di probeHealth() lato
+  // Initiator: distingue transport (porta aperta) da auth (200 vs 401) da
+  // reachability (payload). Nessun segreto in risposta.
+  r.get('/health', (_req, res) => {
+    const st = store.loadStore(nodesPath);
+    res.json({ ok: true, instanceId: (st && st.nodeId) || null, version, readonly: !!readonly() });
+  });
   r.get('/topology', async (req, res) => {
     const ttl = Math.max(0, Math.min(MAX_HOPS, Number(req.query.ttl) || MAX_HOPS));
     const visited = String(req.query.visited || '').split(',');
@@ -213,5 +323,6 @@ function reject(socket, code) { try { socket.end(`HTTP/1.1 ${code} Error\r\nConn
 
 module.exports = {
   MAX_HOPS, ROUTE_DELIMITER, peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource,
-  collectTopology, peerRouter, localRouter, forwardUpgrade,
+  collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade,
+  probeHealth,
 };

package/lib/pty/provider.js

@@ -1,22 +1,22 @@
 'use strict';
 // Ritorna un oggetto { spawn(file, args, opts) } con un PTY REALE.
-// Termux/Android → @mmmbuto/node-pty-android-arm64 ; altrove → node-pty upstream.
+// Termux/Android e desktop usano esclusivamente pacchetti prebuilt scriptless.
 // `tmux attach` ESIGE un vero tty: il fallback child_process NON è accettabile qui.
 let _cached = null;
 
 function providerCandidates({ platform = process.platform, arch = process.arch, env = process.env } = {}) {
   const isTermux = platform === 'android'
     || (env.PREFIX || '').includes('com.termux');
-  if (isTermux) return ['@mmmbuto/node-pty-android-arm64', 'node-pty'];
+  if (isTermux) return ['@mmmbuto/node-pty-android-arm64'];
   if (platform === 'darwin') {
     return arch === 'arm64'
-      ? ['@lydell/node-pty-darwin-arm64', 'node-pty']
-      : ['@lydell/node-pty-darwin-x64', 'node-pty'];
+      ? ['@lydell/node-pty-darwin-arm64']
+      : ['@lydell/node-pty-darwin-x64'];
   }
   if (platform === 'linux' && arch === 'arm64') {
-    return ['@lydell/node-pty-linux-arm64', 'node-pty'];
+    return ['@lydell/node-pty-linux-arm64'];
   }
-  return ['@lydell/node-pty-linux-x64', 'node-pty'];
+  return ['@lydell/node-pty-linux-x64'];
 }
 
 function loadPty() {
@@ -43,6 +43,6 @@ function loadPty() {
       }
     } catch (_) { /* prova il prossimo */ }
   }
-  throw new Error('no real PTY provider available (install a platform prebuilt or node-pty build prerequisites)');
+  throw new Error('no real PTY provider available (platform prebuilt missing)');
 }
 module.exports = { loadPty, providerCandidates };

package/lib/server.js

@@ -25,6 +25,7 @@ const { fleetRoutes } = require('./fleet/routes.js');
 const { fsRoutes } = require('./fs/routes.js');
 const nodesStore = require('./nodes/store.js');
 const nodesTunnel = require('./nodes/tunnel.js');
+const nodesHealth = require('./nodes/health.js');
 const { createNodeProxy, handleNodeUpgrade } = require('./proxy/node-proxy.js');
 const federation = require('./proxy/federation.js');
 const { settingsRoutes, publicPeeringRoutes } = require('./settings/routes.js');
@@ -73,6 +74,13 @@ function createServer(opts = {}) {
     proxySockets.clear();
   };
   const watcher = createOutboxWatcher({ root: cfg.filesRoot });
+  // server e' creato piu' sotto (http.createServer); lo dichiariamo qui perche' le
+  // closure localPort/localCredential dei router federation lo riferiscono lazy, al
+  // request time. localPort DEVE leggere la porta effettiva (server.address().port)
+  // e non cfg.port: in test (listen(0) su porta random) o dopo fallback EADDRINUSE,
+  // cfg.port non coincide con la porta reale e il proxy federation locale puntava
+  // alla porta sbagliata (bug reale: 401/"unauthorized" dal servizio su cfg.port).
+  let server = null;
   const previews = createPreviewSampler(cfg.tmuxBin);
   // MCP bridge (notify/ask/push): lo stato vive accanto al token (dirname del
   // tokenPath = ~/.nexuscrew di default) cosi' le istanze isolate via opts/env
@@ -100,6 +108,9 @@ function createServer(opts = {}) {
   // token / add-remove nodi visibili senza restart). token MAI redatto qui: e'
   // il valore che il proxy inietta upstream, non esce mai verso il browser.
   const nodesPath = cfg.nodesPath || nodesStore.defaultNodesPath(cfg.home || os.homedir());
+  // fetch usata dai probe di salute federati (iniettabile nei test); default globale.
+  const healthFetch = cfg.fetchImpl || fetch;
+  const topologyCachePath = cfg.topologyCachePath || require('./nodes/topology-cache.js').defaultPath(cfg.home || os.homedir());
   const decksPath = cfg.decksPath || decksStore.defaultDecksPath(cfg.home || os.homedir());
   const proxyReadonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
   function resolveNode(name) {
@@ -215,16 +226,23 @@ function createServer(opts = {}) {
   api.use('/decks', decksRoutes({ cfg, decksPath }));
   api.use('/fs', fsRoutes({ home: os.homedir() }));  // folder-picker del dialog new session
   // /nodes (read-only, per la settings UI B2): stesso formato di `nodes list --json`
-  // (token SEMPRE redatti via redactStore) + stato tunnel per-nodo.
-  api.get('/nodes', (_req, res) => {
+  // (token SEMPRE redatti via redactStore) + health federato per-nodo. Il campo
+  // `tunnel` resta per retro-compatibilita' col frontend (derivato dal health).
+  //   health = { transport, auth, reachability, status, detail, managed, at }
+  // inbound: non probeable -> health unknown (NON "up" fittizio). outbound: probe
+  // reale /federation/health (cache TTL) -> distingue tcp down / 401 / 200.
+  api.get('/nodes', async (_req, res) => {
     try {
       const st = nodesStore.loadStore(nodesPath);
       if (!st) return res.json({ nodeId: null, nodes: [] });
       const view = nodesStore.redactStore(st);
-      const nodes = view.nodes.map((n) => ({
-        ...n,
-        tunnel: n.direction === 'inbound' ? { status: 'up', managed: false } : nodesTunnel.readTunnelState(os.homedir(), n.name),
-      }));
+      const healths = await nodesHealth.nodesHealth({
+        nodes: st.nodes, home: cfg.home || os.homedir(), fetchImpl: healthFetch, now: Date.now(),
+      });
+      const nodes = view.nodes.map((n, i) => {
+        const h = healths[i] || null;
+        return { ...n, tunnel: nodesHealth.tunnelFromHealth(h), health: h };
+      });
       const out = { nodeId: view.nodeId, nodes };
       if (view.rendezvous) out.rendezvous = view.rendezvous;
       res.json(out);
@@ -235,11 +253,11 @@ function createServer(opts = {}) {
   // READONLY route-level e la redazione token vivono dentro settingsRoutes.
   api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions }));
   api.get('/topology', async (_req, res) => {
-    try { res.json(await federation.collectTopology({ nodesPath })); }
+    try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   api.use('/route', federation.localRouter({
-    nodesPath, localPort: () => cfg.port, localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
   }));
   api.get('/voice/status', (_req, res) => res.json({ serverSttConfigured: !!cfg.voiceUrl }));
   api.post('/voice/transcribe',
@@ -264,7 +282,7 @@ function createServer(opts = {}) {
 
   app.use('/api', api);
   app.use('/federation', federation.peerRouter({
-    nodesPath, localPort: () => cfg.port, localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
   }));
 
   // Reverse-proxy single-origin /node/<name>/… (design §4b(2)). Auth locale PRIMA
@@ -292,7 +310,7 @@ function createServer(opts = {}) {
   });
   app.get('*', (_req, res) => res.sendFile(path.join(distDir, 'index.html')));
 
-  const server = http.createServer(app);
+  server = http.createServer(app);
   // Close the watcher when the HTTP server closes. Registered HERE (inside
   // createServer) — not in start() — so every createServer consumer is covered,
   // not only the start() path. watcher.close() is idempotent.

package/lib/settings/routes.js

@@ -49,16 +49,26 @@ const peering = require('../nodes/peering.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
-const { isServiceRunning, readRoles } = require('../cli/commands.js');
+const { isServiceRunning, readRoles, bootState } = require('../cli/commands.js');
 const { configJsonPath } = require('../config.js');
 const VERSION = require('../../package.json').version;
 
 // Whitelist chiavi scrivibili di config.json via API (lista chiusa dal task B2).
 const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone']);
 const ROLE_KEYS = new Set(['client', 'node']);
-const ADD_KEYS = new Set(['name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath']);
+const ADD_KEYS = new Set(['name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'label']);
 const NODE_ROLE_KEYS = new Set(['enabled', 'rendezvousSsh', 'publishedPort', 'keyPath']);
 
+// Default sensato per il "nome dispositivo" proposto nei form (pairing/invite).
+// NON usa ciecamente hostname: se l'hostname e' vuoto o 'localhost' (tipico di
+// chiavi di test / host dietro tunnel) propone un fallback neutro. L'utente puo'
+// sempre sovrascriverlo: questo e' solo il valore iniziale del campo.
+function defaultDeviceName() {
+  const h = String(os.hostname() || '').trim();
+  if (!h || /^localhost$/i.test(h)) return 'NexusCrew';
+  return h.slice(0, nodesStore.LABEL_MAX);
+}
+
 // Cintura §4b(3): rimozione ricorsiva di ogni chiave `token` da QUALUNQUE payload
 // di risposta (la vista redatta espone hasToken, mai il valore). Difesa in
 // profondita' oltre a redactStore: anche un bug a monte non fa uscire il segreto.
@@ -178,6 +188,7 @@ function settingsRoutes(deps = {}) {
       const service = {
         installed: fs.existsSync(svcPath),
         active: isServiceRunning({ platform, execImpl: seams.execImpl, uid: seams.uid, home }),
+        boot: bootState({ platform, execImpl: seams.execImpl, uid: seams.uid, home }).enabled,
       };
       const out = {
         roles: readRoles(configPath),
@@ -186,6 +197,9 @@ function settingsRoutes(deps = {}) {
         platform,
         service,
         version: VERSION,
+        // Nome dispositivo proposto per i form di pairing (etichetta umana, non
+        // lo slug). La UI lo precompila e lascia editing libero.
+        deviceName: defaultDeviceName(),
       };
       // rendezvous via redactStore (view sicura §4b(4)): non contiene token, ma
       // la si prende comunque SOLO dalla vista redatta.
@@ -272,12 +286,15 @@ function settingsRoutes(deps = {}) {
   });
 
   // One-time PWA pairing capability. It is not the UI bearer token and is
-  // persisted hashed, 0600, for ten minutes only.
-  r.post('/peering/invite', mutGate, (_req, res) => {
+  // persisted hashed, 0600, for ten minutes only. Il `label` nel payload e'
+  // l'etichetta umana con cui il peer vedra' questo dispositivo: default sensato
+  // (mai 'localhost' crudo), sovrascrivibile dal form.
+  r.post('/peering/invite', mutGate, (req, res) => {
     try {
+      const label = nodesStore.sanitizeLabel(req.body && req.body.label, defaultDeviceName());
       const st = nodesStore.loadOrInitStore(nodesPath);
       send(res, 200, peering.createInvite({
-        invitesPath, instanceId: st.nodeId, port: cfg.port, label: os.hostname(),
+        invitesPath, instanceId: st.nodeId, port: cfg.port, label,
       }));
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -293,6 +310,12 @@ function settingsRoutes(deps = {}) {
     if (!pair) return send(res, 400, { error: 'link di pairing non valido' });
     if (b.sshPort !== undefined && !nodesStore.isPort(b.sshPort)) return send(res, 400, { error: 'sshPort non valida' });
     if (b.identityFile !== undefined && !nodesStore.isAbsPath(b.identityFile)) return send(res, 400, { error: 'identityFile non valido' });
+    if (b.label !== undefined && !nodesStore.validLabel(b.label)) return send(res, 400, { error: 'label non valida (max 64 char, niente a capo)' });
+    if (b.localLabel !== undefined && !nodesStore.validLabel(b.localLabel)) return send(res, 400, { error: 'localLabel non valida (max 64 char, niente a capo)' });
+    // label umana del peer come lo vedro' io (display); se assente usa lo slug.
+    const peerLabel = nodesStore.sanitizeLabel(b.label, b.name);
+    // etichetta umana con cui il peer vedra' questo dispositivo; default sensato.
+    const localLabel = nodesStore.sanitizeLabel(b.localLabel, defaultDeviceName());
     let provisionalPort = null;
     let rollbackCredential = null;
     let created = false;
@@ -305,7 +328,7 @@ function settingsRoutes(deps = {}) {
         name: b.name, ssh: b.ssh, sshPort: b.sshPort,
         remotePort: pair.port, localPort, identityFile: b.identityFile,
         transport: 'auto', autostart: true, visibility: 'network',
-        direction: 'outbound', acceptToken,
+        direction: 'outbound', acceptToken, label: peerLabel,
       });
       nodesStore.atomicWriteStore(nodesPath, st);
       created = true;
@@ -325,6 +348,7 @@ function settingsRoutes(deps = {}) {
           invite: pair.invite,
           instanceId: st.nodeId,
           name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
+          label: localLabel,
           port: cfg.port,
           acceptToken,
         }),
@@ -409,6 +433,9 @@ function settingsRoutes(deps = {}) {
       if (b.keyPath !== undefined && !nodesStore.isAbsPath(b.keyPath)) {
         return send(res, 400, { error: 'keyPath deve essere un path assoluto' });
       }
+      if (b.label !== undefined && !nodesStore.validLabel(b.label)) {
+        return send(res, 400, { error: 'label non valida (max 64 char, niente a capo)' });
+      }
 
       const cap = capture();
       const out = nodesCmds.nodesAdd({
@@ -417,6 +444,16 @@ function settingsRoutes(deps = {}) {
         remotePort: b.remotePort, localPort: b.localPort, key: b.keyPath,
       });
       if (out.code === 0) {
+        // label (display) opzionale: la persistiamo dopo l'add come rename che NON
+        // tocca il name (route stabile). Best-effort: una label malformata qui e'
+        // impossibile (validata sopra), ma non facciamo mai fallire l'add per lei.
+        if (b.label !== undefined) {
+          try {
+            let st = nodesStore.loadOrInitStore(nodesPath);
+            st = nodesStore.updateNode(st, out.name, { label: nodesStore.sanitizeLabel(b.label, out.name) });
+            nodesStore.atomicWriteStore(nodesPath, st);
+          } catch (_) { /* best-effort: il nodo e' gia' creato */ }
+        }
         return send(res, 200, {
           added: true,
           name: out.name,
@@ -512,6 +549,20 @@ function settingsRoutes(deps = {}) {
       send(res, 200, { saved: true, name, visibility });
     } catch (e) { send(res, 400, { error: String(e.message || e) }); }
   });
+  // Rinomina la label umana di un nodo SENZA toccare il name (route/URL stabili).
+  r.patch('/nodes/:name/label', mutGate, (req, res) => {
+    try {
+      const name = String(req.params.name || '');
+      const label = req.body && req.body.label;
+      if (!validName(name)) return send(res, 400, { error: 'name non valido (^[a-z0-9-]{1,32}$)' });
+      if (!nodesStore.validLabel(label)) return send(res, 400, { error: 'label non valida (max 64 char, niente a capo)' });
+      let st = nodesStore.loadOrInitStore(nodesPath);
+      if (!nodesStore.getNode(st, name)) return send(res, 404, { error: `nodo sconosciuto "${name}"` });
+      st = nodesStore.updateNode(st, name, { label: nodesStore.sanitizeLabel(label, name) });
+      nodesStore.atomicWriteStore(nodesPath, st);
+      send(res, 200, { saved: true, name, label: nodesStore.nodeLabel(nodesStore.getNode(st, name)) });
+    } catch (e) { send(res, 400, { error: String(e.message || e) }); }
+  });
 
   // --- POST /node-role — node on/off (rendezvous config) ---------------------
   r.post('/node-role', mutGate, (req, res) => {
@@ -568,6 +619,9 @@ function settingsRoutes(deps = {}) {
   // dall'API (la UI avvisa di riavviare a mano).
   r.post('/service/regenerate', mutGate, (_req, res) => {
     try {
+      if (!bootState({ platform, execImpl: seams.execImpl, uid: seams.uid, home }).enabled) {
+        return send(res, 409, { error: 'boot non abilitato: usa `nexuscrew boot`' });
+      }
       const { cfg: fileCfg } = readConfigFile(configPath);
       const port = nodesStore.isPort(fileCfg.port) ? fileCfg.port : cfg.port;
       const ctx = {
@@ -628,6 +682,9 @@ function publicPeeringRoutes(deps = {}) {
       || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)) {
       return res.status(400).json({ error: 'pairing request non valida' });
     }
+    if (b.label !== undefined && !nodesStore.validLabel(b.label)) {
+      return res.status(400).json({ error: 'label non valida' });
+    }
     if (!peering.consumeInvite({ invitesPath, invite: b.invite })) return res.status(410).json({ error: 'invito scaduto o gia usato' });
     try {
       const st = nodesStore.loadOrInitStore(nodesPath);
@@ -637,6 +694,7 @@ function publicPeeringRoutes(deps = {}) {
       const reversePort = peering.allocateReversePort(st.nodes);
       const credential = peering.createPending({ pendingPath, data: {
         name, remotePort: b.port, reversePort, instanceId: b.instanceId, acceptToken: b.acceptToken,
+        label: nodesStore.sanitizeLabel(b.label, name),
       } });
       res.json({ paired: true, instanceId: st.nodeId, reversePort, credential });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -658,6 +716,7 @@ function publicPeeringRoutes(deps = {}) {
         direction: 'inbound', transport: 'inbound', autostart: true,
         visibility: 'network', nodeId: pending.instanceId,
         token: pending.acceptToken, acceptToken: b.credential,
+        ...(pending.label ? { label: pending.label } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);
       res.json({ confirmed: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
@@ -23,7 +23,6 @@
     "test": "node --test tests/*.test.js"
   },
   "dependencies": {
-    "@mmmbuto/pty-termux-utils": "^1.1.4",
     "express": "^4.21.0",
     "multer": "^2.2.0",
     "qrcode-terminal": "^0.12.0",
@@ -31,11 +30,11 @@
     "ws": "^8.18.0"
   },
   "optionalDependencies": {
+    "@mmmbuto/node-pty-android-arm64": "^1.1.2",
     "@lydell/node-pty-darwin-arm64": "^1.2.0-beta.14",
     "@lydell/node-pty-darwin-x64": "^1.2.0-beta.14",
     "@lydell/node-pty-linux-arm64": "^1.2.0-beta.12",
-    "@lydell/node-pty-linux-x64": "^1.2.0-beta.12",
-    "node-pty": "^1.1.0"
+    "@lydell/node-pty-linux-x64": "^1.2.0-beta.12"
   },
   "engines": {
     "node": ">=18"
@@ -64,8 +63,5 @@
     "url": "git+https://github.com/DioNanos/nexuscrew.git"
   },
   "author": "DioNanos",
-  "license": "Apache-2.0",
-  "allowScripts": {
-    "@mmmbuto/node-pty-android-arm64@1.1.0": true
-  }
+  "license": "Apache-2.0"
 }