@mmmbuto/nexuscrew 0.8.44 → 0.8.46

package/lib/server.js

@@ -29,6 +29,8 @@ const nodesStore = require('./nodes/store.js');
 const nodesTunnel = require('./nodes/tunnel.js');
 const nodesHealth = require('./nodes/health.js');
 const nodesInventory = require('./nodes/inventory.js');
+const { createReverseSlotListeners } = require('./nodes/reverse-slot-listeners.js');
+const reverseRotation = require('./nodes/reverse-rotation.js');
 const topologyCache = require('./nodes/topology-cache.js');
 const { createNodeProxy, handleNodeUpgrade } = require('./proxy/node-proxy.js');
 const federation = require('./proxy/federation.js');
@@ -160,6 +162,10 @@ function createServer(opts = {}) {
   // route federata da un POST diretto di chi possiede il token della UI.
   const hopSecret = createHopSecret();
   const audioNonceCache = createNonceCache();
+  let reverseSlotListeners = null;
+  const rotatableReverse = new Map(); // node -> Map("port:generation", tracked listener/supervisor)
+  const reverseWatchers = new Map();
+  const reverseRotationInFlight = new Set();
   function resolveNode(name) {
     const st = nodesStore.loadStore(nodesPath);
     if (!st) return null;
@@ -170,6 +176,229 @@ function createServer(opts = {}) {
 
   const runtimePort = () => (server && server.address() ? server.address().port : cfg.port);
   let tunnelsStarted = false;
+  function reverseKey(remotePort, generation) { return `${remotePort}:${generation}`; }
+  function nodeReverseEntries(name) { return rotatableReverse.get(name) || new Map(); }
+  async function startRotatableReverse(node, { slot = node?.reversePool?.activeSlot, generation = null } = {}) {
+    if (!reverseSlotListeners || node.shared !== true || !node.reversePool || !node.acceptToken || !node.nodeId) return null;
+    const active = node.reversePool.slots[slot];
+    const expectedGeneration = generation === null ? active?.generation : generation;
+    if (!active || !Number.isSafeInteger(expectedGeneration) || expectedGeneration < 1) throw new Error('reverse pool slot non valida');
+    const entries = nodeReverseEntries(node.name);
+    const key = reverseKey(active.port, expectedGeneration);
+    const existing = entries.get(key);
+    if (existing) return existing;
+    const listener = await reverseSlotListeners.open({
+      nodeName: node.name, remotePort: active.port, generation: expectedGeneration,
+      instanceId: node.nodeId, secret: node.acceptToken,
+    });
+    let launched = nodesTunnel.startReverseForward({
+      home: cfg.home || os.homedir(), node, remotePort: active.port, generation: expectedGeneration,
+      targetPort: listener.localPort, spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
+      sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
+    });
+    if (!launched.started && launched.reason === 'already running') {
+      const stopped = nodesTunnel.stopTunnel({ home: cfg.home || os.homedir(), name: nodesTunnel.reverseTunnelName(node.name, active.port, expectedGeneration) });
+      if (!stopped.stopped) {
+        await reverseSlotListeners.closePort(listener.localPort);
+        throw new Error(stopped.reason || 'supervisor reverse preesistente non attribuibile');
+      }
+      launched = nodesTunnel.startReverseForward({
+        home: cfg.home || os.homedir(), node, remotePort: active.port, generation: expectedGeneration,
+        targetPort: listener.localPort, spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
+        sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
+      });
+    }
+    if (!launched.started && launched.reason !== 'already running') {
+      await reverseSlotListeners.closePort(listener.localPort);
+      throw new Error(launched.reason || 'reverse slot supervisor non avviato');
+    }
+    const tracked = { ...listener, remotePort: active.port, generation: expectedGeneration };
+    entries.set(key, tracked);
+    rotatableReverse.set(node.name, entries);
+    if (slot === node.reversePool.activeSlot && node.reversePool.verification === 'verified') ensureReverseWatcher(node.name);
+    return tracked;
+  }
+  async function stopRotatableReverse(name, { remotePort = null, generation = null } = {}) {
+    const entries = rotatableReverse.get(name);
+    if (!entries) {
+      if (!Number.isInteger(remotePort) || !Number.isSafeInteger(generation)) return false;
+      const result = nodesTunnel.stopTunnel({ home: cfg.home || os.homedir(), name: nodesTunnel.reverseTunnelName(name, remotePort, generation) });
+      return result.stopped || ['no pidfile', 'stale (pid dead)'].includes(result.reason);
+    }
+    const selected = [...entries.values()].filter((entry) => (remotePort === null || entry.remotePort === remotePort)
+      && (generation === null || entry.generation === generation));
+    let stopped = false;
+    for (const existing of selected) {
+      const result = nodesTunnel.stopTunnel({ home: cfg.home || os.homedir(), name: nodesTunnel.reverseTunnelName(name, existing.remotePort, existing.generation) });
+      // If we cannot prove ownership we neither signal nor close the listener:
+      // the channel is quarantined for diagnostics rather than broken by us.
+      if (!result.stopped && !['no pidfile', 'stale (pid dead)'].includes(result.reason)) continue;
+      entries.delete(reverseKey(existing.remotePort, existing.generation));
+      await reverseSlotListeners?.closePort(existing.localPort);
+      stopped = true;
+    }
+    if (!entries.size) rotatableReverse.delete(name);
+    if (remotePort === null && generation === null) {
+      const watcher = reverseWatchers.get(name);
+      if (watcher) clearInterval(watcher);
+      reverseWatchers.delete(name);
+    }
+    return stopped;
+  }
+  async function verifyRotatablePool(node) {
+    const pool = node?.reversePool;
+    if (!pool || !node.shared || !node.token || !node.nodeId) return { verified: false, code: 'reverse-pool-not-ready' };
+    const proven = [];
+    for (let slot = 0; slot < pool.slots.length; slot += 1) {
+      const candidate = pool.slots[slot];
+      let temporary = false;
+      try {
+        await startRotatableReverse(node, { slot, generation: candidate.generation });
+        temporary = slot !== pool.activeSlot;
+        await federation.verifyHubPoolSlot({ node, slot, generation: candidate.generation, fetchImpl: healthFetch });
+        proven.push(slot);
+      } catch (_) {
+        break;
+      } finally {
+        if (temporary) await stopRotatableReverse(node.name, { remotePort: candidate.port, generation: candidate.generation });
+      }
+    }
+    const current = nodesStore.loadStoreStrict(nodesPath);
+    const fresh = nodesStore.getNode(current, node.name);
+    if (!fresh?.reversePool) return { verified: false, code: 'reverse-pool-missing' };
+    const verifiedSlots = [...new Set(proven)].sort((a, b) => a - b);
+    const verification = verifiedSlots.length === fresh.reversePool.slots.length ? 'verified' : 'unverifiable';
+    const updatedPool = { ...fresh.reversePool, verifiedSlots, verification };
+    nodesStore.atomicWriteStore(nodesPath, nodesStore.setNodeReversePool(current, fresh.name, updatedPool));
+    diagnostics.record(verification === 'verified' ? 'info' : 'warn', 'reverse-pool',
+      verification === 'verified' ? 'REVERSE_POOL_VERIFIED' : 'REVERSE_POOL_UNVERIFIABLE',
+      verification === 'verified' ? 'Reverse pool verified' : 'Reverse pool could not be fully verified', { node: fresh.name, verifiedSlots: verifiedSlots.length });
+    if (verification === 'verified') ensureReverseWatcher(fresh.name);
+    return { verified: verification === 'verified', verification, verifiedSlots };
+  }
+  async function settleRotatableGrace(name, generation) {
+    const current = nodesStore.loadStoreStrict(nodesPath);
+    const node = nodesStore.getNode(current, name);
+    const pool = node?.reversePool;
+    if (!pool || pool.rotation?.phase !== 'switched' || pool.activeGeneration !== generation) return;
+    const old = pool.slots[pool.rotation.oldSlot];
+    const stopped = await stopRotatableReverse(name, { remotePort: old.port, generation: pool.rotation.oldGeneration });
+    if (!stopped) {
+      diagnostics.record('warn', 'reverse-pool', 'REVERSE_POOL_OLD_QUARANTINED', 'Old reverse slot was not attributable for shutdown', { node: name, slot: pool.rotation.oldSlot });
+      return;
+    }
+    try {
+      await federation.settleHubPoolSlot({ node, generation, fetchImpl: healthFetch });
+      const freshStore = nodesStore.loadStoreStrict(nodesPath);
+      const fresh = nodesStore.getNode(freshStore, name);
+      const settled = fresh?.reversePool && reverseRotation.settleGrace(fresh.reversePool, { now: Date.now() + 1 });
+      if (settled) nodesStore.atomicWriteStore(nodesPath, nodesStore.setNodeReversePool(freshStore, name, settled));
+    } catch (_) {
+      diagnostics.record('warn', 'reverse-pool', 'REVERSE_POOL_GRACE_PENDING', 'Reverse pool grace settlement pending', { node: name });
+    }
+  }
+  async function reconcileRotatablePool(node) {
+    if (!node?.reversePool || node.shared !== true) return node;
+    try {
+      const result = await federation.getHubPoolStatus({ node, fetchImpl: healthFetch });
+      const remote = nodesStore.parseReversePool(result && result.pool);
+      if (!remote || remote.base !== node.reversePool.base) throw new Error('stato pool remoto non valido');
+      const current = nodesStore.loadStoreStrict(nodesPath);
+      const fresh = nodesStore.getNode(current, node.name);
+      if (!fresh?.reversePool) return node;
+      if (JSON.stringify(fresh.reversePool) === JSON.stringify(remote)) return fresh;
+      const updated = nodesStore.setNodeReversePool(current, fresh.name, remote);
+      nodesStore.atomicWriteStore(nodesPath, updated);
+      diagnostics.record('info', 'reverse-pool', 'REVERSE_POOL_RECONCILED', 'Reverse pool reconciled from hub generation', {
+        node: fresh.name, slot: remote.activeSlot, generation: remote.activeGeneration,
+      });
+      return nodesStore.getNode(updated, fresh.name);
+    } catch (_) {
+      // The saved local generation remains authoritative while the private
+      // path is down. This is a retryable reconciliation, never a reason to
+      // stop a healthy existing slot or invent a new one.
+      return node;
+    }
+  }
+  async function rotateRotatableReverse(name) {
+    if (reverseRotationInFlight.has(name)) return { status: 'already-running' };
+    reverseRotationInFlight.add(name);
+    try {
+      const now = Date.now();
+      let current = nodesStore.loadStoreStrict(nodesPath);
+      let node = nodesStore.getNode(current, name);
+      const pool = node?.reversePool;
+      if (!node || node.shared !== true || !pool || pool.verification !== 'verified'
+        || !Array.isArray(pool.verifiedSlots) || pool.verifiedSlots.length !== pool.slots.length) {
+        return { status: 'skipped', reason: 'pool-not-verified' };
+      }
+      if (Number.isSafeInteger(pool.lastAutoRotationAt) && now - pool.lastAutoRotationAt < 10 * 60 * 1000) {
+        return { status: 'skipped', reason: 'rate-limited' };
+      }
+      const slot = reverseRotation.nextReadySlot(pool);
+      if (!Number.isInteger(slot)) {
+        diagnostics.record('error', 'reverse-pool', 'REVERSE_POOL_EXHAUSTED', 'No verified reverse slot remains', { node: name });
+        return { status: 'skipped', reason: 'pool-exhausted' };
+      }
+      const lease = await federation.reserveHubPoolSlot({ node, slot, fetchImpl: healthFetch });
+      if (lease.slot !== slot || !Number.isSafeInteger(lease.generation) || typeof lease.leaseId !== 'string') {
+        throw new Error('hub reverse lease non valida');
+      }
+      const prepared = reverseRotation.prepareRotation(pool, {
+        slot, now, leaseId: lease.leaseId,
+        leaseMs: Math.max(1, Math.min(60_000, Number(lease.expiresAt) - now)),
+      });
+      if (!prepared || prepared.rotation.generation !== lease.generation) throw new Error('lease reverse non coerente con il pool locale');
+      prepared.lastAutoRotationAt = now;
+      current = nodesStore.updateNode(current, name, { reversePool: prepared });
+      nodesStore.atomicWriteStore(nodesPath, current);
+      node = nodesStore.getNode(current, name);
+      const candidate = node.reversePool.slots[slot];
+      try {
+        await startRotatableReverse(node, { slot, generation: candidate.generation });
+        const committedRemote = await federation.commitHubPoolSlot({ node, leaseId: lease.leaseId, fetchImpl: healthFetch });
+        const committed = reverseRotation.commitRotation(node.reversePool, { leaseId: lease.leaseId, now, graceMs: Math.max(0, Number(committedRemote.graceUntil) - now) });
+        if (!committed || committed.activeGeneration !== committedRemote.generation) throw new Error('commit reverse non coerente');
+        committed.lastAutoRotationAt = now;
+        const afterStore = nodesStore.loadStoreStrict(nodesPath);
+        nodesStore.atomicWriteStore(nodesPath, nodesStore.setNodeReversePool(afterStore, name, committed));
+        const delay = Math.max(0, committed.rotation.graceUntil - Date.now()) + 50;
+        const timer = setTimeout(() => { void settleRotatableGrace(name, committed.activeGeneration); }, delay);
+        timer.unref?.();
+        diagnostics.record('warn', 'reverse-pool', 'REVERSE_POOL_SWITCHED', 'Reverse pool switched after verified conflict', { node: name, slot, generation: committed.activeGeneration });
+        return { status: 'switched', slot, generation: committed.activeGeneration };
+      } catch (error) {
+        await federation.abortHubPoolSlot({ node, leaseId: lease.leaseId, fetchImpl: healthFetch }).catch(() => {});
+        await stopRotatableReverse(name, { remotePort: candidate.port, generation: candidate.generation });
+        const failedStore = nodesStore.loadStoreStrict(nodesPath);
+        const failedNode = nodesStore.getNode(failedStore, name);
+        const quarantined = failedNode?.reversePool && reverseRotation.quarantineSlot(failedNode.reversePool, { slot });
+        if (quarantined) {
+          quarantined.verification = 'invalidated'; quarantined.verifiedSlots = []; quarantined.lastAutoRotationAt = now;
+          nodesStore.atomicWriteStore(nodesPath, nodesStore.setNodeReversePool(failedStore, name, quarantined));
+        }
+        diagnostics.record('error', 'reverse-pool', 'REVERSE_POOL_CANDIDATE_FAILED', 'Reverse candidate failed; pool invalidated', { node: name, slot });
+        throw error;
+      }
+    } finally { reverseRotationInFlight.delete(name); }
+  }
+  function ensureReverseWatcher(name) {
+    if (reverseWatchers.has(name)) return;
+    const timer = setInterval(() => {
+      if (reverseRotationInFlight.has(name)) return;
+      const current = nodesStore.loadStore(nodesPath);
+      const node = current && nodesStore.getNode(current, name);
+      const pool = node?.reversePool;
+      if (!node || node.shared !== true || !pool || pool.verification !== 'verified') return;
+      const active = pool.slots[pool.activeSlot];
+      const state = nodesTunnel.readTunnelState(cfg.home || os.homedir(), nodesTunnel.reverseTunnelName(name, active.port, pool.activeGeneration));
+      if (state.phase === 'degraded') {
+        void rotateRotatableReverse(name).catch(() => {});
+      }
+    }, 5000);
+    timer.unref?.();
+    reverseWatchers.set(name, timer);
+  }
   function startManagedTunnels() {
     if (tunnelsStarted) return;
     tunnelsStarted = true;
@@ -210,7 +439,14 @@ function createServer(opts = {}) {
           // senza ritardare il listen del server.
           const reconcileShare = cfg.reconcilePeerShareImpl || federation.reconcilePeerShare;
           if (node.shared === true) {
-            Promise.resolve(reconcileShare({
+            Promise.resolve(node.reversePool ? reconcileRotatablePool(node) : node).then((effectiveNode) => {
+              if (effectiveNode?.reversePool?.rotation?.phase === 'switched') {
+                const delay = Math.max(0, effectiveNode.reversePool.rotation.graceUntil - Date.now()) + 50;
+                const timer = setTimeout(() => { void settleRotatableGrace(effectiveNode.name, effectiveNode.reversePool.activeGeneration); }, delay);
+                timer.unref?.();
+              }
+              return effectiveNode?.reversePool ? startRotatableReverse(effectiveNode) : null;
+            }).then(() => reconcileShare({
               node, shared: true, fetchImpl: healthFetch,
               healthAttempts: 3, notifyAttempts: 3, delayMs: 200,
             })).catch((e) => {
@@ -237,10 +473,17 @@ function createServer(opts = {}) {
   }
 
   const app = express();
+  reverseSlotListeners = createReverseSlotListeners({ app, diagnostics, createServerImpl: cfg.reverseSlotCreateServerImpl });
   const distDir = path.join(__dirname, '..', 'frontend', 'dist');
   // no-store on everything (HTML+assets+API): this is a local, token-adjacent tool.
   app.use((_req, res, next) => { res.set('Cache-Control', 'no-store'); next(); });
   app.use('/pair', publicPeeringRoutes({ cfg, nodesPath }));
+  // This route is deliberately outside the bearer-authenticated federation
+  // router.  It emits a MAC only on a listener owned by the expected slot and
+  // never accepts/sends a bearer to a suspicious loopback listener.
+  app.post('/reverse-slot-proof', express.json({ limit: '2kb' }), (req, res) => {
+    if (!reverseSlotListeners.respond(req, res)) res.status(404).json({ error: 'reverse slot non disponibile' });
+  });
 
   // Tutte le /api dietro Bearer: sul loopback il gate vero è il tunnel,
   // ma il token chiude anche altri processi locali della stessa macchina.
@@ -452,6 +695,7 @@ function createServer(opts = {}) {
     // Stesso adapter/coda dell'API Audio: Settings puo' fare solo la prova
     // locale a frase fissa e lo stop sovrano, mai una seconda sintesi parallela.
     audio: { adapter: audioAdapter, queue: audioQueue },
+    reverseSlots: { ensure: startRotatableReverse, close: stopRotatableReverse, verify: verifyRotatablePool },
   }));
   api.use('/diagnostics', diagnosticsRoutes({ diagnostics, readonly: proxyReadonly }));
   api.get('/topology', async (_req, res) => {
@@ -532,6 +776,8 @@ function createServer(opts = {}) {
   server.on('close', () => {
     diagnostics.record('info', 'server', 'SERVER_STOPPED', 'NexusCrew server stopped', { reason: 'close' });
     watcher.close(); previews.close(); eventsHub.closeAll(); updater.close();
+    for (const timer of reverseWatchers.values()) clearInterval(timer);
+    reverseWatchers.clear(); rotatableReverse.clear(); void reverseSlotListeners?.closeAll();
   });
   // noServer: gestiamo l'upgrade a mano per instradare /ws (locale) e /node/*
   // (proxy). Il WS locale resta identico; il proxy WS applica gli STESSI check

package/lib/settings/pairing-coordinator.js

@@ -257,6 +257,11 @@ function createPairHandler(deps) {
         });
       }
       const joinedRoles = joined.roles === undefined ? null : nodesStore.parseRoles(joined.roles);
+      const joinedPool = joined.reversePool && typeof joined.reversePool === 'object' && !Array.isArray(joined.reversePool)
+        && nodesStore.isPort(joined.reversePool.base) && Array.isArray(joined.reversePool.slots)
+        && joined.reversePool.slots.length === 3
+        && joined.reversePool.slots.every(nodesStore.isPort)
+        ? nodesStore.reversePoolDefault(joined.reversePool.base) : null;
       if (!nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
         || !nodesStore.NODE_ID_RE.test(joined.instanceId) || (joined.roles !== undefined && !joinedRoles)) {
         return failRolledBack(502, 'join', 'join-invalid-response', 'risposta di join non valida dal peer', {
@@ -270,14 +275,27 @@ function createPairHandler(deps) {
             hint: 'controlla che il target SSH punti al nodo che ha generato il link',
           });
       }
+      if (joined.reversePool && (!joinedPool
+        || joined.reversePort !== joinedPool.base
+        || joinedPool.slots.some((slot, index) => slot.port !== joined.reversePool.slots[index]))) {
+        return failRolledBack(502, 'join', 'join-invalid-reverse-pool', 'pool reverse non valido dal peer', {
+          hint: 'versioni NexusCrew incompatibili? aggiorna entrambi i nodi',
+        });
+      }
 
       // --- tunnel-final: connessione privata, solo -L -------------------------
       // reversePort resta negoziata per un futuro Share opt-in, ma il builder
       // non emette -R finche' shared non diventa true.
       st = nodesStore.loadStoreStrict(nodesPath);
+      if (joinedPool && st.schemaVersion < nodesStore.SCHEMA_VERSION) {
+        // This device is a client of the hub-owned pool.  It persists the
+        // assigned slots but intentionally has no allocation anchor/ledger.
+        st = nodesStore.upgradeToReversePoolSchema(st);
+      }
       st = nodesStore.updateNode(st, b.name, {
         token: joined.credential, nodeId: joined.instanceId, reversePort: joined.reversePort,
         shared: false,
+        ...(joinedPool ? { reversePool: joinedPool } : {}),
         ...(joinedRoles ? { roles: joinedRoles, rolesKnown: true } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);

package/lib/settings/public-peering-routes.js

@@ -13,6 +13,7 @@ const express = require('express');
 
 const nodesStore = require('../nodes/store.js');
 const peering = require('../nodes/peering.js');
+const reversePool = require('../nodes/reverse-pool.js');
 const { readRoles } = require('../cli/commands.js');
 const { configJsonPath } = require('../config.js');
 
@@ -25,6 +26,7 @@ function publicPeeringRoutes(deps = {}) {
   const nodesPath = deps.nodesPath || cfg.nodesPath || nodesStore.defaultNodesPath(home);
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
+  const reversePoolLedgerPath = deps.reversePoolLedgerPath || cfg.reversePoolLedgerPath || reversePool.defaultLedgerPath(home);
   const r = express.Router();
   const attempts = new Map();
   r.use(express.json({ limit: '8kb' }));
@@ -92,11 +94,60 @@ function publicPeeringRoutes(deps = {}) {
         });
       }
       const name = b.name;
-      const reversePort = await peering.allocateAvailableReversePort(st.nodes, pending, {
-        ...(deps.createServerImpl ? { createServerImpl: deps.createServerImpl } : {}),
+      // The hub owns allocation.  Establish an empty v3 anchor before any
+      // allocation event; from here onward each allocated pool is written to
+      // the append-only ledger first and the anchor second.  A ledger ahead of
+      // its anchor is therefore a safe interrupted write and is reconciled;
+      // a missing/behind prefix never becomes a reason to reuse a port.
+      let poolStore = st;
+      let ledger = reversePool.loadLedger(reversePoolLedgerPath);
+      if (poolStore.schemaVersion < nodesStore.SCHEMA_VERSION || poolStore.reversePoolLedgerInitialized !== true) {
+        if (ledger) {
+          const error = new Error('reverse pool ledger presente senza anchor: nuove assegnazioni bloccate');
+          error.code = 'reverse-pool-anchor-missing'; error.status = 503; throw error;
+        }
+        ledger = reversePool.emptyLedger();
+        poolStore = nodesStore.upgradeToReversePoolSchema(poolStore, reversePool.ledgerHead(ledger));
+        nodesStore.atomicWriteStore(nodesPath, poolStore);
+        reversePool.atomicWriteLedger(reversePoolLedgerPath, ledger);
+      } else {
+        const anchor = poolStore.reversePoolAnchor;
+        if (!ledger) {
+          // A zero anchor is the only safe state where an absent ledger can be
+          // initialized: no allocation has ever been anchored.  Existing
+          // private peers remain usable even when this path refuses new ones.
+          const parsed = reversePool.parseAnchor(anchor);
+          const empty = parsed && parsed.seq === 0 && parsed.digest === reversePool.genesisDigest(parsed.epoch)
+            ? reversePool.emptyLedger(parsed.epoch) : null;
+          if (!empty) {
+            const error = new Error('reverse pool ledger assente dopo assegnazioni: nuove assegnazioni bloccate');
+            error.code = 'reverse-pool-ledger-missing'; error.status = 503; throw error;
+          }
+          ledger = reversePool.atomicWriteLedger(reversePoolLedgerPath, empty);
+        }
+        const checked = reversePool.validateLedgerAnchor(ledger, anchor);
+        if (!checked.ok) {
+          const error = new Error(`reverse pool ledger non sicuro: ${checked.code}`);
+          error.code = checked.code; error.status = 503; throw error;
+        }
+        if (checked.advanceAnchor) {
+          poolStore = { ...poolStore, reversePoolAnchor: checked.advanceAnchor };
+          poolStore = nodesStore.atomicWriteStore(nodesPath, poolStore);
+        }
+      }
+      const allocation = await reversePool.allocateAvailableReversePool(poolStore.nodes, ledger, {
+        canBind: (port) => peering.canBindReversePort(port, deps.createServerImpl),
+      });
+      ledger = reversePool.appendLedger(ledger, { type: 'allocated', base: allocation.base });
+      reversePool.atomicWriteLedger(reversePoolLedgerPath, ledger);
+      poolStore = nodesStore.atomicWriteStore(nodesPath, {
+        ...poolStore,
+        reversePoolAnchor: reversePool.ledgerHead(ledger),
       });
+      const reversePort = allocation.base;
+      const assignedPool = nodesStore.reversePoolDefault(reversePort);
       credential = peering.createPending({ pendingPath, data: {
-        name, remotePort: b.port, reversePort, instanceId: b.instanceId, acceptToken: b.acceptToken,
+        name, remotePort: b.port, reversePort, reversePool: assignedPool, instanceId: b.instanceId, acceptToken: b.acceptToken,
         shared: false,
         label: nodesStore.sanitizeLabel(b.label, name),
         ...(peerRoles ? { roles: { ...peerRoles, node: false }, rolesKnown: true } : { rolesKnown: false }),
@@ -105,7 +156,9 @@ function publicPeeringRoutes(deps = {}) {
         peering.consumePending({ pendingPath, credential, now });
         return res.status(410).json({ error: 'invito scaduto o gia usato' });
       }
-      res.json({ paired: true, instanceId: st.nodeId, reversePort, credential, roles: readRoles(configPath) });
+      res.json({ paired: true, instanceId: poolStore.nodeId, reversePort,
+        reversePool: { base: assignedPool.base, slots: assignedPool.slots.map((slot) => slot.port) },
+        credential, roles: readRoles(configPath) });
     } catch (e) {
       if (credential) try { peering.consumePending({ pendingPath, credential, now }); } catch (_) {}
       res.status(e.status || 500).json({ error: String(e.message || e), ...(e.code ? { code: e.code } : {}) });
@@ -138,6 +191,7 @@ function publicPeeringRoutes(deps = {}) {
         ...(pending.roles ? { roles: pending.roles } : {}),
         rolesKnown: pending.rolesKnown === true,
         ...(pending.label ? { label: pending.label } : {}),
+        ...(pending.reversePool ? { reversePool: pending.reversePool } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);
       res.json({ confirmed: true });

package/lib/settings/routes.js

@@ -52,7 +52,7 @@ const audioGroups = require('../audio/groups.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
-const { waitForHealthyPeer, notifyHubShare, reconcilePeerShare } = require('../proxy/federation.js');
+const { waitForHealthyPeer, preflightHubReverse, notifyHubShare, reconcilePeerShare } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
@@ -174,6 +174,7 @@ function settingsRoutes(deps = {}) {
   // test unitari di Settings costruiti senza il server: non deve creare una
   // seconda coda che dichiara un test riuscito ma non parla sul nodo vero.
   const audioService = deps.audio && typeof deps.audio === 'object' ? deps.audio : null;
+  const reverseSlots = deps.reverseSlots && typeof deps.reverseSlots === 'object' ? deps.reverseSlots : null;
 
   const r = express.Router();
   r.use(express.json({ limit: '8kb' }));
@@ -595,6 +596,7 @@ function settingsRoutes(deps = {}) {
     }
     const wasShared = node.shared === true;
     let persistedDesired = wasShared;
+    let shareOnAttempted = false;
     const fetchImpl = seams.fetchImpl || fetch;
     const notifyHub = (shared) => notifyHubShare({ node, shared, fetchImpl, timeoutMs: 5000 });
     const ensureLocal = async ({ restart = false } = {}) => {
@@ -623,6 +625,12 @@ function settingsRoutes(deps = {}) {
         if (diagnosis && typeof diagnosis.hint === 'string') failure.hint = diagnosis.hint;
         throw failure;
       }
+      if (node.shared === true && node.reversePool && typeof reverseSlots?.ensure === 'function') {
+        await reverseSlots.ensure(node);
+        if (typeof reverseSlots.verify === 'function' && node.reversePool.verification !== 'verified') {
+          await reverseSlots.verify(node);
+        }
+      }
       return started;
     };
     const applyLocal = async (shared) => {
@@ -631,6 +639,7 @@ function settingsRoutes(deps = {}) {
       nodesStore.atomicWriteStore(nodesPath, st);
       persistedDesired = shared;
       node = nodesStore.getNode(st, name);
+      if (!shared && node.reversePool && typeof reverseSlots?.close === 'function') await reverseSlots.close(name);
       await ensureLocal({ restart: true });
     };
     const revokeHub = () => reconcilePeerShare({
@@ -650,6 +659,7 @@ function settingsRoutes(deps = {}) {
           detail: scrubError(revokeErr),
         });
       }
+      if (node.reversePool && typeof reverseSlots?.close === 'function') await reverseSlots.close(name);
       try {
         // A changed ON->OFF spec is restarted explicitly; same-state OFF uses
         // the idempotent spec-aware path, which only replaces a stale -R.
@@ -698,6 +708,19 @@ function settingsRoutes(deps = {}) {
         return reconcileOff({ unchanged: true });
       }
       if (body.shared) {
+        // Il -L privato e' ancora vivo: chiedi al nuovo hub, con il token del
+        // peer, se la SOLA porta reverse assegnata e' gia' occupata. Un 404 o
+        // un guasto preflight mantiene compatibilita' con hub precedenti; un
+        // conflitto certo evita restart/rollback inutili del tunnel privato.
+        const reverse = await preflightHubReverse({ node, fetchImpl, timeoutMs: 1500 });
+        if (reverse.supported && reverse.available === false) {
+          const conflict = new Error('la porta reverse assegnata a questo peer è già occupata sul nodo hub');
+          conflict.status = 409;
+          conflict.code = 'reverse-port-conflict';
+          conflict.hint = 'riconnetti o riassocia il peer proprietario del listener; non terminare tunnel sconosciuti sul hub';
+          throw conflict;
+        }
+        shareOnAttempted = true;
         await applyLocal(true);
         await notifyHub(true);
         return send(res, 200, { name, shared: true });
@@ -718,15 +741,19 @@ function settingsRoutes(deps = {}) {
     } catch (e) {
       // Share-on is transactional: a failed hub acknowledgement returns to the
       // safe private -L-only state. Never include remote response bodies/tokens.
-      if (body.shared && !wasShared) {
+      if (body.shared && !wasShared && shareOnAttempted) {
         try { await applyLocal(false); } catch (_) { /* best-effort safe rollback */ }
       }
       const offPersisted = body.shared === false && persistedDesired === false;
       const redact = (value) => String(value || '').replace(/Bearer\s+\S+/gi, 'Bearer ***');
-      return send(res, 502, {
-        error: body.shared ? 'Share non attivato'
+      const status = e && e.status === 409 ? 409 : 502;
+      return send(res, status, {
+        error: body.shared ? (e && e.code === 'reverse-port-conflict'
+          ? 'Share non attivato: porta reverse già occupata sul nodo hub'
+          : 'Share non attivato')
           : offPersisted ? 'Share disattivato localmente; hub non riconciliato' : 'Share non disattivato',
         ...(offPersisted ? { shared: false, reconcilePending: true } : {}),
+        ...(e && typeof e.code === 'string' ? { code: e.code } : {}),
         detail: redact(e && e.message || e),
         ...(e && typeof e.hint === 'string' ? { hint: redact(e.hint) } : {}),
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.44",
+  "version": "0.8.46",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {