@mmmbuto/nexuscrew 0.8.5 → 0.8.7

package/lib/nodes/peering.js

@@ -40,13 +40,44 @@ function encodePairing(data) {
   return Buffer.from(JSON.stringify(data)).toString('base64url');
 }
 
+// Allowlist rigorosa per versione (caps). v1: solo {v,instanceId,port,label,invite}.
+// v2 aggiunge name (slug suggerito), ssh (target/alias), sshPort?: routing non
+// segreto. NESSUN campo segreto è ammesso oltre l'invite one-time: niente
+// identityFile, chiave privata, API key, bearer UI. Unknown field -> null.
+const PAIRING_V1_KEYS = new Set(['v', 'instanceId', 'port', 'label', 'invite']);
+const PAIRING_V2_KEYS = new Set(['v', 'instanceId', 'port', 'label', 'invite', 'name', 'ssh', 'sshPort']);
+
 function decodePairing(value) {
+  let x;
   try {
-    const x = JSON.parse(Buffer.from(String(value || ''), 'base64url').toString('utf8'));
-    if (!x || x.v !== 1 || !store.NODE_ID_RE.test(x.instanceId) || !store.isPort(x.port)
-      || !store.validToken(x.invite) || typeof x.label !== 'string') return null;
-    return x;
+    x = JSON.parse(Buffer.from(String(value || ''), 'base64url').toString('utf8'));
   } catch (_) { return null; }
+  if (!x || typeof x !== 'object' || Array.isArray(x)) return null;
+  const allowed = x.v === 1 ? PAIRING_V1_KEYS : x.v === 2 ? PAIRING_V2_KEYS : null;
+  if (!allowed) return null;
+  for (const k of Object.keys(x)) if (!allowed.has(k)) return null; // strict: unknown -> null
+  // core obbligatorio (entrambe le versioni)
+  if (!store.NODE_ID_RE.test(x.instanceId) || !store.isPort(x.port)
+    || !store.validToken(x.invite) || typeof x.label !== 'string') return null;
+  const out = { v: x.v, instanceId: x.instanceId, port: x.port, label: x.label, invite: x.invite };
+  if (x.v === 2) {
+    if (x.name !== undefined) {
+      if (typeof x.name !== 'string' || !store.NODE_NAME_RE.test(x.name)) return null;
+      out.name = x.name;
+    }
+    if (x.ssh !== undefined) {
+      // target/alias SSH (user@host o Host alias); MAI secret. parseSshTarget
+      // rifiuta whitespace/control/leading '-' (argv-safe, non diventa flag ssh).
+      const ssh = typeof x.ssh === 'string' ? store.parseSshTarget(x.ssh) : null;
+      if (!ssh) return null;
+      out.ssh = ssh.value;
+    }
+    if (x.sshPort !== undefined) {
+      if (!store.isPort(x.sshPort)) return null;
+      out.sshPort = x.sshPort;
+    }
+  }
+  return out;
 }
 
 function parsePairingUrl(value) {
@@ -57,14 +88,35 @@ function parsePairingUrl(value) {
   } catch (_) { return null; }
 }
 
-function createInvite({ invitesPath, instanceId, port, label = 'NexusCrew', now = Date.now(), randomBytes = crypto.randomBytes }) {
+function createInvite({
+  invitesPath, instanceId, port, label = 'NexusCrew', now = Date.now(), randomBytes = crypto.randomBytes,
+  ssh, sshPort, name,
+} = {}) {
   const invite = randomBytes(32).toString('base64url');
   const expiresAt = now + INVITE_TTL_MS;
   const rows = readInvites(invitesPath, now);
   rows.push({ hash: crypto.createHash('sha256').update(invite).digest('hex'), expiresAt, usedAt: null });
   writeInvites(invitesPath, rows.slice(-32));
-  const pair = encodePairing({ v: 1, instanceId, port, label: String(label).slice(0, 64), invite });
-  return { pairingUrl: `http://127.0.0.1:${port}/#pair=${pair}`, expiresAt };
+  const payload = { v: 1, instanceId, port, label: String(label).slice(0, 64), invite };
+  // v2: include Host/alias SSH + slug quando forniti (routing non segreto). Così
+  // il ricevente incolla/scansiona UN solo link e ha tutto per precompilare il
+  // form. Senza ssh/name resta v1 (backward-compat con link 0.8.x esistenti).
+  const sshVal = typeof ssh === 'string' && ssh.trim() ? store.parseSshTarget(ssh.trim()) : null;
+  const requestedName = typeof name === 'string' && name.trim() && store.NODE_NAME_RE.test(name.trim())
+    ? name.trim()
+    : '';
+  // Un link con routing SSH deve sempre portare anche lo slug. Se il chiamante
+  // non lo specifica, lo ricaviamo dalla label del dispositivo: il ricevente non
+  // deve compilare altri campi per arrivare a "testa e collega".
+  const linkName = requestedName || (sshVal ? store.toSlug(payload.label) : '');
+  if (sshVal || linkName) {
+    payload.v = 2;
+    if (linkName) payload.name = linkName;
+    if (sshVal) payload.ssh = sshVal.value;
+    if (sshVal && store.isPort(sshPort)) payload.sshPort = sshPort;
+  }
+  const pair = encodePairing(payload);
+  return { pairingUrl: `http://127.0.0.1:${port}/#pair=${pair}`, expiresAt, version: payload.v };
 }
 
 function consumeInvite({ invitesPath, invite, now = Date.now() }) {
@@ -109,8 +161,34 @@ function consumePending({ pendingPath, credential, now = Date.now() }) {
   return found;
 }
 
+// Probe di trasporto del tunnel -L provvisorio PRIMA di consumare l'invite
+// one-time: qualunque risposta HTTP dal peer attraverso la forward (anche un
+// 401 su /federation/health senza credenziali) dimostra che ssh+forward sono
+// vivi; un errore di rete no. Sostituisce lo sleep fisso 900ms: bounded, con
+// sleep iniettabile (deterministico nei test) e timeout per tentativo.
+async function probeTransportReady({ port, fetchImpl = fetch, attempts = 6, timeoutMs = 1500, sleep } = {}) {
+  const wait = typeof sleep === 'function' ? sleep : (ms) => new Promise((r) => setTimeout(r, ms));
+  let lastError = '';
+  for (let i = 0; i < attempts; i += 1) {
+    let timer;
+    try {
+      const ctrl = new AbortController();
+      timer = setTimeout(() => ctrl.abort(), timeoutMs);
+      await fetchImpl(`http://127.0.0.1:${port}/federation/health`, { signal: ctrl.signal });
+      return { ready: true, attempts: i + 1 };
+    } catch (e) {
+      lastError = String((e && e.message) || e);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    if (i < attempts - 1) await wait(250 * (i + 1));
+  }
+  return { ready: false, attempts, lastError };
+}
+
 module.exports = {
   INVITE_TTL_MS, REVERSE_PORT_BASE, defaultInvitesPath, defaultPendingPath, safeEqual,
   readInvites, writeInvites, encodePairing, decodePairing, parsePairingUrl,
   createInvite, consumeInvite, allocateReversePort, createPending, consumePending,
+  probeTransportReady,
 };

package/lib/settings/routes.js

@@ -46,6 +46,7 @@ const nodesStore = require('../nodes/store.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
+const { probeHealth } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
@@ -289,74 +290,219 @@ function settingsRoutes(deps = {}) {
   // persisted hashed, 0600, for ten minutes only. Il `label` nel payload e'
   // l'etichetta umana con cui il peer vedra' questo dispositivo: default sensato
   // (mai 'localhost' crudo), sovrascrivibile dal form.
+  // v2: il creatore puo' includere l'Host/alias SSH raggiungibile (+ slug + porta
+  // SSH opzionale) cosicché il ricevente incolla/scansiona UN solo link e precompila
+  // tutto. NIENTE segreti: solo routing. L'invite one-time resta l'unica credenziale.
   r.post('/peering/invite', mutGate, (req, res) => {
     try {
-      const label = nodesStore.sanitizeLabel(req.body && req.body.label, defaultDeviceName());
+      const b = req.body || {};
+      const label = nodesStore.sanitizeLabel(b.label, defaultDeviceName());
+      const extra = {};
+      if (typeof b.ssh === 'string' && b.ssh.trim()) {
+        const ssh = nodesStore.parseSshTarget(b.ssh.trim());
+        if (!ssh) return send(res, 400, { error: 'ssh non valido (atteso user@host o alias)' });
+        extra.ssh = ssh.value;
+      }
+      if (b.sshPort !== undefined && b.sshPort !== null && b.sshPort !== '') {
+        if (!nodesStore.isPort(Number(b.sshPort))) return send(res, 400, { error: 'sshPort non valida (1..65535)' });
+        extra.sshPort = Number(b.sshPort);
+      }
+      if (extra.sshPort && !extra.ssh) return send(res, 400, { error: 'sshPort richiede un target SSH' });
+      if (typeof b.name === 'string' && b.name.trim()) {
+        if (!nodesStore.NODE_NAME_RE.test(b.name.trim())) return send(res, 400, { error: 'name non valido (a-z 0-9 -, max 32)' });
+        extra.name = b.name.trim();
+      }
+      if (extra.ssh && !extra.name) extra.name = nodesStore.toSlug(label);
       const st = nodesStore.loadOrInitStore(nodesPath);
       send(res, 200, peering.createInvite({
-        invitesPath, instanceId: st.nodeId, port: cfg.port, label,
+        invitesPath, instanceId: st.nodeId, port: cfg.port, label, ...extra,
       }));
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
-  // Hydra join: add once from the PWA. A provisional -L reaches the invite
-  // endpoint, then the negotiated -R makes the same SSH link reciprocal.
+  // Hydra join in stadi espliciti: la PWA riceve un contratto strutturato
+  // {error, code, stage, detail?, hint?, retryable?} — MAI credenziali, token,
+  // header Authorization o contenuto di chiavi nel payload. Stadi distinti:
+  //   validation | conflict | ssh-start | ssh-ready | join | tunnel-final |
+  //   confirm | health   (+ internal per gli inattesi)
+  // Lo sleep fisso 900ms e' sostituito da un probe di readiness bounded
+  // (peering.probeTransportReady) eseguito PRIMA di consumare l'invite one-time;
+  // una risposta join ambigua (rete morta dopo l'invio) non viene mai rigiocata.
+  // Su qualunque fallimento post-provisioning il rollback locale/remoto gira
+  // esattamente una volta e lo stage fallito arriva al client.
   r.post('/nodes/pair', mutGate, async (req, res) => {
     const b = req.body || {};
-    if (!validName(b.name) || !nodesStore.parseSshTarget(b.ssh)) {
-      return send(res, 400, { error: 'name o alias SSH non valido' });
-    }
+    const redactSecrets = (s) => String(s || '')
+      .replace(/Bearer\s+\S+/gi, 'Bearer ***')
+      .replace(/[A-Za-z0-9_-]{40,}/g, '***');
+    const fail = (status, stage, code, detail, extra = {}) => send(res, status, {
+      error: redactSecrets(detail), stage, code, detail: redactSecrets(detail), retryable: false, ...extra,
+    });
+    if (!validName(b.name)) return fail(400, 'validation', 'bad-name', 'name non valido (slug a-z, 0-9, -, max 32)', { retryable: true });
+    if (!nodesStore.parseSshTarget(b.ssh)) return fail(400, 'validation', 'bad-ssh', 'alias SSH non valido (atteso user@host o Host alias)', { retryable: true });
     const pair = peering.parsePairingUrl(b.pairingUrl);
-    if (!pair) return send(res, 400, { error: 'link di pairing non valido' });
-    if (b.sshPort !== undefined && !nodesStore.isPort(b.sshPort)) return send(res, 400, { error: 'sshPort non valida' });
-    if (b.identityFile !== undefined && !nodesStore.isAbsPath(b.identityFile)) return send(res, 400, { error: 'identityFile non valido' });
-    if (b.label !== undefined && !nodesStore.validLabel(b.label)) return send(res, 400, { error: 'label non valida (max 64 char, niente a capo)' });
-    if (b.localLabel !== undefined && !nodesStore.validLabel(b.localLabel)) return send(res, 400, { error: 'localLabel non valida (max 64 char, niente a capo)' });
+    if (!pair) return fail(400, 'validation', 'bad-link', 'link di pairing non valido o corrotto', { retryable: true, hint: 'rigenera il link sul dispositivo che invita' });
+    if (b.sshPort !== undefined && !nodesStore.isPort(b.sshPort)) return fail(400, 'validation', 'bad-ssh-port', 'sshPort non valida (1..65535)', { retryable: true });
+    if (b.identityFile !== undefined && !nodesStore.isAbsPath(b.identityFile)) return fail(400, 'validation', 'bad-identity-file', 'identityFile non valido (path assoluto)', { retryable: true });
+    if (b.label !== undefined && !nodesStore.validLabel(b.label)) return fail(400, 'validation', 'bad-label', 'label non valida (max 64 char, niente a capo)', { retryable: true });
+    if (b.localLabel !== undefined && !nodesStore.validLabel(b.localLabel)) return fail(400, 'validation', 'bad-label', 'localLabel non valida (max 64 char, niente a capo)', { retryable: true });
     // label umana del peer come lo vedro' io (display); se assente usa lo slug.
     const peerLabel = nodesStore.sanitizeLabel(b.label, b.name);
     // etichetta umana con cui il peer vedra' questo dispositivo; default sensato.
     const localLabel = nodesStore.sanitizeLabel(b.localLabel, defaultDeviceName());
+    const fetchImpl = seams.fetchImpl || fetch;
+    const sleep = typeof seams.pairDelay === 'function' ? seams.pairDelay : undefined;
+    const requestTimeoutMs = Number.isInteger(seams.pairRequestTimeoutMs) && seams.pairRequestTimeoutMs > 0
+      ? seams.pairRequestTimeoutMs : 6000;
+    // Every protocol request must terminate. Readiness and federation health
+    // already have their own bounded probes; join/confirm/cancel use this
+    // wrapper so a half-open peer cannot leave the PWA waiting forever.
+    const pairFetch = async (url, opts = {}, timeoutMs = requestTimeoutMs) => {
+      const ctrl = new AbortController();
+      const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+      try { return await fetchImpl(url, { ...opts, signal: ctrl.signal }); }
+      finally { clearTimeout(timer); }
+    };
+
     let provisionalPort = null;
     let rollbackCredential = null;
     let created = false;
+    let rolledBack = false;
+    // Rollback locale/remoto ESATTAMENTE una volta, best-effort: cancella la
+    // credenziale provvisoria sul peer (se emessa) e rimuove nodo+tunnel locali.
+    const rollback = async () => {
+      if (rolledBack) return; rolledBack = true;
+      if (rollbackCredential && provisionalPort) {
+        try {
+          await pairFetch(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId, credential: rollbackCredential }),
+          }, Math.min(requestTimeoutMs, 3000));
+        } catch (_) { /* best-effort */ }
+      }
+      try {
+        const st = nodesStore.loadStore(nodesPath);
+        const n = st && nodesStore.getNode(st, b.name);
+        if (n && created) {
+          nodesTunnel.stopTunnel({ home, name: b.name });
+          nodesStore.atomicWriteStore(nodesPath, nodesStore.removeNode(st, b.name));
+        }
+      } catch (_) { /* best-effort */ }
+    };
+    const failRolledBack = async (status, stage, code, detail, extra = {}) => {
+      await rollback();
+      return fail(status, stage, code, detail, extra);
+    };
+
     try {
+      // --- conflict: il nome non deve gia' esistere --------------------------
       let st = nodesStore.loadOrInitStore(nodesPath);
+      if (st.nodes.some((n) => n.name === b.name)) {
+        return fail(409, 'conflict', 'name-exists', `nodo "${b.name}" gia' presente`, {
+          retryable: true, hint: 'scegli un altro nome nelle opzioni avanzate e riprova',
+        });
+      }
+      if (st.nodeId === pair.instanceId) {
+        return fail(409, 'conflict', 'self-pairing', 'il link appartiene a questa stessa installazione', {
+          hint: 'genera il link sul nodo remoto che vuoi collegare',
+        });
+      }
+      const knownPeer = st.nodes.find((n) => n.nodeId === pair.instanceId);
+      if (knownPeer) {
+        return fail(409, 'conflict', 'peer-exists', `questa installazione e' gia' collegata come "${knownPeer.name}"`, {
+          hint: 'usa il nodo esistente oppure rimuovilo prima di rifare il pairing',
+        });
+      }
       const localPort = nodesCmds.assignLocalPort(st);
       provisionalPort = localPort;
       const acceptToken = crypto.randomBytes(32).toString('base64url');
-      st = nodesStore.addNode(st, {
-        name: b.name, ssh: b.ssh, sshPort: b.sshPort,
-        remotePort: pair.port, localPort, identityFile: b.identityFile,
-        transport: 'auto', autostart: true, visibility: 'network',
-        direction: 'outbound', acceptToken, label: peerLabel,
-      });
+      try {
+        st = nodesStore.addNode(st, {
+          name: b.name, ssh: b.ssh, sshPort: b.sshPort,
+          remotePort: pair.port, localPort, identityFile: b.identityFile,
+          transport: 'auto', autostart: true, visibility: 'network',
+          direction: 'outbound', acceptToken, label: peerLabel,
+        });
+      } catch (e) {
+        const msg = String((e && e.message) || e);
+        const isDup = msg.includes('duplicato') || msg.includes('self-reference');
+        return fail(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
+      }
       nodesStore.atomicWriteStore(nodesPath, st);
       created = true;
       const node = nodesStore.getNode(st, b.name);
+
+      // --- ssh-start: supervisor del tunnel -L provvisorio --------------------
       const started = nodesTunnel.startForward({
         home, node, localAppPort: cfg.port,
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
-      if (!started.started && started.reason !== 'already running') throw new Error(started.reason || 'tunnel start failed');
-      if (typeof seams.pairDelay === 'function') await seams.pairDelay();
-      else await new Promise((resolve) => setTimeout(resolve, 900));
-      const fetchImpl = seams.fetchImpl || fetch;
-      const jr = await fetchImpl(`http://127.0.0.1:${localPort}/pair/join`, {
-        method: 'POST', headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          invite: pair.invite,
-          instanceId: st.nodeId,
-          name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
-          label: localLabel,
-          port: cfg.port,
-          acceptToken,
-        }),
-      });
+      if (!started.started && started.reason !== 'already running') {
+        return failRolledBack(502, 'ssh-start', 'tunnel-start-failed', started.reason || 'avvio del tunnel SSH fallito', {
+          retryable: true,
+          hint: 'verifica ssh e target/alias su questo dispositivo; il link NON e\' stato consumato e puoi riprovare',
+        });
+      }
+
+      // --- ssh-ready: readiness bounded PRIMA di consumare l'invite -----------
+      const ready = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      if (!ready.ready) {
+        return failRolledBack(502, 'ssh-ready', 'transport-not-ready',
+          `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
+            retryable: true,
+            hint: 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
+          });
+      }
+
+      // --- join: consuma l'invite one-time (UNA volta, mai replay) ------------
+      let jr;
+      try {
+        jr = await pairFetch(`http://127.0.0.1:${localPort}/pair/join`, {
+          method: 'POST', headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            invite: pair.invite,
+            instanceId: st.nodeId,
+            name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
+            label: localLabel,
+            port: cfg.port,
+            acceptToken,
+          }),
+        });
+      } catch (e) {
+        // Risposta persa DOPO l'invio: l'invite potrebbe essere stato consumato.
+        // Un join ambiguo non si rigioca mai.
+        return failRolledBack(502, 'join', 'join-ambiguous',
+          'risposta di join persa: l\'invito potrebbe essere gia\' stato consumato', {
+            hint: 'rigenera un nuovo link sul dispositivo che invita e riprova',
+          });
+      }
       const joined = await jr.json().catch(() => ({}));
-      if (!jr.ok || !nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
-        || !nodesStore.NODE_ID_RE.test(joined.instanceId)) throw new Error(joined.error || `pairing HTTP ${jr.status}`);
+      if (jr.status === 410) {
+        return failRolledBack(502, 'join', 'invite-expired', 'invito scaduto o gia\' usato (one-time)', {
+          hint: 'rigenera un nuovo link sul dispositivo che invita',
+        });
+      }
+      if (!jr.ok) {
+        return failRolledBack(502, 'join', 'join-rejected', joined.error || `join rifiutato dal peer (HTTP ${jr.status})`, {
+          hint: 'rigenera un nuovo link e riprova',
+        });
+      }
+      if (!nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
+        || !nodesStore.NODE_ID_RE.test(joined.instanceId)) {
+        return failRolledBack(502, 'join', 'join-invalid-response', 'risposta di join non valida dal peer', {
+          hint: 'versioni NexusCrew incompatibili? aggiorna entrambi i nodi',
+        });
+      }
       rollbackCredential = joined.credential;
+      if (joined.instanceId !== pair.instanceId) {
+        return failRolledBack(502, 'join', 'peer-identity-mismatch',
+          'l\'identita\' del peer raggiunto non coincide con quella contenuta nel link', {
+            hint: 'controlla che il target SSH punti al nodo che ha generato il link',
+          });
+      }
+
+      // --- tunnel-final: riavvio con la spec negoziata (-R inclusa) -----------
       st = nodesStore.loadOrInitStore(nodesPath);
       st = nodesStore.updateNode(st, b.name, {
         token: joined.credential, nodeId: joined.instanceId, reversePort: joined.reversePort,
@@ -368,44 +514,51 @@ function settingsRoutes(deps = {}) {
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
-      if (!finalStart.started && finalStart.reason !== 'already running') throw new Error(finalStart.reason || 'final tunnel start failed');
-      if (typeof seams.pairDelay === 'function') await seams.pairDelay();
-      else await new Promise((resolve) => setTimeout(resolve, 900));
+      if (!finalStart.started && finalStart.reason !== 'already running') {
+        return failRolledBack(502, 'tunnel-final', 'tunnel-restart-failed', finalStart.reason || 'riavvio del tunnel negoziato fallito', {});
+      }
+      const readyFinal = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      if (!readyFinal.ready) {
+        return failRolledBack(502, 'tunnel-final', 'transport-not-ready',
+          `il tunnel negoziato non risponde (${readyFinal.attempts} tentativi)`, {});
+      }
+
+      // --- confirm: idempotente lato peer -> bounded retry ---------------------
       let confirmed = null;
       for (let attempt = 0; attempt < 3; attempt += 1) {
         try {
-          confirmed = await fetchImpl(`http://127.0.0.1:${localPort}/pair/confirm`, {
+          confirmed = await pairFetch(`http://127.0.0.1:${localPort}/pair/confirm`, {
             method: 'POST', headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ credential: joined.credential }),
-          });
+          }, Math.min(requestTimeoutMs, 3500));
           if (confirmed.ok) break;
-        } catch (_) {}
-        await new Promise((resolve) => setTimeout(resolve, 400 * (attempt + 1)));
+        } catch (_) { /* retry: confirm e' idempotente lato peer */ }
+        if (attempt < 2) await (sleep ? sleep() : new Promise((resolve) => setTimeout(resolve, 400 * (attempt + 1))));
       }
       if (!confirmed || !confirmed.ok) {
         const x = confirmed ? await confirmed.json().catch(() => ({})) : {};
-        throw new Error(x.error || `pair confirm HTTP ${confirmed ? confirmed.status : 'unreachable'}`);
+        return failRolledBack(502, 'confirm', 'confirm-failed',
+          x.error || `conferma pairing fallita (HTTP ${confirmed ? confirmed.status : 'irraggiungibile'})`, {
+            hint: 'rigenera un nuovo link e riprova',
+          });
       }
-      send(res, 200, { paired: true, name: b.name, instanceId: joined.instanceId, transport: 'auto' });
-    } catch (e) {
-      if (rollbackCredential && provisionalPort) {
-        try {
-          const fetchImpl = seams.fetchImpl || fetch;
-          await fetchImpl(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
-            method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId, credential: rollbackCredential }),
+
+      // --- health: federazione AUTENTICATA verificata prima di paired:true ----
+      const health = await probeHealth({
+        port: localPort, token: joined.credential, expectedInstanceId: joined.instanceId,
+        fetchImpl, now: Date.now(),
+      });
+      if (!health || health.status !== 'healthy') {
+        return failRolledBack(502, 'health', 'federation-health-failed',
+          (health && health.detail) || 'health federato non verificabile dopo la conferma', {
+            hint: 'pairing annullato e ripulito: rigenera il link e riprova',
           });
-        } catch (_) {}
       }
-      try {
-        const st = nodesStore.loadStore(nodesPath);
-        const n = st && nodesStore.getNode(st, b.name);
-        if (n && created) {
-          nodesTunnel.stopTunnel({ home, name: b.name });
-          nodesStore.atomicWriteStore(nodesPath, nodesStore.removeNode(st, b.name));
-        }
-      } catch (_) {}
-      send(res, 502, { error: String(e.message || e) });
+
+      send(res, 200, { paired: true, name: b.name, instanceId: joined.instanceId, transport: 'auto', health: { status: health.status } });
+    } catch (e) {
+      await rollback();
+      fail(502, 'internal', 'unexpected', String((e && e.message) || e), {});
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {