@mmmbuto/nexuscrew 0.8.6 → 0.8.9

package/lib/settings/routes.js

@@ -46,15 +46,17 @@ const nodesStore = require('../nodes/store.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
+const { probeHealth } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
 const { isServiceRunning, readRoles, bootState } = require('../cli/commands.js');
 const { configJsonPath } = require('../config.js');
 const VERSION = require('../../package.json').version;
+const { scrubError } = require('../update/core.js');
 
 // Whitelist chiavi scrivibili di config.json via API (lista chiusa dal task B2).
-const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone']);
+const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone', 'autoUpdate']);
 const ROLE_KEYS = new Set(['client', 'node']);
 const ADD_KEYS = new Set(['name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'label']);
 const NODE_ROLE_KEYS = new Set(['enabled', 'rendezvousSsh', 'publishedPort', 'keyPath']);
@@ -140,6 +142,7 @@ function settingsRoutes(deps = {}) {
   // scrive solo il file (come prima), senza reload in-memory.
   const tokenStore = deps.tokenStore || null;
   const closeSessions = deps.closeSessions || null;
+  const updater = deps.updater || null;
   const home = cfg.home || os.homedir();
   const configDir = cfg.configDir || path.join(home, '.nexuscrew');
   // configJsonPath() rispetta NEXUSCREW_CONFIG_FILE (stessa risoluzione di
@@ -190,6 +193,7 @@ function settingsRoutes(deps = {}) {
         active: isServiceRunning({ platform, execImpl: seams.execImpl, uid: seams.uid, home }),
         boot: bootState({ platform, execImpl: seams.execImpl, uid: seams.uid, home }).enabled,
       };
+      const updateStatus = updater && typeof updater.status === 'function' ? updater.status() : null;
       const out = {
         roles: readRoles(configPath),
         firstRun,
@@ -197,10 +201,12 @@ function settingsRoutes(deps = {}) {
         platform,
         service,
         version: VERSION,
+        autoUpdate: updateStatus ? updateStatus.enabled : fileCfg.autoUpdate !== false,
         // Nome dispositivo proposto per i form di pairing (etichetta umana, non
         // lo slug). La UI lo precompila e lascia editing libero.
         deviceName: defaultDeviceName(),
       };
+      if (updateStatus) out.update = updateStatus;
       // rendezvous via redactStore (view sicura §4b(4)): non contiene token, ma
       // la si prende comunque SOLO dalla vista redatta.
       const st = nodesStore.loadStore(nodesPath);
@@ -220,10 +226,10 @@ function settingsRoutes(deps = {}) {
         return send(res, 400, { error: 'body deve essere un oggetto JSON' });
       }
       for (const k of Object.keys(b)) {
-        if (!CONFIG_KEYS.has(k)) return send(res, 400, { error: `chiave non ammessa: "${k}" (whitelist: roles, port, wizardDone)` });
+        if (!CONFIG_KEYS.has(k)) return send(res, 400, { error: `chiave non ammessa: "${k}" (whitelist: roles, port, wizardDone, autoUpdate)` });
       }
       if (Object.keys(b).length === 0) {
-        return send(res, 400, { error: 'nessuna chiave da scrivere (whitelist: roles, port, wizardDone)' });
+        return send(res, 400, { error: 'nessuna chiave da scrivere (whitelist: roles, port, wizardDone, autoUpdate)' });
       }
       if (b.roles !== undefined) {
         if (!b.roles || typeof b.roles !== 'object' || Array.isArray(b.roles)) {
@@ -240,6 +246,9 @@ function settingsRoutes(deps = {}) {
       if (b.wizardDone !== undefined && typeof b.wizardDone !== 'boolean') {
         return send(res, 400, { error: 'wizardDone deve essere boolean' });
       }
+      if (b.autoUpdate !== undefined && typeof b.autoUpdate !== 'boolean') {
+        return send(res, 400, { error: 'autoUpdate deve essere boolean' });
+      }
 
       // merge sul config esistente (preserva le chiavi non gestite qui)
       const { cfg: current } = readConfigFile(configPath);
@@ -250,11 +259,15 @@ function settingsRoutes(deps = {}) {
       }
       if (b.port !== undefined) next.port = b.port;
       if (b.wizardDone !== undefined) next.wizardDone = b.wizardDone;
+      if (b.autoUpdate !== undefined) next.autoUpdate = b.autoUpdate;
       atomicWriteConfig(configPath, next);
+      if (b.autoUpdate !== undefined && updater && typeof updater.setEnabled === 'function') {
+        updater.setEnabled(b.autoUpdate);
+      }
 
       const out = {
         saved: true,
-        config: { roles: next.roles, port: next.port, wizardDone: next.wizardDone },
+        config: { roles: next.roles, port: next.port, wizardDone: next.wizardDone, autoUpdate: next.autoUpdate !== false },
       };
       // Il server legge la porta SOLO allo startup: il cambio vale al prossimo
       // restart (contratto dichiarato nella risposta, la UI avvisa).
@@ -265,6 +278,20 @@ function settingsRoutes(deps = {}) {
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
+  // Auto-update npm: check e apply sono autenticati, READONLY-gated e non
+  // accettano mai package/versione dal browser. Il manager usa esclusivamente
+  // @mmmbuto/nexuscrew@latest, confronta semver e installa la versione esatta.
+  r.post('/update/check', mutGate, async (_req, res) => {
+    if (!updater) return send(res, 501, { error: 'auto-update non disponibile' });
+    try { send(res, 200, await updater.check()); }
+    catch (e) { send(res, e.status || 500, { error: scrubError(e), ...(e.code ? { code: e.code } : {}) }); }
+  });
+  r.post('/update/apply', mutGate, async (_req, res) => {
+    if (!updater) return send(res, 501, { error: 'auto-update non disponibile' });
+    try { send(res, 202, await updater.apply()); }
+    catch (e) { send(res, e.status || 500, { error: scrubError(e), ...(e.code ? { code: e.code } : {}) }); }
+  });
+
   // --- POST /token/rotate — atomico + reload live + chiusura WS; token MAI in risposta
   // Contratto §4b(3): "scrittura atomica del token file + chiusura delle sessioni
   // WS/API attive locali + reload credenziali proxy". Audit F7: prima questa route
@@ -296,90 +323,231 @@ function settingsRoutes(deps = {}) {
     try {
       const b = req.body || {};
       const label = nodesStore.sanitizeLabel(b.label, defaultDeviceName());
+      const st = nodesStore.loadOrInitStore(nodesPath);
+      const rendezvous = st.rendezvous || null;
       const extra = {};
       if (typeof b.ssh === 'string' && b.ssh.trim()) {
         const ssh = nodesStore.parseSshTarget(b.ssh.trim());
         if (!ssh) return send(res, 400, { error: 'ssh non valido (atteso user@host o alias)' });
         extra.ssh = ssh.value;
+      } else if (rendezvous && rendezvous.ssh) {
+        // Zero-field creator path: the rendezvous SSH target is reachable by
+        // definition. Its publishedPort is the REMOTE NEXUSCREW HTTP port,
+        // never the OpenSSH transport port.
+        extra.ssh = rendezvous.ssh;
       }
       if (b.sshPort !== undefined && b.sshPort !== null && b.sshPort !== '') {
         if (!nodesStore.isPort(Number(b.sshPort))) return send(res, 400, { error: 'sshPort non valida (1..65535)' });
         extra.sshPort = Number(b.sshPort);
       }
       if (extra.sshPort && !extra.ssh) return send(res, 400, { error: 'sshPort richiede un target SSH' });
+      let remotePort = cfg.port;
+      if (b.remotePort !== undefined && b.remotePort !== null && b.remotePort !== '') {
+        if (!nodesStore.isPort(Number(b.remotePort))) return send(res, 400, { error: 'remotePort non valida (1..65535)' });
+        remotePort = Number(b.remotePort);
+      } else if (rendezvous && extra.ssh === rendezvous.ssh) {
+        remotePort = rendezvous.publishedPort;
+      }
       if (typeof b.name === 'string' && b.name.trim()) {
         if (!nodesStore.NODE_NAME_RE.test(b.name.trim())) return send(res, 400, { error: 'name non valido (a-z 0-9 -, max 32)' });
         extra.name = b.name.trim();
       }
       if (extra.ssh && !extra.name) extra.name = nodesStore.toSlug(label);
-      const st = nodesStore.loadOrInitStore(nodesPath);
       send(res, 200, peering.createInvite({
-        invitesPath, instanceId: st.nodeId, port: cfg.port, label, ...extra,
+        invitesPath, instanceId: st.nodeId, port: remotePort, linkPort: cfg.port, label, ...extra,
       }));
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
-  // Hydra join: add once from the PWA. A provisional -L reaches the invite
-  // endpoint, then the negotiated -R makes the same SSH link reciprocal.
+  // Hydra join in stadi espliciti: la PWA riceve un contratto strutturato
+  // {error, code, stage, detail?, hint?, retryable?} — MAI credenziali, token,
+  // header Authorization o contenuto di chiavi nel payload. Stadi distinti:
+  //   validation | conflict | ssh-start | ssh-ready | join | tunnel-final |
+  //   confirm | health   (+ internal per gli inattesi)
+  // Lo sleep fisso 900ms e' sostituito da un probe di readiness bounded
+  // (peering.probeTransportReady) eseguito PRIMA di consumare l'invite one-time;
+  // una risposta join ambigua (rete morta dopo l'invio) non viene mai rigiocata.
+  // Su qualunque fallimento post-provisioning il rollback locale/remoto gira
+  // esattamente una volta e lo stage fallito arriva al client.
   r.post('/nodes/pair', mutGate, async (req, res) => {
     const b = req.body || {};
-    if (!validName(b.name) || !nodesStore.parseSshTarget(b.ssh)) {
-      return send(res, 400, { error: 'name o alias SSH non valido' });
-    }
+    const redactSecrets = (s) => String(s || '')
+      .replace(/Bearer\s+\S+/gi, 'Bearer ***')
+      .replace(/[A-Za-z0-9_-]{40,}/g, '***');
+    const fail = (status, stage, code, detail, extra = {}) => send(res, status, {
+      error: redactSecrets(detail), stage, code, detail: redactSecrets(detail), retryable: false, ...extra,
+    });
+    if (!validName(b.name)) return fail(400, 'validation', 'bad-name', 'name non valido (slug a-z, 0-9, -, max 32)', { retryable: true });
+    if (!nodesStore.parseSshTarget(b.ssh)) return fail(400, 'validation', 'bad-ssh', 'alias SSH non valido (atteso user@host o Host alias)', { retryable: true });
     const pair = peering.parsePairingUrl(b.pairingUrl);
-    if (!pair) return send(res, 400, { error: 'link di pairing non valido' });
-    if (b.sshPort !== undefined && !nodesStore.isPort(b.sshPort)) return send(res, 400, { error: 'sshPort non valida' });
-    if (b.identityFile !== undefined && !nodesStore.isAbsPath(b.identityFile)) return send(res, 400, { error: 'identityFile non valido' });
-    if (b.label !== undefined && !nodesStore.validLabel(b.label)) return send(res, 400, { error: 'label non valida (max 64 char, niente a capo)' });
-    if (b.localLabel !== undefined && !nodesStore.validLabel(b.localLabel)) return send(res, 400, { error: 'localLabel non valida (max 64 char, niente a capo)' });
+    if (!pair) return fail(400, 'validation', 'bad-link', 'link di pairing non valido o corrotto', { retryable: true, hint: 'rigenera il link sul dispositivo che invita' });
+    if (b.sshPort !== undefined && !nodesStore.isPort(b.sshPort)) return fail(400, 'validation', 'bad-ssh-port', 'sshPort non valida (1..65535)', { retryable: true });
+    if (b.identityFile !== undefined && !nodesStore.isAbsPath(b.identityFile)) return fail(400, 'validation', 'bad-identity-file', 'identityFile non valido (path assoluto)', { retryable: true });
+    if (b.label !== undefined && !nodesStore.validLabel(b.label)) return fail(400, 'validation', 'bad-label', 'label non valida (max 64 char, niente a capo)', { retryable: true });
+    if (b.localLabel !== undefined && !nodesStore.validLabel(b.localLabel)) return fail(400, 'validation', 'bad-label', 'localLabel non valida (max 64 char, niente a capo)', { retryable: true });
     // label umana del peer come lo vedro' io (display); se assente usa lo slug.
     const peerLabel = nodesStore.sanitizeLabel(b.label, b.name);
     // etichetta umana con cui il peer vedra' questo dispositivo; default sensato.
     const localLabel = nodesStore.sanitizeLabel(b.localLabel, defaultDeviceName());
+    const fetchImpl = seams.fetchImpl || fetch;
+    const sleep = typeof seams.pairDelay === 'function' ? seams.pairDelay : undefined;
+    const requestTimeoutMs = Number.isInteger(seams.pairRequestTimeoutMs) && seams.pairRequestTimeoutMs > 0
+      ? seams.pairRequestTimeoutMs : 6000;
+    // Every protocol request must terminate. Readiness and federation health
+    // already have their own bounded probes; join/confirm/cancel use this
+    // wrapper so a half-open peer cannot leave the PWA waiting forever.
+    const pairFetch = async (url, opts = {}, timeoutMs = requestTimeoutMs) => {
+      const ctrl = new AbortController();
+      const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+      try { return await fetchImpl(url, { ...opts, signal: ctrl.signal }); }
+      finally { clearTimeout(timer); }
+    };
+
     let provisionalPort = null;
     let rollbackCredential = null;
     let created = false;
+    let rolledBack = false;
+    // Rollback locale/remoto ESATTAMENTE una volta, best-effort: cancella la
+    // credenziale provvisoria sul peer (se emessa) e rimuove nodo+tunnel locali.
+    const rollback = async () => {
+      if (rolledBack) return; rolledBack = true;
+      if (rollbackCredential && provisionalPort) {
+        try {
+          await pairFetch(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId, credential: rollbackCredential }),
+          }, Math.min(requestTimeoutMs, 3000));
+        } catch (_) { /* best-effort */ }
+      }
+      try {
+        const st = nodesStore.loadStore(nodesPath);
+        const n = st && nodesStore.getNode(st, b.name);
+        if (n && created) {
+          nodesTunnel.stopTunnel({ home, name: b.name });
+          nodesStore.atomicWriteStore(nodesPath, nodesStore.removeNode(st, b.name));
+        }
+      } catch (_) { /* best-effort */ }
+    };
+    const failRolledBack = async (status, stage, code, detail, extra = {}) => {
+      await rollback();
+      return fail(status, stage, code, detail, extra);
+    };
+
     try {
+      // --- conflict: il nome non deve gia' esistere --------------------------
       let st = nodesStore.loadOrInitStore(nodesPath);
+      if (st.nodes.some((n) => n.name === b.name)) {
+        return fail(409, 'conflict', 'name-exists', `nodo "${b.name}" gia' presente`, {
+          retryable: true, hint: 'scegli un altro nome nelle opzioni avanzate e riprova',
+        });
+      }
+      if (st.nodeId === pair.instanceId) {
+        return fail(409, 'conflict', 'self-pairing', 'il link appartiene a questa stessa installazione', {
+          hint: 'genera il link sul nodo remoto che vuoi collegare',
+        });
+      }
+      const knownPeer = st.nodes.find((n) => n.nodeId === pair.instanceId);
+      if (knownPeer) {
+        return fail(409, 'conflict', 'peer-exists', `questa installazione e' gia' collegata come "${knownPeer.name}"`, {
+          hint: 'usa il nodo esistente oppure rimuovilo prima di rifare il pairing',
+        });
+      }
       const localPort = nodesCmds.assignLocalPort(st);
       provisionalPort = localPort;
       const acceptToken = crypto.randomBytes(32).toString('base64url');
-      st = nodesStore.addNode(st, {
-        name: b.name, ssh: b.ssh, sshPort: b.sshPort,
-        remotePort: pair.port, localPort, identityFile: b.identityFile,
-        transport: 'auto', autostart: true, visibility: 'network',
-        direction: 'outbound', acceptToken, label: peerLabel,
-      });
+      try {
+        st = nodesStore.addNode(st, {
+          name: b.name, ssh: b.ssh, sshPort: b.sshPort,
+          remotePort: pair.port, localPort, identityFile: b.identityFile,
+          transport: 'auto', autostart: true, visibility: 'network',
+          direction: 'outbound', acceptToken, label: peerLabel,
+        });
+      } catch (e) {
+        const msg = String((e && e.message) || e);
+        const isDup = msg.includes('duplicato') || msg.includes('self-reference');
+        return fail(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
+      }
       nodesStore.atomicWriteStore(nodesPath, st);
       created = true;
       const node = nodesStore.getNode(st, b.name);
+
+      // --- ssh-start: supervisor del tunnel -L provvisorio --------------------
       const started = nodesTunnel.startForward({
         home, node, localAppPort: cfg.port,
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
-      if (!started.started && started.reason !== 'already running') throw new Error(started.reason || 'tunnel start failed');
-      if (typeof seams.pairDelay === 'function') await seams.pairDelay();
-      else await new Promise((resolve) => setTimeout(resolve, 900));
-      const fetchImpl = seams.fetchImpl || fetch;
-      const jr = await fetchImpl(`http://127.0.0.1:${localPort}/pair/join`, {
-        method: 'POST', headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          invite: pair.invite,
-          instanceId: st.nodeId,
-          name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
-          label: localLabel,
-          port: cfg.port,
-          acceptToken,
-        }),
-      });
+      if (!started.started && started.reason !== 'already running') {
+        return failRolledBack(502, 'ssh-start', 'tunnel-start-failed', started.reason || 'avvio del tunnel SSH fallito', {
+          retryable: true,
+          hint: 'verifica ssh e target/alias su questo dispositivo; il link NON e\' stato consumato e puoi riprovare',
+        });
+      }
+
+      // --- ssh-ready: readiness bounded PRIMA di consumare l'invite -----------
+      const ready = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      if (!ready.ready) {
+        return failRolledBack(502, 'ssh-ready', 'transport-not-ready',
+          `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
+            retryable: true,
+            hint: 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
+          });
+      }
+
+      // --- join: consuma l'invite one-time (UNA volta, mai replay) ------------
+      let jr;
+      try {
+        jr = await pairFetch(`http://127.0.0.1:${localPort}/pair/join`, {
+          method: 'POST', headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            invite: pair.invite,
+            instanceId: st.nodeId,
+            name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
+            label: localLabel,
+            port: cfg.port,
+            acceptToken,
+            roles: readRoles(configPath),
+          }),
+        });
+      } catch (e) {
+        // Risposta persa DOPO l'invio: l'invite potrebbe essere stato consumato.
+        // Un join ambiguo non si rigioca mai.
+        return failRolledBack(502, 'join', 'join-ambiguous',
+          'risposta di join persa: l\'invito potrebbe essere gia\' stato consumato', {
+            hint: 'rigenera un nuovo link sul dispositivo che invita e riprova',
+          });
+      }
       const joined = await jr.json().catch(() => ({}));
-      if (!jr.ok || !nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
-        || !nodesStore.NODE_ID_RE.test(joined.instanceId)) throw new Error(joined.error || `pairing HTTP ${jr.status}`);
+      if (jr.status === 410) {
+        return failRolledBack(502, 'join', 'invite-expired', 'invito scaduto o gia\' usato (one-time)', {
+          hint: 'rigenera un nuovo link sul dispositivo che invita',
+        });
+      }
+      if (!jr.ok) {
+        return failRolledBack(502, 'join', 'join-rejected', joined.error || `join rifiutato dal peer (HTTP ${jr.status})`, {
+          hint: 'rigenera un nuovo link e riprova',
+        });
+      }
+      const joinedRoles = joined.roles === undefined ? null : nodesStore.parseRoles(joined.roles);
+      if (!nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
+        || !nodesStore.NODE_ID_RE.test(joined.instanceId) || (joined.roles !== undefined && !joinedRoles)) {
+        return failRolledBack(502, 'join', 'join-invalid-response', 'risposta di join non valida dal peer', {
+          hint: 'versioni NexusCrew incompatibili? aggiorna entrambi i nodi',
+        });
+      }
       rollbackCredential = joined.credential;
+      if (joined.instanceId !== pair.instanceId) {
+        return failRolledBack(502, 'join', 'peer-identity-mismatch',
+          'l\'identita\' del peer raggiunto non coincide con quella contenuta nel link', {
+            hint: 'controlla che il target SSH punti al nodo che ha generato il link',
+          });
+      }
+
+      // --- tunnel-final: riavvio con la spec negoziata (-R inclusa) -----------
       st = nodesStore.loadOrInitStore(nodesPath);
       st = nodesStore.updateNode(st, b.name, {
         token: joined.credential, nodeId: joined.instanceId, reversePort: joined.reversePort,
+        ...(joinedRoles ? { roles: joinedRoles, rolesKnown: true } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);
       nodesTunnel.stopTunnel({ home, name: b.name });
@@ -388,44 +556,51 @@ function settingsRoutes(deps = {}) {
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
-      if (!finalStart.started && finalStart.reason !== 'already running') throw new Error(finalStart.reason || 'final tunnel start failed');
-      if (typeof seams.pairDelay === 'function') await seams.pairDelay();
-      else await new Promise((resolve) => setTimeout(resolve, 900));
+      if (!finalStart.started && finalStart.reason !== 'already running') {
+        return failRolledBack(502, 'tunnel-final', 'tunnel-restart-failed', finalStart.reason || 'riavvio del tunnel negoziato fallito', {});
+      }
+      const readyFinal = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      if (!readyFinal.ready) {
+        return failRolledBack(502, 'tunnel-final', 'transport-not-ready',
+          `il tunnel negoziato non risponde (${readyFinal.attempts} tentativi)`, {});
+      }
+
+      // --- confirm: idempotente lato peer -> bounded retry ---------------------
       let confirmed = null;
       for (let attempt = 0; attempt < 3; attempt += 1) {
         try {
-          confirmed = await fetchImpl(`http://127.0.0.1:${localPort}/pair/confirm`, {
+          confirmed = await pairFetch(`http://127.0.0.1:${localPort}/pair/confirm`, {
             method: 'POST', headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ credential: joined.credential }),
-          });
+          }, Math.min(requestTimeoutMs, 3500));
           if (confirmed.ok) break;
-        } catch (_) {}
-        await new Promise((resolve) => setTimeout(resolve, 400 * (attempt + 1)));
+        } catch (_) { /* retry: confirm e' idempotente lato peer */ }
+        if (attempt < 2) await (sleep ? sleep() : new Promise((resolve) => setTimeout(resolve, 400 * (attempt + 1))));
       }
       if (!confirmed || !confirmed.ok) {
         const x = confirmed ? await confirmed.json().catch(() => ({})) : {};
-        throw new Error(x.error || `pair confirm HTTP ${confirmed ? confirmed.status : 'unreachable'}`);
+        return failRolledBack(502, 'confirm', 'confirm-failed',
+          x.error || `conferma pairing fallita (HTTP ${confirmed ? confirmed.status : 'irraggiungibile'})`, {
+            hint: 'rigenera un nuovo link e riprova',
+          });
       }
-      send(res, 200, { paired: true, name: b.name, instanceId: joined.instanceId, transport: 'auto' });
-    } catch (e) {
-      if (rollbackCredential && provisionalPort) {
-        try {
-          const fetchImpl = seams.fetchImpl || fetch;
-          await fetchImpl(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
-            method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ instanceId: (nodesStore.loadStore(nodesPath) || {}).nodeId, credential: rollbackCredential }),
+
+      // --- health: federazione AUTENTICATA verificata prima di paired:true ----
+      const health = await probeHealth({
+        port: localPort, token: joined.credential, expectedInstanceId: joined.instanceId,
+        fetchImpl, now: Date.now(),
+      });
+      if (!health || health.status !== 'healthy') {
+        return failRolledBack(502, 'health', 'federation-health-failed',
+          (health && health.detail) || 'health federato non verificabile dopo la conferma', {
+            hint: 'pairing annullato e ripulito: rigenera il link e riprova',
           });
-        } catch (_) {}
       }
-      try {
-        const st = nodesStore.loadStore(nodesPath);
-        const n = st && nodesStore.getNode(st, b.name);
-        if (n && created) {
-          nodesTunnel.stopTunnel({ home, name: b.name });
-          nodesStore.atomicWriteStore(nodesPath, nodesStore.removeNode(st, b.name));
-        }
-      } catch (_) {}
-      send(res, 502, { error: String(e.message || e) });
+
+      send(res, 200, { paired: true, name: b.name, instanceId: joined.instanceId, transport: 'auto', health: { status: health.status } });
+    } catch (e) {
+      await rollback();
+      fail(502, 'internal', 'unexpected', String((e && e.message) || e), {});
     }
   });
 
@@ -685,6 +860,7 @@ function settingsRoutes(deps = {}) {
 function publicPeeringRoutes(deps = {}) {
   const cfg = deps.cfg || {};
   const home = cfg.home || os.homedir();
+  const configPath = cfg.configPath || configJsonPath();
   const nodesPath = deps.nodesPath || cfg.nodesPath || nodesStore.defaultNodesPath(home);
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
@@ -698,8 +874,10 @@ function publicPeeringRoutes(deps = {}) {
     recent.push(now); attempts.set(key, recent);
     if (recent.length > 10) return res.status(429).json({ error: 'troppi tentativi di pairing' });
     const b = req.body || {};
+    const peerRoles = b.roles === undefined ? null : nodesStore.parseRoles(b.roles);
     if (!nodesStore.validToken(b.invite) || !nodesStore.NODE_ID_RE.test(b.instanceId)
-      || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)) {
+      || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)
+      || (b.roles !== undefined && !peerRoles)) {
       return res.status(400).json({ error: 'pairing request non valida' });
     }
     if (b.label !== undefined && !nodesStore.validLabel(b.label)) {
@@ -715,8 +893,9 @@ function publicPeeringRoutes(deps = {}) {
       const credential = peering.createPending({ pendingPath, data: {
         name, remotePort: b.port, reversePort, instanceId: b.instanceId, acceptToken: b.acceptToken,
         label: nodesStore.sanitizeLabel(b.label, name),
+        ...(peerRoles ? { roles: peerRoles, rolesKnown: true } : { rolesKnown: false }),
       } });
-      res.json({ paired: true, instanceId: st.nodeId, reversePort, credential });
+      res.json({ paired: true, instanceId: st.nodeId, reversePort, credential, roles: readRoles(configPath) });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   r.post('/confirm', (req, res) => {
@@ -736,6 +915,8 @@ function publicPeeringRoutes(deps = {}) {
         direction: 'inbound', transport: 'inbound', autostart: true,
         visibility: 'network', nodeId: pending.instanceId,
         token: pending.acceptToken, acceptToken: b.credential,
+        ...(pending.roles ? { roles: pending.roles } : {}),
+        rolesKnown: pending.rolesKnown === true,
         ...(pending.label ? { label: pending.label } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);

package/lib/update/core.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const PACKAGE_NAME = require('../../package.json').name;
+const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+
+function parseVersion(value) {
+  const m = VERSION_RE.exec(String(value || '').trim());
+  if (!m) return null;
+  return {
+    raw: m[0],
+    major: Number(m[1]),
+    minor: Number(m[2]),
+    patch: Number(m[3]),
+    prerelease: m[4] ? m[4].split('.') : [],
+  };
+}
+
+function compareIdentifier(a, b) {
+  const an = /^[0-9]+$/.test(a);
+  const bn = /^[0-9]+$/.test(b);
+  if (an && bn) return Number(a) === Number(b) ? 0 : Number(a) > Number(b) ? 1 : -1;
+  if (an !== bn) return an ? -1 : 1;
+  return a === b ? 0 : a > b ? 1 : -1;
+}
+
+function compareVersions(a, b) {
+  const av = parseVersion(a);
+  const bv = parseVersion(b);
+  if (!av || !bv) throw new Error('versione semver non valida');
+  for (const key of ['major', 'minor', 'patch']) {
+    if (av[key] !== bv[key]) return av[key] > bv[key] ? 1 : -1;
+  }
+  if (!av.prerelease.length && !bv.prerelease.length) return 0;
+  if (!av.prerelease.length) return 1;
+  if (!bv.prerelease.length) return -1;
+  const n = Math.max(av.prerelease.length, bv.prerelease.length);
+  for (let i = 0; i < n; i += 1) {
+    if (av.prerelease[i] === undefined) return -1;
+    if (bv.prerelease[i] === undefined) return 1;
+    const c = compareIdentifier(av.prerelease[i], bv.prerelease[i]);
+    if (c) return c;
+  }
+  return 0;
+}
+
+function registryVersion(stdout) {
+  const raw = String(stdout || '').trim();
+  let value = raw;
+  try {
+    const decoded = JSON.parse(raw);
+    if (typeof decoded === 'string') value = decoded;
+  } catch (_) { /* npm senza --json o output gia' plain */ }
+  const parsed = parseVersion(value);
+  if (!parsed) throw new Error('npm ha restituito una versione non valida');
+  return parsed.raw;
+}
+
+function scrubError(error) {
+  return String((error && error.message) || error || 'errore sconosciuto')
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/gi, 'https://***@')
+    .replace(/\/(?:home|Users|data\/data\/com\.termux\/files\/home)\/[^\s:]+/g, '<local-path>')
+    .replace(/(?:Bearer\s+)?[A-Za-z0-9_-]{40,}/gi, '***')
+    .slice(0, 300);
+}
+
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid < 1) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+
+function readLock(file) {
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return null;
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return value && Number.isInteger(value.pid) && typeof value.token === 'string' ? value : null;
+  } catch (_) { return null; }
+}
+
+function writeLock(file, value, flags = 'wx') {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(file, `${JSON.stringify(value)}\n`, { flag: flags, mode: 0o600 });
+  fs.chmodSync(file, 0o600);
+}
+
+function acquireUpdateLock(file, pid = process.pid, token = crypto.randomBytes(16).toString('hex')) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try { writeLock(file, { pid, token, createdAt: Date.now() }); return { ok: true, token }; }
+    catch (e) {
+      if (e.code !== 'EEXIST') throw e;
+      const current = readLock(file);
+      if (current && pidAlive(current.pid)) return { ok: false, current };
+      try { fs.unlinkSync(file); } catch (unlinkError) { if (unlinkError.code !== 'ENOENT') throw unlinkError; }
+    }
+  }
+  return { ok: false, current: readLock(file) };
+}
+
+function adoptUpdateLock(file, token, pid = process.pid) {
+  const current = readLock(file);
+  if (!current || current.token !== token) return false;
+  const tmp = `${file}.${pid}.tmp`;
+  try {
+    writeLock(tmp, { ...current, pid, adoptedAt: Date.now() });
+    fs.renameSync(tmp, file);
+    return true;
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+}
+
+function releaseUpdateLock(file, token) {
+  const current = readLock(file);
+  if (!current || current.token !== token) return false;
+  try { fs.unlinkSync(file); return true; } catch (_) { return false; }
+}
+
+function readState(file) {
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return {};
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  } catch (_) { return {}; }
+}
+
+function writeState(file, value) {
+  try {
+    const st = fs.lstatSync(file);
+    if (st.isSymbolicLink() || !st.isFile()) throw new Error('update state target non sicuro');
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+  }
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+}
+
+module.exports = {
+  PACKAGE_NAME, VERSION_RE, parseVersion, compareVersions, registryVersion,
+  scrubError, pidAlive, readLock, acquireUpdateLock, adoptUpdateLock, releaseUpdateLock,
+  readState, writeState,
+};