@mmmbuto/nexuscrew 0.8.7 → 0.8.10

package/lib/settings/routes.js

@@ -3,7 +3,7 @@
 //
 // Contratto duro:
 //   - read-only: GET /api/settings (roles, firstRun, port, platform, service,
-//     rendezvous redatto, version).
+//     version).
 //   - mutanti (LISTA CHIUSA §4b(6)), tutti dietro requireToken (montati sotto il
 //     router /api gia' autenticato) + gate READONLY route-level (pattern
 //     lib/fleet/routes.js, 403 esplicito):
@@ -11,7 +11,8 @@
 //       POST   /token/rotate       riusa rotateToken(); token MAI in risposta (§4b(3))
 //       POST   /nodes              nodes add (riusa lib/nodes/commands.js)
 //       DELETE /nodes/:name        nodes remove
-//       POST   /node-role          node on/off (rendezvous config)
+//       PATCH  /nodes/:name/share publish/revoke the local node on its hub
+//       POST   /node-role          retired compatibility endpoint (410)
 //       POST   /service/regenerate rigenera unit service (NO restart automatico)
 //   - NON gate READONLY (lifecycle di PROCESSO, non mutazione di config — decisione
 //     B0 documentata in lib/nodes/commands.js: READONLY blocca le mutazioni di
@@ -27,9 +28,9 @@
 //     403 readonly, 404 nodo, 409 conflitto, 500 con messaggio). Niente stack trace.
 //   - validazione input strict fail-closed: schema chiuso per ogni body, garbage
 //     -> 400 con causa, mai guess.
-//   - NIENTE reimplementazione della logica B0: i mutanti nodes/node-role
-//     incapsulano le funzioni CLI di lib/nodes/commands.js (log catturato per
-//     estrarre esito/authorized_keys); config.json scritto col pattern atomico
+//   - NIENTE reimplementazione della logica B0: i mutanti nodes incapsulano le
+//     funzioni CLI di lib/nodes/commands.js (log catturato per estrarre l'esito);
+//     config.json scritto col pattern atomico
 //     tmp+rename di lib/nodes/store.js.
 //
 // Nota lifecycle: i tunnel avviati da /nodes/:name/up sono spawn DETACHED+unref
@@ -53,12 +54,12 @@ const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js')
 const { isServiceRunning, readRoles, bootState } = require('../cli/commands.js');
 const { configJsonPath } = require('../config.js');
 const VERSION = require('../../package.json').version;
+const { scrubError } = require('../update/core.js');
 
 // Whitelist chiavi scrivibili di config.json via API (lista chiusa dal task B2).
-const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone']);
+const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone', 'autoUpdate']);
 const ROLE_KEYS = new Set(['client', 'node']);
 const ADD_KEYS = new Set(['name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'label']);
-const NODE_ROLE_KEYS = new Set(['enabled', 'rendezvousSsh', 'publishedPort', 'keyPath']);
 
 // Default sensato per il "nome dispositivo" proposto nei form (pairing/invite).
 // NON usa ciecamente hostname: se l'hostname e' vuoto o 'localhost' (tipico di
@@ -141,6 +142,7 @@ function settingsRoutes(deps = {}) {
   // scrive solo il file (come prima), senza reload in-memory.
   const tokenStore = deps.tokenStore || null;
   const closeSessions = deps.closeSessions || null;
+  const updater = deps.updater || null;
   const home = cfg.home || os.homedir();
   const configDir = cfg.configDir || path.join(home, '.nexuscrew');
   // configJsonPath() rispetta NEXUSCREW_CONFIG_FILE (stessa risoluzione di
@@ -153,6 +155,7 @@ function settingsRoutes(deps = {}) {
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
   const platform = seams.platform || detectPlatform();
+  const runtimePort = typeof deps.runtimePort === 'function' ? deps.runtimePort : () => cfg.port;
 
   const r = express.Router();
   r.use(express.json({ limit: '8kb' }));
@@ -174,6 +177,7 @@ function settingsRoutes(deps = {}) {
     spawnImpl: seams.spawnImpl, sshBin: seams.sshBin, logFd: seams.logFd,
     httpProbe: seams.httpProbe, sshVersion: seams.sshVersion,
     spawnSyncImpl: seams.spawnSyncImpl,
+    localAppPort: runtimePort(),
   });
 
   const validName = (name) => typeof name === 'string' && nodesStore.NODE_NAME_RE.test(name);
@@ -191,6 +195,7 @@ function settingsRoutes(deps = {}) {
         active: isServiceRunning({ platform, execImpl: seams.execImpl, uid: seams.uid, home }),
         boot: bootState({ platform, execImpl: seams.execImpl, uid: seams.uid, home }).enabled,
       };
+      const updateStatus = updater && typeof updater.status === 'function' ? updater.status() : null;
       const out = {
         roles: readRoles(configPath),
         firstRun,
@@ -198,17 +203,12 @@ function settingsRoutes(deps = {}) {
         platform,
         service,
         version: VERSION,
+        autoUpdate: updateStatus ? updateStatus.enabled : fileCfg.autoUpdate !== false,
         // Nome dispositivo proposto per i form di pairing (etichetta umana, non
         // lo slug). La UI lo precompila e lascia editing libero.
         deviceName: defaultDeviceName(),
       };
-      // rendezvous via redactStore (view sicura §4b(4)): non contiene token, ma
-      // la si prende comunque SOLO dalla vista redatta.
-      const st = nodesStore.loadStore(nodesPath);
-      if (st) {
-        const view = nodesStore.redactStore(st);
-        if (view.rendezvous) out.rendezvous = view.rendezvous;
-      }
+      if (updateStatus) out.update = updateStatus;
       send(res, 200, out);
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -221,10 +221,10 @@ function settingsRoutes(deps = {}) {
         return send(res, 400, { error: 'body deve essere un oggetto JSON' });
       }
       for (const k of Object.keys(b)) {
-        if (!CONFIG_KEYS.has(k)) return send(res, 400, { error: `chiave non ammessa: "${k}" (whitelist: roles, port, wizardDone)` });
+        if (!CONFIG_KEYS.has(k)) return send(res, 400, { error: `chiave non ammessa: "${k}" (whitelist: roles, port, wizardDone, autoUpdate)` });
       }
       if (Object.keys(b).length === 0) {
-        return send(res, 400, { error: 'nessuna chiave da scrivere (whitelist: roles, port, wizardDone)' });
+        return send(res, 400, { error: 'nessuna chiave da scrivere (whitelist: roles, port, wizardDone, autoUpdate)' });
       }
       if (b.roles !== undefined) {
         if (!b.roles || typeof b.roles !== 'object' || Array.isArray(b.roles)) {
@@ -238,9 +238,22 @@ function settingsRoutes(deps = {}) {
       if (b.port !== undefined && !nodesStore.isPort(b.port)) {
         return send(res, 400, { error: 'port deve essere un intero 1..65535' });
       }
+      if (b.port !== undefined && b.port !== runtimePort()) {
+        const peers = nodesStore.loadStore(nodesPath);
+        if (nodesStore.hasPairedPeers(peers)) {
+          return send(res, 409, {
+            error: 'porta non modificata: esistono nodi già collegati',
+            code: 'paired-port-change-refused',
+            hint: 'libera la porta corrente oppure rimuovi e ricollega intenzionalmente i peer',
+          });
+        }
+      }
       if (b.wizardDone !== undefined && typeof b.wizardDone !== 'boolean') {
         return send(res, 400, { error: 'wizardDone deve essere boolean' });
       }
+      if (b.autoUpdate !== undefined && typeof b.autoUpdate !== 'boolean') {
+        return send(res, 400, { error: 'autoUpdate deve essere boolean' });
+      }
 
       // merge sul config esistente (preserva le chiavi non gestite qui)
       const { cfg: current } = readConfigFile(configPath);
@@ -251,11 +264,15 @@ function settingsRoutes(deps = {}) {
       }
       if (b.port !== undefined) next.port = b.port;
       if (b.wizardDone !== undefined) next.wizardDone = b.wizardDone;
+      if (b.autoUpdate !== undefined) next.autoUpdate = b.autoUpdate;
       atomicWriteConfig(configPath, next);
+      if (b.autoUpdate !== undefined && updater && typeof updater.setEnabled === 'function') {
+        updater.setEnabled(b.autoUpdate);
+      }
 
       const out = {
         saved: true,
-        config: { roles: next.roles, port: next.port, wizardDone: next.wizardDone },
+        config: { roles: next.roles, port: next.port, wizardDone: next.wizardDone, autoUpdate: next.autoUpdate !== false },
       };
       // Il server legge la porta SOLO allo startup: il cambio vale al prossimo
       // restart (contratto dichiarato nella risposta, la UI avvisa).
@@ -266,6 +283,20 @@ function settingsRoutes(deps = {}) {
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
+  // Auto-update npm: check e apply sono autenticati, READONLY-gated e non
+  // accettano mai package/versione dal browser. Il manager usa esclusivamente
+  // @mmmbuto/nexuscrew@latest, confronta semver e installa la versione esatta.
+  r.post('/update/check', mutGate, async (_req, res) => {
+    if (!updater) return send(res, 501, { error: 'auto-update non disponibile' });
+    try { send(res, 200, await updater.check()); }
+    catch (e) { send(res, e.status || 500, { error: scrubError(e), ...(e.code ? { code: e.code } : {}) }); }
+  });
+  r.post('/update/apply', mutGate, async (_req, res) => {
+    if (!updater) return send(res, 501, { error: 'auto-update non disponibile' });
+    try { send(res, 202, await updater.apply()); }
+    catch (e) { send(res, e.status || 500, { error: scrubError(e), ...(e.code ? { code: e.code } : {}) }); }
+  });
+
   // --- POST /token/rotate — atomico + reload live + chiusura WS; token MAI in risposta
   // Contratto §4b(3): "scrittura atomica del token file + chiusura delle sessioni
   // WS/API attive locali + reload credenziali proxy". Audit F7: prima questa route
@@ -281,7 +312,7 @@ function settingsRoutes(deps = {}) {
       if (typeof closeSessions === 'function') closeSessions();
       send(res, 200, {
         rotated: true,
-        note: 'token ruotato: sessioni attive chiuse, vecchio token invalidato (401) — recupera il nuovo con `nexuscrew url`',
+        note: 'token ruotato: sessioni attive chiuse, vecchio token invalidato (401) — recupera il nuovo con `nexuscrew show token`',
       });
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -297,6 +328,7 @@ function settingsRoutes(deps = {}) {
     try {
       const b = req.body || {};
       const label = nodesStore.sanitizeLabel(b.label, defaultDeviceName());
+      const st = nodesStore.loadOrInitStore(nodesPath);
       const extra = {};
       if (typeof b.ssh === 'string' && b.ssh.trim()) {
         const ssh = nodesStore.parseSshTarget(b.ssh.trim());
@@ -308,14 +340,19 @@ function settingsRoutes(deps = {}) {
         extra.sshPort = Number(b.sshPort);
       }
       if (extra.sshPort && !extra.ssh) return send(res, 400, { error: 'sshPort richiede un target SSH' });
+      if (!extra.ssh) return send(res, 400, { error: 'indica l’Host SSH pubblico/alias con cui gli altri dispositivi raggiungono questo hub' });
+      let remotePort = runtimePort();
+      if (b.remotePort !== undefined && b.remotePort !== null && b.remotePort !== '') {
+        if (!nodesStore.isPort(Number(b.remotePort))) return send(res, 400, { error: 'remotePort non valida (1..65535)' });
+        remotePort = Number(b.remotePort);
+      }
       if (typeof b.name === 'string' && b.name.trim()) {
         if (!nodesStore.NODE_NAME_RE.test(b.name.trim())) return send(res, 400, { error: 'name non valido (a-z 0-9 -, max 32)' });
         extra.name = b.name.trim();
       }
       if (extra.ssh && !extra.name) extra.name = nodesStore.toSlug(label);
-      const st = nodesStore.loadOrInitStore(nodesPath);
       send(res, 200, peering.createInvite({
-        invitesPath, instanceId: st.nodeId, port: cfg.port, label, ...extra,
+        invitesPath, instanceId: st.nodeId, port: remotePort, linkPort: runtimePort(), label, ...extra,
       }));
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -352,6 +389,8 @@ function settingsRoutes(deps = {}) {
     const localLabel = nodesStore.sanitizeLabel(b.localLabel, defaultDeviceName());
     const fetchImpl = seams.fetchImpl || fetch;
     const sleep = typeof seams.pairDelay === 'function' ? seams.pairDelay : undefined;
+    const transportProbe = typeof seams.probeTransportReady === 'function'
+      ? seams.probeTransportReady : peering.probeTransportReady;
     const requestTimeoutMs = Number.isInteger(seams.pairRequestTimeoutMs) && seams.pairRequestTimeoutMs > 0
       ? seams.pairRequestTimeoutMs : 6000;
     // Every protocol request must terminate. Readiness and federation health
@@ -365,6 +404,7 @@ function settingsRoutes(deps = {}) {
     };
 
     let provisionalPort = null;
+    let portReservation = null;
     let rollbackCredential = null;
     let created = false;
     let rolledBack = false;
@@ -372,6 +412,10 @@ function settingsRoutes(deps = {}) {
     // credenziale provvisoria sul peer (se emessa) e rimuove nodo+tunnel locali.
     const rollback = async () => {
       if (rolledBack) return; rolledBack = true;
+      if (portReservation) {
+        try { await portReservation.release(); } catch (_) { /* best-effort */ }
+        portReservation = null;
+      }
       if (rollbackCredential && provisionalPort) {
         try {
           await pairFetch(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
@@ -413,7 +457,18 @@ function settingsRoutes(deps = {}) {
           hint: 'usa il nodo esistente oppure rimuovilo prima di rifare il pairing',
         });
       }
-      const localPort = nodesCmds.assignLocalPort(st);
+      let localPort;
+      try {
+        portReservation = await nodesCmds.reserveLocalPort(st, {
+          createServerImpl: seams.createPortServer,
+        });
+        localPort = portReservation.port;
+      } catch (e) {
+        return fail(502, 'ssh-start', 'local-port-unavailable',
+          `nessuna porta locale disponibile per il tunnel: ${String((e && e.message) || e)}`, {
+            retryable: true, hint: 'chiudi il processo che occupa le porte locali e riprova',
+          });
+      }
       provisionalPort = localPort;
       const acceptToken = crypto.randomBytes(32).toString('base64url');
       try {
@@ -426,15 +481,20 @@ function settingsRoutes(deps = {}) {
       } catch (e) {
         const msg = String((e && e.message) || e);
         const isDup = msg.includes('duplicato') || msg.includes('self-reference');
-        return fail(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
+        return failRolledBack(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
       }
       nodesStore.atomicWriteStore(nodesPath, st);
       created = true;
       const node = nodesStore.getNode(st, b.name);
 
       // --- ssh-start: supervisor del tunnel -L provvisorio --------------------
+      // Il bind OS-aware ha protetto la scelta fino a questo punto. SSH deve
+      // prendere la stessa porta, quindi rilasciamo immediatamente prima dello
+      // spawn (eventuali race residue emergono come local-forward-bind).
+      await portReservation.release();
+      portReservation = null;
       const started = nodesTunnel.startForward({
-        home, node, localAppPort: cfg.port,
+        home, node, localAppPort: runtimePort(),
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
@@ -446,13 +506,19 @@ function settingsRoutes(deps = {}) {
       }
 
       // --- ssh-ready: readiness bounded PRIMA di consumare l'invite -----------
-      const ready = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      const ready = await transportProbe({
+        port: localPort, capability: pair.invite, expectedInstanceId: pair.instanceId,
+        fetchImpl, sleep,
+      });
       if (!ready.ready) {
-        return failRolledBack(502, 'ssh-ready', 'transport-not-ready',
-          `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
-            retryable: true,
-            hint: 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
-          });
+        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, b.name, pair.port);
+        return failRolledBack(502, 'ssh-ready', (diagnosis && diagnosis.code) || ready.code || 'transport-not-ready',
+          (diagnosis && diagnosis.detail)
+            || `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
+          retryable: true,
+          hint: (diagnosis && diagnosis.hint)
+            || 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
+        });
       }
 
       // --- join: consuma l'invite one-time (UNA volta, mai replay) ------------
@@ -465,8 +531,12 @@ function settingsRoutes(deps = {}) {
             instanceId: st.nodeId,
             name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
             label: localLabel,
-            port: cfg.port,
+            port: runtimePort(),
             acceptToken,
+            // Pairing establishes a private client-to-hub connection. Sharing
+            // this device back through the hub is a separate explicit action.
+            shared: false,
+            roles: readRoles(configPath),
           }),
         });
       } catch (e) {
@@ -488,8 +558,9 @@ function settingsRoutes(deps = {}) {
           hint: 'rigenera un nuovo link e riprova',
         });
       }
+      const joinedRoles = joined.roles === undefined ? null : nodesStore.parseRoles(joined.roles);
       if (!nodesStore.validToken(joined.credential) || !nodesStore.isPort(joined.reversePort)
-        || !nodesStore.NODE_ID_RE.test(joined.instanceId)) {
+        || !nodesStore.NODE_ID_RE.test(joined.instanceId) || (joined.roles !== undefined && !joinedRoles)) {
         return failRolledBack(502, 'join', 'join-invalid-response', 'risposta di join non valida dal peer', {
           hint: 'versioni NexusCrew incompatibili? aggiorna entrambi i nodi',
         });
@@ -502,25 +573,36 @@ function settingsRoutes(deps = {}) {
           });
       }
 
-      // --- tunnel-final: riavvio con la spec negoziata (-R inclusa) -----------
+      // --- tunnel-final: connessione privata, solo -L -------------------------
+      // reversePort resta negoziata per un futuro Share opt-in, ma il builder
+      // non emette -R finche' shared non diventa true.
       st = nodesStore.loadOrInitStore(nodesPath);
       st = nodesStore.updateNode(st, b.name, {
         token: joined.credential, nodeId: joined.instanceId, reversePort: joined.reversePort,
+        shared: false,
+        ...(joinedRoles ? { roles: joinedRoles, rolesKnown: true } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);
       nodesTunnel.stopTunnel({ home, name: b.name });
       const finalStart = nodesTunnel.startForward({
-        home, node: nodesStore.getNode(st, b.name), localAppPort: cfg.port,
+        home, node: nodesStore.getNode(st, b.name), localAppPort: runtimePort(),
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
       if (!finalStart.started && finalStart.reason !== 'already running') {
         return failRolledBack(502, 'tunnel-final', 'tunnel-restart-failed', finalStart.reason || 'riavvio del tunnel negoziato fallito', {});
       }
-      const readyFinal = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      const readyFinal = await transportProbe({
+        port: localPort, capability: joined.credential, expectedInstanceId: joined.instanceId,
+        fetchImpl, sleep,
+      });
       if (!readyFinal.ready) {
-        return failRolledBack(502, 'tunnel-final', 'transport-not-ready',
-          `il tunnel negoziato non risponde (${readyFinal.attempts} tentativi)`, {});
+        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, b.name, pair.port);
+        return failRolledBack(502, 'tunnel-final', (diagnosis && diagnosis.code) || readyFinal.code || 'transport-not-ready',
+          (diagnosis && diagnosis.detail)
+            || `il tunnel negoziato non risponde o non corrisponde al peer atteso (${readyFinal.attempts} tentativi)`, {
+            hint: (diagnosis && diagnosis.hint) || 'verifica il target SSH e riprova con un nuovo link',
+          });
       }
 
       // --- confirm: idempotente lato peer -> bounded retry ---------------------
@@ -654,7 +736,10 @@ function settingsRoutes(deps = {}) {
       const out = await nodesCmds.nodesTest({ ...cliOpts(cap), name });
       if (out.result === 'unknown-node') return send(res, 404, { error: `nodo sconosciuto "${name}"` });
       // result distingue: ok | tunnel-down | health-ko | token-missing | token-ko
-      send(res, 200, { ok: out.result === 'ok', result: out.result, detail: lastLine(cap, '') });
+      send(res, 200, {
+        ok: out.result === 'ok', result: out.result, detail: lastLine(cap, ''),
+        ...(out.diagnostic ? { diagnostic: out.diagnostic } : {}),
+      });
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
@@ -673,21 +758,103 @@ function settingsRoutes(deps = {}) {
         const fn = action === 'up' ? nodesCmds.nodesUp
           : action === 'down' ? nodesCmds.nodesDown
             : nodesCmds.nodesRestart;
-        const out = fn({ ...cliOpts(cap), name });
+        const out = fn({ ...cliOpts(cap), name, persistAutostart: action === 'up' || action === 'down' });
         if (out.code !== 0) {
           const msg = lastLine(cap, `nodes ${action} fallito`);
           const status = /sconosciuto/.test(msg) ? 404 : 500;
-          return send(res, status, { error: msg });
+          return send(res, status, { error: msg, ...(out.diagnostic ? { diagnostic: out.diagnostic } : {}) });
         }
-        if (action === 'up') return send(res, 200, { name, started: out.started, pid: out.pid });
+        if (action === 'up') return send(res, 200, { name, started: out.started, pid: out.pid, diagnostic: out.diagnostic });
         if (action === 'down') return send(res, 200, { name, stopped: out.stopped });
-        return send(res, 200, { name, restarted: true, pid: out.pid });
+        return send(res, 200, { name, restarted: true, pid: out.pid, diagnostic: out.diagnostic });
       } catch (e) { send(res, 500, { error: String(e.message || e) }); }
     };
   }
   r.post('/nodes/:name/up', mutGate, lifecycleHandler('up'));
   r.post('/nodes/:name/down', mutGate, lifecycleHandler('down'));
   r.post('/nodes/:name/restart', mutGate, lifecycleHandler('restart'));
+
+  // Share is the only publication control exposed to the user. The normal
+  // paired connection is -L only; enabling Share restarts the same supervised
+  // SSH session with its negotiated -R and asks the hub to advertise it only
+  // after the reverse channel passes an authenticated health probe.
+  r.patch('/nodes/:name/share', mutGate, async (req, res) => {
+    const name = String(req.params.name || '');
+    const body = req.body || {};
+    if (!validName(name)) return send(res, 400, { error: 'name non valido (^[a-z0-9-]{1,32}$)' });
+    if (Object.keys(body).some((k) => k !== 'shared') || typeof body.shared !== 'boolean') {
+      return send(res, 400, { error: 'body non valido: atteso {shared:boolean}' });
+    }
+    let st = nodesStore.loadStore(nodesPath);
+    let node = st && nodesStore.getNode(st, name);
+    if (!node) return send(res, 404, { error: `nodo sconosciuto "${name}"` });
+    if (node.direction !== 'outbound') return send(res, 409, { error: 'Share si attiva sul dispositivo che possiede la connessione SSH' });
+    if (!node.token || !node.nodeId) return send(res, 409, { error: 'nodo non associato: ripeti il pairing' });
+    if (body.shared && !nodesStore.isPort(node.reversePort)) {
+      return send(res, 409, { error: 'canale share non negoziato: ripeti il pairing' });
+    }
+    if (node.shared === body.shared) return send(res, 200, { name, shared: body.shared, unchanged: true });
+
+    const fetchImpl = seams.fetchImpl || fetch;
+    const notifyHub = async (shared) => {
+      const ctrl = new AbortController();
+      const timer = setTimeout(() => ctrl.abort(), 5000);
+      try {
+        const response = await fetchImpl(`http://127.0.0.1:${node.localPort}/federation/share`, {
+          method: 'POST', signal: ctrl.signal,
+          headers: { authorization: `Bearer ${node.token}`, 'content-type': 'application/json' },
+          body: JSON.stringify({ shared }),
+        });
+        if (!response.ok) throw new Error(`hub HTTP ${response.status}`);
+      } finally { clearTimeout(timer); }
+    };
+    const applyLocal = async (shared) => {
+      st = nodesStore.loadOrInitStore(nodesPath);
+      st = nodesStore.updateNode(st, name, { shared });
+      nodesStore.atomicWriteStore(nodesPath, st);
+      node = nodesStore.getNode(st, name);
+      nodesTunnel.stopTunnel({ home, name });
+      const started = nodesTunnel.startForward({
+        home, node, localAppPort: runtimePort(),
+        spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
+        sshBin: seams.sshBin, logFd: seams.logFd,
+      });
+      if (!started.started && started.reason !== 'already running') {
+        throw new Error(started.reason || 'avvio SSH fallito');
+      }
+      const ready = await probeHealth({
+        port: node.localPort, token: node.token, expectedInstanceId: node.nodeId,
+        fetchImpl,
+      });
+      if (!ready || ready.status !== 'healthy') {
+        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, name, node.remotePort);
+        throw new Error((diagnosis && diagnosis.detail) || (ready && ready.detail) || 'hub non raggiungibile dopo il riavvio SSH');
+      }
+    };
+
+    try {
+      if (body.shared) {
+        await applyLocal(true);
+        await notifyHub(true);
+      } else {
+        // Revoke at the hub while -R is still alive, then remove -R locally.
+        await notifyHub(false);
+        await applyLocal(false);
+      }
+      return send(res, 200, { name, shared: body.shared });
+    } catch (e) {
+      // Share-on is transactional: a failed hub acknowledgement returns to the
+      // safe private -L-only state. Never include remote response bodies/tokens.
+      if (body.shared) {
+        try { await applyLocal(false); } catch (_) { /* best-effort safe rollback */ }
+      }
+      return send(res, 502, {
+        error: body.shared ? 'Share non attivato' : 'Share non disattivato',
+        detail: String(e && e.message || e).replace(/Bearer\s+\S+/gi, 'Bearer ***'),
+      });
+    }
+  });
+
   r.patch('/nodes/:name/visibility', mutGate, (req, res) => {
     try {
       const name = String(req.params.name || '');
@@ -717,53 +884,13 @@ function settingsRoutes(deps = {}) {
     } catch (e) { send(res, 400, { error: String(e.message || e) }); }
   });
 
-  // --- POST /node-role — node on/off (rendezvous config) ---------------------
-  r.post('/node-role', mutGate, (req, res) => {
-    try {
-      const b = req.body;
-      if (!b || typeof b !== 'object' || Array.isArray(b)) {
-        return send(res, 400, { error: 'body deve essere un oggetto JSON' });
-      }
-      for (const k of Object.keys(b)) {
-        if (!NODE_ROLE_KEYS.has(k)) return send(res, 400, { error: `chiave non ammessa: "${k}" (schema: enabled, rendezvousSsh?, publishedPort?, keyPath?)` });
-      }
-      if (typeof b.enabled !== 'boolean') return send(res, 400, { error: 'enabled deve essere boolean' });
-      if (b.rendezvousSsh !== undefined && !nodesStore.parseSsh(b.rendezvousSsh)) {
-        return send(res, 400, { error: 'rendezvousSsh non valido (atteso user@host strict)' });
-      }
-      if (b.publishedPort !== undefined && !nodesStore.isPort(b.publishedPort)) {
-        return send(res, 400, { error: 'publishedPort deve essere un intero 1..65535' });
-      }
-      if (b.keyPath !== undefined && !nodesStore.isAbsPath(b.keyPath)) {
-        return send(res, 400, { error: 'keyPath deve essere un path assoluto' });
-      }
-
-      const cap = capture();
-      if (b.enabled === false) {
-        const out = nodesCmds.nodeOff({ ...cliOpts(cap) });
-        if (out.code === 0) return send(res, 200, { enabled: false, roles: out.roles });
-        return send(res, 500, { error: lastLine(cap, 'node off fallito') });
-      }
-      const out = nodesCmds.nodeOn({
-        ...cliOpts(cap),
-        rendezvousSsh: b.rendezvousSsh,
-        publishedPort: b.publishedPort,
-        key: b.keyPath,
-        port: cfg.port, // porta nexus locale da esporre = quella del server attivo
-      });
-      if (out.code === 0) {
-        const resp = { enabled: true, roles: out.roles, tunnel: out.tunnel || null };
-        const line = authorizedKeysLine(cap);
-        if (line) resp.authorizedKeys = line; // pubkey con permitlisten: non un segreto
-        return send(res, 200, resp);
-      }
-      const msg = lastLine(cap, 'node on fallito');
-      if (out.reason === 'readonly') return send(res, 403, { error: msg });
-      if (out.reason === 'no rendezvous') return send(res, 400, { error: msg });
-      if (out.reason === 'permitlisten') return send(res, 409, { error: msg });
-      send(res, 500, { error: msg });
-    } catch (e) { send(res, 500, { error: String(e.message || e) }); }
-  });
+  // Legacy compatibility endpoint: the old node-role/rendezvous flow opened a
+  // second SSH process and is intentionally retired. Existing data is kept for
+  // migration, but all new publication goes through pairing + Share on the
+  // already-connected hub.
+  r.post('/node-role', mutGate, (_req, res) => send(res, 410, {
+    error: 'node-role/rendezvous ritirato: collega un hub e usa “Condividi questo nodo”',
+  }));
 
   // --- POST /service/regenerate — rigenera l'unit service --------------------
   // Riusa generateService/installService (lib/cli/service.js: escaping per-platform,
@@ -818,21 +945,45 @@ function settingsRoutes(deps = {}) {
 function publicPeeringRoutes(deps = {}) {
   const cfg = deps.cfg || {};
   const home = cfg.home || os.homedir();
+  const configPath = cfg.configPath || configJsonPath();
   const nodesPath = deps.nodesPath || cfg.nodesPath || nodesStore.defaultNodesPath(home);
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
   const r = express.Router();
   const attempts = new Map();
   r.use(express.json({ limit: '8kb' }));
+  // Identity proof non consuma la capability e non riceve mai invite/token in
+  // chiaro. Serve a impedire che un qualunque listener HTTP sulla porta -L
+  // venga scambiato per il nodo contenuto nel link.
+  r.post('/identity', (req, res) => {
+    const key = `identity:${String(req.socket && req.socket.remoteAddress || 'local')}`;
+    const now = Date.now();
+    const recent = (attempts.get(key) || []).filter((x) => now - x < 60_000);
+    recent.push(now); attempts.set(key, recent);
+    if (recent.length > 30) return res.status(429).json({ error: 'troppi tentativi' });
+    const b = req.body || {};
+    const proof = peering.capabilityIdentity({
+      invitesPath, pendingPath, capabilityId: b.capabilityId, challenge: b.challenge, now,
+    });
+    if (!proof) return res.status(404).json({ error: 'capability non valida' });
+    const st = nodesStore.loadStore(nodesPath);
+    if (!st || !nodesStore.NODE_ID_RE.test(st.nodeId)) return res.status(503).json({ error: 'identita nodo non disponibile' });
+    return res.json({ ok: true, instanceId: st.nodeId, proof });
+  });
   r.post('/join', (req, res) => {
-    const key = String(req.socket && req.socket.remoteAddress || 'local');
+    const key = `join:${String(req.socket && req.socket.remoteAddress || 'local')}`;
     const now = Date.now();
     const recent = (attempts.get(key) || []).filter((x) => now - x < 60_000);
     recent.push(now); attempts.set(key, recent);
     if (recent.length > 10) return res.status(429).json({ error: 'troppi tentativi di pairing' });
     const b = req.body || {};
+    const peerRoles = b.roles === undefined ? null : nodesStore.parseRoles(b.roles);
     if (!nodesStore.validToken(b.invite) || !nodesStore.NODE_ID_RE.test(b.instanceId)
-      || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)) {
+      || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)
+      || (b.roles !== undefined && !peerRoles)
+      // Pairing is always private. Publishing is a separate authenticated
+      // action after the reverse channel is live and health-checked.
+      || (b.shared !== undefined && b.shared !== false)) {
       return res.status(400).json({ error: 'pairing request non valida' });
     }
     if (b.label !== undefined && !nodesStore.validLabel(b.label)) {
@@ -847,9 +998,11 @@ function publicPeeringRoutes(deps = {}) {
       const reversePort = peering.allocateReversePort(st.nodes);
       const credential = peering.createPending({ pendingPath, data: {
         name, remotePort: b.port, reversePort, instanceId: b.instanceId, acceptToken: b.acceptToken,
+        shared: false,
         label: nodesStore.sanitizeLabel(b.label, name),
+        ...(peerRoles ? { roles: { ...peerRoles, node: false }, rolesKnown: true } : { rolesKnown: false }),
       } });
-      res.json({ paired: true, instanceId: st.nodeId, reversePort, credential });
+      res.json({ paired: true, instanceId: st.nodeId, reversePort, credential, roles: readRoles(configPath) });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   r.post('/confirm', (req, res) => {
@@ -867,8 +1020,10 @@ function publicPeeringRoutes(deps = {}) {
       st = nodesStore.addNode(st, {
         name: pending.name, remotePort: pending.remotePort, localPort: pending.reversePort,
         direction: 'inbound', transport: 'inbound', autostart: true,
-        visibility: 'network', nodeId: pending.instanceId,
+        visibility: 'network', shared: pending.shared === true, nodeId: pending.instanceId,
         token: pending.acceptToken, acceptToken: b.credential,
+        ...(pending.roles ? { roles: pending.roles } : {}),
+        rolesKnown: pending.rolesKnown === true,
         ...(pending.label ? { label: pending.label } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);