@mmmbuto/nexuscrew 0.8.9 → 0.8.11

package/lib/settings/routes.js

@@ -3,7 +3,7 @@
 //
 // Contratto duro:
 //   - read-only: GET /api/settings (roles, firstRun, port, platform, service,
-//     rendezvous redatto, version).
+//     version).
 //   - mutanti (LISTA CHIUSA §4b(6)), tutti dietro requireToken (montati sotto il
 //     router /api gia' autenticato) + gate READONLY route-level (pattern
 //     lib/fleet/routes.js, 403 esplicito):
@@ -11,7 +11,8 @@
 //       POST   /token/rotate       riusa rotateToken(); token MAI in risposta (§4b(3))
 //       POST   /nodes              nodes add (riusa lib/nodes/commands.js)
 //       DELETE /nodes/:name        nodes remove
-//       POST   /node-role          node on/off (rendezvous config)
+//       PATCH  /nodes/:name/share publish/revoke the local node on its hub
+//       POST   /node-role          retired compatibility endpoint (410)
 //       POST   /service/regenerate rigenera unit service (NO restart automatico)
 //   - NON gate READONLY (lifecycle di PROCESSO, non mutazione di config — decisione
 //     B0 documentata in lib/nodes/commands.js: READONLY blocca le mutazioni di
@@ -27,9 +28,9 @@
 //     403 readonly, 404 nodo, 409 conflitto, 500 con messaggio). Niente stack trace.
 //   - validazione input strict fail-closed: schema chiuso per ogni body, garbage
 //     -> 400 con causa, mai guess.
-//   - NIENTE reimplementazione della logica B0: i mutanti nodes/node-role
-//     incapsulano le funzioni CLI di lib/nodes/commands.js (log catturato per
-//     estrarre esito/authorized_keys); config.json scritto col pattern atomico
+//   - NIENTE reimplementazione della logica B0: i mutanti nodes incapsulano le
+//     funzioni CLI di lib/nodes/commands.js (log catturato per estrarre l'esito);
+//     config.json scritto col pattern atomico
 //     tmp+rename di lib/nodes/store.js.
 //
 // Nota lifecycle: i tunnel avviati da /nodes/:name/up sono spawn DETACHED+unref
@@ -59,7 +60,6 @@ const { scrubError } = require('../update/core.js');
 const CONFIG_KEYS = new Set(['roles', 'port', 'wizardDone', 'autoUpdate']);
 const ROLE_KEYS = new Set(['client', 'node']);
 const ADD_KEYS = new Set(['name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'label']);
-const NODE_ROLE_KEYS = new Set(['enabled', 'rendezvousSsh', 'publishedPort', 'keyPath']);
 
 // Default sensato per il "nome dispositivo" proposto nei form (pairing/invite).
 // NON usa ciecamente hostname: se l'hostname e' vuoto o 'localhost' (tipico di
@@ -155,6 +155,7 @@ function settingsRoutes(deps = {}) {
   const invitesPath = cfg.invitesPath || peering.defaultInvitesPath(home);
   const pendingPath = cfg.pendingPairingsPath || peering.defaultPendingPath(home);
   const platform = seams.platform || detectPlatform();
+  const runtimePort = typeof deps.runtimePort === 'function' ? deps.runtimePort : () => cfg.port;
 
   const r = express.Router();
   r.use(express.json({ limit: '8kb' }));
@@ -176,6 +177,7 @@ function settingsRoutes(deps = {}) {
     spawnImpl: seams.spawnImpl, sshBin: seams.sshBin, logFd: seams.logFd,
     httpProbe: seams.httpProbe, sshVersion: seams.sshVersion,
     spawnSyncImpl: seams.spawnSyncImpl,
+    localAppPort: runtimePort(),
   });
 
   const validName = (name) => typeof name === 'string' && nodesStore.NODE_NAME_RE.test(name);
@@ -207,13 +209,6 @@ function settingsRoutes(deps = {}) {
         deviceName: defaultDeviceName(),
       };
       if (updateStatus) out.update = updateStatus;
-      // rendezvous via redactStore (view sicura §4b(4)): non contiene token, ma
-      // la si prende comunque SOLO dalla vista redatta.
-      const st = nodesStore.loadStore(nodesPath);
-      if (st) {
-        const view = nodesStore.redactStore(st);
-        if (view.rendezvous) out.rendezvous = view.rendezvous;
-      }
       send(res, 200, out);
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -243,6 +238,16 @@ function settingsRoutes(deps = {}) {
       if (b.port !== undefined && !nodesStore.isPort(b.port)) {
         return send(res, 400, { error: 'port deve essere un intero 1..65535' });
       }
+      if (b.port !== undefined && b.port !== runtimePort()) {
+        const peers = nodesStore.loadStore(nodesPath);
+        if (nodesStore.hasPairedPeers(peers)) {
+          return send(res, 409, {
+            error: 'porta non modificata: esistono nodi già collegati',
+            code: 'paired-port-change-refused',
+            hint: 'libera la porta corrente oppure rimuovi e ricollega intenzionalmente i peer',
+          });
+        }
+      }
       if (b.wizardDone !== undefined && typeof b.wizardDone !== 'boolean') {
         return send(res, 400, { error: 'wizardDone deve essere boolean' });
       }
@@ -307,7 +312,7 @@ function settingsRoutes(deps = {}) {
       if (typeof closeSessions === 'function') closeSessions();
       send(res, 200, {
         rotated: true,
-        note: 'token ruotato: sessioni attive chiuse, vecchio token invalidato (401) — recupera il nuovo con `nexuscrew url`',
+        note: 'token ruotato: sessioni attive chiuse, vecchio token invalidato (401) — recupera il nuovo con `nexuscrew show token`',
       });
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -324,29 +329,22 @@ function settingsRoutes(deps = {}) {
       const b = req.body || {};
       const label = nodesStore.sanitizeLabel(b.label, defaultDeviceName());
       const st = nodesStore.loadOrInitStore(nodesPath);
-      const rendezvous = st.rendezvous || null;
       const extra = {};
       if (typeof b.ssh === 'string' && b.ssh.trim()) {
         const ssh = nodesStore.parseSshTarget(b.ssh.trim());
         if (!ssh) return send(res, 400, { error: 'ssh non valido (atteso user@host o alias)' });
         extra.ssh = ssh.value;
-      } else if (rendezvous && rendezvous.ssh) {
-        // Zero-field creator path: the rendezvous SSH target is reachable by
-        // definition. Its publishedPort is the REMOTE NEXUSCREW HTTP port,
-        // never the OpenSSH transport port.
-        extra.ssh = rendezvous.ssh;
       }
       if (b.sshPort !== undefined && b.sshPort !== null && b.sshPort !== '') {
         if (!nodesStore.isPort(Number(b.sshPort))) return send(res, 400, { error: 'sshPort non valida (1..65535)' });
         extra.sshPort = Number(b.sshPort);
       }
       if (extra.sshPort && !extra.ssh) return send(res, 400, { error: 'sshPort richiede un target SSH' });
-      let remotePort = cfg.port;
+      if (!extra.ssh) return send(res, 400, { error: 'indica l’Host SSH pubblico/alias con cui gli altri dispositivi raggiungono questo hub' });
+      let remotePort = runtimePort();
       if (b.remotePort !== undefined && b.remotePort !== null && b.remotePort !== '') {
         if (!nodesStore.isPort(Number(b.remotePort))) return send(res, 400, { error: 'remotePort non valida (1..65535)' });
         remotePort = Number(b.remotePort);
-      } else if (rendezvous && extra.ssh === rendezvous.ssh) {
-        remotePort = rendezvous.publishedPort;
       }
       if (typeof b.name === 'string' && b.name.trim()) {
         if (!nodesStore.NODE_NAME_RE.test(b.name.trim())) return send(res, 400, { error: 'name non valido (a-z 0-9 -, max 32)' });
@@ -354,7 +352,7 @@ function settingsRoutes(deps = {}) {
       }
       if (extra.ssh && !extra.name) extra.name = nodesStore.toSlug(label);
       send(res, 200, peering.createInvite({
-        invitesPath, instanceId: st.nodeId, port: remotePort, linkPort: cfg.port, label, ...extra,
+        invitesPath, instanceId: st.nodeId, port: remotePort, linkPort: runtimePort(), label, ...extra,
       }));
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
@@ -391,6 +389,8 @@ function settingsRoutes(deps = {}) {
     const localLabel = nodesStore.sanitizeLabel(b.localLabel, defaultDeviceName());
     const fetchImpl = seams.fetchImpl || fetch;
     const sleep = typeof seams.pairDelay === 'function' ? seams.pairDelay : undefined;
+    const transportProbe = typeof seams.probeTransportReady === 'function'
+      ? seams.probeTransportReady : peering.probeTransportReady;
     const requestTimeoutMs = Number.isInteger(seams.pairRequestTimeoutMs) && seams.pairRequestTimeoutMs > 0
       ? seams.pairRequestTimeoutMs : 6000;
     // Every protocol request must terminate. Readiness and federation health
@@ -404,6 +404,7 @@ function settingsRoutes(deps = {}) {
     };
 
     let provisionalPort = null;
+    let portReservation = null;
     let rollbackCredential = null;
     let created = false;
     let rolledBack = false;
@@ -411,6 +412,10 @@ function settingsRoutes(deps = {}) {
     // credenziale provvisoria sul peer (se emessa) e rimuove nodo+tunnel locali.
     const rollback = async () => {
       if (rolledBack) return; rolledBack = true;
+      if (portReservation) {
+        try { await portReservation.release(); } catch (_) { /* best-effort */ }
+        portReservation = null;
+      }
       if (rollbackCredential && provisionalPort) {
         try {
           await pairFetch(`http://127.0.0.1:${provisionalPort}/pair/cancel`, {
@@ -452,7 +457,18 @@ function settingsRoutes(deps = {}) {
           hint: 'usa il nodo esistente oppure rimuovilo prima di rifare il pairing',
         });
       }
-      const localPort = nodesCmds.assignLocalPort(st);
+      let localPort;
+      try {
+        portReservation = await nodesCmds.reserveLocalPort(st, {
+          createServerImpl: seams.createPortServer,
+        });
+        localPort = portReservation.port;
+      } catch (e) {
+        return fail(502, 'ssh-start', 'local-port-unavailable',
+          `nessuna porta locale disponibile per il tunnel: ${String((e && e.message) || e)}`, {
+            retryable: true, hint: 'chiudi il processo che occupa le porte locali e riprova',
+          });
+      }
       provisionalPort = localPort;
       const acceptToken = crypto.randomBytes(32).toString('base64url');
       try {
@@ -465,15 +481,20 @@ function settingsRoutes(deps = {}) {
       } catch (e) {
         const msg = String((e && e.message) || e);
         const isDup = msg.includes('duplicato') || msg.includes('self-reference');
-        return fail(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
+        return failRolledBack(isDup ? 409 : 400, isDup ? 'conflict' : 'validation', 'node-rejected', msg, { retryable: !isDup });
       }
       nodesStore.atomicWriteStore(nodesPath, st);
       created = true;
       const node = nodesStore.getNode(st, b.name);
 
       // --- ssh-start: supervisor del tunnel -L provvisorio --------------------
+      // Il bind OS-aware ha protetto la scelta fino a questo punto. SSH deve
+      // prendere la stessa porta, quindi rilasciamo immediatamente prima dello
+      // spawn (eventuali race residue emergono come local-forward-bind).
+      await portReservation.release();
+      portReservation = null;
       const started = nodesTunnel.startForward({
-        home, node, localAppPort: cfg.port,
+        home, node, localAppPort: runtimePort(),
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
@@ -485,13 +506,19 @@ function settingsRoutes(deps = {}) {
       }
 
       // --- ssh-ready: readiness bounded PRIMA di consumare l'invite -----------
-      const ready = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      const ready = await transportProbe({
+        port: localPort, capability: pair.invite, expectedInstanceId: pair.instanceId,
+        fetchImpl, sleep,
+      });
       if (!ready.ready) {
-        return failRolledBack(502, 'ssh-ready', 'transport-not-ready',
-          `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
-            retryable: true,
-            hint: 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
-          });
+        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, b.name, pair.port);
+        return failRolledBack(502, 'ssh-ready', (diagnosis && diagnosis.code) || ready.code || 'transport-not-ready',
+          (diagnosis && diagnosis.detail)
+            || `il peer non risponde attraverso il tunnel SSH (${ready.attempts} tentativi${ready.lastError ? `: ${ready.lastError}` : ''})`, {
+          retryable: true,
+          hint: (diagnosis && diagnosis.hint)
+            || 'controlla target SSH, porta e chiavi; il link NON e\' stato consumato, puoi riprovare',
+        });
       }
 
       // --- join: consuma l'invite one-time (UNA volta, mai replay) ------------
@@ -504,8 +531,11 @@ function settingsRoutes(deps = {}) {
             instanceId: st.nodeId,
             name: String(b.localName || os.hostname()).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '').slice(0, 32) || 'node',
             label: localLabel,
-            port: cfg.port,
+            port: runtimePort(),
             acceptToken,
+            // Pairing establishes a private client-to-hub connection. Sharing
+            // this device back through the hub is a separate explicit action.
+            shared: false,
             roles: readRoles(configPath),
           }),
         });
@@ -543,26 +573,36 @@ function settingsRoutes(deps = {}) {
           });
       }
 
-      // --- tunnel-final: riavvio con la spec negoziata (-R inclusa) -----------
+      // --- tunnel-final: connessione privata, solo -L -------------------------
+      // reversePort resta negoziata per un futuro Share opt-in, ma il builder
+      // non emette -R finche' shared non diventa true.
       st = nodesStore.loadOrInitStore(nodesPath);
       st = nodesStore.updateNode(st, b.name, {
         token: joined.credential, nodeId: joined.instanceId, reversePort: joined.reversePort,
+        shared: false,
         ...(joinedRoles ? { roles: joinedRoles, rolesKnown: true } : {}),
       });
       nodesStore.atomicWriteStore(nodesPath, st);
       nodesTunnel.stopTunnel({ home, name: b.name });
       const finalStart = nodesTunnel.startForward({
-        home, node: nodesStore.getNode(st, b.name), localAppPort: cfg.port,
+        home, node: nodesStore.getNode(st, b.name), localAppPort: runtimePort(),
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
       });
       if (!finalStart.started && finalStart.reason !== 'already running') {
         return failRolledBack(502, 'tunnel-final', 'tunnel-restart-failed', finalStart.reason || 'riavvio del tunnel negoziato fallito', {});
       }
-      const readyFinal = await peering.probeTransportReady({ port: localPort, fetchImpl, sleep });
+      const readyFinal = await transportProbe({
+        port: localPort, capability: joined.credential, expectedInstanceId: joined.instanceId,
+        fetchImpl, sleep,
+      });
       if (!readyFinal.ready) {
-        return failRolledBack(502, 'tunnel-final', 'transport-not-ready',
-          `il tunnel negoziato non risponde (${readyFinal.attempts} tentativi)`, {});
+        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, b.name, pair.port);
+        return failRolledBack(502, 'tunnel-final', (diagnosis && diagnosis.code) || readyFinal.code || 'transport-not-ready',
+          (diagnosis && diagnosis.detail)
+            || `il tunnel negoziato non risponde o non corrisponde al peer atteso (${readyFinal.attempts} tentativi)`, {
+            hint: (diagnosis && diagnosis.hint) || 'verifica il target SSH e riprova con un nuovo link',
+          });
       }
 
       // --- confirm: idempotente lato peer -> bounded retry ---------------------
@@ -696,7 +736,10 @@ function settingsRoutes(deps = {}) {
       const out = await nodesCmds.nodesTest({ ...cliOpts(cap), name });
       if (out.result === 'unknown-node') return send(res, 404, { error: `nodo sconosciuto "${name}"` });
       // result distingue: ok | tunnel-down | health-ko | token-missing | token-ko
-      send(res, 200, { ok: out.result === 'ok', result: out.result, detail: lastLine(cap, '') });
+      send(res, 200, {
+        ok: out.result === 'ok', result: out.result, detail: lastLine(cap, ''),
+        ...(out.diagnostic ? { diagnostic: out.diagnostic } : {}),
+      });
     } catch (e) { send(res, 500, { error: String(e.message || e) }); }
   });
 
@@ -715,21 +758,103 @@ function settingsRoutes(deps = {}) {
         const fn = action === 'up' ? nodesCmds.nodesUp
           : action === 'down' ? nodesCmds.nodesDown
             : nodesCmds.nodesRestart;
-        const out = fn({ ...cliOpts(cap), name });
+        const out = fn({ ...cliOpts(cap), name, persistAutostart: action === 'up' || action === 'down' });
         if (out.code !== 0) {
           const msg = lastLine(cap, `nodes ${action} fallito`);
           const status = /sconosciuto/.test(msg) ? 404 : 500;
-          return send(res, status, { error: msg });
+          return send(res, status, { error: msg, ...(out.diagnostic ? { diagnostic: out.diagnostic } : {}) });
         }
-        if (action === 'up') return send(res, 200, { name, started: out.started, pid: out.pid });
+        if (action === 'up') return send(res, 200, { name, started: out.started, pid: out.pid, diagnostic: out.diagnostic });
         if (action === 'down') return send(res, 200, { name, stopped: out.stopped });
-        return send(res, 200, { name, restarted: true, pid: out.pid });
+        return send(res, 200, { name, restarted: true, pid: out.pid, diagnostic: out.diagnostic });
       } catch (e) { send(res, 500, { error: String(e.message || e) }); }
     };
   }
   r.post('/nodes/:name/up', mutGate, lifecycleHandler('up'));
   r.post('/nodes/:name/down', mutGate, lifecycleHandler('down'));
   r.post('/nodes/:name/restart', mutGate, lifecycleHandler('restart'));
+
+  // Share is the only publication control exposed to the user. The normal
+  // paired connection is -L only; enabling Share restarts the same supervised
+  // SSH session with its negotiated -R and asks the hub to advertise it only
+  // after the reverse channel passes an authenticated health probe.
+  r.patch('/nodes/:name/share', mutGate, async (req, res) => {
+    const name = String(req.params.name || '');
+    const body = req.body || {};
+    if (!validName(name)) return send(res, 400, { error: 'name non valido (^[a-z0-9-]{1,32}$)' });
+    if (Object.keys(body).some((k) => k !== 'shared') || typeof body.shared !== 'boolean') {
+      return send(res, 400, { error: 'body non valido: atteso {shared:boolean}' });
+    }
+    let st = nodesStore.loadStore(nodesPath);
+    let node = st && nodesStore.getNode(st, name);
+    if (!node) return send(res, 404, { error: `nodo sconosciuto "${name}"` });
+    if (node.direction !== 'outbound') return send(res, 409, { error: 'Share si attiva sul dispositivo che possiede la connessione SSH' });
+    if (!node.token || !node.nodeId) return send(res, 409, { error: 'nodo non associato: ripeti il pairing' });
+    if (body.shared && !nodesStore.isPort(node.reversePort)) {
+      return send(res, 409, { error: 'canale share non negoziato: ripeti il pairing' });
+    }
+    if (node.shared === body.shared) return send(res, 200, { name, shared: body.shared, unchanged: true });
+
+    const fetchImpl = seams.fetchImpl || fetch;
+    const notifyHub = async (shared) => {
+      const ctrl = new AbortController();
+      const timer = setTimeout(() => ctrl.abort(), 5000);
+      try {
+        const response = await fetchImpl(`http://127.0.0.1:${node.localPort}/federation/share`, {
+          method: 'POST', signal: ctrl.signal,
+          headers: { authorization: `Bearer ${node.token}`, 'content-type': 'application/json' },
+          body: JSON.stringify({ shared }),
+        });
+        if (!response.ok) throw new Error(`hub HTTP ${response.status}`);
+      } finally { clearTimeout(timer); }
+    };
+    const applyLocal = async (shared) => {
+      st = nodesStore.loadOrInitStore(nodesPath);
+      st = nodesStore.updateNode(st, name, { shared });
+      nodesStore.atomicWriteStore(nodesPath, st);
+      node = nodesStore.getNode(st, name);
+      nodesTunnel.stopTunnel({ home, name });
+      const started = nodesTunnel.startForward({
+        home, node, localAppPort: runtimePort(),
+        spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
+        sshBin: seams.sshBin, logFd: seams.logFd,
+      });
+      if (!started.started && started.reason !== 'already running') {
+        throw new Error(started.reason || 'avvio SSH fallito');
+      }
+      const ready = await probeHealth({
+        port: node.localPort, token: node.token, expectedInstanceId: node.nodeId,
+        fetchImpl,
+      });
+      if (!ready || ready.status !== 'healthy') {
+        const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, name, node.remotePort);
+        throw new Error((diagnosis && diagnosis.detail) || (ready && ready.detail) || 'hub non raggiungibile dopo il riavvio SSH');
+      }
+    };
+
+    try {
+      if (body.shared) {
+        await applyLocal(true);
+        await notifyHub(true);
+      } else {
+        // Revoke at the hub while -R is still alive, then remove -R locally.
+        await notifyHub(false);
+        await applyLocal(false);
+      }
+      return send(res, 200, { name, shared: body.shared });
+    } catch (e) {
+      // Share-on is transactional: a failed hub acknowledgement returns to the
+      // safe private -L-only state. Never include remote response bodies/tokens.
+      if (body.shared) {
+        try { await applyLocal(false); } catch (_) { /* best-effort safe rollback */ }
+      }
+      return send(res, 502, {
+        error: body.shared ? 'Share non attivato' : 'Share non disattivato',
+        detail: String(e && e.message || e).replace(/Bearer\s+\S+/gi, 'Bearer ***'),
+      });
+    }
+  });
+
   r.patch('/nodes/:name/visibility', mutGate, (req, res) => {
     try {
       const name = String(req.params.name || '');
@@ -759,53 +884,13 @@ function settingsRoutes(deps = {}) {
     } catch (e) { send(res, 400, { error: String(e.message || e) }); }
   });
 
-  // --- POST /node-role — node on/off (rendezvous config) ---------------------
-  r.post('/node-role', mutGate, (req, res) => {
-    try {
-      const b = req.body;
-      if (!b || typeof b !== 'object' || Array.isArray(b)) {
-        return send(res, 400, { error: 'body deve essere un oggetto JSON' });
-      }
-      for (const k of Object.keys(b)) {
-        if (!NODE_ROLE_KEYS.has(k)) return send(res, 400, { error: `chiave non ammessa: "${k}" (schema: enabled, rendezvousSsh?, publishedPort?, keyPath?)` });
-      }
-      if (typeof b.enabled !== 'boolean') return send(res, 400, { error: 'enabled deve essere boolean' });
-      if (b.rendezvousSsh !== undefined && !nodesStore.parseSsh(b.rendezvousSsh)) {
-        return send(res, 400, { error: 'rendezvousSsh non valido (atteso user@host strict)' });
-      }
-      if (b.publishedPort !== undefined && !nodesStore.isPort(b.publishedPort)) {
-        return send(res, 400, { error: 'publishedPort deve essere un intero 1..65535' });
-      }
-      if (b.keyPath !== undefined && !nodesStore.isAbsPath(b.keyPath)) {
-        return send(res, 400, { error: 'keyPath deve essere un path assoluto' });
-      }
-
-      const cap = capture();
-      if (b.enabled === false) {
-        const out = nodesCmds.nodeOff({ ...cliOpts(cap) });
-        if (out.code === 0) return send(res, 200, { enabled: false, roles: out.roles });
-        return send(res, 500, { error: lastLine(cap, 'node off fallito') });
-      }
-      const out = nodesCmds.nodeOn({
-        ...cliOpts(cap),
-        rendezvousSsh: b.rendezvousSsh,
-        publishedPort: b.publishedPort,
-        key: b.keyPath,
-        port: cfg.port, // porta nexus locale da esporre = quella del server attivo
-      });
-      if (out.code === 0) {
-        const resp = { enabled: true, roles: out.roles, tunnel: out.tunnel || null };
-        const line = authorizedKeysLine(cap);
-        if (line) resp.authorizedKeys = line; // pubkey con permitlisten: non un segreto
-        return send(res, 200, resp);
-      }
-      const msg = lastLine(cap, 'node on fallito');
-      if (out.reason === 'readonly') return send(res, 403, { error: msg });
-      if (out.reason === 'no rendezvous') return send(res, 400, { error: msg });
-      if (out.reason === 'permitlisten') return send(res, 409, { error: msg });
-      send(res, 500, { error: msg });
-    } catch (e) { send(res, 500, { error: String(e.message || e) }); }
-  });
+  // Legacy compatibility endpoint: the old node-role/rendezvous flow opened a
+  // second SSH process and is intentionally retired. Existing data is kept for
+  // migration, but all new publication goes through pairing + Share on the
+  // already-connected hub.
+  r.post('/node-role', mutGate, (_req, res) => send(res, 410, {
+    error: 'node-role/rendezvous ritirato: collega un hub e usa “Condividi questo nodo”',
+  }));
 
   // --- POST /service/regenerate — rigenera l'unit service --------------------
   // Riusa generateService/installService (lib/cli/service.js: escaping per-platform,
@@ -867,8 +952,26 @@ function publicPeeringRoutes(deps = {}) {
   const r = express.Router();
   const attempts = new Map();
   r.use(express.json({ limit: '8kb' }));
+  // Identity proof non consuma la capability e non riceve mai invite/token in
+  // chiaro. Serve a impedire che un qualunque listener HTTP sulla porta -L
+  // venga scambiato per il nodo contenuto nel link.
+  r.post('/identity', (req, res) => {
+    const key = `identity:${String(req.socket && req.socket.remoteAddress || 'local')}`;
+    const now = Date.now();
+    const recent = (attempts.get(key) || []).filter((x) => now - x < 60_000);
+    recent.push(now); attempts.set(key, recent);
+    if (recent.length > 30) return res.status(429).json({ error: 'troppi tentativi' });
+    const b = req.body || {};
+    const proof = peering.capabilityIdentity({
+      invitesPath, pendingPath, capabilityId: b.capabilityId, challenge: b.challenge, now,
+    });
+    if (!proof) return res.status(404).json({ error: 'capability non valida' });
+    const st = nodesStore.loadStore(nodesPath);
+    if (!st || !nodesStore.NODE_ID_RE.test(st.nodeId)) return res.status(503).json({ error: 'identita nodo non disponibile' });
+    return res.json({ ok: true, instanceId: st.nodeId, proof });
+  });
   r.post('/join', (req, res) => {
-    const key = String(req.socket && req.socket.remoteAddress || 'local');
+    const key = `join:${String(req.socket && req.socket.remoteAddress || 'local')}`;
     const now = Date.now();
     const recent = (attempts.get(key) || []).filter((x) => now - x < 60_000);
     recent.push(now); attempts.set(key, recent);
@@ -877,7 +980,10 @@ function publicPeeringRoutes(deps = {}) {
     const peerRoles = b.roles === undefined ? null : nodesStore.parseRoles(b.roles);
     if (!nodesStore.validToken(b.invite) || !nodesStore.NODE_ID_RE.test(b.instanceId)
       || !validPeerName(b.name) || !nodesStore.isPort(b.port) || !nodesStore.validToken(b.acceptToken)
-      || (b.roles !== undefined && !peerRoles)) {
+      || (b.roles !== undefined && !peerRoles)
+      // Pairing is always private. Publishing is a separate authenticated
+      // action after the reverse channel is live and health-checked.
+      || (b.shared !== undefined && b.shared !== false)) {
       return res.status(400).json({ error: 'pairing request non valida' });
     }
     if (b.label !== undefined && !nodesStore.validLabel(b.label)) {
@@ -892,8 +998,9 @@ function publicPeeringRoutes(deps = {}) {
       const reversePort = peering.allocateReversePort(st.nodes);
       const credential = peering.createPending({ pendingPath, data: {
         name, remotePort: b.port, reversePort, instanceId: b.instanceId, acceptToken: b.acceptToken,
+        shared: false,
         label: nodesStore.sanitizeLabel(b.label, name),
-        ...(peerRoles ? { roles: peerRoles, rolesKnown: true } : { rolesKnown: false }),
+        ...(peerRoles ? { roles: { ...peerRoles, node: false }, rolesKnown: true } : { rolesKnown: false }),
       } });
       res.json({ paired: true, instanceId: st.nodeId, reversePort, credential, roles: readRoles(configPath) });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -913,7 +1020,7 @@ function publicPeeringRoutes(deps = {}) {
       st = nodesStore.addNode(st, {
         name: pending.name, remotePort: pending.remotePort, localPort: pending.reversePort,
         direction: 'inbound', transport: 'inbound', autostart: true,
-        visibility: 'network', nodeId: pending.instanceId,
+        visibility: 'network', shared: pending.shared === true, nodeId: pending.instanceId,
         token: pending.acceptToken, acceptToken: b.credential,
         ...(pending.roles ? { roles: pending.roles } : {}),
         rolesKnown: pending.rolesKnown === true,

package/lib/update/runner.js

@@ -29,7 +29,10 @@ async function restartRuntime(opts = {}) {
   const token = opts.token || url.readToken(url.resolvePaths({ home }).tokenPath);
   let mode = 'inactive';
   if (commands.isServiceRunning({ platform, home })) {
-    commands.restart({ platform, home, log: () => {} });
+    const restarted = commands.restart({ platform, home, log: () => {} });
+    if (!restarted || restarted.restarted !== true) {
+      throw new Error(`restart service fallito: ${(restarted && restarted.reason) || 'esito non verificato'}`);
+    }
     mode = 'service';
   } else {
     const pidPath = pidf.defaultPidfilePath(home);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
@@ -20,7 +20,7 @@
     "start": "node bin/nexuscrew.js serve",
     "dev": "node bin/nexuscrew.js serve",
     "build": "cd frontend && npm install && npm run build && cd ..",
-    "test": "node --test tests/*.test.js"
+    "test": "node tests/run-isolated.js"
   },
   "dependencies": {
     "express": "^4.21.0",

package/skills/nexuscrew-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nexuscrew-agent
-description: Use when an AI agent connected to NexusCrew must notify or ask the human, inspect NexusCrew session/fleet status, read its inbox, deliver a file (report, screenshot, export), send text/input to a tmux session, or recover from tmux send-keys messages that remain unsubmitted or arrive garbled. Prefer the NexusCrew MCP tools nc_notify, nc_ask, nc_status, nc_inbox, and nc_send_file when exposed; use the bundled tmux/file helpers as fallback.
+description: Use when an AI agent connected to NexusCrew must notify or ask the human, inspect NexusCrew session/fleet status or its own deck membership, read its inbox, deliver a file (report, screenshot, export), send text/input to a tmux session, or recover from tmux send-keys messages that remain unsubmitted or arrive garbled. Prefer the NexusCrew MCP tools nc_notify, nc_ask, nc_status, nc_deck, nc_inbox, and nc_send_file when exposed; use the bundled tmux/file helpers as fallback.
 ---
 
 # NexusCrew Agent I/O
@@ -16,6 +16,7 @@ When the client exposes the NexusCrew MCP server, use these tools directly:
 | Notify the human about a result, blocker, or milestone | `nc_notify` |
 | Ask for a decision without blocking the agent | `nc_ask` |
 | Inspect live tmux sessions and fleet cells | `nc_status` |
+| Read the caller's deck name(s) and member cells/tmux sessions | `nc_deck` |
 | List files received for the current session | `nc_inbox` |
 | Deliver an absolute file path under the user's home | `nc_send_file` |
 
@@ -24,7 +25,9 @@ Apply these rules:
 - Use `nc_notify` for meaningful asynchronous updates, failures requiring attention, and completion. Do not notify for every command or duplicate routine chat commentary.
 - Never include access tokens, credentials, private keys, push subscriptions, or other secrets in a notification, ask, file caption, or tool result.
 - Treat `nc_ask` as non-blocking: it returns an ask ID immediately. Continue safe independent work or wait normally; the human response arrives in the originating tmux session with a `[human reply · ask#<id>]` prefix by default.
-- Use `nc_status` instead of scraping NexusCrew state files. Use `nc_inbox` instead of guessing an inbox path when the tool is available.
+- Use `nc_status` instead of scraping NexusCrew state files. Use `nc_deck` instead of reading `decks.json`: it returns every local or authorized shared-owner deck containing the caller, preserves visual member order, identifies each deck and member by stable owner ID, includes viewer-valid Hydra routes, and reports `cell: null` when no managed Fleet match is available.
+- Treat `nc_deck` as discovery, not authorization to contact every member. Use the verified tmux-messaging flow below for actual delivery and confirm submission visually.
+- Use `nc_inbox` instead of guessing an inbox path when the tool is available.
 - Pass `nc_send_file` an existing absolute regular-file path below the user's home. Let NexusCrew choose and sanitize the outbox name.
 - Do not treat an MCP notification as a substitute for the final response required by the active client.
 
@@ -68,6 +71,7 @@ tmux capture-pane -t <session> -p | tail -8   # see the text / a running state
 | Notify the human | `nc_notify` |
 | Ask the human without blocking | `nc_ask` |
 | Inspect NexusCrew runtime state | `nc_status` |
+| Discover this session's deck neighbours | `nc_deck` |
 | Give the human a file | `nc_send_file` or fallback `nc-deliver <file>...` |
 | Read a file the human sent | `nc_inbox` or fallback to the path in the prompt |
 | Send a prompt/command to a session | `nc-send <session> "text"` |