@mmmbuto/nexuscrew 0.2.5 → 0.4.1

package/frontend/dist/assets/index-Cjqxzf2o.css

@@ -0,0 +1,32 @@
+.nc-sessions{display:flex;flex-direction:column;gap:6px;padding:10px;color:#cfe}.nc-sessions header{display:flex;justify-content:space-between;font-weight:600;opacity:.8}.nc-sessions header button{background:none;border:1px solid #243;color:#9fd;border-radius:6px;padding:2px 8px}.nc-session{display:flex;align-items:center;gap:8px;padding:12px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:8px;text-align:left}.nc-session .dot{width:8px;height:8px;border-radius:50%;background:#355}.nc-session .dot.on{background:#0c6}.nc-session small{margin-left:auto;opacity:.6}.nc-err{color:#f88;font-size:12px}.nc-empty{opacity:.5;padding:12px}/**
+ * Copyright (c) 2014 The xterm.js authors. All rights reserved.
+ * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
+ * https://github.com/chjj/term.js
+ * @license MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * Originally forked from (with the author's permission):
+ *   Fabrice Bellard's javascript vt100 for jslinux:
+ *   http://bellard.org/jslinux/
+ *   Copyright (c) 2011 Fabrice Bellard
+ *   The original design remains. The terminal itself
+ *   has been extended to include xterm CSI codes, among
+ *   other features.
+ */.xterm{cursor:text;position:relative;user-select:none;-ms-user-select:none;-webkit-user-select:none}.xterm.focus,.xterm:focus{outline:none}.xterm .xterm-helpers{position:absolute;top:0;z-index:5}.xterm .xterm-helper-textarea{padding:0;border:0;margin:0;position:absolute;opacity:0;left:-9999em;top:0;width:0;height:0;z-index:-5;white-space:nowrap;overflow:hidden;resize:none}.xterm .composition-view{background:#000;color:#fff;display:none;position:absolute;white-space:nowrap;z-index:1}.xterm .composition-view.active{display:block}.xterm .xterm-viewport{background-color:#000;overflow-y:scroll;cursor:default;position:absolute;right:0;left:0;top:0;bottom:0}.xterm .xterm-screen{position:relative}.xterm .xterm-screen canvas{position:absolute;left:0;top:0}.xterm-char-measure-element{display:inline-block;visibility:hidden;position:absolute;top:0;left:-9999em;line-height:normal}.xterm.enable-mouse-events{cursor:default}.xterm.xterm-cursor-pointer,.xterm .xterm-cursor-pointer{cursor:pointer}.xterm.column-select.focus{cursor:crosshair}.xterm .xterm-accessibility:not(.debug),.xterm .xterm-message{position:absolute;left:0;top:0;bottom:0;right:0;z-index:10;color:transparent;pointer-events:none}.xterm .xterm-accessibility-tree:not(.debug) *::selection{color:transparent}.xterm .xterm-accessibility-tree{font-family:monospace;-webkit-user-select:text;user-select:text;white-space:pre}.xterm .xterm-accessibility-tree>div{transform-origin:left;width:fit-content}.xterm .live-region{position:absolute;left:-9999px;width:1px;height:1px;overflow:hidden}.xterm-dim{opacity:1!important}.xterm-underline-1{text-decoration:underline}.xterm-underline-2{text-decoration:double underline}.xterm-underline-3{text-decoration:wavy underline}.xterm-underline-4{text-decoration:dotted underline}.xterm-underline-5{text-decoration:dashed underline}.xterm-overline{text-decoration:overline}.xterm-overline.xterm-underline-1{text-decoration:overline underline}.xterm-overline.xterm-underline-2{text-decoration:overline double underline}.xterm-overline.xterm-underline-3{text-decoration:overline wavy underline}.xterm-overline.xterm-underline-4{text-decoration:overline dotted underline}.xterm-overline.xterm-underline-5{text-decoration:overline dashed underline}.xterm-strikethrough{text-decoration:line-through}.xterm-screen .xterm-decoration-container .xterm-decoration{z-index:6;position:absolute}.xterm-screen .xterm-decoration-container .xterm-decoration.xterm-decoration-top-layer{z-index:7}.xterm-decoration-overview-ruler{z-index:8;position:absolute;top:0;right:0;pointer-events:none}.xterm-decoration-top{z-index:2;position:relative}.xterm .xterm-scrollable-element>.scrollbar{cursor:default}.xterm .xterm-scrollable-element>.scrollbar>.scra{cursor:pointer;font-size:11px!important}.xterm .xterm-scrollable-element>.visible{opacity:1;background:#0000;transition:opacity .1s linear;z-index:11}.xterm .xterm-scrollable-element>.invisible{opacity:0;pointer-events:none}.xterm .xterm-scrollable-element>.invisible.fade{transition:opacity .8s linear}.xterm .xterm-scrollable-element>.shadow{position:absolute;display:none}.xterm .xterm-scrollable-element>.shadow.top{display:block;top:0;left:3px;height:3px;width:100%;box-shadow:var(--vscode-scrollbar-shadow, #000) 0 6px 6px -6px inset}.xterm .xterm-scrollable-element>.shadow.left{display:block;top:3px;left:0;height:100%;width:3px;box-shadow:var(--vscode-scrollbar-shadow, #000) 6px 0 6px -6px inset}.xterm .xterm-scrollable-element>.shadow.top-left-corner{display:block;top:0;left:0;height:3px;width:3px}.xterm .xterm-scrollable-element>.shadow.top.left{box-shadow:var(--vscode-scrollbar-shadow, #000) 6px 0 6px -6px inset}.nc-terminal{position:absolute;top:0;right:0;bottom:0;left:0;padding:4px;background:#0a0e0a}.nc-terminal .xterm{height:100%}.nc-keybar{display:flex;gap:6px;overflow-x:auto;padding:8px;background:#0e140e;border-top:1px solid #1c241c;-webkit-overflow-scrolling:touch}.nc-keybar button{flex:0 0 auto;padding:10px 12px;min-width:48px;border-radius:8px;border:1px solid #243;background:#122;color:#9fd;font-size:13px}.nc-keybar button:active{background:#0c6;color:#021}.nc-keybar.copy{background:#14210f}.nc-keybar .tag{flex:0 0 auto;align-self:center;padding:0 8px;color:#8e8;font-size:12px}:root{color-scheme:dark}body,#root{margin:0;height:100vh;background:#0a0e0a;font-family:ui-monospace,monospace}.nc-app{display:flex;flex-direction:column;height:100vh}.nc-bar{display:flex;gap:10px;align-items:center;padding:8px;color:#cfe;background:#0e140e}.nc-bar button{background:none;border:1px solid #243;color:#9fd;border-radius:6px;padding:4px 10px}.nc-termwrap{position:relative;flex:1}.nc-auth{color:#cfe;padding:20px;display:flex;flex-direction:column;gap:10px;max-width:420px}.nc-auth input[type=text],.nc-auth input:not([type]){padding:10px;background:#122;border:1px solid #243;color:#cfe;border-radius:6px}.nc-auth button{padding:10px;background:#122;border:1px solid #243;color:#9fd;border-radius:6px}:root{--bg-primary: #0d1117;--bg-secondary: #161b22;--bg-tertiary: #21262d;--bg-hover: #30363d;--text-primary: #e6edf3;--text-secondary: #8b949e;--text-tertiary: #6e7681;--border: #30363d;--accent: #6c5ce7;--accent-hover: #7c6cf7;--success: #3fb950;--warning: #d29922;--error: #f85149;--user-bg: #1c2333;--assistant-bg: transparent;--font-mono: "SF Mono", monospace;--font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif}*{box-sizing:border-box;margin:0;padding:0}html,body,#root{height:100%;width:100%;overflow:hidden}body{font-family:var(--font-sans);background:var(--bg-primary);color:var(--text-primary);-webkit-font-smoothing:antialiased}::-webkit-scrollbar{width:6px}::-webkit-scrollbar-track{background:transparent}::-webkit-scrollbar-thumb{background:var(--bg-tertiary);border-radius:3px}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.spinning{animation:spin 1s linear infinite}

package/frontend/dist/icon-maskable.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="96" fill="#0d1117"/>
+  <text x="256" y="340" font-family="monospace" font-size="280" font-weight="bold" fill="#3fb950" text-anchor="middle">&gt;_</text>
+</svg>

package/frontend/dist/icon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="96" fill="#0d1117"/>
+  <text x="256" y="340" font-family="monospace" font-size="280" font-weight="bold" fill="#3fb950" text-anchor="middle">&gt;_</text>
+</svg>

package/frontend/dist/index.html

@@ -2,12 +2,20 @@
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
+  <meta name="theme-color" content="#0d1117" />
+  <meta name="apple-mobile-web-app-capable" content="yes" />
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+  <meta name="mobile-web-app-capable" content="yes" />
+  <meta name="application-name" content="NexusCrew" />
+  <meta name="apple-mobile-web-app-title" content="NexusCrew" />
+  <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-CSPyKzmq.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-Cl7bxc7X.css">
+  <script type="module" crossorigin src="/assets/index-B41xYEDb.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-Cjqxzf2o.css">
 </head>
 <body>
   <div id="root"></div>
+  <script>if('serviceWorker' in navigator) navigator.serviceWorker.register('/sw.js');</script>
 </body>
 </html>

package/frontend/dist/manifest.json

@@ -0,0 +1,24 @@
+{
+  "name": "NexusCrew",
+  "short_name": "NexusCrew",
+  "description": "tmux-based AI cockpit",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#0d1117",
+  "theme_color": "#0d1117",
+  "orientation": "any",
+  "icons": [
+    {
+      "src": "/icon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any"
+    },
+    {
+      "src": "/icon-maskable.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "maskable"
+    }
+  ]
+}

package/frontend/dist/sw.js

@@ -0,0 +1,3 @@
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', () => self.clients.claim());
+self.addEventListener('fetch', (e) => e.respondWith(fetch(e.request)));

package/frontend/index.html

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
+  <meta name="theme-color" content="#0d1117" />
+  <meta name="apple-mobile-web-app-capable" content="yes" />
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+  <meta name="mobile-web-app-capable" content="yes" />
+  <meta name="application-name" content="NexusCrew" />
+  <meta name="apple-mobile-web-app-title" content="NexusCrew" />
+  <link rel="manifest" href="/manifest.json" />
+  <title>NexusCrew</title>
+</head>
+<body>
+  <div id="root"></div>
+  <script>if('serviceWorker' in navigator) navigator.serviceWorker.register('/sw.js');</script>
+  <script type="module" src="/src/main.jsx"></script>
+</body>
+</html>

package/lib/auth/token.js

@@ -0,0 +1,26 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+function loadOrCreateToken(tokenPath) {
+  try {
+    const t = fs.readFileSync(tokenPath, 'utf8').trim();
+    if (t) return t;
+  } catch (_) { /* crea sotto */ }
+  fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+  const tok = crypto.randomBytes(24).toString('base64url');
+  fs.writeFileSync(tokenPath, tok + '\n', { mode: 0o600 });
+  fs.chmodSync(tokenPath, 0o600);
+  return tok;
+}
+
+function verify(expected, given) {
+  if (typeof expected !== 'string' || typeof given !== 'string') return false;
+  const a = Buffer.from(expected);
+  const b = Buffer.from(given);
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+module.exports = { loadOrCreateToken, verify };

package/lib/config.js

@@ -0,0 +1,25 @@
+'use strict';
+const os = require('os');
+const path = require('path');
+
+const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
+
+function assertLoopback(bind) {
+  if (!LOOPBACK.has(bind)) {
+    throw new Error(`refusing non-loopback bind "${bind}": nexuscrew is localhost-only`);
+  }
+  return bind;
+}
+
+function defaults() {
+  return {
+    bind: '127.0.0.1',
+    port: Number(process.env.NEXUSCREW_PORT || 41820),
+    tokenPath: process.env.NEXUSCREW_TOKEN_FILE
+      || path.join(os.homedir(), '.nexuscrew', 'token'),
+    tmuxBin: process.env.NEXUSCREW_TMUX || 'tmux',
+    readonlyDefault: process.env.NEXUSCREW_READONLY === '1' ? true : false,
+  };
+}
+
+module.exports = { assertLoopback, defaults, LOOPBACK };

package/lib/pty/attach.js

@@ -0,0 +1,30 @@
+'use strict';
+const { loadPty } = require('./provider.js');
+
+// Opens `tmux attach` inside a real PTY, non-destructive for other clients.
+// With `window-size latest` + `aggressive-resize on`, a small web client would
+// shrink the window for the user's real terminal too. So:
+//   default  → `-f ignore-size`  (our client does NOT drive the geometry)
+//   takeSize → normal attach      (only when the size should be driven deliberately)
+//   readonly → `-f read-only,ignore-size` (note: read-only also limits copy-mode/KeyBar)
+function openAttach(session, opts = {}) {
+  const { readonly = false, takeSize = false, cols = 80, rows = 24, tmuxBin = 'tmux' } = opts;
+  const pty = loadPty();
+  const args = ['attach-session', '-t', session];
+  if (readonly) args.push('-f', 'read-only,ignore-size');
+  else if (!takeSize) args.push('-f', 'ignore-size');
+  const term = pty.spawn(tmuxBin, args, {
+    name: 'xterm-256color',
+    cols, rows,
+    cwd: process.env.HOME,
+    env: process.env,
+  });
+  return {
+    write: (data) => term.write(data),
+    resize: (c, r) => { try { term.resize(c, r); } catch (_) {} },
+    onData: (cb) => term.onData(cb),
+    onExit: (cb) => term.onExit(cb),
+    kill: () => { try { term.kill(); } catch (_) {} },
+  };
+}
+module.exports = { openAttach };

package/lib/pty/provider.js

@@ -0,0 +1,33 @@
+'use strict';
+// Ritorna un oggetto { spawn(file, args, opts) } con un PTY REALE.
+// Termux/Android → @mmmbuto/node-pty-android-arm64 ; altrove → node-pty upstream.
+// `tmux attach` ESIGE un vero tty: il fallback child_process NON è accettabile qui.
+let _cached = null;
+
+function loadPty() {
+  if (_cached) return _cached;
+  const isTermux = process.platform === 'android'
+    || (process.env.PREFIX || '').includes('com.termux');
+  const candidates = isTermux
+    ? ['@mmmbuto/node-pty-android-arm64', 'node-pty']
+    : ['node-pty', '@lydell/node-pty-linux-x64', '@mmmbuto/node-pty-android-arm64'];
+  for (const mod of candidates) {
+    try {
+      const pty = require(mod);
+      // Accept ONLY a provider with a complete PTY API; never child_process.
+      if (pty && typeof pty.spawn === 'function') {
+        const t = pty.spawn(process.env.SHELL || '/bin/sh', ['-c', 'true'], { cols: 80, rows: 24 });
+        const ok = t && typeof t.write === 'function' && typeof t.onData === 'function'
+          && typeof t.resize === 'function' && typeof t.kill === 'function';
+        try { t.kill(); } catch (_) {}
+        if (ok) {
+          if (process.env.NEXUSCREW_DEBUG) console.error(`[pty] provider=${mod}`);
+          _cached = pty;
+          return pty;
+        }
+      }
+    } catch (_) { /* prova il prossimo */ }
+  }
+  throw new Error('no real PTY provider available (need node-pty or @mmmbuto/node-pty-android-arm64)');
+}
+module.exports = { loadPty };

package/lib/server.js

@@ -0,0 +1,62 @@
+'use strict';
+const http = require('node:http');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const express = require('express');
+const { WebSocketServer } = require('ws');
+const { defaults, assertLoopback } = require('./config.js');
+const { listSessions } = require('./tmux/list.js');
+const { runAction } = require('./tmux/actions.js');
+const { openAttach } = require('./pty/attach.js');
+const { bindWs } = require('./ws/bridge.js');
+const { loadOrCreateToken, verify } = require('./auth/token.js');
+
+function sessionExists(tmuxBin, name) {
+  if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name)) return false;
+  try { execFileSync(tmuxBin, ['has-session', '-t', `=${name}`], { stdio: 'ignore' }); return true; }
+  catch (_) { return false; }
+}
+
+function createServer(opts = {}) {
+  const cfg = { ...defaults(), ...opts };
+  assertLoopback(cfg.bind);
+  const token = loadOrCreateToken(cfg.tokenPath);
+
+  const app = express();
+  const distDir = path.join(__dirname, '..', 'frontend', 'dist');
+  // no-store on everything (HTML+assets+API): this is a local, token-adjacent tool.
+  app.use((_req, res, next) => { res.set('Cache-Control', 'no-store'); next(); });
+  app.get('/api/sessions', async (_req, res) => {
+    try { res.json({ sessions: await listSessions(cfg.tmuxBin) }); }
+    catch (e) { res.status(500).json({ error: String(e.message || e) }); }
+  });
+  // Note: the token must never be exposed here.
+  app.get('/api/config', (_req, res) => res.json({ readonlyDefault: cfg.readonlyDefault }));
+  app.use(express.static(distDir));
+  app.get('*', (_req, res) => res.sendFile(path.join(distDir, 'index.html')));
+
+  const server = http.createServer(app);
+  const wss = new WebSocketServer({ server, path: '/ws', maxPayload: 1 << 20 });
+  wss.on('connection', (ws) => {
+    bindWs(ws, {
+      openAttach,
+      verifyToken: (t) => verify(token, t),
+      isValidSession: (name) => sessionExists(cfg.tmuxBin, name),
+      runAction: (sess, action) => runAction(cfg.tmuxBin, sess, action),
+      defaults: { readonlyDefault: cfg.readonlyDefault, tmuxBin: cfg.tmuxBin },
+    });
+  });
+
+  return { app, server, wss, cfg, token };
+}
+
+function start(opts = {}) {
+  const { server, cfg, token } = createServer(opts);
+  server.listen(cfg.port, cfg.bind, () => {
+    console.log(`nexuscrew on http://${cfg.bind}:${cfg.port}  (token: ${token})`);
+    console.log('localhost-only — reach it via SSH/autossh/VPN tunnel.');
+  });
+  return server;
+}
+
+module.exports = { createServer, start };

package/lib/tmux/actions.js

@@ -0,0 +1,27 @@
+'use strict';
+const { execFile } = require('node:child_process');
+
+// Window/pane navigation must NOT be emulated with client-side prefix keys
+// (it depends on each host's bindings, which may be remapped or broken).
+// It runs server-side with direct, allowlisted tmux commands on the active session.
+const ACTIONS = {
+  'prev-window': ['previous-window'],
+  'next-window': ['next-window'],
+  'pane-left': ['select-pane', '-L'],
+  'pane-right': ['select-pane', '-R'],
+};
+
+// Pure: ritorna gli arg tmux per un'azione allowlistata, o null.
+function actionArgs(name) {
+  return Object.prototype.hasOwnProperty.call(ACTIONS, name) ? ACTIONS[name].slice() : null;
+}
+
+// Fire-and-forget: esegue l'azione sulla sessione (match esatto `=name`). false se non allowlistata.
+function runAction(tmuxBin, session, name) {
+  const base = actionArgs(name);
+  if (!base) return false;
+  try { execFile(tmuxBin, [...base, '-t', `=${session}`], () => {}); return true; }
+  catch (_) { return false; }
+}
+
+module.exports = { actionArgs, runAction, ACTIONS };

package/lib/tmux/list.js

@@ -0,0 +1,33 @@
+'use strict';
+const { execFile } = require('node:child_process');
+
+const FMT = "#{session_name}\t#{session_attached}\t#{session_windows}\t#{session_created}";
+
+function parseSessions(raw) {
+  return String(raw)
+    .split('\n')
+    .filter((l) => l.trim() !== '')
+    .map((line) => {
+      const [name, attached, windows, created] = line.split('\t');
+      return {
+        name,
+        attached: attached === '1',
+        windows: Number(windows),
+        created: Number(created),
+      };
+    });
+}
+
+function listSessions(tmuxBin = 'tmux') {
+  return new Promise((resolve, reject) => {
+    execFile(tmuxBin, ['list-sessions', '-F', FMT], (err, stdout, stderr) => {
+      if (err) {
+        if (/no server running/i.test(stderr || '')) return resolve([]);
+        return reject(new Error(`tmux list-sessions failed: ${stderr || err.message}`));
+      }
+      resolve(parseSessions(stdout));
+    });
+  });
+}
+
+module.exports = { parseSessions, listSessions, FMT };

package/lib/ws/bridge.js

@@ -0,0 +1,66 @@
+'use strict';
+// Bridges ONE WebSocket to ONE PTY attach. Dependencies are injectable for tests.
+// Hardening: close on protocol violation, no 2nd attach, clamp cols/rows,
+// validated session, backpressure cutoff, errors as JSON with a code.
+const MAX_BUFFERED = 12 * 1024 * 1024; // 12 MiB
+
+function clamp(n, lo, hi, def) {
+  n = Number(n);
+  if (!Number.isFinite(n)) return def;
+  return Math.max(lo, Math.min(hi, Math.round(n)));
+}
+
+function bindWs(ws, deps) {
+  const { openAttach, verifyToken, isValidSession = () => true, runAction = () => false, defaults = {} } = deps;
+  let pty = null;
+  let attached = false;
+  let session = null;
+
+  function fail(code, reason) {
+    try { ws.send(JSON.stringify({ type: 'error', reason })); } catch (_) {}
+    try { ws.close(code, reason); } catch (_) {}
+  }
+
+  function onMessage(data, isBinary) {
+    if (!attached) {
+      if (isBinary) return fail(1002, 'binary before attach');
+      let msg;
+      try { msg = JSON.parse(data.toString()); } catch (_) { return fail(1002, 'bad handshake'); }
+      if (msg.type !== 'attach') return fail(1002, 'expected attach');
+      if (!verifyToken(msg.token)) return fail(4401, 'bad token');
+      if (!isValidSession(msg.session)) return fail(4404, 'no such session');
+      attached = true;
+      session = msg.session;
+      pty = openAttach(msg.session, {
+        readonly: msg.readonly ?? defaults.readonlyDefault ?? false,
+        takeSize: !!msg.takeSize,
+        cols: clamp(msg.cols, 20, 300, 80),
+        rows: clamp(msg.rows, 5, 120, 24),
+        tmuxBin: defaults.tmuxBin || 'tmux',
+      });
+      pty.onData((d) => {
+        try { ws.send(Buffer.from(d), { binary: true }); } catch (_) { return; }
+        if ((ws.bufferedAmount || 0) > MAX_BUFFERED) fail(1011, 'backpressure');
+      });
+      pty.onExit((info) => {
+        try { ws.send(JSON.stringify({ type: 'exit', code: info && info.exitCode })); } catch (_) {}
+        try { ws.close(1000, 'exit'); } catch (_) {}
+      });
+      return;
+    }
+    // dopo l'attach
+    if (isBinary) { pty.write(data); return; }
+    let msg;
+    try { msg = JSON.parse(data.toString()); } catch (_) { return; }
+    if (msg.type === 'attach') return fail(1002, 'already attached'); // no 2nd attach
+    if (msg.type === 'resize') pty.resize(clamp(msg.cols, 20, 300, 80), clamp(msg.rows, 5, 120, 24));
+    else if (msg.type === 'input') pty.write(typeof msg.data === 'string' ? msg.data : '');
+    else if (msg.type === 'key') pty.write(typeof msg.seq === 'string' ? msg.seq.slice(0, 64) : '');
+    else if (msg.type === 'action') runAction(session, msg.name); // nav window/pane server-side
+  }
+
+  ws.on('message', onMessage);
+  ws.on('close', () => { if (pty) pty.kill(); pty = null; });
+  ws.on('error', () => { if (pty) pty.kill(); pty = null; });
+}
+module.exports = { bindWs, clamp };

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.2.5",
-  "description": "tmux-based AI cockpit for real active sessions and launcher discovery across Termux, Linux, and macOS",
-  "main": "lib/server/server.js",
+  "version": "0.4.1",
+  "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
+  "main": "lib/server.js",
   "bin": {
     "nexuscrew": "bin/nexuscrew.js"
   },
@@ -10,26 +10,25 @@
     "bin/",
     "lib/",
     "frontend/dist/",
+    "frontend/index.html",
     "LICENSE",
     "README.md"
   ],
   "scripts": {
-    "dev": "node lib/server/server.js",
+    "start": "node bin/nexuscrew.js",
+    "dev": "node bin/nexuscrew.js",
     "build": "cd frontend && npm install && npm run build && cd ..",
-    "start": "node lib/server/server.js",
-    "test": "node --test tests/*.test.js",
-    "setup": "node bin/nexuscrew.js init",
-    "prepublishOnly": "chmod +x bin/nexuscrew.js && cd frontend && npm install && npm run build",
-    "postinstall": "node bin/nexuscrew.js init --silent"
+    "test": "node --test tests/*.test.js"
   },
   "dependencies": {
-    "better-sqlite3": "npm:@mmmbuto/better-sqlite3-termux@12.8.0-termux.1",
-    "commander": "^12.1.0",
-    "cors": "^2.8.5",
     "express": "^4.21.0",
-    "uuid": "^10.0.0"
+    "ws": "^8.18.0",
+    "@mmmbuto/pty-termux-utils": "^1.1.4"
+  },
+  "optionalDependencies": {
+    "node-pty": "^1.1.0",
+    "@lydell/node-pty-linux-x64": "^1.2.0-beta.12"
   },
-  "optionalDependencies": {},
   "engines": {
     "node": ">=18"
   },
@@ -40,20 +39,17 @@
   ],
   "cpu": [
     "x64",
-    "arm64",
-    "arm"
+    "arm64"
   ],
   "keywords": [
     "tmux",
-    "claude-code",
-    "codex",
-    "gemini",
-    "qwen",
-    "ai",
-    "cockpit",
     "terminal",
-    "session-manager",
-    "ssh"
+    "pty",
+    "websocket",
+    "xterm",
+    "cockpit",
+    "mobile",
+    "session-manager"
   ],
   "repository": {
     "type": "git",