@mmmbuto/nexuscrew 0.4.2 → 0.7.0

package/lib/cli/service.js

@@ -0,0 +1,229 @@
+'use strict';
+// Service generation per-platform: systemd --user (linux), launchd plist (mac),
+// Termux:boot script. Escaping per-platform + install no-symlink atomic. [M2][M3][B1][R2][R3]
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { detectPlatform, uid } = require('./platform.js');
+
+// --- Escaping helpers ---
+
+// systemd WorkingDirectory: escape % (percent specifier). Spazi ok.
+function escapeSystemdPath(s) {
+  return String(s).replace(/%/g, '%%');
+}
+
+// systemd ExecStart arg: escape backslash, %, spazio.
+function escapeSystemdExec(s) {
+  return String(s)
+    .replace(/\\/g, '\\\\')
+    .replace(/%/g, '%%')
+    .replace(/ /g, '\\ ');
+}
+
+// launchd plist XML escape.
+function escapeXml(s) {
+  return String(s)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
+// POSIX shell single-quote.
+function shellQuote(s) {
+  return "'" + String(s).replace(/'/g, "'\\''") + "'";
+}
+
+// systemd ExecStart non gestisce bene alcuni char (", $, ;, backtick, newline, apice)
+// nemmeno con escaping ad hoc: reject esplicito con errore chiaro. [M3]
+// space e % sono ok (escaped). Path repo normali non hanno questi char.
+const SYSTEMD_FORBIDDEN = /[";$`\n']/;
+function assertSystemdSafe(label, p) {
+  if (SYSTEMD_FORBIDDEN.test(String(p))) {
+    throw new Error(`${label} path contiene caratteri non supportati in systemd (", $, ;, backtick, newline, apice): "${p}". Usa un path senza questi caratteri (spazi e % sono ok).`);
+  }
+}
+
+// --- Templates ---
+
+function generateService(platform, ctx) {
+  if (platform === 'linux') return generateLinux(ctx);
+  if (platform === 'mac') return generateMac(ctx);
+  if (platform === 'termux') return generateTermux(ctx);
+  throw new Error(`unsupported platform: ${platform}`);
+}
+
+function generateLinux(ctx) {
+  assertSystemdSafe('repoRoot', ctx.repoRoot); // [M3] reject char non gestibili
+  assertSystemdSafe('nodeBin', ctx.nodeBin);
+  const repo = escapeSystemdPath(ctx.repoRoot);
+  const node = escapeSystemdExec(ctx.nodeBin);
+  const repoBin = escapeSystemdExec(path.join(ctx.repoRoot, 'bin', 'nexuscrew.js'));
+  const nodeDir = escapeSystemdPath(path.dirname(ctx.nodeBin));
+  return `# NexusCrew service (systemd --user, loopback, solo tunnel SSH/VPN)
+[Unit]
+Description=NexusCrew - browser tmux client (loopback, solo tunnel SSH/VPN)
+After=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${repo}
+Environment=NEXUSCREW_PORT=${ctx.port}
+Environment=PATH=${nodeDir}:/usr/local/bin:/usr/bin:/bin
+ExecStart=${node} ${repoBin} serve
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+function generateMac(ctx) {
+  const nodeXml = escapeXml(ctx.nodeBin);
+  const repoBinXml = escapeXml(path.join(ctx.repoRoot, 'bin', 'nexuscrew.js'));
+  const repoXml = escapeXml(ctx.repoRoot);
+  const homeXml = escapeXml(ctx.home);
+  const port = ctx.port;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.mmmbuto.nexuscrew</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nodeXml}</string>
+    <string>${repoBinXml}</string>
+    <string>serve</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${repoXml}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>NEXUSCREW_PORT</key>
+    <string>${port}</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${homeXml}/.nexuscrew/nexuscrew.log</string>
+  <key>StandardErrorPath</key>
+  <string>${homeXml}/.nexuscrew/nexuscrew.log</string>
+</dict>
+</plist>
+`;
+}
+
+function generateTermux(ctx) {
+  const nodeQ = shellQuote(ctx.nodeBin);
+  const repoBinQ = shellQuote(path.join(ctx.repoRoot, 'bin', 'nexuscrew.js'));
+  const repoQ = shellQuote(ctx.repoRoot);
+  return `#!/data/data/com.termux/files/usr/bin/sh
+# NexusCrew boot (Termux) - loopback, localhost del telefono
+export PATH=/data/data/com.termux/files/usr/bin:$PATH
+export HOME=/data/data/com.termux/files/home
+export NEXUSCREW_PORT=${ctx.port}
+cd -- ${repoQ}
+termux-wake-lock 2>/dev/null || true
+mkdir -p "$HOME/.nexuscrew"
+exec ${nodeQ} ${repoBinQ} serve --pidfile >> "$HOME/.nexuscrew/nexuscrew.log" 2>&1
+`;
+}
+
+// --- Install paths ---
+
+function installPath(platform, home) {
+  if (platform === 'linux') return path.join(home, '.config', 'systemd', 'user', 'nexuscrew.service');
+  if (platform === 'mac') return path.join(home, 'Library', 'LaunchAgents', 'com.mmmbuto.nexuscrew.plist');
+  if (platform === 'termux') return path.join(home, '.termux', 'boot', 'nexuscrew.sh');
+  throw new Error(`unsupported platform: ${platform}`);
+}
+
+function fileMode(platform) {
+  if (platform === 'termux') return 0o700;
+  return 0o644; // systemd unit + launchd plist
+}
+
+// Install no-symlink + atomic rename. [M3]
+// - lstat target: reject symlink (no follow)
+// - write temp file nella stessa dir -> chmod mode -> atomic rename
+// - exec service manager (systemctl/launchctl); skip in dryRun
+// execImpl per test (default execFileSync).
+function installService(platform, content, ctx, { dryRun = false, execImpl = execFileSync } = {}) {
+  const home = ctx.home || os.homedir();
+  const target = ctx.installPath || installPath(platform, home);
+  const mode = fileMode(platform);
+
+  // lstat: reject symlink preesistente
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink()) {
+      throw new Error(`refusing symlink install target: ${target}`);
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+  }
+
+  if (dryRun) {
+    return { target, mode, written: false, failures: [], note: 'dry-run: nessuna scrittura' };
+  }
+
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  // temp file stessa dir (per atomic rename su stesso filesystem)
+  const tmp = target + '.tmp.' + process.pid;
+  try {
+    fs.writeFileSync(tmp, content, { mode });
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, target); // atomic
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {} // cleanup temp su failure [m1]
+    throw e;
+  }
+
+  // exec service manager — NON ingoiare failure (M1): raccogli per diagnosi
+  const cmds = installCommands(platform, target, ctx);
+  const failures = [];
+  for (const [bin, args] of cmds) {
+    try { execImpl(bin, args, { stdio: 'ignore' }); }
+    catch (e) { failures.push({ cmd: `${bin} ${args.join(' ')}`, error: e.message }); }
+  }
+
+  return { target, mode, written: true, failures };
+}
+
+function installCommands(platform, target, ctx) {
+  if (platform === 'linux') {
+    return [
+      ['systemctl', ['--user', 'daemon-reload']],
+      ['systemctl', ['--user', 'enable', 'nexuscrew']],
+      ['systemctl', ['--user', 'restart', 'nexuscrew']], // restart carica nuovo codice (drop-in)
+    ];
+  }
+  if (platform === 'mac') {
+    const label = `gui/${ctx.uid || uid()}/com.mmmbuto.nexuscrew`;
+    // bootout (ignore se non esiste) poi bootstrap
+    return [
+      ['launchctl', ['bootout', label]],
+      ['launchctl', ['bootstrap', label, target]],
+    ];
+  }
+  if (platform === 'termux') {
+    return []; // nessun service manager; boot script + start manuale (nohup+pidfile)
+  }
+  return [];
+}
+
+module.exports = {
+  generateService, generateLinux, generateMac, generateTermux,
+  installService, installPath, installCommands, fileMode,
+  escapeSystemdPath, escapeSystemdExec, escapeXml, shellQuote,
+  assertSystemdSafe, SYSTEMD_FORBIDDEN,
+};

package/lib/config.js

@@ -1,6 +1,7 @@
 'use strict';
-const os = require('os');
-const path = require('path');
+const os = require('node:os');
+const path = require('node:path');
+const fs = require('node:fs');
 
 const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
 
@@ -11,15 +12,64 @@ function assertLoopback(bind) {
   return bind;
 }
 
-function defaults() {
+// Defaults PURI (no env, no config.json). voice null = graceful (non configurato).
+function baseDefaults() {
   return {
     bind: '127.0.0.1',
-    port: Number(process.env.NEXUSCREW_PORT || 41820),
-    tokenPath: process.env.NEXUSCREW_TOKEN_FILE
-      || path.join(os.homedir(), '.nexuscrew', 'token'),
-    tmuxBin: process.env.NEXUSCREW_TMUX || 'tmux',
-    readonlyDefault: process.env.NEXUSCREW_READONLY === '1' ? true : false,
+    port: 41820,
+    tokenPath: path.join(os.homedir(), '.nexuscrew', 'token'),
+    tmuxBin: 'tmux',
+    readonlyDefault: false,
+    filesRoot: path.join(os.homedir(), 'NexusFiles'),
+    maxUpload: 100 * 1024 * 1024,
+    voiceUrl: null,
+    voiceToken: '',
+    voiceTokenFile: null,
+    fleetEnabled: true,
+    fleetBin: path.join(os.homedir(), '.local', 'bin', 'fleet'),
+    sessionPresets: {},
   };
 }
 
-module.exports = { assertLoopback, defaults, LOOPBACK };
+function configJsonPath() {
+  return process.env.NEXUSCREW_CONFIG_FILE || path.join(os.homedir(), '.nexuscrew', 'config.json');
+}
+
+// Legge ~/.nexuscrew/config.json se esiste (nuovo, B2). {} se assente/malformato.
+function readConfigJson() {
+  try {
+    const raw = fs.readFileSync(configJsonPath(), 'utf8');
+    const obj = JSON.parse(raw);
+    return (obj && typeof obj === 'object') ? obj : {};
+  } catch (_) { return {}; }
+}
+
+// Override da env (precedence più alta di config.json).
+function envOverrides() {
+  const e = {};
+  if (process.env.NEXUSCREW_PORT) e.port = Number(process.env.NEXUSCREW_PORT);
+  if (process.env.NEXUSCREW_TOKEN_FILE) e.tokenPath = process.env.NEXUSCREW_TOKEN_FILE;
+  if (process.env.NEXUSCREW_TMUX) e.tmuxBin = process.env.NEXUSCREW_TMUX;
+  if (process.env.NEXUSCREW_READONLY) e.readonlyDefault = process.env.NEXUSCREW_READONLY === '1';
+  if (process.env.NEXUSCREW_FILES_ROOT) e.filesRoot = process.env.NEXUSCREW_FILES_ROOT;
+  if (process.env.NEXUSCREW_MAX_UPLOAD_MB) e.maxUpload = Number(process.env.NEXUSCREW_MAX_UPLOAD_MB) * 1024 * 1024;
+  if (process.env.NEXUSCREW_VOICE_URL) e.voiceUrl = process.env.NEXUSCREW_VOICE_URL;
+  if (process.env.NEXUSCREW_VOICE_TOKEN) e.voiceToken = process.env.NEXUSCREW_VOICE_TOKEN;
+  if (process.env.NEXUSCREW_VOICE_TOKEN_FILE) e.voiceTokenFile = process.env.NEXUSCREW_VOICE_TOKEN_FILE;
+  if (process.env.NEXUSCREW_FLEET) e.fleetEnabled = process.env.NEXUSCREW_FLEET !== '0';
+  if (process.env.NEXUSCREW_FLEET_BIN) e.fleetBin = process.env.NEXUSCREW_FLEET_BIN;
+  return e;
+}
+
+// Precedence: baseDefaults < config.json < env < opts. [B2]
+function loadConfig(opts = {}) {
+  return { ...baseDefaults(), ...readConfigJson(), ...envOverrides(), ...opts };
+}
+
+// Retrocompat: defaults() = baseDefaults + env (NO config.json — per test isolati
+// che non devono leggere ~/.nexuscrew/config.json del device). server.js usa loadConfig().
+function defaults() {
+  return { ...baseDefaults(), ...envOverrides() };
+}
+
+module.exports = { assertLoopback, baseDefaults, readConfigJson, loadConfig, defaults, LOOPBACK, configJsonPath };

package/lib/files/routes.js

@@ -0,0 +1,60 @@
+'use strict';
+const { Router } = require('express');
+const multer = require('multer');
+const store = require('./store.js');
+
+// Router file-exchange. Nessuno stato: tutto deriva da cfg + filesystem.
+function filesRoutes({ cfg, sessionExists, paste }) {
+  const router = Router();
+  const upload = multer({
+    storage: multer.memoryStorage(),
+    limits: { fileSize: cfg.maxUpload, files: 1 },
+  });
+
+  router.post('/upload', (req, res) => {
+    upload.single('file')(req, res, async (err) => {
+      if (err) {
+        const status = err.code === 'LIMIT_FILE_SIZE' ? 413 : 400;
+        return res.status(status).json({ error: err.message });
+      }
+      const session = String((req.body && req.body.session) || '');
+      if (!req.file) return res.status(400).json({ error: 'file mancante' });
+      if (!store.isValidSession(session) || !sessionExists(session)) {
+        return res.status(404).json({ error: 'sessione tmux inesistente' });
+      }
+      const saved = store.saveUpload(cfg.filesRoot, session, req.file.buffer, req.file.originalname);
+      const pasted = await paste(session, saved.path);
+      res.json({ ...saved, pasted });
+    });
+  });
+
+  router.get('/', (req, res) => {
+    const session = String(req.query.session || '');
+    if (!store.isValidSession(session)) return res.status(400).json({ error: 'sessione invalida' });
+    res.json({
+      session,
+      inbox: store.listBox(cfg.filesRoot, session, 'inbox'),
+      outbox: store.listBox(cfg.filesRoot, session, 'outbox'),
+    });
+  });
+
+  router.get('/download', (req, res) => {
+    const full = store.resolveExisting(
+      cfg.filesRoot, String(req.query.session || ''), String(req.query.box || 'outbox'), String(req.query.name || ''),
+    );
+    if (!full) return res.status(404).json({ error: 'file non trovato' });
+    res.download(full);
+  });
+
+  router.delete('/', (req, res) => {
+    const ok = store.removeFile(
+      cfg.filesRoot, String(req.query.session || ''), String(req.query.box || ''), String(req.query.name || ''),
+    );
+    if (!ok) return res.status(404).json({ error: 'file non trovato' });
+    res.json({ deleted: true });
+  });
+
+  return router;
+}
+
+module.exports = { filesRoutes };

package/lib/files/store.js

@@ -0,0 +1,127 @@
+'use strict';
+// File exchange per sessione: <root>/<sessione>/{inbox,outbox}.
+// Ogni path e' derivato SOLO da input validati: sessione via regex tmux,
+// nome file senza separatori. Mai overwrite in inbox.
+//
+// NOTE: i check su control-char/separatori/backslash usano charCode invece
+// di regex con escape (\u00XX, \w, \\) perche' il layer di scrittura del file
+// corrompe gli escape backslash. Semantica identica al piano.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const BOXES = new Set(['inbox', 'outbox']);
+// \w === [A-Za-z0-9_]; espanso in letterali per evitare escape nel sorgente.
+const SESSION_RE = /^[A-Za-z0-9_.@%:+-]{1,128}$/;
+const BS = String.fromCharCode(0x5c); // backslash
+
+function isValidSession(name) {
+  return typeof name === 'string' && SESSION_RE.test(name);
+}
+
+// Rimuove i control char (0x00-0x1f e 0x7f) — eliminati, non sostituiti.
+function stripControl(s) {
+  let out = '';
+  for (let i = 0; i < s.length; i += 1) {
+    const c = s.charCodeAt(i);
+    if (c > 0x1f && c !== 0x7f) out += s[i];
+  }
+  return out;
+}
+
+// Sostituisce separatori di path e whitespace con '_' (mai un separatore nel nome).
+function replaceSeparators(s) {
+  let out = '';
+  for (let i = 0; i < s.length; i += 1) {
+    const ch = s[i];
+    const c = s.charCodeAt(i);
+    if (ch === '/' || ch === BS || c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) out += '_';
+    else out += ch;
+  }
+  return out;
+}
+
+function sanitizeName(name) {
+  const base = replaceSeparators(stripControl(path.basename(String(name || ''))));
+  // '..' o solo punti -> neutri (mai un nome che il shell interpreta).
+  let onlyDots = true;
+  for (let i = 0; i < base.length; i += 1) { if (base[i] !== '.') { onlyDots = false; break; } }
+  const safe = onlyDots ? '' : base;
+  return (safe || 'file').slice(0, 128);
+}
+
+function stamp(now = new Date()) {
+  const p = (n) => String(n).padStart(2, '0');
+  return `${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}`;
+}
+
+function boxDir(root, session, box) {
+  if (!isValidSession(session) || !BOXES.has(box)) return null;
+  return path.join(root, session, box);
+}
+
+function ensureBox(root, session, box) {
+  const dir = boxDir(root, session, box);
+  if (!dir) return null;
+  fs.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function saveUpload(root, session, buffer, origName, now = new Date()) {
+  const dir = ensureBox(root, session, 'inbox');
+  if (!dir) return null;
+  const base = `${stamp(now)}_${sanitizeName(origName)}`;
+  let name = base;
+  for (let i = 1; fs.existsSync(path.join(dir, name)); i += 1) name = `${i}-${base}`;
+  const full = path.join(dir, name);
+  fs.writeFileSync(full, buffer, { flag: 'wx' });
+  return { name, path: full, size: buffer.length };
+}
+
+function listBox(root, session, box) {
+  const dir = boxDir(root, session, box);
+  if (!dir) return null;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch (_) { return []; }
+  return entries
+    .filter((e) => e.isFile())
+    .map((e) => {
+      const st = fs.statSync(path.join(dir, e.name));
+      return { name: e.name, size: st.size, mtime: st.mtimeMs };
+    })
+    .sort((a, b) => b.mtime - a.mtime);
+}
+
+// true se il nome contiene separatori/NUL o e' '.'/'..' (guardia anti-traversal).
+function isUnsafeName(name) {
+  if (name === '.' || name === '..') return true;
+  for (let i = 0; i < name.length; i += 1) {
+    const ch = name[i];
+    const c = name.charCodeAt(i);
+    if (ch === '/' || ch === BS || c === 0x00) return true;
+  }
+  return false;
+}
+
+function resolveExisting(root, session, box, name) {
+  const dir = boxDir(root, session, box);
+  if (!dir || typeof name !== 'string' || name === '') return null;
+  if (isUnsafeName(name)) return null;
+  const full = path.join(dir, name);
+  // lstat (non stat): NON segue i symlink. Un symlink ha isFile()=false su lstat,
+  // quindi un link nella box che punta fuori NON viene mai servito/scaricato (anti-evasion).
+  try { if (!fs.lstatSync(full).isFile()) return null; } catch (_) { return null; }
+  return full;
+}
+
+function removeFile(root, session, box, name) {
+  const full = resolveExisting(root, session, box, name);
+  if (!full) return false;
+  fs.unlinkSync(full);
+  return true;
+}
+
+module.exports = {
+  isValidSession, sanitizeName, stamp, boxDir, ensureBox,
+  saveUpload, listBox, resolveExisting, removeFile, BOXES,
+};

package/lib/files/watcher.js

@@ -0,0 +1,69 @@
+'use strict';
+// Osserva <root>/<sessione>/outbox per tutte le sessioni presenti su disco.
+// fs.watch dove disponibile (con debounce); il polling periodico e' la rete
+// di sicurezza che copre anche i filesystem dove fs.watch non funziona.
+const fs = require('node:fs');
+const path = require('node:path');
+const { EventEmitter } = require('node:events');
+const { listBox } = require('./store.js');
+
+function createOutboxWatcher({ root, pollMs = 5000, debounceMs = 300 }) {
+  const em = new EventEmitter();
+  const watchers = new Map();
+  const timers = new Map();
+  const summary = {};
+  let closed = false;
+
+  function rescan(session) {
+    if (closed) return;
+    const files = listBox(root, session, 'outbox') || [];
+    const snap = { count: files.length, latest: files.length ? files[0].mtime : 0 };
+    const prev = summary[session];
+    summary[session] = snap;
+    if (!prev || prev.count !== snap.count || prev.latest !== snap.latest) {
+      em.emit('change', session, files);
+    }
+  }
+
+  function bump(session) {
+    clearTimeout(timers.get(session));
+    timers.set(session, setTimeout(() => rescan(session), debounceMs));
+  }
+
+  function ensureWatch(session) {
+    if (watchers.has(session)) return;
+    try {
+      const w = fs.watch(path.join(root, session, 'outbox'), () => bump(session));
+      w.on('error', () => { try { w.close(); } catch (_) {} watchers.delete(session); });
+      watchers.set(session, w);
+    } catch (_) { /* il polling copre */ }
+  }
+
+  function scanAll() {
+    if (closed) return;
+    let names = [];
+    try {
+      names = fs.readdirSync(root, { withFileTypes: true })
+        .filter((d) => d.isDirectory()).map((d) => d.name);
+    } catch (_) { return; }
+    for (const session of names) { ensureWatch(session); rescan(session); }
+  }
+
+  scanAll();
+  const timer = setInterval(scanAll, pollMs);
+  if (timer.unref) timer.unref();
+
+  return {
+    on: (ev, fn) => em.on(ev, fn),
+    getSummary: () => ({ ...summary }),
+    close: () => {
+      closed = true;
+      clearInterval(timer);
+      for (const t of timers.values()) clearTimeout(t);
+      for (const w of watchers.values()) { try { w.close(); } catch (_) {} }
+      watchers.clear();
+    },
+  };
+}
+
+module.exports = { createOutboxWatcher };

package/lib/fleet/exec.js

@@ -0,0 +1,32 @@
+'use strict';
+const { execFile } = require('node:child_process');
+
+// Esecutore serializzato del binario fleet: UNA invocazione alla volta
+// (fleet tocca systemd/tmux reali: due comandi concorrenti = stato incoerente),
+// timeout duro, stderr propagato nell'errore. Argomenti SEMPRE array (no shell).
+function createFleetExec(bin, { timeoutMs = 15000 } = {}) {
+  let chain = Promise.resolve();
+
+  function exec(args) {
+    return new Promise((resolve, reject) => {
+      execFile(bin, args, { timeout: timeoutMs, killSignal: 'SIGKILL' }, (err, stdout, stderr) => {
+        if (err) {
+          if (err.killed || err.signal === 'SIGKILL') return reject(new Error('fleet timeout'));
+          return reject(new Error(`fleet ${args.join(' ')} failed: ${String(stderr || err.message).trim()}`));
+        }
+        resolve(String(stdout));
+      });
+    });
+  }
+
+  function run(args) {
+    const next = chain.then(() => exec(args));
+    // la coda non si spezza sugli errori (catch), ma il chiamante li vede
+    chain = next.catch(() => {});
+    return next;
+  }
+
+  return { run };
+}
+
+module.exports = { createFleetExec };