@mmmbuto/nexuscrew 0.7.6 → 0.8.0

package/lib/cli/doctor.js

@@ -0,0 +1,160 @@
+'use strict';
+// nexuscrew doctor: auto-diagnosi (design §3, §7). [A2]
+// Struttura ESTENSIBILE: una lista di check-fn, ognuna ritorna
+//   { name, ok, warn?, detail? }. B0 aggiungerà i check tunnel/ssh (permitlisten,
+//   OpenSSH ≥7.8 sul rendezvous) appendendo alla lista, senza toccare il resto.
+// Exit code: 0 se tutti ok (i warn non falliscono), 1 se almeno un check è FAIL.
+// Nessun segreto nell'output (mai il token, solo il path + i permessi).
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { detectPlatform, uid } = require('./platform.js');
+const { installPath } = require('./service.js');
+const { resolvePaths } = require('./url.js');
+const { commandExists } = require('./path.js');
+
+function nodeMajor() {
+  return parseInt(String(process.versions.node).split('.')[0], 10);
+}
+
+function checkNode() {
+  const maj = nodeMajor();
+  return { name: 'node >= 18', ok: maj >= 18, detail: `v${process.versions.node}` };
+}
+
+function checkTmux(existsImpl, tmuxBin) {
+  return existsImpl(tmuxBin || 'tmux')
+    ? { name: 'tmux presente', ok: true }
+    : { name: 'tmux presente', ok: false, detail: 'non trovato su PATH (installa tmux)' };
+}
+
+function checkPty(ptyLoad) {
+  try {
+    ptyLoad();
+    return { name: 'PTY prebuilt caricabile', ok: true };
+  } catch (e) {
+    return { name: 'PTY prebuilt caricabile', ok: false, detail: e && e.message ? e.message : 'load fallito' };
+  }
+}
+
+function checkService(platform, home, execImpl, uidVal, installPathOverride) {
+  const target = installPathOverride || installPath(platform, home);
+  const installed = fs.existsSync(target);
+  let active = false;
+  try {
+    if (platform === 'linux') {
+      const s = execImpl('systemctl', ['--user', 'is-active', 'nexuscrew'], { encoding: 'utf8' });
+      active = String(s).trim() === 'active';
+    } else if (platform === 'mac') {
+      execImpl('launchctl', ['print', `gui/${uidVal}/com.mmmbuto.nexuscrew`], { stdio: 'ignore' });
+      active = true;
+    } else if (platform === 'termux') {
+      const pidf = require('./pidfile.js');
+      const meta = pidf.readPidfile(pidf.defaultPidfilePath());
+      active = !!(meta && pidf.isAlive(meta));
+    }
+  } catch (_) { active = false; }
+  return {
+    name: 'service installato/attivo',
+    ok: installed,
+    warn: installed && !active, // installato ma non attivo = warning, non fail
+    detail: installed ? (active ? 'attivo' : 'installato ma non attivo') : `non installato (${target})`,
+  };
+}
+
+function checkBoot(platform, home, execImpl) {
+  if (platform === 'termux') {
+    const p = path.join(home, '.termux', 'boot', 'nexuscrew.sh');
+    const ok = fs.existsSync(p);
+    return { name: 'boot script', ok, warn: !ok, detail: ok ? p : 'nessun Termux:boot script' };
+  }
+  if (platform === 'linux') {
+    try {
+      const s = execImpl('systemctl', ['--user', 'is-enabled', 'nexuscrew'], { encoding: 'utf8' });
+      const enabled = String(s).trim() === 'enabled';
+      return { name: 'boot (systemd enabled)', ok: true, warn: !enabled, detail: enabled ? 'enabled' : 'non enabled (non parte al boot)' };
+    } catch (_) {
+      return { name: 'boot (systemd enabled)', ok: true, warn: true, detail: 'non enabled' };
+    }
+  }
+  // mac: RunAtLoad nel plist installato
+  const target = installPath('mac', home);
+  const ok = fs.existsSync(target);
+  return { name: 'boot (launchd RunAtLoad)', ok: true, warn: !ok, detail: ok ? 'plist installato' : 'plist non installato' };
+}
+
+// ssh client presente su PATH: prerequisito dei tunnel multi-node (design §4).
+function checkSshClient(existsImpl) {
+  return existsImpl('ssh')
+    ? { name: 'ssh client presente', ok: true }
+    : { name: 'ssh client presente', ok: false, detail: 'ssh non trovato su PATH (necessario per i tunnel multi-node)' };
+}
+
+// OpenSSH >=7.8 per permitlisten (vincola i -R lato rendezvous; design §7 (a)).
+// Determinabile e <7.8 -> FAIL (il ruolo node non e' abilitabile). Non
+// determinabile -> WARN (verifica manuale), non blocca la diagnosi generale.
+function checkSshPermitlisten(sshVersionImpl) {
+  const tun = require('../nodes/tunnel.js');
+  const v = tun.readSshVersion(sshVersionImpl);
+  const supp = tun.sshSupportsPermitlisten(v);
+  if (supp === null) {
+    return { name: 'OpenSSH permitlisten (>=7.8)', ok: true, warn: true, detail: 'versione ssh non determinabile — verifica prima di abilitare il ruolo node' };
+  }
+  if (supp) return { name: 'OpenSSH permitlisten (>=7.8)', ok: true, detail: v.raw };
+  return { name: 'OpenSSH permitlisten (>=7.8)', ok: false, detail: `OpenSSH ${v.major}.${v.minor} < 7.8 — permitlisten non supportato (ruolo node non abilitabile)` };
+}
+
+function checkTokenPerms(tokenPath) {
+  try {
+    const st = fs.lstatSync(tokenPath);
+    if (st.isSymbolicLink()) {
+      return { name: 'token file permessi', ok: false, detail: 'è un symlink (rifiutato)' };
+    }
+    const mode = st.mode & 0o777;
+    const ok = mode === 0o600;
+    return { name: 'token file permessi', ok, detail: `mode 0${mode.toString(8)}${ok ? '' : ' (atteso 0600)'}` };
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      return { name: 'token file permessi', ok: false, detail: 'token assente (esegui init)' };
+    }
+    return { name: 'token file permessi', ok: false, detail: e.message };
+  }
+}
+
+// Esegue tutti i check. Seam iniettabili per test (platform, home, execImpl, ptyLoad).
+function doctor(opts = {}) {
+  const platform = opts.platform || detectPlatform();
+  const home = opts.home || os.homedir();
+  const execImpl = opts.execImpl || execFileSync;
+  const uidVal = opts.uid || uid();
+  const log = opts.log || console.log;
+  const ptyLoad = opts.ptyLoad || (() => require('../pty/provider.js').loadPty());
+  const existsImpl = opts.commandExists || commandExists;
+  const { tokenPath } = resolvePaths(opts);
+
+  const checks = [
+    checkNode(),
+    checkTmux(existsImpl, opts.tmuxBin),
+    checkPty(ptyLoad),
+    checkService(platform, home, execImpl, uidVal, opts.installPath),
+    checkBoot(platform, home, execImpl),
+    checkTokenPerms(tokenPath),
+    checkSshClient(existsImpl),
+    checkSshPermitlisten(opts.sshVersion),
+  ];
+
+  for (const c of checks) {
+    const tag = c.ok ? (c.warn ? 'WARN' : 'OK  ') : 'FAIL';
+    log(`${tag}  ${c.name}${c.detail ? ' — ' + c.detail : ''}`);
+  }
+  const ok = checks.every((c) => c.ok); // i warn non fanno fallire
+  log(ok ? 'doctor: tutto ok' : 'doctor: problemi rilevati (vedi FAIL sopra)');
+  return { platform, checks, ok, code: ok ? 0 : 1 };
+}
+
+module.exports = {
+  doctor, nodeMajor,
+  checkNode, checkTmux, checkPty, checkService, checkBoot, checkTokenPerms,
+  checkSshClient, checkSshPermitlisten,
+};

package/lib/cli/fleet-service.js

@@ -0,0 +1,319 @@
+'use strict';
+// B4.3 — Service companion (boot) generation + migration gate. Design §4c / §9b.
+//
+// generateFleetService({platform, nodeBin, entryPath}) genera il contenuto del
+// service UNICO di boot (NON una unit per cella) che al boot esegue
+//     <node> <entry> fleet-boot
+// seguendo ESATTAMENTE i pattern/escaping di lib/cli/service.js:
+//   linux  -> systemd --user  'nexuscrew-fleet.service'  (Type=oneshot)
+//   mac    -> launchd plist   'com.mmmbuto.nexuscrew-fleet.plist' (RunAtLoad)
+//   termux -> script          '~/.termux/boot/nexuscrew-fleet.sh'
+//
+// migrationGate({exec, platform}) rileva unit legacy 'cloud-cell@*.service'
+// abilitate (systemctl --user list-unit-files --state=enabled, via execFile —
+// MAI shell string). Se presenti -> {blocked:true, units, remediation}: il
+// companion NON va installato (design 9b: mai doppio boot silenzioso). Su
+// piattaforme senza systemd il gate passa. `exec` e' iniettabile per testabilita'.
+//
+// Nessun side-effect all'import e NESSUNA installazione reale qui (solo generazione
+// contenuto + gate). L'installazione e' demandata al flusso init (separato).
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const {
+  escapeSystemdPath, escapeSystemdExec, escapeXml, shellQuote, assertSystemdSafe,
+} = require('./service.js');
+const { uid } = require('./platform.js');
+
+// entryPath e' tipicamente <repoRoot>/bin/nexuscrew.js -> repoRoot = dirname x2.
+function deriveRepoRoot(entryPath) {
+  return path.dirname(path.dirname(entryPath));
+}
+
+function generateFleetService(opts) {
+  const platform = opts && opts.platform;
+  if (platform === 'linux') return generateFleetLinux(opts);
+  if (platform === 'mac') return generateFleetMac(opts);
+  if (platform === 'termux') return generateFleetTermux(opts);
+  throw new Error(`unsupported platform: ${platform}`);
+}
+
+function generateFleetLinux(opts) {
+  const repoRoot = opts.repoRoot || deriveRepoRoot(opts.entryPath);
+  const { nodeBin, entryPath } = opts;
+  // Parita' di hardening con service.js (M3): reject char non gestibili in systemd.
+  assertSystemdSafe('repoRoot', repoRoot);
+  assertSystemdSafe('nodeBin', nodeBin);
+  assertSystemdSafe('entryPath', entryPath);
+  const repo = escapeSystemdPath(repoRoot);
+  const node = escapeSystemdExec(nodeBin);
+  const entry = escapeSystemdExec(entryPath);
+  const nodeDir = escapeSystemdPath(path.dirname(nodeBin));
+  return `# NexusCrew fleet boot companion (systemd --user) - avvia le celle boot:true
+[Unit]
+Description=NexusCrew fleet boot companion (avvia le celle boot:true)
+After=network-online.target
+
+[Service]
+Type=oneshot
+WorkingDirectory=${repo}
+Environment=PATH=${nodeDir}:/usr/local/bin:/usr/bin:/bin
+ExecStart=${node} ${entry} fleet-boot
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+function generateFleetMac(opts) {
+  const repoRoot = opts.repoRoot || deriveRepoRoot(opts.entryPath);
+  const home = opts.home || os.homedir();
+  const nodeXml = escapeXml(opts.nodeBin);
+  const entryXml = escapeXml(opts.entryPath);
+  const repoXml = escapeXml(repoRoot);
+  const homeXml = escapeXml(home);
+  const launchPath = [...new Set([
+    path.dirname(opts.nodeBin), '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin',
+  ])].join(':');
+  const launchPathXml = escapeXml(launchPath);
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.mmmbuto.nexuscrew-fleet</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nodeXml}</string>
+    <string>${entryXml}</string>
+    <string>fleet-boot</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${repoXml}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${launchPathXml}</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${homeXml}/.nexuscrew/fleet-boot.log</string>
+  <key>StandardErrorPath</key>
+  <string>${homeXml}/.nexuscrew/fleet-boot.log</string>
+</dict>
+</plist>
+`;
+}
+
+function generateFleetTermux(opts) {
+  const repoRoot = opts.repoRoot || deriveRepoRoot(opts.entryPath);
+  const nodeQ = shellQuote(opts.nodeBin);
+  const entryQ = shellQuote(opts.entryPath);
+  const repoQ = shellQuote(repoRoot);
+  return `#!/data/data/com.termux/files/usr/bin/sh
+# NexusCrew fleet boot companion (Termux) - avvia le celle boot:true
+export PATH=/data/data/com.termux/files/usr/bin:$PATH
+export HOME=/data/data/com.termux/files/home
+cd -- ${repoQ}
+exec ${nodeQ} ${entryQ} fleet-boot >> "$HOME/.nexuscrew/fleet-boot.log" 2>&1
+`;
+}
+
+// Default exec per il gate: execFileSync (argv diretto, MAI shell string).
+function defaultListEnabled(bin, args, opts) {
+  return execFileSync(bin, args, opts);
+}
+
+// Migration gate (design 9b): blocca l'installazione del companion se ci sono
+// unit legacy cloud-cell@*.service abilitate (mai doppio boot silenzioso).
+//   opts.exec     — funzione iniettabile con firma execFileSync(bin, args, opts)
+//   opts.platform — se !== 'linux' il gate passa (no systemd -> no rischio)
+// Ritorna {blocked, units[], remediation?|reason?}.
+function migrationGate(opts = {}) {
+  const { exec, platform } = opts;
+  if (platform && platform !== 'linux') {
+    return { blocked: false, units: [], reason: `platform ${platform}: no systemd, gate skipped` };
+  }
+  const execImpl = typeof exec === 'function' ? exec : defaultListEnabled;
+
+  let stdout;
+  try {
+    stdout = execImpl('systemctl',
+      ['--user', 'list-unit-files', '--state=enabled', 'cloud-cell@*'],
+      { encoding: 'utf8' });
+  } catch (e) {
+    // systemctl assente / ambiente non systemd-user: nessuna evidenza di unit
+    // legacy -> il gate passa (non blocca su assenza di informazioni).
+    return { blocked: false, units: [], reason: `gate skipped: ${e && e.message ? e.message : 'command error'}` };
+  }
+
+  const units = [];
+  for (const line of String(stdout || '').split('\n')) {
+    const tok = line.trim().split(/\s+/)[0];
+    if (tok && /^cloud-cell@.+\.service$/.test(tok)) units.push(tok);
+  }
+
+  if (units.length) {
+    return {
+      blocked: true,
+      units,
+      remediation: 'disabilita le unit legacy cloud-cell@*.service (systemctl --user disable "cloud-cell@*") o usa il fleet esterno; il companion nexuscrew-fleet.service non va installato per evitare doppio boot',
+    };
+  }
+  return { blocked: false, units: [], reason: 'nessuna unit cloud-cell@*.service abilitata' };
+}
+
+// --- selectProviderModeSync — resolver SINCRONO del mode del provider ---
+// Speculare alla logica di selectProvider (lib/fleet/provider.js) ma SENZA spawn/await.
+// Necessario: runInit e' sync (bin/nexuscrew.js chiama process.exit subito dopo dispatch
+// per 'init'; selectProvider e' async e non sopravvive al process.exit). E' il default
+// del seam opts.selectProvider del companion (iniettabile per i test).
+//
+// Divergenza documentata vs selectProvider: la responsivita' del fleet esterno
+// (status --json) richiederebbe spawn async; qui un fleetBin FIDATO (binTrusted, sync)
+// -> external. Scelta CONSERVATIVA sicura (no-doppio-boot, §9b): se c'e' un fleet
+// esterno fidato configurato, NON installiamo il companion builtin.
+// Ritorna {mode, reason} con mode in 'external' | 'builtin' | 'disabled'.
+function selectProviderModeSync(cfg = {}) {
+  if (cfg.fleetEnabled === false) {
+    return { mode: 'disabled', reason: 'fleet disabilitato (fleetEnabled=false)' };
+  }
+  const forced = (cfg.fleetProvider || process.env.NEXUSCREW_FLEET_PROVIDER || '').toLowerCase() || null;
+
+  // external: binario fidato (regular file, exec, non world-writable, no symlink).
+  // lazy-require: niente costo/accoppiamento all'import del modulo (usato solo dal companion).
+  const { binTrusted } = require('../fleet/index.js'); // sync (audit F3)
+  const extTrusted = !!(cfg.fleetBin && binTrusted(cfg.fleetBin));
+
+  // builtin: fleet.json valido (loadDefinitions e' sync; garbage -> null = fail-closed).
+  const { loadDefinitions } = require('../fleet/definitions.js');
+  const home = cfg.home || os.homedir();
+  const defsPath = cfg.fleetDefsPath || path.join(home, '.nexuscrew', 'fleet.json');
+  const builtinAvail = cfg.builtinEnabled !== false ? !!loadDefinitions(defsPath) : false;
+
+  // forced: fail-closed se il richiesto non e' disponibile (§9g: niente auto-fallback).
+  if (forced === 'external') {
+    return extTrusted
+      ? { mode: 'external', reason: 'forced external (binario fidato)' }
+      : { mode: 'disabled', reason: 'fail-closed: forced external non fidato (§9g)' };
+  }
+  if (forced === 'builtin') {
+    return builtinAvail
+      ? { mode: 'builtin', reason: 'forced builtin (fleet.json valido)' }
+      : { mode: 'disabled', reason: 'fail-closed: forced builtin ma fleet.json invalido/mancante (§9g)' };
+  }
+  if (forced === 'disabled') return { mode: 'disabled', reason: 'forced disabled' };
+  if (forced) return { mode: 'disabled', reason: `fail-closed: provider forzato "${forced}" non riconosciuto` };
+
+  // auto: external fidato vince (no-doppio-boot), poi builtin, poi disabled.
+  if (extTrusted) return { mode: 'external', reason: 'auto: external fidato configurato (skip companion)' };
+  if (builtinAvail) return { mode: 'builtin', reason: 'auto: builtin (fleet.json valido)' };
+  return { mode: 'disabled', reason: 'auto: nessun provider disponibile (no external fidato, no fleet.json)' };
+}
+
+// --- Install (speculare a installService di lib/cli/service.js) ---
+// Stesso hardening di service.js: no-symlink atomic (lstat + tmp+rename), failure
+// collection (NON ingoiare activation — M1), execImpl iniettabile (test). Differenze
+// companion:
+//  - nomi 'nexuscrew-fleet.*' + mode termux 0o755 (boot script eseguibile)
+//  - linux: daemon-reload + enable, NESSUN restart (Type=oneshot -> parte al boot)
+//  - mac: bootout + bootstrap (idempotente come service.js)
+// Nessuna installazione reale all'import: il companion e' installato dal flusso init.
+
+function fleetInstallPath(platform, home) {
+  if (platform === 'linux') return path.join(home, '.config', 'systemd', 'user', 'nexuscrew-fleet.service');
+  if (platform === 'mac') return path.join(home, 'Library', 'LaunchAgents', 'com.mmmbuto.nexuscrew-fleet.plist');
+  if (platform === 'termux') return path.join(home, '.termux', 'boot', 'nexuscrew-fleet.sh');
+  throw new Error(`unsupported platform: ${platform}`);
+}
+
+function fleetFileMode(platform) {
+  if (platform === 'termux') return 0o755; // boot script eseguibile (design §4c: chmod 755)
+  return 0o644;                            // systemd unit + launchd plist (come service.js)
+}
+
+function fleetInstallCommands(platform, target, ctx) {
+  if (platform === 'linux') {
+    return [
+      ['systemctl', ['--user', 'daemon-reload']],
+      ['systemctl', ['--user', 'enable', 'nexuscrew-fleet.service']],
+      // NESSUN restart: Type=oneshot — il companion avvia le celle boot:true al boot.
+    ];
+  }
+  if (platform === 'mac') {
+    const domain = `gui/${ctx.uid || uid()}`;
+    const label = `${domain}/com.mmmbuto.nexuscrew-fleet`;
+    return [
+      ['launchctl', ['bootout', label]],      // idempotente: ignorato se non caricato
+      ['launchctl', ['bootstrap', domain, target]],
+    ];
+  }
+  if (platform === 'termux') {
+    return []; // nessun service manager; boot script + app Termux:Boot (start manuale)
+  }
+  return [];
+}
+
+// Install no-symlink + atomic rename (come service.js). execImpl iniettabile per test;
+// default execFileSync (argv diretto, MAI shell string). Su activation fallita il file
+// e' PRESERVATO e le failure raccolte per diagnosi (M1: non si ingoia, non si rollback).
+function installFleetService(platform, content, ctx, { dryRun = false, execImpl = execFileSync } = {}) {
+  const home = ctx.home || os.homedir();
+  const target = ctx.installPath || fleetInstallPath(platform, home);
+  const mode = fleetFileMode(platform);
+
+  // lstat: reject symlink preesistente (no-symlink atomic, parita' service.js [M3])
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink()) {
+      throw new Error(`refusing symlink install target: ${target}`);
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+  }
+
+  if (dryRun) {
+    return { target, mode, written: false, failures: [], note: 'dry-run: nessuna scrittura' };
+  }
+
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  const tmp = target + '.tmp.' + process.pid; // stessa dir -> atomic rename su stesso FS
+  try {
+    fs.writeFileSync(tmp, content, { mode });
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, target); // atomic
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {} // cleanup temp su failure [m1]
+    throw e;
+  }
+
+  // exec service manager — raccogli failure per diagnosi (NON ingoiare, M1)
+  const cmds = fleetInstallCommands(platform, target, ctx);
+  const failures = [];
+  for (const [bin, args] of cmds) {
+    try { execImpl(bin, args, { stdio: 'ignore' }); }
+    catch (e) {
+      if (platform === 'mac' && bin === 'launchctl' && args[0] === 'bootout') continue;
+      failures.push({ cmd: `${bin} ${args.join(' ')}`, error: e.message });
+    }
+  }
+
+  return { target, mode, written: true, failures };
+}
+
+module.exports = {
+  generateFleetService,
+  generateFleetLinux,
+  generateFleetMac,
+  generateFleetTermux,
+  migrationGate,
+  deriveRepoRoot,
+  installFleetService,
+  fleetInstallPath,
+  fleetFileMode,
+  fleetInstallCommands,
+  selectProviderModeSync,
+};

package/lib/cli/init.js

@@ -3,18 +3,25 @@
 // detectPlatform -> prereq (Node>=18 abort, tmux abort-before-service) ->
 // migration rule (porta da service esistente) -> config.json (preserva) ->
 // token (preserva) -> NexusFiles -> generateService -> installService (skip dry-run) ->
-// print URL #token. Termux:boot detection best-effort.
+// [B4.3] fleet companion (solo se provider builtin + gate ok; READONLY/dry-run skip;
+//   mai fa fallire l'init principale) -> print URL #token. Termux:boot best-effort.
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { execFileSync } = require('node:child_process');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('./platform.js');
 const { loadOrCreateToken } = require('../auth/token.js');
 const { generateService, installService, fileMode, installPath: svcInstallPath } = require('./service.js');
-
-function haveTmux(tmuxBin) {
-  try { execFileSync('command', ['-v', tmuxBin], { stdio: 'ignore', shell: true }); return true; }
-  catch (_) { return false; }
+// B4.3 — companion di boot del fleet (design §4c/§9b/§9d). Seam iniettabili per test.
+const {
+  generateFleetService, installFleetService, migrationGate,
+  selectProviderModeSync, fleetFileMode,
+} = require('./fleet-service.js');
+const { atomicWrite: writeFleet } = require('../fleet/definitions.js');
+const { defaultDefinitions } = require('../fleet/managed.js');
+const { commandExists } = require('./path.js');
+
+function haveTmux(tmuxBin, env = process.env) {
+  return commandExists(tmuxBin, env);
 }
 
 function nodeMajor() {
@@ -81,6 +88,20 @@ function runInit(opts = {}) {
       actions.push(`preserved config ${configPath} (port ${port})`);
     }
   }
+
+  // Fleet app defaults: soltanto i due client nativi. Provider cloud/Z.AI sono
+  // disponibili nel catalogo managed ma vanno aggiunti esplicitamente.
+  const fleetDefsPath = opts.fleetDefsPath || path.join(configDir, 'fleet.json');
+  if (!dryRun && !fs.existsSync(fleetDefsPath)) {
+    try {
+      writeFleet(fleetDefsPath, defaultDefinitions());
+      actions.push(`created fleet defaults ${fleetDefsPath} (claude.native, codex-vl.native)`);
+    } catch (e) {
+      actions.push(`WARN: fleet defaults non creati: ${e.message}`);
+    }
+  } else if (!dryRun) {
+    actions.push(`preserved fleet definitions ${fleetDefsPath}`);
+  }
   if (!port) port = 41820;
 
   // token (preserva esistente) [M4]
@@ -98,6 +119,22 @@ function runInit(opts = {}) {
     actions.push(`files root ${filesRoot}`);
   }
 
+  // nodes.json (B0): nodeId STABILE per installazione (generato qui se manca) +
+  // migrazione esplicita guarded dei nodes legacy da config.json. READONLY/dry-run
+  // saltano; ogni errore -> WARN, MAI far fallire l'init.
+  if (!dryRun && process.env.NEXUSCREW_READONLY !== '1' && !opts.readonly) {
+    try {
+      const nstore = require('../nodes/store.js');
+      const nodesPath = opts.nodesPath || path.join(configDir, 'nodes.json');
+      const st = nstore.loadOrInitStore(nodesPath);
+      actions.push(`nodes.json ok (${nodesPath}, nodeId ${st.nodeId.slice(0, 8)}…)`);
+      const mig = nstore.migrateLegacyNodes(configPath, nodesPath);
+      if (mig.migrated) actions.push(`nodes: migrati ${mig.count} nodi legacy da config.json`);
+    } catch (e) {
+      actions.push(`WARN: nodes.json init/migrazione fallita: ${e.message} (init prosegue)`);
+    }
+  }
+
   // service generation
   const svcCtx = {
     repoRoot: repoRoot(),
@@ -127,6 +164,67 @@ function runInit(opts = {}) {
     }
   }
 
+  // --- B4.3 companion: service di boot del fleet (design §4c/§9b/§9d) ---
+  // Il companion si installa SOLO se il provider e' builtin (§9b) e il migration
+  // gate non rileva unit legacy cloud-cell@*.service abilitate (no doppio boot).
+  // READONLY blocca ogni azione del companion (§9d). MAI far fallire l'init
+  // principale: ogni errore del companion -> WARN action + return normale.
+  try {
+    const readonly = process.env.NEXUSCREW_READONLY === '1' || opts.readonly;
+    if (readonly) {
+      actions.push('fleet companion: READONLY, non installato');
+    } else {
+      // provider mode: companion SOLO se builtin (§9b). selectProviderModeSync e'
+      // il default SINCRONO (runInit e' sync: bin chiama process.exit dopo dispatch,
+      // selectProvider async non sopravvive). Seam opts.selectProvider per i test.
+      const selectProvider = opts.selectProvider || selectProviderModeSync;
+      const fleetCfg = opts.fleetCfg || {
+        home,
+        fleetEnabled: opts.fleetEnabled !== undefined ? opts.fleetEnabled : true,
+        fleetBin: opts.fleetBin || path.join(home, '.local', 'bin', 'fleet'),
+        fleetProvider: opts.fleetProvider || process.env.NEXUSCREW_FLEET_PROVIDER,
+        builtinEnabled: opts.builtinEnabled,
+        fleetDefsPath,
+      };
+      const sel = selectProvider(fleetCfg) || {};
+      if (sel.mode !== 'builtin') {
+        actions.push(`fleet companion: non installato (provider ${sel.mode})`);
+      } else {
+        // migration gate (§9b): seam opts.migrationGate iniettabile; default quello
+        // di fleet-service.js (exec iniettabile via opts.execImpl). blocked -> NON
+        // installare (mai doppio boot silenzioso).
+        const gate = (opts.migrationGate || migrationGate)({ exec: opts.execImpl, platform });
+        if (gate.blocked) {
+          actions.push(`WARN: fleet companion NON installato — migration gate bloccato: ${(gate.units || []).join(', ')} (${gate.remediation || 'disabilita le unit legacy cloud-cell@*.service'})`);
+        } else if (dryRun) {
+          actions.push('DRY-RUN fleet companion generato, NON installato');
+        } else {
+          const fleetContent = generateFleetService({
+            platform,
+            nodeBin: svcCtx.nodeBin,
+            entryPath: path.join(svcCtx.repoRoot, 'bin', 'nexuscrew.js'),
+            repoRoot: svcCtx.repoRoot,
+            home,
+          });
+          const fr = installFleetService(
+            platform, fleetContent,
+            { home, uid: uid(), installPath: opts.fleetInstallPath },
+            { execImpl: opts.execImpl },
+          );
+          if (fr.failures && fr.failures.length) {
+            // file installato MA activation (systemctl/launchctl) fallita [M1]
+            actions.push(`WARN: fleet companion file installato ${fr.target} MA activation fallita: ${fr.failures.map((f) => f.cmd).join('; ')} (file preservato, diagnosi)`);
+          } else {
+            actions.push(`fleet companion installed ${fr.target} (mode 0${fleetFileMode(platform).toString(8)})`);
+          }
+        }
+      }
+    }
+  } catch (e) {
+    // qualunque errore del companion: WARN + init principale prosegue intatto.
+    actions.push(`WARN: fleet companion fallito: ${e.message} (init principale prosegue)`);
+  }
+
   // Termux:boot best-effort detection (R4)
   if (platform === 'termux') {
     const bootDir = path.join(home, '.termux', 'boot');
@@ -139,7 +237,9 @@ function runInit(opts = {}) {
   const url = `http://127.0.0.1:${port}/`;
   const urlWithToken = token ? `${url}#token=${token}` : url;
   actions.push(`platform: ${platform}`);
-  actions.push(`URL: ${urlWithToken}`);
+  // printUrl:false -> non stampare l'URL col token (usato da smart-up, che presenta
+  // URL base + QR da se': cosi' l'output di smart-up non contiene il token in chiaro).
+  if (opts.printUrl !== false) actions.push(`URL: ${urlWithToken}`);
 
   for (const a of actions) log(a);
 

package/lib/cli/path.js

@@ -0,0 +1,24 @@
+'use strict';
+// Risoluzione eseguibili senza shell: nessun `command -v`, nessuna espansione
+// o concatenazione di input. Supporta path assoluti/espliciti e scan di PATH.
+const fs = require('node:fs');
+const path = require('node:path');
+
+function executable(p) {
+  try {
+    const st = fs.statSync(p);
+    if (!st.isFile()) return false;
+    fs.accessSync(p, fs.constants.X_OK);
+    return true;
+  } catch (_) { return false; }
+}
+
+function commandExists(bin, env = process.env) {
+  if (typeof bin !== 'string' || !bin || bin.includes('\0')) return false;
+  if (path.isAbsolute(bin) || bin.includes('/') || bin.includes('\\')) return executable(bin);
+  return String((env && env.PATH) || '').split(path.delimiter)
+    .filter(Boolean)
+    .some((dir) => executable(path.join(dir, bin)));
+}
+
+module.exports = { commandExists };