@mmmbuto/nexuscrew 0.7.7 → 0.8.0

package/lib/files/routes.js

@@ -1,10 +1,15 @@
 'use strict';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const express = require('express');
 const { Router } = require('express');
 const multer = require('multer');
 const store = require('./store.js');
 
 // Router file-exchange. Nessuno stato: tutto deriva da cfg + filesystem.
-function filesRoutes({ cfg, sessionExists, paste }) {
+// notifier (opzionale, MCP bridge): emette la notify di consegna file outbox.
+function filesRoutes({ cfg, sessionExists, paste, notifier }) {
   const router = Router();
   const upload = multer({
     storage: multer.memoryStorage(),
@@ -31,6 +36,55 @@ function filesRoutes({ cfg, sessionExists, paste }) {
     });
   });
 
+  // Consegna deliverable dal MCP bridge (nc_send_file): copia un file locale
+  // nell'outbox della sessione mittente. Path sorgente fail-closed: stringa
+  // assoluta, realpath ESISTENTE sotto HOME (i symlink si risolvono PRIMA del
+  // check: un link che esce da HOME viene rifiutato), file regolare.
+  // F3 (audit): gated READONLY — la copia e' una scrittura su disco; il gate
+  // sta PRIMA di ogni altro check (nessun probe di sessione/path in READONLY).
+  const bridgeReadonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  router.post('/outbox', express.json({ limit: '8kb' }), (req, res) => {
+    try {
+      if (bridgeReadonly()) {
+        return res.status(403).json({ error: 'READONLY: consegna file bloccata' });
+      }
+      const b = req.body || {};
+      const session = String(b.session || '');
+      if (!store.isValidSession(session) || !sessionExists(session)) {
+        return res.status(404).json({ error: 'sessione tmux inesistente' });
+      }
+      if (typeof b.path !== 'string' || !path.isAbsolute(b.path)) {
+        return res.status(400).json({ error: 'path deve essere assoluto' });
+      }
+      if (b.caption !== undefined && (typeof b.caption !== 'string' || b.caption.length > 500)) {
+        return res.status(400).json({ error: 'caption deve essere una stringa (max 500)' });
+      }
+      const home = cfg.home || os.homedir();
+      let src;
+      try { src = fs.realpathSync(b.path); } catch (_) {
+        return res.status(404).json({ error: 'file sorgente inesistente' });
+      }
+      const homeReal = fs.realpathSync(home);
+      if (src !== homeReal && !src.startsWith(homeReal + path.sep)) {
+        return res.status(400).json({ error: 'path fuori da HOME' });
+      }
+      if (!fs.statSync(src).isFile()) {
+        return res.status(400).json({ error: 'path non e\' un file regolare' });
+      }
+      const saved = store.saveDeliverable(cfg.filesRoot, session, src);
+      if (!saved) return res.status(400).json({ error: 'sessione invalida' });
+      // Notify best-effort (il badge outbox lo genera comunque il watcher).
+      if (notifier) {
+        notifier.emit({
+          title: `file da ${session}`,
+          body: b.caption ? `${saved.name} — ${b.caption}` : saved.name,
+          session,
+        }).catch(() => {});
+      }
+      res.json({ name: saved.name, box: 'outbox', size: saved.size });
+    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
+  });
+
   router.get('/', (req, res) => {
     const session = String(req.query.session || '');
     if (!store.isValidSession(session)) return res.status(400).json({ error: 'sessione invalida' });

package/lib/files/store.js

@@ -77,6 +77,21 @@ function saveUpload(root, session, buffer, origName, now = new Date()) {
   return { name, path: full, size: buffer.length };
 }
 
+// Consegna MCP bridge: copia un file gia' su disco nell'outbox della sessione
+// (badge/watcher scattano da soli). Naming identico a saveUpload (stamp +
+// sanitize + dedup) e COPYFILE_EXCL: mai overwrite. La validazione del path
+// sorgente (assoluto, sotto HOME, realpath) sta nella route, non qui.
+function saveDeliverable(root, session, srcPath, now = new Date()) {
+  const dir = ensureBox(root, session, 'outbox');
+  if (!dir) return null;
+  const base = `${stamp(now)}_${sanitizeName(path.basename(srcPath))}`;
+  let name = base;
+  for (let i = 1; fs.existsSync(path.join(dir, name)); i += 1) name = `${i}-${base}`;
+  const full = path.join(dir, name);
+  fs.copyFileSync(srcPath, full, fs.constants.COPYFILE_EXCL);
+  return { name, path: full, size: fs.statSync(full).size };
+}
+
 function listBox(root, session, box) {
   const dir = boxDir(root, session, box);
   if (!dir) return null;
@@ -123,5 +138,5 @@ function removeFile(root, session, box, name) {
 
 module.exports = {
   isValidSession, sanitizeName, stamp, boxDir, ensureBox,
-  saveUpload, listBox, resolveExisting, removeFile, BOXES,
+  saveUpload, saveDeliverable, listBox, resolveExisting, removeFile, BOXES,
 };

package/lib/fleet/builtin.js

@@ -28,6 +28,9 @@ const {
   parseDefinitions, validateCommandTrust, resolveCwd,
   loadDefinitions, atomicWrite, CAPS,
 } = require('./definitions.js');
+const {
+  CATALOG: MANAGED_CATALOG, describeManaged, resolveManagedEngine, discoverOllamaModels,
+} = require('./managed.js');
 
 const STATUS_TTL_MS = 2000;
 
@@ -183,11 +186,34 @@ async function injectPrompt(tmuxBin, session, prompt, { env, readyMs = 400, targ
 function draftFrom(defs) {
   return {
     schemaVersion: defs.schemaVersion,
-    engines: defs.engines.map((e) => ({ ...e })),
-    cells: defs.cells.map((c) => ({ ...c })),
+    engines: defs.engines.map((e) => ({
+      ...e,
+      ...(e.managed ? { managed: { ...e.managed } } : {}),
+      ...(e.args ? { args: [...e.args] } : {}),
+      ...(e.env ? { env: { ...e.env } } : {}),
+      ...(e.model ? { model: { ...e.model } } : {}),
+    })),
+    cells: defs.cells.map((c) => ({ ...c, ...(c.models ? { models: { ...c.models } } : {}) })),
   };
 }
 
+// Applica engine + modello come un'unica transizione. Ogni engine ricorda il
+// proprio ultimo modello; passando a un altro engine il modello vecchio non
+// attraversa mai il confine.
+function applyCellEngineModel(target, engineId, model, hasModel) {
+  const remembered = { ...(target.models || {}) };
+  target.engine = engineId;
+  if (hasModel) {
+    if (typeof model === 'string' && model) remembered[engineId] = model;
+    else delete remembered[engineId];
+  }
+  const selected = hasModel
+    ? (typeof model === 'string' ? model : '')
+    : (remembered[engineId] || '');
+  if (Object.keys(remembered).length) target.models = remembered; else delete target.models;
+  if (selected) target.model = selected; else delete target.model;
+}
+
 // ---------------------------------------------------------------------------
 // createBuiltinFleet(cfg) — async per parita' di contratto con createFleet.
 // cfg: { fleetDefsPath?, tmuxBin?, home?, builtinEnabled?, readonlyDefault?,
@@ -240,11 +266,25 @@ async function createBuiltinFleet(cfg = {}) {
       const alive = sessions.has(c.tmuxSession);
       return {
         cell: c.id, tmuxSession: c.tmuxSession, engine: c.engine,
+        model: c.model || '', models: { ...(c.models || {}) },
         active: alive, boot: c.boot, tmux: alive,
         rc: '', key: '', degraded: false, // builtin: cella "up" <=> sessione tmux viva
       };
     });
-    const engines = cache.defs.engines.map((e) => ({ id: e.id, label: e.label, rc: !!e.rc }));
+    const needsOllama = cache.defs.engines.some((e) => e.managed?.provider === 'ollama-cloud');
+    const ollamaModels = needsOllama ? await discoverOllamaModels({ ...cfg, home }) : [];
+    const engines = cache.defs.engines.map((e) => {
+      const managed = e.managed ? describeManaged(e.managed, { ...cfg, home }) : null;
+      return {
+        id: e.id, label: e.label, rc: !!e.rc,
+        ...(managed ? {
+          kind: 'managed', client: managed.client, provider: managed.provider,
+          model: e.managed.model || managed.defaultModel || '',
+          models: managed.provider === 'ollama-cloud' ? ollamaModels : managed.models,
+          configured: managed.configured, reason: managed.reason,
+        } : { kind: 'custom', configured: true, model: e.model?.value || '', models: [] }),
+      };
+    });
     return {
       available: true,
       provider: 'builtin',
@@ -269,10 +309,16 @@ async function createBuiltinFleet(cfg = {}) {
     if (!cell) throw httpError(400, `cella sconosciuta: ${cellId}`);
     const engine = findEngine(defs, cell.engine);
     if (!engine) throw httpError(400, `engine dangling per cella ${cellId}: ${cell.engine}`);
+    let launchEngine = engine;
+    if (engine.managed) {
+      const resolved = resolveManagedEngine(engine, cell, { ...cfg, home });
+      if (!resolved.ok) throw httpError(400, `engine managed non configurato (${engine.id}): ${resolved.reason}`);
+      launchEngine = resolved.engine;
+    }
 
     // (2) trust del command PRIMA di lanciare
-    const trust = validateCommandTrust(engine.command);
-    if (!trust.ok) throw httpError(400, `command non trusted (${engine.command}): ${trust.reason}`);
+    const trust = validateCommandTrust(launchEngine.command);
+    if (!trust.ok) throw httpError(400, `command non trusted (${launchEngine.command}): ${trust.reason}`);
     // (3) cwd reale sotto la home
     const realCwd = resolveCwd(cell.cwd, home);
     if (!realCwd) throw httpError(400, `cwd non valida (deve esistere sotto la home): ${cell.cwd}`);
@@ -281,28 +327,28 @@ async function createBuiltinFleet(cfg = {}) {
     // '-P -F #{pane_id}': tmux stampa il pane id della sessione appena creata,
     // cosi' l'iniezione del prompt bersaglia ESATTAMENTE quel pane (audit impl
     // #5: elimina la race di riuso del nome sessione tra waitAlive e paste).
-    const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine, cell });
+    const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine: launchEngine, cell });
     argv.splice(2, 0, '-P', '-F', '#{pane_id}');
     const launch = await tmuxExec(tmuxBin, argv, { env: minimalEnv() });
     if (launch.err) {
       // Redazione (§9h): lo stderr di tmux puo' ecoare argv/env del comando lanciato.
       const why = /duplicate session/i.test(launch.stderr)
         ? 'sessione già in esecuzione'
-        : `tmux new-session failed: ${redactSecrets(launch.stderr.trim() || launch.err.message, engine, cell)}`;
+        : `tmux new-session failed: ${redactSecrets(launch.stderr.trim() || launch.err.message, launchEngine, cell)}`;
       throw httpError(/duplicate/i.test(launch.stderr) ? 409 : 500, why);
     }
 
     // (6) prompt send-keys: bracketed-paste best-effort, target = pane id esatto
     // (fallback al nome sessione con match esatto '=' se tmux non ha stampato l'id).
     let prompt = null;
-    if (engine.promptMode === 'send-keys' && cell.prompt) {
+    if (launchEngine.promptMode === 'send-keys' && cell.prompt) {
       const paneId = launch.stdout.trim().split('\n')[0] || '';
       const target = paneId.startsWith('%') ? paneId : `=${cell.tmuxSession}`;
       prompt = await injectPrompt(tmuxBin, cell.tmuxSession, cell.prompt, {
         env: minimalEnv(),
         readyMs: cfg.sendKeysReadyMs != null ? cfg.sendKeysReadyMs : 400,
         target,
-        engine, cell, // per la redazione del reason se paste-buffer fallisce (§9h)
+        engine: launchEngine, cell, // per la redazione del reason se paste-buffer fallisce (§9h)
       });
     }
     cache = { ...cache, at: 0 };              // invalida: prossimo status rilegge tmux
@@ -332,13 +378,14 @@ async function createBuiltinFleet(cfg = {}) {
     return up(cellId);
   }
 
-  async function setEngine(cellId, engId) {
+  async function setEngine(cellId, engId, opts = {}) {
     if (readonly()) throw httpError(403, 'READONLY: engine bloccato');
     const defs = reloadDefs();
     if (!findCell(defs, cellId)) throw httpError(400, `cella sconosciuta: ${cellId}`);
     if (!findEngine(defs, engId)) throw httpError(400, `engine non valido: ${engId}`);
-    await mutate(defs, (d) => { findCell(d, cellId).engine = engId; });
-    return { ok: true };
+    await mutate(defs, (d) => applyCellEngineModel(findCell(d, cellId), engId, opts.model, typeof opts.model === 'string' && opts.model !== ''));
+    const saved = reloadDefs(); const target = findCell(saved, cellId);
+    return { ok: true, engine: engId, model: target.model || '' };
   }
 
   async function setBoot(cellId, enabled) {
@@ -359,13 +406,31 @@ async function createBuiltinFleet(cfg = {}) {
     await mutate(reloadDefs(), (d) => { d.engines.push(def); });
     return { ok: true, id: def.id };
   }
-  async function editEngine(id, patch) {
+  async function editEngine(id, patch, envChanges) {
     if (readonly()) throw httpError(403, 'READONLY: edit-engine bloccato');
     if (!id) throw httpError(400, 'id engine mancante');
     const defs = reloadDefs();
     if (!findEngine(defs, id)) throw httpError(400, `engine inesistente: ${id}`);
-    await mutate(defs, (d) => { Object.assign(findEngine(d, id), patch || {}); });
-    return { ok: true };
+    if (patch && (Object.prototype.hasOwnProperty.call(patch, 'id') || Object.prototype.hasOwnProperty.call(patch, 'env'))) {
+      throw httpError(400, 'id ed env non sono modificabili tramite patch generica');
+    }
+    await mutate(defs, (d) => {
+      const target = findEngine(d, id);
+      for (const [key, value] of Object.entries(patch || {})) {
+        if (value === null) delete target[key]; else target[key] = value;
+      }
+      if (envChanges !== undefined) {
+        if (!envChanges || typeof envChanges !== 'object' || Array.isArray(envChanges)) throw httpError(400, 'envChanges non valido');
+        const next = { ...(target.env || {}) };
+        for (const key of Array.isArray(envChanges.remove) ? envChanges.remove : []) delete next[key];
+        if (envChanges.set && typeof envChanges.set === 'object' && !Array.isArray(envChanges.set)) {
+          for (const [key, value] of Object.entries(envChanges.set)) next[key] = value;
+        }
+        target.env = next;
+      }
+    });
+    const sessions = await refreshSessions();
+    return { ok: true, activeCells: defs.cells.filter((c) => c.engine === id && sessions.has(c.tmuxSession)).map((c) => c.id) };
   }
   async function removeEngine(id) {
     if (readonly()) throw httpError(403, 'READONLY: remove-engine bloccato');
@@ -373,7 +438,14 @@ async function createBuiltinFleet(cfg = {}) {
     if (!findEngine(defs, id)) throw httpError(400, `engine inesistente: ${id}`);
     const used = defs.cells.filter((c) => c.engine === id);
     if (used.length) throw httpError(400, `engine in uso da ${used.length} cella/e: rimuovi prima la cella`);
-    await mutate(defs, (d) => { d.engines = d.engines.filter((e) => e.id !== id); });
+    await mutate(defs, (d) => {
+      d.engines = d.engines.filter((e) => e.id !== id);
+      for (const cell of d.cells) {
+        if (!cell.models || !Object.prototype.hasOwnProperty.call(cell.models, id)) continue;
+        delete cell.models[id];
+        if (!Object.keys(cell.models).length) delete cell.models;
+      }
+    });
     return { ok: true };
   }
 
@@ -389,17 +461,54 @@ async function createBuiltinFleet(cfg = {}) {
     if (!id) throw httpError(400, 'id cell mancante');
     const defs = reloadDefs();
     if (!findCell(defs, id)) throw httpError(400, `cell inesistente: ${id}`);
-    await mutate(defs, (d) => { Object.assign(findCell(d, id), patch || {}); });
-    return { ok: true };
+    if (patch && (Object.prototype.hasOwnProperty.call(patch, 'id') || Object.prototype.hasOwnProperty.call(patch, 'tmuxSession'))) {
+      throw httpError(400, 'id e tmuxSession sono immutabili');
+    }
+    await mutate(defs, (d) => {
+      const target = findCell(d, id);
+      const hasEngine = typeof patch?.engine === 'string';
+      const hasModel = Object.prototype.hasOwnProperty.call(patch || {}, 'model');
+      for (const [key, value] of Object.entries(patch || {})) {
+        if (key === 'engine' || key === 'model') continue;
+        if (value === null) delete target[key]; else target[key] = value;
+      }
+      if (hasEngine || hasModel) applyCellEngineModel(target, hasEngine ? patch.engine : target.engine, patch?.model, hasModel);
+    });
+    const sessions = await refreshSessions();
+    return { ok: true, active: sessions.has(findCell(defs, id).tmuxSession) };
   }
-  async function removeCell(id) {
+  async function removeCell(id, opts = {}) {
     if (readonly()) throw httpError(403, 'READONLY: remove-cell bloccato');
-    const defs = reloadDefs();
-    if (!findCell(defs, id)) throw httpError(400, `cell inesistente: ${id}`);
+    let defs = reloadDefs();
+    const cell = findCell(defs, id);
+    if (!cell) throw httpError(400, `cell inesistente: ${id}`);
+    const sessions = await refreshSessions();
+    if (sessions.has(cell.tmuxSession)) {
+      if (opts.stop !== true) throw httpError(409, 'cell attiva: conferma stop e rimozione');
+      await down(id);
+      defs = reloadDefs();
+    }
     await mutate(defs, (d) => { d.cells = d.cells.filter((c) => c.id !== id); });
     return { ok: true };
   }
 
+  // Vista editabile ma secret-safe: gli env values restano write-only.
+  function definitions() {
+    const defs = reloadDefs();
+    return {
+      schemaVersion: defs.schemaVersion,
+      engines: defs.engines.map((e) => {
+        const out = { ...e, envKeys: Object.keys(e.env || {}).sort() };
+        delete out.env;
+        if (e.managed) out.managedInfo = describeManaged(e.managed, { ...cfg, home });
+        return out;
+      }),
+      cells: defs.cells.map((c) => ({ ...c, ...(c.models ? { models: { ...c.models } } : {}) })),
+      managedCatalog: MANAGED_CATALOG.map((p) => ({ ...p })),
+      managedConfig: { providerSecretsPath: cfg.providerSecretsPath || path.join(home, '.nexuscrew', 'providers.env') },
+    };
+  }
+
   // Scrive il draft mutato; atomicWrite valida PRIMA (fail-closed). Su input
   // invalido: backup predecessore + throw -> httpError(400) (mai garbage).
   async function mutate(defs, mutator) {
@@ -421,10 +530,17 @@ async function createBuiltinFleet(cfg = {}) {
       schemaVersion: 1,
       caps: CAPS,
       engine: {
+        kind: { type: 'enum', values: ['managed', 'custom'], default: 'managed' },
         id: { type: 'string', required: true, pattern: '^[a-z0-9._-]{1,32}$', max: 32 },
         label: { type: 'string', required: false, max: CAPS.MAX_LABEL_LEN, default: '<id>' },
         rc: { type: 'boolean', required: false, default: false },
-        command: { type: 'string', required: true, max: CAPS.MAX_COMMAND_LEN, absolute: true },
+        managed: {
+          type: 'object', requiredFor: 'managed',
+          client: { type: 'enum', values: ['claude', 'codex-vl'] },
+          provider: { type: 'enum', values: ['native', 'ollama-cloud', 'zai-a', 'zai-p'] },
+          model: { type: 'string', required: false, max: CAPS.MAX_MODEL_VAL_LEN },
+        },
+        command: { type: 'string', requiredFor: 'custom', max: CAPS.MAX_COMMAND_LEN, absolute: true },
         args: { type: 'array', of: 'string', required: false, max: CAPS.MAX_ARGS, itemMax: CAPS.MAX_ARG_LEN },
         env: {
           type: 'object', required: false, maxKeys: CAPS.MAX_ENV_KEYS,
@@ -448,13 +564,14 @@ async function createBuiltinFleet(cfg = {}) {
         engine: { type: 'string', required: true, ref: 'engine.id' },
         boot: { type: 'boolean', required: false, default: false },
         model: { type: 'string', required: false, max: CAPS.MAX_MODEL_VAL_LEN },
+        models: { type: 'object', required: false, keyRef: 'engine.id', valueMax: CAPS.MAX_MODEL_VAL_LEN },
         prompt: { type: 'string', required: false, max: CAPS.MAX_PROMPT_LEN },
       },
     };
   }
 
   function capabilities() {
-    return ['status', 'up', 'down', 'restart', 'engine', 'boot', 'define', 'edit', 'remove', 'schema'];
+    return ['status', 'up', 'down', 'restart', 'engine', 'boot', 'define', 'edit', 'remove', 'schema', 'definitions'];
   }
 
   return {
@@ -463,7 +580,7 @@ async function createBuiltinFleet(cfg = {}) {
     status, up, down, restart, engine: setEngine, boot: setBoot, isCellSession,
     defineEngine, editEngine, removeEngine,
     defineCell, editCell, removeCell,
-    schema, capabilities,
+    schema, definitions, capabilities,
   };
 }
 

package/lib/fleet/definitions.js

@@ -11,6 +11,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { normalizeManagedSpec } = require('./managed.js');
 
 // --- Cap + identita' (dichiarati; ragionevoli per un file di flotta locale) ---
 const SCHEMA_VERSION = 1;
@@ -145,6 +146,17 @@ function parseEngine(e) {
     rc = e.rc;
   }
 
+  // Managed: NexusCrew conosce client/provider e compone internamente il
+  // processo. Nessun command/env/argv o segreto vive nella definizione.
+  if (e.managed !== undefined) {
+    const managed = normalizeManagedSpec(e.managed);
+    if (!managed) return null;
+    for (const key of ['command', 'args', 'env', 'promptMode', 'promptFlag', 'model']) {
+      if (e[key] !== undefined) return null;
+    }
+    return { id: e.id, label, rc, managed };
+  }
+
   // command (obbligatorio, stringa non vuota; il trust si verifica a parte)
   if (typeof e.command !== 'string' || !e.command || e.command.length > MAX_COMMAND_LEN) return null;
 
@@ -229,6 +241,19 @@ function parseCell(c, engineIds) {
     model = c.model;
   }
 
+  // Ultimo modello per engine, persistito per cella. Consente di tornare a un
+  // provider e ritrovare la scelta precedente senza trascinarla su altri engine.
+  let models = {};
+  if (c.models !== undefined) {
+    if (!c.models || typeof c.models !== 'object' || Array.isArray(c.models)) return null;
+    const entries = Object.entries(c.models);
+    if (entries.length > MAX_ENGINES) return null;
+    for (const [engineId, value] of entries) {
+      if (!engineIds.has(engineId) || typeof value !== 'string' || !value || value.length > MAX_MODEL_VAL_LEN) return null;
+      models[engineId] = value;
+    }
+  }
+
   // prompt (opzionale, cap)
   let prompt;
   if (c.prompt !== undefined) {
@@ -254,6 +279,7 @@ function parseCell(c, engineIds) {
 
   const out = { id: c.id, cwd: c.cwd, engine: c.engine, boot, tmuxSession };
   if (model !== undefined) out.model = model;
+  if (Object.keys(models).length) out.models = models;
   if (prompt !== undefined) out.prompt = prompt;
   return out;
 }

package/lib/fleet/managed.js

@@ -0,0 +1,211 @@
+'use strict';
+// Profili engine gestiti da NexusCrew. La configurazione descrive client e
+// provider; command/argv/env effettivi vengono composti qui, senza shell e senza
+// salvare segreti in fleet.json. I profili custom v1 restano supportati.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const OLLAMA_CLOUD_MODELS = Object.freeze([
+  'glm-5.2', 'kimi-k2.7-code', 'deepseek-v4-pro', 'minimax-m3',
+  'qwen3.5:397b', 'deepseek-v4-flash', 'mistral-large-3:675b', 'gemma4:31b',
+]);
+const OLLAMA_CONTEXT = Object.freeze({
+  'glm-5.2': 1000000,
+  'kimi-k2.7-code': 262144,
+  'deepseek-v4-pro': 524288,
+  'minimax-m3': 524288,
+  'qwen3.5:397b': 262144,
+  'deepseek-v4-flash': 1048576,
+  'mistral-large-3:675b': 262144,
+  'gemma4:31b': 262144,
+});
+
+const CATALOG = Object.freeze([
+  { id: 'claude.native', client: 'claude', provider: 'native', label: 'Claude · Native', auth: 'login', endpoint: 'Anthropic account', rc: true, default: true },
+  { id: 'codex-vl.native', client: 'codex-vl', provider: 'native', label: 'Codex-VL · Native', auth: 'login', endpoint: 'OpenAI account', rc: false, default: true },
+  { id: 'claude.ollama-cloud', client: 'claude', provider: 'ollama-cloud', label: 'Claude · Ollama Cloud Direct', auth: 'OLLAMA_API_KEY', endpoint: 'https://ollama.com', model: 'glm-5.2', models: OLLAMA_CLOUD_MODELS, rc: false, default: false },
+  { id: 'codex-vl.ollama-cloud', client: 'codex-vl', provider: 'ollama-cloud', label: 'Codex-VL · Ollama Cloud Direct', auth: 'OLLAMA_API_KEY', endpoint: 'https://ollama.com/v1', model: 'glm-5.2', models: OLLAMA_CLOUD_MODELS, rc: false, default: false },
+  { id: 'claude.zai-a', client: 'claude', provider: 'zai-a', label: 'Claude · Z.AI A', auth: 'ZAI_API_KEY_A', endpoint: 'https://api.z.ai/api/anthropic', model: 'glm-5.2[1m]', models: ['glm-5.2[1m]'], rc: false, default: false },
+  { id: 'claude.zai-p', client: 'claude', provider: 'zai-p', label: 'Claude · Z.AI P', auth: 'ZAI_API_KEY_P', endpoint: 'https://api.z.ai/api/anthropic', model: 'glm-5.2[1m]', models: ['glm-5.2[1m]'], rc: false, default: false },
+]);
+
+const byPair = (client, provider) => CATALOG.find((p) => p.client === client && p.provider === provider) || null;
+
+function normalizeManagedSpec(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const keys = Object.keys(value);
+  if (keys.some((k) => !['client', 'provider', 'model'].includes(k))) return null;
+  const profile = byPair(value.client, value.provider);
+  if (!profile) return null;
+  const model = value.model === undefined ? (profile.model || '') : value.model;
+  if (typeof model !== 'string' || model.length > 128) return null;
+  return { client: profile.client, provider: profile.provider, model };
+}
+
+function defaultDefinitions() {
+  return {
+    schemaVersion: 1,
+    engines: CATALOG.filter((p) => p.default).map((p) => ({
+      id: p.id, label: p.label, rc: p.rc,
+      managed: { client: p.client, provider: p.provider, model: p.model || '' },
+    })),
+    cells: [],
+  };
+}
+
+function parseEnvFile(file) {
+  const out = {};
+  let raw;
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink() || (st.mode & 0o077)) return out;
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (_) { return out; }
+  for (const line of raw.split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
+    if (!m) continue;
+    let value = m[2];
+    if ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"'))) value = value.slice(1, -1);
+    out[m[1]] = value;
+  }
+  return out;
+}
+
+function binaryCandidates(client, home) {
+  const prefix = process.env.PREFIX || '';
+  if (client === 'claude') return [path.join(home, '.local', 'bin', 'claude'), '/usr/local/bin/claude', '/opt/homebrew/bin/claude', prefix && path.join(prefix, 'bin', 'claude')].filter(Boolean);
+  return [path.join(home, '.local', 'bin', 'codex-vl'), '/usr/local/bin/codex-vl', '/opt/homebrew/bin/codex-vl', prefix && path.join(prefix, 'bin', 'codex-vl')].filter(Boolean);
+}
+
+function findBinary(client, home) {
+  for (const candidate of binaryCandidates(client, home)) {
+    try {
+      const real = fs.realpathSync(candidate);
+      const st = fs.lstatSync(real);
+      if (!st.isFile() || !(st.mode & 0o100) || (st.mode & 0o002)) continue;
+      if (typeof process.getuid === 'function' && st.uid !== process.getuid() && st.uid !== 0) continue;
+      return real;
+    } catch (_) { /* next */ }
+  }
+  return null;
+}
+
+function secretsPath(cfg, home) {
+  return cfg.providerSecretsPath || process.env.NEXUSCREW_PROVIDER_SECRETS
+    || path.join(home, '.nexuscrew', 'providers.env');
+}
+
+let ollamaCache = { at: 0, models: [] };
+async function discoverOllamaModels(opts = {}) {
+  const now = Date.now();
+  const ttl = opts.ttlMs === undefined ? 30000 : opts.ttlMs;
+  if (!opts.noCache && ollamaCache.models.length && now - ollamaCache.at < ttl) return [...ollamaCache.models];
+  const fetchImpl = opts.fetchImpl || globalThis.fetch;
+  if (typeof fetchImpl !== 'function') return [...OLLAMA_CLOUD_MODELS];
+  try {
+    const home = opts.home || require('node:os').homedir();
+    const apiKey = opts.apiKey || parseEnvFile(secretsPath(opts, home)).OLLAMA_API_KEY;
+    if (!apiKey) throw new Error('OLLAMA_API_KEY mancante');
+    const response = await fetchImpl('https://ollama.com/api/tags', {
+      headers: { authorization: `Bearer ${apiKey}` },
+      signal: typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(2500) : undefined,
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const body = await response.json();
+    const available = new Set();
+    for (const item of Array.isArray(body.models) ? body.models : []) {
+      const name = typeof item?.name === 'string' ? item.name : '';
+      if (!/^[A-Za-z0-9._-]+(?::[A-Za-z0-9._-]+)?$/.test(name) || name.length > 128) continue;
+      available.add(name);
+    }
+    // La API diretta espone molti modelli, inclusi modelli in deprecazione. La UI
+    // mantiene la shortlist TOP curata, ma solo se ancora realmente disponibile.
+    const models = OLLAMA_CLOUD_MODELS.filter((name) => available.has(name));
+    if (!models.length) throw new Error('nessun modello cloud');
+    ollamaCache = { at: now, models };
+    return [...models];
+  } catch (_) {
+    ollamaCache = { at: now, models: [...OLLAMA_CLOUD_MODELS] };
+    return [...OLLAMA_CLOUD_MODELS];
+  }
+}
+
+function describeManaged(spec, cfg = {}) {
+  const normalized = normalizeManagedSpec(spec);
+  if (!normalized) return { configured: false, reason: 'profilo managed non valido' };
+  const home = cfg.home || require('node:os').homedir();
+  const profile = byPair(normalized.client, normalized.provider);
+  const binary = findBinary(normalized.client, home);
+  const secretFile = secretsPath(cfg, home);
+  const secrets = profile.auth === 'login' || profile.auth === 'none' ? {} : parseEnvFile(secretFile);
+  const authConfigured = profile.auth === 'login' || profile.auth === 'none' || !!secrets[profile.auth];
+  const configured = !!binary && authConfigured;
+  return {
+    client: profile.client, provider: profile.provider, model: normalized.model,
+    endpoint: profile.endpoint, auth: profile.auth, authConfigured, configured,
+    models: [...(profile.models || [])], defaultModel: profile.model || '',
+    binary: binary || '',
+    reason: !binary ? `client ${profile.client} non trovato` : (!authConfigured ? `credenziale ${profile.auth} mancante` : 'ready'),
+  };
+}
+
+function resolveManagedEngine(engine, cell, cfg = {}) {
+  const info = describeManaged(engine.managed, cfg);
+  if (!info.configured) return { ok: false, reason: info.reason, info };
+  const home = cfg.home || require('node:os').homedir();
+  const env = {};
+  const args = [];
+  const model = (cell && cell.model) || info.model;
+  if (info.client === 'claude') {
+    args.push('--dangerously-skip-permissions');
+    if (info.provider === 'native') {
+      if (engine.rc !== false) args.push('--remote-control', `Cloud_${cell.id}`);
+    } else if (info.provider === 'ollama-cloud') {
+      const secrets = parseEnvFile(secretsPath(cfg, home));
+      Object.assign(env, {
+        ANTHROPIC_BASE_URL: 'https://ollama.com', ANTHROPIC_AUTH_TOKEN: secrets.OLLAMA_API_KEY,
+        ANTHROPIC_API_KEY: '',
+        ANTHROPIC_MODEL: model, ANTHROPIC_SMALL_FAST_MODEL: model, API_TIMEOUT_MS: '3000000',
+        CLAUDE_CODE_AUTO_COMPACT_WINDOW: String(OLLAMA_CONTEXT[model] || 200000),
+      });
+    } else {
+      const profile = byPair(info.client, info.provider);
+      const secrets = parseEnvFile(secretsPath(cfg, home));
+      Object.assign(env, {
+        ANTHROPIC_BASE_URL: profile.endpoint, ANTHROPIC_AUTH_TOKEN: secrets[profile.auth],
+        ANTHROPIC_MODEL: model, ANTHROPIC_SMALL_FAST_MODEL: model,
+        API_TIMEOUT_MS: '3000000', CLAUDE_CODE_AUTO_COMPACT_WINDOW: '1000000',
+      });
+    }
+    if (model) args.push('--model', model);
+  } else {
+    args.push('--dangerously-bypass-approvals-and-sandbox');
+    if (info.provider === 'ollama-cloud') {
+      const secrets = parseEnvFile(secretsPath(cfg, home));
+      env.OPENAI_API_KEY = secrets.OLLAMA_API_KEY;
+      if (model) args.push('-m', model);
+      const localCatalog = path.join(home, '.codex', 'ollama_cloud_model_catalog.json');
+      args.push(
+        '-c', 'model_provider="ollama_cloud"',
+        '-c', 'model_providers.ollama_cloud.name="Ollama Cloud"',
+        '-c', 'model_providers.ollama_cloud.base_url="https://ollama.com/v1"',
+        '-c', 'model_providers.ollama_cloud.wire_api="responses"',
+        '-c', 'model_providers.ollama_cloud.stream_idle_timeout_ms=600000',
+        '-c', `model_context_window=${OLLAMA_CONTEXT[model] || 200000}`,
+      );
+      // Codex carica il catalogo solo all'avvio. Il file e' locale e opzionale:
+      // sui device che non lo hanno resta valido il fallback context-window sopra.
+      if (fs.existsSync(localCatalog)) args.push('-c', `model_catalog_json="${localCatalog}"`);
+    }
+  }
+  // Entrambi i client accettano il bootstrap come argomento posizionale. Questo
+  // evita di digitare nella TUI prima che sia pronta; argv e' diretto, mai shell.
+  if (cell && cell.prompt) args.push(cell.prompt);
+  return { ok: true, info, engine: { ...engine, command: info.binary, args, env, promptMode: 'managed-argv' } };
+}
+
+module.exports = {
+  CATALOG, OLLAMA_CLOUD_MODELS, OLLAMA_CONTEXT, normalizeManagedSpec, defaultDefinitions, describeManaged,
+  discoverOllamaModels,
+  resolveManagedEngine, parseEnvFile, findBinary,
+};