@mmmbuto/nexuscrew 0.8.10 → 0.8.12

package/frontend/dist/assets/{index-ChGJawuv.css → index-PkKeNfT7.css}

@@ -1,4 +1,4 @@
-.nc-icon{display:block;flex:0 0 auto}.nc-sheet-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:50;background:#0000008c;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-launch-overlay{z-index:70}.nc-sheet{width:100%;max-width:380px;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:16px;display:flex;flex-direction:column;gap:12px;box-shadow:0 12px 40px #00000080}.nc-power-sheet{max-width:min(620px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow-y:auto;box-sizing:border-box;min-width:0}.nc-launch-sheet{max-width:min(520px,calc(100vw - 32px));width:100%;min-width:0}.nc-launch-fields{display:flex;flex-direction:column;gap:10px;min-width:0}.nc-launch-fields .nc-field,.nc-launch-fields .nc-field input,.nc-launch-fields .nc-field select{width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-sheet-head{display:flex;align-items:center;justify-content:space-between}.nc-sheet-head b{font-size:16px;color:#d8ffe8}.nc-sheet-state{font-size:12px;opacity:.6}.nc-sheet-label{font-size:12px;opacity:.7;text-transform:uppercase;letter-spacing:.5px}.nc-power-config{display:grid;grid-template-columns:auto minmax(0,1fr);gap:4px 10px;padding:10px;border:1px solid #243;border-radius:8px;background:#0a0e0a;min-width:0;overflow-wrap:anywhere}.nc-power-config span{opacity:.7}.nc-power-config small{grid-column:1 / -1;opacity:.65}.nc-check{display:flex;align-items:center;gap:8px;font-size:13px;cursor:pointer}.nc-check input{accent-color:#2e7d32}.nc-note{font-size:11px;color:#e0b020;opacity:.9}.nc-field{display:flex;flex-direction:column;gap:4px;font-size:12px;opacity:.8}.nc-field input,.nc-field select{padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-field input:focus,.nc-field select:focus{outline:none;border-color:#2e7d32}.nc-err{color:#f88;font-size:12px}.nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;min-width:0}.nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-btn.primary{background:#2e7d32;color:#fff}.nc-btn.primary:active{background:#255028}.nc-btn:disabled{opacity:.5;cursor:default}@media(max-width:600px){.nc-power-sheet{max-width:380px}}.nc-home{display:flex;flex-direction:column;gap:12px;padding:18px 14px 10px;color:#cfe;max-width:560px;margin:0 auto;height:100dvh;min-height:0;overflow:hidden;box-sizing:border-box}.nc-home-scroll{min-height:0;flex:1 1 auto;overflow-y:auto;overscroll-behavior-y:contain;-webkit-overflow-scrolling:touch;display:flex;flex-direction:column;gap:12px;padding:0 2px 76px 0}.nc-home-head{position:relative}.nc-wordmark{font-size:26px;font-weight:700;letter-spacing:.5px;color:#d8ffe8}.nc-cursor{display:inline-block;width:12px;height:22px;margin-left:6px;background:#0c6;vertical-align:-2px;animation:nc-blink 1.1s steps(1) infinite}@keyframes nc-blink{50%{opacity:0}}@media(prefers-reduced-motion:reduce){.nc-cursor{animation:none}}.nc-home-sub{margin-top:4px;font-size:13px;opacity:.65}.nc-head-actions{position:absolute;top:0;right:0;display:inline-flex;gap:6px}.nc-refresh{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:40px;min-height:40px}.nc-filter{padding:10px 12px;font:16px/1.2 inherit;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:8px}.nc-filter:focus{outline:none;border-color:#2e7d32}.nc-session-list{display:flex;flex-direction:column;gap:8px}.nc-session{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:10px;text-align:left;min-height:56px}.nc-session:active{background:#14200f;border-color:#2e7d32}.nc-session .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-session .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-session-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-session-main b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px}.nc-session-main small{opacity:.55;font-size:12px}.nc-badge{flex:0 0 auto;background:#2e7d32;color:#fff;border-radius:10px;padding:1px 8px;font-size:12px;line-height:18px}.nc-err{color:#f88;font-size:13px;padding:4px 2px}.nc-empty{opacity:.5;padding:18px 4px;font-size:13px}.nc-home-foot{margin-top:auto;padding-top:14px;display:flex;justify-content:space-between;gap:8px;font-size:11px;opacity:.4}.nc-group{display:flex;flex-direction:column;gap:8px}.nc-group-title{font-size:11px;opacity:.55;text-transform:uppercase;letter-spacing:.5px;padding:6px 2px 2px}.nc-mcard{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:12px;min-height:56px}.nc-mcard-main{flex:1 1 auto;min-width:0;display:flex;align-items:center;gap:12px;background:none;border:none;color:inherit;cursor:pointer;padding:0;text-align:left}.nc-mcard-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-mcard-text b{font-size:14px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mcard-text small{font-size:12px;opacity:.6;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dot.warn{background:#e0b020;box-shadow:0 0 6px #e0b02088}.nc-group-title.nc-node-title{display:flex;align-items:center;gap:6px}.nc-group-title.nc-node-title .dot{flex:0 0 auto;width:8px;height:8px;border-radius:50%;background:#355}.nc-group-title.nc-node-title .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mcard .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mcard .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-rel{flex:0 0 auto;font-size:11px;opacity:.45}.nc-power,.nc-menu{flex:0 0 auto;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:38px;min-height:38px;font-size:17px;cursor:pointer}.nc-power:active,.nc-menu:active{border-color:#2e7d32}.nc-fab{position:fixed;right:18px;bottom:18px;z-index:20;width:54px;height:54px;border-radius:50%;background:#2e7d32;color:#fff;border:none;font-size:28px;line-height:1;cursor:pointer;box-shadow:0 6px 18px #00000073}.nc-fab:active{background:#255028}.nc-lang{display:inline-flex;align-items:center;gap:2px}.nc-act{width:34px;height:34px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;flex:0 0 auto;font-size:15px;line-height:1}.nc-act.power.on{color:#0c6;border-color:#00cc668c;background:#00cc661a}.nc-act.power.warn{color:#e8c547;border-color:#e8c5478c;background:#e8c5471a}.nc-act.pin.on{color:#e8c547;border-color:#e8c5478c;background:#e8c54714}.nc-mcard{gap:8px}/**
+.nc-icon{display:block;flex:0 0 auto}.nc-sheet-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:50;background:#0000008c;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-launch-overlay{z-index:70}.nc-sheet{width:100%;max-width:380px;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:16px;display:flex;flex-direction:column;gap:12px;box-shadow:0 12px 40px #00000080}.nc-power-sheet{max-width:min(620px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow-y:auto;box-sizing:border-box;min-width:0}.nc-launch-sheet{max-width:min(520px,calc(100vw - 32px));width:100%;min-width:0}.nc-launch-fields{display:flex;flex-direction:column;gap:10px;min-width:0}.nc-launch-fields .nc-field,.nc-launch-fields .nc-field input,.nc-launch-fields .nc-field select{width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-sheet-head{display:flex;align-items:center;justify-content:space-between}.nc-sheet-head b{font-size:16px;color:#d8ffe8}.nc-sheet-state{font-size:12px;opacity:.6}.nc-sheet-label{font-size:12px;opacity:.7;text-transform:uppercase;letter-spacing:.5px}.nc-power-config{display:grid;grid-template-columns:auto minmax(0,1fr);gap:4px 10px;padding:10px;border:1px solid #243;border-radius:8px;background:#0a0e0a;min-width:0;overflow-wrap:anywhere}.nc-power-config span{opacity:.7}.nc-power-config small{grid-column:1 / -1;opacity:.65}.nc-check{display:flex;align-items:center;gap:8px;font-size:13px;cursor:pointer}.nc-check input{accent-color:#2e7d32}.nc-note{font-size:11px;color:#e0b020;opacity:.9}.nc-field{display:flex;flex-direction:column;gap:4px;font-size:12px;opacity:.8}.nc-field input,.nc-field select{padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-field input:focus,.nc-field select:focus{outline:none;border-color:#2e7d32}.nc-err{color:#f88;font-size:12px}.nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;min-width:0}.nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-btn.primary{background:#2e7d32;color:#fff}.nc-btn.primary:active{background:#255028}.nc-btn:disabled{opacity:.5;cursor:default}@media(max-width:600px){.nc-power-sheet{max-width:380px}}.nc-home{display:flex;flex-direction:column;gap:12px;padding:18px 14px 10px;color:#cfe;max-width:560px;margin:0 auto;height:100dvh;min-height:0;overflow:hidden;box-sizing:border-box}.nc-home-scroll{min-height:0;flex:1 1 auto;overflow-y:auto;overscroll-behavior-y:contain;-webkit-overflow-scrolling:touch;display:flex;flex-direction:column;gap:12px;padding:0 2px 76px 0}.nc-home-head{position:relative}.nc-wordmark{font-size:26px;font-weight:700;letter-spacing:.5px;color:#d8ffe8}.nc-cursor{display:inline-block;width:12px;height:22px;margin-left:6px;background:#0c6;vertical-align:-2px;animation:nc-blink 1.1s steps(1) infinite}@keyframes nc-blink{50%{opacity:0}}@media(prefers-reduced-motion:reduce){.nc-cursor{animation:none}}.nc-home-sub{margin-top:4px;font-size:13px;opacity:.65}.nc-head-actions{position:absolute;top:0;right:0;display:inline-flex;gap:6px}.nc-refresh{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:40px;min-height:40px}.nc-filter{padding:10px 12px;font:16px/1.2 inherit;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:8px}.nc-filter:focus{outline:none;border-color:#2e7d32}.nc-session-list{display:flex;flex-direction:column;gap:8px}.nc-session{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:10px;text-align:left;min-height:56px}.nc-session:active{background:#14200f;border-color:#2e7d32}.nc-session .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-session .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-session-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-session-main b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px}.nc-session-main small{opacity:.55;font-size:12px}.nc-badge{flex:0 0 auto;background:#2e7d32;color:#fff;border-radius:10px;padding:1px 8px;font-size:12px;line-height:18px}.nc-err{color:#f88;font-size:13px;padding:4px 2px}.nc-empty{opacity:.5;padding:18px 4px;font-size:13px}.nc-home-foot{margin-top:auto;padding:14px 4px 4px;width:100%;box-sizing:border-box;display:grid;grid-template-columns:minmax(0,1fr) auto;align-items:end;column-gap:14px;font-size:11px}.nc-home-meta{min-width:0;display:flex;flex-wrap:wrap;align-items:center;gap:2px 8px;opacity:.48;line-height:1.35}.nc-home-version{flex:0 0 auto}.nc-home-endpoint{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-group{display:flex;flex-direction:column;gap:8px}.nc-group-title{font-size:11px;opacity:.55;text-transform:uppercase;letter-spacing:.5px;padding:6px 2px 2px}.nc-mcard{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:12px;min-height:56px}.nc-mcard-main{flex:1 1 auto;min-width:0;display:flex;align-items:center;gap:12px;background:none;border:none;color:inherit;cursor:pointer;padding:0;text-align:left}.nc-mcard-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-mcard-text b{font-size:14px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mcard-text small{font-size:12px;opacity:.6;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dot.warn{background:#e0b020;box-shadow:0 0 6px #e0b02088}.nc-group-title.nc-node-title{display:flex;align-items:center;gap:6px}.nc-group-title.nc-node-title .dot{flex:0 0 auto;width:8px;height:8px;border-radius:50%;background:#355}.nc-group-title.nc-node-title .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mcard .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mcard .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mobile-position-head{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:8px;min-height:48px;padding:2px 0;border-bottom:1px solid #1c2b20}.nc-mobile-position-toggle{min-width:0;min-height:44px;padding:4px 2px;display:flex;align-items:center;gap:8px;border:0;background:none;color:inherit;text-align:left;cursor:pointer}.nc-mobile-position-toggle .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mobile-position-toggle .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mobile-chevron{flex:0 0 14px;font-size:18px;color:#8fc;text-align:center}.nc-mobile-position-copy{min-width:0;display:flex;flex-direction:column;gap:1px}.nc-mobile-position-copy b,.nc-mobile-position-copy small{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mobile-position-copy b{font-size:13px;color:#d8ffe8}.nc-mobile-position-copy small{font-size:11px;opacity:.55}.nc-mobile-position-filter{min-height:44px;max-width:104px;padding:0 26px 0 9px;border:1px solid #294433;border-radius:8px;background:#0e140e;color:#bfe8cf;font:12px/1 inherit}.nc-mobile-position-head>.nc-act{width:44px;height:44px}.nc-rel{flex:0 0 auto;font-size:11px;opacity:.45}.nc-power,.nc-menu{flex:0 0 auto;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:44px;min-height:44px;font-size:17px;cursor:pointer}.nc-power:active,.nc-menu:active{border-color:#2e7d32}.nc-fab{position:fixed;right:18px;bottom:18px;z-index:20;width:54px;height:54px;border-radius:50%;background:#2e7d32;color:#fff;border:none;font-size:28px;line-height:1;cursor:pointer;box-shadow:0 6px 18px #00000073}.nc-fab:active{background:#255028}.nc-lang{display:inline-flex;align-items:center;justify-content:flex-end;gap:2px;white-space:nowrap;opacity:.7}@media(max-width:380px){.nc-home-meta{flex-direction:column;align-items:flex-start;gap:0}.nc-home-endpoint{max-width:100%}}.nc-act{width:44px;height:44px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;flex:0 0 auto;font-size:15px;line-height:1}.nc-act.power.on{color:#0c6;border-color:#00cc668c;background:#00cc661a}.nc-act.power.warn{color:#e8c547;border-color:#e8c5478c;background:#e8c5471a}.nc-act.pin.on{color:#e8c547;border-color:#e8c5478c;background:#e8c54714}.nc-mcard{gap:8px}@media(max-width:390px){.nc-mobile-position-head{gap:5px}.nc-mobile-position-filter{max-width:92px;padding-left:7px}.nc-mcard{padding:10px 9px;gap:5px}}/**
  * Copyright (c) 2014 The xterm.js authors. All rights reserved.
  * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
  * https://github.com/chjj/term.js

package/frontend/dist/index.html

@@ -11,8 +11,8 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-CbUkgtAz.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-ChGJawuv.css">
+  <script type="module" crossorigin src="/assets/index-DrroT7uq.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-PkKeNfT7.css">
 </head>
 <body>
   <div id="root"></div>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.8.10"}
+{"version":"0.8.12"}

package/lib/cli/commands.js

@@ -8,7 +8,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const net = require('node:net');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('./platform.js');
-const { installPath: serviceInstallPath } = require('./service.js');
+const { installPath: serviceInstallPath, ensureLinuxTmuxSurvival } = require('./service.js');
 const { fleetInstallPath } = require('./fleet-service.js');
 const pidf = require('./pidfile.js');
 const { runInit } = require('./init.js');
@@ -263,6 +263,20 @@ function stop(opts = {}) {
   const stoppedOwners = [];
   const errors = [];
 
+  // The shared tmux server can live in the NexusCrew systemd cgroup.  If the
+  // effective KillMode cannot be proven safe, stop must not mutate *any*
+  // runtime owner or detached tunnel: callers can then fix the unit and retry
+  // without ending up in a partially stopped state.
+  if (before.managedRunning && platform === 'linux') {
+    try {
+      (opts.ensureTmuxSurvivalImpl || ensureLinuxTmuxSurvival)({ ...opts, home: opts.home, execImpl });
+    } catch (error) {
+      const reason = String(error.message || error);
+      log(`stop: annullato — protezione tmux non verificata: ${reason}`);
+      return { platform, owner: before.owner, stopped: false, stoppedOwners, reason };
+    }
+  }
+
   if (before.managedRunning) {
     try {
       if (platform === 'linux') {
@@ -477,15 +491,24 @@ function restart(opts = {}) {
   // conflict, first remove only the stray portable owner, then keep managed as
   // the single authority.
   if (before.managedRunning) {
+    if (platform === 'linux') {
+      try {
+        (opts.ensureTmuxSurvivalImpl || ensureLinuxTmuxSurvival)({ ...opts, home: opts.home, execImpl });
+      } catch (error) {
+        return { platform, owner: before.owner, runtimeOwner: 'managed', restarted: false, reason: String(error.message || error) };
+      }
+    }
     if (before.portableRunning) {
       const portable = (opts.stopPortableImpl || stopPortableRuntime)(opts);
       if (!portable.killed) return { platform, owner: before.owner, restarted: false, reason: portable.reason };
     }
     try {
       if (platform === 'linux') {
+        (opts.stopTunnelsImpl || stopManagedTunnels)(opts);
         execImpl('systemctl', ['--user', 'restart', 'nexuscrew'], { stdio: 'ignore' });
         log('restart: systemctl --user restart nexuscrew');
       } else {
+        (opts.stopTunnelsImpl || stopManagedTunnels)(opts);
         const label = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
         execImpl('launchctl', ['kickstart', '-k', label], { stdio: 'ignore' });
         log(`restart: launchctl kickstart -k ${label}`);
@@ -709,17 +732,34 @@ function url(opts = {}) {
 function tokenRotate(opts = {}) {
   const log = opts.log || console.log;
   const platform = opts.platform || detectPlatform();
+  const execImpl = opts.execImpl || execFileSync;
   const { tokenPath } = urlmod.resolvePaths(opts);
   const readonly = process.env.NEXUSCREW_READONLY === '1' || opts.readonly;
   if (readonly) {
     log('token rotate: READONLY, rotazione bloccata');
     return { rotated: false, reason: 'readonly' };
   }
+  const runtime = resolveRuntimeOwner({ ...opts, platform, execImpl });
+  const running = runtime.owner !== 'stopped';
+  if (runtime.managedRunning && platform === 'linux') {
+    try {
+      (opts.ensureTmuxSurvivalImpl || ensureLinuxTmuxSurvival)({ ...opts, home: opts.home, execImpl });
+    } catch (error) {
+      const reason = String(error.message || error);
+      log(`token rotate: annullata — protezione tmux non verificata: ${reason}`);
+      return { rotated: false, tokenWritten: false, restarted: false, running, reason };
+    }
+  }
   rotateToken(tokenPath); // atomico (tmp+rename, 0600, no-symlink); non stampa il token
   log(`token: nuovo segreto scritto (${tokenPath})`);
-  const running = isServiceRunning({ ...opts, platform });
   if (running) {
-    restart({ ...opts, platform, log });
+    const restarted = (opts.restartImpl || restart)({ ...opts, platform, execImpl, log });
+    if (!restarted || restarted.restarted !== true) {
+      const reason = (restarted && restarted.reason) || 'esito restart non verificato';
+      log(`token rotate: INCOMPLETA — nuovo token scritto ma restart fallito: ${reason}`);
+      log('token rotate: non e\' possibile confermare l\'invalidazione del vecchio token; correggi il servizio e ripeti il restart');
+      return { rotated: false, tokenWritten: true, restarted: false, running, reason };
+    }
     log('token rotate: servizio riavviato — vecchio token invalidato (401), nuovo attivo (200)');
   } else {
     // il service manager non lo vede, ma un `serve` manuale (pidfile) puo' essere
@@ -732,7 +772,7 @@ function tokenRotate(opts = {}) {
     }
   }
   log('usa `nexuscrew show token` per il nuovo URL (il token non si stampa qui)');
-  return { rotated: true, running };
+  return { rotated: true, tokenWritten: true, restarted: running, running };
 }
 
 // logs [-f]: passthrough. linux -> journalctl --user -u nexuscrew; mac/termux -> logfile.
@@ -779,12 +819,17 @@ function update(opts = {}) {
   }
   const running = isServiceRunning({ ...opts, platform });
   if (running) {
-    restart({ ...opts, platform, log });
+    const restarted = (opts.restartImpl || restart)({ ...opts, platform, log });
+    if (!restarted || restarted.restarted !== true) {
+      const reason = (restarted && restarted.reason) || 'esito restart non verificato';
+      log(`update: pacchetto installato ma restart fallito — ${reason}`);
+      return { updated: true, running, restarted: false, reason, code: 1 };
+    }
     log('update: servizio riavviato sul nuovo codice');
   } else {
     log('update: servizio non attivo (nessun restart)');
   }
-  return { updated: true, running, code: 0 };
+  return { updated: true, running, restarted: running, code: 0 };
 }
 
 // B4.3 — fleet-boot companion: avvia le celle boot:true del provider selezionato.

package/lib/cli/doctor.js

@@ -67,7 +67,12 @@ function checkBoot(platform, home, execImpl) {
   if (platform === 'termux') {
     const p = path.join(home, '.termux', 'boot', 'nexuscrew.sh');
     const ok = fs.existsSync(p);
-    return { name: 'boot script', ok, warn: !ok, detail: ok ? p : 'nessun Termux:boot script' };
+    return {
+      name: 'boot script', ok, warn: ok,
+      detail: ok
+        ? `${p} · app Termux:Boot non verificabile da CLI: installala e avviala una volta`
+        : 'nessun Termux:boot script',
+    };
   }
   if (platform === 'linux') {
     try {
@@ -84,6 +89,42 @@ function checkBoot(platform, home, execImpl) {
   return { name: 'boot (launchd RunAtLoad)', ok: true, warn: !ok, detail: ok ? 'plist installato' : 'plist non installato' };
 }
 
+function checkUserLinger(platform, execImpl, uidVal) {
+  if (platform !== 'linux') {
+    return { name: 'user linger', ok: true, detail: `${platform}: non applicabile` };
+  }
+  try {
+    const value = String(execImpl('loginctl', [
+      'show-user', String(uidVal), '--property=Linger', '--value',
+    ], { encoding: 'utf8' }) || '').trim().toLowerCase();
+    const enabled = value === 'yes';
+    return {
+      name: 'user linger', ok: true, warn: !enabled,
+      detail: enabled ? 'enabled · il servizio user puo partire senza login' : 'disabled · abilita con loginctl enable-linger per il boot senza login',
+    };
+  } catch (_) {
+    return { name: 'user linger', ok: true, warn: true, detail: 'non verificabile; il boot senza login potrebbe non partire' };
+  }
+}
+
+function checkTmuxSurvival(platform, execImpl) {
+  if (platform !== 'linux') {
+    return { name: 'tmux survival on service restart', ok: true, detail: `${platform}: systemd cgroup non applicabile` };
+  }
+  try {
+    const value = String(execImpl('systemctl', [
+      '--user', 'show', 'nexuscrew.service', '--property=KillMode', '--value',
+    ], { encoding: 'utf8' }) || '').trim();
+    const ok = value === 'process';
+    return {
+      name: 'tmux survival on service restart', ok,
+      detail: ok ? 'KillMode=process' : `KillMode=${value || 'sconosciuto'} (restart NexusCrew puo terminare tmux)`,
+    };
+  } catch (error) {
+    return { name: 'tmux survival on service restart', ok: false, detail: `KillMode non verificabile: ${error.message || error}` };
+  }
+}
+
 // ssh client presente su PATH: prerequisito dei tunnel multi-node (design §4).
 function checkSshClient(existsImpl) {
   return existsImpl('ssh')
@@ -141,6 +182,8 @@ function doctor(opts = {}) {
     checkPty(ptyLoad),
     checkService(platform, home, execImpl, uidVal, opts.installPath),
     checkBoot(platform, home, execImpl),
+    checkUserLinger(platform, execImpl, uidVal),
+    checkTmuxSurvival(platform, execImpl),
     checkTokenPerms(tokenPath),
     checkSshClient(existsImpl),
     checkAutossh(existsImpl),
@@ -159,5 +202,6 @@ function doctor(opts = {}) {
 module.exports = {
   doctor, nodeMajor,
   checkNode, checkTmux, checkPty, checkService, checkBoot, checkTokenPerms,
+  checkTmuxSurvival, checkUserLinger,
   checkSshClient, checkAutossh, checkSshPermitlisten,
 };

package/lib/cli/service.js

@@ -4,6 +4,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 const { execFileSync } = require('node:child_process');
 const { detectPlatform, uid } = require('./platform.js');
 
@@ -65,10 +66,14 @@ function generateLinux(ctx) {
   return `# NexusCrew service (systemd --user, loopback, solo tunnel SSH/VPN)
 [Unit]
 Description=NexusCrew - browser tmux client (loopback, solo tunnel SSH/VPN)
+Wants=network-online.target
 After=network-online.target
 
 [Service]
 Type=simple
+# The HTTP service may be the process that creates the shared tmux server.
+# Restart only NexusCrew itself; tmux sessions are independent user workloads.
+KillMode=process
 WorkingDirectory=${repo}
 Environment=PATH=${nodeDir}:/usr/local/bin:/usr/bin:/bin
 ExecStart=${node} ${repoBin} serve
@@ -153,6 +158,53 @@ function fileMode(platform) {
   return 0o644; // systemd unit + launchd plist
 }
 
+const LINUX_TMUX_SURVIVAL_DROPIN = `[Service]\n# NexusCrew owns the HTTP process, not the shared tmux server it may start.\nKillMode=process\n`;
+
+function linuxTmuxSurvivalPath(home) {
+  return path.join(home, '.config', 'systemd', 'user', 'nexuscrew.service.d', '10-tmux-survival.conf');
+}
+
+// Upgrade existing Linux installations before stop/restart.  Merely updating
+// the npm package does not rewrite an already-installed unit, so the new CLI
+// installs a narrow drop-in and reloads systemd before any destructive service
+// lifecycle operation.  The target is atomic and never follows a symlink.
+function ensureLinuxTmuxSurvival(opts = {}) {
+  const home = opts.home || os.homedir();
+  const target = opts.dropInPath || linuxTmuxSurvivalPath(home);
+  const execImpl = opts.execImpl || execFileSync;
+  let current = '';
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink() || !st.isFile()) throw new Error(`refusing unsafe systemd drop-in: ${target}`);
+    current = fs.readFileSync(target, 'utf8');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+
+  let written = false;
+  if (current !== LINUX_TMUX_SURVIVAL_DROPIN) {
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+    try {
+      fs.writeFileSync(tmp, LINUX_TMUX_SURVIVAL_DROPIN, { mode: 0o644, flag: 'wx' });
+      fs.chmodSync(tmp, 0o644);
+      fs.renameSync(tmp, target);
+      written = true;
+    } catch (error) {
+      try { fs.unlinkSync(tmp); } catch (_) {}
+      throw error;
+    }
+  }
+  execImpl('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
+  const effective = String(execImpl('systemctl', [
+    '--user', 'show', 'nexuscrew.service', '--property=KillMode', '--value',
+  ], { encoding: 'utf8' }) || '').trim();
+  if (effective !== 'process') {
+    throw new Error(`unsafe effective systemd KillMode=${effective || 'unknown'}; refusing NexusCrew lifecycle operation`);
+  }
+  return { target, written, killMode: effective };
+}
+
 // Install no-symlink + atomic rename. [M3]
 // - lstat target: reject symlink (no follow)
 // - write temp file nella stessa dir -> chmod mode -> atomic rename
@@ -230,6 +282,7 @@ function installCommands(platform, target, ctx) {
 module.exports = {
   generateService, generateLinux, generateMac, generateTermux,
   installService, installPath, installCommands, fileMode,
+  ensureLinuxTmuxSurvival, linuxTmuxSurvivalPath, LINUX_TMUX_SURVIVAL_DROPIN,
   escapeSystemdPath, escapeSystemdExec, escapeXml, shellQuote,
   assertSystemdSafe, SYSTEMD_FORBIDDEN,
 };

package/lib/nodes/tunnel-supervisor.js

@@ -14,6 +14,9 @@ const pidPath = process.env.NEXUSCREW_TUNNEL_PIDFILE;
 const runId = process.env.NEXUSCREW_TUNNEL_RUN_ID;
 const stableMsRaw = Number(process.env.NEXUSCREW_TUNNEL_STABLE_MS || 3000);
 const stableMs = Number.isFinite(stableMsRaw) && stableMsRaw >= 100 ? Math.min(stableMsRaw, 30000) : 3000;
+const ownershipGraceRaw = Number(process.env.NEXUSCREW_TUNNEL_OWNERSHIP_GRACE_MS || 2000);
+const ownershipGraceMs = Number.isFinite(ownershipGraceRaw) && ownershipGraceRaw >= 100
+  ? Math.min(ownershipGraceRaw, 10000) : 2000;
 if (!sshBin || !statePath || !pidPath || !runId) process.exit(2);
 
 let child = null;
@@ -21,6 +24,8 @@ let stopping = false;
 let attempt = 0;
 let retryTimer = null;
 let upTimer = null;
+let ownershipWaitTimer = null;
+let ownershipTimer = null;
 
 function ownsGeneration() {
   try {
@@ -48,14 +53,14 @@ function writeState(status, extra = {}) {
 function scheduleRetry(detail) {
   if (stopping) return finish();
   const delayMs = backoffDelay(attempt, { baseMs: 1000, capMs: 60000 });
-  writeState('retrying', { delayMs, detail });
+  if (!writeState('retrying', { delayMs, detail })) return stop();
   attempt += 1;
   retryTimer = setTimeout(run, delayMs);
 }
 
 function run() {
   if (stopping) return finish();
-  writeState('starting');
+  if (!writeState('starting')) return stop();
   try {
     child = spawn(sshBin, sshArgs, { stdio: 'inherit' });
   } catch (e) {
@@ -78,7 +83,7 @@ function run() {
     upTimer = setTimeout(() => {
       if (!stopping && child && child.exitCode == null) {
         attempt = 0;
-        writeState('transport-ready', { sshPid: child.pid, stableMs });
+        if (!writeState('transport-ready', { sshPid: child.pid, stableMs })) stop();
       }
     }, stableMs);
   });
@@ -94,6 +99,8 @@ function run() {
 function finish() {
   clearTimeout(retryTimer);
   clearTimeout(upTimer);
+  clearTimeout(ownershipWaitTimer);
+  clearInterval(ownershipTimer);
   if (ownsGeneration()) {
     writeState('down');
     try {
@@ -119,4 +126,19 @@ function stop() {
 
 process.on('SIGTERM', stop);
 process.on('SIGINT', stop);
-run();
+
+// The parent can only write our PID after spawn returns. Give that narrow race
+// a bounded grace window, then enforce generation ownership continuously. A
+// replaced/removed pidfile must stop both supervisor and ssh instead of leaving
+// an invisible retrying orphan behind.
+const ownershipDeadline = Date.now() + ownershipGraceMs;
+function acquireGeneration() {
+  if (stopping) return finish();
+  if (ownsGeneration()) {
+    ownershipTimer = setInterval(() => { if (!ownsGeneration()) stop(); }, 500);
+    return run();
+  }
+  if (Date.now() >= ownershipDeadline) return finish();
+  ownershipWaitTimer = setTimeout(acquireGeneration, 20);
+}
+acquireGeneration();

package/lib/nodes/tunnel.js

@@ -37,6 +37,11 @@ function assertForwardSpec(node) {
   if (node.sshPort !== undefined && !store.isPort(node.sshPort)) throw new Error('tunnel: sshPort non valida');
   if (node.identityFile !== undefined && !store.isAbsPath(node.identityFile)) throw new Error('tunnel: identityFile non valido');
   if (node.keyPath !== undefined && !store.isAbsPath(node.keyPath)) throw new Error('tunnel: keyPath non valido');
+  if (node.reversePort !== undefined && !store.isPort(node.reversePort)) throw new Error('tunnel: reversePort non valida');
+  if (node.localAppPort !== undefined && !store.isPort(node.localAppPort)) throw new Error('tunnel: localAppPort non valida');
+  if (node.shared === true && node.reversePort !== undefined && !store.isPort(node.localAppPort)) {
+    throw new Error('tunnel: Share richiede localAppPort esplicita');
+  }
   if (!store.parseSshTarget(node.ssh)) throw new Error('tunnel: target ssh non valido');
 }
 
@@ -52,7 +57,7 @@ function buildForwardArgs(node) {
   // The reverse channel publishes this device back through the hub, so it is
   // opt-in only. A negotiated reversePort alone must never imply consent.
   const reverse = node.shared === true && node.reversePort !== undefined ? [
-    '-R', `127.0.0.1:${node.reversePort}:127.0.0.1:${node.localAppPort || node.remotePort}`,
+    '-R', `127.0.0.1:${node.reversePort}:127.0.0.1:${node.localAppPort}`,
   ] : [];
   return SSH_BASE_OPTS.concat(transport, identity ? ['-i', identity] : [], [
     '-L', `127.0.0.1:${node.localPort}:127.0.0.1:${node.remotePort}`,
@@ -246,13 +251,23 @@ function removeStateIfOwned(home, name, meta) {
   return false;
 }
 
-function supervisorExited(pid, timeoutMs = 2500) {
+function supervisorExited(pid, timeoutMs = 2500, impl = {}) {
   const deadline = Date.now() + timeoutMs;
   const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const pidExistsImpl = impl.pidExistsImpl || pidf.pidExists;
+  const procReadImpl = impl.procReadImpl || fs.readFileSync;
+  const spawnSyncImpl = impl.spawnSyncImpl || spawnSync;
   const exited = () => {
-    if (!pidf.pidExists(pid)) return true;
-    try { return fs.readFileSync(`/proc/${pid}/stat`, 'utf8').split(' ')[2] === 'Z'; }
-    catch (_) { return false; }
+    if (!pidExistsImpl(pid)) return true;
+    try { return procReadImpl(`/proc/${pid}/stat`, 'utf8').split(' ')[2] === 'Z'; }
+    catch (_) {
+      // macOS has no /proc. `ps` is argv-only and its STAT starts with Z for a
+      // zombie, which is no longer a usable supervisor even before wait/reap.
+      try {
+        const result = spawnSyncImpl('ps', ['-p', String(pid), '-o', 'stat='], { encoding: 'utf8' });
+        return !result?.error && /^Z/.test(String(result?.stdout || '').trim());
+      } catch (_error) { return false; }
+    }
   };
   while (!exited() && Date.now() < deadline) Atomics.wait(sleeper, 0, 0, 25);
   return exited();
@@ -418,7 +433,8 @@ function restartTunnel(opts) {
 // Helper di alto livello: costruisce args dal nodo e avvia il forward.
 function startForward(opts) {
   const node = opts.node;
-  const args = buildForwardArgs({ ...node, localAppPort: opts.localAppPort });
+  const localAppPort = opts.localAppPort === undefined ? node.localAppPort : opts.localAppPort;
+  const args = buildForwardArgs({ ...node, localAppPort });
   // NexusCrew already owns retry/backoff in tunnel-supervisor.js. Nesting
   // autossh inside that supervisor made liveness dishonest: autossh could stay
   // alive while every SSH child exited 255, so the UI reported "tunnel up".

package/lib/update/runner.js

@@ -29,7 +29,10 @@ async function restartRuntime(opts = {}) {
   const token = opts.token || url.readToken(url.resolvePaths({ home }).tokenPath);
   let mode = 'inactive';
   if (commands.isServiceRunning({ platform, home })) {
-    commands.restart({ platform, home, log: () => {} });
+    const restarted = commands.restart({ platform, home, log: () => {} });
+    if (!restarted || restarted.restarted !== true) {
+      throw new Error(`restart service fallito: ${(restarted && restarted.reason) || 'esito non verificato'}`);
+    }
     mode = 'service';
   } else {
     const pidPath = pidf.defaultPidfilePath(home);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
@@ -20,7 +20,7 @@
     "start": "node bin/nexuscrew.js serve",
     "dev": "node bin/nexuscrew.js serve",
     "build": "cd frontend && npm install && npm run build && cd ..",
-    "test": "node tests/run-isolated.js"
+    "test": "node tests/run-isolated.js && npm --prefix frontend test"
   },
   "dependencies": {
     "express": "^4.21.0",