@mmmbuto/nexuscrew 0.8.11 → 0.8.12

package/frontend/dist/assets/{index-DrrRAIg6.css → index-PkKeNfT7.css}

@@ -1,4 +1,4 @@
-.nc-icon{display:block;flex:0 0 auto}.nc-sheet-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:50;background:#0000008c;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-launch-overlay{z-index:70}.nc-sheet{width:100%;max-width:380px;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:16px;display:flex;flex-direction:column;gap:12px;box-shadow:0 12px 40px #00000080}.nc-power-sheet{max-width:min(620px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow-y:auto;box-sizing:border-box;min-width:0}.nc-launch-sheet{max-width:min(520px,calc(100vw - 32px));width:100%;min-width:0}.nc-launch-fields{display:flex;flex-direction:column;gap:10px;min-width:0}.nc-launch-fields .nc-field,.nc-launch-fields .nc-field input,.nc-launch-fields .nc-field select{width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-sheet-head{display:flex;align-items:center;justify-content:space-between}.nc-sheet-head b{font-size:16px;color:#d8ffe8}.nc-sheet-state{font-size:12px;opacity:.6}.nc-sheet-label{font-size:12px;opacity:.7;text-transform:uppercase;letter-spacing:.5px}.nc-power-config{display:grid;grid-template-columns:auto minmax(0,1fr);gap:4px 10px;padding:10px;border:1px solid #243;border-radius:8px;background:#0a0e0a;min-width:0;overflow-wrap:anywhere}.nc-power-config span{opacity:.7}.nc-power-config small{grid-column:1 / -1;opacity:.65}.nc-check{display:flex;align-items:center;gap:8px;font-size:13px;cursor:pointer}.nc-check input{accent-color:#2e7d32}.nc-note{font-size:11px;color:#e0b020;opacity:.9}.nc-field{display:flex;flex-direction:column;gap:4px;font-size:12px;opacity:.8}.nc-field input,.nc-field select{padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-field input:focus,.nc-field select:focus{outline:none;border-color:#2e7d32}.nc-err{color:#f88;font-size:12px}.nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;min-width:0}.nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-btn.primary{background:#2e7d32;color:#fff}.nc-btn.primary:active{background:#255028}.nc-btn:disabled{opacity:.5;cursor:default}@media(max-width:600px){.nc-power-sheet{max-width:380px}}.nc-home{display:flex;flex-direction:column;gap:12px;padding:18px 14px 10px;color:#cfe;max-width:560px;margin:0 auto;height:100dvh;min-height:0;overflow:hidden;box-sizing:border-box}.nc-home-scroll{min-height:0;flex:1 1 auto;overflow-y:auto;overscroll-behavior-y:contain;-webkit-overflow-scrolling:touch;display:flex;flex-direction:column;gap:12px;padding:0 2px 76px 0}.nc-home-head{position:relative}.nc-wordmark{font-size:26px;font-weight:700;letter-spacing:.5px;color:#d8ffe8}.nc-cursor{display:inline-block;width:12px;height:22px;margin-left:6px;background:#0c6;vertical-align:-2px;animation:nc-blink 1.1s steps(1) infinite}@keyframes nc-blink{50%{opacity:0}}@media(prefers-reduced-motion:reduce){.nc-cursor{animation:none}}.nc-home-sub{margin-top:4px;font-size:13px;opacity:.65}.nc-head-actions{position:absolute;top:0;right:0;display:inline-flex;gap:6px}.nc-refresh{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:40px;min-height:40px}.nc-filter{padding:10px 12px;font:16px/1.2 inherit;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:8px}.nc-filter:focus{outline:none;border-color:#2e7d32}.nc-session-list{display:flex;flex-direction:column;gap:8px}.nc-session{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:10px;text-align:left;min-height:56px}.nc-session:active{background:#14200f;border-color:#2e7d32}.nc-session .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-session .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-session-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-session-main b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px}.nc-session-main small{opacity:.55;font-size:12px}.nc-badge{flex:0 0 auto;background:#2e7d32;color:#fff;border-radius:10px;padding:1px 8px;font-size:12px;line-height:18px}.nc-err{color:#f88;font-size:13px;padding:4px 2px}.nc-empty{opacity:.5;padding:18px 4px;font-size:13px}.nc-home-foot{margin-top:auto;padding:14px 4px 4px;width:100%;box-sizing:border-box;display:grid;grid-template-columns:minmax(0,1fr) auto;align-items:end;column-gap:14px;font-size:11px}.nc-home-meta{min-width:0;display:flex;flex-wrap:wrap;align-items:center;gap:2px 8px;opacity:.48;line-height:1.35}.nc-home-version{flex:0 0 auto}.nc-home-endpoint{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-group{display:flex;flex-direction:column;gap:8px}.nc-group-title{font-size:11px;opacity:.55;text-transform:uppercase;letter-spacing:.5px;padding:6px 2px 2px}.nc-mcard{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:12px;min-height:56px}.nc-mcard-main{flex:1 1 auto;min-width:0;display:flex;align-items:center;gap:12px;background:none;border:none;color:inherit;cursor:pointer;padding:0;text-align:left}.nc-mcard-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-mcard-text b{font-size:14px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mcard-text small{font-size:12px;opacity:.6;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dot.warn{background:#e0b020;box-shadow:0 0 6px #e0b02088}.nc-group-title.nc-node-title{display:flex;align-items:center;gap:6px}.nc-group-title.nc-node-title .dot{flex:0 0 auto;width:8px;height:8px;border-radius:50%;background:#355}.nc-group-title.nc-node-title .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mcard .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mcard .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-rel{flex:0 0 auto;font-size:11px;opacity:.45}.nc-power,.nc-menu{flex:0 0 auto;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:38px;min-height:38px;font-size:17px;cursor:pointer}.nc-power:active,.nc-menu:active{border-color:#2e7d32}.nc-fab{position:fixed;right:18px;bottom:18px;z-index:20;width:54px;height:54px;border-radius:50%;background:#2e7d32;color:#fff;border:none;font-size:28px;line-height:1;cursor:pointer;box-shadow:0 6px 18px #00000073}.nc-fab:active{background:#255028}.nc-lang{display:inline-flex;align-items:center;justify-content:flex-end;gap:2px;white-space:nowrap;opacity:.7}@media(max-width:380px){.nc-home-meta{flex-direction:column;align-items:flex-start;gap:0}.nc-home-endpoint{max-width:100%}}.nc-act{width:34px;height:34px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;flex:0 0 auto;font-size:15px;line-height:1}.nc-act.power.on{color:#0c6;border-color:#00cc668c;background:#00cc661a}.nc-act.power.warn{color:#e8c547;border-color:#e8c5478c;background:#e8c5471a}.nc-act.pin.on{color:#e8c547;border-color:#e8c5478c;background:#e8c54714}.nc-mcard{gap:8px}/**
+.nc-icon{display:block;flex:0 0 auto}.nc-sheet-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:50;background:#0000008c;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-launch-overlay{z-index:70}.nc-sheet{width:100%;max-width:380px;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:16px;display:flex;flex-direction:column;gap:12px;box-shadow:0 12px 40px #00000080}.nc-power-sheet{max-width:min(620px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow-y:auto;box-sizing:border-box;min-width:0}.nc-launch-sheet{max-width:min(520px,calc(100vw - 32px));width:100%;min-width:0}.nc-launch-fields{display:flex;flex-direction:column;gap:10px;min-width:0}.nc-launch-fields .nc-field,.nc-launch-fields .nc-field input,.nc-launch-fields .nc-field select{width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-sheet-head{display:flex;align-items:center;justify-content:space-between}.nc-sheet-head b{font-size:16px;color:#d8ffe8}.nc-sheet-state{font-size:12px;opacity:.6}.nc-sheet-label{font-size:12px;opacity:.7;text-transform:uppercase;letter-spacing:.5px}.nc-power-config{display:grid;grid-template-columns:auto minmax(0,1fr);gap:4px 10px;padding:10px;border:1px solid #243;border-radius:8px;background:#0a0e0a;min-width:0;overflow-wrap:anywhere}.nc-power-config span{opacity:.7}.nc-power-config small{grid-column:1 / -1;opacity:.65}.nc-check{display:flex;align-items:center;gap:8px;font-size:13px;cursor:pointer}.nc-check input{accent-color:#2e7d32}.nc-note{font-size:11px;color:#e0b020;opacity:.9}.nc-field{display:flex;flex-direction:column;gap:4px;font-size:12px;opacity:.8}.nc-field input,.nc-field select{padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-field input:focus,.nc-field select:focus{outline:none;border-color:#2e7d32}.nc-err{color:#f88;font-size:12px}.nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;min-width:0}.nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-btn.primary{background:#2e7d32;color:#fff}.nc-btn.primary:active{background:#255028}.nc-btn:disabled{opacity:.5;cursor:default}@media(max-width:600px){.nc-power-sheet{max-width:380px}}.nc-home{display:flex;flex-direction:column;gap:12px;padding:18px 14px 10px;color:#cfe;max-width:560px;margin:0 auto;height:100dvh;min-height:0;overflow:hidden;box-sizing:border-box}.nc-home-scroll{min-height:0;flex:1 1 auto;overflow-y:auto;overscroll-behavior-y:contain;-webkit-overflow-scrolling:touch;display:flex;flex-direction:column;gap:12px;padding:0 2px 76px 0}.nc-home-head{position:relative}.nc-wordmark{font-size:26px;font-weight:700;letter-spacing:.5px;color:#d8ffe8}.nc-cursor{display:inline-block;width:12px;height:22px;margin-left:6px;background:#0c6;vertical-align:-2px;animation:nc-blink 1.1s steps(1) infinite}@keyframes nc-blink{50%{opacity:0}}@media(prefers-reduced-motion:reduce){.nc-cursor{animation:none}}.nc-home-sub{margin-top:4px;font-size:13px;opacity:.65}.nc-head-actions{position:absolute;top:0;right:0;display:inline-flex;gap:6px}.nc-refresh{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:40px;min-height:40px}.nc-filter{padding:10px 12px;font:16px/1.2 inherit;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:8px}.nc-filter:focus{outline:none;border-color:#2e7d32}.nc-session-list{display:flex;flex-direction:column;gap:8px}.nc-session{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:10px;text-align:left;min-height:56px}.nc-session:active{background:#14200f;border-color:#2e7d32}.nc-session .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-session .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-session-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-session-main b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px}.nc-session-main small{opacity:.55;font-size:12px}.nc-badge{flex:0 0 auto;background:#2e7d32;color:#fff;border-radius:10px;padding:1px 8px;font-size:12px;line-height:18px}.nc-err{color:#f88;font-size:13px;padding:4px 2px}.nc-empty{opacity:.5;padding:18px 4px;font-size:13px}.nc-home-foot{margin-top:auto;padding:14px 4px 4px;width:100%;box-sizing:border-box;display:grid;grid-template-columns:minmax(0,1fr) auto;align-items:end;column-gap:14px;font-size:11px}.nc-home-meta{min-width:0;display:flex;flex-wrap:wrap;align-items:center;gap:2px 8px;opacity:.48;line-height:1.35}.nc-home-version{flex:0 0 auto}.nc-home-endpoint{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-group{display:flex;flex-direction:column;gap:8px}.nc-group-title{font-size:11px;opacity:.55;text-transform:uppercase;letter-spacing:.5px;padding:6px 2px 2px}.nc-mcard{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:12px;min-height:56px}.nc-mcard-main{flex:1 1 auto;min-width:0;display:flex;align-items:center;gap:12px;background:none;border:none;color:inherit;cursor:pointer;padding:0;text-align:left}.nc-mcard-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-mcard-text b{font-size:14px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mcard-text small{font-size:12px;opacity:.6;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dot.warn{background:#e0b020;box-shadow:0 0 6px #e0b02088}.nc-group-title.nc-node-title{display:flex;align-items:center;gap:6px}.nc-group-title.nc-node-title .dot{flex:0 0 auto;width:8px;height:8px;border-radius:50%;background:#355}.nc-group-title.nc-node-title .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mcard .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mcard .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mobile-position-head{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:8px;min-height:48px;padding:2px 0;border-bottom:1px solid #1c2b20}.nc-mobile-position-toggle{min-width:0;min-height:44px;padding:4px 2px;display:flex;align-items:center;gap:8px;border:0;background:none;color:inherit;text-align:left;cursor:pointer}.nc-mobile-position-toggle .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mobile-position-toggle .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mobile-chevron{flex:0 0 14px;font-size:18px;color:#8fc;text-align:center}.nc-mobile-position-copy{min-width:0;display:flex;flex-direction:column;gap:1px}.nc-mobile-position-copy b,.nc-mobile-position-copy small{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mobile-position-copy b{font-size:13px;color:#d8ffe8}.nc-mobile-position-copy small{font-size:11px;opacity:.55}.nc-mobile-position-filter{min-height:44px;max-width:104px;padding:0 26px 0 9px;border:1px solid #294433;border-radius:8px;background:#0e140e;color:#bfe8cf;font:12px/1 inherit}.nc-mobile-position-head>.nc-act{width:44px;height:44px}.nc-rel{flex:0 0 auto;font-size:11px;opacity:.45}.nc-power,.nc-menu{flex:0 0 auto;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:44px;min-height:44px;font-size:17px;cursor:pointer}.nc-power:active,.nc-menu:active{border-color:#2e7d32}.nc-fab{position:fixed;right:18px;bottom:18px;z-index:20;width:54px;height:54px;border-radius:50%;background:#2e7d32;color:#fff;border:none;font-size:28px;line-height:1;cursor:pointer;box-shadow:0 6px 18px #00000073}.nc-fab:active{background:#255028}.nc-lang{display:inline-flex;align-items:center;justify-content:flex-end;gap:2px;white-space:nowrap;opacity:.7}@media(max-width:380px){.nc-home-meta{flex-direction:column;align-items:flex-start;gap:0}.nc-home-endpoint{max-width:100%}}.nc-act{width:44px;height:44px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;flex:0 0 auto;font-size:15px;line-height:1}.nc-act.power.on{color:#0c6;border-color:#00cc668c;background:#00cc661a}.nc-act.power.warn{color:#e8c547;border-color:#e8c5478c;background:#e8c5471a}.nc-act.pin.on{color:#e8c547;border-color:#e8c5478c;background:#e8c54714}.nc-mcard{gap:8px}@media(max-width:390px){.nc-mobile-position-head{gap:5px}.nc-mobile-position-filter{max-width:92px;padding-left:7px}.nc-mcard{padding:10px 9px;gap:5px}}/**
  * Copyright (c) 2014 The xterm.js authors. All rights reserved.
  * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
  * https://github.com/chjj/term.js

package/frontend/dist/index.html

@@ -11,8 +11,8 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-DoUIJ4GM.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-DrrRAIg6.css">
+  <script type="module" crossorigin src="/assets/index-DrroT7uq.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-PkKeNfT7.css">
 </head>
 <body>
   <div id="root"></div>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.8.11"}
+{"version":"0.8.12"}

package/lib/cli/doctor.js

@@ -67,7 +67,12 @@ function checkBoot(platform, home, execImpl) {
   if (platform === 'termux') {
     const p = path.join(home, '.termux', 'boot', 'nexuscrew.sh');
     const ok = fs.existsSync(p);
-    return { name: 'boot script', ok, warn: !ok, detail: ok ? p : 'nessun Termux:boot script' };
+    return {
+      name: 'boot script', ok, warn: ok,
+      detail: ok
+        ? `${p} · app Termux:Boot non verificabile da CLI: installala e avviala una volta`
+        : 'nessun Termux:boot script',
+    };
   }
   if (platform === 'linux') {
     try {
@@ -84,6 +89,24 @@ function checkBoot(platform, home, execImpl) {
   return { name: 'boot (launchd RunAtLoad)', ok: true, warn: !ok, detail: ok ? 'plist installato' : 'plist non installato' };
 }
 
+function checkUserLinger(platform, execImpl, uidVal) {
+  if (platform !== 'linux') {
+    return { name: 'user linger', ok: true, detail: `${platform}: non applicabile` };
+  }
+  try {
+    const value = String(execImpl('loginctl', [
+      'show-user', String(uidVal), '--property=Linger', '--value',
+    ], { encoding: 'utf8' }) || '').trim().toLowerCase();
+    const enabled = value === 'yes';
+    return {
+      name: 'user linger', ok: true, warn: !enabled,
+      detail: enabled ? 'enabled · il servizio user puo partire senza login' : 'disabled · abilita con loginctl enable-linger per il boot senza login',
+    };
+  } catch (_) {
+    return { name: 'user linger', ok: true, warn: true, detail: 'non verificabile; il boot senza login potrebbe non partire' };
+  }
+}
+
 function checkTmuxSurvival(platform, execImpl) {
   if (platform !== 'linux') {
     return { name: 'tmux survival on service restart', ok: true, detail: `${platform}: systemd cgroup non applicabile` };
@@ -159,6 +182,7 @@ function doctor(opts = {}) {
     checkPty(ptyLoad),
     checkService(platform, home, execImpl, uidVal, opts.installPath),
     checkBoot(platform, home, execImpl),
+    checkUserLinger(platform, execImpl, uidVal),
     checkTmuxSurvival(platform, execImpl),
     checkTokenPerms(tokenPath),
     checkSshClient(existsImpl),
@@ -178,6 +202,6 @@ function doctor(opts = {}) {
 module.exports = {
   doctor, nodeMajor,
   checkNode, checkTmux, checkPty, checkService, checkBoot, checkTokenPerms,
-  checkTmuxSurvival,
+  checkTmuxSurvival, checkUserLinger,
   checkSshClient, checkAutossh, checkSshPermitlisten,
 };

package/lib/cli/service.js

@@ -66,6 +66,7 @@ function generateLinux(ctx) {
   return `# NexusCrew service (systemd --user, loopback, solo tunnel SSH/VPN)
 [Unit]
 Description=NexusCrew - browser tmux client (loopback, solo tunnel SSH/VPN)
+Wants=network-online.target
 After=network-online.target
 
 [Service]

package/lib/nodes/tunnel-supervisor.js

@@ -14,6 +14,9 @@ const pidPath = process.env.NEXUSCREW_TUNNEL_PIDFILE;
 const runId = process.env.NEXUSCREW_TUNNEL_RUN_ID;
 const stableMsRaw = Number(process.env.NEXUSCREW_TUNNEL_STABLE_MS || 3000);
 const stableMs = Number.isFinite(stableMsRaw) && stableMsRaw >= 100 ? Math.min(stableMsRaw, 30000) : 3000;
+const ownershipGraceRaw = Number(process.env.NEXUSCREW_TUNNEL_OWNERSHIP_GRACE_MS || 2000);
+const ownershipGraceMs = Number.isFinite(ownershipGraceRaw) && ownershipGraceRaw >= 100
+  ? Math.min(ownershipGraceRaw, 10000) : 2000;
 if (!sshBin || !statePath || !pidPath || !runId) process.exit(2);
 
 let child = null;
@@ -21,6 +24,8 @@ let stopping = false;
 let attempt = 0;
 let retryTimer = null;
 let upTimer = null;
+let ownershipWaitTimer = null;
+let ownershipTimer = null;
 
 function ownsGeneration() {
   try {
@@ -48,14 +53,14 @@ function writeState(status, extra = {}) {
 function scheduleRetry(detail) {
   if (stopping) return finish();
   const delayMs = backoffDelay(attempt, { baseMs: 1000, capMs: 60000 });
-  writeState('retrying', { delayMs, detail });
+  if (!writeState('retrying', { delayMs, detail })) return stop();
   attempt += 1;
   retryTimer = setTimeout(run, delayMs);
 }
 
 function run() {
   if (stopping) return finish();
-  writeState('starting');
+  if (!writeState('starting')) return stop();
   try {
     child = spawn(sshBin, sshArgs, { stdio: 'inherit' });
   } catch (e) {
@@ -78,7 +83,7 @@ function run() {
     upTimer = setTimeout(() => {
       if (!stopping && child && child.exitCode == null) {
         attempt = 0;
-        writeState('transport-ready', { sshPid: child.pid, stableMs });
+        if (!writeState('transport-ready', { sshPid: child.pid, stableMs })) stop();
       }
     }, stableMs);
   });
@@ -94,6 +99,8 @@ function run() {
 function finish() {
   clearTimeout(retryTimer);
   clearTimeout(upTimer);
+  clearTimeout(ownershipWaitTimer);
+  clearInterval(ownershipTimer);
   if (ownsGeneration()) {
     writeState('down');
     try {
@@ -119,4 +126,19 @@ function stop() {
 
 process.on('SIGTERM', stop);
 process.on('SIGINT', stop);
-run();
+
+// The parent can only write our PID after spawn returns. Give that narrow race
+// a bounded grace window, then enforce generation ownership continuously. A
+// replaced/removed pidfile must stop both supervisor and ssh instead of leaving
+// an invisible retrying orphan behind.
+const ownershipDeadline = Date.now() + ownershipGraceMs;
+function acquireGeneration() {
+  if (stopping) return finish();
+  if (ownsGeneration()) {
+    ownershipTimer = setInterval(() => { if (!ownsGeneration()) stop(); }, 500);
+    return run();
+  }
+  if (Date.now() >= ownershipDeadline) return finish();
+  ownershipWaitTimer = setTimeout(acquireGeneration, 20);
+}
+acquireGeneration();

package/lib/nodes/tunnel.js

@@ -37,6 +37,11 @@ function assertForwardSpec(node) {
   if (node.sshPort !== undefined && !store.isPort(node.sshPort)) throw new Error('tunnel: sshPort non valida');
   if (node.identityFile !== undefined && !store.isAbsPath(node.identityFile)) throw new Error('tunnel: identityFile non valido');
   if (node.keyPath !== undefined && !store.isAbsPath(node.keyPath)) throw new Error('tunnel: keyPath non valido');
+  if (node.reversePort !== undefined && !store.isPort(node.reversePort)) throw new Error('tunnel: reversePort non valida');
+  if (node.localAppPort !== undefined && !store.isPort(node.localAppPort)) throw new Error('tunnel: localAppPort non valida');
+  if (node.shared === true && node.reversePort !== undefined && !store.isPort(node.localAppPort)) {
+    throw new Error('tunnel: Share richiede localAppPort esplicita');
+  }
   if (!store.parseSshTarget(node.ssh)) throw new Error('tunnel: target ssh non valido');
 }
 
@@ -52,7 +57,7 @@ function buildForwardArgs(node) {
   // The reverse channel publishes this device back through the hub, so it is
   // opt-in only. A negotiated reversePort alone must never imply consent.
   const reverse = node.shared === true && node.reversePort !== undefined ? [
-    '-R', `127.0.0.1:${node.reversePort}:127.0.0.1:${node.localAppPort || node.remotePort}`,
+    '-R', `127.0.0.1:${node.reversePort}:127.0.0.1:${node.localAppPort}`,
   ] : [];
   return SSH_BASE_OPTS.concat(transport, identity ? ['-i', identity] : [], [
     '-L', `127.0.0.1:${node.localPort}:127.0.0.1:${node.remotePort}`,
@@ -246,13 +251,23 @@ function removeStateIfOwned(home, name, meta) {
   return false;
 }
 
-function supervisorExited(pid, timeoutMs = 2500) {
+function supervisorExited(pid, timeoutMs = 2500, impl = {}) {
   const deadline = Date.now() + timeoutMs;
   const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const pidExistsImpl = impl.pidExistsImpl || pidf.pidExists;
+  const procReadImpl = impl.procReadImpl || fs.readFileSync;
+  const spawnSyncImpl = impl.spawnSyncImpl || spawnSync;
   const exited = () => {
-    if (!pidf.pidExists(pid)) return true;
-    try { return fs.readFileSync(`/proc/${pid}/stat`, 'utf8').split(' ')[2] === 'Z'; }
-    catch (_) { return false; }
+    if (!pidExistsImpl(pid)) return true;
+    try { return procReadImpl(`/proc/${pid}/stat`, 'utf8').split(' ')[2] === 'Z'; }
+    catch (_) {
+      // macOS has no /proc. `ps` is argv-only and its STAT starts with Z for a
+      // zombie, which is no longer a usable supervisor even before wait/reap.
+      try {
+        const result = spawnSyncImpl('ps', ['-p', String(pid), '-o', 'stat='], { encoding: 'utf8' });
+        return !result?.error && /^Z/.test(String(result?.stdout || '').trim());
+      } catch (_error) { return false; }
+    }
   };
   while (!exited() && Date.now() < deadline) Atomics.wait(sleeper, 0, 0, 25);
   return exited();
@@ -418,7 +433,8 @@ function restartTunnel(opts) {
 // Helper di alto livello: costruisce args dal nodo e avvia il forward.
 function startForward(opts) {
   const node = opts.node;
-  const args = buildForwardArgs({ ...node, localAppPort: opts.localAppPort });
+  const localAppPort = opts.localAppPort === undefined ? node.localAppPort : opts.localAppPort;
+  const args = buildForwardArgs({ ...node, localAppPort });
   // NexusCrew already owns retry/backoff in tunnel-supervisor.js. Nesting
   // autossh inside that supervisor made liveness dishonest: autossh could stay
   // alive while every SSH child exited 255, so the UI reported "tunnel up".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
@@ -20,7 +20,7 @@
     "start": "node bin/nexuscrew.js serve",
     "dev": "node bin/nexuscrew.js serve",
     "build": "cd frontend && npm install && npm run build && cd ..",
-    "test": "node tests/run-isolated.js"
+    "test": "node tests/run-isolated.js && npm --prefix frontend test"
   },
   "dependencies": {
     "express": "^4.21.0",