@mmmbuto/nexuscrew 0.8.12 → 0.8.13

package/lib/mcp/server.js

@@ -3,14 +3,16 @@
 //
 // Porta NexusCrew DENTRO le sessioni AI (Claude Code / codex-vl) come server
 // MCP: notifiche umane, richieste di attenzione (ask), consegna file, stato
-// read-only. Il bus cella↔cella resta a crewd/crew: questo bridge parla SOLO
-// con l'HTTP API locale di NexusCrew (loopback + Bearer).
+// read-only e directory/invio autenticato tra celle Fleet attive. Il bridge
+// parla SOLO con l'HTTP API locale di NexusCrew (loopback + Bearer); le route
+// federate applicano ACL e identita' owner-qualified lato server.
 //
 // Protocollo: JSON-RPC 2.0, UN messaggio JSON per riga (stdio framing MCP).
 // Hand-rolled minimale, zero dipendenze SDK (stile del repo). Fail-closed:
 // garbage in input non crasha MAI il processo — risponde un errore JSON-RPC.
 // Niente log su stdout (corromperebbe il canale): diagnostica su stderr.
 const readline = require('node:readline');
+const crypto = require('node:crypto');
 const os = require('node:os');
 const path = require('node:path');
 const { execFile } = require('node:child_process');
@@ -95,6 +97,7 @@ function orderedDeckMembers(deck) {
 
 const NODE_PART_RE = /^[a-z0-9-]{1,32}$/;
 const NODE_ID_RE = /^[a-f0-9]{16,64}$/;
+const CELL_ID_RE = /^[A-Za-z0-9._-]{1,32}$/;
 function fleetStatusPath(node) {
   if (!node) return '/api/fleet/status';
   const parts = String(node).split('/');
@@ -144,6 +147,69 @@ function memberOwnerId(member, deckOwner, ownerTopology) {
   return found ? found.instanceId : null;
 }
 
+function parseCellTarget(value) {
+  if (typeof value !== 'string') return null;
+  const split = value.indexOf(':');
+  if (split < 16) return null;
+  const instanceId = value.slice(0, split);
+  const cell = value.slice(split + 1);
+  return NODE_ID_RE.test(instanceId) && CELL_ID_RE.test(cell) ? { instanceId, cell } : null;
+}
+
+function normalizeCellPayload(payload, owner, callerSession = null) {
+  if (!payload || payload.instanceId !== owner.instanceId || !Array.isArray(payload.cells)) return [];
+  const route = owner.route.length ? owner.route.join('/') : 'local';
+  const seen = new Set();
+  const out = [];
+  for (const raw of payload.cells) {
+    if (!raw || raw.instanceId !== owner.instanceId || !CELL_ID_RE.test(String(raw.cell || ''))
+      || typeof raw.tmuxSession !== 'string' || !isValidSession(raw.tmuxSession)
+      || seen.has(raw.cell)) continue;
+    seen.add(raw.cell);
+    out.push({
+      id: `${owner.instanceId}:${raw.cell}`,
+      instanceId: owner.instanceId,
+      owner: owner.label,
+      route,
+      cell: raw.cell,
+      tmuxSession: raw.tmuxSession,
+      engine: typeof raw.engine === 'string' ? raw.engine : '',
+      model: typeof raw.model === 'string' ? raw.model : '',
+      active: raw.active === true,
+      canReceive: raw.canReceive === true,
+      lastSeen: Number.isFinite(raw.lastSeen) ? raw.lastSeen : null,
+      self: owner.route.length === 0 && callerSession === raw.tmuxSession,
+    });
+  }
+  return out;
+}
+
+async function readCellDirectory(ctx, callerSession = null) {
+  const [config, topology] = await Promise.all([
+    ctx.api('GET', '/api/config'), ctx.api('GET', '/api/topology'),
+  ]);
+  const localId = String(config && config.instanceId || '');
+  if (!NODE_ID_RE.test(localId)) throw new Error('instanceId locale non disponibile');
+  const owners = [{ instanceId: localId, route: [], label: 'Local', stale: false },
+    ...topologyOwners(topology).filter((owner) => !owner.stale && owner.instanceId !== localId)];
+  const cells = [];
+  const unavailable = [];
+  await Promise.all(owners.map(async (owner) => {
+    const apiPath = owner.route.length ? routePath(owner.route, 'cells') : '/api/cells';
+    if (!apiPath) return;
+    try {
+      cells.push(...normalizeCellPayload(await ctx.api('GET', apiPath), owner, callerSession));
+    } catch (_) {
+      unavailable.push({ instanceId: owner.instanceId, owner: owner.label,
+        route: owner.route.length ? owner.route.join('/') : 'local' });
+    }
+  }));
+  cells.sort((a, b) => (a.route === 'local' ? -1 : b.route === 'local' ? 1
+    : a.route.localeCompare(b.route)) || a.cell.localeCompare(b.cell));
+  unavailable.sort((a, b) => a.route.localeCompare(b.route));
+  return { nodeId: localId, cells, unavailable };
+}
+
 // --- definizione tool (prefisso nc_ anti-collisione) ---------------------------
 // annotations.readOnlyHint:true sui tool che non mutano nulla (§1).
 const TOOLS = [
@@ -337,6 +403,63 @@ const TOOLS = [
       };
     },
   },
+  {
+    name: 'nc_cells',
+    description: 'Directory read-only di tutte le celle Fleet autorizzate nella rete NexusCrew. Usa l\'id owner-qualified restituito per evitare nomi ambigui.',
+    inputSchema: { type: 'object', properties: {} },
+    annotations: { readOnlyHint: true },
+    async handler(_args, ctx) {
+      const callerSession = await ctx.session();
+      return readCellDirectory(ctx, callerSession);
+    },
+  },
+  {
+    name: 'nc_send_cell',
+    description: 'Invia e sottopone un messaggio a una cella Fleet attiva autorizzata. target deve essere l\'id esatto restituito da nc_cells; submitted non significa lavoro completato.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        target: { type: 'string', description: 'id owner-qualified restituito da nc_cells: <instanceId>:<cell>' },
+        message: { type: 'string', description: 'messaggio o task da sottoporre (max 8000 caratteri)' },
+      },
+      required: ['target', 'message'],
+    },
+    async handler(args, ctx) {
+      const targetRef = parseCellTarget(argString(args, 'target', { required: true, max: 128 }));
+      if (!targetRef) throw new Error('target non valido: usa l\'id esatto restituito da nc_cells');
+      const message = argString(args, 'message', { required: true, max: 8000 });
+      for (let i = 0; i < message.length; i += 1) {
+        const code = message.charCodeAt(i);
+        if (code === 9 || code === 10 || code === 13) continue;
+        if (code < 32 || code === 127) throw new Error('message contiene caratteri di controllo non ammessi');
+      }
+      const callerSession = requireSession(await ctx.session(), 'nc_send_cell');
+      const directory = await readCellDirectory(ctx, callerSession);
+      const sender = directory.cells.find((cell) => cell.self && cell.active);
+      if (!sender) throw new Error('nc_send_cell: la sessione chiamante non e\' una cella Fleet attiva locale');
+      const target = directory.cells.find((cell) => cell.instanceId === targetRef.instanceId
+        && cell.cell === targetRef.cell);
+      if (!target) throw new Error('cella destinataria non trovata nella rete autorizzata');
+      if (!target.canReceive) throw new Error('cella destinataria non attiva; nessun messaggio accodato');
+      const apiPath = target.route === 'local'
+        ? '/api/cells/send' : routePath(target.route.split('/'), 'cells/send');
+      if (!apiPath) throw new Error('route destinataria non valida');
+      const id = ctx.messageId();
+      const receipt = await ctx.api('POST', apiPath, {
+        id,
+        from: { instanceId: sender.instanceId, cell: sender.cell, tmuxSession: sender.tmuxSession },
+        to: { instanceId: target.instanceId, cell: target.cell, tmuxSession: target.tmuxSession },
+        message,
+      });
+      return {
+        id: receipt.id,
+        status: receipt.status,
+        at: receipt.at,
+        to: receipt.to,
+        note: receipt.note || 'submitted conferma il trasporto, non il completamento del task',
+      };
+    },
+  },
   {
     name: 'nc_inbox',
     description: 'Elenca i file ricevuti nell\'inbox NexusCrew di questa sessione (read-only).',
@@ -357,6 +480,7 @@ function createMcpServer(opts = {}) {
   const env = opts.env || process.env;
   const execFileImpl = opts.execFileImpl || execFile;
   const fetchImpl = opts.fetchImpl || fetch;
+  const idFactory = opts.idFactory || (() => crypto.randomUUID());
   const errlog = opts.errlog || ((s) => { try { process.stderr.write(`${s}\n`); } catch (_) {} });
   // Config UNICA fonte per porta/token path: stessa risoluzione del server
   // (config.json + env NEXUSCREW_CONFIG_FILE/PORT/TOKEN_FILE). opts.config per test.
@@ -405,6 +529,7 @@ function createMcpServer(opts = {}) {
     api,
     home: () => env.HOME || os.homedir(),
     fileExists: (p) => { try { return require('node:fs').statSync(p).isFile(); } catch (_) { return false; } },
+    messageId: () => String(idFactory()).toLowerCase(),
   };
 
   function write(msg) {
@@ -539,4 +664,7 @@ function startMcp(opts = {}) {
   return srv;
 }
 
-module.exports = { createMcpServer, startMcp, resolveSession, TOOLS };
+module.exports = {
+  createMcpServer, startMcp, resolveSession, TOOLS,
+  parseCellTarget, normalizeCellPayload, readCellDirectory,
+};

package/lib/proxy/federation.js

@@ -57,6 +57,8 @@ function knownResource(resource) {
     || resource === '/files'
     || resource === '/files/download'
     || resource === '/files/upload'
+    || resource === '/cells'
+    || resource === '/cells/send'
     || resource === '/decks'
     || /^\/decks\/[a-z0-9-]{1,32}$/.test(resource)
     || resource === '/topology'
@@ -65,7 +67,7 @@ function knownResource(resource) {
     // Hydra: the rest of /settings stays unreachable.
     || resource === '/settings/peering/invite'
     || resource === '/ws'
-    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells)$/.test(resource);
+    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource);
 }
 
 function allowedResource(resource, method = 'GET') {
@@ -76,6 +78,8 @@ function allowedResource(resource, method = 'GET') {
   if (resource === '/files') return method === 'GET' || method === 'DELETE';
   if (resource === '/files/download') return method === 'GET';
   if (resource === '/files/upload') return method === 'POST';
+  if (resource === '/cells') return method === 'GET';
+  if (resource === '/cells/send') return method === 'POST';
   if (resource === '/decks') return method === 'GET' || method === 'POST';
   if (/^\/decks\/[a-z0-9-]{1,32}$/.test(resource)) {
     return method === 'PUT' || method === 'PATCH' || method === 'DELETE';
@@ -84,7 +88,7 @@ function allowedResource(resource, method = 'GET') {
   if (resource === '/settings/peering/invite') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
   if (/^\/fleet\/(status|schema|definitions)$/.test(resource)) return method === 'GET';
-  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells)$/.test(resource)) return method === 'POST';
+  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource)) return method === 'POST';
   return false;
 }
 
@@ -116,7 +120,12 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     const visited = controlledVisited(req, ingress, st.nodeId);
     if (!visited) return res.status(409).json({ error: 'federation cycle rejected' });
     if (parsed.route.length === 0) {
-      return proxyHttp(req, res, { port: typeof localPort === 'function' ? localPort() : localPort, path: `/api${parsed.resource}${queryOf(req.url)}`, credential: localCredential() });
+      return proxyHttp(req, res, {
+        port: typeof localPort === 'function' ? localPort() : localPort,
+        path: `/api${parsed.resource}${queryOf(req.url)}`,
+        credential: localCredential(),
+        visited,
+      });
     }
     const next = st && store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
@@ -196,9 +205,37 @@ async function probeHealth({ port, token, expectedInstanceId = null, fetchImpl =
   return out;
 }
 
+// A freshly restarted SSH supervisor returns before both forwards are
+// necessarily accepting traffic.  Share must therefore wait for the actual
+// authenticated federation channel instead of racing a single immediate
+// fetch.  Auth/identity failures are terminal; transport startup is retried
+// for a short bounded window.
+async function waitForHealthyPeer(opts = {}) {
+  const attempts = Number.isInteger(opts.attempts) && opts.attempts > 0 ? Math.min(opts.attempts, 12) : 6;
+  const delayMs = Number.isInteger(opts.delayMs) && opts.delayMs >= 0 ? Math.min(opts.delayMs, 2000) : 200;
+  const delay = typeof opts.delay === 'function'
+    ? opts.delay : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  const probeOpts = { ...opts };
+  delete probeOpts.attempts; delete probeOpts.delayMs; delete probeOpts.delay;
+  let last = null;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    last = await probeHealth(probeOpts);
+    if (last.status === 'healthy') return last;
+    if (last.auth === 'failed' || /instanceId inatteso/.test(last.detail || '')) break;
+    if (attempt + 1 < attempts) await delay(delayMs);
+  }
+  return last || { status: 'down', detail: 'peer non raggiungibile' };
+}
+
 function controlledVisited(req, ingress, instanceId) {
   const raw = ingress ? String(req.headers['x-nexuscrew-visited'] || '') : '';
   const seen = raw ? raw.split(',').filter(Boolean) : [];
+  // On a peer-facing route the last server-controlled hop must be the peer
+  // authenticated by its scoped federation token.  Without this binding a
+  // token holder could forge the first visited ID and impersonate another
+  // cell-network sender at the destination.
+  if (ingress && (!store.NODE_ID_RE.test(String(ingress.nodeId || ''))
+    || !seen.length || seen.at(-1) !== ingress.nodeId)) return null;
   if (seen.some((id) => !store.NODE_ID_RE.test(id)) || seen.includes(instanceId) || seen.length > MAX_HOPS) return null;
   return [...seen, instanceId];
 }
@@ -320,11 +357,13 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
     }
     try {
       if (body.shared) {
-        const health = await probeHealth({
+        const health = await waitForHealthyPeer({
           port: req.peer.localPort,
           token: req.peer.token,
           expectedInstanceId: req.peer.nodeId || null,
           fetchImpl: fetchImpl || fetch,
+          attempts: 6,
+          delayMs: 200,
         });
         if (health.status !== 'healthy') {
           return res.status(409).json({
@@ -396,5 +435,5 @@ function reject(socket, code) { try { socket.end(`HTTP/1.1 ${code} Error\r\nConn
 module.exports = {
   MAX_HOPS, ROUTE_DELIMITER, peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade,
-  probeHealth,
+  probeHealth, waitForHealthyPeer,
 };

package/lib/pty/attach.js

@@ -2,6 +2,7 @@
 const { execFile } = require('node:child_process');
 const os = require('node:os');
 const { loadPty } = require('./provider.js');
+const { withUtf8Locale } = require('../runtime/env.js');
 
 // Opens `tmux attach` inside a real PTY, non-destructive for other clients.
 //
@@ -31,7 +32,7 @@ function openAttach(session, opts = {}) {
     name: 'xterm-256color',
     cols, rows,
     cwd: process.env.HOME || os.homedir(),
-    env: process.env,
+    env: withUtf8Locale(process.env),
   });
   // tty del client tmux (es. /dev/pts/N): identifica QUESTO client per la
   // promozione/demozione runtime del size-owner via `refresh-client -t <tty>`.
@@ -52,4 +53,4 @@ function openAttach(session, opts = {}) {
     demote: () => setFlags('ignore-size'),
   };
 }
-module.exports = { openAttach };
+module.exports = { openAttach, attachEnv: (env, platform) => withUtf8Locale(env, { platform }) };

package/lib/runtime/env.js

@@ -0,0 +1,50 @@
+'use strict';
+
+const os = require('node:os');
+
+const MINIMAL_ENV_KEYS = Object.freeze([
+  'PATH', 'HOME', 'SHELL', 'TERM', 'COLORTERM', 'LANG', 'LANGUAGE',
+  'LC_ALL', 'LC_CTYPE', 'USER', 'LOGNAME', 'TMUX', 'TMUX_TMPDIR',
+  'XDG_RUNTIME_DIR', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME',
+  'DBUS_SESSION_BUS_ADDRESS',
+  // Termux/Android native clients need these to resolve their runtime, tmp and
+  // platform paths.  They are location metadata, never credentials.
+  'PREFIX', 'TMPDIR', 'TERMUX_VERSION', 'ANDROID_DATA', 'ANDROID_ROOT',
+]);
+
+const UTF8_RE = /utf-?8/i;
+
+function localeDefaults(platform = process.platform, env = process.env) {
+  const termux = platform === 'android' || String(env.PREFIX || '').includes('com.termux');
+  if (platform === 'darwin') return { lang: 'en_US.UTF-8', ctype: 'UTF-8' };
+  if (termux) return { lang: 'en_US.UTF-8', ctype: 'en_US.UTF-8' };
+  return { lang: 'C.UTF-8', ctype: 'C.UTF-8' };
+}
+
+function withUtf8Locale(source = process.env, { platform = process.platform } = {}) {
+  const env = { ...source };
+  const defaults = localeDefaults(platform, env);
+  const effective = env.LC_ALL || env.LC_CTYPE || env.LANG || '';
+  if (!UTF8_RE.test(effective)) {
+    if (env.LC_ALL) env.LC_ALL = defaults.lang;
+    env.LANG = defaults.lang;
+    env.LC_CTYPE = defaults.ctype;
+  } else {
+    if (!env.LANG) env.LANG = defaults.lang;
+    if (!env.LC_CTYPE) env.LC_CTYPE = env.LC_ALL || env.LANG || defaults.ctype;
+  }
+  if (!env.TERM) env.TERM = 'xterm-256color';
+  return env;
+}
+
+function minimalRuntimeEnv(source = process.env, opts = {}) {
+  const selected = {};
+  for (const key of MINIMAL_ENV_KEYS) {
+    if (source[key] !== undefined && source[key] !== '') selected[key] = String(source[key]);
+  }
+  if (!selected.PATH) selected.PATH = '/usr/local/bin:/usr/bin:/bin';
+  if (!selected.HOME) selected.HOME = opts.home || os.homedir();
+  return withUtf8Locale(selected, opts);
+}
+
+module.exports = { MINIMAL_ENV_KEYS, UTF8_RE, localeDefaults, withUtf8Locale, minimalRuntimeEnv };

package/lib/server.js

@@ -9,7 +9,7 @@ const { WebSocketServer } = require('ws');
 const { defaults, loadConfig, assertLoopback, configJsonPath } = require('./config.js');
 const { writeConfigAtomic } = require('./cli/init.js');
 const { listSessions, attachedClients } = require('./tmux/list.js');
-const { runAction, pasteToSession } = require('./tmux/actions.js');
+const { runAction, pasteToSession, submitToSession } = require('./tmux/actions.js');
 const { createSession, killSession, isProtectedSession } = require('./tmux/lifecycle.js');
 const { createPreviewSampler } = require('./tmux/preview.js');
 const { openAttach } = require('./pty/attach.js');
@@ -22,6 +22,7 @@ const VERSION = require('../package.json').version;
 const { transcribe } = require('./voice/transcribe.js');
 const { selectProvider } = require('./fleet/provider.js');
 const { fleetRoutes } = require('./fleet/routes.js');
+const { cellsRoutes } = require('./cells/routes.js');
 const { fsRoutes } = require('./fs/routes.js');
 const nodesStore = require('./nodes/store.js');
 const nodesTunnel = require('./nodes/tunnel.js');
@@ -220,6 +221,14 @@ function createServer(opts = {}) {
     sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
   }));
   api.use('/fleet', fleetRoutes(fleetP, cfg));
+  api.use('/cells', cellsRoutes({
+    fleetP,
+    instanceId: () => (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
+    submit: opts.cellSubmit || ((session, text, meta) => submitToSession(cfg.tmuxBin, session, text, {
+      engine: meta && meta.engine,
+    })),
+    readonly: proxyReadonly,
+  }));
   api.use('/decks', decksRoutes({ cfg, decksPath }));
   api.use('/fs', fsRoutes({ home: os.homedir() }));  // folder-picker del dialog new session
   // /nodes (read-only, per la settings UI B2): stesso formato di `nodes list --json`

package/lib/settings/routes.js

@@ -47,7 +47,7 @@ const nodesStore = require('../nodes/store.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
-const { probeHealth } = require('../proxy/federation.js');
+const { probeHealth, waitForHealthyPeer } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
@@ -822,9 +822,10 @@ function settingsRoutes(deps = {}) {
       if (!started.started && started.reason !== 'already running') {
         throw new Error(started.reason || 'avvio SSH fallito');
       }
-      const ready = await probeHealth({
+      const ready = await waitForHealthyPeer({
         port: node.localPort, token: node.token, expectedInstanceId: node.nodeId,
-        fetchImpl,
+        fetchImpl, attempts: 8, delayMs: 200,
+        ...(typeof seams.pairDelay === 'function' ? { delay: seams.pairDelay } : {}),
       });
       if (!ready || ready.status !== 'healthy') {
         const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, name, node.remotePort);

package/lib/tmux/actions.js

@@ -1,5 +1,10 @@
 'use strict';
 const { execFile } = require('node:child_process');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { isValidSession } = require('../files/store.js');
 
 // Window/pane navigation must NOT be emulated with client-side prefix keys
 // (it depends on each host's bindings, which may be remapped or broken).
@@ -53,6 +58,7 @@ function runAction(tmuxBin, session, name) {
 }
 
 const MAX_PASTE = 4096;
+const MAX_SUBMIT = 8192;
 
 // true se text contiene control char (codici 0x00-0x1f e 0x7f). Espresso via
 // charCode invece di regex perche' il write-layer corrompe gli escape backslash
@@ -86,4 +92,93 @@ function pasteToSession(tmuxBin, session, text) {
   });
 }
 
-module.exports = { actionArgs, runAction, ACTIONS, pasteArgs, pasteToSession, scrollArgs };
+function submitTextOk(text) {
+  if (typeof text !== 'string' || !text || text.length > MAX_SUBMIT) return false;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text.charCodeAt(i);
+    if (c === 9 || c === 10 || c === 13) continue;
+    if (c < 32 || c === 127) return false;
+  }
+  return true;
+}
+
+function execTmux(execFileImpl, tmuxBin, args, timeout = 5000) {
+  return new Promise((resolve) => {
+    try {
+      execFileImpl(tmuxBin, args, { timeout }, (err, stdout) => {
+        resolve({ ok: !err, stdout: String(stdout || '') });
+      });
+    } catch (_) { resolve({ ok: false, stdout: '' }); }
+  });
+}
+
+// Consegna un messaggio a un pane esatto e lo sottopone al TUI. Il testo non
+// passa mai in argv: file temporaneo 0600 -> tmux load-buffer -> paste-buffer -p
+// (bracketed paste), poi Enter con una chiamata separata. Il pane id viene
+// risolto prima del paste e verificato di nuovo prima dell'Enter, evitando
+// prefix match e il riuso del solo nome sessione.
+async function submitToSession(tmuxBin, session, text, opts = {}) {
+  if (!isValidSession(session) || !submitTextOk(text)) {
+    return { submitted: false, reason: 'input non valido' };
+  }
+  const execFileImpl = opts.execFileImpl || execFile;
+  const fsImpl = opts.fsImpl || fs;
+  const tmpRoot = opts.tmpdir || os.tmpdir();
+  const delay = typeof opts.delay === 'function'
+    ? opts.delay : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  const codexComposer = /^(?:codex|codex-vl)(?:\.|$)/.test(String(opts.engine || ''));
+  const nonce = (opts.nonce || crypto.randomBytes(8).toString('hex')).replace(/[^a-f0-9]/g, '').slice(0, 32);
+  if (!nonce) return { submitted: false, reason: 'invio non disponibile' };
+  const buffer = `ncmsg-${nonce}`;
+  const tmp = path.join(tmpRoot, `.nexuscrew-message-${nonce}.txt`);
+  let loaded = false;
+  try {
+    fsImpl.writeFileSync(tmp, text, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    fsImpl.chmodSync(tmp, 0o600);
+    const pane = await execTmux(execFileImpl, tmuxBin,
+      ['display-message', '-p', '-t', `=${session}:`, '#{pane_id}']);
+    const paneId = pane.stdout.trim();
+    if (!pane.ok || !/^%[0-9]+$/.test(paneId)) {
+      return { submitted: false, reason: 'sessione non raggiungibile' };
+    }
+    const load = await execTmux(execFileImpl, tmuxBin, ['load-buffer', '-b', buffer, tmp]);
+    if (!load.ok) return { submitted: false, reason: 'buffer non disponibile' };
+    loaded = true;
+    const paste = await execTmux(execFileImpl, tmuxBin,
+      ['paste-buffer', '-p', '-t', paneId, '-b', buffer]);
+    if (!paste.ok) return { submitted: false, reason: 'consegna non riuscita' };
+    const paneAlive = async () => {
+      const verify = await execTmux(execFileImpl, tmuxBin,
+        ['display-message', '-p', '-t', paneId, '#{session_name}\t#{pane_dead}\t#{pane_id}']);
+      const [verifiedSession, dead, verifiedPane] = verify.stdout.trim().split('\t');
+      return verify.ok && verifiedSession === session && dead === '0' && verifiedPane === paneId;
+    };
+    // Codex/Codex-VL have a paste-burst window: a too-early Enter can remain
+    // inside the composer. C-e is sent as its own tmux command after the paste,
+    // then the pane is revalidated before the separate Enter. Other clients
+    // still receive a short separation between paste and submit.
+    await delay(codexComposer ? 400 : 150);
+    if (!(await paneAlive())) return { submitted: false, reason: 'sessione terminata durante la consegna' };
+    if (codexComposer) {
+      const flush = await execTmux(execFileImpl, tmuxBin, ['send-keys', '-t', paneId, 'C-e']);
+      if (!flush.ok) return { submitted: false, reason: 'testo consegnato ma flush composer non riuscito' };
+      await delay(300);
+      if (!(await paneAlive())) return { submitted: false, reason: 'sessione terminata durante la consegna' };
+    }
+    const enter = await execTmux(execFileImpl, tmuxBin, ['send-keys', '-t', paneId, 'Enter']);
+    if (!enter.ok) return { submitted: false, reason: 'testo consegnato ma invio non riuscito' };
+    return { submitted: true, reason: codexComposer
+      ? 'bracketed paste + burst flush + Enter separati'
+      : 'bracketed paste + Enter separato' };
+  } catch (_) {
+    return { submitted: false, reason: 'consegna non riuscita' };
+  } finally {
+    if (loaded) await execTmux(execFileImpl, tmuxBin, ['delete-buffer', '-b', buffer]);
+    try { fsImpl.unlinkSync(tmp); } catch (_) { /* cleanup best-effort */ }
+  }
+}
+
+module.exports = {
+  actionArgs, runAction, ACTIONS, pasteArgs, pasteToSession, scrollArgs,
+  submitTextOk, submitToSession, MAX_SUBMIT,
+};

package/lib/tmux/list.js

@@ -17,7 +17,8 @@ function parseSessions(raw) {
         activity: Number(activity) || 0,
         cmd: cmd || '',
       };
-    });
+    })
+    .filter((session) => session.windows > 0);
 }
 
 function listSessions(tmuxBin = 'tmux') {

package/lib/update/core.js

@@ -48,15 +48,42 @@ function compareVersions(a, b) {
 }
 
 function registryVersion(stdout) {
-  const raw = String(stdout || '').trim();
-  let value = raw;
+  const raw = String(stdout || '')
+    .replace(/^\uFEFF/, '')
+    .replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, '')
+    .trim();
+  const candidates = [];
+  const add = (value) => {
+    if (typeof value !== 'string') return;
+    const parsed = parseVersion(value);
+    if (parsed) candidates.push(parsed.raw);
+  };
   try {
     const decoded = JSON.parse(raw);
-    if (typeof decoded === 'string') value = decoded;
-  } catch (_) { /* npm senza --json o output gia' plain */ }
-  const parsed = parseVersion(value);
-  if (!parsed) throw new Error('npm ha restituito una versione non valida');
-  return parsed.raw;
+    if (typeof decoded === 'string') add(decoded);
+    else if (Array.isArray(decoded)) decoded.forEach(add);
+    else if (decoded && typeof decoded === 'object') add(decoded.version);
+  } catch (_) {
+    // npm versions differ in whether --json returns a JSON scalar or a plain
+    // line.  Notices may also precede the value, so inspect complete lines but
+    // never extract a semver from the middle of arbitrary text.
+    for (const line of raw.split(/\r?\n/)) add(line.trim().replace(/^['"]|['"]$/g, ''));
+  }
+  const unique = [...new Set(candidates)];
+  if (unique.length !== 1) throw new Error('npm ha restituito una versione non valida');
+  return unique[0];
+}
+
+function stableRuntimeDir(home) {
+  const dir = path.join(path.resolve(String(home || '')), '.nexuscrew');
+  try {
+    const st = fs.lstatSync(dir);
+    if (!st.isDirectory() || st.isSymbolicLink()) throw new Error('directory runtime NexusCrew non sicura');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  }
+  return dir;
 }
 
 function scrubError(error) {
@@ -153,5 +180,5 @@ function writeState(file, value) {
 module.exports = {
   PACKAGE_NAME, VERSION_RE, parseVersion, compareVersions, registryVersion,
   scrubError, pidAlive, readLock, acquireUpdateLock, adoptUpdateLock, releaseUpdateLock,
-  readState, writeState,
+  readState, writeState, stableRuntimeDir,
 };

package/lib/update/manager.js

@@ -6,7 +6,7 @@ const path = require('node:path');
 const { execFile, spawn } = require('node:child_process');
 const {
   PACKAGE_NAME, compareVersions, parseVersion, registryVersion, scrubError, pidAlive, readLock,
-  acquireUpdateLock, releaseUpdateLock, readState, writeState,
+  acquireUpdateLock, releaseUpdateLock, readState, writeState, stableRuntimeDir,
 } = require('./core.js');
 
 const DEFAULT_INITIAL_DELAY_MS = 60 * 1000;
@@ -24,10 +24,11 @@ function isNewer(candidate, current) {
   try { return compareVersions(candidate, current) > 0; } catch (_) { return false; }
 }
 
-function lookupLatestNpm({ execFileImpl = execFile, timeoutMs = 20_000 } = {}) {
+function lookupLatestNpm({ execFileImpl = execFile, timeoutMs = 20_000, home = os.homedir(), cwd } = {}) {
   return new Promise((resolve, reject) => {
     execFileImpl('npm', ['view', `${PACKAGE_NAME}@latest`, 'version', '--json'], {
       encoding: 'utf8', timeout: timeoutMs, maxBuffer: 64 * 1024,
+      cwd: cwd || stableRuntimeDir(home),
     }, (error, stdout) => {
       if (error) return reject(error);
       try { resolve(registryVersion(stdout)); } catch (e) { reject(e); }
@@ -42,6 +43,7 @@ function createNpmUpdater(opts = {}) {
   const logPath = opts.logPath || path.join(home, '.nexuscrew', 'npm-update.log');
   const lockPath = opts.lockPath || path.join(home, '.nexuscrew', 'npm-update.lock');
   const runnerPath = opts.runnerPath || path.join(__dirname, 'runner.js');
+  const workDir = opts.cwd || stableRuntimeDir(home);
   const supported = opts.supported === undefined ? isGlobalInstall(opts.packageRoot) : !!opts.supported;
   const readonly = opts.readonly === true;
   const lookupLatest = opts.lookupLatest || (() => lookupLatestNpm(opts));
@@ -135,7 +137,8 @@ function createNpmUpdater(opts = {}) {
           process.execPath, ...runnerArgs]
         : runnerArgs;
       child = spawnImpl(bin, argv, {
-        detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, NEXUSCREW_UPDATE_RUNNER: '1' },
+        detached: true, stdio: ['ignore', fd, fd], cwd: workDir,
+        env: { ...process.env, NEXUSCREW_UPDATE_RUNNER: '1' },
       });
     } catch (e) {
       releaseUpdateLock(lockPath, reservation.token);