@mmmbuto/nexuscrew 0.8.12 → 0.8.14

package/lib/proxy/federation.js

@@ -51,12 +51,14 @@ function parseRoute(raw) {
 
 function knownResource(resource) {
   return resource === '/sessions'
-    || /^\/sessions\/[\w.@%:+-]{1,128}$/.test(resource)
+    || /^\/sessions\/[\w.@%:+-]{1,128}(?:\/visibility)?$/.test(resource)
     || resource === '/config'
     || resource === '/fs/dirs'
     || resource === '/files'
     || resource === '/files/download'
     || resource === '/files/upload'
+    || resource === '/cells'
+    || resource === '/cells/send'
     || resource === '/decks'
     || /^\/decks\/[a-z0-9-]{1,32}$/.test(resource)
     || resource === '/topology'
@@ -65,17 +67,20 @@ function knownResource(resource) {
     // Hydra: the rest of /settings stays unreachable.
     || resource === '/settings/peering/invite'
     || resource === '/ws'
-    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells)$/.test(resource);
+    || /^\/fleet\/(status|schema|definitions|credentials\/status|credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource);
 }
 
 function allowedResource(resource, method = 'GET') {
   if (resource === '/sessions') return method === 'GET' || method === 'POST';
   if (/^\/sessions\/[\w.@%:+-]{1,128}$/.test(resource)) return method === 'DELETE';
+  if (/^\/sessions\/[\w.@%:+-]{1,128}\/visibility$/.test(resource)) return method === 'PATCH';
   if (resource === '/config') return method === 'GET';
   if (resource === '/fs/dirs') return method === 'GET';
   if (resource === '/files') return method === 'GET' || method === 'DELETE';
   if (resource === '/files/download') return method === 'GET';
   if (resource === '/files/upload') return method === 'POST';
+  if (resource === '/cells') return method === 'GET';
+  if (resource === '/cells/send') return method === 'POST';
   if (resource === '/decks') return method === 'GET' || method === 'POST';
   if (/^\/decks\/[a-z0-9-]{1,32}$/.test(resource)) {
     return method === 'PUT' || method === 'PATCH' || method === 'DELETE';
@@ -83,8 +88,8 @@ function allowedResource(resource, method = 'GET') {
   if (resource === '/topology') return method === 'GET';
   if (resource === '/settings/peering/invite') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
-  if (/^\/fleet\/(status|schema|definitions)$/.test(resource)) return method === 'GET';
-  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells)$/.test(resource)) return method === 'POST';
+  if (/^\/fleet\/(status|schema|definitions|credentials\/status)$/.test(resource)) return method === 'GET';
+  if (/^\/fleet\/(credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource)) return method === 'POST';
   return false;
 }
 
@@ -116,7 +121,12 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     const visited = controlledVisited(req, ingress, st.nodeId);
     if (!visited) return res.status(409).json({ error: 'federation cycle rejected' });
     if (parsed.route.length === 0) {
-      return proxyHttp(req, res, { port: typeof localPort === 'function' ? localPort() : localPort, path: `/api${parsed.resource}${queryOf(req.url)}`, credential: localCredential() });
+      return proxyHttp(req, res, {
+        port: typeof localPort === 'function' ? localPort() : localPort,
+        path: `/api${parsed.resource}${queryOf(req.url)}`,
+        credential: localCredential(),
+        visited,
+      });
     }
     const next = st && store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
@@ -196,9 +206,37 @@ async function probeHealth({ port, token, expectedInstanceId = null, fetchImpl =
   return out;
 }
 
+// A freshly restarted SSH supervisor returns before both forwards are
+// necessarily accepting traffic.  Share must therefore wait for the actual
+// authenticated federation channel instead of racing a single immediate
+// fetch.  Auth/identity failures are terminal; transport startup is retried
+// for a short bounded window.
+async function waitForHealthyPeer(opts = {}) {
+  const attempts = Number.isInteger(opts.attempts) && opts.attempts > 0 ? Math.min(opts.attempts, 12) : 6;
+  const delayMs = Number.isInteger(opts.delayMs) && opts.delayMs >= 0 ? Math.min(opts.delayMs, 2000) : 200;
+  const delay = typeof opts.delay === 'function'
+    ? opts.delay : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  const probeOpts = { ...opts };
+  delete probeOpts.attempts; delete probeOpts.delayMs; delete probeOpts.delay;
+  let last = null;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    last = await probeHealth(probeOpts);
+    if (last.status === 'healthy') return last;
+    if (last.auth === 'failed' || /instanceId inatteso/.test(last.detail || '')) break;
+    if (attempt + 1 < attempts) await delay(delayMs);
+  }
+  return last || { status: 'down', detail: 'peer non raggiungibile' };
+}
+
 function controlledVisited(req, ingress, instanceId) {
   const raw = ingress ? String(req.headers['x-nexuscrew-visited'] || '') : '';
   const seen = raw ? raw.split(',').filter(Boolean) : [];
+  // On a peer-facing route the last server-controlled hop must be the peer
+  // authenticated by its scoped federation token.  Without this binding a
+  // token holder could forge the first visited ID and impersonate another
+  // cell-network sender at the destination.
+  if (ingress && (!store.NODE_ID_RE.test(String(ingress.nodeId || ''))
+    || !seen.length || seen.at(-1) !== ingress.nodeId)) return null;
   if (seen.some((id) => !store.NODE_ID_RE.test(id)) || seen.includes(instanceId) || seen.length > MAX_HOPS) return null;
   return [...seen, instanceId];
 }
@@ -320,11 +358,13 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
     }
     try {
       if (body.shared) {
-        const health = await probeHealth({
+        const health = await waitForHealthyPeer({
           port: req.peer.localPort,
           token: req.peer.token,
           expectedInstanceId: req.peer.nodeId || null,
           fetchImpl: fetchImpl || fetch,
+          attempts: 6,
+          delayMs: 200,
         });
         if (health.status !== 'healthy') {
           return res.status(409).json({
@@ -396,5 +436,5 @@ function reject(socket, code) { try { socket.end(`HTTP/1.1 ${code} Error\r\nConn
 module.exports = {
   MAX_HOPS, ROUTE_DELIMITER, peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade,
-  probeHealth,
+  probeHealth, waitForHealthyPeer,
 };

package/lib/pty/attach.js

@@ -2,6 +2,7 @@
 const { execFile } = require('node:child_process');
 const os = require('node:os');
 const { loadPty } = require('./provider.js');
+const { withUtf8Locale } = require('../runtime/env.js');
 
 // Opens `tmux attach` inside a real PTY, non-destructive for other clients.
 //
@@ -31,7 +32,7 @@ function openAttach(session, opts = {}) {
     name: 'xterm-256color',
     cols, rows,
     cwd: process.env.HOME || os.homedir(),
-    env: process.env,
+    env: withUtf8Locale(process.env),
   });
   // tty del client tmux (es. /dev/pts/N): identifica QUESTO client per la
   // promozione/demozione runtime del size-owner via `refresh-client -t <tty>`.
@@ -52,4 +53,4 @@ function openAttach(session, opts = {}) {
     demote: () => setFlags('ignore-size'),
   };
 }
-module.exports = { openAttach };
+module.exports = { openAttach, attachEnv: (env, platform) => withUtf8Locale(env, { platform }) };

package/lib/runtime/env.js

@@ -0,0 +1,50 @@
+'use strict';
+
+const os = require('node:os');
+
+const MINIMAL_ENV_KEYS = Object.freeze([
+  'PATH', 'HOME', 'SHELL', 'TERM', 'COLORTERM', 'LANG', 'LANGUAGE',
+  'LC_ALL', 'LC_CTYPE', 'USER', 'LOGNAME', 'TMUX', 'TMUX_TMPDIR',
+  'XDG_RUNTIME_DIR', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME',
+  'DBUS_SESSION_BUS_ADDRESS',
+  // Termux/Android native clients need these to resolve their runtime, tmp and
+  // platform paths.  They are location metadata, never credentials.
+  'PREFIX', 'TMPDIR', 'TERMUX_VERSION', 'ANDROID_DATA', 'ANDROID_ROOT',
+]);
+
+const UTF8_RE = /utf-?8/i;
+
+function localeDefaults(platform = process.platform, env = process.env) {
+  const termux = platform === 'android' || String(env.PREFIX || '').includes('com.termux');
+  if (platform === 'darwin') return { lang: 'en_US.UTF-8', ctype: 'UTF-8' };
+  if (termux) return { lang: 'en_US.UTF-8', ctype: 'en_US.UTF-8' };
+  return { lang: 'C.UTF-8', ctype: 'C.UTF-8' };
+}
+
+function withUtf8Locale(source = process.env, { platform = process.platform } = {}) {
+  const env = { ...source };
+  const defaults = localeDefaults(platform, env);
+  const effective = env.LC_ALL || env.LC_CTYPE || env.LANG || '';
+  if (!UTF8_RE.test(effective)) {
+    if (env.LC_ALL) env.LC_ALL = defaults.lang;
+    env.LANG = defaults.lang;
+    env.LC_CTYPE = defaults.ctype;
+  } else {
+    if (!env.LANG) env.LANG = defaults.lang;
+    if (!env.LC_CTYPE) env.LC_CTYPE = env.LC_ALL || env.LANG || defaults.ctype;
+  }
+  if (!env.TERM) env.TERM = 'xterm-256color';
+  return env;
+}
+
+function minimalRuntimeEnv(source = process.env, opts = {}) {
+  const selected = {};
+  for (const key of MINIMAL_ENV_KEYS) {
+    if (source[key] !== undefined && source[key] !== '') selected[key] = String(source[key]);
+  }
+  if (!selected.PATH) selected.PATH = '/usr/local/bin:/usr/bin:/bin';
+  if (!selected.HOME) selected.HOME = opts.home || os.homedir();
+  return withUtf8Locale(selected, opts);
+}
+
+module.exports = { MINIMAL_ENV_KEYS, UTF8_RE, localeDefaults, withUtf8Locale, minimalRuntimeEnv };

package/lib/server.js

@@ -8,8 +8,8 @@ const express = require('express');
 const { WebSocketServer } = require('ws');
 const { defaults, loadConfig, assertLoopback, configJsonPath } = require('./config.js');
 const { writeConfigAtomic } = require('./cli/init.js');
-const { listSessions, attachedClients } = require('./tmux/list.js');
-const { runAction, pasteToSession } = require('./tmux/actions.js');
+const { listSessions, attachedClients, setSessionVisibility } = require('./tmux/list.js');
+const { runAction, pasteToSession, submitToSession } = require('./tmux/actions.js');
 const { createSession, killSession, isProtectedSession } = require('./tmux/lifecycle.js');
 const { createPreviewSampler } = require('./tmux/preview.js');
 const { openAttach } = require('./pty/attach.js');
@@ -22,6 +22,7 @@ const VERSION = require('../package.json').version;
 const { transcribe } = require('./voice/transcribe.js');
 const { selectProvider } = require('./fleet/provider.js');
 const { fleetRoutes } = require('./fleet/routes.js');
+const { cellsRoutes } = require('./cells/routes.js');
 const { fsRoutes } = require('./fs/routes.js');
 const nodesStore = require('./nodes/store.js');
 const nodesTunnel = require('./nodes/tunnel.js');
@@ -196,6 +197,17 @@ function createServer(opts = {}) {
       res.json({ killed: true });
     } catch (e) { res.status(e.status || 500).json({ error: String(e.message || e) }); }
   });
+  api.patch('/sessions/:name/visibility', express.json({ limit: '1kb' }), async (req, res) => {
+    if (proxyReadonly()) return res.status(403).json({ error: 'READONLY: classificazione sessione bloccata' });
+    const name = String(req.params.name || '');
+    try {
+      const fleet = await fleetP;
+      if (isProtectedSession(name, fleet.isCellSession)) {
+        return res.status(409).json({ error: 'sessione di cella: la visibilità tecnica vale solo per sessioni tmux non gestite' });
+      }
+      res.json(await setSessionVisibility(cfg.tmuxBin, name, req.body?.technical === true));
+    } catch (e) { res.status(e.status || 500).json({ error: String(e.message || e) }); }
+  });
   api.get('/config', (_req, res) => res.json({
     readonlyDefault: cfg.readonlyDefault, version: VERSION, uiVersion: uiBuildVersion(distDir),
     bind: cfg.bind, port: cfg.port,
@@ -220,6 +232,14 @@ function createServer(opts = {}) {
     sessionExists: (name) => sessionExists(cfg.tmuxBin, name),
   }));
   api.use('/fleet', fleetRoutes(fleetP, cfg));
+  api.use('/cells', cellsRoutes({
+    fleetP,
+    instanceId: () => (nodesStore.loadStore(nodesPath) || {}).nodeId || null,
+    submit: opts.cellSubmit || ((session, text, meta) => submitToSession(cfg.tmuxBin, session, text, {
+      engine: meta && meta.engine,
+    })),
+    readonly: proxyReadonly,
+  }));
   api.use('/decks', decksRoutes({ cfg, decksPath }));
   api.use('/fs', fsRoutes({ home: os.homedir() }));  // folder-picker del dialog new session
   // /nodes (read-only, per la settings UI B2): stesso formato di `nodes list --json`
@@ -396,6 +416,10 @@ function createServer(opts = {}) {
     }
   });
 
+  server.on('close', () => {
+    fleetP.then((fleet) => (typeof fleet.close === 'function' ? fleet.close() : null)).catch(() => {});
+  });
+
   return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater };
 }
 

package/lib/settings/routes.js

@@ -47,7 +47,7 @@ const nodesStore = require('../nodes/store.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
-const { probeHealth } = require('../proxy/federation.js');
+const { probeHealth, waitForHealthyPeer } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
@@ -822,9 +822,10 @@ function settingsRoutes(deps = {}) {
       if (!started.started && started.reason !== 'already running') {
         throw new Error(started.reason || 'avvio SSH fallito');
       }
-      const ready = await probeHealth({
+      const ready = await waitForHealthyPeer({
         port: node.localPort, token: node.token, expectedInstanceId: node.nodeId,
-        fetchImpl,
+        fetchImpl, attempts: 8, delayMs: 200,
+        ...(typeof seams.pairDelay === 'function' ? { delay: seams.pairDelay } : {}),
       });
       if (!ready || ready.status !== 'healthy') {
         const diagnosis = (seams.readTunnelDiagnostic || nodesTunnel.readTunnelDiagnostic)(home, name, node.remotePort);

package/lib/tmux/actions.js

@@ -1,5 +1,10 @@
 'use strict';
 const { execFile } = require('node:child_process');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { isValidSession } = require('../files/store.js');
 
 // Window/pane navigation must NOT be emulated with client-side prefix keys
 // (it depends on each host's bindings, which may be remapped or broken).
@@ -53,6 +58,7 @@ function runAction(tmuxBin, session, name) {
 }
 
 const MAX_PASTE = 4096;
+const MAX_SUBMIT = 8192;
 
 // true se text contiene control char (codici 0x00-0x1f e 0x7f). Espresso via
 // charCode invece di regex perche' il write-layer corrompe gli escape backslash
@@ -86,4 +92,93 @@ function pasteToSession(tmuxBin, session, text) {
   });
 }
 
-module.exports = { actionArgs, runAction, ACTIONS, pasteArgs, pasteToSession, scrollArgs };
+function submitTextOk(text) {
+  if (typeof text !== 'string' || !text || text.length > MAX_SUBMIT) return false;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text.charCodeAt(i);
+    if (c === 9 || c === 10 || c === 13) continue;
+    if (c < 32 || c === 127) return false;
+  }
+  return true;
+}
+
+function execTmux(execFileImpl, tmuxBin, args, timeout = 5000) {
+  return new Promise((resolve) => {
+    try {
+      execFileImpl(tmuxBin, args, { timeout }, (err, stdout) => {
+        resolve({ ok: !err, stdout: String(stdout || '') });
+      });
+    } catch (_) { resolve({ ok: false, stdout: '' }); }
+  });
+}
+
+// Consegna un messaggio a un pane esatto e lo sottopone al TUI. Il testo non
+// passa mai in argv: file temporaneo 0600 -> tmux load-buffer -> paste-buffer -p
+// (bracketed paste), poi Enter con una chiamata separata. Il pane id viene
+// risolto prima del paste e verificato di nuovo prima dell'Enter, evitando
+// prefix match e il riuso del solo nome sessione.
+async function submitToSession(tmuxBin, session, text, opts = {}) {
+  if (!isValidSession(session) || !submitTextOk(text)) {
+    return { submitted: false, reason: 'input non valido' };
+  }
+  const execFileImpl = opts.execFileImpl || execFile;
+  const fsImpl = opts.fsImpl || fs;
+  const tmpRoot = opts.tmpdir || os.tmpdir();
+  const delay = typeof opts.delay === 'function'
+    ? opts.delay : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  const codexComposer = /^(?:codex|codex-vl)(?:\.|$)/.test(String(opts.engine || ''));
+  const nonce = (opts.nonce || crypto.randomBytes(8).toString('hex')).replace(/[^a-f0-9]/g, '').slice(0, 32);
+  if (!nonce) return { submitted: false, reason: 'invio non disponibile' };
+  const buffer = `ncmsg-${nonce}`;
+  const tmp = path.join(tmpRoot, `.nexuscrew-message-${nonce}.txt`);
+  let loaded = false;
+  try {
+    fsImpl.writeFileSync(tmp, text, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    fsImpl.chmodSync(tmp, 0o600);
+    const pane = await execTmux(execFileImpl, tmuxBin,
+      ['display-message', '-p', '-t', `=${session}:`, '#{pane_id}']);
+    const paneId = pane.stdout.trim();
+    if (!pane.ok || !/^%[0-9]+$/.test(paneId)) {
+      return { submitted: false, reason: 'sessione non raggiungibile' };
+    }
+    const load = await execTmux(execFileImpl, tmuxBin, ['load-buffer', '-b', buffer, tmp]);
+    if (!load.ok) return { submitted: false, reason: 'buffer non disponibile' };
+    loaded = true;
+    const paste = await execTmux(execFileImpl, tmuxBin,
+      ['paste-buffer', '-p', '-t', paneId, '-b', buffer]);
+    if (!paste.ok) return { submitted: false, reason: 'consegna non riuscita' };
+    const paneAlive = async () => {
+      const verify = await execTmux(execFileImpl, tmuxBin,
+        ['display-message', '-p', '-t', paneId, '#{session_name}\t#{pane_dead}\t#{pane_id}']);
+      const [verifiedSession, dead, verifiedPane] = verify.stdout.trim().split('\t');
+      return verify.ok && verifiedSession === session && dead === '0' && verifiedPane === paneId;
+    };
+    // Codex/Codex-VL have a paste-burst window: a too-early Enter can remain
+    // inside the composer. C-e is sent as its own tmux command after the paste,
+    // then the pane is revalidated before the separate Enter. Other clients
+    // still receive a short separation between paste and submit.
+    await delay(codexComposer ? 400 : 150);
+    if (!(await paneAlive())) return { submitted: false, reason: 'sessione terminata durante la consegna' };
+    if (codexComposer) {
+      const flush = await execTmux(execFileImpl, tmuxBin, ['send-keys', '-t', paneId, 'C-e']);
+      if (!flush.ok) return { submitted: false, reason: 'testo consegnato ma flush composer non riuscito' };
+      await delay(300);
+      if (!(await paneAlive())) return { submitted: false, reason: 'sessione terminata durante la consegna' };
+    }
+    const enter = await execTmux(execFileImpl, tmuxBin, ['send-keys', '-t', paneId, 'Enter']);
+    if (!enter.ok) return { submitted: false, reason: 'testo consegnato ma invio non riuscito' };
+    return { submitted: true, reason: codexComposer
+      ? 'bracketed paste + burst flush + Enter separati'
+      : 'bracketed paste + Enter separato' };
+  } catch (_) {
+    return { submitted: false, reason: 'consegna non riuscita' };
+  } finally {
+    if (loaded) await execTmux(execFileImpl, tmuxBin, ['delete-buffer', '-b', buffer]);
+    try { fsImpl.unlinkSync(tmp); } catch (_) { /* cleanup best-effort */ }
+  }
+}
+
+module.exports = {
+  actionArgs, runAction, ACTIONS, pasteArgs, pasteToSession, scrollArgs,
+  submitTextOk, submitToSession, MAX_SUBMIT,
+};

package/lib/tmux/list.js

@@ -1,14 +1,14 @@
 'use strict';
 const { execFile, execFileSync } = require('node:child_process');
 
-const FMT = "#{session_name}\t#{session_attached}\t#{session_windows}\t#{session_created}\t#{session_activity}\t#{pane_current_command}";
+const FMT = "#{session_name}\t#{session_attached}\t#{session_windows}\t#{session_created}\t#{session_activity}\t#{pane_current_command}\t#{@nexuscrew_visibility}";
 
 function parseSessions(raw) {
   return String(raw)
     .split('\n')
     .filter((l) => l.trim() !== '')
     .map((line) => {
-      const [name, attached, windows, created, activity, cmd] = line.split('\t');
+      const [name, attached, windows, created, activity, cmd, visibility] = line.split('\t');
       return {
         name,
         attached: attached === '1',
@@ -16,8 +16,27 @@ function parseSessions(raw) {
         created: Number(created),
         activity: Number(activity) || 0,
         cmd: cmd || '',
+        technical: visibility === 'technical',
       };
+    })
+    .filter((session) => session.windows > 0);
+}
+
+function setSessionVisibility(tmuxBin = 'tmux', name, technical = false) {
+  return new Promise((resolve, reject) => {
+    if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name) || name.startsWith('-')) {
+      const error = new Error('nome sessione non valido'); error.status = 400; reject(error); return;
+    }
+    const args = technical
+      ? ['set-option', '-t', `=${name}`, '@nexuscrew_visibility', 'technical']
+      : ['set-option', '-u', '-t', `=${name}`, '@nexuscrew_visibility'];
+    execFile(tmuxBin, args, (err, _stdout, stderr) => {
+      if (!err) { resolve({ name, technical: !!technical }); return; }
+      const error = new Error(`tmux set-option failed: ${String(stderr || err.message).trim()}`);
+      error.status = /can't find session|no server running/i.test(stderr || '') ? 404 : 500;
+      reject(error);
     });
+  });
 }
 
 function listSessions(tmuxBin = 'tmux') {
@@ -45,4 +64,4 @@ function attachedClients(tmuxBin = 'tmux', session) {
   } catch (_) { return 0; }
 }
 
-module.exports = { parseSessions, listSessions, attachedClients, FMT };
+module.exports = { parseSessions, listSessions, attachedClients, setSessionVisibility, FMT };

package/lib/update/core.js

@@ -48,15 +48,42 @@ function compareVersions(a, b) {
 }
 
 function registryVersion(stdout) {
-  const raw = String(stdout || '').trim();
-  let value = raw;
+  const raw = String(stdout || '')
+    .replace(/^\uFEFF/, '')
+    .replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, '')
+    .trim();
+  const candidates = [];
+  const add = (value) => {
+    if (typeof value !== 'string') return;
+    const parsed = parseVersion(value);
+    if (parsed) candidates.push(parsed.raw);
+  };
   try {
     const decoded = JSON.parse(raw);
-    if (typeof decoded === 'string') value = decoded;
-  } catch (_) { /* npm senza --json o output gia' plain */ }
-  const parsed = parseVersion(value);
-  if (!parsed) throw new Error('npm ha restituito una versione non valida');
-  return parsed.raw;
+    if (typeof decoded === 'string') add(decoded);
+    else if (Array.isArray(decoded)) decoded.forEach(add);
+    else if (decoded && typeof decoded === 'object') add(decoded.version);
+  } catch (_) {
+    // npm versions differ in whether --json returns a JSON scalar or a plain
+    // line.  Notices may also precede the value, so inspect complete lines but
+    // never extract a semver from the middle of arbitrary text.
+    for (const line of raw.split(/\r?\n/)) add(line.trim().replace(/^['"]|['"]$/g, ''));
+  }
+  const unique = [...new Set(candidates)];
+  if (unique.length !== 1) throw new Error('npm ha restituito una versione non valida');
+  return unique[0];
+}
+
+function stableRuntimeDir(home) {
+  const dir = path.join(path.resolve(String(home || '')), '.nexuscrew');
+  try {
+    const st = fs.lstatSync(dir);
+    if (!st.isDirectory() || st.isSymbolicLink()) throw new Error('directory runtime NexusCrew non sicura');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  }
+  return dir;
 }
 
 function scrubError(error) {
@@ -153,5 +180,5 @@ function writeState(file, value) {
 module.exports = {
   PACKAGE_NAME, VERSION_RE, parseVersion, compareVersions, registryVersion,
   scrubError, pidAlive, readLock, acquireUpdateLock, adoptUpdateLock, releaseUpdateLock,
-  readState, writeState,
+  readState, writeState, stableRuntimeDir,
 };

package/lib/update/manager.js

@@ -6,7 +6,7 @@ const path = require('node:path');
 const { execFile, spawn } = require('node:child_process');
 const {
   PACKAGE_NAME, compareVersions, parseVersion, registryVersion, scrubError, pidAlive, readLock,
-  acquireUpdateLock, releaseUpdateLock, readState, writeState,
+  acquireUpdateLock, releaseUpdateLock, readState, writeState, stableRuntimeDir,
 } = require('./core.js');
 
 const DEFAULT_INITIAL_DELAY_MS = 60 * 1000;
@@ -24,10 +24,11 @@ function isNewer(candidate, current) {
   try { return compareVersions(candidate, current) > 0; } catch (_) { return false; }
 }
 
-function lookupLatestNpm({ execFileImpl = execFile, timeoutMs = 20_000 } = {}) {
+function lookupLatestNpm({ execFileImpl = execFile, timeoutMs = 20_000, home = os.homedir(), cwd } = {}) {
   return new Promise((resolve, reject) => {
     execFileImpl('npm', ['view', `${PACKAGE_NAME}@latest`, 'version', '--json'], {
       encoding: 'utf8', timeout: timeoutMs, maxBuffer: 64 * 1024,
+      cwd: cwd || stableRuntimeDir(home),
     }, (error, stdout) => {
       if (error) return reject(error);
       try { resolve(registryVersion(stdout)); } catch (e) { reject(e); }
@@ -42,6 +43,7 @@ function createNpmUpdater(opts = {}) {
   const logPath = opts.logPath || path.join(home, '.nexuscrew', 'npm-update.log');
   const lockPath = opts.lockPath || path.join(home, '.nexuscrew', 'npm-update.lock');
   const runnerPath = opts.runnerPath || path.join(__dirname, 'runner.js');
+  const workDir = opts.cwd || stableRuntimeDir(home);
   const supported = opts.supported === undefined ? isGlobalInstall(opts.packageRoot) : !!opts.supported;
   const readonly = opts.readonly === true;
   const lookupLatest = opts.lookupLatest || (() => lookupLatestNpm(opts));
@@ -135,7 +137,8 @@ function createNpmUpdater(opts = {}) {
           process.execPath, ...runnerArgs]
         : runnerArgs;
       child = spawnImpl(bin, argv, {
-        detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, NEXUSCREW_UPDATE_RUNNER: '1' },
+        detached: true, stdio: ['ignore', fd, fd], cwd: workDir,
+        env: { ...process.env, NEXUSCREW_UPDATE_RUNNER: '1' },
       });
     } catch (e) {
       releaseUpdateLock(lockPath, reservation.token);

package/lib/update/runner.js

@@ -7,6 +7,7 @@ const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const {
   PACKAGE_NAME, parseVersion, scrubError, pidAlive, adoptUpdateLock, releaseUpdateLock, readState, writeState,
+  stableRuntimeDir,
 } = require('./core.js');
 
 function args(argv) {
@@ -69,6 +70,7 @@ async function runUpdate(opts = {}) {
   if (!parseVersion(version)) throw new Error('versione update non valida');
   const home = opts.home || os.homedir();
   const statusPath = opts.statusPath || path.join(home, '.nexuscrew', 'npm-update.json');
+  const workDir = opts.cwd || stableRuntimeDir(home);
   const execImpl = opts.execImpl || execFileSync;
   const readInstalledVersion = opts.readInstalledVersion || (() => {
     const p = path.resolve(__dirname, '..', '..', 'package.json');
@@ -76,7 +78,9 @@ async function runUpdate(opts = {}) {
   });
   const preflightImpl = opts.preflightImpl || (({ version: expectedVersion = version } = {}) => {
     const bin = path.resolve(__dirname, '..', '..', 'bin', 'nexuscrew.js');
-    const output = execFileSync(process.execPath, [bin, 'version'], { encoding: 'utf8', timeout: 20_000, stdio: ['ignore', 'pipe', 'pipe'] });
+    const output = execFileSync(process.execPath, [bin, 'version'], {
+      encoding: 'utf8', timeout: 20_000, stdio: ['ignore', 'pipe', 'pipe'], cwd: workDir,
+    });
     if (String(output || '').trim() !== expectedVersion) throw new Error(`preflight CLI fallito: attesa ${expectedVersion}`);
     return true;
   });
@@ -96,7 +100,7 @@ async function runUpdate(opts = {}) {
   try {
     writeState(statusPath, { ...previous, phase: 'installing', targetVersion: version, updaterPid: process.pid, lastError: '' });
     execImpl('npm', ['install', '--global', `${PACKAGE_NAME}@${version}`, '--no-audit', '--no-fund'], {
-      stdio: 'inherit', timeout: 5 * 60 * 1000,
+      stdio: 'inherit', timeout: 5 * 60 * 1000, cwd: workDir,
     });
     const installed = String(readInstalledVersion() || '');
     if (installed !== version) throw new Error(`verifica installazione fallita: attesa ${version}, trovata ${installed || 'sconosciuta'}`);
@@ -114,7 +118,7 @@ async function runUpdate(opts = {}) {
     if (installedNew && parseVersion(previousVersion) && previousVersion !== version) {
       try {
         execImpl('npm', ['install', '--global', `${PACKAGE_NAME}@${previousVersion}`, '--no-audit', '--no-fund'], {
-          stdio: 'inherit', timeout: 5 * 60 * 1000,
+          stdio: 'inherit', timeout: 5 * 60 * 1000, cwd: workDir,
         });
         if (String(readInstalledVersion() || '') !== previousVersion) throw new Error(`rollback verify: attesa ${previousVersion}`);
         await preflightImpl({ version: previousVersion, home, rollback: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.12",
+  "version": "0.8.14",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {