@mmmbuto/nexuscrew 0.8.13 → 0.8.14

package/README.md

@@ -16,7 +16,7 @@ panes, windows. tmux does the work; the browser is just a faithful client.
 
 ---
 
-## What it is (v0.8.13 "Fleet Network")
+## What it is (v0.8.14 "Private Launch")
 
 - Runs a small server on the host where your tmux sessions live.
 - Each attach spawns a real PTY running `tmux attach` and bridges its bytes over a WebSocket
@@ -25,13 +25,15 @@ panes, windows. tmux does the work; the browser is just a faithful client.
   live terminals side by side, draggable dividers, per-tile composer, layout remembered.
   Tiles attach with `ignore-size` so they never resize your real terminals.
 - **Ordered Fleet roster**: desktop and mobile share the same per-location model. Local and
-  every Hydra route are independently collapsible and filterable by all, pinned, active, or
-  off. Route-qualified pins keep priority, while cells can be reordered directly with a mouse,
-  a dedicated touch handle, or keyboard move controls; the owner-qualified order survives
-  reloads and is shared by the compact and expanded views. Search covers every visible node
-  once the combined roster grows beyond eight entries. Desktop chrome and the mobile header
-  stay fixed while their lists scroll, and the compact version/endpoint/language footer remains
-  readable on narrow screens.
+  every Hydra route are independently collapsible and filterable by all, pinned, active, off,
+  or technical. Technical tmux sessions stay out of the normal roster until explicitly shown,
+  and every location count reflects the rows actually displayed. Route-qualified pins keep
+  priority, while cells can be reordered from the dedicated handle with Pointer Events on
+  mouse, touch, or pen, or with keyboard move controls. Reorder highlights the destination,
+  scrolls at list edges, commits only on release and can be cancelled without changing the
+  saved order. The owner-qualified order survives reloads and is shared by compact and expanded
+  views. Desktop chrome and the mobile header stay fixed while their lists scroll, and the
+  compact version/endpoint/language footer remains readable on narrow screens.
 - **Attached decks by default**: named workspaces switch as tabs inside the same PWA without
   reloading terminals or losing a pending layout save. Use `↗` only when you want to detach a
   deck into another browser window or monitor. Every Local or remote owner group ends with its
@@ -59,6 +61,11 @@ panes, windows. tmux does the work; the browser is just a faithful client.
   engine mapping and system prompts, then select exactly what to restore. Archives contain
   credential-variable names but never their values, provider keys or runtime session state;
   conflicts and active cells that need a restart are reported explicitly.
+- **Private provider credentials**: each node resolves a required key from its runtime
+  environment, compatible user-owned provider files, or an optional local write-only store.
+  The PWA can set, replace, or forget a missing key on that exact node without displaying it.
+  Values never enter Fleet definitions, backups, API responses, tmux state, process arguments,
+  temporary files, or logs.
 - **Rich cards**: last activity, current command, a sanitized one-line preview per session.
 - **Fleet control**: a built-in schema-driven fleet manager handles cells, engines, model
   selection, and boot persistence; an existing external `fleet` CLI can take ownership through
@@ -120,13 +127,19 @@ The concise provider catalog is scoped per CLI:
   GitHub Copilot, OpenRouter, local Ollama, DeepSeek, Z.AI, and a custom provider.
 
 Provider credentials are resolved from the selected CLI's native login or from an environment
-variable named in the PWA; NexusCrew never stores a new secret value. A named variable is read
-first from the service environment, then—when present—from the user-owned
-`~/.config/ai-shell/providers.zsh`, parsed strictly as assignment data and never sourced or
-executed. Only requested names are resolved, and values are never copied into NexusCrew config,
-service files or backups. Legacy Z.AI A/P engines remain launch-compatible for existing fleets
-but are not provider choices for new engines. Model discovery is used where the CLI/provider
-documents it, with a manual model field as the portable fallback.
+variable named in the PWA. A named variable is read first from the service environment, then
+from the optional node-local NexusCrew store, then—when present—from the user-owned
+`~/.config/ai-shell/providers.zsh`, `~/.config/keys/ai.env`, or
+`~/.config/secure/.env`, parsed strictly as assignment data and never sourced or executed.
+The PWA shows only whether the requested name is configured and its source category; a missing
+value can be saved locally in `~/.nexuscrew/credentials.json` under a user-owned `0700`
+directory and `0600` file, or removed again. The store is write-only through the API and is
+never included in config, services, Fleet backups, federation payloads, logs, or responses.
+At launch, secret-bearing environment data crosses a private one-shot Unix socket and reaches
+the CLI by direct process spawn; it never enters tmux environment state, argv, or a temporary
+file. Legacy Z.AI A/P engines remain launch-compatible for existing fleets but are not provider
+choices for new engines. Model discovery is used where the CLI/provider documents it, with a
+manual model field as the portable fallback.
 
 Managed engines expose a permission selector both in their definition and in the cell launch
 sheet. New Claude engines (native, Z.AI, Ollama, or custom) default to **Bypass permissions**
@@ -444,8 +457,9 @@ node bin/nexuscrew.js serve
 
 ## Status
 
-The current release candidate is **v0.8.13**. npm **`latest`**, the GitHub tag and the release
-assets are promoted from the same verified artifact.
+The current release candidate is **v0.8.14**. npm **`latest`** is promoted from the verified
+artifact first; the GitHub tag and release follow the operator field test from the same source
+candidate.
 
 ## License