@mmmbuto/nexuscrew 0.8.13 → 0.8.15

package/frontend/dist/assets/index-C-JOkuIc.css

@@ -0,0 +1,32 @@
+.nc-icon{display:block;flex:0 0 auto}.nc-sheet-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:50;background:#0000008c;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-launch-overlay{z-index:70}.nc-sheet{width:100%;max-width:380px;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:16px;display:flex;flex-direction:column;gap:12px;box-shadow:0 12px 40px #00000080}.nc-power-sheet{max-width:min(620px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow-y:auto;box-sizing:border-box;min-width:0}.nc-launch-sheet{max-width:min(520px,calc(100vw - 32px));width:100%;min-width:0}.nc-launch-fields{display:flex;flex-direction:column;gap:10px;min-width:0}.nc-launch-fields .nc-field,.nc-launch-fields .nc-field input,.nc-launch-fields .nc-field select{width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-sheet-head{display:flex;align-items:center;justify-content:space-between}.nc-sheet-head b{font-size:16px;color:#d8ffe8}.nc-sheet-state{font-size:12px;opacity:.6}.nc-sheet-label{font-size:12px;opacity:.7;text-transform:uppercase;letter-spacing:.5px}.nc-power-config{display:grid;grid-template-columns:auto minmax(0,1fr);gap:4px 10px;padding:10px;border:1px solid #243;border-radius:8px;background:#0a0e0a;min-width:0;overflow-wrap:anywhere}.nc-power-config span{opacity:.7}.nc-power-config small{grid-column:1 / -1;opacity:.65}.nc-check{display:flex;align-items:center;gap:8px;font-size:13px;cursor:pointer}.nc-check input{accent-color:#2e7d32}.nc-note{font-size:11px;color:#e0b020;opacity:.9}.nc-field{display:flex;flex-direction:column;gap:4px;font-size:12px;opacity:.8}.nc-field input,.nc-field select{padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-field input:focus,.nc-field select:focus{outline:none;border-color:#2e7d32}.nc-err{color:#f88;font-size:12px}.nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;min-width:0}.nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-btn.primary{background:#2e7d32;color:#fff}.nc-btn.primary:active{background:#255028}.nc-btn:disabled{opacity:.5;cursor:default}@media(max-width:600px){.nc-power-sheet{max-width:380px}}.nc-home{display:flex;flex-direction:column;gap:12px;padding:18px 14px 10px;color:#cfe;max-width:560px;margin:0 auto;height:100dvh;min-height:0;overflow:hidden;box-sizing:border-box}.nc-home-scroll{min-height:0;flex:1 1 auto;overflow-y:auto;overscroll-behavior-y:contain;-webkit-overflow-scrolling:touch;display:flex;flex-direction:column;gap:12px;padding:0 2px 76px 0}.nc-home-head{position:relative}.nc-wordmark{font-size:26px;font-weight:700;letter-spacing:.5px;color:#d8ffe8}.nc-cursor{display:inline-block;width:12px;height:22px;margin-left:6px;background:#0c6;vertical-align:-2px;animation:nc-blink 1.1s steps(1) infinite}@keyframes nc-blink{50%{opacity:0}}@media(prefers-reduced-motion:reduce){.nc-cursor{animation:none}}.nc-home-sub{margin-top:4px;font-size:13px;opacity:.65}.nc-head-actions{position:absolute;top:0;right:0;display:inline-flex;gap:6px}.nc-refresh{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:40px;min-height:40px}.nc-filter{padding:10px 12px;font:16px/1.2 inherit;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:8px}.nc-filter:focus{outline:none;border-color:#2e7d32}.nc-session-list{display:flex;flex-direction:column;gap:8px}.nc-session{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:10px;text-align:left;min-height:56px}.nc-session:active{background:#14200f;border-color:#2e7d32}.nc-session .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-session .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-session-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-session-main b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px}.nc-session-main small{opacity:.55;font-size:12px}.nc-badge{flex:0 0 auto;background:#2e7d32;color:#fff;border-radius:10px;padding:1px 8px;font-size:12px;line-height:18px}.nc-err{color:#f88;font-size:13px;padding:4px 2px}.nc-empty{opacity:.5;padding:18px 4px;font-size:13px}.nc-home-foot{margin-top:auto;padding:14px 4px 4px;width:100%;box-sizing:border-box;display:grid;grid-template-columns:minmax(0,1fr) auto;align-items:end;column-gap:14px;font-size:11px}.nc-home-meta{min-width:0;display:flex;flex-wrap:wrap;align-items:center;gap:2px 8px;opacity:.48;line-height:1.35}.nc-home-version{flex:0 0 auto}.nc-home-endpoint{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-group{display:flex;flex-direction:column;gap:8px}.nc-group-title{font-size:11px;opacity:.55;text-transform:uppercase;letter-spacing:.5px;padding:6px 2px 2px}.nc-mcard{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid #1c241c;background:#0e140e;color:#cfe;border-radius:12px;min-height:56px}.nc-mcard-main{flex:1 1 auto;min-width:0;display:flex;align-items:center;gap:12px;background:none;border:none;color:inherit;cursor:pointer;padding:0;text-align:left}.nc-mcard-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px}.nc-mcard-text b{font-size:14px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mcard-text small{font-size:12px;opacity:.6;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dot.warn{background:#e0b020;box-shadow:0 0 6px #e0b02088}.nc-group-title.nc-node-title{display:flex;align-items:center;gap:6px}.nc-group-title.nc-node-title .dot{flex:0 0 auto;width:8px;height:8px;border-radius:50%;background:#355}.nc-group-title.nc-node-title .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mcard .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mcard .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mobile-position-head{display:grid;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:8px;min-height:48px;padding:2px 0;border-bottom:1px solid #1c2b20}.nc-mobile-position-toggle{min-width:0;min-height:44px;padding:4px 2px;display:flex;align-items:center;gap:8px;border:0;background:none;color:inherit;text-align:left;cursor:pointer}.nc-mobile-position-toggle .dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-mobile-position-toggle .dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-mobile-chevron{flex:0 0 14px;font-size:18px;color:#8fc;text-align:center}.nc-mobile-position-copy{min-width:0;display:flex;flex-direction:column;gap:1px}.nc-mobile-position-copy b,.nc-mobile-position-copy small{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-mobile-position-copy b{font-size:13px;color:#d8ffe8}.nc-mobile-position-copy small{font-size:11px;opacity:.55}.nc-mobile-position-filter{min-height:44px;max-width:104px;padding:0 26px 0 9px;border:1px solid #294433;border-radius:8px;background:#0e140e;color:#bfe8cf;font:12px/1 inherit}.nc-mobile-position-head>.nc-act{width:44px;height:44px}.nc-rel{flex:0 0 auto;font-size:11px;opacity:.45}.nc-power,.nc-menu{flex:0 0 auto;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:44px;min-height:44px;font-size:17px;cursor:pointer}.nc-power:active,.nc-menu:active{border-color:#2e7d32}.nc-fab{position:fixed;right:18px;bottom:18px;z-index:20;width:54px;height:54px;border-radius:50%;background:#2e7d32;color:#fff;border:none;font-size:28px;line-height:1;cursor:pointer;box-shadow:0 6px 18px #00000073}.nc-fab:active{background:#255028}.nc-lang{display:inline-flex;align-items:center;justify-content:flex-end;gap:2px;white-space:nowrap;opacity:.7}@media(max-width:380px){.nc-home-meta{flex-direction:column;align-items:flex-start;gap:0}.nc-home-endpoint{max-width:100%}}.nc-act{width:44px;height:44px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;flex:0 0 auto;font-size:15px;line-height:1}.nc-act.power.on{color:#0c6;border-color:#00cc668c;background:#00cc661a}.nc-act.power.warn{color:#e8c547;border-color:#e8c5478c;background:#e8c5471a}.nc-act.pin.on{color:#e8c547;border-color:#e8c5478c;background:#e8c54714}.nc-act.technical.on{color:#d8a8ff;border-color:#b478ff8c;background:#b478ff1a}.nc-mcard{gap:8px}.nc-mcard .nc-roster-handle{flex:0 0 36px;width:36px;min-width:36px;height:44px;border:1px solid transparent;border-radius:9px;background:#ffffff06;color:#688475;touch-action:none}.nc-mcard .nc-roster-handle.active,.nc-mcard .nc-roster-handle:focus-visible{color:#bfffd8;border-color:#00cc6673;background:#00cc661f}.nc-mcard.nc-roster-dragging{opacity:.62}.nc-mcard.nc-roster-over{outline:2px solid rgba(0,204,102,.72);outline-offset:2px}@media(max-width:390px){.nc-mobile-position-head{gap:5px}.nc-mobile-position-filter{max-width:92px;padding-left:7px}.nc-mcard{padding:10px 9px;gap:5px}}/**
+ * Copyright (c) 2014 The xterm.js authors. All rights reserved.
+ * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
+ * https://github.com/chjj/term.js
+ * @license MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * Originally forked from (with the author's permission):
+ *   Fabrice Bellard's javascript vt100 for jslinux:
+ *   http://bellard.org/jslinux/
+ *   Copyright (c) 2011 Fabrice Bellard
+ *   The original design remains. The terminal itself
+ *   has been extended to include xterm CSI codes, among
+ *   other features.
+ */.xterm{cursor:text;position:relative;user-select:none;-ms-user-select:none;-webkit-user-select:none}.xterm.focus,.xterm:focus{outline:none}.xterm .xterm-helpers{position:absolute;top:0;z-index:5}.xterm .xterm-helper-textarea{padding:0;border:0;margin:0;position:absolute;opacity:0;left:-9999em;top:0;width:0;height:0;z-index:-5;white-space:nowrap;overflow:hidden;resize:none}.xterm .composition-view{background:#000;color:#fff;display:none;position:absolute;white-space:nowrap;z-index:1}.xterm .composition-view.active{display:block}.xterm .xterm-viewport{background-color:#000;overflow-y:scroll;cursor:default;position:absolute;right:0;left:0;top:0;bottom:0}.xterm .xterm-screen{position:relative}.xterm .xterm-screen canvas{position:absolute;left:0;top:0}.xterm-char-measure-element{display:inline-block;visibility:hidden;position:absolute;top:0;left:-9999em;line-height:normal}.xterm.enable-mouse-events{cursor:default}.xterm.xterm-cursor-pointer,.xterm .xterm-cursor-pointer{cursor:pointer}.xterm.column-select.focus{cursor:crosshair}.xterm .xterm-accessibility:not(.debug),.xterm .xterm-message{position:absolute;left:0;top:0;bottom:0;right:0;z-index:10;color:transparent;pointer-events:none}.xterm .xterm-accessibility-tree:not(.debug) *::selection{color:transparent}.xterm .xterm-accessibility-tree{font-family:monospace;-webkit-user-select:text;user-select:text;white-space:pre}.xterm .xterm-accessibility-tree>div{transform-origin:left;width:fit-content}.xterm .live-region{position:absolute;left:-9999px;width:1px;height:1px;overflow:hidden}.xterm-dim{opacity:1!important}.xterm-underline-1{text-decoration:underline}.xterm-underline-2{text-decoration:double underline}.xterm-underline-3{text-decoration:wavy underline}.xterm-underline-4{text-decoration:dotted underline}.xterm-underline-5{text-decoration:dashed underline}.xterm-overline{text-decoration:overline}.xterm-overline.xterm-underline-1{text-decoration:overline underline}.xterm-overline.xterm-underline-2{text-decoration:overline double underline}.xterm-overline.xterm-underline-3{text-decoration:overline wavy underline}.xterm-overline.xterm-underline-4{text-decoration:overline dotted underline}.xterm-overline.xterm-underline-5{text-decoration:overline dashed underline}.xterm-strikethrough{text-decoration:line-through}.xterm-screen .xterm-decoration-container .xterm-decoration{z-index:6;position:absolute}.xterm-screen .xterm-decoration-container .xterm-decoration.xterm-decoration-top-layer{z-index:7}.xterm-decoration-overview-ruler{z-index:8;position:absolute;top:0;right:0;pointer-events:none}.xterm-decoration-top{z-index:2;position:relative}.xterm .xterm-scrollable-element>.scrollbar{cursor:default}.xterm .xterm-scrollable-element>.scrollbar>.scra{cursor:pointer;font-size:11px!important}.xterm .xterm-scrollable-element>.visible{opacity:1;background:#0000;transition:opacity .1s linear;z-index:11}.xterm .xterm-scrollable-element>.invisible{opacity:0;pointer-events:none}.xterm .xterm-scrollable-element>.invisible.fade{transition:opacity .8s linear}.xterm .xterm-scrollable-element>.shadow{position:absolute;display:none}.xterm .xterm-scrollable-element>.shadow.top{display:block;top:0;left:3px;height:3px;width:100%;box-shadow:var(--vscode-scrollbar-shadow, #000) 0 6px 6px -6px inset}.xterm .xterm-scrollable-element>.shadow.left{display:block;top:3px;left:0;height:100%;width:3px;box-shadow:var(--vscode-scrollbar-shadow, #000) 6px 0 6px -6px inset}.xterm .xterm-scrollable-element>.shadow.top-left-corner{display:block;top:0;left:0;height:3px;width:3px}.xterm .xterm-scrollable-element>.shadow.top.left{box-shadow:var(--vscode-scrollbar-shadow, #000) 6px 0 6px -6px inset}.nc-terminal{position:absolute;top:0;right:0;bottom:0;left:0;background:#0a0e0a}.nc-terminal-host{position:absolute;top:0;right:0;bottom:0;left:0;padding:4px}.nc-terminal .xterm{height:100%}.nc-terminal-host,.nc-terminal .xterm,.nc-terminal .xterm-viewport{touch-action:none}.nc-terminal.selecting{box-shadow:inset 0 0 0 2px #d6a600}.nc-selection-tools{position:absolute;z-index:9;right:10px;top:10px;display:flex;gap:6px;align-items:center;background:#0e140ef0;border:1px solid #586b2a;border-radius:8px;padding:5px 7px;color:#edda8a;font-size:11px}.nc-selection-tools button{background:#172417;border:1px solid #486044;color:#d8ffe8;border-radius:6px;padding:5px 9px}.nc-selection-tools textarea{width:180px;height:48px;background:#071007;color:#d8ffe8}.nc-upload-state{position:absolute;z-index:10;left:50%;top:12px;transform:translate(-50%);max-width:min(520px,calc(100% - 24px));padding:6px 10px;border-radius:7px;border:1px solid #2e7d32;background:#0a140af5;color:#cfe;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:11px}.nc-upload-state.error{border-color:#a44;color:#fbb}.nc-keybar{background:#0a0e0a;border-top:1px solid #1c241c;position:relative}.nc-keybar.termux{display:flex;flex-direction:column;padding:2px 0}.nc-keybar .row{display:flex}.nc-keybar .row button{flex:1 1 0;min-width:0;padding:10px 2px;background:none;border:none;border-radius:0;color:#e6ffe6;font-size:14px;font-weight:600;letter-spacing:.5px;font-family:inherit}.nc-keybar .row button:active{background:#1d2a1d}.nc-keybar .row button.armed{color:#021;background:#0c6}.nc-keymenu{position:absolute;bottom:100%;left:8px;right:8px;z-index:30;display:flex;flex-wrap:wrap;gap:6px;padding:8px;background:#101810;border:1px solid #2a3a2a;border-radius:10px 10px 0 0}.nc-keymenu button{flex:1 0 30%;padding:10px 6px;border-radius:8px;border:1px solid #243;background:#122;color:#9fd;font-size:13px}.nc-keymenu button:active{background:#0c6;color:#021}.nc-keybar.copy{display:flex;gap:6px;overflow-x:auto;padding:8px;background:#14210f}.nc-keybar.copy button{flex:0 0 auto;padding:10px 12px;min-width:48px;border-radius:8px;border:1px solid #243;background:#122;color:#9fd;font-size:13px}.nc-keybar.copy button:active{background:#0c6;color:#021}.nc-keybar .tag{flex:0 0 auto;align-self:center;padding:0 8px;color:#8e8;font-size:12px}@media(pointer:coarse){.nc-keybar .row button{padding:12px 2px;font-size:15px}}.nc-files{position:fixed;top:0;right:0;bottom:0;width:min(340px,90vw);background:var(--bg, #111511);border-left:1px solid #2a332a;display:flex;flex-direction:column;z-index:30}.nc-files header{display:flex;justify-content:space-between;align-items:center;padding:8px 10px;border-bottom:1px solid #2a332a}.nc-files nav{display:flex;gap:6px;padding:8px 10px}.nc-files nav button{flex:0 0 auto;padding:4px 10px;border-radius:6px}.nc-files nav button.on{background:#2e7d32;color:#fff}.nc-files nav .up{margin-left:auto}.nc-files ul{list-style:none;margin:0;padding:0;overflow-y:auto;flex:1}.nc-files li{display:flex;align-items:center;gap:8px;padding:8px 10px;border-bottom:1px solid #1c231c}.nc-files li .name{flex:1;cursor:pointer;overflow-wrap:anywhere}.nc-files li.empty{opacity:.5;justify-content:center}.nc-busy{padding:4px 10px;font-size:12px;color:#e0a030}@media(pointer:coarse){.nc-files nav button,.nc-files li{min-height:42px}}.nc-files header button,.nc-files nav button,.nc-files li button{display:inline-flex;align-items:center;justify-content:center;gap:6px}.nc-composer{border-top:1px solid #2a332a;padding:6px 8px;background:var(--bg, #111511)}.nc-composer-row{display:flex;gap:6px;align-items:flex-end}.nc-composer textarea{flex:1;resize:none;background:#0a0e0a;color:#d8e0d8;border:1px solid #2a332a;border-radius:8px;padding:6px 8px;font:13px/1.4 inherit}.nc-composer .mic.on{background:#b02a2a;color:#fff}.nc-composer-err{font-size:12px;color:#e0a030;padding-bottom:4px}@media(pointer:coarse){.nc-composer .mic,.nc-composer .go,.nc-composer .attach{min-width:46px;min-height:46px;font-size:20px}.nc-composer textarea{font-size:16px}.nc-attach-menu button{min-height:48px}}.nc-composer .mic,.nc-composer .go,.nc-composer .attach{display:inline-flex;align-items:center;justify-content:center;background:none;border:1px solid #243;color:#9fd;border-radius:8px;cursor:pointer}.nc-composer .go{color:#7ee787;border-color:#2e7d32}.nc-composer .go:disabled{opacity:.5;cursor:wait}.nc-composer .attach.busy{opacity:.5;animation:nc-attach-pulse 1s ease-in-out infinite}@keyframes nc-attach-pulse{50%{opacity:.9}}.nc-attach-menu{position:fixed;z-index:1000;min-width:180px;display:flex;flex-direction:column;padding:4px;background:#0e130e;border:1px solid #2e7d32;border-radius:10px;box-shadow:0 6px 24px #0000008c}.nc-attach-menu button{display:flex;align-items:center;gap:10px;text-align:left;min-height:40px;padding:8px 12px;border:0;border-radius:7px;background:none;color:#d8e0d8;font:14px/1 inherit;cursor:pointer}.nc-attach-menu button:hover,.nc-attach-menu button:focus-visible{background:#1a241a;color:#7ee787}.nc-sidebar{display:flex;flex-direction:column;gap:8px;padding:12px 10px;color:#cfe;min-height:0;position:relative;overflow:hidden;box-sizing:border-box;border-right:1px solid #1c241c;background:#0a0e0a}.nc-sidebar.mini{padding:12px 4px;align-items:center;gap:6px}.nc-side-resize{position:absolute;top:0;right:0;bottom:0;width:6px;cursor:col-resize;z-index:5}.nc-side-resize:hover{background:#1c3a1c}.nc-collapse-btn{flex:0 0 auto;background:none;border:1px solid #243;color:#9fd;border-radius:8px;min-width:26px;min-height:26px;cursor:pointer;font-size:13px;line-height:1}.nc-collapse-btn:hover{border-color:#2e7d32;color:#d8ffe8}.nc-side-head{display:flex;align-items:center;gap:6px;justify-content:space-between;padding:2px 4px 6px}.nc-side-head.mini{padding:2px 0 6px;justify-content:center}.nc-side-scroll{min-height:0;flex:1;overflow-y:auto;display:flex;flex-direction:column;gap:8px;padding-right:2px}.nc-side-scroll.mini{width:100%;align-items:center}.nc-side-group.mini{align-items:center;gap:6px}.nc-mini-dot,.nc-mini-init{display:flex;align-items:center;justify-content:center;width:34px;height:34px;box-sizing:border-box;border:1px solid #1c241c;background:#0e140e;border-radius:9px;cursor:pointer;-webkit-user-select:none;user-select:none;color:#d8ffe8;padding:0}.nc-mini-init{font-size:13px;font-weight:700}.nc-mini-dot:hover,.nc-mini-init:hover{border-color:#244}.nc-mini-dot.active,.nc-mini-init.active{border-color:#2e7d32;background:#14200f}.nc-side-title{font-size:13px;font-weight:700;letter-spacing:.5px;text-transform:uppercase;opacity:.8}.nc-new-btn{background:#2e7d32;color:#fff;border:none;border-radius:8px;padding:4px 10px;font-size:12px;cursor:pointer}.nc-new-btn:active{background:#255028}.nc-side-group{display:flex;flex-direction:column;gap:6px}.nc-side-group-title{font-size:11px;opacity:.55;text-transform:uppercase;letter-spacing:.5px;padding:10px 4px 2px}.nc-node-title{display:flex;align-items:center;gap:6px;opacity:.8}.nc-node-title[role=button]{cursor:pointer;border-radius:6px}.nc-node-title[role=button]:focus-visible{outline:1px solid #2e7d32}.nc-node-title .nc-dot{width:7px;height:7px;flex:0 0 auto}.nc-node-title b{font-weight:700;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:0}.nc-node-title small{text-transform:none;letter-spacing:0;opacity:.8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-node-chevron{flex:0 0 10px;font-size:13px}.nc-node-filter{flex:0 0 auto;max-width:82px;min-width:58px;padding:3px 18px 3px 5px;border:1px solid #243;border-radius:6px;background:#0a0e0a;color:#9fd;font:10px/1.2 inherit;text-transform:lowercase}.nc-cell{display:flex;align-items:center;gap:8px;padding:9px 10px;border:1px solid #1c241c;background:#0e140e;border-radius:10px;overflow:hidden}.nc-cell-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:1px}.nc-cell-main b{font-size:13px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:100%}.nc-cell-main small{font-size:11px;opacity:.6;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:100%}.nc-power{flex:0 0 auto;width:28px;height:28px;padding:0;display:inline-flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;border-radius:50%;cursor:pointer}.nc-power.on{color:#0c6;border-color:#00cc668c;background:#00cc661a}.nc-power.warn{color:#e8c547;border-color:#e8c5478c;background:#e8c5471a}.nc-power:hover{filter:brightness(1.25)}.nc-dot{flex:0 0 auto;width:9px;height:9px;border-radius:50%;background:#355}.nc-dot.on{background:#0c6;box-shadow:0 0 6px #0c68}.nc-dot.warn{background:#e0b020;box-shadow:0 0 6px #e0b02088}.nc-side-card{display:flex;align-items:center;gap:8px;padding:9px 10px;border:1px solid #1c241c;background:#0e140e;border-radius:10px;cursor:grab;-webkit-user-select:none;user-select:none}.nc-side-card:hover{border-color:#244}.nc-side-card.active{border-color:#2e7d32;background:#14200f}.nc-side-card:active{cursor:grabbing}.nc-card-main{flex:1;min-width:0;display:flex;flex-direction:column;gap:1px}.nc-card-main b{font-size:13px;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-card-main small{font-size:11px;opacity:.55;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-rel{flex:0 0 auto;font-size:10px;opacity:.45}.nc-menu{flex:0 0 auto;width:26px;height:26px;padding:0;display:inline-flex;align-items:center;justify-content:center;background:none;border:none;color:#9fd;cursor:pointer;font-size:15px;line-height:1;border-radius:50%}.nc-menu:active{color:#f88}.nc-empty{opacity:.4;padding:8px 4px;font-size:12px}.nc-side-gear{display:flex;align-items:center;gap:8px;background:none;border:1px solid #1c241c;border-radius:10px;color:#9fd;font-size:12px;padding:7px 10px;cursor:pointer;margin-top:0;flex:0 0 auto}.nc-side-gear:hover{border-color:#2e7d32;color:#d8ffe8}.nc-side-gear.mini{justify-content:center;width:34px;height:34px;box-sizing:border-box;padding:0;border-radius:9px;margin:6px auto 0}.nc-side-lang{flex:0 0 auto;padding:4px;display:flex;align-items:center;gap:2px;font-size:11px;opacity:.6}.nc-lang-btn{background:none;border:none;color:inherit;cursor:pointer;font-size:11px;padding:0 1px;opacity:.5;text-transform:uppercase}.nc-lang-btn.on{opacity:1;font-weight:700;color:#d8ffe8}.nc-cell.live{cursor:pointer}.nc-cell.live:hover{background:#ffffff0f}.nc-cell.active{outline:1px solid rgba(0,204,102,.5)}.nc-side-presets{display:flex;gap:4px;padding:2px 8px 6px}.nc-side-presets button{background:none;border:1px solid rgba(255,255,255,.15);border-radius:4px;color:inherit;cursor:pointer;padding:2px 8px}.nc-side-presets button:hover{background:#ffffff14}.nc-pin{flex:0 0 auto;width:28px;height:28px;padding:0;display:inline-flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;border-radius:50%;font-size:14px;line-height:1}.nc-pin:hover{filter:brightness(1.25)}.nc-pin.on{color:#e8c547;border-color:#e8c5478c;background:#e8c54714}.nc-technical{flex:0 0 auto;width:28px;height:28px;padding:0;display:inline-flex;align-items:center;justify-content:center;background:#ffffff0d;border:1px solid rgba(255,255,255,.22);color:#9aa89a;cursor:pointer;border-radius:50%;font:12px/1 monospace}.nc-technical.on{color:#d8a8ff;border-color:#b478ff8c;background:#b478ff1a}.nc-mini-tip{position:fixed;left:56px;transform:translateY(-50%);background:#161b16;color:#e6ffe6;border:1px solid rgba(0,204,102,.4);padding:3px 10px;border-radius:4px;white-space:nowrap;z-index:1000;pointer-events:none;font-size:12px}.nc-roster-handle{flex:0 0 24px;width:24px;min-width:24px;height:32px;display:inline-flex;align-items:center;justify-content:center;padding:0;border:0;border-radius:6px;background:transparent;color:#668875;cursor:grab;font:15px/1 monospace;touch-action:none}.nc-roster-handle:hover,.nc-roster-handle:focus-visible,.nc-roster-handle.active{color:#9fd;background:#00cc661a;outline:none}.nc-roster-handle:active,.nc-roster-handle.active{cursor:grabbing}.nc-side-card.nc-roster-dragging,.nc-cell.nc-roster-dragging{opacity:.62}.nc-side-card.nc-roster-over,.nc-cell.nc-roster-over{outline:2px solid rgba(0,204,102,.72);outline-offset:2px}.nc-tile{display:flex;flex-direction:column;min-height:0;min-width:0;position:relative;background:#0a0e0a;border:1px solid #1c241c;border-radius:8px;overflow:hidden}.nc-tile.focused{border-color:#2e7d32;box-shadow:0 0 0 1px #2e7d3244 inset}.nc-tile-head{flex:0 0 auto;display:flex;align-items:center;gap:6px;padding:3px 6px;background:#0e140e;border-bottom:1px solid #1c241c;height:28px}.nc-tile-name{flex:1 1 auto;min-width:0;display:inline-flex;align-items:center;gap:6px;background:none;border:none;color:#cfe;cursor:pointer;padding:0}.nc-tile-name b{font-size:12px;font-weight:600;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-tile-node{flex:0 0 auto;font-size:10px;color:#7fb89a;border:1px solid #2c4a3a;border-radius:4px;padding:0 4px;line-height:14px}.nc-tile .nc-dot{width:7px;height:7px;flex:0 0 auto}.nc-tile-actions{flex:0 0 auto;display:inline-flex;gap:2px}.nc-tile-actions button{background:none;border:none;color:#9fd;cursor:pointer;min-width:22px;height:22px;font-size:13px;border-radius:4px;padding:0 3px}.nc-tile-actions button:hover{color:#d8ffe8}.nc-tile-actions .nc-tile-close:hover{color:#f88}.nc-tile-body{flex:1 1 auto;position:relative;min-height:0}.nc-tile-body .nc-terminal{width:100%;height:100%}.nc-tile-unavailable{position:absolute;top:0;right:0;bottom:0;left:0;display:grid;place-items:center;padding:20px;color:#789a87;text-align:center;font-size:12px;background:repeating-linear-gradient(135deg,#0a0e0a,#0a0e0a 12px,#0d130d 12px,#0d130d 24px)}.nc-tile-composer{flex:0 0 auto;border-top:1px solid #1c241c}.nc-tile-files{position:absolute;top:0;right:0;bottom:0;left:0;z-index:5;background:#0e140e}.nc-tile-head{cursor:grab}.nc-tile-head:active{cursor:grabbing}.nc-grid{flex:1 1 auto;min-width:0;min-height:0;display:flex;flex-direction:row;padding:6px;gap:0;position:relative;background:#070a07}.nc-col{display:flex;flex-direction:column;min-width:120px;min-height:0;position:relative}.nc-col.drop-newcol:before{content:"";position:absolute;left:-3px;top:0;bottom:0;width:3px;background:#0c6;border-radius:2px;z-index:6}.nc-tile-slot{display:flex;flex-direction:column;min-height:60px;min-width:0;position:relative}.nc-tile-slot>.nc-tile{flex:1 1 auto;min-height:0}.nc-tile-slot.drop-left:after,.nc-tile-slot.drop-right:after,.nc-tile-slot.drop-top:after,.nc-tile-slot.drop-bottom:after{content:"";position:absolute;z-index:7;pointer-events:none;background:#00cc6647;border:2px solid #00cc66;border-radius:4px}.nc-tile-slot.drop-left:after{left:0;top:0;bottom:0;width:50%}.nc-tile-slot.drop-right:after{right:0;top:0;bottom:0;width:50%}.nc-tile-slot.drop-top:after{left:0;right:0;top:0;height:50%}.nc-tile-slot.drop-bottom:after{left:0;right:0;bottom:0;height:50%}.nc-grid-toolbar{position:absolute;top:10px;right:12px;z-index:8;display:flex;gap:4px;background:#0a100ad1;border:1px solid #1c241c;border-radius:8px;padding:3px}.nc-grid-toolbar button{background:none;border:none;color:#9fd;cursor:pointer;font-size:15px;line-height:1;padding:4px 7px;border-radius:6px}.nc-grid-toolbar button:hover{background:#1c3a1c;color:#d8ffe8}.nc-divider-v{flex:0 0 6px;cursor:col-resize;margin:0 1px;border-radius:2px}.nc-divider-v:hover{background:#1c3a1c}.nc-divider-h{flex:0 0 6px;cursor:row-resize;margin:1px 0;border-radius:2px}.nc-divider-h:hover{background:#1c3a1c}.nc-drop-line-v{flex:0 0 3px;align-self:stretch;background:#0c6;border-radius:2px}.nc-drop-line-end{margin-left:3px}.nc-grid-empty{position:absolute;top:0;right:0;bottom:0;left:0;display:flex;align-items:center;justify-content:center;color:#cfe;opacity:.4;font-size:13px;text-align:center;padding:20px}.nc-deckbar{display:flex;align-items:center;gap:8px;flex:0 0 auto;min-width:0;padding:5px 8px;background:#0e140e;border-bottom:1px solid #1c2a1c;overflow-x:auto;white-space:nowrap}.nc-deckbar-label{font-size:10px;text-transform:uppercase;letter-spacing:.06em;opacity:.5;color:#9fd;flex:0 0 auto}.nc-deck-sidebar-toggle{flex:0 0 auto;min-width:28px;height:26px;border:1px solid #243;border-radius:6px;background:#0a0e0a;color:#9fd;cursor:pointer;font:inherit}.nc-deck-sidebar-toggle:hover{border-color:#7aa903}.nc-deck-chips{display:flex;align-items:center;gap:6px;flex:0 1 auto;min-width:0}.nc-deck-owner-group{display:inline-flex;align-items:center;gap:4px;padding:2px 4px 2px 2px;border:1px solid #182318;border-radius:8px;background:#0b100b;flex:0 0 auto}.nc-deck-owner{max-width:120px;padding:0 4px;overflow:hidden;text-overflow:ellipsis;color:#789a87;font-size:9px;text-transform:uppercase;letter-spacing:.04em}.nc-deck-chip{display:inline-flex;align-items:center;border:1px solid #243;border-radius:6px;overflow:hidden;background:#0a0e0a}.nc-deck-chip.current{border-color:#7aa903}.nc-deck-chip.offline{opacity:.58;border-style:dashed}.nc-deck-chip.nc-deck-dragging{opacity:.58}.nc-deck-chip.nc-deck-over{box-shadow:0 0 0 2px #0c6 inset}.nc-deck-handle{align-self:stretch;min-width:25px;padding:0 5px;background:#ffffff09;border:0;border-right:1px solid #1c2a1c;color:#789a87;cursor:grab;touch-action:none;-webkit-user-select:none;user-select:none;font:11px/1 monospace}.nc-deck-handle:hover,.nc-deck-handle:focus-visible,.nc-deck-handle.active{color:#bfffd8;background:#00cc661f;outline:none}.nc-deck-handle.active{cursor:grabbing}.nc-deck-open{background:none;border:none;color:#cfe;padding:3px 8px;font:inherit;font-size:12px;cursor:pointer;max-width:180px;overflow:hidden;text-overflow:ellipsis}.nc-deck-chip.current .nc-deck-open{color:#d9f7c7}.nc-deck-open:hover{background:#132013}.nc-deck-open:disabled,.nc-deck-mini:disabled,.nc-deck-newbtn:disabled{cursor:not-allowed;opacity:.55}.nc-deck-mini{background:none;border:none;border-left:1px solid #1c2a1c;color:#7a9;padding:3px 6px;font:inherit;font-size:11px;cursor:pointer}.nc-deck-mini:hover{background:#132013;color:#9fd}.nc-deck-del:hover{color:#f99}.nc-deck-newbtn{background:none;border:1px dashed #2a3a2a;color:#9fd;border-radius:6px;padding:3px 7px;font:inherit;font-size:11px;cursor:pointer;flex:0 0 auto}.nc-deck-newbtn:hover{border-color:#7aa903}.nc-deck-add{display:inline-flex;align-items:center;gap:5px;flex:0 0 auto}.nc-deck-add input{padding:3px 8px;background:#122;border:1px solid #243;color:#cfe;border-radius:6px;font:inherit;font-size:12px;width:130px}.nc-deck-add input.invalid{border-color:#a44}.nc-deck-slug{color:#7a9;font-size:10px;max-width:130px;overflow:hidden;text-overflow:ellipsis}.nc-deck-ok,.nc-deck-cancel{background:#122;border:1px solid #243;color:#9fd;border-radius:6px;padding:3px 9px;font:inherit;font-size:12px;cursor:pointer}.nc-deck-ok:disabled{opacity:.4;cursor:default}.nc-deck-state{font-size:10px;color:#7a9;min-width:64px}.nc-deck-state.error,.nc-deck-error{color:#f88;font-size:10px}.nc-deck-fallback{color:#fd8;font-size:11px}.nc-tile-deck{background:#0a0e0a;border:1px solid #243;color:#9fd;border-radius:5px;font:inherit;font-size:11px;padding:1px 3px;max-width:92px}.nc-pair-card{border:1px solid #2f5;border-radius:8px;box-shadow:0 0 0 1px #22ff5514}.nc-pair-input{width:100%;min-width:0;box-sizing:border-box;font-size:15px;padding:10px}.nc-pair-actions{display:flex;gap:8px;flex-wrap:wrap;align-items:center}.nc-pair-status{min-height:1em}.nc-pair-progress{color:#9f9;animation:nc-pair-pulse 1.2s ease-in-out infinite}@keyframes nc-pair-pulse{0%,to{opacity:1}50%{opacity:.45}}.nc-pair-hint{opacity:.85;margin-top:4px;font-size:12px}.nc-pair-notice{display:block}.nc-pair-advanced-toggle{align-self:flex-start}.nc-pair-advanced{display:flex;flex-direction:column;gap:8px;min-width:0}.nc-qr-overlay{z-index:80}.nc-qr-modal{max-width:min(480px,calc(100vw - 32px));width:100%}.nc-qr-video{width:100%;max-height:60dvh;border-radius:6px;background:#000;object-fit:cover}.nc-qr-upload{display:inline-flex;align-items:center;cursor:pointer}.nc-set-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:60;background:#0000008c;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-set-panel{width:100%;max-width:560px;max-height:90vh;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:16px;display:flex;flex-direction:column;gap:12px;box-shadow:0 12px 40px #00000080;overflow:hidden}@media(max-width:1023px){.nc-set-overlay{padding:0}.nc-set-panel{max-width:none;max-height:none;height:100%;border-radius:0;border:none}}.nc-set-head{display:flex;align-items:center;gap:8px}.nc-set-head b{font-size:16px;color:#d8ffe8;flex:1}.nc-set-close{background:none;border:none;color:#9fd;cursor:pointer;padding:4px}.nc-set-readonly{font-size:12px;color:#e0b020;border:1px solid #4a3a10;border-radius:8px;padding:8px 10px;background:#171307}.nc-set-tabs{display:flex;gap:6px;border-bottom:1px solid #1c241c;padding-bottom:8px}.nc-set-tabbtn{background:none;border:1px solid #1c241c;border-radius:8px;color:#9fd;font-size:12px;padding:6px 12px;cursor:pointer;text-transform:uppercase;letter-spacing:.5px}.nc-set-tabbtn.on{border-color:#2e7d32;background:#14200f;color:#d8ffe8}.nc-set-body{overflow-y:auto;flex:1;min-height:120px}.nc-set-tab{display:flex;flex-direction:column;gap:12px}.nc-set-tab .nc-check span{display:flex;flex-direction:column;gap:2px}.nc-set-tab .nc-check small{opacity:.6;font-size:11px}.nc-set-info{font-size:12px;opacity:.7;line-height:1.6}.nc-set-note{font-size:12px;color:#9fd}.nc-set-hint{font-size:11px;opacity:.7}.nc-set-form{display:flex;flex-direction:column;gap:8px}.nc-set-form .nc-field{display:flex;flex-direction:column;gap:4px;font-size:12px;opacity:.82}.nc-set-form .nc-field small{font-size:10px;opacity:.7;line-height:1.3}.nc-set-ports{display:grid;grid-template-columns:1fr 1fr;gap:8px}@media(max-width:520px){.nc-set-ports{grid-template-columns:1fr}}.nc-set-form input:not([type=checkbox]):not([type=file]){padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-set-form input:focus{outline:none;border-color:#2e7d32}.nc-set-form input:disabled{opacity:.5}.nc-set-form textarea,.nc-set-form select{padding:9px 10px;font:13px/1.3 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px;min-height:36px;width:100%;min-width:0;max-width:100%;box-sizing:border-box}.nc-set-form textarea{min-height:72px;resize:vertical}.nc-fleet-editor{gap:10px}.nc-fleet-view-tabs{display:grid;grid-template-columns:1fr 1fr;gap:6px;position:sticky;top:0;z-index:2;background:#0e140e;padding-bottom:6px}.nc-fleet-view-tabs .nc-set-tabbtn{width:100%;text-transform:none}.nc-fleet-section-head,.nc-fleet-item{display:flex;align-items:center;justify-content:space-between;gap:8px}.nc-fleet-section-head{margin-top:4px;border-bottom:1px solid #243;padding-bottom:6px}.nc-fleet-item{border:1px solid #1c241c;border-radius:8px;padding:8px}.nc-fleet-item>span{display:flex;gap:6px;align-items:center;min-width:0}.nc-fleet-item>span:first-child{flex-direction:column;align-items:flex-start;min-width:0}.nc-fleet-item>span:last-child{flex-wrap:wrap;justify-content:flex-end}.nc-fleet-item>span:first-child b,.nc-fleet-item>span:first-child small{display:block;max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nc-fleet-item small{opacity:.6}.nc-fleet-form{border:1px solid #2e7d32;border-radius:10px;padding:10px}.nc-fleet-modal{position:fixed;top:0;right:0;bottom:0;left:0;z-index:75;padding:16px;display:flex;align-items:center;justify-content:center;box-sizing:border-box;background:#000000b8;overscroll-behavior:contain}.nc-fleet-modal-dialog{width:min(680px,100%);max-height:calc(100dvh - 32px);overflow-y:auto;border-radius:12px;background:#0e140e;box-shadow:0 14px 50px #000000b3;overscroll-behavior:contain}.nc-fleet-modal-dialog .nc-fleet-form{margin:0;padding:14px}.nc-fleet-head-actions{display:flex;gap:6px;flex-wrap:wrap;justify-content:flex-end}.nc-fleet-pair,.nc-fleet-env{display:flex;gap:6px}.nc-fleet-pair input,.nc-fleet-pair select,.nc-fleet-env input{flex:1;min-width:0}@media(max-width:520px){.nc-fleet-modal{padding:0;align-items:stretch}.nc-fleet-modal-dialog{width:100%;max-height:100dvh;border-radius:0}.nc-fleet-item{align-items:flex-start;flex-direction:column}.nc-fleet-item>span:last-child{width:100%;justify-content:flex-start}.nc-fleet-pair{flex-direction:column}}.nc-invite-endpoint{border:1px solid #243;border-radius:8px;padding:9px 10px;overflow-wrap:anywhere}.nc-local-share{border:1px solid #243;border-radius:10px;padding:10px;background:#0a0e0a}.nc-local-share .nc-node-share{padding:2px 0}.nc-invite-advanced{display:flex;flex-direction:column;gap:8px;padding:9px;border-left:2px solid #243}.nc-invite-actions{flex-wrap:wrap}.nc-update-settings,.nc-backup-dialog{border:1px solid #243;border-radius:10px;padding:10px}.nc-backup-tabs{margin:0}.nc-backup-list{display:flex;flex-direction:column;gap:6px;max-height:42vh;overflow-y:auto}.nc-backup-row,.nc-backup-import-row{border:1px solid #1c241c;border-radius:8px;padding:8px}.nc-backup-import-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(160px,.7fr);gap:8px;align-items:center}@media(max-width:520px){.nc-backup-import-row{grid-template-columns:1fr}}.nc-set-node{border:1px solid #1c241c;border-radius:10px;padding:10px;display:flex;flex-direction:column;gap:8px;background:#0a0e0a}.nc-set-node-head{display:flex;align-items:center;gap:8px;flex-wrap:wrap}.nc-set-node-head b{color:#d8ffe8}.nc-set-node-head small{opacity:.6;font-size:11px}.nc-set-tunnel{margin-left:auto;font-size:11px;color:#f88}.nc-set-tunnel.up{color:#6c6}.nc-set-node-actions{display:flex;gap:6px;flex-wrap:wrap}.nc-set-node-actions .nc-btn{padding:5px 10px;font-size:12px}.nc-set-test{font-size:11px}.nc-set-test.ok{color:#6c6}.nc-set-test.ko{color:#f88}.nc-set-copyline{display:flex;gap:8px;align-items:center}.nc-set-copyline code{flex:1;font-size:10px;word-break:break-all;-webkit-user-select:all;user-select:all;background:#0a0e0a;border:1px solid #1c241c;border-radius:6px;padding:6px;max-height:72px;overflow-y:auto}.nc-set-akeys{display:flex;flex-direction:column;gap:6px}.nc-set-row{display:flex;gap:8px;flex-wrap:wrap}.nc-set-confirm{border:1px solid #4a3a10;border-radius:10px;padding:10px;background:#171307;font-size:12px;color:#e8d8a0;display:flex;flex-direction:column;gap:10px}.nc-set-panel .nc-check{display:flex;align-items:flex-start;gap:8px;font-size:13px;cursor:pointer}.nc-set-panel .nc-check input{accent-color:#2e7d32;margin-top:2px}.nc-set-panel .nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-set-panel .nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-set-panel .nc-btn.primary{background:#2e7d32;color:#fff}.nc-set-panel .nc-btn.danger{background:none;border:1px solid #532;color:#f88}.nc-set-panel .nc-btn:disabled{opacity:.5;cursor:default}.nc-set-panel .nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap}.nc-set-panel .nc-sheet-label{font-size:12px;opacity:.7;text-transform:uppercase;letter-spacing:.5px}.nc-set-panel .nc-err{color:#f88;font-size:12px}.nc-set-panel .nc-empty{opacity:.5;font-size:12px}.nc-set-panel .nc-dot{width:8px;height:8px;border-radius:50%;background:#333;display:inline-block;flex:0 0 8px}.nc-set-panel .nc-dot.on{background:#2e7d32}.nc-wiz-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:70;background:#000000b3;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}.nc-wiz{width:100%;max-width:420px;max-height:90vh;overflow-y:auto;background:#0e140e;color:#cfe;border:1px solid #243;border-radius:14px;padding:18px;display:flex;flex-direction:column;gap:14px;box-shadow:0 12px 40px #00000080}.nc-wiz-head{display:flex;flex-direction:column;gap:4px}.nc-wiz-head b{font-size:17px;color:#d8ffe8}.nc-wiz-head small{font-size:12px;opacity:.65;text-transform:uppercase;letter-spacing:.5px}.nc-wiz-body{display:flex;flex-direction:column;gap:10px}.nc-wiz-body input{padding:9px 10px;font:14px/1.2 inherit;background:#0a0e0a;color:#cfe;border:1px solid #243;border-radius:8px}.nc-wiz-body input:focus{outline:none;border-color:#2e7d32}.nc-wiz-body .nc-field{display:flex;flex-direction:column;gap:5px;font-size:12px;color:#bfe8cd}.nc-wiz-body .nc-field small{font-size:10px;opacity:.58;line-height:1.3}.nc-wiz-help{margin:0;font-size:11px;line-height:1.4;opacity:.7}.nc-wiz-ports{display:grid;grid-template-columns:1fr 1fr;gap:10px}@media(max-width:420px){.nc-wiz-ports{grid-template-columns:1fr}}.nc-wiz-done{font-size:13px;opacity:.85}.nc-wiz .nc-check{display:flex;align-items:flex-start;gap:8px;font-size:13px;cursor:pointer}.nc-wiz .nc-check input{accent-color:#2e7d32;margin-top:2px}.nc-wiz .nc-check span{display:flex;flex-direction:column;gap:2px}.nc-wiz .nc-check small{opacity:.6;font-size:11px}.nc-wiz .nc-btn{border:none;border-radius:8px;padding:8px 16px;font-size:13px;cursor:pointer}.nc-wiz .nc-btn.ghost{background:none;border:1px solid #243;color:#9fd}.nc-wiz .nc-btn.primary{background:#2e7d32;color:#fff}.nc-wiz .nc-btn:disabled{opacity:.5;cursor:default}.nc-wiz .nc-sheet-actions{display:flex;justify-content:flex-end;gap:8px}.nc-wiz .nc-err{color:#f88;font-size:12px}.nc-wiz-skip{background:none;border:none;color:#9fd;opacity:.6;font-size:12px;cursor:pointer;text-decoration:underline;align-self:center;padding:4px}.nc-wiz-skip:hover{opacity:1}.nc-ntf-toasts{position:fixed;top:10px;right:10px;z-index:2100;display:flex;flex-direction:column;gap:8px;max-width:min(360px,calc(100vw - 20px))}.nc-ntf-toast{display:flex;align-items:flex-start;gap:8px;background:var(--bg-secondary);color:var(--text-primary);border:1px solid var(--border);border-left:3px solid var(--accent);border-radius:10px;padding:8px 8px 8px 12px;font-size:13px;box-shadow:0 2px 12px #0000008c}.nc-ntf-toast.high{border-left-color:var(--warning)}.nc-ntf-toast-txt{display:flex;flex-direction:column;gap:2px;min-width:0}.nc-ntf-toast-txt b{word-break:break-word}.nc-ntf-toast-txt small{color:var(--text-secondary);word-break:break-word}.nc-ntf-from{color:var(--text-tertiary);font-size:11px;font-family:var(--font-mono)}.nc-ntf-x{margin-left:auto;background:none;border:none;color:var(--text-tertiary);cursor:pointer;padding:2px;display:inline-flex;border-radius:6px}.nc-ntf-x:hover{color:var(--text-primary);background:var(--bg-hover)}.nc-ask-badge{position:fixed;bottom:64px;right:12px;z-index:2100;display:inline-flex;align-items:center;gap:6px;background:var(--accent);color:#fff;border:none;border-radius:999px;padding:8px 14px;font-size:14px;font-weight:700;cursor:pointer;box-shadow:0 2px 12px #0000008c}.nc-ask-badge:hover{background:var(--accent-hover)}.nc-ask-count{background:#00000059;border-radius:999px;padding:0 7px;font-size:12px;line-height:18px}.nc-ask-panel{position:fixed;bottom:10px;right:10px;z-index:2100;width:min(420px,calc(100vw - 20px));max-height:min(70vh,560px);display:flex;flex-direction:column;background:var(--bg-secondary);border:1px solid var(--border);border-radius:12px;box-shadow:0 4px 20px #0009}.nc-ask-panel-head{display:flex;align-items:center;gap:8px;padding:10px 12px;border-bottom:1px solid var(--border);font-size:13px}.nc-ask-panel-head .nc-ask-count{background:var(--accent)}.nc-ask-panel-body{overflow-y:auto;padding:10px 12px;display:flex;flex-direction:column;gap:10px}.nc-ask-card{background:var(--bg-tertiary);border:1px solid var(--border);border-radius:10px;padding:10px;display:flex;flex-direction:column;gap:8px}.nc-ask-head{display:flex;align-items:center;gap:8px}.nc-ask-id{color:var(--text-tertiary);font-size:11px;margin-left:auto}.nc-ask-q{font-size:13px;white-space:pre-wrap;word-break:break-word}.nc-ask-opts{display:flex;flex-wrap:wrap;gap:6px}.nc-ask-reply{display:flex;gap:6px;align-items:flex-end}.nc-ask-reply textarea{flex:1;resize:vertical;min-height:34px;background:var(--bg-primary);color:var(--text-primary);border:1px solid var(--border);border-radius:8px;padding:6px 8px;font:inherit;font-size:13px}.nc-ask-card .nc-err{color:var(--error);font-size:12px}:root{color-scheme:dark}body,#root{margin:0;height:100vh;height:100dvh;background:#0a0e0a;font-family:ui-monospace,monospace}.nc-app{display:flex;flex-direction:column;height:100vh;height:100dvh;min-height:0}.nc-keybar{flex:0 0 auto}.nc-bar{display:flex;gap:10px;align-items:center;padding:8px;color:#cfe;background:#0e140e}.nc-bar button{background:none;border:1px solid #243;color:#9fd;border-radius:6px;padding:4px 10px}.nc-termwrap{position:relative;flex:1}.nc-auth{color:#cfe;padding:20px;display:flex;flex-direction:column;gap:10px;max-width:420px}.nc-auth input[type=text],.nc-auth input:not([type]){padding:10px;background:#122;border:1px solid #243;color:#cfe;border-radius:6px}.nc-auth button{padding:10px;background:#122;border:1px solid #243;color:#9fd;border-radius:6px}.nc-bar-right{margin-left:auto;display:flex;gap:4px}@media(pointer:coarse){.nc-bar button,.nc-bar-right button{min-height:42px;min-width:42px;font-size:20px}}.nc-bar button,.nc-bar-right button{display:inline-flex;align-items:center;justify-content:center;gap:6px}.nc-bar>button{flex:0 0 auto}.nc-bar>b{flex:1 1 auto;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:13px;font-weight:600}.nc-bar-right{flex:0 0 auto}@media(max-width:480px){.nc-bar-label{display:none}}.nc-workspace{display:flex;flex-direction:row;height:100vh;height:100dvh;min-height:0;background:#0a0e0a;color:#cfe}.nc-workspace-main{flex:1 1 auto;min-width:0;min-height:0;display:flex;flex-direction:column}.nc-single-overlay{position:fixed;top:0;right:0;bottom:0;left:0;z-index:40;background:#0a0e0a}.nc-bar-single .nc-bar-center{flex:1 1 auto;min-width:0;display:flex;flex-direction:column;align-items:center;justify-content:center;line-height:1.15}.nc-bar-single .nc-bar-center b{font-size:13px;font-weight:600;color:#d8ffe8;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:100%}.nc-bar-sub{font-size:10px;opacity:.55}.nc-app{animation:nc-slide-in .2s ease-out}@keyframes nc-slide-in{0%{transform:translate(12%);opacity:0}to{transform:translate(0);opacity:1}}@media(prefers-reduced-motion:reduce){.nc-app{animation:none}}.nc-stale{position:fixed;top:8px;left:50%;transform:translate(-50%);z-index:2000;cursor:pointer;background:#1a2410;color:#d9f7c7;border:1px solid #7aa903;border-radius:8px;padding:6px 14px;font-size:13px;box-shadow:0 2px 10px #00000080}.nc-update{position:fixed;bottom:8px;left:50%;transform:translate(-50%);z-index:2000;display:flex;align-items:center;gap:10px;background:#0f1a0f;color:#d9f7c7;border:1px solid #2e7d32;border-radius:10px;padding:6px 8px 6px 14px;font-size:13px;box-shadow:0 2px 12px #0000008c}.nc-update-msg{white-space:nowrap}.nc-update-btn{display:inline-flex;align-items:center;justify-content:center;background:#2e7d32;border:1px solid #2e7d32;color:#06120a;border-radius:7px;padding:4px 12px;font:inherit;font-size:13px;cursor:pointer}.nc-update-btn:hover{background:#3a9d42}@media(prefers-reduced-motion:reduce){.nc-update{transition:none}}:root{--bg-primary: #0d1117;--bg-secondary: #161b22;--bg-tertiary: #21262d;--bg-hover: #30363d;--text-primary: #e6edf3;--text-secondary: #8b949e;--text-tertiary: #6e7681;--border: #30363d;--accent: #6c5ce7;--accent-hover: #7c6cf7;--success: #3fb950;--warning: #d29922;--error: #f85149;--user-bg: #1c2333;--assistant-bg: transparent;--font-mono: "SF Mono", monospace;--font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif}*{box-sizing:border-box;margin:0;padding:0}html,body,#root{height:100%;width:100%;overflow:hidden}body{font-family:var(--font-sans);background:var(--bg-primary);color:var(--text-primary);-webkit-font-smoothing:antialiased}::-webkit-scrollbar{width:6px}::-webkit-scrollbar-track{background:transparent}::-webkit-scrollbar-thumb{background:var(--bg-tertiary);border-radius:3px}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.spinning{animation:spin 1s linear infinite}

package/frontend/dist/index.html

@@ -11,8 +11,8 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-DuIR61l-.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-4rNd0SwZ.css">
+  <script type="module" crossorigin src="/assets/index-BD-7qEsn.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-C-JOkuIc.css">
 </head>
 <body>
   <div id="root"></div>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.8.13"}
+{"version":"0.8.15"}

package/lib/config.js

@@ -33,6 +33,13 @@ function baseDefaults() {
     // Existing user-owned shell exports. NexusCrew parses simple assignments
     // as data; it never executes/sources this file and never copies values.
     providerShellPath: path.join(os.homedir(), '.config', 'ai-shell', 'providers.zsh'),
+    // Canonical credential files sourced by providers.zsh. NexusCrew reads
+    // only strict KEY=VALUE assignments as data and never executes either file.
+    providerKeysPath: path.join(os.homedir(), '.config', 'keys', 'ai.env'),
+    providerSecurePath: path.join(os.homedir(), '.config', 'secure', '.env'),
+    // Write-only local provider store managed by NexusCrew. It is never part
+    // of Fleet backups, federation payloads or API responses.
+    credentialsPath: path.join(os.homedir(), '.nexuscrew', 'credentials.json'),
     // Installazioni npm globali controllano periodicamente il dist-tag latest.
     // Il manager aggiorna solo verso una semver superiore: mai downgrade.
     autoUpdate: true,
@@ -70,6 +77,9 @@ function envOverrides() {
   if (process.env.NEXUSCREW_FLEET_BIN) e.fleetBin = process.env.NEXUSCREW_FLEET_BIN;
   if (process.env.NEXUSCREW_PROVIDER_SECRETS) e.providerSecretsPath = process.env.NEXUSCREW_PROVIDER_SECRETS;
   if (process.env.NEXUSCREW_PROVIDER_SHELL) e.providerShellPath = process.env.NEXUSCREW_PROVIDER_SHELL;
+  if (process.env.NEXUSCREW_PROVIDER_KEYS) e.providerKeysPath = process.env.NEXUSCREW_PROVIDER_KEYS;
+  if (process.env.NEXUSCREW_PROVIDER_SECURE) e.providerSecurePath = process.env.NEXUSCREW_PROVIDER_SECURE;
+  if (process.env.NEXUSCREW_CREDENTIALS_FILE) e.credentialsPath = process.env.NEXUSCREW_CREDENTIALS_FILE;
   if (process.env.NEXUSCREW_AUTO_UPDATE !== undefined) {
     e.autoUpdate = !['', '0', 'false', 'no', 'off'].includes(String(process.env.NEXUSCREW_AUTO_UPDATE).toLowerCase());
   }

package/lib/fleet/builtin.js

@@ -13,8 +13,9 @@
 //    exec del comando, NON sh -c — verificato: ';','|','$' passano verbatim).
 //  - env: il builtin lancia con un env MINIMALE controllato dal service (allowlist
 //    dura); engine.env — gia' ripulito dalle loader-key da parseDefinitions —
-//    raggiunge la sessione SOLO via `tmux -e` (chiavi validate). PATH lo controlla
-//    il service, mai la definizione.
+//    raggiunge il client solo tramite un broker AF_UNIX privato e monouso. Nessun
+//    valore passa in argv, `tmux -e`, file temporanei o ambiente globale tmux.
+//    PATH lo controlla il service, mai la definizione.
 //  - READONLY (cfg.readonlyDefault===true | NEXUSCREW_READONLY=1) blocca ogni
 //    mutazione fleet e ogni up (§9d): passano solo status/schema/capabilities.
 //  - promptMode 'send-keys' inietta via `tmux load-buffer` + `paste-buffer -p`
@@ -31,13 +32,17 @@ const {
 const {
   publicCatalog, describeManaged, resolveManagedEngine, discoverOllamaModels, discoverPiModels,
 } = require('./managed.js');
+const { validEnvKey } = require('./env-key.js');
+const { setCredential, removeCredential } = require('./credentials.js');
+const { createLaunchBroker } = require('./launch-broker.js');
 const { MINIMAL_ENV_KEYS, minimalRuntimeEnv } = require('../runtime/env.js');
 
 const STATUS_TTL_MS = 2000;
 
 // Env minimale controllato dal service (design §9a). Allowlist DURA: le definizioni
 // non possono toccare PATH/loader-key (parseDefinitions le rifiuta gia' in env);
-// qui NON passiamo MAI l'env del processo per intero. engine.env va in session via -e.
+// qui NON passiamo MAI l'env del processo per intero. engine.env viene consegnato
+// direttamente al processo figlio dal broker, senza entrare nello stato tmux.
 // Nota: se un server tmux e' gia' in esecuzione (avviato fuori dal service), i comandi
 // ereditano l'env di quel server; la garanzia dura resta: le definizioni non possono
 // iniettare loader-key, e engine.env arriva al pane SOLO tramite chiavi validate.
@@ -130,16 +135,12 @@ function promptCharsOk(prompt) {
 }
 
 // ---------------------------------------------------------------------------
-// composeLaunchArgv({tmuxSession, realCwd, engine, cell}) -> argv per new-session
-// PURA + testabile. No shell: command e args sono argv diretto. model/prompt sono
-// aggiunti solo se c'e' un VALORE effettivo (override cella || default engine).
+// Build the direct child invocation separately from tmux. This lets the secure
+// launch broker carry the complete child argv and environment in memory while
+// tmux receives only the broker helper path and a one-time nonce.
 // ---------------------------------------------------------------------------
-function composeLaunchArgv({ tmuxSession, realCwd, engine, cell }) {
-  const args = ['new-session', '-d', '-s', tmuxSession, '-c', realCwd];
-  // engine.env -> env di sessione via -e (chiavi gia' validate, no loader-key)
-  for (const [k, v] of Object.entries(engine.env || {})) args.push('-e', `${k}=${v}`);
-  // command + args: argv diretto (tmux exec, NON sh -c)
-  args.push(engine.command, ...(engine.args || []));
+function composeClientInvocation(engine, cell) {
+  const args = [...(engine.args || [])];
   // model: flag + (override cella || valore engine), solo se c'e' un valore
   if (engine.model) {
     const val = (cell.model != null && cell.model !== '') ? cell.model : engine.model.value;
@@ -152,7 +153,15 @@ function composeLaunchArgv({ tmuxSession, realCwd, engine, cell }) {
   if (engine.promptMode === 'flag' && cell.prompt) {
     args.push(engine.promptFlag, cell.prompt);
   }
-  return args;
+  return { command: engine.command, args };
+}
+
+// composeLaunchArgv({tmuxSession, realCwd, engine, cell}) -> argv per new-session
+// PURA + testabile. Provider values are deliberately absent: no `tmux -e`, no
+// environment value and no broker payload ever appears in the tmux client argv.
+function composeLaunchArgv({ tmuxSession, realCwd, engine, cell }) {
+  const child = composeClientInvocation(engine, cell);
+  return ['new-session', '-d', '-s', tmuxSession, '-c', realCwd, child.command, ...child.args];
 }
 
 // Poll has-session entro readyMs (no delay fisso cieco). Ritorna true se la sessione
@@ -276,6 +285,7 @@ async function createBuiltinFleet(cfg = {}) {
   const defsPath = cfg.fleetDefsPath || path.join(home, '.nexuscrew', 'fleet.json');
   const tmuxBin = cfg.tmuxBin || process.env.TMUX_BIN || 'tmux';
   const readonly = () => (cfg.readonlyDefault === true || process.env.NEXUSCREW_READONLY === '1');
+  const launchBroker = cfg.launchBroker || createLaunchBroker({ ...cfg, home });
 
   // Bootstrap: fleet.json valido? garbage -> unavailable (fail-closed, design §7)
   const boot = loadDefinitions(defsPath);
@@ -392,11 +402,27 @@ async function createBuiltinFleet(cfg = {}) {
     const realCwd = resolveCwd(cell.cwd, home);
     if (!realCwd) throw httpError(400, `cwd non valida (deve esistere sotto la home): ${cell.cwd}`);
 
-    // (4)+(5) argv diretto (no shell), env minimale + engine.env via -e.
+    // (4)+(5) argv diretto (no shell). Environment-bearing launches go
+    // through a private, one-shot Unix-socket broker so credentials never
+    // appear in `ps`, tmux argv, tmux global/session env or a temporary file.
     // '-P -F #{pane_id}': tmux stampa il pane id della sessione appena creata,
     // cosi' l'iniezione del prompt bersaglia ESATTAMENTE quel pane (audit impl
     // #5: elimina la race di riuso del nome sessione tra waitAlive e paste).
-    const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine: launchEngine, cell });
+    let tmuxLaunchEngine = launchEngine;
+    if (Object.keys(launchEngine.env || {}).length) {
+      const child = composeClientInvocation(launchEngine, cell);
+      const ticket = await launchBroker.issue({
+        command: child.command,
+        args: child.args,
+        env: { ...minimalEnv(), ...launchEngine.env },
+      });
+      tmuxLaunchEngine = {
+        command: process.execPath,
+        args: [path.join(__dirname, 'cell-exec.js'), '--socket', ticket.socketPath, '--nonce', ticket.nonce],
+        env: {}, promptMode: 'managed-argv',
+      };
+    }
+    const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine: tmuxLaunchEngine, cell });
     argv.splice(2, 0, '-P', '-F', '#{pane_id}');
     // Mantieni il pane morto solo durante la finestra di readiness: permette di
     // catturare un errore reale del client senza lasciare una sessione fantasma.
@@ -816,10 +842,61 @@ async function createBuiltinFleet(cfg = {}) {
       managedConfig: {
         providerSecretsPath: cfg.providerSecretsPath || path.join(home, '.nexuscrew', 'providers.env'),
         providerShellPath: cfg.providerShellPath || path.join(home, '.config', 'ai-shell', 'providers.zsh'),
+        providerKeysPath: cfg.providerKeysPath || path.join(home, '.config', 'keys', 'ai.env'),
+        providerSecurePath: cfg.providerSecurePath || path.join(home, '.config', 'secure', '.env'),
+        localCredentialStore: true,
       },
     };
   }
 
+  function credentialRequirements() {
+    const defs = reloadDefs(); const map = new Map();
+    for (const engine of defs.engines) {
+      if (!engine.managed) continue;
+      const info = describeManaged(engine.managed, { ...cfg, home });
+      const envKey = info.auth;
+      if (!validEnvKey(envKey) || envKey === 'login' || envKey === 'none') continue;
+      const current = map.get(envKey) || {
+        envKey, configured: false, source: 'missing', engines: [], activeCells: [],
+      };
+      current.configured ||= info.authConfigured === true;
+      if (info.credentialSource && info.credentialSource !== 'missing') current.source = info.credentialSource;
+      current.engines.push(engine.id);
+      map.set(envKey, current);
+    }
+    return { defs, map };
+  }
+
+  async function credentialStatus() {
+    const { defs, map } = credentialRequirements();
+    const sessions = await refreshSessions();
+    for (const entry of map.values()) {
+      entry.engines.sort();
+      entry.activeCells = defs.cells
+        .filter((cell) => entry.engines.includes(cell.engine) && sessions.has(cell.tmuxSession))
+        .map((cell) => cell.id).sort();
+    }
+    return { credentials: [...map.values()].sort((a, b) => a.envKey.localeCompare(b.envKey)) };
+  }
+
+  async function setLocalCredential(envKey, value) {
+    if (readonly()) throw httpError(403, 'READONLY: credential write blocked');
+    const { map } = credentialRequirements();
+    if (!map.has(envKey)) throw httpError(400, 'credential key is not required by a configured engine');
+    try { setCredential({ ...cfg, home }, envKey, value, home); }
+    catch (error) { throw httpError(400, error.message); }
+    return credentialStatus();
+  }
+
+  async function removeLocalCredential(envKey) {
+    if (readonly()) throw httpError(403, 'READONLY: credential removal blocked');
+    const { map } = credentialRequirements();
+    if (!map.has(envKey)) throw httpError(400, 'credential key is not required by a configured engine');
+    try { removeCredential({ ...cfg, home }, envKey, home); }
+    catch (error) { throw httpError(400, error.message); }
+    return credentialStatus();
+  }
+
   // Scrive il draft mutato; atomicWrite valida PRIMA (fail-closed). Su input
   // invalido: backup predecessore + throw -> httpError(400) (mai garbage).
   async function mutate(defs, mutator) {
@@ -890,9 +967,11 @@ async function createBuiltinFleet(cfg = {}) {
   }
 
   function capabilities() {
-    return ['status', 'up', 'down', 'restart', 'engine', 'boot', 'define', 'edit', 'remove', 'import', 'restore', 'schema', 'definitions'];
+    return ['status', 'up', 'down', 'restart', 'engine', 'boot', 'define', 'edit', 'remove', 'import', 'restore', 'schema', 'definitions', 'credentials'];
   }
 
+  async function close() { await launchBroker.close(); }
+
   return {
     available: true,
     provider: 'builtin',
@@ -900,12 +979,14 @@ async function createBuiltinFleet(cfg = {}) {
     defineEngine, editEngine, removeEngine,
     defineCell, editCell, removeCell, importCell, restoreCells, restoreEngines,
     schema, definitions, capabilities,
+    credentialStatus, setLocalCredential, removeLocalCredential, close,
   };
 }
 
 module.exports = {
   createBuiltinFleet,
   composeLaunchArgv,
+  composeClientInvocation,
   minimalEnv,
   promptCharsOk,
   redactSecrets,

package/lib/fleet/cell-exec.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+'use strict';
+
+// Tiny launch helper. It receives only a local socket path and a random,
+// single-use nonce in argv. Provider values arrive over the private Unix
+// socket, stay in memory and are passed directly to the child process.
+const net = require('node:net');
+const { spawn } = require('node:child_process');
+const { MAX_PAYLOAD } = require('./launch-broker.js');
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    if (argv[i] === '--socket') out.socketPath = argv[i + 1];
+    else if (argv[i] === '--nonce') out.nonce = argv[i + 1];
+    else return null;
+  }
+  if (typeof out.socketPath !== 'string' || !out.socketPath
+    || typeof out.nonce !== 'string' || !/^[a-f0-9]{64}$/.test(out.nonce)) return null;
+  return out;
+}
+
+function validPayload(payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false;
+  if (typeof payload.command !== 'string' || !payload.command || !Array.isArray(payload.args)) return false;
+  if (!payload.env || typeof payload.env !== 'object' || Array.isArray(payload.env)) return false;
+  return payload.args.every((v) => typeof v === 'string')
+    && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string');
+}
+
+function receivePayload(socketPath, nonce, timeoutMs = 5000) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(socketPath);
+    let data = Buffer.alloc(0); let expected = null; let done = false;
+    const finish = (error, payload) => {
+      if (done) return; done = true; socket.destroy();
+      if (error) reject(error); else resolve(payload);
+    };
+    socket.setTimeout(timeoutMs, () => finish(new Error('launch broker timed out')));
+    socket.once('connect', () => socket.write(`${JSON.stringify({ nonce })}\n`));
+    socket.on('data', (chunk) => {
+      data = Buffer.concat([data, chunk]);
+      if (expected === null && data.length >= 4) {
+        expected = data.readUInt32BE(0); data = data.subarray(4);
+        if (!expected || expected > MAX_PAYLOAD) return finish(new Error('invalid launch payload length'));
+      }
+      if (expected !== null && data.length >= expected) {
+        try {
+          const payload = JSON.parse(data.subarray(0, expected).toString('utf8'));
+          if (!validPayload(payload)) return finish(new Error('invalid launch payload'));
+          finish(null, payload);
+        } catch (error) { finish(error); }
+      }
+    });
+    socket.once('error', (error) => finish(error));
+    socket.once('end', () => { if (!done) finish(new Error('launch broker closed early')); });
+  });
+}
+
+async function main(argv = process.argv.slice(2), seams = {}) {
+  const parsed = parseArgs(argv);
+  if (!parsed) throw new Error('usage: cell-exec --socket <path> --nonce <hex>');
+  const payload = await (seams.receivePayload || receivePayload)(parsed.socketPath, parsed.nonce);
+  const spawnImpl = seams.spawn || spawn;
+  const child = spawnImpl(payload.command, payload.args, { env: payload.env, stdio: 'inherit' });
+  for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
+    process.once(signal, () => { try { child.kill(signal); } catch (_) {} });
+  }
+  return new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('exit', (code, signal) => resolve(signal ? 128 : (code == null ? 1 : code)));
+  });
+}
+
+if (require.main === module) {
+  main().then((code) => { process.exitCode = code; }).catch((error) => {
+    process.stderr.write(`nexuscrew cell launch failed: ${error.message}\n`); process.exitCode = 1;
+  });
+}
+
+module.exports = { parseArgs, validPayload, receivePayload, main };

package/lib/fleet/credentials.js

@@ -0,0 +1,135 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { validEnvKey } = require('./env-key.js');
+
+const SCHEMA_VERSION = 1;
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_VALUE_BYTES = 16 * 1024;
+
+function credentialsPath(cfg = {}, home = cfg.home || os.homedir()) {
+  return cfg.credentialsPath || process.env.NEXUSCREW_CREDENTIALS_FILE
+    || path.join(home, '.nexuscrew', 'credentials.json');
+}
+
+function ownedByCurrentUser(st) {
+  return typeof process.getuid !== 'function' || st.uid === process.getuid();
+}
+
+function safePrivateDir(dir, { create = false } = {}) {
+  let st;
+  try { st = fs.lstatSync(dir); }
+  catch (error) {
+    if (error.code !== 'ENOENT' || !create) throw error;
+    fs.mkdirSync(dir, { recursive: false, mode: 0o700 });
+    st = fs.lstatSync(dir);
+  }
+  if (!st.isSymbolicLink() && st.isDirectory() && ownedByCurrentUser(st) && (st.mode & 0o077) && create) {
+    fs.chmodSync(dir, 0o700); st = fs.lstatSync(dir);
+  }
+  if (st.isSymbolicLink() || !st.isDirectory() || !ownedByCurrentUser(st) || (st.mode & 0o077)) {
+    throw new Error('unsafe credential directory (must be user-owned mode 0700, not a symlink)');
+  }
+  return st;
+}
+
+function normalizeCredentials(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('invalid credential store');
+  if (raw.schemaVersion !== SCHEMA_VERSION || !raw.credentials
+    || typeof raw.credentials !== 'object' || Array.isArray(raw.credentials)) {
+    throw new Error('invalid credential store schema');
+  }
+  const credentials = {};
+  for (const [key, value] of Object.entries(raw.credentials)) {
+    if (!validEnvKey(key) || typeof value !== 'string' || !value
+      || Buffer.byteLength(value) > MAX_VALUE_BYTES || /[\x00\r\n]/.test(value)) {
+      throw new Error('invalid credential store entry');
+    }
+    credentials[key] = value;
+  }
+  return credentials;
+}
+
+function readCredentialStore(cfg = {}, home = cfg.home || os.homedir()) {
+  const file = credentialsPath(cfg, home);
+  try {
+    const parent = path.dirname(file);
+    safePrivateDir(parent);
+    const st = fs.lstatSync(file);
+    if (st.isSymbolicLink() || !st.isFile() || !ownedByCurrentUser(st)
+      || (st.mode & 0o077) || st.size > MAX_FILE_BYTES) {
+      throw new Error('unsafe credential store (must be user-owned mode 0600, not a symlink)');
+    }
+    return normalizeCredentials(JSON.parse(fs.readFileSync(file, 'utf8')));
+  } catch (error) {
+    if (error.code === 'ENOENT') return {};
+    throw error;
+  }
+}
+
+function validateCredential(key, value) {
+  if (!validEnvKey(key)) throw new Error('invalid credential environment key');
+  if (typeof value !== 'string' || !value || Buffer.byteLength(value) > MAX_VALUE_BYTES
+    || /[\x00\r\n]/.test(value)) {
+    throw new Error('credential must be 1-16384 bytes without control line breaks');
+  }
+}
+
+function atomicWriteStore(file, credentials) {
+  const dir = path.dirname(file);
+  safePrivateDir(dir, { create: true });
+  try {
+    const existing = fs.lstatSync(file);
+    if (existing.isSymbolicLink() || !existing.isFile() || !ownedByCurrentUser(existing)
+      || (existing.mode & 0o077)) throw new Error('unsafe existing credential store');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  const body = `${JSON.stringify({ schemaVersion: SCHEMA_VERSION, credentials }, null, 2)}\n`;
+  if (Buffer.byteLength(body) > MAX_FILE_BYTES) throw new Error('credential store is too large');
+  const tmp = path.join(dir, `.credentials.${process.pid}.${crypto.randomBytes(8).toString('hex')}.tmp`);
+  let fd;
+  try {
+    fd = fs.openSync(tmp, 'wx', 0o600);
+    fs.writeFileSync(fd, body, 'utf8');
+    fs.fsyncSync(fd);
+    fs.closeSync(fd); fd = undefined;
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, file);
+    // Best effort directory fsync: supported on Linux/macOS, harmlessly
+    // skipped on filesystems that do not permit opening directories.
+    try {
+      const dfd = fs.openSync(dir, 'r');
+      try { fs.fsyncSync(dfd); } finally { fs.closeSync(dfd); }
+    } catch (_) {}
+  } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) {} }
+    try { fs.unlinkSync(tmp); } catch (_) {}
+  }
+}
+
+function setCredential(cfg, key, value, home = cfg.home || os.homedir()) {
+  validateCredential(key, value);
+  safePrivateDir(path.dirname(credentialsPath(cfg, home)), { create: true });
+  const current = readCredentialStore(cfg, home);
+  atomicWriteStore(credentialsPath(cfg, home), { ...current, [key]: value });
+}
+
+function removeCredential(cfg, key, home = cfg.home || os.homedir()) {
+  if (!validEnvKey(key)) throw new Error('invalid credential environment key');
+  safePrivateDir(path.dirname(credentialsPath(cfg, home)), { create: true });
+  const current = readCredentialStore(cfg, home);
+  if (!Object.prototype.hasOwnProperty.call(current, key)) return false;
+  delete current[key];
+  atomicWriteStore(credentialsPath(cfg, home), current);
+  return true;
+}
+
+module.exports = {
+  SCHEMA_VERSION, MAX_FILE_BYTES, MAX_VALUE_BYTES,
+  credentialsPath, readCredentialStore, setCredential, removeCredential,
+  safePrivateDir, validateCredential,
+};

package/lib/fleet/env-key.js

@@ -0,0 +1,12 @@
+'use strict';
+
+// Shared by managed providers, the local credential store and the HTTP API.
+// Mixed-case names are valid POSIX environment keys and are intentionally
+// preserved for custom providers.
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+
+function validEnvKey(value) {
+  return typeof value === 'string' && ENV_KEY_RE.test(value);
+}
+
+module.exports = { ENV_KEY_RE, validEnvKey };