@mmmbuto/nexuscrew 0.8.13 → 0.8.15

package/lib/fleet/launch-broker.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const fs = require('node:fs');
+const net = require('node:net');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const MAX_PAYLOAD = 512 * 1024;
+const REQUEST_LIMIT = 256;
+
+function runtimeDir(cfg = {}) {
+  const home = cfg.home || os.homedir();
+  return cfg.launchRuntimeDir || path.join(home, '.nexuscrew', 'run');
+}
+
+function ensureRuntimeDir(dir) {
+  const parent = path.dirname(dir);
+  try {
+    const parentSt = fs.lstatSync(parent);
+    const owned = typeof process.getuid !== 'function' || parentSt.uid === process.getuid();
+    if (!parentSt.isSymbolicLink() && parentSt.isDirectory() && owned && (parentSt.mode & 0o077)) {
+      fs.chmodSync(parent, 0o700);
+    }
+    const checked = fs.lstatSync(parent);
+    if (checked.isSymbolicLink() || !checked.isDirectory()
+      || (typeof process.getuid === 'function' && checked.uid !== process.getuid()) || (checked.mode & 0o077)) {
+      throw new Error('unsafe launch broker parent directory');
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    const grand = fs.lstatSync(path.dirname(parent));
+    if (grand.isSymbolicLink() || !grand.isDirectory()
+      || (typeof process.getuid === 'function' && grand.uid !== process.getuid()) || (grand.mode & 0o022)) {
+      throw new Error('unsafe launch broker parent root');
+    }
+    fs.mkdirSync(parent, { mode: 0o700 });
+  }
+  try {
+    const st = fs.lstatSync(dir);
+    if (st.isSymbolicLink() || !st.isDirectory()
+      || (typeof process.getuid === 'function' && st.uid !== process.getuid()) || (st.mode & 0o077)) {
+      throw new Error('unsafe launch broker directory');
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    fs.mkdirSync(dir, { mode: 0o700 });
+  }
+}
+
+function encodePayload(payload) {
+  const body = Buffer.from(JSON.stringify(payload), 'utf8');
+  if (!body.length || body.length > MAX_PAYLOAD) throw new Error('launch payload too large');
+  const head = Buffer.allocUnsafe(4); head.writeUInt32BE(body.length, 0);
+  return Buffer.concat([head, body]);
+}
+
+function createLaunchBroker(cfg = {}) {
+  const dir = runtimeDir(cfg);
+  let server = null;
+  let socketPath = '';
+  let starting = null;
+  let closed = false;
+  const pending = new Map();
+  const ttlMs = Math.max(1000, Number(cfg.launchTokenTtlMs) || 15000);
+
+  function expire(nonce) {
+    const entry = pending.get(nonce);
+    if (!entry) return;
+    pending.delete(nonce);
+    clearTimeout(entry.timer);
+  }
+
+  async function start() {
+    if (closed) throw new Error('launch broker closed');
+    if (server) return socketPath;
+    if (starting) return starting;
+    starting = new Promise((resolve, reject) => {
+      try {
+        ensureRuntimeDir(dir);
+        socketPath = path.join(dir, `launch-${process.pid}-${crypto.randomBytes(5).toString('hex')}.sock`);
+      } catch (error) { reject(error); return; }
+      server = net.createServer((socket) => {
+        let raw = '';
+        socket.setEncoding('utf8');
+        socket.setTimeout(3000, () => socket.destroy());
+        socket.on('data', (chunk) => {
+          raw += chunk;
+          if (raw.length > REQUEST_LIMIT) return socket.destroy();
+          const nl = raw.indexOf('\n');
+          if (nl === -1) return;
+          let nonce = '';
+          try { nonce = JSON.parse(raw.slice(0, nl)).nonce; } catch (_) {}
+          if (typeof nonce !== 'string' || !/^[a-f0-9]{64}$/.test(nonce)) return socket.destroy();
+          const entry = pending.get(nonce);
+          if (!entry || entry.expires < Date.now()) { expire(nonce); return socket.destroy(); }
+          // Single-use before any bytes leave this process. A second client can
+          // never claim the same payload, even while the first socket drains.
+          pending.delete(nonce); clearTimeout(entry.timer);
+          try { socket.end(entry.encoded); } catch (_) { socket.destroy(); }
+        });
+      });
+      server.once('error', (error) => {
+        if (!server?.listening) { server = null; starting = null; reject(error); }
+      });
+      server.listen(socketPath, () => {
+        try { fs.chmodSync(socketPath, 0o600); } catch (_) {}
+        server.unref(); starting = null; resolve(socketPath);
+      });
+    });
+    return starting;
+  }
+
+  async function issue(payload) {
+    const target = await start();
+    const nonce = crypto.randomBytes(32).toString('hex');
+    const entry = { encoded: encodePayload(payload), expires: Date.now() + ttlMs, timer: null };
+    entry.timer = setTimeout(() => expire(nonce), ttlMs);
+    entry.timer.unref?.();
+    pending.set(nonce, entry);
+    return { socketPath: target, nonce };
+  }
+
+  async function close() {
+    if (closed) return;
+    closed = true;
+    for (const [nonce] of pending) expire(nonce);
+    const active = server; server = null;
+    if (active) await new Promise((resolve) => active.close(() => resolve()));
+    try { if (socketPath) fs.unlinkSync(socketPath); } catch (_) {}
+  }
+
+  return { issue, close, pendingCount: () => pending.size };
+}
+
+module.exports = { createLaunchBroker, runtimeDir, ensureRuntimeDir, encodePayload, MAX_PAYLOAD };

package/lib/fleet/managed.js

@@ -6,6 +6,8 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { execFile } = require('node:child_process');
+const { ENV_KEY_RE } = require('./env-key.js');
+const { readCredentialStore } = require('./credentials.js');
 
 const OLLAMA_CLOUD_MODELS = Object.freeze([
   'glm-5.2', 'kimi-k2.7-code', 'deepseek-v4-pro', 'minimax-m3',
@@ -20,7 +22,6 @@ const OLLAMA_CONTEXT = Object.freeze({
 const CUSTOM_KEYS = ['displayName', 'protocol', 'baseUrl', 'envKey', 'providerId'];
 const MANAGED_KEYS = new Set(['client', 'provider', 'credentialProfile', 'model', 'permissionPolicy', ...CUSTOM_KEYS]);
 const CLIENT_LABELS = Object.freeze({ claude: 'Claude Code', codex: 'Codex', 'codex-vl': 'Codex-VL', pi: 'Pi' });
-const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
 const PROVIDER_ID_RE = /^[a-z][a-z0-9_-]{0,31}$/;
 
 function validBaseUrl(value) {
@@ -149,17 +150,44 @@ function parseAssignments(raw) {
     if ((v.startsWith("'") && v.endsWith("'")) || (v.startsWith('"') && v.endsWith('"'))) v = v.slice(1, -1);
     // This is a data parser, not a shell. Reject syntax that would have a
     // different meaning if sourced instead of treating it as a credential.
-    if (/\$\(|`|\x00|\r|\n/.test(v)) continue;
+    if (/\$\(|`|\x00|\r|\n|\$(?:\{[A-Za-z_][A-Za-z0-9_]*\}|[A-Za-z_][A-Za-z0-9_]*)/.test(v)) continue;
     out[m[1]] = v;
   }
   return out;
 }
 
-function parseEnvFile(file) {
+function insideRoot(root, target) {
+  const relative = path.relative(root, target);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function safeAllowedRoots(roots = []) {
+  const out = [];
+  for (const root of roots) {
+    try {
+      const st = fs.lstatSync(root);
+      if (st.isSymbolicLink() || !st.isDirectory() || (st.mode & 0o022)) continue;
+      if (typeof process.getuid === 'function' && st.uid !== process.getuid()) continue;
+      out.push(fs.realpathSync(root));
+    } catch (_) {}
+  }
+  return out;
+}
+
+function parseEnvFile(file, opts = {}) {
   try {
-    const st = fs.lstatSync(file);
+    const lst = fs.lstatSync(file);
+    let target = file;
+    if (lst.isSymbolicLink()) {
+      const roots = safeAllowedRoots(opts.allowSymlinkRoots);
+      if (!roots.length) return {};
+      target = fs.realpathSync(file);
+      if (!roots.some((root) => insideRoot(root, target))) return {};
+    }
+    const st = fs.lstatSync(target);
     if (!st.isFile() || st.isSymbolicLink() || (st.mode & 0o077) || st.size > 256 * 1024) return {};
-    return parseAssignments(fs.readFileSync(file, 'utf8'));
+    if (typeof process.getuid === 'function' && st.uid !== process.getuid()) return {};
+    return parseAssignments(fs.readFileSync(target, 'utf8'));
   } catch (_) { return {}; }
 }
 
@@ -222,24 +250,54 @@ function shellProvidersPath(cfg, home) {
     || path.join(home, '.config', 'ai-shell', 'providers.zsh');
 }
 
+function providerKeyPaths(cfg, home) {
+  const paths = [
+    cfg.providerKeysPath || process.env.NEXUSCREW_PROVIDER_KEYS
+      || path.join(home, '.config', 'keys', 'ai.env'),
+    cfg.providerSecurePath || process.env.NEXUSCREW_PROVIDER_SECURE
+      || path.join(home, '.config', 'secure', '.env'),
+  ];
+  return [...new Set(paths.filter((file) => typeof file === 'string' && file))];
+}
+
+function parseProviderKeyFiles(cfg, home) {
+  const values = {};
+  // Match providers.zsh ordering: a later secure file may intentionally
+  // override the canonical ai.env value. Files remain data-only and must be
+  // private regular files owned by the NexusCrew user.
+  const files = providerKeyPaths(cfg, home);
+  const roots = [...new Set(files.map((file) => path.dirname(path.resolve(file))))];
+  for (const file of files) Object.assign(values, parseEnvFile(file, { allowSymlinkRoots: roots }));
+  return values;
+}
+
 function credentialSources(cfg, home) {
+  let local = {};
+  try { local = readCredentialStore(cfg, home); } catch (_) { /* unsafe/corrupt store is ignored, never trusted */ }
   return {
     runtime: cfg.env || process.env,
+    local,
     shell: parseProviderShellFile(shellProvidersPath(cfg, home)),
+    keys: parseProviderKeyFiles(cfg, home),
     legacy: parseEnvFile(secretsPath(cfg, home)),
   };
 }
 
 function credential(profile, spec, cfg, home) {
-  if (profile.auth === 'login' || profile.auth === 'none') return { envKey: profile.auth, value: '' };
+  if (profile.auth === 'login' || profile.auth === 'none') return { envKey: profile.auth, value: '', source: profile.auth };
   const envKey = profile.auth === 'dynamic' ? spec.envKey : profile.auth;
   const sources = credentialSources(cfg, home);
   // The fixed shell file is already the user's environment source. Values are
   // consumed only in memory and passed to the selected child; never persisted
   // in fleet.json, service files, API responses or logs.
-  let value = sources.runtime[envKey] || sources.shell[envKey] || '';
-  if (!value && profile.legacySecrets) value = sources.legacy[envKey] || '';
-  return { envKey, value };
+  if (sources.runtime[envKey]) return { envKey, value: sources.runtime[envKey], source: 'environment' };
+  if (sources.local[envKey]) return { envKey, value: sources.local[envKey], source: 'local' };
+  if (sources.shell[envKey]) return { envKey, value: sources.shell[envKey], source: 'compatibility' };
+  if (sources.keys[envKey]) return { envKey, value: sources.keys[envKey], source: 'compatibility' };
+  if (profile.legacySecrets && sources.legacy[envKey]) {
+    return { envKey, value: sources.legacy[envKey], source: 'compatibility' };
+  }
+  return { envKey, value: '', source: 'missing' };
 }
 
 let ollamaCache = { at: 0, models: [] };
@@ -252,7 +310,8 @@ async function discoverOllamaModels(opts = {}) {
     const home = opts.home || require('node:os').homedir();
     const sources = credentialSources(opts, home);
     const apiKey = opts.apiKey || sources.runtime.OLLAMA_API_KEY
-      || sources.shell.OLLAMA_API_KEY || sources.legacy.OLLAMA_API_KEY;
+      || sources.local.OLLAMA_API_KEY || sources.shell.OLLAMA_API_KEY || sources.keys.OLLAMA_API_KEY
+      || sources.legacy.OLLAMA_API_KEY;
     if (!apiKey) throw new Error('OLLAMA_API_KEY missing');
     const response = await fetchImpl('https://ollama.com/api/tags', { headers: { authorization: `Bearer ${apiKey}` }, signal: AbortSignal.timeout?.(2500) });
     if (!response.ok) throw new Error(`HTTP ${response.status}`);
@@ -320,9 +379,12 @@ function describeManaged(spec, cfg = {}) {
     credentialProfile: normalized.credentialProfile || '', model: normalized.model,
     permissionPolicy: normalized.permissionPolicy, protocol: normalized.protocol || profile.protocol,
     endpoint: normalized.baseUrl || profile.endpoint || '', auth: cred.envKey, authConfigured,
+    credentialSource: authConfigured ? cred.source : 'missing',
     configured: !!binary && authConfigured, models: [...(profile.models || [])], defaultModel: profile.model || '',
     binary: binary || '', displayName: normalized.displayName || profile.label,
-    reason: !binary ? `client ${profile.client} not found` : (!authConfigured ? `environment variable ${cred.envKey} missing` : 'ready'),
+    reason: !binary ? `client ${profile.client} not found` : (!authConfigured
+      ? `credential ${cred.envKey} missing — set it on this device`
+      : 'ready'),
   };
 }
 
@@ -469,4 +531,5 @@ module.exports = {
   CATALOG, OLLAMA_CLOUD_MODELS, OLLAMA_CONTEXT, CLIENT_LABELS, normalizeManagedSpec,
   defaultDefinitions, describeManaged, discoverOllamaModels, resolveManagedEngine, needsExplicitNode,
   discoverPiModels, parseEnvFile, parseProviderShellFile, findBinary, publicCatalog, writePiProviderExtension,
+  providerKeyPaths, parseProviderKeyFiles, credentialSources, credential, ENV_KEY_RE,
 };

package/lib/fleet/routes.js

@@ -106,6 +106,16 @@ function fleetRoutes(fleetP, cfg = {}) {
   // Ogni route negozia la capability del provider: mancante → 501 (§9c).
   r.get('/schema', guard((f) => { requireCap(f, 'schema'); return f.schema(); }));
   r.get('/definitions', guard((f) => { requireCap(f, 'definitions'); return f.definitions(); }));
+  r.get('/credentials/status', guard((f) => {
+    requireCap(f, 'credentials'); return f.credentialStatus();
+  }));
+  r.post('/credentials/set', guard((f, b) => {
+    requireCap(f, 'credentials');
+    return f.setLocalCredential(String(b.envKey || ''), typeof b.value === 'string' ? b.value : '');
+  }, { mutate: true }));
+  r.post('/credentials/remove', guard((f, b) => {
+    requireCap(f, 'credentials'); return f.removeLocalCredential(String(b.envKey || ''));
+  }, { mutate: true }));
   r.post('/define-engine', guard((f, b) => { requireCap(f, 'define'); return f.defineEngine(b.def); }, { mutate: true }));
   r.post('/edit-engine', guard((f, b) => { requireCap(f, 'edit'); return f.editEngine(b.id, b.patch, b.envChanges); }, { mutate: true }));
   r.post('/remove-engine', guard((f, b) => { requireCap(f, 'remove'); return f.removeEngine(b.id); }, { mutate: true }));

package/lib/nodes/peering.js

@@ -198,21 +198,29 @@ function capabilityProbeMaterial(capability, randomBytes = crypto.randomBytes) {
 // restart negoziato. Oltre alla reachability verifica prova capability e
 // instanceId atteso. Bounded, con sleep/random iniettabili per test.
 async function probeTransportReady({
-  port, capability, expectedInstanceId, fetchImpl = fetch, attempts = 6,
-  timeoutMs = 1500, sleep, randomBytes,
+  port, capability, expectedInstanceId, fetchImpl = fetch, attempts = 16,
+  timeoutMs = 1500, deadlineMs = 20000, sleep, randomBytes, now = Date.now,
 } = {}) {
   const wait = typeof sleep === 'function' ? sleep : (ms) => new Promise((r) => setTimeout(r, ms));
   const material = capabilityProbeMaterial(capability, randomBytes);
   if (!store.isPort(port) || !material || !store.NODE_ID_RE.test(String(expectedInstanceId || ''))) {
     return { ready: false, attempts: 0, code: 'identity-probe-invalid', lastError: 'parametri identity probe non validi' };
   }
+  const maxAttempts = Number.isInteger(attempts) && attempts > 0 ? Math.min(attempts, 32) : 16;
+  const boundedDeadlineMs = Number.isFinite(deadlineMs) && deadlineMs > 0
+    ? Math.min(Math.floor(deadlineMs), 60000) : 20000;
+  const startedAt = now();
+  const deadlineAt = startedAt + boundedDeadlineMs;
   let lastError = '';
   let code = 'transport-not-ready';
-  for (let i = 0; i < attempts; i += 1) {
+  let attempted = 0;
+  for (let i = 0; i < maxAttempts && now() < deadlineAt; i += 1) {
+    attempted += 1;
     let timer;
     try {
       const ctrl = new AbortController();
-      timer = setTimeout(() => ctrl.abort(), timeoutMs);
+      const remainingMs = Math.max(1, deadlineAt - now());
+      timer = setTimeout(() => ctrl.abort(), Math.min(timeoutMs, remainingMs));
       const response = await fetchImpl(`http://127.0.0.1:${port}/pair/identity`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -238,15 +246,24 @@ async function probeTransportReady({
         code = 'identity-proof-invalid';
         throw new Error('prova crittografica del peer non valida');
       }
-      return { ready: true, attempts: i + 1, instanceId: body.instanceId };
+      return { ready: true, attempts: attempted, instanceId: body.instanceId, elapsedMs: Math.max(0, now() - startedAt) };
     } catch (e) {
       lastError = String((e && e.message) || e);
     } finally {
       if (timer) clearTimeout(timer);
     }
-    if (i < attempts - 1) await wait(250 * (i + 1));
+    if (i < maxAttempts - 1) {
+      const remainingMs = deadlineAt - now();
+      if (remainingMs <= 0) break;
+      // A refused loopback socket fails immediately.  The old six-probe loop
+      // therefore exhausted in only 3.75 s and could tear down a perfectly
+      // valid SSH session just as mobile/macOS/Linux key negotiation finished.
+      // Keep retrying against a real deadline, with a bounded progressive wait.
+      const retryDelayMs = Math.min(1500, 250 * (i + 1), remainingMs);
+      if (retryDelayMs > 0) await wait(retryDelayMs);
+    }
   }
-  return { ready: false, attempts, code, lastError };
+  return { ready: false, attempts: attempted, code, lastError, elapsedMs: Math.max(0, now() - startedAt) };
 }
 
 module.exports = {

package/lib/nodes/tunnel-supervisor.js

@@ -27,6 +27,10 @@ let upTimer = null;
 let ownershipWaitTimer = null;
 let ownershipTimer = null;
 
+function logEvent(message) {
+  try { process.stderr.write(`[nexuscrew] ${String(message).replace(/[\r\n]+/g, ' ')}\n`); } catch (_) {}
+}
+
 function ownsGeneration() {
   try {
     const meta = JSON.parse(fs.readFileSync(pidPath, 'utf8'));
@@ -53,6 +57,7 @@ function writeState(status, extra = {}) {
 function scheduleRetry(detail) {
   if (stopping) return finish();
   const delayMs = backoffDelay(attempt, { baseMs: 1000, capMs: 60000 });
+  logEvent(`ssh retry scheduled attempt=${attempt + 2} delayMs=${delayMs}`);
   if (!writeState('retrying', { delayMs, detail })) return stop();
   attempt += 1;
   retryTimer = setTimeout(run, delayMs);
@@ -61,6 +66,7 @@ function scheduleRetry(detail) {
 function run() {
   if (stopping) return finish();
   if (!writeState('starting')) return stop();
+  logEvent(`ssh attempt=${attempt + 1} starting`);
   try {
     child = spawn(sshBin, sshArgs, { stdio: 'inherit' });
   } catch (e) {
@@ -77,21 +83,25 @@ function run() {
     scheduleRetry(detail);
   };
   child.once('spawn', () => {
+    logEvent(`ssh attempt=${attempt + 1} spawned`);
     // ExitOnForwardFailure makes bind/auth failures exit. Do not reset backoff
     // or advertise readiness on the spawn event: only a stable transport window
     // qualifies as transport-ready; HTTP federation health is checked above us.
     upTimer = setTimeout(() => {
       if (!stopping && child && child.exitCode == null) {
         attempt = 0;
+        logEvent(`transport ready stableMs=${stableMs}`);
         if (!writeState('transport-ready', { sshPid: child.pid, stableMs })) stop();
       }
     }, stableMs);
   });
   child.once('error', (e) => {
+    logEvent(`ssh child error code=${(e && e.code) || 'unknown'}`);
     handleFailure(String(e && e.message || e));
   });
   child.once('exit', (code, signal) => {
     if (stopping) return finish();
+    logEvent(`ssh exited code=${code === null ? 'null' : code} signal=${signal || 'none'}`);
     handleFailure(`ssh exited code=${code} signal=${signal || ''}`);
   });
 }

package/lib/nodes/tunnel.js

@@ -28,6 +28,10 @@ const SSH_BASE_OPTS = Object.freeze([
   '-o', 'ServerAliveInterval=30',
   '-o', 'ServerAliveCountMax=3',
   '-o', 'BatchMode=yes',
+  // A Host stanza may set LogLevel=QUIET, leaving the per-tunnel diagnostic
+  // completely empty even for bind/auth/forward failures.  ERROR is still
+  // quiet on success and never logs key material, but preserves real failures.
+  '-o', 'LogLevel=ERROR',
 ]);
 
 function assertForwardSpec(node) {
@@ -406,6 +410,11 @@ function startTunnel(opts) {
     closeOwnedFd();
     return { started: false, reason: 'pidfile error', error: String(e && e.message || e) };
   }
+  // Safe local breadcrumb: argv, host, key paths and credentials are omitted.
+  // The detached supervisor appends lifecycle events to the same 0600 file.
+  if (Number.isInteger(logFd)) {
+    try { fs.writeSync(logFd, `[nexuscrew] supervisor requested transport=${path.basename(sshBin)}\n`); } catch (_) {}
+  }
   closeOwnedFd(); // copia del padre: il figlio ha la sua dup; nessun leak (audit F3)
   return { started: true, pid, logPath, transport: sshBin };
 }

package/lib/proxy/federation.js

@@ -51,7 +51,7 @@ function parseRoute(raw) {
 
 function knownResource(resource) {
   return resource === '/sessions'
-    || /^\/sessions\/[\w.@%:+-]{1,128}$/.test(resource)
+    || /^\/sessions\/[\w.@%:+-]{1,128}(?:\/visibility)?$/.test(resource)
     || resource === '/config'
     || resource === '/fs/dirs'
     || resource === '/files'
@@ -67,12 +67,13 @@ function knownResource(resource) {
     // Hydra: the rest of /settings stays unreachable.
     || resource === '/settings/peering/invite'
     || resource === '/ws'
-    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource);
+    || /^\/fleet\/(status|schema|definitions|credentials\/status|credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource);
 }
 
 function allowedResource(resource, method = 'GET') {
   if (resource === '/sessions') return method === 'GET' || method === 'POST';
   if (/^\/sessions\/[\w.@%:+-]{1,128}$/.test(resource)) return method === 'DELETE';
+  if (/^\/sessions\/[\w.@%:+-]{1,128}\/visibility$/.test(resource)) return method === 'PATCH';
   if (resource === '/config') return method === 'GET';
   if (resource === '/fs/dirs') return method === 'GET';
   if (resource === '/files') return method === 'GET' || method === 'DELETE';
@@ -87,8 +88,8 @@ function allowedResource(resource, method = 'GET') {
   if (resource === '/topology') return method === 'GET';
   if (resource === '/settings/peering/invite') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
-  if (/^\/fleet\/(status|schema|definitions)$/.test(resource)) return method === 'GET';
-  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource)) return method === 'POST';
+  if (/^\/fleet\/(status|schema|definitions|credentials\/status)$/.test(resource)) return method === 'GET';
+  if (/^\/fleet\/(credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource)) return method === 'POST';
   return false;
 }
 

package/lib/server.js

@@ -8,7 +8,7 @@ const express = require('express');
 const { WebSocketServer } = require('ws');
 const { defaults, loadConfig, assertLoopback, configJsonPath } = require('./config.js');
 const { writeConfigAtomic } = require('./cli/init.js');
-const { listSessions, attachedClients } = require('./tmux/list.js');
+const { listSessions, attachedClients, setSessionVisibility } = require('./tmux/list.js');
 const { runAction, pasteToSession, submitToSession } = require('./tmux/actions.js');
 const { createSession, killSession, isProtectedSession } = require('./tmux/lifecycle.js');
 const { createPreviewSampler } = require('./tmux/preview.js');
@@ -197,6 +197,17 @@ function createServer(opts = {}) {
       res.json({ killed: true });
     } catch (e) { res.status(e.status || 500).json({ error: String(e.message || e) }); }
   });
+  api.patch('/sessions/:name/visibility', express.json({ limit: '1kb' }), async (req, res) => {
+    if (proxyReadonly()) return res.status(403).json({ error: 'READONLY: classificazione sessione bloccata' });
+    const name = String(req.params.name || '');
+    try {
+      const fleet = await fleetP;
+      if (isProtectedSession(name, fleet.isCellSession)) {
+        return res.status(409).json({ error: 'sessione di cella: la visibilità tecnica vale solo per sessioni tmux non gestite' });
+      }
+      res.json(await setSessionVisibility(cfg.tmuxBin, name, req.body?.technical === true));
+    } catch (e) { res.status(e.status || 500).json({ error: String(e.message || e) }); }
+  });
   api.get('/config', (_req, res) => res.json({
     readonlyDefault: cfg.readonlyDefault, version: VERSION, uiVersion: uiBuildVersion(distDir),
     bind: cfg.bind, port: cfg.port,
@@ -405,6 +416,10 @@ function createServer(opts = {}) {
     }
   });
 
+  server.on('close', () => {
+    fleetP.then((fleet) => (typeof fleet.close === 'function' ? fleet.close() : null)).catch(() => {});
+  });
+
   return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater };
 }
 

package/lib/tmux/list.js

@@ -1,14 +1,14 @@
 'use strict';
 const { execFile, execFileSync } = require('node:child_process');
 
-const FMT = "#{session_name}\t#{session_attached}\t#{session_windows}\t#{session_created}\t#{session_activity}\t#{pane_current_command}";
+const FMT = "#{session_name}\t#{session_attached}\t#{session_windows}\t#{session_created}\t#{session_activity}\t#{pane_current_command}\t#{@nexuscrew_visibility}";
 
 function parseSessions(raw) {
   return String(raw)
     .split('\n')
     .filter((l) => l.trim() !== '')
     .map((line) => {
-      const [name, attached, windows, created, activity, cmd] = line.split('\t');
+      const [name, attached, windows, created, activity, cmd, visibility] = line.split('\t');
       return {
         name,
         attached: attached === '1',
@@ -16,11 +16,29 @@ function parseSessions(raw) {
         created: Number(created),
         activity: Number(activity) || 0,
         cmd: cmd || '',
+        technical: visibility === 'technical',
       };
     })
     .filter((session) => session.windows > 0);
 }
 
+function setSessionVisibility(tmuxBin = 'tmux', name, technical = false) {
+  return new Promise((resolve, reject) => {
+    if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name) || name.startsWith('-')) {
+      const error = new Error('nome sessione non valido'); error.status = 400; reject(error); return;
+    }
+    const args = technical
+      ? ['set-option', '-t', `=${name}`, '@nexuscrew_visibility', 'technical']
+      : ['set-option', '-u', '-t', `=${name}`, '@nexuscrew_visibility'];
+    execFile(tmuxBin, args, (err, _stdout, stderr) => {
+      if (!err) { resolve({ name, technical: !!technical }); return; }
+      const error = new Error(`tmux set-option failed: ${String(stderr || err.message).trim()}`);
+      error.status = /can't find session|no server running/i.test(stderr || '') ? 404 : 500;
+      reject(error);
+    });
+  });
+}
+
 function listSessions(tmuxBin = 'tmux') {
   return new Promise((resolve, reject) => {
     execFile(tmuxBin, ['list-sessions', '-F', FMT], (err, stdout, stderr) => {
@@ -46,4 +64,4 @@ function attachedClients(tmuxBin = 'tmux', session) {
   } catch (_) { return 0; }
 }
 
-module.exports = { parseSessions, listSessions, attachedClients, FMT };
+module.exports = { parseSessions, listSessions, attachedClients, setSessionVisibility, FMT };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {