@mmmbuto/nexuscrew 0.8.14 → 0.8.16

package/README.md

@@ -16,7 +16,7 @@ panes, windows. tmux does the work; the browser is just a faithful client.
 
 ---
 
-## What it is (v0.8.14 "Private Launch")
+## What it is (v0.8.16 "Honest Tunnel")
 
 - Runs a small server on the host where your tmux sessions live.
 - Each attach spawns a real PTY running `tmux attach` and bridges its bytes over a WebSocket
@@ -38,6 +38,8 @@ panes, windows. tmux does the work; the browser is just a faithful client.
   reloading terminals or losing a pending layout save. Use `↗` only when you want to detach a
   deck into another browser window or monitor. Every Local or remote owner group ends with its
   own compact `+ new`, so the creation destination is explicit and never falls back elsewhere.
+  A dedicated handle reorders owner-qualified deck tabs with mouse, touch, pen, or keyboard;
+  the order autosaves locally and survives polling, reloads, rename, and deletion.
 - **Federated Hydra inventory**: connect existing NexusCrew installations through the SSH
   configuration you already control and see local, direct, and relayed tmux fleets in one UI.
   Route labels show where every session lives; creation, attach, files, lifecycle and Fleet
@@ -46,7 +48,14 @@ panes, windows. tmux does the work; the browser is just a faithful client.
   link tests SSH, exchanges the one-time invitation, confirms both directions and verifies
   the peer automatically; failures identify the exact connection stage. A device already
   connected to a hub creates invitations through that hub; a standalone hub asks only for
-  the SSH address by which the receiving device can reach it.
+  the SSH address by which the receiving device can reach it. Readiness uses a real bounded
+  deadline and a live TCP-forward probe instead of treating a merely running `ssh` process as
+  connected. When a portable address cannot select this device's key, the failure opens the
+  local fields so it can be replaced with the same SSH alias that works in the terminal.
+  Per-tunnel logs contain safe supervisor lifecycle markers and actionable SSH errors, never
+  synthetic argv dumps, key contents, tokens, or credentials. OpenSSH may name the failed
+  target in this owner-only 0600 diagnostic. Startup and lifecycle commands also recover
+  verified orphan supervisors left by removed nodes or interrupted older runtimes.
 - **Settings and wizard**: manage roles, nodes, token rotation, and service regeneration
   from the UI; the first-run wizard uses the same pairing flow as Settings.
 - **Cell lifecycle from the UI**: the primary `+` creates a managed Fleet cell at Local or
@@ -230,12 +239,16 @@ flow stays entirely in the PWA:
 2. On the other device, open its own NexusCrew PWA (`nexuscrew show`), go to
    **Settings → Nodes**, and use the first card, **Connect with one link**. Paste the complete
    link in the prominent field or scan the QR. Do not navigate to the loopback address in the
-   link: it is only a portable container for the pairing payload.
+   link: it is only a portable container for the pairing payload. The embedded host is a
+   portable suggestion, not an SSH identity. If `ssh my-relay` works on this device but the raw
+   address does not select the same key, open **Advanced / edit** and enter `my-relay`; aliases,
+   agents and private keys always stay on this device.
 3. A complete v2 link connects automatically. NexusCrew starts a provisional SSH forward,
-   checks transport readiness, consumes the one-time invite once, negotiates the reciprocal
-   path, confirms it, and verifies authenticated federation health and peer identity. If a
-   stage fails, the PWA preserves the link and shows the exact stage, detail and safe retry
-   guidance. Older v1 links remain accepted and open only the missing routing fields.
+   proves the local TCP forward rather than only the supervisor PID, consumes the one-time
+   invite once, negotiates the reciprocal path, confirms it, and verifies authenticated
+   federation health and peer identity. If SSH authentication or routing fails, the PWA
+   preserves the link, opens the editable local SSH fields and shows the exact stage, detail
+   and safe retry guidance. Older v1 links remain accepted and open only the missing fields.
 
 The link never contains an SSH key, identity file, API key or PWA token. Its only credential is
 the random, one-time pairing invite; SSH routing fields are non-secret configuration. A
@@ -257,7 +270,11 @@ NexusCrew does not create SSH keys or edit `authorized_keys`. OpenSSH remains au
 identity files, agents, host keys, ports, ProxyJump and forwarding policy. NexusCrew uses
 one built-in retry supervisor around `ssh`; it never nests `autossh`. `nexuscrew doctor` reports
 whether both binaries are installed and states that OpenSSH is the transport actually used.
-Missing `ssh` is a blocking error; `autossh` is optional. Configured links return at boot.
+Missing `ssh` is a blocking error; `autossh` is optional. A 15-second OpenSSH connect timeout
+bounds unreachable endpoints, while readiness is advertised only after the configured local
+forward accepts TCP. On startup, stop and restart, NexusCrew reconciles strict, verified tunnel
+pidfiles against the node store so a removed node cannot leave a hidden retry supervisor.
+Configured links return at boot.
 Pair credentials are random, per-peer and scoped only to the federated session/file surface—the
 PWA token never crosses a peer link.
 
@@ -457,9 +474,8 @@ node bin/nexuscrew.js serve
 
 ## Status
 
-The current release candidate is **v0.8.14**. npm **`latest`** is promoted from the verified
-artifact first; the GitHub tag and release follow the operator field test from the same source
-candidate.
+The current stable release is **v0.8.16**. npm **`latest`**, the GitHub tag and the release use
+the same audited package artifact.
 
 ## License