@mmmbuto/nexuscrew 0.8.21 → 0.8.23

package/lib/config.js

@@ -19,6 +19,9 @@ function baseDefaults() {
     port: 41820,
     tokenPath: path.join(os.homedir(), '.nexuscrew', 'token'),
     tmuxBin: 'tmux',
+    // Shared-server safety is operational hardening, not a same-UID security
+    // boundary. Disable only when the operator deliberately owns tmux policy.
+    protectSharedTmuxServer: true,
     readonlyDefault: false,
     // Etichetta neutra usata nel prefisso delle risposte ask incollate in TUI.
     replyLabel: 'human',
@@ -28,7 +31,6 @@ function baseDefaults() {
     voiceToken: '',
     voiceTokenFile: null,
     fleetEnabled: true,
-    fleetBin: path.join(os.homedir(), '.local', 'bin', 'fleet'),
     providerSecretsPath: path.join(os.homedir(), '.nexuscrew', 'providers.env'),
     // Existing user-owned shell exports. NexusCrew parses simple assignments
     // as data; it never executes/sources this file and never copies values.
@@ -66,6 +68,10 @@ function envOverrides() {
   if (process.env.NEXUSCREW_PORT) e.port = Number(process.env.NEXUSCREW_PORT);
   if (process.env.NEXUSCREW_TOKEN_FILE) e.tokenPath = process.env.NEXUSCREW_TOKEN_FILE;
   if (process.env.NEXUSCREW_TMUX) e.tmuxBin = process.env.NEXUSCREW_TMUX;
+  if (process.env.NEXUSCREW_PROTECT_SHARED_TMUX_SERVER !== undefined) {
+    e.protectSharedTmuxServer = !['', '0', 'false', 'no', 'off']
+      .includes(String(process.env.NEXUSCREW_PROTECT_SHARED_TMUX_SERVER).toLowerCase());
+  }
   if (process.env.NEXUSCREW_READONLY) e.readonlyDefault = process.env.NEXUSCREW_READONLY === '1';
   if (process.env.NEXUSCREW_REPLY_LABEL) e.replyLabel = process.env.NEXUSCREW_REPLY_LABEL;
   if (process.env.NEXUSCREW_FILES_ROOT) e.filesRoot = process.env.NEXUSCREW_FILES_ROOT;
@@ -74,7 +80,6 @@ function envOverrides() {
   if (process.env.NEXUSCREW_VOICE_TOKEN) e.voiceToken = process.env.NEXUSCREW_VOICE_TOKEN;
   if (process.env.NEXUSCREW_VOICE_TOKEN_FILE) e.voiceTokenFile = process.env.NEXUSCREW_VOICE_TOKEN_FILE;
   if (process.env.NEXUSCREW_FLEET) e.fleetEnabled = process.env.NEXUSCREW_FLEET !== '0';
-  if (process.env.NEXUSCREW_FLEET_BIN) e.fleetBin = process.env.NEXUSCREW_FLEET_BIN;
   if (process.env.NEXUSCREW_PROVIDER_SECRETS) e.providerSecretsPath = process.env.NEXUSCREW_PROVIDER_SECRETS;
   if (process.env.NEXUSCREW_PROVIDER_SHELL) e.providerShellPath = process.env.NEXUSCREW_PROVIDER_SHELL;
   if (process.env.NEXUSCREW_PROVIDER_KEYS) e.providerKeysPath = process.env.NEXUSCREW_PROVIDER_KEYS;

package/lib/fleet/builtin.js

@@ -1,8 +1,7 @@
 'use strict';
-// B4.2 — Fleet built-in. FACADE: implementa lo STESSO contratto di
-// lib/fleet/index.js (createFleet: available / status / up / down / engine /
-// boot / isCellSession) leggendo le definizioni da ~/.nexuscrew/fleet.json
-// tramite lib/fleet/definitions.js, e lo ESTENDE con define*/edit*/remove* +
+// Fleet built-in. FACADE: espone available/status/up/down/engine/boot e
+// isCellSession leggendo le definizioni da ~/.nexuscrew/fleet.json tramite
+// lib/fleet/definitions.js, insieme a define*/edit*/remove* +
 // schema + capabilities (design §4b/§9c).
 //
 // La responsabilita' runtime/launch (status/up/down/restart + launch/readiness
@@ -39,6 +38,7 @@ const { validEnvKey } = require('./env-key.js');
 const { setCredential, removeCredential } = require('./credentials.js');
 const { createLaunchBroker } = require('./launch-broker.js');
 const { MINIMAL_ENV_KEYS } = require('../runtime/env.js');
+const { requireSharedTmuxProtection } = require('../tmux/shared-server.js');
 
 // Toolkit stateless + runtime estratti (behavior-preserving). I simboli di
 // launch.js sono re-esportati in module.exports per i test che li importano
@@ -94,7 +94,7 @@ function applyCellTransition(target, engineId, { model, hasModel, policy, hasPol
 }
 
 // ---------------------------------------------------------------------------
-// createBuiltinFleet(cfg) — async per parita' di contratto con createFleet.
+// createBuiltinFleet(cfg) — unica implementazione Fleet di NexusCrew.
 // cfg: { fleetDefsPath?, tmuxBin?, home?, builtinEnabled?, readonlyDefault?,
 //        sendKeysReadyMs?, fleetProviderReason?, launchBroker?, launchReadyMs? }
 // ---------------------------------------------------------------------------
@@ -115,12 +115,23 @@ async function createBuiltinFleet(cfg = {}) {
   const boot = loadDefinitions(defsPath);
   if (!boot) return off;
 
+  // Adopt or create the shared server before exposing a mutable Fleet. Reapply
+  // before every lifecycle mutation so an accidental config reload cannot
+  // silently leave NexusCrew operations unguarded.
+  const ensureProtection = typeof cfg.ensureTmuxProtection === 'function'
+    ? cfg.ensureTmuxProtection
+    : () => requireSharedTmuxProtection(tmuxBin, {
+      enabled: cfg.protectSharedTmuxServer !== false,
+      home,
+    });
+  await ensureProtection();
+
   // Runtime estratto (lib/fleet/runtime.js): possiede cache + definizioni e
   // espone status/up/down/restart/isCellSession + gli accessor allo store
   // (reloadDefs/findCell/findEngine/refreshSessions/commitDefs) che il CRUD
   // qui sotto riusa. status/up/down/restart sono INVARIATI.
   const rt = createBuiltinRuntime({
-    cfg, home, defsPath, tmuxBin, readonly, launchBroker, boot,
+    cfg, home, defsPath, tmuxBin, readonly, launchBroker, boot, ensureProtection,
   });
   const {
     status, up, down, restart, isCellSession,

package/lib/fleet/cell-exec.js

@@ -1,13 +1,23 @@
 #!/usr/bin/env node
 'use strict';
 
-// Tiny launch helper. It receives only a local socket path and a random,
-// single-use nonce in argv. Provider values arrive over the private Unix
-// socket, stay in memory and are passed directly to the child process.
+// Private per-cell launcher and supervisor.  tmux sees only this helper plus a
+// single-use broker ticket; the real command, provider environment and restart
+// policy arrive in memory over the local 0600 Unix socket.
 const net = require('node:net');
 const { spawn } = require('node:child_process');
 const { MAX_PAYLOAD } = require('./launch-broker.js');
 
+const DEFAULT_SUPERVISE = Object.freeze({
+  enabled: true,
+  initialReadyMs: 500,
+  restartDelayMs: 1000,
+  maxRestartDelayMs: 60000,
+  resetAfterMs: 30000,
+  rapidWindowMs: 60000,
+  maxRapidRestarts: 8,
+});
+
 function parseArgs(argv) {
   const out = {};
   for (let i = 0; i < argv.length; i += 2) {
@@ -20,12 +30,57 @@ function parseArgs(argv) {
   return out;
 }
 
+function validInteger(value, min, max) {
+  return Number.isInteger(value) && value >= min && value <= max;
+}
+
+function validSupervise(value) {
+  if (value === undefined) return true;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const keys = new Set([
+    'enabled', 'initialReadyMs', 'restartDelayMs', 'maxRestartDelayMs',
+    'resetAfterMs', 'rapidWindowMs', 'maxRapidRestarts',
+  ]);
+  if (Object.keys(value).some((key) => !keys.has(key))) return false;
+  if (value.enabled !== undefined && typeof value.enabled !== 'boolean') return false;
+  const checks = [
+    ['initialReadyMs', 50, 30000], ['restartDelayMs', 50, 60000],
+    ['maxRestartDelayMs', 100, 300000], ['resetAfterMs', 1000, 3600000],
+    ['rapidWindowMs', 1000, 3600000], ['maxRapidRestarts', 1, 100],
+  ];
+  return checks.every(([key, min, max]) => value[key] === undefined || validInteger(value[key], min, max));
+}
+
+function promptCharsOk(prompt) {
+  if (typeof prompt !== 'string' || prompt.length > 131072) return false;
+  for (let i = 0; i < prompt.length; i += 1) {
+    const code = prompt.charCodeAt(i);
+    if (code === 9 || code === 10 || code === 13) continue;
+    if (code < 32 || code === 127) return false;
+  }
+  return true;
+}
+
+function validRestartPrompt(value) {
+  if (value === undefined) return true;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  if (Object.keys(value).some((key) => !['tmuxBin', 'tmuxSession', 'prompt', 'readyMs'].includes(key))) return false;
+  return typeof value.tmuxBin === 'string' && value.tmuxBin.length > 0 && value.tmuxBin.length <= 4096
+    && !/[\0\r\n]/.test(value.tmuxBin)
+    && typeof value.tmuxSession === 'string' && /^[\w.@%:+-]{1,128}$/.test(value.tmuxSession)
+    && promptCharsOk(value.prompt)
+    && (value.readyMs === undefined || validInteger(value.readyMs, 0, 30000));
+}
+
 function validPayload(payload) {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false;
+  if (Object.keys(payload).some((key) => !['command', 'args', 'env', 'supervise', 'restartPrompt'].includes(key))) return false;
   if (typeof payload.command !== 'string' || !payload.command || !Array.isArray(payload.args)) return false;
   if (!payload.env || typeof payload.env !== 'object' || Array.isArray(payload.env)) return false;
   return payload.args.every((v) => typeof v === 'string')
-    && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string');
+    && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string')
+    && validSupervise(payload.supervise)
+    && validRestartPrompt(payload.restartPrompt);
 }
 
 function receivePayload(socketPath, nonce, timeoutMs = 5000) {
@@ -57,19 +112,115 @@ function receivePayload(socketPath, nonce, timeoutMs = 5000) {
   });
 }
 
+function normalizeSupervise(value = {}) {
+  return { ...DEFAULT_SUPERVISE, ...(value || {}) };
+}
+
+function waitChild(child) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (code, signal, error = null) => {
+      if (settled) return; settled = true; resolve({ code: code == null ? 1 : code, signal, error });
+    };
+    child.once('error', (error) => finish(1, null, error));
+    child.once('exit', (code, signal) => finish(code, signal));
+  });
+}
+
+function scheduleRestartPrompt(config, childState, seams = {}) {
+  if (!config) return { cancel() {} };
+  let timer = null; let cancelled = false;
+  const setTimer = seams.setTimeout || setTimeout;
+  const clearTimer = seams.clearTimeout || clearTimeout;
+  timer = setTimer(async () => {
+    timer = null;
+    if (cancelled || childState.exited) return;
+    try {
+      const inject = seams.injectPrompt || require('./launch.js').injectPrompt;
+      await inject(config.tmuxBin, config.tmuxSession, config.prompt, {
+        target: process.env.TMUX_PANE || `=${config.tmuxSession}`,
+        readyMs: 0,
+      });
+    } catch (_) { /* keepalive must not die because prompt reinjection failed */ }
+  }, config.readyMs ?? 400);
+  timer.unref?.();
+  return { cancel() { cancelled = true; if (timer) clearTimer(timer); timer = null; } };
+}
+
 async function main(argv = process.argv.slice(2), seams = {}) {
   const parsed = parseArgs(argv);
   if (!parsed) throw new Error('usage: cell-exec --socket <path> --nonce <hex>');
   const payload = await (seams.receivePayload || receivePayload)(parsed.socketPath, parsed.nonce);
+  const supervise = normalizeSupervise(payload.supervise);
   const spawnImpl = seams.spawn || spawn;
-  const child = spawnImpl(payload.command, payload.args, { env: payload.env, stdio: 'inherit' });
+  const now = seams.now || Date.now;
+  const sleep = seams.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const proc = seams.process || process;
+  const writeError = seams.writeError || ((message) => process.stderr.write(message));
+  const childEnv = { ...payload.env };
+  // tmux injects these only after the broker ticket was created. Preserve them
+  // for the actual TUI and bind NexusCrew MCP callbacks to the owning session.
+  if (process.env.TMUX) childEnv.TMUX = process.env.TMUX;
+  if (process.env.TMUX_PANE) childEnv.TMUX_PANE = process.env.TMUX_PANE;
+
+  let current = null; let stopping = false;
+  const handlers = new Map();
   for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
-    process.once(signal, () => { try { child.kill(signal); } catch (_) {} });
+    const handler = () => {
+      stopping = true;
+      try { if (current) current.kill(signal); } catch (_) {}
+    };
+    handlers.set(signal, handler);
+    proc.once?.(signal, handler);
   }
-  return new Promise((resolve, reject) => {
-    child.once('error', reject);
-    child.once('exit', (code, signal) => resolve(signal ? 128 : (code == null ? 1 : code)));
-  });
+  const cleanup = () => {
+    for (const [signal, handler] of handlers) proc.off?.(signal, handler);
+  };
+
+  let generation = 0;
+  let delayMs = supervise.restartDelayMs;
+  let rapid = [];
+  try {
+    for (;;) {
+      if (stopping) return 0;
+      const startedAt = now();
+      current = spawnImpl(payload.command, payload.args, { env: childEnv, stdio: 'inherit' });
+      const childState = { exited: false };
+      const prompt = generation > 0 ? scheduleRestartPrompt(payload.restartPrompt, childState, seams) : null;
+      const result = await waitChild(current);
+      childState.exited = true;
+      prompt?.cancel();
+      current = null;
+      const runtimeMs = Math.max(0, now() - startedAt);
+      if (stopping) return 0;
+      if (!supervise.enabled) return result.signal ? 128 : result.code;
+
+      // Preserve the launch readiness contract: a first child that dies before
+      // the gate is a failed start, not a successfully supervised cell.
+      if (generation === 0 && runtimeMs < supervise.initialReadyMs) {
+        return result.signal ? 128 : (result.code || 1);
+      }
+
+      const stamp = now();
+      if (runtimeMs >= supervise.resetAfterMs) {
+        rapid = [];
+        delayMs = supervise.restartDelayMs;
+      } else {
+        rapid = rapid.filter((value) => stamp - value <= supervise.rapidWindowMs);
+        rapid.push(stamp);
+        if (rapid.length > supervise.maxRapidRestarts) {
+          writeError('nexuscrew cell supervisor stopped after repeated early exits\n');
+          return result.signal ? 128 : (result.code || 1);
+        }
+      }
+      await sleep(delayMs);
+      // A down/kill-session can reach the supervisor while it is waiting in
+      // backoff. Never start another client after that stop signal.
+      if (stopping) return 0;
+      delayMs = Math.min(supervise.maxRestartDelayMs, Math.max(supervise.restartDelayMs, delayMs * 2));
+      generation += 1;
+    }
+  } finally { cleanup(); }
 }
 
 if (require.main === module) {
@@ -78,4 +229,7 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, validPayload, receivePayload, main };
+module.exports = {
+  DEFAULT_SUPERVISE, parseArgs, validSupervise, validRestartPrompt, validPayload,
+  receivePayload, normalizeSupervise, waitChild, scheduleRestartPrompt, main,
+};

package/lib/fleet/definitions.js

@@ -306,7 +306,7 @@ function parseCell(c, engineIds) {
 // ---------------------------------------------------------------------------
 // validateCommandTrust(command) -> {ok, reason}
 // Path assoluto, regular file, owner-executable, NON symlink (lstat), NON
-// world-writable. Riutilizza il pattern di binTrusted in lib/fleet/index.js.
+// world-writable. Questa è la trust boundary dei comandi engine built-in.
 // ---------------------------------------------------------------------------
 function validateCommandTrust(command) {
   if (typeof command !== 'string' || !command) return { ok: false, reason: 'command vuoto' };

package/lib/fleet/provider.js

@@ -1,103 +1,23 @@
 'use strict';
-// B4.2 — Provider selection. Sceglie UNA volta, a startup, quale fleet governa il
-// runtime (design §4b/§9b/§9g). Ritorna { mode, reason, fleet }.
-//
-//   mode ∈ 'external' | 'builtin' | 'disabled'
-//
-// Regole (design §9g):
-//  - forced (cfg.fleetProvider | NEXUSCREW_FLEET_PROVIDER): onorato e FAIL-CLOSED
-//    se indisponibile. NIENTE auto-fallback silenzioso al built-in.
-//  - auto: 'external' vince solo se fidato (binTrusted, riusato da index.js) E
-//    risponde al contratto (createFleet → available). Altrimenti 'builtin' se
-//    abilitato e fleet.json valido. Altrimenti 'disabled'.
-//
-// Il drift a runtime NON si risolve qui: e' una scelta one-shot. Se l'external
-// diventa invalido DOPO lo startup, lo status risultante sara' degraded/unavailable
-// (mai fall-through silenzioso al built-in) — gestito dal layer di status.
-const { binTrusted, externalFleetCandidates, resolveExternalFleet } = require('./index.js');
+// NexusCrew is the single Fleet authority.  The legacy external `fleet` binary
+// is intentionally not discovered or executed: definitions, credentials,
+// lifecycle and boot ownership all live in the builtin provider.
 const { createBuiltinFleet } = require('./builtin.js');
 
 const DISABLED_FLEET = Object.freeze({
   available: false, provider: 'disabled', isCellSession: () => false, capabilities: () => [],
 });
 
-function failClosed(mode) {
-  return {
-    mode: 'disabled',
-    reason: `fail-closed: provider forzato "${mode}" non disponibile (nessun auto-fallback, §9g)`,
-    fleet: DISABLED_FLEET,
-  };
+function disabled(reason) {
+  return { mode: 'disabled', reason, fleet: { ...DISABLED_FLEET, reason } };
 }
 
-// Costruisce (una volta) i candidati e ne valuta la disponibilita'.
 async function selectProvider(cfg = {}) {
-  if (cfg.fleetEnabled === false) {
-    return { mode: 'disabled', reason: 'fleet disabilitato (fleetEnabled=false)', fleet: DISABLED_FLEET };
-  }
-
-  const forced = (cfg.fleetProvider || process.env.NEXUSCREW_FLEET_PROVIDER || '').toLowerCase() || null;
-
-  // External: scopre il binario fleet legacy cross-platform (cfg.fleetBin,
-  // $PREFIX/bin/fleet su Termux, ~/.local/bin/fleet) e accetta il primo fidato
-  // (binTrusted) che risponde al contratto (status --json con schema valido).
-  let extFleet = null;
-  let extReason = null;
-  const resolvedExternal = await resolveExternalFleet(cfg);
-  if (resolvedExternal) {
-    extFleet = resolvedExternal.fleet;
-    extReason = resolvedExternal.reason;
-  } else {
-    // Diagnosi: perché nessun candidato external è valido (fidato + contratto).
-    const cands = externalFleetCandidates(cfg);
-    if (!cands.length) extReason = 'nessun fleetBin esterno configurato';
-    else extReason = `nessun candidato external valido: ${cands.map((b) => (binTrusted(b) ? `${b} (non risponde al contratto)` : `${b} (non fidato)`)).join('; ')}`;
-  }
-
-  // Builtin: abilitato + fleet.json valido.
-  let biFleet = null;
-  let biReason = null;
-  if (cfg.builtinEnabled !== false) {
-    const f = await createBuiltinFleet({ ...cfg, fleetProviderReason: 'fleet.json definitions' });
-    if (f.available) { biFleet = f; biReason = 'fleet.json valido'; }
-    else biReason = 'fleet.json mancante o invalido (fail-closed)';
-  } else {
-    biReason = 'builtin disabilitato (builtinEnabled=false)';
-  }
-
-  // --- Mode FORZATO: fail-closed se il richiesto non e' disponibile ---
-  if (forced === 'external') {
-    return extFleet
-      ? { mode: 'external', reason: `forced external (${extReason})`, fleet: extFleet }
-      : failClosed('external');
-  }
-  if (forced === 'builtin') {
-    return biFleet
-      ? { mode: 'builtin', reason: `forced builtin (${biReason})`, fleet: biFleet }
-      : failClosed('builtin');
-  }
-  if (forced === 'disabled') {
-    return { mode: 'disabled', reason: 'forced disabled', fleet: DISABLED_FLEET };
-  }
-  if (forced) {
-    return failClosed(forced); // valore forzato non riconosciuto
-  }
-
-  // --- AUTO: external fidato+contratto vince, poi builtin, poi disabled ---
-  if (extFleet) {
-    return { mode: 'external', reason: `auto: external ${extReason}`, fleet: extFleet };
-  }
-  if (biFleet) {
-    return {
-      mode: 'builtin',
-      reason: `auto: external scartato (${extReason}) → builtin (${biReason})`,
-      fleet: biFleet,
-    };
-  }
-  return {
-    mode: 'disabled',
-    reason: `auto: nessun provider disponibile — external: ${extReason}; builtin: ${biReason}`,
-    fleet: DISABLED_FLEET,
-  };
+  if (cfg.fleetEnabled === false) return disabled('fleet disabilitata (fleetEnabled=false)');
+  if (cfg.builtinEnabled === false) return disabled('fleet builtin disabilitata (builtinEnabled=false)');
+  const fleet = await createBuiltinFleet({ ...cfg, fleetProviderReason: 'NexusCrew builtin fleet' });
+  if (!fleet.available) return disabled('fleet.json mancante o invalido (fail-closed)');
+  return { mode: 'builtin', reason: 'NexusCrew builtin fleet', fleet };
 }
 
 module.exports = { selectProvider, DISABLED_FLEET };

package/lib/fleet/routes.js

@@ -1,9 +1,8 @@
 'use strict';
 const express = require('express');
 
-// Capability minime del contratto storico per i fleet external/legacy che NON
-// dichiarano capabilities() (design §9c): status/up/down/engine/boot.
-// Il built-in B4 aggiunge define/edit/remove/schema.
+// Fallback difensivo per un adapter builtin incompleto nei test. Il provider di
+// prodotto dichiara sempre la propria capability list.
 const DEFAULT_CAPS = ['status', 'up', 'down', 'engine', 'boot'];
 
 function capList(fleet) {
@@ -33,8 +32,7 @@ function fleetRoutes(fleetP, cfg = {}) {
 
   const guard = (fn, opts = {}) => async (req, res) => {
     try {
-      // READONLY e' un gate di prodotto, non solo del provider built-in: deve
-      // bloccare anche il fleet esterno legacy prima che tocchi systemd/tmux reali.
+      // READONLY e' un gate di prodotto oltre che del provider built-in.
       if (opts.mutate && readonly()) return res.status(403).json({ error: 'READONLY: mutazione fleet bloccata' });
       const fleet = await fleetP;
       if (!fleet.available) return res.status(404).json({ error: 'fleet non disponibile' });
@@ -45,8 +43,7 @@ function fleetRoutes(fleetP, cfg = {}) {
   };
 
   // /status espone anche `provider` e `capabilities` (design §9b/§9c), oltre ai
-  // campi storici (available/cells/engines). Provider senza capabilities()
-  // (external legacy) → DEFAULT_CAPS; external senza campo provider → 'external'.
+  // campi storici (available/cells/engines).
   r.get('/status', async (_req, res) => {
     try {
       const fleet = await fleetP;
@@ -56,14 +53,12 @@ function fleetRoutes(fleetP, cfg = {}) {
           provider: fleet.provider || 'disabled',
           bootOwner: 'none', // §9b: provider non disponibile -> nessun boot owner
           capabilities: capList(fleet),
+          ...(fleet.reason ? { reason: fleet.reason } : {}),
         });
       }
       const st = await fleet.status();
-      const provider = st.provider || fleet.provider || 'external';
-      // bootOwner (§9b): preferisce quello dichiarato dal provider (st.bootOwner);
-      // altrimenti deriva dal mode: builtin -> 'builtin', disabled -> 'none',
-      // external -> 'external'. Contratto valori: 'builtin' | 'external' | 'none'.
-      const bootOwner = st.bootOwner || (provider === 'builtin' ? 'builtin' : provider === 'disabled' ? 'none' : 'external');
+      const provider = st.provider || fleet.provider || 'builtin';
+      const bootOwner = st.bootOwner || (provider === 'disabled' ? 'none' : 'builtin');
       res.json({
         ...st,
         provider,
@@ -76,7 +71,6 @@ function fleetRoutes(fleetP, cfg = {}) {
   // /up: il built-in (capability 'edit') è definitions-driven — se il body porta
   // un engine lo persiste sulla cella (f.engine) PRIMA di up, perché l'engine
   // dichiarato vince sull'override runtime (ignored dal builtin.up).
-  // External legacy: passthrough up(cell,{engine,boot}) invariato.
   r.post('/up', guard(async (f, b) => {
     const cell = String(b.cell || '');
     if (b.engine && capList(f).includes('edit')) {
@@ -129,7 +123,7 @@ function fleetRoutes(fleetP, cfg = {}) {
     return f.restoreEngines(b.engines, { overwrite: b.overwrite === true });
   }, { mutate: true }));
   // Riconciliazione sessione tmux esistente (cella Fleet legacy orfana) in cella
-  // gestita fleet.json. Capability 'define' (solo builtin): external legacy -> 501.
+  // gestita fleet.json.
   r.post('/import-cell', guard(async (f, b) => { requireCap(f, 'import'); return f.importCell(b || {}); }, { mutate: true }));
 
   r.use((err, _req, res, _next) => {

package/lib/fleet/runtime.js

@@ -34,12 +34,13 @@ function findEngine(defs, id) { return defs.engines.find((e) => e.id === id) ||
 
 // ---------------------------------------------------------------------------
 // createBuiltinRuntime(ctx)
-//   ctx: { cfg, home, defsPath, tmuxBin, readonly, launchBroker, boot }
+//   ctx: { cfg, home, defsPath, tmuxBin, readonly, launchBroker, boot,
+//          ensureProtection }
 //   boot = definizioni iniziali (loadDefinitions, non null: il caller gia'
 //   e' tornato unavailable su garbage).
 // ---------------------------------------------------------------------------
 function createBuiltinRuntime(ctx) {
-  const { cfg, home, defsPath, tmuxBin, readonly, launchBroker, boot } = ctx;
+  const { cfg, home, defsPath, tmuxBin, readonly, launchBroker, boot, ensureProtection } = ctx;
   let cache = { at: 0, defs: boot, sessions: new Set() };
 
   function reloadDefs() {
@@ -93,7 +94,8 @@ function createBuiltinRuntime(ctx) {
         permissionPolicy: effectivePolicy,
         permissionPolicies: { ...(c.permissionPolicies || {}) },
         active: alive, boot: c.boot, tmux: alive,
-        rc: '', key: '', degraded: false, // builtin: cella "up" <=> sessione tmux viva
+        supervised: true, keepalive: true,
+        rc: '', key: '', degraded: false, // supervisor vivo <=> sessione tmux viva
       };
     });
     const needsOllama = cache.defs.engines.some((e) => e.managed?.provider === 'ollama-cloud');
@@ -138,6 +140,7 @@ function createBuiltinRuntime(ctx) {
   // stato persistente gestito da boot()). Lancia SENZA shell.
   async function up(cellId /* , { engine, boot } = {} */) {
     if (readonly()) throw httpError(403, 'READONLY: up bloccato');
+    if (typeof ensureProtection === 'function') await ensureProtection();
     const defs = reloadDefs();
     const cell = findCell(defs, cellId);
     if (!cell) throw httpError(400, `cella sconosciuta: ${cellId}`);
@@ -157,26 +160,45 @@ function createBuiltinRuntime(ctx) {
     const realCwd = resolveCwd(cell.cwd, home);
     if (!realCwd) throw httpError(400, `cwd non valida (deve esistere sotto la home): ${cell.cwd}`);
 
-    // (4)+(5) argv diretto (no shell). Environment-bearing launches go
-    // through a private, one-shot Unix-socket broker so credentials never
-    // appear in `ps`, tmux argv, tmux global/session env or a temporary file.
+    // (4)+(5) argv diretto (no shell). Every cell goes through the private
+    // broker-backed supervisor: credentials never enter tmux state/argv and a
+    // client that exits after readiness is restarted with bounded backoff.
     // '-P -F #{pane_id}': tmux stampa il pane id della sessione appena creata,
     // cosi' l'iniezione del prompt bersaglia ESATTAMENTE quel pane (audit impl
     // #5: elimina la race di riuso del nome sessione tra waitAlive e paste).
-    let tmuxLaunchEngine = launchEngine;
-    if (Object.keys(launchEngine.env || {}).length) {
-      const child = composeClientInvocation(launchEngine, cell);
-      const ticket = await launchBroker.issue({
-        command: child.command,
-        args: child.args,
-        env: { ...minimalEnv(), ...launchEngine.env },
-      });
-      tmuxLaunchEngine = {
-        command: process.execPath,
-        args: [path.join(__dirname, 'cell-exec.js'), '--socket', ticket.socketPath, '--nonce', ticket.nonce],
-        env: {}, promptMode: 'managed-argv',
-      };
-    }
+    const readyMs = cfg.launchReadyMs != null ? cfg.launchReadyMs : 500;
+    const child = composeClientInvocation(launchEngine, cell);
+    const ticket = await launchBroker.issue({
+      command: child.command,
+      args: child.args,
+      env: {
+        ...minimalEnv(),
+        ...launchEngine.env,
+        NEXUSCREW_MCP_SESSION: cell.tmuxSession,
+      },
+      supervise: {
+        enabled: true,
+        initialReadyMs: Math.max(50, Math.min(30000, Number(readyMs) || 500)),
+        restartDelayMs: Math.max(50, Math.min(60000, Number(cfg.cellRestartDelayMs) || 1000)),
+        maxRestartDelayMs: Math.max(100, Math.min(300000, Number(cfg.cellMaxRestartDelayMs) || 60000)),
+        resetAfterMs: Math.max(1000, Math.min(3600000, Number(cfg.cellRestartResetMs) || 30000)),
+        rapidWindowMs: Math.max(1000, Math.min(3600000, Number(cfg.cellRapidWindowMs) || 60000)),
+        maxRapidRestarts: Math.max(1, Math.min(100, Number(cfg.cellMaxRapidRestarts) || 8)),
+      },
+      ...(launchEngine.promptMode === 'send-keys' && cell.prompt ? {
+        restartPrompt: {
+          tmuxBin,
+          tmuxSession: cell.tmuxSession,
+          prompt: cell.prompt,
+          readyMs: Math.max(0, Math.min(30000, Number(cfg.sendKeysReadyMs) || readyMs)),
+        },
+      } : {}),
+    });
+    const tmuxLaunchEngine = {
+      command: process.execPath,
+      args: [path.join(__dirname, 'cell-exec.js'), '--socket', ticket.socketPath, '--nonce', ticket.nonce],
+      env: {}, promptMode: 'managed-argv',
+    };
     const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine: tmuxLaunchEngine, cell });
     argv.splice(2, 0, '-P', '-F', '#{pane_id}');
     // Mantieni il pane morto solo durante la finestra di readiness: permette di
@@ -196,7 +218,6 @@ function createBuiltinRuntime(ctx) {
     // moment later (missing login, bad model, incompatible provider).  Without
     // this readiness gate the PWA reported success and then showed nothing.
     // Always verify liveness, including cells without a system prompt.
-    const readyMs = cfg.launchReadyMs != null ? cfg.launchReadyMs : 500;
     const paneId = launch.stdout.trim().split('\n')[0] || '';
     const readiness = paneId.startsWith('%')
       ? await waitStablePane(tmuxBin, paneId, { env: minimalEnv(), readyMs })
@@ -239,6 +260,7 @@ function createBuiltinRuntime(ctx) {
 
   async function down(cellId /* , opts */) {
     if (readonly()) throw httpError(403, 'READONLY: down bloccato');
+    if (typeof ensureProtection === 'function') await ensureProtection();
     const defs = reloadDefs();
     const cell = findCell(defs, cellId);
     if (!cell) throw httpError(400, `cella sconosciuta: ${cellId}`);
@@ -253,7 +275,7 @@ function createBuiltinRuntime(ctx) {
 
   // restart = down (riusa la kill esistente; sessione non viva NON e' errore,
   // come down) seguito da up (rilancia secondo la definizione corrente).
-  // Capability del SOLO built-in: i provider legacy non la espongono (501 in route).
+  // Restart è implementato dal runtime built-in come transizione intenzionale.
   async function restart(cellId) {
     if (readonly()) throw httpError(403, 'READONLY: restart bloccato');
     await down(cellId); // idempotente: cella non viva -> nessun errore