@mmmbuto/nexuscrew 0.8.25 → 0.8.27

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.8.27 — 2026-07-21 — "Portable Control"
+
+- Restores Fleet and shell launches on current Android/Termux builds by preserving only a
+  validated, owner-safe `libtermux-exec` preload under the active Termux prefix. The related
+  Node-shebang workaround now detects the Termux runtime layout even when Node reports Linux.
+- Surfaces stable, sanitized `ENOENT`/`EACCES` client-spawn diagnostics without exposing command
+  paths, arguments, environment values or credentials, and adds an actionable `nexuscrew doctor`
+  check for the Termux execution bridge.
+- Keeps macOS LaunchAgents rooted at the stable user home rather than the replaceable runtime
+  directory, with a blocking doctor check for stale launchd working directories.
+- Adds viewer-local aliases for routed nodes, keyed by stable instance identity and stored in a
+  private local file. Aliases change display text only; remote labels, routes, owners and topology
+  remain untouched and the mutation is never federated.
+- Adds **Settings → Diagnostics** with bounded, structured, source-redacted records, temporary
+  5/15/30/60-minute verbose windows, filtering, pause, export, clear and routed read access.
+  Warning and error records remain available while verbose mode is off.
+- Uses the logical Fleet cell name as the visible cell title on mobile, desktop overlays and grid
+  tiles, while retaining technical route context only as non-primary metadata.
+- Updates the production lock to `body-parser@1.20.6`.
+- Gate: **931 isolated Node tests** (930 pass / 1 platform skip), **70/70 frontend component
+  tests**, production PWA build and zero production dependency vulnerabilities in both dependency
+  trees.
+
+## 0.8.26 — 2026-07-20 — "MCP Identity"
+
+- Makes MCP caller resolution directly diagnosable through the read-only `nc_identity` tool.
+  The diagnostic works without a token or resolved session, reports only non-sensitive source
+  and presence metadata, and returns stable missing/invalid identity codes with remediation.
+- Keeps identity-gated tools fail-closed while improving their error contract. A missing or
+  invalid tmux identity can no longer be mistaken for a transport failure, and `nc_notify`
+  continues to degrade safely to an unknown sender.
+- Documents the explicit `env_vars` name allowlist required by clients that clear the MCP stdio
+  environment, including the matching repeatable `codex-vl mcp add --env-var NAME` form. Values
+  remain outside command arguments and configuration files.
+- Extends `nexuscrew doctor` with a non-failing MCP identity check: PWA-only users receive at
+  most an informational warning, while MCP users can see whether `TMUX` or
+  `NEXUSCREW_MCP_SESSION` is observable in the current process.
+- Stabilizes the writable-provider-file security fixture across differing CI umasks without
+  weakening the production permission check.
+- Gate: **888 isolated Node tests** (887 pass / 1 platform skip), **39/39 frontend component
+  tests**, production PWA build and zero production dependency vulnerabilities in both the root
+  and frontend dependency trees.
+
 ## 0.8.25 — 2026-07-19 — "Token Plan"
 
 - Adds Alibaba Token Plan Personal as a first-class managed provider for Claude Code,

package/README.md

@@ -83,6 +83,10 @@ The first run creates the loopback-only runtime, starts it in the background, op
 and presents the setup wizard. Later runs reuse the configured service, print a compact status,
 and exit.
 
+On Android, `nexuscrew doctor` also verifies the Termux execution bridge used by current app
+builds. NexusCrew carries forward only a validated `libtermux-exec` preload from the active
+Termux prefix; arbitrary loader injection remains excluded from Fleet environments.
+
 The preferred port is `41820`. If another process owns it, NexusCrew selects the next free
 loopback port and records the result.
 
@@ -203,7 +207,8 @@ can be changed with pointer drag-and-drop or keyboard controls and is saved auto
 
 On mobile, locations are independently collapsible and filterable by all, pinned, active, off,
 or technical sessions. The same owner-qualified ordering model is used by compact and expanded
-desktop views.
+desktop views. Managed terminals use the logical Fleet cell name as their visible title; tmux
+session and route identifiers remain technical context rather than the primary heading.
 
 <p align="center">
   <img src="docs/img/fleet-mobile.gif" width="420" alt="NexusCrew mobile Fleet view with managed cells and session controls">
@@ -270,6 +275,10 @@ Their human-readable label has one server-backed source: rename from Settings or
 same canonical label appears everywhere without changing the technical route name, node identity,
 credentials, Share state or deck identity.
 
+For routed nodes that the current installation does not own, Settings → Nodes offers a local
+alias instead of a remote rename. The alias is private to the viewing installation, follows the
+stable instance identity and never changes or federates the remote label, route or owner.
+
 Pairing links contain a short-lived one-time invite and routing fields, but no SSH private key,
 provider key or PWA token. Node and deck identities remain owner-qualified across the network,
 and every routed HTTP or WebSocket request rechecks authorization, hop count and cycle rules.
@@ -316,6 +325,17 @@ state and manual controls are available in Settings → System; set
 On Linux, generated user services use `KillMode=process` so restarting NexusCrew does not stop
 the shared tmux server. Lifecycle commands fail closed when that protection cannot be verified.
 
+## Structured diagnostics
+
+Settings → Diagnostics shows a bounded in-memory event buffer for the local installation or an
+authorized routed node. Verbose collection is explicit and expires after 5, 15, 30 or 60 minutes;
+operational warnings and errors remain available when verbose mode is off. The view supports
+level/component filtering, pause, autoscroll, copy, JSON export and explicit clear.
+
+Records are structured and redacted before storage. Raw terminal content, prompts, command lines,
+environment values, tokens, credentials and filesystem paths are not accepted as diagnostic
+metadata. The buffer is not a reader for service journals or log files.
+
 ## MCP bridge
 
 `nexuscrew mcp` exposes the local authenticated runtime as a dependency-free stdio MCP server.
@@ -331,11 +351,18 @@ It is intended for AI sessions running inside managed tmux cells.
 | `nc_deck` | Discover owner-qualified decks containing the calling tmux session |
 | `nc_cells` | List authorized active and inactive Fleet cells across visible nodes |
 | `nc_send_cell` | Submit bounded text to one exact active cell returned by `nc_cells` |
+| `nc_identity` | Read-only identity diagnostics; callable with no session and no token |
 
 Cell delivery uses bracketed paste followed by a separate Enter. A `submitted` receipt confirms
 delivery to the target TUI, not acceptance or completion by its model. There is no silent
 offline queue.
 
+`nc_identity` returns only non-sensitive data: the `source` the caller was resolved from
+(`tmux`, `NEXUSCREW_MCP_SESSION`, or `missing`), boolean presence of the identity env vars,
+a stable `code` (`OK`, `NEXUSCREW_MCP_IDENTITY_MISSING`, `NEXUSCREW_MCP_IDENTITY_INVALID`) and
+a remediation hint. It never calls an HTTP API or reads the token, so it works even when the
+identity is missing — use it to diagnose why the identity-gated tools fail closed.
+
 Register the bridge in Claude Code:
 
 ```json
@@ -349,16 +376,32 @@ Register the bridge in Claude Code:
 }
 ```
 
-Or in Codex / Codex-VL:
+Or in Codex / Codex-VL (`env_vars` allowlists variable **names** only — no values are copied
+into the CLI or config file):
 
 ```toml
 [mcp_servers.nexuscrew]
 command = "nexuscrew"
 args = ["mcp"]
+env_vars = ["NEXUSCREW_MCP_SESSION", "TMUX", "TMUX_PANE"]
+```
+
+The equivalent CLI form on a Codex-VL build that supports `--env-var` (allowlist by name, repeated):
+
+```text
+codex-vl mcp add nexuscrew \
+  --env-var NEXUSCREW_MCP_SESSION \
+  --env-var TMUX \
+  --env-var TMUX_PANE \
+  -- nexuscrew mcp
 ```
 
-The caller is resolved from its tmux session. `NEXUSCREW_MCP_SESSION` is available only as an
-explicit fallback for non-tmux contexts.
+The caller is resolved, in order, from its tmux session (`tmux display-message -p '#S'`),
+then from the `NEXUSCREW_MCP_SESSION` fallback, then not at all. Codex/Codex-VL launch MCP stdio
+processes with a cleared environment, so those clients must explicitly allowlist the identity
+env vars for the server to observe them; otherwise the identity-gated tools (`nc_ask`, `nc_send_file`,
+`nc_deck`, `nc_send_cell`, `nc_inbox`) stay fail-closed with a stable
+`NEXUSCREW_MCP_IDENTITY_*` code, while `nc_notify` degrades to an unknown sender.
 
 ## Configuration
 
@@ -411,7 +454,7 @@ See [CHANGELOG.md](CHANGELOG.md) for released changes.
 
 ## Status
 
-The current stable release is **v0.8.25** on npm and GitHub.
+The current stable release is **v0.8.27** on npm and GitHub.
 
 ## License