npm - @mmmbuto/nexuscrew - Versions diffs - 0.8.27 → 0.8.29 - Mend

@mmmbuto/nexuscrew 0.8.27 → 0.8.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/CHANGELOG.md +41 -0
package/README.md +24 -9
package/frontend/dist/assets/{index-xxfypte7.css → index-BAzlX2nP.css} +1 -1
package/frontend/dist/assets/index-BJdAdNOq.js +93 -0
package/frontend/dist/index.html +2 -2
package/frontend/dist/version.json +1 -1
package/lib/cli/commands.js +96 -3
package/lib/cli/doctor.js +123 -11
package/lib/cli/fleet-service.js +9 -10
package/lib/cli/init.js +8 -1
package/lib/cli/service.js +7 -4
package/lib/diagnostics/store.js +2 -2
package/lib/fleet/builtin.js +206 -17
package/lib/fleet/causes.js +68 -0
package/lib/fleet/definitions.js +86 -4
package/lib/fleet/launch.js +25 -1
package/lib/fleet/managed.js +62 -9
package/lib/fleet/routes.js +16 -2
package/lib/fleet/runtime.js +69 -33
package/package.json +1 -1
package/frontend/dist/assets/index-CWKyv6KS.js +0 -93

package/frontend/dist/index.html CHANGED Viewed

@@ -11,8 +11,8 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-CWKyv6KS.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-xxfypte7.css">
+  <script type="module" crossorigin src="/assets/index-BJdAdNOq.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-BAzlX2nP.css">
 </head>
 <body>
   <div id="root"></div>

package/frontend/dist/version.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":"0.8.27"}
1	+ {"version":"0.8.29"}

package/lib/cli/commands.js CHANGED Viewed

@@ -14,7 +14,7 @@ const pidf = require('./pidfile.js');
 const { runInit, ensureFleetDefaults } = require('./init.js');
 const { rotateToken } = require('../auth/token.js');
 const urlmod = require('./url.js');
-const { doctor } = require('./doctor.js');
+const { doctor, checkServiceWorkingDirectory } = require('./doctor.js');
 const nodesStore = require('../nodes/store.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const nodesCmds = require('../nodes/commands.js');
@@ -346,6 +346,66 @@ function servicePinsLegacyPort(platform, home, installPath) {
   try { return /NEXUSCREW_PORT/.test(fs.readFileSync(target, 'utf8')); } catch (_) { return false; }
 }
+function fleetServiceDefinitionNeedsRefresh(platform, home, installPath) {
+  let target;
+  try { target = installPath || fleetInstallPath(platform, home); } catch (_) { return false; }
+  try { fs.lstatSync(target); }
+  catch (error) { return error.code !== 'ENOENT'; }
+  return !checkServiceWorkingDirectory(platform, home, target).ok;
+}
+function serviceDefinitionNeedsRefresh(platform, home, installPath, fleetInstallPathOverride) {
+  if (servicePinsLegacyPort(platform, home, installPath)) return true;
+  if (!checkServiceWorkingDirectory(platform, home, installPath).ok) return true;
+  return fleetServiceDefinitionNeedsRefresh(platform, home, fleetInstallPathOverride);
+}
+function serviceMigrationMarkerPath(home, override) {
+  return override || path.join(home, '.nexuscrew', 'service-cwd-migration.pending');
+}
+function serviceMigrationPending(home, override) {
+  const target = serviceMigrationMarkerPath(home, override);
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink() || !st.isFile()) throw new Error(`unsafe service migration marker: ${target}`);
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+function ensureServiceMigrationMarker(home, override) {
+  const target = serviceMigrationMarkerPath(home, override);
+  if (serviceMigrationPending(home, override)) return target;
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  let fd;
+  try {
+    fd = fs.openSync(target, 'wx', 0o600);
+    fs.writeFileSync(fd, 'pending\n');
+    fs.fsyncSync(fd);
+    fs.fchmodSync(fd, 0o600);
+  } catch (error) {
+    if (error.code === 'EEXIST' && serviceMigrationPending(home, override)) return target;
+    throw error;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+  return target;
+}
+function clearServiceMigrationMarker(home, override) {
+  const target = serviceMigrationMarkerPath(home, override);
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink() || !st.isFile()) throw new Error(`unsafe service migration marker: ${target}`);
+    fs.unlinkSync(target);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+}
 function portAvailable(port, host = '127.0.0.1') {
   return new Promise((resolve) => {
     const s = net.createServer();
@@ -465,8 +525,38 @@ async function smartUp(opts = {}) {
   // config.json forever. Regenerate once so config.json becomes authoritative.
   const home = opts.home || require('node:os').homedir();
   const persistent = bootState({ ...opts, platform }).enabled;
-  if (persistent && servicePinsLegacyPort(platform, home, opts.installPath)) {
-    runInitImpl({ ...opts, log: quiet, platform, installBoot: true, printUrl: false });
+  let serviceRefreshed = false;
+  const migrationPending = persistent
+    ? serviceMigrationPending(home, opts.serviceMigrationMarkerPath) : false;
+  if (persistent && (migrationPending || serviceDefinitionNeedsRefresh(
+    platform, home, opts.installPath, opts.fleetInstallPath,
+  ))) {
+    ensureServiceMigrationMarker(home, opts.serviceMigrationMarkerPath);
+    const initResult = runInitImpl({ ...opts, log: quiet, platform, installBoot: true, printUrl: false });
+    serviceRefreshed = !serviceDefinitionNeedsRefresh(
+      platform, home, opts.installPath, opts.fleetInstallPath,
+    );
+    if (!serviceRefreshed) {
+      throw new Error('service cwd migration failed verification; refusing to continue with a replaceable working directory');
+    }
+    const installFailures = Array.isArray(initResult?.installFailures) ? initResult.installFailures : [];
+    if (installFailures.length) {
+      const components = [...new Set(installFailures.map((failure) => failure?.component)
+        .filter((component) => component === 'service' || component === 'fleet-companion'))];
+      throw new Error(`service cwd migration activation failed verification${components.length ? ` (${components.join(', ')})` : ''}; refusing to continue with an unverified service runtime`);
+    }
+    // Writing and activating a definition does not prove that an already-active
+    // Linux unit adopted it (`systemctl enable --now` is a no-op for that
+    // process). Restart every persistent runtime exactly once after the files
+    // and activation outcomes are verified. The lifecycle helper preserves the
+    // shared tmux server on Linux and uses PID-pinned portable restart on Termux.
+    const migrated = restartImpl({ ...opts, platform, log: quiet });
+    if (!migrated || migrated.restarted !== true) {
+      throw new Error(`service cwd migration restart failed verification (${platform}); refusing to continue with an unverified service runtime`);
+    }
+    // Only a verified file migration plus successful service activation (and,
+    // on Termux, a verified runtime restart) clears the durable retry marker.
+    clearServiceMigrationMarker(home, opts.serviceMigrationMarkerPath);
   }
   if (!port) port = urlmod.loadPort(opts);
@@ -972,6 +1062,9 @@ function dispatch(argv, opts = {}) {
 module.exports = {
   dispatch, dispatchNodes, serve, start, stop, status, parseFlags, HELP, NODES_HELP,
   smartUp, url, tokenRotate, logs, doctor, update, restart,
+  serviceDefinitionNeedsRefresh,
+  fleetServiceDefinitionNeedsRefresh,
+  serviceMigrationPending,
   portAvailable, findAvailablePort, probeNexusCrew, waitForNexusCrew, openPwa, startPortable, wizardComplete,
   servicePinsLegacyPort,
   isServiceRunning, readRoles,

package/lib/cli/doctor.js CHANGED Viewed

@@ -11,6 +11,7 @@ const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const { detectPlatform, uid } = require('./platform.js');
 const { installPath } = require('./service.js');
+const { fleetInstallPath } = require('./fleet-service.js');
 const { resolvePaths } = require('./url.js');
 const { commandExists } = require('./path.js');
 const { loadDefinitions } = require('../fleet/definitions.js');
@@ -79,25 +80,73 @@ function checkMacServiceWorkingDirectory(platform, home, installPathOverride) {
   if (platform !== 'mac') {
     return { name: 'launchd cwd stabile', ok: true, detail: `${platform}: non applicabile` };
   }
-  const target = installPathOverride || installPath('mac', home);
+  return checkServiceWorkingDirectory(platform, home, installPathOverride);
+}
+// The service cwd is inherited by a shared tmux server and every future pane.
+// It must therefore be HOME, never the replaceable runtime directory. This
+// check reads only the installed definition and fails closed on missing,
+// symlinked, malformed, or legacy service files.
+function checkServiceWorkingDirectory(platform, home, installPathOverride) {
+  if (!['linux', 'mac', 'termux'].includes(platform)) {
+    return { name: 'service cwd stabile', ok: true, detail: `${platform}: non applicabile` };
+  }
+  const target = installPathOverride || installPath(platform, home);
   let raw;
-  try { raw = fs.readFileSync(target, 'utf8'); }
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink() || !st.isFile()) throw Object.assign(new Error('definizione service non regolare'), { code: 'UNSAFE' });
+    raw = fs.readFileSync(target, 'utf8');
+  }
   catch (error) {
     return {
-      name: 'launchd cwd stabile', ok: false,
-      detail: error.code === 'ENOENT' ? `plist non installato (${target})` : error.message,
+      name: 'service cwd stabile', ok: false,
+      detail: error.code === 'ENOENT' ? `service non installato (${target})` : error.message,
     };
   }
-  const match = raw.match(/<key>WorkingDirectory<\/key>\s*<string>([\s\S]*?)<\/string>/);
-  if (!match) return { name: 'launchd cwd stabile', ok: false, detail: 'WorkingDirectory assente dal plist' };
-  const actual = decodeXmlText(match[1]);
-  const expected = String(home);
+  let actual = '';
+  let ok = false;
+  if (platform === 'mac') {
+    const match = raw.match(/<key>WorkingDirectory<\/key>\s*<string>([\s\S]*?)<\/string>/);
+    if (!match) return { name: 'service cwd stabile', ok: false, detail: 'WorkingDirectory assente dal plist' };
+    actual = decodeXmlText(match[1]);
+    ok = actual === String(home);
+  } else if (platform === 'linux') {
+    const match = raw.match(/^WorkingDirectory=(.+)$/m);
+    if (!match) return { name: 'service cwd stabile', ok: false, detail: 'WorkingDirectory assente dalla unit' };
+    actual = match[1].replace(/%%/g, '%');
+    ok = actual === String(home);
+  } else {
+    const stable = /^\s*cd -- "\$HOME"\s*$/m.test(raw);
+    actual = stable ? '$HOME' : (/^\s*cd\s+--\s+(.+)$/m.exec(raw)?.[1] || 'cd assente');
+    ok = stable;
+  }
   return {
-    name: 'launchd cwd stabile', ok: actual === expected,
-    detail: actual === expected ? expected : `${actual} (atteso HOME stabile: ${expected})`,
+    name: 'service cwd stabile', ok,
+    detail: ok ? (platform === 'termux' ? '$HOME' : String(home)) : `${actual} (atteso HOME stabile)`,
   };
 }
+// The Fleet boot companion can win the boot race and create the shared tmux
+// server before the HTTP service. Apply the same stable-HOME invariant to it.
+// A missing companion is non-fatal because Fleet boot is optional; an installed
+// but stale/unsafe definition is a real failure.
+function checkFleetServiceWorkingDirectory(platform, home, installPathOverride) {
+  if (!['linux', 'mac', 'termux'].includes(platform)) {
+    return { name: 'fleet service cwd stabile', ok: true, detail: `${platform}: non applicabile` };
+  }
+  const target = installPathOverride || fleetInstallPath(platform, home);
+  try {
+    fs.lstatSync(target);
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return { name: 'fleet service cwd stabile', ok: true, warn: true, detail: `companion non installato (${target})` };
+    }
+  }
+  const result = checkServiceWorkingDirectory(platform, home, target);
+  return { ...result, name: 'fleet service cwd stabile' };
+}
 function checkBoot(platform, home, execImpl) {
   if (platform === 'termux') {
     const p = path.join(home, '.termux', 'boot', 'nexuscrew.sh');
@@ -261,6 +310,61 @@ function checkTermuxExec(runtimeEnv, opts = {}) {
   };
 }
+// Read-only probe of the long-lived tmux server cwd. A server that retained an
+// unlinked runtime directory keeps accepting clients but makes later children
+// fail getcwd(3). Never reports the path itself; only stable state.
+function checkTmuxServerCwd(platform, execImpl, opts = {}) {
+  if (!['linux', 'termux'].includes(platform)) {
+    return { name: 'tmux server cwd', ok: true, detail: `${platform}: non applicabile` };
+  }
+  let rawPid = '';
+  try {
+    rawPid = String(execImpl(opts.tmuxBin || 'tmux', ['display-message', '-p', '#{pid}'], { encoding: 'utf8' }) || '').trim();
+  } catch (_) {
+    return { name: 'tmux server cwd', ok: true, warn: true, detail: 'server tmux non attivo; probe rinviato al primo avvio' };
+  }
+  if (!/^\d+$/.test(rawPid)) {
+    return { name: 'tmux server cwd', ok: true, warn: true, detail: 'server tmux non rilevato' };
+  }
+  try {
+    const resolveImpl = opts.procCwdImpl || ((pid) => fs.realpathSync(`/proc/${pid}/cwd`));
+    const cwd = resolveImpl(Number(rawPid));
+    if (typeof cwd !== 'string' || !cwd) throw new Error('cwd vuota');
+    return { name: 'tmux server cwd', ok: true, detail: 'cwd risolvibile' };
+  } catch (_) {
+    return {
+      name: 'tmux server cwd', ok: false,
+      detail: 'cwd del server tmux non risolvibile (directory sostituita); termina le sessioni in modo esplicito e riavvia tmux',
+    };
+  }
+}
+// Inspect only the single tmux global environment key required by
+// termux-exec. The value is validated and then discarded; it is never logged.
+// This distinguishes a healthy server from RC-2 (stale/no preload) and RC-7
+// (present but rejected by the trust boundary) without killing any session.
+function checkTmuxServerTermuxPreload(runtimeEnv, execImpl, opts = {}) {
+  const env = runtimeEnv || process.env;
+  const platform = opts.platform || detectPlatform();
+  if (!termuxRuntimePaths(env, { platform, home: opts.home })) {
+    return { name: 'tmux server termux-exec', ok: true, detail: `${platform}: non applicabile` };
+  }
+  let raw = '';
+  try {
+    raw = String(execImpl(opts.tmuxBin || 'tmux', ['show-environment', '-g', 'LD_PRELOAD'], { encoding: 'utf8' }) || '').trim();
+  } catch (_) {
+    return { name: 'tmux server termux-exec', ok: true, warn: true, detail: 'server tmux non attivo; probe rinviato al primo avvio' };
+  }
+  const match = raw.match(/^LD_PRELOAD=(.+)$/);
+  const trusted = match && trustedTermuxPreload({ ...env, LD_PRELOAD: match[1] }, { platform, home: opts.home });
+  return trusted
+    ? { name: 'tmux server termux-exec', ok: true, detail: 'preload trusted presente nel server tmux' }
+    : {
+      name: 'tmux server termux-exec', ok: false,
+      detail: 'LD_PRELOAD assente o non trusted nel server tmux; server stale o formato non compatibile (nessun kill automatico)',
+    };
+}
 // Check MCP identity (P0). NON-FAILING per costrutto: `ok` è sempre true, così
 // chi usa NexusCrew solo come PWA (nessuna integrazione MCP) non vede mai il
 // doctor andare in FAIL solo per env MCP assente. Il check osserva SOLO la
@@ -341,7 +445,10 @@ function doctor(opts = {}) {
     checkTmux(existsImpl, opts.tmuxBin),
     checkPty(ptyLoad),
     checkService(platform, home, execImpl, uidVal, opts.installPath),
-    checkMacServiceWorkingDirectory(platform, home, opts.installPath),
+    checkServiceWorkingDirectory(platform, home, opts.installPath),
+    fleetEnabled
+      ? checkFleetServiceWorkingDirectory(platform, home, opts.fleetInstallPath)
+      : { name: 'fleet service cwd stabile', ok: true, warn: true, detail: 'Fleet disabilitata' },
     checkBoot(platform, home, execImpl),
     checkUserLinger(platform, execImpl, uidVal),
     checkTmuxSurvival(platform, execImpl),
@@ -352,6 +459,8 @@ function doctor(opts = {}) {
     checkAutossh(existsImpl),
     checkSshPermitlisten(opts.sshVersion),
     checkMcpIdentity(opts.env),
+    checkTmuxServerCwd(platform, execImpl, { tmuxBin: opts.tmuxBin, procCwdImpl: opts.procCwdImpl }),
+    checkTmuxServerTermuxPreload(opts.env, execImpl, { platform, home, tmuxBin: opts.tmuxBin }),
   ];
   for (const c of checks) {
@@ -368,7 +477,10 @@ module.exports = {
   checkNode, checkTmux, checkPty, checkService, checkBoot, checkTokenPerms,
   checkMacServiceWorkingDirectory,
   checkFleetDefinitions,
+  checkServiceWorkingDirectory,
+  checkFleetServiceWorkingDirectory,
   checkTmuxSurvival, checkUserLinger,
   checkSshClient, checkAutossh, checkSshPermitlisten,
   checkMcpIdentity, checkTermuxExec,
+  checkTmuxServerCwd, checkTmuxServerTermuxPreload,
 };

package/lib/cli/fleet-service.js CHANGED Viewed

@@ -41,13 +41,16 @@ function generateFleetService(opts) {
 }
 function generateFleetLinux(opts) {
-  const repoRoot = opts.repoRoot || deriveRepoRoot(opts.entryPath);
+  const home = opts.home || os.homedir();
   const { nodeBin, entryPath } = opts;
   // Parita' di hardening con service.js (M3): reject char non gestibili in systemd.
-  assertSystemdSafe('repoRoot', repoRoot);
+  assertSystemdSafe('home', home);
   assertSystemdSafe('nodeBin', nodeBin);
   assertSystemdSafe('entryPath', entryPath);
-  const repo = escapeSystemdPath(repoRoot);
+  // fleet-boot can create the shared tmux server before the HTTP service. Its
+  // cwd must therefore be the stable HOME, never the replaceable npm package
+  // directory containing entryPath.
+  const stableCwd = escapeSystemdPath(home);
   const node = escapeSystemdExec(nodeBin);
   const entry = escapeSystemdExec(entryPath);
   const nodeDir = escapeSystemdPath(path.dirname(nodeBin));
@@ -61,7 +64,7 @@ Type=oneshot
 # fleet-boot may be the process that creates the shared tmux server. Keep
 # systemd from reaping that server and its cells when this oneshot exits.
 KillMode=process
-WorkingDirectory=${repo}
+WorkingDirectory=${stableCwd}
 Environment=PATH=${nodeDir}:/usr/local/bin:/usr/bin:/bin
 ExecStart=${node} ${entry} fleet-boot
@@ -71,11 +74,9 @@ WantedBy=default.target
 }
 function generateFleetMac(opts) {
-  const repoRoot = opts.repoRoot || deriveRepoRoot(opts.entryPath);
   const home = opts.home || os.homedir();
   const nodeXml = escapeXml(opts.nodeBin);
   const entryXml = escapeXml(opts.entryPath);
-  const repoXml = escapeXml(repoRoot);
   const homeXml = escapeXml(home);
   const launchPath = [...new Set([
     path.dirname(opts.nodeBin), '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin',
@@ -94,7 +95,7 @@ function generateFleetMac(opts) {
     <string>fleet-boot</string>
   </array>
   <key>WorkingDirectory</key>
-  <string>${repoXml}</string>
+  <string>${homeXml}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key>
@@ -112,10 +113,8 @@ function generateFleetMac(opts) {
 }
 function generateFleetTermux(opts) {
-  const repoRoot = opts.repoRoot || deriveRepoRoot(opts.entryPath);
   const nodeQ = shellQuote(opts.nodeBin);
   const entryQ = shellQuote(opts.entryPath);
-  const repoQ = shellQuote(repoRoot);
   return `#!/data/data/com.termux/files/usr/bin/sh
 # NexusCrew fleet boot companion (Termux) - avvia le celle boot:true
 export PATH=/data/data/com.termux/files/usr/bin:$PATH
@@ -124,7 +123,7 @@ export PREFIX=/data/data/com.termux/files/usr
 export TMPDIR=$PREFIX/tmp
 export TMUX_TMPDIR=$PREFIX/var/run
 mkdir -p "$TMPDIR" "$TMUX_TMPDIR"
-cd -- ${repoQ}
+cd -- "$HOME"
 exec ${nodeQ} ${entryQ} fleet-boot >> "$HOME/.nexuscrew/fleet-boot.log" 2>&1
 `;
 }

package/lib/cli/init.js CHANGED Viewed

@@ -109,6 +109,9 @@ function runInit(opts = {}) {
   }
   const actions = [];
+  // Structured, value-free install outcomes for callers that must fail closed
+  // (notably smart-up migrations). Human-readable actions remain compatible.
+  const installFailures = [];
   // porta: opts.port > migration rule > config esistente > default 41820
   let port = opts.port;
@@ -214,12 +217,14 @@ function runInit(opts = {}) {
       const r = installService(platform, content, svcCtx, { execImpl: opts.execImpl });
       if (r.failures && r.failures.length) {
         // file installato MA activation (systemctl/launchctl) fallita [M1]
+        installFailures.push({ component: 'service', phase: 'activation' });
         actions.push(`WARN: service file installato ${r.target} MA activation fallita: ${r.failures.map((f) => f.cmd).join('; ')} (file preservato, diagnosi)`);
       } else {
         actions.push(`service installed ${r.target} (mode 0${fileMode(platform).toString(8)})`);
       }
     } catch (e) {
       // failure: preserve file + diagnosi (no rollback) [M8]
+      installFailures.push({ component: 'service', phase: 'install' });
       actions.push(`WARN: service install fallito: ${e.message} (file generati preservati)`);
     }
   }
@@ -273,6 +278,7 @@ function runInit(opts = {}) {
           );
           if (fr.failures && fr.failures.length) {
             // file installato MA activation (systemctl/launchctl) fallita [M1]
+            installFailures.push({ component: 'fleet-companion', phase: 'activation' });
             actions.push(`WARN: fleet companion file installato ${fr.target} MA activation fallita: ${fr.failures.map((f) => f.cmd).join('; ')} (file preservato, diagnosi)`);
           } else {
             actions.push(`fleet companion installed ${fr.target} (mode 0${fleetFileMode(platform).toString(8)})`);
@@ -282,6 +288,7 @@ function runInit(opts = {}) {
     }
   } catch (e) {
     // qualunque errore del companion: WARN + init principale prosegue intatto.
+    installFailures.push({ component: 'fleet-companion', phase: 'install' });
     actions.push(`WARN: fleet companion fallito: ${e.message} (init principale prosegue)`);
   }
@@ -303,7 +310,7 @@ function runInit(opts = {}) {
   for (const a of actions) log(a);
-  return { platform, port, token, url: urlWithToken, actions, tmuxOk, dryRun };
+  return { platform, port, token, url: urlWithToken, actions, installFailures, tmuxOk, dryRun };
 }
 module.exports = { runInit, readExistingPort, haveTmux, nodeMajor, writeConfigAtomic, ensureFleetDefaults };

package/lib/cli/service.js CHANGED Viewed

@@ -59,9 +59,12 @@ function generateService(platform, ctx) {
 function generateLinux(ctx) {
   assertSystemdSafe('repoRoot', ctx.repoRoot); // [M3] reject char non gestibili
   assertSystemdSafe('nodeBin', ctx.nodeBin);
-  const workDir = ctx.runtimeDir || path.join(ctx.home, '.nexuscrew');
-  assertSystemdSafe('runtimeDir', workDir);
-  const runtime = escapeSystemdPath(workDir);
+  // HOME is stable across init/repair/update. The runtime directory may be
+  // atomically replaced; keeping it as the service cwd leaves the HTTP process
+  // and a shared tmux server holding an orphaned inode, so every later pane can
+  // fail getcwd(3). Runtime state still lives in runtimeDir; only cwd changes.
+  assertSystemdSafe('home', ctx.home);
+  const runtime = escapeSystemdPath(ctx.home);
   const node = escapeSystemdExec(ctx.nodeBin);
   const repoBin = escapeSystemdExec(path.join(ctx.repoRoot, 'bin', 'nexuscrew.js'));
   const nodeDir = escapeSystemdPath(path.dirname(ctx.nodeBin));
@@ -151,7 +154,7 @@ export LANG=\${LANG:-en_US.UTF-8}
 export LC_CTYPE=\${LC_CTYPE:-en_US.UTF-8}
 termux-wake-lock 2>/dev/null || true
 mkdir -p "$HOME/.nexuscrew" "$TMPDIR" "$TMUX_TMPDIR"
-cd -- "$HOME/.nexuscrew"
+cd -- "$HOME"
 exec ${nodeQ} ${repoBinQ} serve --pidfile >> "$HOME/.nexuscrew/nexuscrew.log" 2>&1
 `;
 }

package/lib/diagnostics/store.js CHANGED Viewed

@@ -7,7 +7,7 @@ const ALLOWED_DURATIONS = new Set([300, 900, 1800, 3600]);
 const LEVELS = new Set(['debug', 'info', 'warn', 'error']);
 const META_KEYS = new Set([
   'port', 'platform', 'reason', 'durationSeconds', 'count', 'errno', 'client',
-  'cell', 'engine', 'action', 'state', 'transport', 'phase', 'version', 'status', 'node',
+  'cell', 'engine', 'action', 'state', 'transport', 'phase', 'version', 'status', 'node', 'code',
 ]);
 const DENIED_KEY = /(authorization|cookie|token|secret|credential|password|prompt|terminal|argv|command|env|content|payload|file|path|endpoint|url)/i;
@@ -18,7 +18,7 @@ function redactText(value, max = 160) {
     .replace(/\bBearer\s+\S+/gi, 'Bearer [redacted]')
     .replace(/\b(?:sk|xox[baprs]|gh[pousr]|npm)_[A-Za-z0-9_-]{8,}\b/g, '[redacted]')
     .replace(/\b(?:token|password|secret|api[_-]?key)\s*[=:]\s*\S+/gi, '[redacted]')
-    .replace(/(?:\/home\/[^/\s]+|\/data\/(?:data|user\/\d+)\/[^/\s]+)(?:\/[^\s]*)?/g, '[path]')
+    .replace(/(?:\/home\/[^/\s]+|\/Users\/[^/\s]+|\/data\/(?:data|user\/\d+)\/[^/\s]+)(?:\/[^\s]*)?/g, '[path]')
     .replace(/\b[A-Z][A-Z0-9_]{2,}\s*=\s*\S+/g, '[env]');
   return text.slice(0, max);
 }