@mmmbuto/nexuscrew 0.8.29 → 0.8.31

package/CHANGELOG.md

@@ -2,6 +2,80 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.8.31 — 2026-07-22 — "Safe Identity"
+
+- **tmux session naming for dotted cell ids.** tmux silently normalizes `.` to `_`
+  in session names, so a cell whose id contains a dot (e.g. `agy.native`) could no
+  longer be targeted by its nominal `cloud-<id>` name. Dotted ids now map
+  deterministically to a dot-free, collision-free session name (`cloud-v2-…`, 55
+  chars); ids without a dot keep the historical `cloud-<id>` name, so the existing
+  sessions are never renamed. The real `tmuxSession` for any cell is always
+  available from `nc_cells` and the Fleet UI — use that rather than guessing
+  `cloud-<Cell>` for dotted ids. Cell launches are now staged (inert placeholder →
+  window-local `remain-on-exit` on `@N` → `respawn-pane` on `%N`) so setup and
+  early-exit diagnostics use stable tmux object IDs. Any pre-existing legacy
+  session is migrated in place via `rename-session -t $N`
+  (preserving the session id and the operator's attach).
+- **Agy as a managed primary client** on Linux and macOS (non-Termux), with auth
+  delegated to Agy's own local login (no credential store read or copied),
+  `standard`/`unsafe` permission policies (`unsafe` adds
+  `--dangerously-skip-permissions`, consistent with the other clients),
+  free-text model selection, and an optional `--prompt-interactive` prompt passed
+  as the last argument. Termux and Windows keep using Agy through `shell.local`
+  with a per-cell `agy` command. Added to existing installs by an idempotent,
+  non-destructive, platform-aware backfill.
+- **Share revocation now converges as authorization, not availability.** Turning
+  Share off persists private intent, withdraws the node from its hub over the
+  still-live private forward, and only then replaces the local tunnel without
+  its reverse channel. Authorized operational discovery (topology, decks and
+  MCP cell directories) removes the owner after the hub acknowledgement, while
+  a merely unreachable node remains visible as stale/offline. Partial failures
+  remain explicit and are retried with bounded, structured boot diagnostics.
+
+- **Selective mobile-UX PR #1 (UI only).** Three client-only behaviours ported
+  onto the 0.8.31 candidate, no merge of PR #1:
+  - **Optional compact KeyBar.** A new `keybarLayout: "full" | "compact"`
+    preference (default `full`) renders a one-row compact bar with an expand
+    toggle that temporarily reveals the exact full key set without rewriting
+    the stored preference; the tall Enter and `showKeybarEnter=false` (no gap)
+    apply to both layouts. Editable in Settings → Input (IT/EN/ES), reset-safe
+    and synced across windows; a layout change never remounts xterm or
+    reconnects its WebSocket.
+  - **Live-DOM composer submit during IME.** Explicit submit reads
+    `textareaRef.current.value`, syncs the React draft and sends the visible
+    text after newline normalization — preserving the empty no-op, the
+    failed-send draft, history, STT and the focus policy.
+  - **Alternate-screen scroll as PageUp/PageDown.** A pure bounded plan routes
+    writable alternate-screen (vim/less/htop) vertical gestures to raw
+    `ESC[5~`/`ESC[6~` PTY input with a page-sized threshold; normal-screen and
+    any readonly terminal keep the server-side `scroll-up`/`scroll-down`
+    actions. Integrated into both wheel and touch paths without weakening
+    double-tap unlock, long-press selection, multi-touch or VirtualKeyboard.
+
+## 0.8.30 — 2026-07-22 — "Focused Control"
+
+- Makes every owner/node name in the top deck bar an explicit expand/collapse control. Newly seen
+  nodes start collapsed, each deck shows a compact live activity dot, and browser-local choices
+  synchronize across open NexusCrew windows without exposing topology or presence to other nodes.
+- Adds a full-height mobile Enter key beside Page Up/Page Down and a dedicated **Settings → Input**
+  panel. Key-bar and speech-to-text actions keep the software keyboard closed by default, terminal
+  input requires a nearby double tap, and every behavior can be changed or reset per browser.
+- Hardens the mobile gesture state machine for movement, long press, cancel, blur, VirtualKeyboard
+  geometry changes, visual-viewport recovery and sequential two-finger releases. Preference changes
+  do not remount xterm or reconnect the terminal WebSocket.
+- Runs configured Shell commands through an interactive login invocation on known POSIX shells so
+  user PATH entries such as `agy` resolve while retaining the private launch broker. Immediate
+  non-zero exits now surface a bounded `SHELL_COMMAND_FAILED` cause; successful one-shot completion
+  and commands that remain active are reported distinctly.
+- Adds the read-only `nc_cell_diagnostics` MCP tool for one exact local Fleet cell. It returns the
+  configured Shell command with bounded credential redaction and the latest closed spawn/start
+  failure cause, rejects remote targets, and preserves the existing local active-caller ACL.
+- Extends regression coverage for cross-window input preferences, listener cleanup, IME relocking,
+  multi-touch cancellation, redaction of generic uppercase environment assignments and the complete
+  DeckBar/mobile-input/Shell/MCP integration.
+- Gate: **998 isolated Node tests** (997 pass / 1 platform skip), **192/192 frontend tests**,
+  production PWA build and zero production dependency vulnerabilities in both dependency trees.
+
 ## 0.8.29 — 2026-07-21 — "Stable Fleet Boot"
 
 - Keeps the optional Fleet boot companion rooted at the stable user home on Linux, macOS and

package/README.md

@@ -133,12 +133,13 @@ model, permission policy, optional system prompt, optional Shell command and boo
 a stopped cell opens the same launch sheet on desktop and mobile, so the effective settings can
 be reviewed before the process starts.
 
-An **engine** describes how a CLI is launched. Clean installations include five base adapters:
+An **engine** describes how a CLI is launched. Clean installations include these base adapters:
 
 - Claude Code
 - Codex
 - Codex-VL
 - Pi
+- Agy — Linux and macOS only (auth delegated to Agy's local login; `standard`/`unsafe` permission policies). On Android/Termux use the Shell adapter with a per-cell `agy` command.
 - Shell
 
 The provider catalog is scoped to the selected CLI rather than to a machine-specific setup:
@@ -157,9 +158,11 @@ directly without a shell after trust-boundary validation.
 
 The Shell engine resolves `$SHELL` or a trusted platform shell when the cell starts; executable
 paths are not stored in Fleet definitions or backups. Leaving its command empty opens an
-interactive login shell. A configured command is passed as one opaque argument to that shell's
-`-lc`, runs once without restart supervision, and then leaves the cell stopped. Shell does not
-accept prompts, models or unsafe permission policy.
+interactive login shell. A configured command is passed as one opaque argument through the
+private launch broker, runs once without restart supervision, and then leaves the cell stopped.
+Known POSIX shells use an interactive login invocation (`-lic`) so the user's configured PATH is
+available; custom shells retain the conservative `-lc` contract. Shell does not accept prompts,
+models or unsafe permission policy.
 
 OpenRouter is first-class for Claude Code and Codex-VL. Claude uses OpenRouter's Anthropic
 Messages compatibility endpoint, while Codex-VL uses the beta, stateless Responses endpoint
@@ -213,6 +216,11 @@ Desktop decks place multiple live terminals in a saved tiled layout. Decks remai
 the current PWA by default; `↗` detaches one into another browser window. Session and deck order
 can be changed with pointer drag-and-drop or keyboard controls and is saved automatically.
 
+The top deck bar groups workspaces by owner node. Clicking a node name expands or collapses its
+decks; newly seen nodes start collapsed so connected-but-idle machines remain available without
+occupying the bar. Every deck carries a compact activity dot, and collapse choices are stored in
+the current browser and synchronized across its open NexusCrew windows.
+
 On mobile, locations are independently collapsible and filterable by all, pinned, active, off,
 or technical sessions. The same owner-qualified ordering model is used by compact and expanded
 desktop views. Managed terminals use the logical Fleet cell name as their visible title; tmux
@@ -229,6 +237,17 @@ multiline prompts use the terminal application's bracketed-paste mode; clipboard
 dropped files are stored in the selected session inbox and their paths are inserted without
 submitting Enter.
 
+The two-row mobile key bar can also show a full-height Enter key beside Page Up/Page Down, so
+interactive terminal choices can be confirmed without opening the software keyboard. By default,
+key-bar and speech-to-text actions keep that keyboard closed, while a nearby double tap inside the
+terminal explicitly opens it. **Settings → Input** can change the terminal gesture, hide the Enter
+key, or allow key-bar and voice actions to retain the keyboard. The key bar also has a
+**compact** layout (one row with an expand toggle that temporarily reveals the full key set
+without changing the preference), and alternate-screen TUIs (vim/less/htop) receive vertical
+gestures as raw Page Up/Page Down while normal and readonly terminals keep server-side scroll.
+These preferences are browser-local and are synchronized between open NexusCrew windows for
+the same origin.
+
 The input composer can expand for longer prompts. Each owner-qualified tmux cell keeps its own
 draft, size preference and bounded prompt history in the current browser, including safe
 ArrowUp/ArrowDown recall at textarea boundaries. This browser-local state is not federated or
@@ -264,9 +283,19 @@ need direct SSH reachability to one another.
 
 Reverse ports are reserved across active and pending pairings, probed before use and protected
 by a persistent uniqueness check. Share is stored as desired state: failed activation rolls back
-to private, while a failed deactivation remains private and is reconciled after restart. A stale
-same-name peer or a late allocation collision returns an actionable conflict instead of silently
-creating a duplicate record or consuming the invitation.
+to private. Deactivation first saves private intent, then asks the hub to withdraw the node over
+the still-live private forward, and only after that acknowledgement removes the reverse channel.
+If the hub cannot acknowledge the revocation, Settings refreshes to the saved private state and
+shows that hub reconciliation is still pending; bounded boot retries continue without claiming
+that remote removal already completed. A stale same-name peer or a late allocation collision
+returns an actionable conflict instead of silently creating a duplicate record or consuming the
+invitation.
+
+Private pairing is administrative inventory, not operational publication. A paired client can
+remain listed as **private** in Settings so it can be reconnected or shared again, but it is absent
+from routable topology, owner/deck bars and MCP cell/deck discovery. Temporary loss of reachability
+does not revoke consent: an authorized node remains visible as stale/offline until a successful
+authoritative refresh either restores it or confirms its withdrawal.
 
 The Share control reports desired publication separately from verified tunnel reachability. If a
 detached process survives an upgrade with stale `-R` arguments, **Reconnect and reconcile** applies
@@ -362,6 +391,7 @@ It is intended for AI sessions running inside managed tmux cells.
 | `nc_inbox` | List files received by the caller |
 | `nc_deck` | Discover owner-qualified decks containing the calling tmux session |
 | `nc_cells` | List authorized active and inactive Fleet cells across visible nodes |
+| `nc_cell_diagnostics` | Read the redacted Shell command and latest bounded start/spawn failure for one exact local cell |
 | `nc_send_cell` | Submit bounded text to one exact active cell returned by `nc_cells` |
 | `nc_identity` | Read-only identity diagnostics; callable with no session and no token |
 
@@ -412,9 +442,15 @@ The caller is resolved, in order, from its tmux session (`tmux display-message -
 then from the `NEXUSCREW_MCP_SESSION` fallback, then not at all. Codex/Codex-VL launch MCP stdio
 processes with a cleared environment, so those clients must explicitly allowlist the identity
 env vars for the server to observe them; otherwise the identity-gated tools (`nc_ask`, `nc_send_file`,
-`nc_deck`, `nc_send_cell`, `nc_inbox`) stay fail-closed with a stable
+`nc_deck`, `nc_cell_diagnostics`, `nc_send_cell`, `nc_inbox`) stay fail-closed with a stable
 `NEXUSCREW_MCP_IDENTITY_*` code, while `nc_notify` degrades to an unknown sender.
 
+`nc_cell_diagnostics` accepts an exact owner-qualified ID returned by `nc_cells`, but only when
+that target belongs to the local node and the caller is an active local Fleet cell. It does not
+query remote nodes or add commands to the federated directory. The returned command is bounded
+and credential-redacted; the failure is a closed `{status, code, phase}` cause rather than raw
+stderr, paths, environment values, prompts or tokens.
+
 ## Configuration
 
 Runtime state is local to the current user:
@@ -469,7 +505,7 @@ See [CHANGELOG.md](CHANGELOG.md) for released changes.
 
 ## Status
 
-The current stable release is **v0.8.29** on npm and GitHub.
+The current stable release is **v0.8.31** on npm and GitHub.
 
 ## License