@mmmbuto/nexuscrew 0.8.30 → 0.8.31

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.8.31 — 2026-07-22 — "Safe Identity"
+
+- **tmux session naming for dotted cell ids.** tmux silently normalizes `.` to `_`
+  in session names, so a cell whose id contains a dot (e.g. `agy.native`) could no
+  longer be targeted by its nominal `cloud-<id>` name. Dotted ids now map
+  deterministically to a dot-free, collision-free session name (`cloud-v2-…`, 55
+  chars); ids without a dot keep the historical `cloud-<id>` name, so the existing
+  sessions are never renamed. The real `tmuxSession` for any cell is always
+  available from `nc_cells` and the Fleet UI — use that rather than guessing
+  `cloud-<Cell>` for dotted ids. Cell launches are now staged (inert placeholder →
+  window-local `remain-on-exit` on `@N` → `respawn-pane` on `%N`) so setup and
+  early-exit diagnostics use stable tmux object IDs. Any pre-existing legacy
+  session is migrated in place via `rename-session -t $N`
+  (preserving the session id and the operator's attach).
+- **Agy as a managed primary client** on Linux and macOS (non-Termux), with auth
+  delegated to Agy's own local login (no credential store read or copied),
+  `standard`/`unsafe` permission policies (`unsafe` adds
+  `--dangerously-skip-permissions`, consistent with the other clients),
+  free-text model selection, and an optional `--prompt-interactive` prompt passed
+  as the last argument. Termux and Windows keep using Agy through `shell.local`
+  with a per-cell `agy` command. Added to existing installs by an idempotent,
+  non-destructive, platform-aware backfill.
+- **Share revocation now converges as authorization, not availability.** Turning
+  Share off persists private intent, withdraws the node from its hub over the
+  still-live private forward, and only then replaces the local tunnel without
+  its reverse channel. Authorized operational discovery (topology, decks and
+  MCP cell directories) removes the owner after the hub acknowledgement, while
+  a merely unreachable node remains visible as stale/offline. Partial failures
+  remain explicit and are retried with bounded, structured boot diagnostics.
+
+- **Selective mobile-UX PR #1 (UI only).** Three client-only behaviours ported
+  onto the 0.8.31 candidate, no merge of PR #1:
+  - **Optional compact KeyBar.** A new `keybarLayout: "full" | "compact"`
+    preference (default `full`) renders a one-row compact bar with an expand
+    toggle that temporarily reveals the exact full key set without rewriting
+    the stored preference; the tall Enter and `showKeybarEnter=false` (no gap)
+    apply to both layouts. Editable in Settings → Input (IT/EN/ES), reset-safe
+    and synced across windows; a layout change never remounts xterm or
+    reconnects its WebSocket.
+  - **Live-DOM composer submit during IME.** Explicit submit reads
+    `textareaRef.current.value`, syncs the React draft and sends the visible
+    text after newline normalization — preserving the empty no-op, the
+    failed-send draft, history, STT and the focus policy.
+  - **Alternate-screen scroll as PageUp/PageDown.** A pure bounded plan routes
+    writable alternate-screen (vim/less/htop) vertical gestures to raw
+    `ESC[5~`/`ESC[6~` PTY input with a page-sized threshold; normal-screen and
+    any readonly terminal keep the server-side `scroll-up`/`scroll-down`
+    actions. Integrated into both wheel and touch paths without weakening
+    double-tap unlock, long-press selection, multi-touch or VirtualKeyboard.
+
 ## 0.8.30 — 2026-07-22 — "Focused Control"
 
 - Makes every owner/node name in the top deck bar an explicit expand/collapse control. Newly seen

package/README.md

@@ -133,12 +133,13 @@ model, permission policy, optional system prompt, optional Shell command and boo
 a stopped cell opens the same launch sheet on desktop and mobile, so the effective settings can
 be reviewed before the process starts.
 
-An **engine** describes how a CLI is launched. Clean installations include five base adapters:
+An **engine** describes how a CLI is launched. Clean installations include these base adapters:
 
 - Claude Code
 - Codex
 - Codex-VL
 - Pi
+- Agy — Linux and macOS only (auth delegated to Agy's local login; `standard`/`unsafe` permission policies). On Android/Termux use the Shell adapter with a per-cell `agy` command.
 - Shell
 
 The provider catalog is scoped to the selected CLI rather than to a machine-specific setup:
@@ -240,8 +241,12 @@ The two-row mobile key bar can also show a full-height Enter key beside Page Up/
 interactive terminal choices can be confirmed without opening the software keyboard. By default,
 key-bar and speech-to-text actions keep that keyboard closed, while a nearby double tap inside the
 terminal explicitly opens it. **Settings → Input** can change the terminal gesture, hide the Enter
-key, or allow key-bar and voice actions to retain the keyboard. These preferences are browser-local
-and are synchronized between open NexusCrew windows for the same origin.
+key, or allow key-bar and voice actions to retain the keyboard. The key bar also has a
+**compact** layout (one row with an expand toggle that temporarily reveals the full key set
+without changing the preference), and alternate-screen TUIs (vim/less/htop) receive vertical
+gestures as raw Page Up/Page Down while normal and readonly terminals keep server-side scroll.
+These preferences are browser-local and are synchronized between open NexusCrew windows for
+the same origin.
 
 The input composer can expand for longer prompts. Each owner-qualified tmux cell keeps its own
 draft, size preference and bounded prompt history in the current browser, including safe
@@ -278,9 +283,19 @@ need direct SSH reachability to one another.
 
 Reverse ports are reserved across active and pending pairings, probed before use and protected
 by a persistent uniqueness check. Share is stored as desired state: failed activation rolls back
-to private, while a failed deactivation remains private and is reconciled after restart. A stale
-same-name peer or a late allocation collision returns an actionable conflict instead of silently
-creating a duplicate record or consuming the invitation.
+to private. Deactivation first saves private intent, then asks the hub to withdraw the node over
+the still-live private forward, and only after that acknowledgement removes the reverse channel.
+If the hub cannot acknowledge the revocation, Settings refreshes to the saved private state and
+shows that hub reconciliation is still pending; bounded boot retries continue without claiming
+that remote removal already completed. A stale same-name peer or a late allocation collision
+returns an actionable conflict instead of silently creating a duplicate record or consuming the
+invitation.
+
+Private pairing is administrative inventory, not operational publication. A paired client can
+remain listed as **private** in Settings so it can be reconnected or shared again, but it is absent
+from routable topology, owner/deck bars and MCP cell/deck discovery. Temporary loss of reachability
+does not revoke consent: an authorized node remains visible as stale/offline until a successful
+authoritative refresh either restores it or confirms its withdrawal.
 
 The Share control reports desired publication separately from verified tunnel reachability. If a
 detached process survives an upgrade with stale `-R` arguments, **Reconnect and reconcile** applies
@@ -490,7 +505,7 @@ See [CHANGELOG.md](CHANGELOG.md) for released changes.
 
 ## Status
 
-The current stable release is **v0.8.30** on npm and GitHub.
+The current stable release is **v0.8.31** on npm and GitHub.
 
 ## License