@mmmbuto/nexuscrew 0.8.30 → 0.8.31

package/lib/fleet/launch.js

@@ -23,6 +23,7 @@ const path = require('node:path');
 const { execFile } = require('node:child_process');
 const { minimalRuntimeEnv } = require('../runtime/env.js');
 const { codeOf, phaseOf } = require('./causes.js');
+const { isTmuxSafeName, tmuxSessionForCell } = require('./definitions.js');
 
 // Env minimale controllato dal service (design §9a). Allowlist DURA: le definizioni
 // non possono toccare PATH/loader-key (parseDefinitions le rifiuta gia' in env);
@@ -129,6 +130,128 @@ function tmuxExec(tmuxBin, args, { env, timeoutMs = 10000 } = {}) {
 
 function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
 
+function tmuxMigrationError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function boundedTmuxFailure(result) {
+  return String(result?.stderr || result?.err?.message || 'errore tmux')
+    .replace(/[\x00-\x1f\x7f]+/g, ' ').trim().slice(0, 240) || 'errore tmux';
+}
+
+// Migrazione identita' tmux (design §3.2). Prima costruisce e valida TUTTO il
+// piano: nessun rename parte se una sessione legacy normalizzata e' rivendicata
+// da piu celle (es. a.b vs a_b), se legacy+target safe coesistono o se il target
+// non e' tmux-safe. Solo dopo il preflight rinomina via `$N`; qualunque errore e'
+// propagato con causa bounded e impedisce la persistenza di fleet.json. I rename
+// gia riusciti prima di un errore operativo restano comunque idempotenti al boot
+// successivo, mentre lo store precedente rimane intatto.
+async function migrateLegacyTmuxSessions(tmuxBin, defs, { readonly = false } = {}) {
+  const cells = defs && Array.isArray(defs.cells) ? defs.cells : [];
+  const legacyMap = defs?.legacyTmuxSessions instanceof Map ? defs.legacyTmuxSessions : new Map();
+  const candidates = [];
+  for (const cell of cells) {
+    if (!cell || typeof cell.id !== 'string') continue;
+    const legacyRaw = legacyMap.get(cell.id) || (cell.id.includes('.') ? `cloud-${cell.id}` : '');
+    if (!legacyRaw) continue;
+    const safe = cell.tmuxSession || tmuxSessionForCell(cell.id);
+    if (!isTmuxSafeName(safe)) {
+      throw tmuxMigrationError('TMUX_MIGRATION_INVALID_TARGET',
+        `migrazione tmux bloccata per ${cell.id}: target safe non valido`);
+    }
+    candidates.push({ id: cell.id, legacyRaw, legacyNorm: legacyRaw.replace(/\./g, '_'), safe });
+  }
+  if (!candidates.length || readonly) {
+    return {
+      migrated: [], reason: readonly ? 'readonly' : 'none',
+      needsPersistence: legacyMap.size > 0,
+    };
+  }
+  const listing = await tmuxExec(tmuxBin,
+    ['list-sessions', '-F', '#{session_id}\t#{session_name}'], { env: minimalEnv() });
+  if (listing.err) {
+    const detail = boundedTmuxFailure(listing);
+    if (/no server running|failed to connect|connection refused|no such file.*tmux/i.test(detail)) {
+      return { migrated: [], reason: 'no-tmux-server', needsPersistence: legacyMap.size > 0 };
+    }
+    throw tmuxMigrationError('TMUX_MIGRATION_LIST_FAILED',
+      `migrazione tmux: elenco sessioni non disponibile (${detail})`);
+  }
+  const realByName = new Map(); // session_name -> session_id ($N)
+  for (const line of listing.stdout.split('\n')) {
+    const [sid, sname] = line.split('\t');
+    if (sid && sname) realByName.set(String(sname).trim(), String(sid).trim());
+  }
+
+  const ownersBySafe = new Map(cells.map((cell) => [cell.tmuxSession, cell.id]));
+  const claimsByReal = new Map();
+  for (const candidate of candidates) {
+    for (const name of new Set([candidate.legacyRaw, candidate.legacyNorm])) {
+      if (!realByName.has(name)) continue;
+      const claims = claimsByReal.get(name) || [];
+      claims.push(candidate);
+      claimsByReal.set(name, claims);
+    }
+  }
+
+  const activeNamesByCell = new Map();
+  for (const [realName, claims] of claimsByReal) {
+    for (const claim of claims) {
+      const names = activeNamesByCell.get(claim.id) || [];
+      names.push(realName);
+      activeNamesByCell.set(claim.id, names);
+    }
+  }
+  for (const [cellId, names] of activeNamesByCell) {
+    if (names.length > 1) {
+      throw tmuxMigrationError('TMUX_MIGRATION_AMBIGUOUS',
+        `migrazione tmux ambigua per ${cellId}: piu sessioni legacy (${names.join(', ')})`);
+    }
+  }
+
+  const operations = [];
+  for (const [realName, claims] of claimsByReal) {
+    if (claims.length !== 1) {
+      throw tmuxMigrationError('TMUX_MIGRATION_AMBIGUOUS',
+        `migrazione tmux ambigua: ${realName} corrisponde a ${claims.map((c) => c.id).join(', ')}`);
+    }
+    const candidate = claims[0];
+    const owner = ownersBySafe.get(realName);
+    if (owner && owner !== candidate.id) {
+      throw tmuxMigrationError('TMUX_MIGRATION_AMBIGUOUS',
+        `migrazione tmux ambigua: ${realName} e gia assegnata a ${owner}`);
+    }
+    const legacyId = realByName.get(realName);
+    if (!/^\$[0-9]+$/.test(legacyId || '')) {
+      throw tmuxMigrationError('TMUX_MIGRATION_INVALID_ID',
+        `migrazione tmux bloccata per ${candidate.id}: session ID non valido`);
+    }
+    const safeId = realByName.get(candidate.safe);
+    if (safeId && safeId !== legacyId) {
+      throw tmuxMigrationError('TMUX_MIGRATION_TARGET_EXISTS',
+        `migrazione tmux bloccata per ${candidate.id}: target ${candidate.safe} gia esistente`);
+    }
+    operations.push({ ...candidate, legacyId, realName });
+  }
+
+  const migrated = [];
+  for (const operation of operations) {
+    const rn = await tmuxExec(tmuxBin,
+      ['rename-session', '-t', operation.legacyId, operation.safe], { env: minimalEnv() });
+    if (rn.err) {
+      throw tmuxMigrationError('TMUX_MIGRATION_RENAME_FAILED',
+        `migrazione tmux fallita per ${operation.id} (${boundedTmuxFailure(rn)})`);
+    }
+    migrated.push({ id: operation.id, from: operation.realName, to: operation.safe });
+  }
+  return {
+    migrated, reason: 'ok',
+    needsPersistence: legacyMap.size > 0 || migrated.length > 0,
+  };
+}
+
 // Policy caratteri del prompt send-keys (§9e): ammette stampabili + \t \n \r;
 // rifiuta ESC(0x1b) e gli altri byte di controllo (niente marker bracketed-paste
 // iniettabili). parseDefinitions caps solo la lunghezza: questo e' defense-in-depth.
@@ -243,6 +366,7 @@ module.exports = {
   promptCharsOk,
   composeClientInvocation,
   composeLaunchArgv,
+  migrateLegacyTmuxSessions,
   waitAlive,
   waitStablePane,
   injectPrompt,

package/lib/fleet/managed.js

@@ -61,7 +61,7 @@ const ALIBABA_PI_MODELS = Object.freeze([
 
 const CUSTOM_KEYS = ['displayName', 'protocol', 'baseUrl', 'envKey', 'providerId'];
 const MANAGED_KEYS = new Set(['client', 'provider', 'credentialProfile', 'model', 'permissionPolicy', ...CUSTOM_KEYS]);
-const CLIENT_LABELS = Object.freeze({ claude: 'Claude Code', codex: 'Codex', 'codex-vl': 'Codex-VL', pi: 'Pi', shell: 'Shell' });
+const CLIENT_LABELS = Object.freeze({ claude: 'Claude Code', codex: 'Codex', 'codex-vl': 'Codex-VL', pi: 'Pi', agy: 'Agy', shell: 'Shell' });
 const PROVIDER_ID_RE = /^[a-z][a-z0-9_-]{0,31}$/;
 
 function validBaseUrl(value) {
@@ -128,6 +128,16 @@ const CATALOG = Object.freeze([
   { id: 'pi.ollama', client: 'pi', provider: 'ollama', label: 'Ollama local', auth: 'none', protocol: 'openai-completions', piProvider: 'ollama', requiresModel: true, core: true, piExtension: { baseUrl: 'http://127.0.0.1:11434/v1', apiKey: 'ollama' } },
   { id: 'pi.zai', client: 'pi', provider: 'zai', label: 'Z.AI', auth: 'ZAI_API_KEY', protocol: 'pi_native', piProvider: 'zai', core: true },
   { id: 'pi.custom', client: 'pi', provider: 'custom', label: 'Custom provider', auth: 'dynamic', protocol: 'openai-responses', protocols: ['openai-responses', 'anthropic-messages', 'openai-completions', 'google-generative-ai'], custom: true, core: true },
+
+  // Agy: client gestito primario (Linux/macOS non-Termux). Auth delegata al
+  // login locale del client (nessuno store letto/copiato). Nessun remote-control
+  // NexusCrew; permission default 'standard' (unsafe aggiunge --dangerously-skip-
+  // permissions, allineato agli altri client). NON e' un default seed (non va nel
+  // fleet.json fresco su piattaforme non supportate): viene aggiunto solo da un
+  // backfill platform-aware (builtin.js) su Linux/macOS non-Termux. Qui figura
+  // (core) per la UI; describeManaged lo dichiara non configurato altrove.
+  // Termux/Windows restano fuori dal primary: l'utente usa agy via shell.local.
+  { id: 'agy.native', client: 'agy', provider: 'native', label: 'Agy', auth: 'login', protocol: 'agy_native', core: true },
 ]);
 
 function profileFor(client, provider, credentialProfile) {
@@ -202,6 +212,18 @@ function defaultShellEngine() {
   };
 }
 
+// Engine Agy per il backfill platform-aware (builtin.js): standard di default,
+// auth delegata al login locale, niente remote-control. Non e' un default seed.
+function defaultAgyEngine() {
+  const profile = CATALOG.find((entry) => entry.id === 'agy.native');
+  return {
+    id: profile.id,
+    label: CLIENT_LABELS.agy,
+    rc: false,
+    managed: { client: 'agy', provider: 'native', model: '', permissionPolicy: 'standard' },
+  };
+}
+
 function parseAssignments(raw) {
   const out = {};
   for (const line of raw.split(/\r?\n/)) {
@@ -485,17 +507,30 @@ function describeManaged(spec, cfg = {}) {
   const delegatedPiAuth = profile.client === 'pi' && profile.provider !== 'custom'
     && profile.delegatePiAuth !== false;
   const authConfigured = delegatedPiAuth || profile.auth === 'login' || profile.auth === 'none' || !!cred.value;
+  let configured = !!binary && authConfigured;
+  let reason = !binary ? `client ${profile.client} not found` : (!authConfigured
+    ? `credential ${cred.envKey} missing — set it on this device`
+    : 'ready');
+  // Agy e' un client primario supportato solo su Linux/macOS non-Termux.
+  // Rilevazione Termux via termuxRuntimePaths (non solo process.platform): un
+  // Node che riporta 'linux' sotto proot/Termux viene comunque intercettato.
+  if (normalized.client === 'agy') {
+    const platform = cfg.platform || process.platform;
+    const termux = platform === 'android' || termuxRuntimePaths(cfg.env || process.env, { platform, home }) !== null;
+    if (termux || (platform !== 'linux' && platform !== 'darwin')) {
+      configured = false;
+      reason = 'agy non supportato su questa piattaforma (usa shell.local con command agy)';
+    }
+  }
   return {
     client: profile.client, clientLabel: CLIENT_LABELS[profile.client], provider: profile.provider,
     credentialProfile: normalized.credentialProfile || '', model: normalized.model,
     permissionPolicy: normalized.permissionPolicy, protocol: normalized.protocol || profile.protocol,
     endpoint: normalized.baseUrl || profile.endpoint || '', auth: cred.envKey, authConfigured,
     credentialSource: authConfigured ? cred.source : 'missing',
-    configured: !!binary && authConfigured, models: [...(profile.models || [])], defaultModel: profile.model || '',
+    configured, models: [...(profile.models || [])], defaultModel: profile.model || '',
     binary: binary || '', displayName: normalized.displayName || profile.label,
-    reason: !binary ? `client ${profile.client} not found` : (!authConfigured
-      ? `credential ${cred.envKey} missing — set it on this device`
-      : 'ready'),
+    reason,
   };
 }
 
@@ -644,7 +679,7 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
   if (spec.client === 'pi' || spec.client === 'shell') effectivePolicy = 'standard';
   info.permissionPolicy = effectivePolicy;
   if (effectivePolicy === 'unsafe') {
-    if (spec.client === 'claude') args.push('--dangerously-skip-permissions');
+    if (spec.client === 'claude' || spec.client === 'agy') args.push('--dangerously-skip-permissions');
     if (spec.client === 'codex' || spec.client === 'codex-vl') args.push('--dangerously-bypass-approvals-and-sandbox');
   }
   let shellOneShot = false;
@@ -770,6 +805,13 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
     if (spec.provider !== 'native') args.push('--provider', spec.provider === 'custom' ? spec.providerId : profile.piProvider);
     if (model) args.push('--model', model);
     if (spec.provider === 'alibaba-token-plan' && model === 'qwen3.8-max-preview') args.push('--thinking', 'xhigh');
+  } else if (spec.client === 'agy') {
+    // Agy delega l'autenticazione al proprio login locale (auth: 'login'): niente
+    // env provider, niente credenziali copiate. Argv diretto: --model prima del
+    // prompt; --prompt-interactive e' l'ultima coppia (il prompt value e' accodato
+    // dal push generico qui sotto). Senza prompt parte il TUI interattivo `agy`.
+    if (model) args.push('--model', model);
+    if (cell?.prompt) args.push('--prompt-interactive');
   }
   if (spec.client !== 'shell' && cell?.prompt) args.push(cell.prompt);
   let command = info.binary;
@@ -800,7 +842,7 @@ module.exports = {
   CATALOG, OLLAMA_CLOUD_MODELS, OLLAMA_CONTEXT, ALIBABA_TOKEN_PLAN_MODELS,
   ALIBABA_CODEX_MODELS, ALIBABA_TOKEN_PLAN_CONTEXT, ALIBABA_PI_MODELS,
   CLIENT_LABELS, normalizeManagedSpec,
-  defaultDefinitions, defaultShellEngine, describeManaged, describeCatalogCredential, discoverOllamaModels, resolveManagedEngine, needsExplicitNode,
+  defaultDefinitions, defaultShellEngine, defaultAgyEngine, describeManaged, describeCatalogCredential, discoverOllamaModels, resolveManagedEngine, needsExplicitNode,
   discoverPiModels, parseEnvFile, parseProviderShellFile, findBinary, publicCatalog, writePiProviderExtension,
   providerKeyPaths, parseProviderKeyFiles, credentialSources, credential,
   ensureKimiClaudeConfig, ensureAlibabaClaudeConfig, resolveInteractiveShell,

package/lib/fleet/provider.js

@@ -16,7 +16,7 @@ async function selectProvider(cfg = {}) {
   if (cfg.fleetEnabled === false) return disabled('fleet disabilitata (fleetEnabled=false)');
   if (cfg.builtinEnabled === false) return disabled('fleet builtin disabilitata (builtinEnabled=false)');
   const fleet = await createBuiltinFleet({ ...cfg, fleetProviderReason: 'NexusCrew builtin fleet' });
-  if (!fleet.available) return disabled('fleet.json mancante o invalido (fail-closed)');
+  if (!fleet.available) return disabled(fleet.reason || 'fleet.json mancante o invalido (fail-closed)');
   return { mode: 'builtin', reason: 'NexusCrew builtin fleet', fleet };
 }
 

package/lib/fleet/runtime.js

@@ -21,7 +21,7 @@ const {
 } = require('./managed.js');
 const {
   httpError, minimalEnv, tmuxExec,
-  composeClientInvocation, composeLaunchArgv,
+  composeClientInvocation,
   waitAlive, waitStablePane, injectPrompt,
   redactSecrets, sanitizeEarlyDiagnostic,
 } = require('./launch.js');
@@ -216,29 +216,105 @@ function createBuiltinRuntime(ctx) {
       args: [path.join(__dirname, 'cell-exec.js'), '--socket', ticket.socketPath, '--nonce', ticket.nonce],
       env: {}, promptMode: 'managed-argv',
     };
-    const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine: tmuxLaunchEngine, cell });
-    argv.splice(2, 0, '-P', '-F', '#{pane_id}');
-    // Mantieni il pane morto solo durante la finestra di readiness: permette di
-    // catturare sia un errore reale del client sia l'exit immediato di un command
-    // Shell. Il separatore e' interpretato da tmux (execFile argv diretto), non
-    // dalla shell che esegue il command configurato.
-    argv.push(';', 'set-option', '-w', '-t', `=${cell.tmuxSession}:`, 'remain-on-exit', 'on');
-    const launch = await tmuxExec(tmuxBin, argv, { env: minimalEnv() });
-    if (launch.err) {
+    const tmuxChild = composeClientInvocation(tmuxLaunchEngine, cell);
+
+    // Avvio staged (design §3.3): crea il pane con un placeholder inerte trusted
+    // (cell-hold.js), arma remain-on-exit window-local sul @N, poi respawn-pane -k
+    // verso cell-exec sul %N esatto. Cosi' remain-on-exit e' gia' ON quando il vero
+    // child puo' terminare: nessuna finestra scomparsa, nessun NEW_SESSION_FAILED
+    // che maschera l'exit reale. Il nome sessione e' gia' validato tmux-safe (v2
+    // per id puntati, definitions.js); gli step critici usano gli ID restituiti
+    // da tmux ($N/@N/%N). respawn-pane -k preserva il pane ID: il %N catturato
+    // qui resta valido per readiness e prompt. Nessuna shell string, nessun
+    // command/env/prompt del child nell'argv tmux (solo cell-hold, poi cell-exec
+    // via broker). Nessun sleep come sincronizzazione.
+    const CELL_HOLD = path.join(__dirname, 'cell-hold.js');
+    const create = await tmuxExec(tmuxBin,
+      ['new-session', '-d', '-s', cell.tmuxSession, '-c', realCwd,
+        '-P', '-F', '#{session_id}\t#{window_id}\t#{pane_id}',
+        process.execPath, CELL_HOLD],
+      { env: minimalEnv() });
+    if (create.err) {
+      // new-session fallita: nessuna sessione creata. Revoca il ticket (il child
+      // non partira' mai) prima di propagare l'errore.
+      try { await launchBroker.revoke?.(ticket.nonce); } catch (_) { /* best-effort */ }
       // Redazione (§9h): lo stderr di tmux puo' ecoare argv/env del comando lanciato.
-      const dup = /duplicate session/i.test(launch.stderr);
+      const dup = /duplicate session/i.test(create.stderr);
       const why = dup
         ? 'sessione già in esecuzione'
-        : `tmux new-session failed: ${redactSecrets(launch.stderr.trim() || launch.err.message, launchEngine, cell)}`;
+        : `tmux new-session failed: ${redactSecrets(create.stderr.trim() || create.err.message, launchEngine, cell)}`;
       throw httpError(dup ? 409 : 500, why, null,
         { phase: 'new-session', code: dup ? 'SESSION_DUPLICATE' : 'NEW_SESSION_FAILED' });
     }
+    const createdIds = create.stdout.trim().split('\n')[0].split('\t');
+    const sessionId = /^\$[0-9]+$/.test(createdIds[0] || '') ? createdIds[0] : '';
+    const windowId = /^@[0-9]+$/.test(createdIds[1] || '') ? createdIds[1] : '';
+    const paneId = /^%[0-9]+$/.test(createdIds[2] || '') ? createdIds[2] : '';
+    const resolveSessionIdForCleanup = async () => {
+      if (sessionId) return sessionId;
+      // Output parziale anomalo: risali al $N da un @N/%N gia restituito. Come
+      // ultima recovery enumera id+nomi e usa il nome safe solo per SELEZIONARE
+      // l'id; kill-session non torna mai al target nominale richiesto.
+      for (const target of [paneId, windowId]) {
+        if (!target) continue;
+        const shown = await tmuxExec(tmuxBin,
+          ['display-message', '-p', '-t', target, '#{session_id}'],
+          { env: minimalEnv(), timeoutMs: 2000 });
+        const resolved = shown.stdout.trim();
+        if (!shown.err && /^\$[0-9]+$/.test(resolved)) return resolved;
+      }
+      const listed = await tmuxExec(tmuxBin,
+        ['list-sessions', '-F', '#{session_id}\t#{session_name}'],
+        { env: minimalEnv(), timeoutMs: 2000 });
+      if (listed.err) return '';
+      for (const line of listed.stdout.split('\n')) {
+        const [sid, name] = line.split('\t');
+        if (name === cell.tmuxSession && /^\$[0-9]+$/.test(sid || '')) return sid;
+      }
+      return '';
+    };
+    const cleanupLaunch = async () => {
+      const stableSessionId = await resolveSessionIdForCleanup();
+      if (stableSessionId) {
+        await tmuxExec(tmuxBin, ['kill-session', '-t', stableSessionId],
+          { env: minimalEnv(), timeoutMs: 2000 });
+      }
+      try { await launchBroker.revoke?.(ticket.nonce); } catch (_) { /* best-effort */ }
+    };
+    if (!sessionId || !windowId || !paneId) {
+      await cleanupLaunch();
+      throw httpError(500, 'tmux new-session: ID sessione/finestra/pane non restituito', null,
+        { phase: 'new-session', code: 'NEW_SESSION_FAILED' });
+    }
+    // Arma remain-on-exit window-local sul @N: la finestra esiste (il placeholder
+    // la tiene viva), quindi niente race con un child che termini nel frattempo.
+    const arm = await tmuxExec(tmuxBin,
+      ['set-option', '-w', '-t', windowId, 'remain-on-exit', 'on'],
+      { env: minimalEnv() });
+    if (arm.err) {
+      await cleanupLaunch();
+      throw httpError(500,
+        `tmux set-option remain-on-exit failed: ${redactSecrets(arm.stderr.trim() || arm.err.message, launchEngine, cell)}`,
+        null, { phase: 'new-session', code: 'NEW_SESSION_FAILED' });
+    }
+    // Sostituisci il placeholder con il vero child (cell-exec via broker) sul %N.
+    const respawn = await tmuxExec(tmuxBin,
+      ['respawn-pane', '-k', '-c', realCwd, '-t', paneId, tmuxChild.command, ...tmuxChild.args],
+      { env: minimalEnv() });
+    if (respawn.err) {
+      // respawn fallito dopo issue(): il nonce va revocato/consumato prima
+      // dell'errore (design §3.3), poi cleanup della sessione-pannello.
+      await cleanupLaunch();
+      throw httpError(500,
+        `tmux respawn-pane failed: ${redactSecrets(respawn.stderr.trim() || respawn.err.message, launchEngine, cell)}`,
+        null, { phase: 'new-session', code: 'NEW_SESSION_FAILED' });
+    }
 
     // `tmux new-session -d` can return 0 even when the launched CLI exits a
     // moment later (missing login, bad model, incompatible provider).  Without
     // this readiness gate the PWA reported success and then showed nothing.
     // Always verify liveness, including cells without a system prompt.
-    const paneId = launch.stdout.trim().split('\n')[0] || '';
+
     const readiness = paneId.startsWith('%')
       ? await waitStablePane(tmuxBin, paneId, { env: minimalEnv(), readyMs })
       : { alive: await waitAlive(tmuxBin, cell.tmuxSession, { env: minimalEnv(), readyMs }), status: null, target: null };
@@ -251,7 +327,7 @@ function createBuiltinRuntime(ctx) {
       }
       // remain-on-exit era soltanto diagnostico: nessun pane morto deve restare
       // nella Fleet o nella lista tmux dopo aver raccolto l'errore.
-      await tmuxExec(tmuxBin, ['kill-session', '-t', `=${cell.tmuxSession}`], { env: minimalEnv(), timeoutMs: 2000 });
+      await cleanupLaunch();
       cache = { ...cache, at: 0 };
       // Un command Shell completato rapidamente con exit 0 e' un one-shot
       // riuscito. Qualunque altro exit immediato e' invece osservabile come

package/lib/mcp/tools.js

@@ -295,7 +295,8 @@ const TOOLS = [
           const members = orderedDeckMembers(deck).map((member) => ({
             ...member,
             ownerId: memberOwnerId(member, source.owner, source.ownerTopology),
-          }));
+          })).filter((member) => member.ownerId === localNodeId
+            || (member.ownerId && viewerById.has(member.ownerId)));
           if (!members.some((member) => member.ownerId === localNodeId && member.tmuxSession === tmuxSession)) continue;
           decks.push({
             id: `${source.owner.instanceId}:${deck.name}`,

package/lib/proxy/federation.js

@@ -310,7 +310,7 @@ async function reconcilePeerShare(opts = {}) {
     throw new Error((health && health.detail) || 'hub non raggiungibile per riconciliare Share');
   }
   const attempts = Number.isInteger(opts.notifyAttempts)
-    ? Math.max(1, Math.min(opts.notifyAttempts, 6)) : (shared ? 3 : 1);
+    ? Math.max(1, Math.min(opts.notifyAttempts, 6)) : 3;
   let lastError = null;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
@@ -324,6 +324,67 @@ async function reconcilePeerShare(opts = {}) {
   throw lastError || new Error('riconciliazione Share fallita');
 }
 
+// Runner di riconciliazione Share OFF al boot (design piano §3.2.8). Per-peer,
+// no-overlap (un solo runner attivo per nome), al massimo tre round per processo,
+// backoff nominato 0/1000/5000 ms (iniettabile). Re-read dello stato desiderato
+// (nodes.json) prima di ogni round: abort se non e' piu' shared:false (es. il peer
+// e' stato ri-condiviso o rimosso). Emette SHARE_REVOKE_PENDING/RECOVERED/EXHAUSTED
+// tramite il callback diagnostico (una transizione ciascuno, no spam). Nessun
+// timer infinito, nessuna retry storm process-wide, nessun retry di ON sotto la
+// policy OFF. Il backoff e' un delay nominato usato solo fra round di fallimento.
+const SHARE_REVOKE_BACKOFF_MS = Object.freeze([0, 1000, 5000]);
+const shareRevokeRunning = new Set(); // per-peer no-overlap (scope modulo)
+function runShareRevokeBoot({
+  node, nodesPath, fetchImpl = fetch, diagnostics,
+  backoff = SHARE_REVOKE_BACKOFF_MS, delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  runningSet = shareRevokeRunning, reconcileImpl = reconcilePeerShare,
+  healthAttempts = 3, notifyAttempts = 3, delayMs = 200, timeoutMs = 5000,
+}) {
+  const name = node && typeof node.name === 'string' ? node.name : '';
+  if (!store.NODE_NAME_RE.test(name) || !store.NODE_ID_RE.test(String(node && node.nodeId || ''))
+    || !store.validToken(node && node.token) || typeof nodesPath !== 'string' || !nodesPath
+    || typeof reconcileImpl !== 'function') {
+    return Promise.resolve({ status: 'skipped', reason: 'invalid-input' });
+  }
+  if (runningSet.has(name)) return Promise.resolve({ status: 'already-running' });
+  runningSet.add(name);
+  const emit = (level, code, message, state) => {
+    if (diagnostics && typeof diagnostics.record === 'function') {
+      try { diagnostics.record(level, 'share', code, message, { node: name, state }); } catch (_) { /* best-effort */ }
+    }
+  };
+  return (async () => {
+    emit('warn', 'SHARE_REVOKE_PENDING', 'Share OFF reconciliation pending', 'pending');
+    const slots = Array.from({ length: 3 }, (_, index) => {
+      const candidate = Array.isArray(backoff) ? backoff[index] : SHARE_REVOKE_BACKOFF_MS[index];
+      return Number.isFinite(candidate) ? Math.max(0, Math.min(candidate, 30000)) : SHARE_REVOKE_BACKOFF_MS[index];
+    });
+    for (let round = 0; round < slots.length; round += 1) {
+      try {
+        if (slots[round] > 0) await delay(slots[round]);
+        // Re-read dello stato desiderato immediatamente prima di ogni round.
+        // Un peer rimosso o nuovamente condiviso annulla la policy OFF in coda.
+        const st = store.loadStoreStrict(nodesPath);
+        const fresh = store.getNode(st, name);
+        if (!fresh || fresh.shared !== false) return { status: 'aborted', reason: 'desired-state-changed' };
+        await reconcileImpl({
+          node: fresh, shared: false, fetchImpl,
+          healthAttempts: Math.max(3, Math.min(Number(healthAttempts) || 3, 12)),
+          notifyAttempts: Math.max(3, Math.min(Number(notifyAttempts) || 3, 6)),
+          delayMs: Math.max(0, Math.min(Number(delayMs) || 0, 2000)), timeoutMs,
+        });
+        emit('warn', 'SHARE_REVOKE_RECOVERED', 'Share OFF reconciliation recovered', 'recovered');
+        return { status: 'recovered', rounds: round + 1 };
+      } catch (_) {
+        // Error text is intentionally not recorded: it can contain transport
+        // details. The stable transition code is sufficient for Diagnostics.
+      }
+    }
+    emit('error', 'SHARE_REVOKE_EXHAUSTED', 'Share OFF reconciliation exhausted', 'exhausted');
+    return { status: 'exhausted', rounds: 3 };
+  })().finally(() => { runningSet.delete(name); });
+}
+
 function controlledVisited(req, ingress, instanceId) {
   const raw = ingress ? String(req.headers['x-nexuscrew-visited'] || '') : '';
   const seen = raw ? raw.split(',').filter(Boolean) : [];
@@ -565,5 +626,5 @@ module.exports = {
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS,
   peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource, allowedQuery,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade,
-  probeHealth, waitForHealthyPeer, notifyHubShare, reconcilePeerShare,
+  probeHealth, waitForHealthyPeer, notifyHubShare, reconcilePeerShare, runShareRevokeBoot,
 };

package/lib/server.js

@@ -182,12 +182,28 @@ function createServer(opts = {}) {
           // asincrona chiude la finestra di crash tra write locale e ACK hub
           // senza ritardare il listen del server.
           const reconcileShare = cfg.reconcilePeerShareImpl || federation.reconcilePeerShare;
-          Promise.resolve(reconcileShare({
-            node, shared: node.shared === true, fetchImpl: healthFetch,
-            healthAttempts: 3, notifyAttempts: node.shared === true ? 3 : 1, delayMs: 200,
-          })).catch((e) => {
-            process.stderr.write(`[nexuscrew] peer ${node.name} Share reconcile pending: ${String(e && e.message || e).replace(/Bearer\s+\S+/gi, 'Bearer ***')}\n`);
-          });
+          if (node.shared === true) {
+            Promise.resolve(reconcileShare({
+              node, shared: true, fetchImpl: healthFetch,
+              healthAttempts: 3, notifyAttempts: 3, delayMs: 200,
+            })).catch((e) => {
+              process.stderr.write(`[nexuscrew] peer ${node.name} Share reconcile pending: ${String(e && e.message || e).replace(/Bearer\s+\S+/gi, 'Bearer ***')}\n`);
+            });
+          } else {
+            const runRevoke = cfg.runShareRevokeBootImpl || federation.runShareRevokeBoot;
+            Promise.resolve(runRevoke({
+              node, nodesPath, fetchImpl: healthFetch, diagnostics,
+              reconcileImpl: reconcileShare,
+              healthAttempts: 3, notifyAttempts: 3, delayMs: 200,
+              ...(Array.isArray(cfg.shareRevokeBackoff) ? { backoff: cfg.shareRevokeBackoff } : {}),
+              ...(typeof cfg.shareRevokeDelay === 'function' ? { delay: cfg.shareRevokeDelay } : {}),
+            })).catch(() => {
+              // The production runner contains failures and records the stable
+              // transitions itself. This protects only an injected/custom runner.
+              diagnostics.record('error', 'share', 'SHARE_REVOKE_EXHAUSTED',
+                'Share OFF reconciliation exhausted', { node: node.name, state: 'exhausted' });
+            });
+          }
         }
       }
     }

package/lib/settings/routes.js

@@ -48,7 +48,7 @@ const nodeAliases = require('../nodes/aliases.js');
 const nodesCmds = require('../nodes/commands.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 const peering = require('../nodes/peering.js');
-const { waitForHealthyPeer, notifyHubShare } = require('../proxy/federation.js');
+const { waitForHealthyPeer, notifyHubShare, reconcilePeerShare } = require('../proxy/federation.js');
 const { rotateToken } = require('../auth/token.js');
 const { generateService, installService, installPath: svcInstallPath } = require('../cli/service.js');
 const { detectPlatform, nodeBin, repoRoot, uid } = require('../cli/platform.js');
@@ -573,8 +573,10 @@ function settingsRoutes(deps = {}) {
     const fetchImpl = seams.fetchImpl || fetch;
     const notifyHub = (shared) => notifyHubShare({ node, shared, fetchImpl, timeoutMs: 5000 });
     const ensureLocal = async ({ restart = false } = {}) => {
-      if (restart) nodesTunnel.stopTunnel({ home, name });
-      const started = nodesTunnel.startForward({
+      const stopForward = seams.stopTunnelImpl || nodesTunnel.stopTunnel;
+      const startForward = seams.startForwardImpl || nodesTunnel.startForward;
+      if (restart) stopForward({ home, name });
+      const started = startForward({
         home, node, localAppPort: runtimePort(),
         spawnImpl: seams.spawnImpl, spawnSyncImpl: seams.spawnSyncImpl,
         sshBin: seams.sshBin, logFd: seams.logFd,
@@ -606,27 +608,71 @@ function settingsRoutes(deps = {}) {
       node = nodesStore.getNode(st, name);
       await ensureLocal({ restart: true });
     };
+    const revokeHub = () => reconcilePeerShare({
+      node, shared: false, fetchImpl,
+      healthAttempts: 6, delayMs: 200, notifyAttempts: 3, timeoutMs: 5000,
+      ...(typeof seams.pairDelay === 'function' ? { delay: seams.pairDelay } : {}),
+    });
+    const reconcileOff = async ({ restart = false, unchanged = false } = {}) => {
+      try {
+        // The authenticated hub endpoint is reached through the existing -L.
+        // Revoke before any spec-aware replacement can tear that transport down.
+        await revokeHub();
+      } catch (revokeErr) {
+        return send(res, 502, {
+          error: 'Share disattivato localmente; hub non riconciliato',
+          shared: false, revoked: false, reconcilePending: true,
+          detail: scrubError(revokeErr),
+        });
+      }
+      try {
+        // A changed ON->OFF spec is restarted explicitly; same-state OFF uses
+        // the idempotent spec-aware path, which only replaces a stale -R.
+        await ensureLocal({ restart });
+      } catch (restartErr) {
+        return send(res, 502, {
+          error: 'Share revocato sul hub; riavvio locale non riconciliato',
+          shared: false, revoked: true, localReconcilePending: true,
+          detail: scrubError(restartErr),
+        });
+      }
+      return send(res, 200, {
+        name, shared: false, revoked: true,
+        ...(unchanged ? { unchanged: true, reconciled: true } : {}),
+      });
+    };
 
     try {
       if (node.shared === body.shared) {
         // Persisted intent is not proof of the detached process mode. A stale
         // supervisor can survive an npm upgrade and keep retrying -R even when
-        // the store/UI says private. Re-enter the spec-aware start path before
-        // reconciling the hub, without rewriting nodes.json.
-        await ensureLocal();
-        await notifyHub(body.shared);
-        return send(res, 200, { name, shared: body.shared, unchanged: true, reconciled: true });
+        // the store/UI says private. Same-state OFF revokes first, then enters
+        // the spec-aware start path without rewriting nodes.json.
+        if (body.shared) {
+          await ensureLocal();
+          await notifyHub(true);
+          return send(res, 200, { name, shared: true, unchanged: true, reconciled: true });
+        }
+        return reconcileOff({ unchanged: true });
       }
       if (body.shared) {
         await applyLocal(true);
         await notifyHub(true);
-      } else {
-        // Persist OFF first. If the process dies before the hub ACK, the next
-        // boot starts only -L and reconciles the stored false state.
-        await applyLocal(false);
-        await notifyHub(false);
+        return send(res, 200, { name, shared: true });
       }
-      return send(res, 200, { name, shared: body.shared });
+      // OFF e' fail-safe e crash-durevole (design piano §3.2): persist desired
+      // false -> revoke autenticata sul canale -L ancora vivo -> restart locale
+      // senza -R. MAI restart-before-revoke: il -L e' il canale stesso della
+      // revoca, e un crash prima dell'ACK non puo' mai ripubblicare da intent
+      // stale (il file dice gia' false; il boot riparte -L only + reconcile).
+      // 1) persist desired false (snapshot dei soli campi gia' validati).
+      st = nodesStore.loadStoreStrict(nodesPath);
+      st = nodesStore.updateNode(st, name, { shared: false });
+      nodesStore.atomicWriteStore(nodesPath, st);
+      persistedDesired = false;
+      node = nodesStore.getNode(st, name);
+      // 2-3) revoke sul -L vivo, poi restart locale senza -R.
+      return reconcileOff({ restart: true });
     } catch (e) {
       // Share-on is transactional: a failed hub acknowledgement returns to the
       // safe private -L-only state. Never include remote response bodies/tokens.

package/lib/tmux/lifecycle.js

@@ -43,6 +43,7 @@ function presetArgv(preset, extra) {
 // Pure: argomenti tmux per la create, o null se input invalido.
 function buildCreateArgs(name, realCwd, preset, extraPresets) {
   if (!validSessionName(name) || typeof realCwd !== 'string' || !realCwd) return null;
+  if (name.includes('.')) return null; // tmux normalizza '.' in '_': rifiuta in scrittura
   const argv = presetArgv(String(preset || 'shell'), extraPresets);
   if (argv === undefined) return null;
   const base = ['new-session', '-d', '-s', name, '-c', realCwd];