@mmmbuto/nexuscrew 0.8.5 → 0.8.7

package/README.md

@@ -16,7 +16,7 @@ panes, windows. tmux does the work; the browser is just a faithful client.
 
 ---
 
-## What it is (v0.8.5 "Clean Fleet")
+## What it is (v0.8.7 "One-Link Pairing")
 
 - Runs a small server on the host where your tmux sessions live.
 - Each attach spawns a real PTY running `tmux attach` and bridges its bytes over a WebSocket
@@ -31,11 +31,17 @@ panes, windows. tmux does the work; the browser is just a faithful client.
   configuration you already control and see local, direct, and relayed tmux fleets in one UI.
   Route labels show where every session lives; creation, attach, files, lifecycle and Fleet
   management use the selected location through a scoped single-origin route.
+- **One-link node pairing**: paste a link or scan its QR in Settings → Nodes. A complete
+  link tests SSH, exchanges the one-time invitation, confirms both directions and verifies
+  the peer automatically; failures identify the exact connection stage.
 - **Settings and wizard**: manage roles, nodes, token rotation, and service regeneration
-  from the UI; a skippable first-run wizard guides initial setup.
+  from the UI; the first-run wizard uses the same pairing flow as Settings.
 - **Cell lifecycle from the UI**: the primary `+` creates a managed Fleet cell at Local or
-  any reachable node. Cards expose direct power and settings controls; deletion lives in
-  Settings → Fleet. Unmanaged tmux sessions remain attachable and can be terminated there.
+  any reachable node. Power opens one shared launch sheet where engine, model, permission
+  policy and boot can be reviewed before every start; deletion lives in Settings → Fleet.
+- **Legacy session adoption**: Settings → Fleet lists managed and unmanaged tmux sessions on
+  every route. A live unmanaged session can be explicitly imported as a managed cell without
+  inventing its engine, provider or model.
 - **Rich cards**: last activity, current command, a sanitized one-line preview per session.
 - **Fleet control**: a built-in schema-driven fleet manager handles cells, engines, model
   selection, and boot persistence; an existing external `fleet` CLI can take ownership through
@@ -56,20 +62,21 @@ panes, windows. tmux does the work; the browser is just a faithful client.
 The **Fleet Deck** desktop grid (≥1024px): drag sessions into a tiling layout — live
 terminals side by side, each a real PTY streamed to the browser.
 
-| Mobile home | Attached session |
-|:---:|:---:|
-| <img src="docs/img/fleet-deck.gif" width="300" alt="NexusCrew mobile home: the tmux fleet with live cards, cursor blinking"> | <img src="docs/img/session-window.png" width="300" alt="A tmux session attached in the browser over a real PTY"> |
+<p align="center">
+  <img src="docs/img/fleet-mobile.png" width="420" alt="NexusCrew mobile Fleet overview with managed AI cells and direct power controls">
+</p>
 
-The mobile home lists your tmux fleet with live cards; tapping a session attaches it
-over a real PTY. On the right, a `codex-vl` session running inside the browser client.
+The mobile Fleet overview keeps managed cells, current engines, activity and direct power
+controls in one place. Tapping a live session still attaches through a real PTY.
 
 ## Fleet integration
 
 A clean install includes the built-in, schema-driven fleet manager. Its safe defaults contain
 four CLI adapters — **Claude Code**, **Codex**, **Codex-VL**, and **Pi** — and no cells,
-prompts, API keys, or machine-specific paths. Engine, provider, credential-variable name,
-model and permission policy are configured only in Settings → Fleet; the power sheet only
-starts or stops the already configured cell and controls boot persistence.
+prompts, API keys, or machine-specific paths. Provider, credential-variable name and reusable
+engine definitions live in Settings → Fleet. When a cell is off, its shared launch sheet lets
+you choose the engine, model, permission policy and boot state before starting it; the last
+model and permission choice is remembered separately for each cell and engine.
 
 The concise provider catalog is scoped per CLI:
 
@@ -86,11 +93,13 @@ remain launch-compatible for existing fleets but are not provider choices for ne
 Model discovery is used where the CLI/provider documents it, with a manual model field as the
 portable fallback.
 
-Managed engines expose a permission selector. New Claude engines (native, Z.AI, Ollama, or
-custom) default to **Bypass permissions** and launch with
-`--dangerously-skip-permissions`; choose **Standard permissions** to disable it. New Codex and
-Codex-VL engines default to Standard and offer an explicit opt-in for
-`--dangerously-bypass-approvals-and-sandbox`. Pi keeps its native permission behavior.
+Managed engines expose a permission selector both in their definition and in the cell launch
+sheet. New Claude engines (native, Z.AI, Ollama, or custom) default to **Bypass permissions**
+and launch with `--dangerously-skip-permissions`; choose **Standard permissions** to disable
+it. New Codex and Codex-VL engines default to Standard and offer an explicit opt-in for
+`--dangerously-bypass-approvals-and-sandbox`. Pi is always launched with its native Standard
+permission behavior. Claude-compatible managed models also receive matching context and
+auto-compaction window variables, including one-million-token profiles where declared.
 
 Custom argv-based engines remain supported. Their command, environment, cwd, and prompt are
 validated against a strict trust boundary and launched without a shell.
@@ -116,7 +125,11 @@ the NexusCrew power control starts or stops the cell without changing that confi
 and accepts `up <Cell> [--engine E] [--boot]`, `down <Cell> [--boot]`, `engine <Cell> <E>`,
 `boot|noboot <Cell>`. The binary is trust-checked (regular file, not a symlink, not
 world-writable) and the schema is validated strictly — anything else and the feature stays
-off. Set `NEXUSCREW_FLEET=0` to disable it entirely.
+off. Automatic discovery checks the configured path, Termux's `$PREFIX/bin/fleet`, then
+`~/.local/bin/fleet`; startup-service ownership uses the same resolver so built-in and external
+boot managers cannot both take ownership. An explicitly pinned external binary fails closed
+instead of silently switching to another executable. Set `NEXUSCREW_FLEET=0` to disable Fleet
+entirely.
 
 ## Requirements
 
@@ -147,10 +160,26 @@ token travels in the URL **fragment** (`#token=…`), so it never reaches the se
 
 ## Federated Hydra nodes (configured from the PWA)
 
-Every installation is always the local node and can join other NexusCrew nodes. Open
-**Settings → Nodes**, create a ten-minute pairing link/QR on one device, then paste or scan it
-on the other together with an OpenSSH Host alias. That single pairing creates a reciprocal,
-loopback-only link and both sides exchange a redacted topology automatically.
+Every installation is always the local node and can join other NexusCrew nodes. The normal
+flow stays entirely in the PWA:
+
+1. On the installation being shared, open **Settings → Nodes → Invite a node**. Enter the
+   OpenSSH target or Host alias that the *other device* uses to reach this installation, then
+   create the ten-minute link/QR.
+2. On the other device, open its own NexusCrew PWA (`nexuscrew show`), go to
+   **Settings → Nodes**, and use the first card, **Connect with one link**. Paste the complete
+   link in the prominent field or scan the QR. Do not navigate to the loopback address in the
+   link: it is only a portable container for the pairing payload.
+3. A complete v2 link connects automatically. NexusCrew starts a provisional SSH forward,
+   checks transport readiness, consumes the one-time invite once, negotiates the reciprocal
+   path, confirms it, and verifies authenticated federation health and peer identity. If a
+   stage fails, the PWA preserves the link and shows the exact stage, detail and safe retry
+   guidance. Older v1 links remain accepted and open only the missing routing fields.
+
+The link never contains an SSH key, identity file, API key or PWA token. Its only credential is
+the random, one-time pairing invite; SSH routing fields are non-secret configuration. A
+successful pairing creates a reciprocal loopback-only link and both sides exchange a redacted
+topology automatically.
 
 NexusCrew does not create SSH keys or edit `authorized_keys`. OpenSSH remains authoritative for
 identity files, agents, host keys, ports, ProxyJump and forwarding policy. NexusCrew uses
@@ -306,7 +335,7 @@ node bin/nexuscrew.js serve
 
 ## Status
 
-The current stable release is **v0.8.5**, published on npm under the **`latest`** dist-tag.
+The current stable release is **v0.8.7**, published on npm under the **`latest`** dist-tag.
 
 ## License