@mmmbuto/nexuscrew 0.8.7 → 0.8.10

package/lib/update/core.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const PACKAGE_NAME = require('../../package.json').name;
+const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+
+function parseVersion(value) {
+  const m = VERSION_RE.exec(String(value || '').trim());
+  if (!m) return null;
+  return {
+    raw: m[0],
+    major: Number(m[1]),
+    minor: Number(m[2]),
+    patch: Number(m[3]),
+    prerelease: m[4] ? m[4].split('.') : [],
+  };
+}
+
+function compareIdentifier(a, b) {
+  const an = /^[0-9]+$/.test(a);
+  const bn = /^[0-9]+$/.test(b);
+  if (an && bn) return Number(a) === Number(b) ? 0 : Number(a) > Number(b) ? 1 : -1;
+  if (an !== bn) return an ? -1 : 1;
+  return a === b ? 0 : a > b ? 1 : -1;
+}
+
+function compareVersions(a, b) {
+  const av = parseVersion(a);
+  const bv = parseVersion(b);
+  if (!av || !bv) throw new Error('versione semver non valida');
+  for (const key of ['major', 'minor', 'patch']) {
+    if (av[key] !== bv[key]) return av[key] > bv[key] ? 1 : -1;
+  }
+  if (!av.prerelease.length && !bv.prerelease.length) return 0;
+  if (!av.prerelease.length) return 1;
+  if (!bv.prerelease.length) return -1;
+  const n = Math.max(av.prerelease.length, bv.prerelease.length);
+  for (let i = 0; i < n; i += 1) {
+    if (av.prerelease[i] === undefined) return -1;
+    if (bv.prerelease[i] === undefined) return 1;
+    const c = compareIdentifier(av.prerelease[i], bv.prerelease[i]);
+    if (c) return c;
+  }
+  return 0;
+}
+
+function registryVersion(stdout) {
+  const raw = String(stdout || '').trim();
+  let value = raw;
+  try {
+    const decoded = JSON.parse(raw);
+    if (typeof decoded === 'string') value = decoded;
+  } catch (_) { /* npm senza --json o output gia' plain */ }
+  const parsed = parseVersion(value);
+  if (!parsed) throw new Error('npm ha restituito una versione non valida');
+  return parsed.raw;
+}
+
+function scrubError(error) {
+  return String((error && error.message) || error || 'errore sconosciuto')
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/gi, 'https://***@')
+    .replace(/\/(?:home|Users|data\/data\/com\.termux\/files\/home)\/[^\s:]+/g, '<local-path>')
+    .replace(/(?:Bearer\s+)?[A-Za-z0-9_-]{40,}/gi, '***')
+    .slice(0, 300);
+}
+
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid < 1) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+
+function readLock(file) {
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return null;
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return value && Number.isInteger(value.pid) && typeof value.token === 'string' ? value : null;
+  } catch (_) { return null; }
+}
+
+function writeLock(file, value, flags = 'wx') {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(file, `${JSON.stringify(value)}\n`, { flag: flags, mode: 0o600 });
+  fs.chmodSync(file, 0o600);
+}
+
+function acquireUpdateLock(file, pid = process.pid, token = crypto.randomBytes(16).toString('hex')) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try { writeLock(file, { pid, token, createdAt: Date.now() }); return { ok: true, token }; }
+    catch (e) {
+      if (e.code !== 'EEXIST') throw e;
+      const current = readLock(file);
+      if (current && pidAlive(current.pid)) return { ok: false, current };
+      try { fs.unlinkSync(file); } catch (unlinkError) { if (unlinkError.code !== 'ENOENT') throw unlinkError; }
+    }
+  }
+  return { ok: false, current: readLock(file) };
+}
+
+function adoptUpdateLock(file, token, pid = process.pid) {
+  const current = readLock(file);
+  if (!current || current.token !== token) return false;
+  const tmp = `${file}.${pid}.tmp`;
+  try {
+    writeLock(tmp, { ...current, pid, adoptedAt: Date.now() });
+    fs.renameSync(tmp, file);
+    return true;
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+}
+
+function releaseUpdateLock(file, token) {
+  const current = readLock(file);
+  if (!current || current.token !== token) return false;
+  try { fs.unlinkSync(file); return true; } catch (_) { return false; }
+}
+
+function readState(file) {
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return {};
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  } catch (_) { return {}; }
+}
+
+function writeState(file, value) {
+  try {
+    const st = fs.lstatSync(file);
+    if (st.isSymbolicLink() || !st.isFile()) throw new Error('update state target non sicuro');
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+  }
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+}
+
+module.exports = {
+  PACKAGE_NAME, VERSION_RE, parseVersion, compareVersions, registryVersion,
+  scrubError, pidAlive, readLock, acquireUpdateLock, adoptUpdateLock, releaseUpdateLock,
+  readState, writeState,
+};

package/lib/update/manager.js

@@ -0,0 +1,245 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFile, spawn } = require('node:child_process');
+const {
+  PACKAGE_NAME, compareVersions, parseVersion, registryVersion, scrubError, pidAlive, readLock,
+  acquireUpdateLock, releaseUpdateLock, readState, writeState,
+} = require('./core.js');
+
+const DEFAULT_INITIAL_DELAY_MS = 60 * 1000;
+const DEFAULT_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const DEFAULT_MAX_LOG_BYTES = 1024 * 1024;
+
+function packageRoot() { return path.resolve(__dirname, '..', '..'); }
+
+function isGlobalInstall(root = packageRoot()) {
+  const normalized = path.resolve(root).split(path.sep).join('/');
+  return normalized.includes('/node_modules/@mmmbuto/nexuscrew');
+}
+
+function isNewer(candidate, current) {
+  try { return compareVersions(candidate, current) > 0; } catch (_) { return false; }
+}
+
+function lookupLatestNpm({ execFileImpl = execFile, timeoutMs = 20_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFileImpl('npm', ['view', `${PACKAGE_NAME}@latest`, 'version', '--json'], {
+      encoding: 'utf8', timeout: timeoutMs, maxBuffer: 64 * 1024,
+    }, (error, stdout) => {
+      if (error) return reject(error);
+      try { resolve(registryVersion(stdout)); } catch (e) { reject(e); }
+    });
+  });
+}
+
+function createNpmUpdater(opts = {}) {
+  const currentVersion = String(opts.currentVersion || require('../../package.json').version);
+  const home = opts.home || os.homedir();
+  const statusPath = opts.statusPath || path.join(home, '.nexuscrew', 'npm-update.json');
+  const logPath = opts.logPath || path.join(home, '.nexuscrew', 'npm-update.log');
+  const lockPath = opts.lockPath || path.join(home, '.nexuscrew', 'npm-update.lock');
+  const runnerPath = opts.runnerPath || path.join(__dirname, 'runner.js');
+  const supported = opts.supported === undefined ? isGlobalInstall(opts.packageRoot) : !!opts.supported;
+  const readonly = opts.readonly === true;
+  const lookupLatest = opts.lookupLatest || (() => lookupLatestNpm(opts));
+  const spawnImpl = opts.spawnImpl || spawn;
+  const useSystemdRun = opts.useSystemdRun === undefined
+    ? (process.platform === 'linux' && !!process.env.INVOCATION_ID)
+    : opts.useSystemdRun === true;
+  const initialDelayMs = opts.initialDelayMs === undefined ? DEFAULT_INITIAL_DELAY_MS : opts.initialDelayMs;
+  const intervalMs = opts.intervalMs === undefined ? DEFAULT_INTERVAL_MS : opts.intervalMs;
+  const maxLogBytes = opts.maxLogBytes === undefined ? DEFAULT_MAX_LOG_BYTES : opts.maxLogBytes;
+  let enabled = opts.enabled !== false && !readonly;
+  let checking = null;
+  let timer = null;
+  let state = readState(statusPath);
+
+  // Only stale temp files are reaped. A fresh temp may belong to another live
+  // NexusCrew process writing the same shared state.
+  try {
+    const dir = path.dirname(statusPath); const prefix = `${path.basename(statusPath)}.`;
+    for (const name of fs.readdirSync(dir)) {
+      if (!name.startsWith(prefix) || !name.endsWith('.tmp')) continue;
+      const file = path.join(dir, name);
+      if (Date.now() - fs.statSync(file).mtimeMs > 24 * 60 * 60 * 1000) fs.unlinkSync(file);
+    }
+  } catch (_) {}
+
+  if (state.phase === 'installed' && state.targetVersion === currentVersion) {
+    state = { ...state, phase: 'idle', available: false, latest: currentVersion, lastError: '' };
+    writeState(statusPath, state);
+  }
+  const activeLock = () => { const lock = readLock(lockPath); return !!(lock && pidAlive(lock.pid)); };
+  if ((state.phase === 'installing' || state.phase === 'restarting') && !pidAlive(state.updaterPid) && !activeLock()) {
+    state = { ...state, phase: 'error', lastError: 'aggiornamento precedente interrotto' };
+    writeState(statusPath, state);
+  }
+
+  const persist = (patch) => {
+    state = { ...state, ...patch };
+    writeState(statusPath, state);
+    return status();
+  };
+
+  const status = () => {
+    state = { ...state, ...readState(statusPath) };
+    return {
+      supported, enabled, current: currentVersion,
+      phase: state.phase || 'idle', latest: state.latest || '',
+      available: state.available === true && isNewer(state.latest, currentVersion),
+      lastCheckedAt: state.lastCheckedAt || '', lastUpdatedAt: state.lastUpdatedAt || '',
+      lastError: state.lastError || '', blockedVersion: state.blockedVersion || '',
+    };
+  };
+
+  const launch = (version) => {
+    if (!supported) throw new Error('auto-update disponibile solo nell’installazione npm globale');
+    if (readonly) throw new Error('READONLY: auto-update bloccato');
+    if (!isNewer(version, currentVersion)) return status();
+    status();
+    if (state.phase === 'installing' || state.phase === 'restarting' || activeLock()) {
+      const error = new Error('aggiornamento già in corso'); error.status = 409; error.code = 'update-busy'; throw error;
+    }
+    if (state.blockedVersion === version) {
+      const error = new Error(`versione ${version} bloccata dopo un rollback fallito/necessario`); error.status = 409; error.code = 'update-blocked'; throw error;
+    }
+    const reservation = acquireUpdateLock(lockPath);
+    if (!reservation.ok) {
+      const error = new Error('aggiornamento già in corso'); error.status = 409; error.code = 'update-busy'; throw error;
+    }
+    fs.mkdirSync(path.dirname(logPath), { recursive: true, mode: 0o700 });
+    try {
+      const logStat = fs.lstatSync(logPath);
+      if (!logStat.isFile() || logStat.isSymbolicLink()) throw new Error('update log target non sicuro');
+      if (logStat.size > maxLogBytes) fs.truncateSync(logPath, 0);
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        releaseUpdateLock(lockPath, reservation.token);
+        persist({ phase: 'error', available: true, lastError: scrubError(error) });
+        throw error;
+      }
+    }
+    const fd = fs.openSync(logPath, 'a', 0o600);
+    let child;
+    try {
+      persist({ phase: 'installing', targetVersion: version, latest: version, available: true, lastError: '' });
+      const runnerArgs = [runnerPath, '--version', version, '--status', statusPath, '--home', home,
+        '--lock', lockPath, '--lock-token', reservation.token];
+      const bin = useSystemdRun ? 'systemd-run' : process.execPath;
+      const argv = useSystemdRun
+        ? ['--user', '--quiet', '--collect', `--unit=nexuscrew-update-${process.pid}-${Date.now()}`,
+          `--property=StandardOutput=append:${logPath}`, `--property=StandardError=append:${logPath}`,
+          process.execPath, ...runnerArgs]
+        : runnerArgs;
+      child = spawnImpl(bin, argv, {
+        detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, NEXUSCREW_UPDATE_RUNNER: '1' },
+      });
+    } catch (e) {
+      releaseUpdateLock(lockPath, reservation.token);
+      persist({ phase: 'error', available: true, lastError: scrubError(e) });
+      throw e;
+    } finally {
+      try { fs.closeSync(fd); } catch (_) {}
+    }
+    if (child && typeof child.once === 'function') {
+      child.once('error', (error) => {
+        if (releaseUpdateLock(lockPath, reservation.token)) {
+          persist({ phase: 'error', available: true, lastError: scrubError(error) });
+        }
+      });
+      if (useSystemdRun) child.once('exit', (code) => {
+        if (code && releaseUpdateLock(lockPath, reservation.token)) {
+          persist({ phase: 'error', available: true, lastError: `systemd-run terminato con codice ${code}` });
+          return;
+        }
+        // systemd-run returns after scheduling the transient unit. The runner
+        // must adopt the reservation promptly; otherwise release a dead lock.
+        const timer = setTimeout(() => {
+          const lock = readLock(lockPath);
+          if (lock?.token === reservation.token && lock.pid === process.pid
+            && releaseUpdateLock(lockPath, reservation.token)) {
+            persist({ phase: 'error', available: true, lastError: 'runner aggiornamento non avviato' });
+          }
+        }, 15_000);
+        if (typeof timer.unref === 'function') timer.unref();
+      });
+    }
+    if (!child || !Number.isInteger(child.pid)) {
+      releaseUpdateLock(lockPath, reservation.token);
+      const error = new Error('impossibile avviare il processo di aggiornamento');
+      persist({ phase: 'error', available: true, lastError: error.message });
+      throw error;
+    }
+    persist({ updaterPid: child.pid });
+    if (typeof child.unref === 'function') child.unref();
+    return status();
+  };
+
+  const check = async ({ autoApply = false } = {}) => {
+    if (!supported) return status();
+    if (checking) return checking;
+    checking = (async () => {
+      status();
+      if (state.phase === 'installing' || state.phase === 'restarting' || activeLock()) return status();
+      persist({ phase: 'checking', lastError: '' });
+      try {
+        const latest = await lookupLatest();
+        if (parseVersion(latest)?.prerelease.length) throw new Error('npm latest punta a una prerelease: aggiornamento rifiutato');
+        const available = isNewer(latest, currentVersion);
+        const blocked = state.blockedVersion === latest;
+        persist({
+          phase: blocked ? 'error' : available ? 'available' : 'idle', latest, available,
+          lastCheckedAt: new Date().toISOString(),
+          lastError: blocked ? (state.lastError || `versione ${latest} bloccata dopo rollback`) : '',
+        });
+        if (available && !blocked && autoApply && enabled) return launch(latest);
+        return status();
+      } catch (e) {
+        return persist({ phase: 'error', lastCheckedAt: new Date().toISOString(), lastError: scrubError(e) });
+      } finally { checking = null; }
+    })();
+    return checking;
+  };
+
+  const apply = async () => {
+    if (!supported) throw new Error('auto-update disponibile solo nell’installazione npm globale');
+    if (readonly) throw new Error('READONLY: auto-update bloccato');
+    status();
+    if (state.phase === 'installing' || state.phase === 'restarting' || activeLock()) {
+      const error = new Error('aggiornamento già in corso'); error.status = 409; error.code = 'update-busy'; throw error;
+    }
+    const latest = state.latest && isNewer(state.latest, currentVersion)
+      ? state.latest : (await check()).latest;
+    if (!latest || !isNewer(latest, currentVersion)) return status();
+    return launch(latest);
+  };
+
+  const schedule = (delay) => {
+    if (!enabled || !supported || readonly || timer) return;
+    timer = setTimeout(async () => {
+      timer = null;
+      await check({ autoApply: true });
+      schedule(intervalMs);
+    }, Math.max(0, delay));
+    if (typeof timer.unref === 'function') timer.unref();
+  };
+
+  const start = () => schedule(initialDelayMs);
+  const close = () => { if (timer) clearTimeout(timer); timer = null; };
+  const setEnabled = (value) => {
+    enabled = value === true && !readonly;
+    close();
+    if (enabled) schedule(250);
+    return status();
+  };
+
+  return { status, check, apply, start, close, setEnabled, supported };
+}
+
+module.exports = {
+  DEFAULT_INITIAL_DELAY_MS, DEFAULT_INTERVAL_MS, DEFAULT_MAX_LOG_BYTES, packageRoot, isGlobalInstall,
+  isNewer, pidAlive, lookupLatestNpm, createNpmUpdater,
+};

package/lib/update/runner.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const {
+  PACKAGE_NAME, parseVersion, scrubError, pidAlive, adoptUpdateLock, releaseUpdateLock, readState, writeState,
+} = require('./core.js');
+
+function args(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    const key = argv[i];
+    if (!key || !key.startsWith('--') || argv[i + 1] === undefined) return null;
+    out[key.slice(2)] = argv[i + 1];
+  }
+  return out;
+}
+
+async function restartRuntime(opts = {}) {
+  const home = opts.home || os.homedir();
+  const commands = opts.commands || require('../cli/commands.js');
+  const pidf = opts.pidfile || require('../cli/pidfile.js');
+  const platform = opts.platform || require('../cli/platform.js').detectPlatform();
+  const url = opts.url || require('../cli/url.js');
+  const port = opts.port || url.loadPort({ home });
+  const token = opts.token || url.readToken(url.resolvePaths({ home }).tokenPath);
+  let mode = 'inactive';
+  if (commands.isServiceRunning({ platform, home })) {
+    commands.restart({ platform, home, log: () => {} });
+    mode = 'service';
+  } else {
+    const pidPath = pidf.defaultPidfilePath(home);
+    const meta = pidf.readPidfile(pidPath);
+    if (meta && pidf.isAlive(meta)) {
+      const stopped = pidf.killPidfile(pidPath);
+      if (!stopped.killed) throw new Error(`restart portatile fallito: ${stopped.reason || 'processo non arrestato'}`);
+      const wait = opts.waitImpl || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+      let released = false;
+      for (let i = 0; i < 60; i += 1) {
+        const dead = !(opts.pidAliveImpl || pidAlive)(stopped.pid);
+        const free = await (opts.portAvailableImpl || commands.portAvailable)(port);
+        if (dead && free) { released = true; break; }
+        await wait(100);
+      }
+      if (!released) throw new Error(`restart portatile fallito: porta ${port} non liberata`);
+      commands.startPortable({ platform, home });
+      mode = 'portable';
+    }
+  }
+  if (mode !== 'inactive') {
+    const waitFor = opts.waitForRuntimeImpl || commands.waitForNexusCrew;
+    const healthy = await waitFor(port, token, {
+      waitAttempts: opts.healthAttempts || 60, waitDelayMs: opts.healthDelayMs || 250,
+      ...(opts.healthProbeImpl ? { probeImpl: opts.healthProbeImpl } : {}),
+    });
+    if (!healthy) throw new Error(`NexusCrew ${mode} non healthy su 127.0.0.1:${port} dopo il restart`);
+  }
+  return mode;
+}
+
+async function runUpdate(opts = {}) {
+  const version = String(opts.version || '');
+  if (!parseVersion(version)) throw new Error('versione update non valida');
+  const home = opts.home || os.homedir();
+  const statusPath = opts.statusPath || path.join(home, '.nexuscrew', 'npm-update.json');
+  const execImpl = opts.execImpl || execFileSync;
+  const readInstalledVersion = opts.readInstalledVersion || (() => {
+    const p = path.resolve(__dirname, '..', '..', 'package.json');
+    return JSON.parse(fs.readFileSync(p, 'utf8')).version;
+  });
+  const preflightImpl = opts.preflightImpl || (({ version: expectedVersion = version } = {}) => {
+    const bin = path.resolve(__dirname, '..', '..', 'bin', 'nexuscrew.js');
+    const output = execFileSync(process.execPath, [bin, 'version'], { encoding: 'utf8', timeout: 20_000, stdio: ['ignore', 'pipe', 'pipe'] });
+    if (String(output || '').trim() !== expectedVersion) throw new Error(`preflight CLI fallito: attesa ${expectedVersion}`);
+    return true;
+  });
+  const restartImpl = opts.restartImpl || restartRuntime;
+  const lockPath = opts.lockPath || '';
+  const lockToken = opts.lockToken || '';
+  let ownsLock = false;
+  if (lockPath || lockToken) {
+    if (!lockPath || !lockToken || !adoptUpdateLock(lockPath, lockToken, process.pid)) {
+      const error = new Error('lock aggiornamento non posseduto'); error.status = 409; throw error;
+    }
+    ownsLock = true;
+  }
+  const previous = readState(statusPath);
+  const previousVersion = String(readInstalledVersion() || '');
+  let installedNew = false;
+  try {
+    writeState(statusPath, { ...previous, phase: 'installing', targetVersion: version, updaterPid: process.pid, lastError: '' });
+    execImpl('npm', ['install', '--global', `${PACKAGE_NAME}@${version}`, '--no-audit', '--no-fund'], {
+      stdio: 'inherit', timeout: 5 * 60 * 1000,
+    });
+    const installed = String(readInstalledVersion() || '');
+    if (installed !== version) throw new Error(`verifica installazione fallita: attesa ${version}, trovata ${installed || 'sconosciuta'}`);
+    installedNew = true;
+    await preflightImpl({ version, home });
+    writeState(statusPath, { ...readState(statusPath), phase: 'restarting', updaterPid: process.pid, lastError: '' });
+    const restartMode = await restartImpl({ home, ...(opts.runtimeSeams || {}) });
+    writeState(statusPath, {
+      ...readState(statusPath), phase: 'installed', current: version, latest: version,
+      available: false, blockedVersion: '', lastUpdatedAt: new Date().toISOString(), lastError: '',
+    });
+    return { updated: true, version, restartMode };
+  } catch (e) {
+    let rollbackError = null; let rolledBack = false;
+    if (installedNew && parseVersion(previousVersion) && previousVersion !== version) {
+      try {
+        execImpl('npm', ['install', '--global', `${PACKAGE_NAME}@${previousVersion}`, '--no-audit', '--no-fund'], {
+          stdio: 'inherit', timeout: 5 * 60 * 1000,
+        });
+        if (String(readInstalledVersion() || '') !== previousVersion) throw new Error(`rollback verify: attesa ${previousVersion}`);
+        await preflightImpl({ version: previousVersion, home, rollback: true });
+        await restartImpl({ home, ...(opts.runtimeSeams || {}) });
+        rolledBack = true;
+      } catch (rollbackFailure) { rollbackError = rollbackFailure; }
+    }
+    const detail = rollbackError
+      ? `${scrubError(e)}; rollback ${previousVersion || '?'} fallito: ${scrubError(rollbackError)}`
+      : rolledBack ? `${scrubError(e)}; rollback a ${previousVersion} completato` : scrubError(e);
+    writeState(statusPath, {
+      ...readState(statusPath), phase: 'error', current: rolledBack ? previousVersion : readState(statusPath).current,
+      available: true, blockedVersion: installedNew ? version : '', rolledBackTo: rolledBack ? previousVersion : '',
+      lastError: detail,
+    });
+    throw e;
+  } finally {
+    if (ownsLock) releaseUpdateLock(lockPath, lockToken);
+  }
+}
+
+if (require.main === module) {
+  const parsed = args(process.argv.slice(2));
+  if (!parsed || !parsed.version || !parsed.status) process.exitCode = 2;
+  else runUpdate({ version: parsed.version, statusPath: parsed.status, home: parsed.home,
+    lockPath: parsed.lock, lockToken: parsed['lock-token'] })
+    .catch(() => { process.exitCode = 1; });
+}
+
+module.exports = { args, restartRuntime, runUpdate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.7",
+  "version": "0.8.10",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
@@ -20,7 +20,7 @@
     "start": "node bin/nexuscrew.js serve",
     "dev": "node bin/nexuscrew.js serve",
     "build": "cd frontend && npm install && npm run build && cd ..",
-    "test": "node --test tests/*.test.js"
+    "test": "node tests/run-isolated.js"
   },
   "dependencies": {
     "express": "^4.21.0",

package/skills/nexuscrew-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nexuscrew-agent
-description: Use when an AI agent connected to NexusCrew must notify or ask the human, inspect NexusCrew session/fleet status, read its inbox, deliver a file (report, screenshot, export), send text/input to a tmux session, or recover from tmux send-keys messages that remain unsubmitted or arrive garbled. Prefer the NexusCrew MCP tools nc_notify, nc_ask, nc_status, nc_inbox, and nc_send_file when exposed; use the bundled tmux/file helpers as fallback.
+description: Use when an AI agent connected to NexusCrew must notify or ask the human, inspect NexusCrew session/fleet status or its own deck membership, read its inbox, deliver a file (report, screenshot, export), send text/input to a tmux session, or recover from tmux send-keys messages that remain unsubmitted or arrive garbled. Prefer the NexusCrew MCP tools nc_notify, nc_ask, nc_status, nc_deck, nc_inbox, and nc_send_file when exposed; use the bundled tmux/file helpers as fallback.
 ---
 
 # NexusCrew Agent I/O
@@ -16,6 +16,7 @@ When the client exposes the NexusCrew MCP server, use these tools directly:
 | Notify the human about a result, blocker, or milestone | `nc_notify` |
 | Ask for a decision without blocking the agent | `nc_ask` |
 | Inspect live tmux sessions and fleet cells | `nc_status` |
+| Read the caller's deck name(s) and member cells/tmux sessions | `nc_deck` |
 | List files received for the current session | `nc_inbox` |
 | Deliver an absolute file path under the user's home | `nc_send_file` |
 
@@ -24,7 +25,9 @@ Apply these rules:
 - Use `nc_notify` for meaningful asynchronous updates, failures requiring attention, and completion. Do not notify for every command or duplicate routine chat commentary.
 - Never include access tokens, credentials, private keys, push subscriptions, or other secrets in a notification, ask, file caption, or tool result.
 - Treat `nc_ask` as non-blocking: it returns an ask ID immediately. Continue safe independent work or wait normally; the human response arrives in the originating tmux session with a `[human reply · ask#<id>]` prefix by default.
-- Use `nc_status` instead of scraping NexusCrew state files. Use `nc_inbox` instead of guessing an inbox path when the tool is available.
+- Use `nc_status` instead of scraping NexusCrew state files. Use `nc_deck` instead of reading `decks.json`: it returns every local or authorized shared-owner deck containing the caller, preserves visual member order, identifies each deck and member by stable owner ID, includes viewer-valid Hydra routes, and reports `cell: null` when no managed Fleet match is available.
+- Treat `nc_deck` as discovery, not authorization to contact every member. Use the verified tmux-messaging flow below for actual delivery and confirm submission visually.
+- Use `nc_inbox` instead of guessing an inbox path when the tool is available.
 - Pass `nc_send_file` an existing absolute regular-file path below the user's home. Let NexusCrew choose and sanitize the outbox name.
 - Do not treat an MCP notification as a substitute for the final response required by the active client.
 
@@ -68,6 +71,7 @@ tmux capture-pane -t <session> -p | tail -8   # see the text / a running state
 | Notify the human | `nc_notify` |
 | Ask the human without blocking | `nc_ask` |
 | Inspect NexusCrew runtime state | `nc_status` |
+| Discover this session's deck neighbours | `nc_deck` |
 | Give the human a file | `nc_send_file` or fallback `nc-deliver <file>...` |
 | Read a file the human sent | `nc_inbox` or fallback to the path in the prompt |
 | Send a prompt/command to a session | `nc-send <session> "text"` |