@mmmbuto/nexuscrew 0.8.9 → 0.8.10

package/lib/cli/commands.js

@@ -1,5 +1,5 @@
 'use strict';
-// CLI dispatcher: init / serve / start / stop / status. [M6][R1]
+// Minimal public CLI plus internal service/MCP entry points. [M6][R1]
 // serve = foreground HTTP (+ --pidfile lifecycle su Termux/manuale).
 // start/stop/status = per-platform: linux (systemctl --user), mac (launchctl),
 // termux (nohup serve --pidfile + pidfile verificato; status boot-script vs running).
@@ -15,16 +15,9 @@ const { runInit } = require('./init.js');
 const { rotateToken } = require('../auth/token.js');
 const urlmod = require('./url.js');
 const { doctor } = require('./doctor.js');
-const nodesCmds = require('../nodes/commands.js');
 const nodesStore = require('../nodes/store.js');
 const nodesTunnel = require('../nodes/tunnel.js');
 
-// Flag CLI che consumano il token successivo (forma "--k v", oltre a "--k=v").
-// Solo flag esclusivi dei subcomandi nodes/node: non collidono con gli altri.
-const VALUE_FLAGS = new Set([
-  'ssh', 'ssh-port', 'remote-port', 'key', 'local-port', 'node-id', 'rendezvous', 'published-port', 'token',
-]);
-
 const HELP = `NexusCrew — PWA for local and remote AI workers.
 
 Usage:
@@ -32,6 +25,9 @@ Usage:
   nexuscrew show     start when needed and open the authenticated PWA
   nexuscrew show token  print the clickable authenticated URL
   nexuscrew boot     enable startup at boot (use: boot off|status)
+  nexuscrew status   show service, port, roles and node status
+  nexuscrew stop     stop the background service
+  nexuscrew restart  restart the background service
   nexuscrew doctor   run local diagnostics
   nexuscrew help     show this help
   nexuscrew version  show the installed version
@@ -153,57 +149,166 @@ function start(opts = {}) {
   throw new Error(`start: platform ${platform} non supportata`);
 }
 
-function stop(opts = {}) {
+function stopManagedTunnels(opts = {}) {
+  const home = opts.home || require('node:os').homedir();
+  const { configDir } = urlmod.resolvePaths(opts);
+  const nodesPath = opts.nodesPath || path.join(configDir, 'nodes.json');
+  const st = nodesStore.loadStore(nodesPath);
+  const stopped = [];
+  for (const node of (st && st.nodes) || []) {
+    if (node.direction === 'inbound') continue;
+    try { nodesTunnel.stopTunnel({ home, name: node.name }); stopped.push(node.name); } catch (_) {}
+  }
+  if (st && st.rendezvous) {
+    try { nodesTunnel.stopTunnel({ home, name: nodesTunnel.REVERSE_NAME }); stopped.push(nodesTunnel.REVERSE_NAME); } catch (_) {}
+  }
+  return stopped;
+}
+
+function refusePairedPortRelocation(opts, from, to) {
+  if (Number(from) === Number(to)) return;
+  const { configDir } = urlmod.resolvePaths(opts);
+  const nodesPath = opts.nodesPath || path.join(configDir, 'nodes.json');
+  if (nodesStore.hasPairedPeers(nodesStore.loadStore(nodesPath))) {
+    throw new Error(`port ${from} is busy and paired peers exist; refusing automatic move to ${to}. Free the configured port or reconnect peers intentionally.`);
+  }
+}
+
+// Runtime ownership is independent from boot persistence.  With boot disabled,
+// smartUp intentionally launches `serve --pidfile` on Linux/macOS too; lifecycle
+// commands must therefore inspect both the service manager and that portable
+// pidfile instead of assuming the platform selects exactly one owner.
+function managedRuntimeState(opts = {}) {
   const platform = opts.platform || detectPlatform();
   const execImpl = opts.execImpl || execFileSync;
-  const log = opts.log || console.log;
-
   if (platform === 'linux') {
-    execImpl('systemctl', ['--user', 'stop', 'nexuscrew'], { stdio: 'ignore' });
-    log('stop: systemctl --user stop nexuscrew');
-    return { platform, stopped: true };
+    try {
+      const service = String(execImpl('systemctl', ['--user', 'is-active', 'nexuscrew'], { encoding: 'utf8' }) || '').trim();
+      return { supported: true, running: service === 'active', service: service || 'inactive' };
+    } catch (_) { return { supported: true, running: false, service: 'inactive' }; }
   }
   if (platform === 'mac') {
-    const label = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
+    const service = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
     try {
-      // bootout scarica il job: KeepAlive non puo' rianimare uno stop volontario.
-      execImpl('launchctl', ['bootout', label], { stdio: 'ignore' });
-      log(`stop: launchctl bootout ${label}`);
-      return { platform, stopped: true };
-    } catch (e) {
-      const reason = String(e.message || e);
-      log(`stop: launchctl bootout fallito: ${reason}`);
-      return { platform, stopped: false, reason };
-    }
+      execImpl('launchctl', ['print', service], { stdio: 'ignore' });
+      return { supported: true, running: true, service };
+    } catch (_) { return { supported: true, running: false, service }; }
   }
-  if (platform === 'termux') {
-    // kill via pidfile verificato (no broad match) + wake-lock-release
-    const pidPath = pidf.defaultPidfilePath(opts.home);
-    const r = pidf.killPidfile(pidPath);
-    try { execImpl('termux-wake-lock-release', [], { stdio: 'ignore' }); } catch (_) {}
-    log(`stop: ${r.killed ? `killed pid ${r.pid}` : r.reason}`);
-    return { platform, stopped: r.killed, reason: r.reason };
+  return { supported: false, running: false, service: 'portable-only' };
+}
+
+function portableRuntimeState(opts = {}) {
+  const home = opts.home || require('node:os').homedir();
+  const pidPath = pidf.defaultPidfilePath(home);
+  const meta = pidf.readPidfile(pidPath);
+  if (!meta) return { running: false, pidPath, reason: 'no pidfile' };
+  if (pidf.isAlive(meta)) return { running: true, pidPath, pid: meta.pid, meta };
+  pidf.cleanStale(pidPath);
+  return { running: false, pidPath, reason: 'stale pidfile' };
+}
+
+function resolveRuntimeOwner(opts = {}) {
+  const platform = opts.platform || detectPlatform();
+  const managed = managedRuntimeState({ ...opts, platform });
+  const portable = portableRuntimeState(opts);
+  let owner = 'stopped';
+  if (managed.running && portable.running) owner = 'conflict';
+  else if (managed.running) owner = 'managed';
+  else if (portable.running) owner = 'portable';
+  return {
+    platform, owner,
+    managedRunning: managed.running,
+    portableRunning: portable.running,
+    service: managed.service,
+    portablePid: portable.pid,
+    pidPath: portable.pidPath,
+    stalePidfile: portable.reason === 'stale pidfile',
+    portableReason: portable.reason,
+  };
+}
+
+function waitForPidExit(pid, timeoutMs = 2000) {
+  const deadline = Date.now() + timeoutMs;
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  const exited = () => {
+    if (!pidf.pidExists(pid)) return true;
+    // A test-owned child can remain as a zombie until this synchronous caller
+    // returns to the event loop. It no longer owns sockets and is exited for
+    // lifecycle purposes. Linux/Termux expose the state in /proc; macOS has no
+    // equivalent cheap path and normally removes a non-child immediately.
+    try { return fs.readFileSync(`/proc/${pid}/stat`, 'utf8').split(' ')[2] === 'Z'; }
+    catch (_) { return false; }
+  };
+  while (!exited() && Date.now() < deadline) Atomics.wait(sleeper, 0, 0, 25);
+  return exited();
+}
+
+function stopPortableRuntime(opts = {}) {
+  const home = opts.home || require('node:os').homedir();
+  const pidPath = pidf.defaultPidfilePath(home);
+  const result = pidf.killPidfile(pidPath);
+  if (result.killed && !waitForPidExit(result.pid, opts.stopWaitMs || 2000)) {
+    return { ...result, killed: false, reason: `pid ${result.pid} did not exit after SIGTERM` };
   }
-  throw new Error(`stop: platform ${platform} non supportata`);
+  return result;
 }
 
-// running-check per-platform (no log) — riusato da smart-up / token rotate / update.
-function isServiceRunning(opts = {}) {
+function stop(opts = {}) {
   const platform = opts.platform || detectPlatform();
   const execImpl = opts.execImpl || execFileSync;
-  if (platform === 'linux') {
-    try { return execImpl('systemctl', ['--user', 'is-active', 'nexuscrew'], { encoding: 'utf8' }).trim() === 'active'; }
-    catch (_) { return false; }
+  const log = opts.log || console.log;
+  if (!['linux', 'mac', 'termux'].includes(platform)) throw new Error(`stop: platform ${platform} non supportata`);
+
+  const before = resolveRuntimeOwner({ ...opts, platform, execImpl });
+  const stoppedOwners = [];
+  const errors = [];
+
+  if (before.managedRunning) {
+    try {
+      if (platform === 'linux') {
+        execImpl('systemctl', ['--user', 'stop', 'nexuscrew'], { stdio: 'ignore' });
+        log('stop: systemctl --user stop nexuscrew');
+      } else {
+        const label = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
+        // bootout unloads KeepAlive, so a voluntary stop stays stopped.
+        execImpl('launchctl', ['bootout', label], { stdio: 'ignore' });
+        log(`stop: launchctl bootout ${label}`);
+      }
+      stoppedOwners.push('managed');
+    } catch (error) { errors.push(String(error.message || error)); }
   }
-  if (platform === 'mac') {
-    try { execImpl('launchctl', ['print', `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`], { stdio: 'ignore' }); return true; }
-    catch (_) { return false; }
+
+  if (before.portableRunning) {
+    const portable = (opts.stopPortableImpl || stopPortableRuntime)(opts);
+    if (portable.killed) {
+      stoppedOwners.push('portable');
+      log(`stop: killed portable pid ${portable.pid}`);
+    } else errors.push(portable.reason || 'portable stop failed');
   }
+
+  // Detached tunnel supervisors are outside both server owners. A real stop
+  // closes them once; the next start restores only autostart:true links.
+  (opts.stopTunnelsImpl || stopManagedTunnels)(opts);
   if (platform === 'termux') {
-    const meta = pidf.readPidfile(pidf.defaultPidfilePath(opts.home));
-    return !!(meta && pidf.isAlive(meta));
+    try { execImpl('termux-wake-lock-release', [], { stdio: 'ignore' }); } catch (_) {}
   }
-  return false;
+
+  if (errors.length) {
+    const reason = errors.join('; ');
+    log(`stop: incompleto — ${reason}`);
+    return { platform, owner: before.owner, stopped: false, stoppedOwners, reason };
+  }
+  const alreadyStopped = before.owner === 'stopped';
+  if (alreadyStopped) log(`stop: ${before.portableReason || 'already stopped'}`);
+  return {
+    platform, owner: before.owner, stopped: true, stoppedOwners, alreadyStopped,
+    reason: alreadyStopped ? (before.portableReason || 'already stopped') : undefined,
+  };
+}
+
+// running-check per-platform (no log) — riusato da smart-up / token rotate / update.
+function isServiceRunning(opts = {}) {
+  return resolveRuntimeOwner(opts).owner !== 'stopped';
 }
 
 function bootState(opts = {}) {
@@ -274,12 +379,13 @@ function quickSummary(result, opts = {}) {
   let cached = [];
   try { cached = (require('../nodes/topology-cache.js').loadCache(opts.topologyCachePath || require('../nodes/topology-cache.js').defaultPath(home)) || {}).nodes || []; } catch (_) {}
   const direct = (st && st.nodes) || [];
-  const online = direct.filter((n) => nodesTunnel.readTunnelState(home, n.name).status === 'up').length;
+  const managed = direct.filter((n) => n.direction !== 'inbound');
+  const online = managed.filter((n) => nodesTunnel.readTunnelState(home, n.name).status === 'up').length;
   const known = direct.length + cached.filter((n) => !direct.some((d) => d.nodeId && d.nodeId === n.instanceId)).length;
   log(`NexusCrew ${require('../../package.json').version}`);
   log(`server  ${result.running ? '● running' : '○ stopped'} · 127.0.0.1:${result.port}`);
   log(`boot    ${bootState({ ...opts, platform }).enabled ? 'on' : 'off'} · ${platform}`);
-  log(`nodes   ${known} known · ${online}/${direct.length} direct tunnels up`);
+  log(`nodes   ${known} known · ${online}/${managed.length} hub connections up`);
   log('');
   log('open    nexuscrew show');
   log('link    nexuscrew show token');
@@ -304,25 +410,18 @@ function status(opts = {}) {
   const { configPath, configDir } = urlmod.resolvePaths(opts);
   const nodesPath = opts.nodesPath || path.join(configDir, 'nodes.json');
 
-  const out = { platform, service: null, running: null, port: null, url: null, roles: null, nodes: [] };
+  const runtime = resolveRuntimeOwner({ ...opts, platform, execImpl });
+  const out = {
+    platform, service: runtime.service, running: runtime.owner !== 'stopped',
+    runtimeOwner: runtime.owner, managedRunning: runtime.managedRunning,
+    portableRunning: runtime.portableRunning, portablePid: runtime.portablePid,
+    port: null, url: null, roles: null, nodes: [],
+  };
 
-  if (platform === 'linux') {
-    try {
-      const s = execImpl('systemctl', ['--user', 'is-active', 'nexuscrew'], { encoding: 'utf8' }).trim();
-      out.service = s; out.running = s === 'active';
-    } catch (_) { out.service = 'inactive'; out.running = false; }
-  } else if (platform === 'mac') {
-    out.service = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
-    try {
-      execImpl('launchctl', ['print', out.service], { stdio: 'ignore' });
-      out.running = true;
-    } catch (_) { out.running = false; }
-  } else if (platform === 'termux') {
+  if (platform === 'termux') {
     // boot-script installed vs server running (pidfile vivo)
     const bootScript = path.join(home, '.termux', 'boot', 'nexuscrew.sh');
     out.bootScriptInstalled = fs.existsSync(bootScript);
-    const meta = pidf.readPidfile(pidf.defaultPidfilePath(home));
-    out.running = !!(meta && pidf.isAlive(meta));
     out.service = out.bootScriptInstalled ? 'boot-script installed' : 'no boot-script';
   }
 
@@ -341,8 +440,10 @@ function status(opts = {}) {
         return {
           name: red.name, roles: red.roles,
           remotePort: red.remotePort, localPort: red.localPort,
-          hasToken: red.hasToken,
-          tunnel: nodesTunnel.readTunnelState(home, n.name),
+          direction: red.direction, shared: red.shared, hasToken: red.hasToken,
+          tunnel: n.direction === 'inbound'
+            ? { status: n.shared === true ? 'shared-peer' : 'private-peer', managed: false }
+            : nodesTunnel.readTunnelState(home, n.name),
         };
       });
     }
@@ -354,6 +455,7 @@ function status(opts = {}) {
     log(`platform:  ${out.platform}`);
     log(`service:   ${out.service}`);
     log(`running:   ${out.running}`);
+    log(`runtime:   ${out.runtimeOwner}${out.portablePid ? ` (pid ${out.portablePid})` : ''}`);
     log(`port:      ${out.port}`);
     log(`url:       ${out.url}`);
     log(`roles:     client=${out.roles.client} node=${out.roles.node}`);
@@ -368,23 +470,50 @@ function restart(opts = {}) {
   const platform = opts.platform || detectPlatform();
   const execImpl = opts.execImpl || execFileSync;
   const log = opts.log || console.log;
-  if (platform === 'linux') {
-    execImpl('systemctl', ['--user', 'restart', 'nexuscrew'], { stdio: 'ignore' });
-    log('restart: systemctl --user restart nexuscrew');
-    return { platform, restarted: true };
-  }
-  if (platform === 'mac') {
-    const label = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
-    execImpl('launchctl', ['kickstart', '-k', label], { stdio: 'ignore' });
-    log(`restart: launchctl kickstart -k ${label}`);
-    return { platform, restarted: true };
-  }
-  if (platform === 'termux') {
-    stop({ execImpl, log, platform, uid: opts.uid });
-    start({ execImpl, spawnImpl: opts.spawnImpl, log, platform, uid: opts.uid });
-    return { platform, restarted: true };
+  if (!['linux', 'mac', 'termux'].includes(platform)) throw new Error(`restart: platform ${platform} non supportata`);
+  const before = resolveRuntimeOwner({ ...opts, platform, execImpl });
+
+  // A managed owner can use the service manager's atomic restart. In a
+  // conflict, first remove only the stray portable owner, then keep managed as
+  // the single authority.
+  if (before.managedRunning) {
+    if (before.portableRunning) {
+      const portable = (opts.stopPortableImpl || stopPortableRuntime)(opts);
+      if (!portable.killed) return { platform, owner: before.owner, restarted: false, reason: portable.reason };
+    }
+    try {
+      if (platform === 'linux') {
+        execImpl('systemctl', ['--user', 'restart', 'nexuscrew'], { stdio: 'ignore' });
+        log('restart: systemctl --user restart nexuscrew');
+      } else {
+        const label = `gui/${opts.uid || uid()}/com.mmmbuto.nexuscrew`;
+        execImpl('launchctl', ['kickstart', '-k', label], { stdio: 'ignore' });
+        log(`restart: launchctl kickstart -k ${label}`);
+      }
+      return { platform, owner: before.owner, runtimeOwner: 'managed', restarted: true };
+    } catch (error) {
+      return { platform, owner: before.owner, runtimeOwner: 'managed', restarted: false, reason: String(error.message || error) };
+    }
   }
-  throw new Error(`restart: platform ${platform} non supportata`);
+
+  if (before.portableRunning) {
+    const stopped = stop({ ...opts, platform, execImpl, log });
+    if (!stopped.stopped) return { platform, owner: before.owner, restarted: false, reason: stopped.reason };
+    const started = (opts.startPortableImpl || startPortable)({ ...opts, platform, spawnImpl: opts.spawnImpl });
+    const ok = !!(started && started.started !== false);
+    if (ok) log('restart: portable runtime started');
+    return { platform, owner: before.owner, runtimeOwner: 'portable', restarted: ok, reason: ok ? undefined : started && started.reason };
+  }
+
+  // `restart` on a stopped runtime follows the explicit boot owner; with boot
+  // disabled it starts a portable background runtime.
+  const useManaged = platform !== 'termux' && bootState({ ...opts, platform, execImpl }).enabled;
+  const started = useManaged
+    ? start({ ...opts, platform, execImpl, spawnImpl: opts.spawnImpl, log })
+    : (opts.startPortableImpl || startPortable)({ ...opts, platform, spawnImpl: opts.spawnImpl });
+  const ok = !!(started && started.started !== false);
+  if (ok) log(`restart: ${useManaged ? 'managed' : 'portable'} runtime started`);
+  return { platform, owner: before.owner, runtimeOwner: useManaged ? 'managed' : 'portable', restarted: ok, reason: ok ? undefined : started && started.reason };
 }
 
 function wizardComplete(configPath) {
@@ -446,6 +575,8 @@ async function waitForNexusCrew(port, token, opts = {}) {
 function startPortable(opts = {}) {
   const spawnImpl = opts.spawnImpl || spawn;
   const home = opts.home || require('node:os').homedir();
+  const existing = portableRuntimeState({ home });
+  if (existing.running) return { started: false, reason: 'already running', pid: existing.pid, portable: true };
   const logPath = path.join(home, '.nexuscrew', 'nexuscrew.log');
   fs.mkdirSync(path.dirname(logPath), { recursive: true });
   const logFd = fs.openSync(logPath, 'a');
@@ -502,6 +633,7 @@ async function smartUp(opts = {}) {
   if (!initialized) {
     const requested = opts.port || urlmod.loadPort(opts);
     const selected = await findAvailablePort(requested, opts);
+    refusePairedPortRelocation(opts, requested, selected);
     runInitImpl({ ...opts, port: selected, log: quiet, platform, installBoot: false, printUrl: false });
     port = selected;
     initialized = true;
@@ -519,19 +651,24 @@ async function smartUp(opts = {}) {
   let token = urlmod.readToken(tokenPath);
   let running = await probe(port, token, opts);
   let portableAttempted = false;
-  const managedRunning = isServiceRunning({ ...opts, platform });
-  if (!running && managedRunning) running = await waitForNexusCrew(port, token, opts);
+  let runtime = resolveRuntimeOwner({ ...opts, platform });
+  if (!running && runtime.owner !== 'stopped') running = await waitForNexusCrew(port, token, opts);
 
   if (!running) {
     if (!(await (opts.portAvailableImpl || portAvailable)(port, '127.0.0.1'))) {
+      const previousPort = port;
       port = await findAvailablePort(port + 1, opts);
+      refusePairedPortRelocation(opts, previousPort, port);
       runInitImpl({ ...opts, port, log: quiet, platform, installBoot: persistent, printUrl: false });
       token = urlmod.readToken(tokenPath);
     } else {
       try {
-        const started = persistent
-          ? (managedRunning ? restartImpl({ ...opts, platform, log: quiet }) : startImpl({ ...opts, platform, log: quiet }))
-          : portableStart({ ...opts, platform });
+        runtime = resolveRuntimeOwner({ ...opts, platform });
+        const started = runtime.owner === 'conflict'
+          ? restartImpl({ ...opts, platform, log: quiet })
+          : persistent
+            ? (runtime.managedRunning ? restartImpl({ ...opts, platform, log: quiet }) : startImpl({ ...opts, platform, log: quiet }))
+            : (runtime.portableRunning ? restartImpl({ ...opts, platform, log: quiet }) : portableStart({ ...opts, platform }));
         if (started && started.started === false) {
           portableStart({ ...opts, platform }); portableAttempted = true;
         }
@@ -594,7 +731,7 @@ function tokenRotate(opts = {}) {
       log('token rotate: servizio non attivo (il nuovo token varra\' al prossimo start)');
     }
   }
-  log('usa `nexuscrew url` per il nuovo URL (il token non si stampa qui)');
+  log('usa `nexuscrew show token` per il nuovo URL (il token non si stampa qui)');
   return { rotated: true, running };
 }
 
@@ -703,7 +840,7 @@ function dispatch(argv, opts = {}) {
     log(require('../../package.json').version);
     return { code: 0 };
   }
-  const { flags, rest } = parseFlags(argv, VALUE_FLAGS);
+  const { flags, rest } = parseFlags(argv);
   const cmd = rest[0];
 
   // help esplicito
@@ -742,6 +879,18 @@ function dispatch(argv, opts = {}) {
     log(require('../../package.json').version);
     return { code: 0 };
   }
+  if (cmd === 'status') {
+    status({ ...opts, log });
+    return { code: 0 };
+  }
+  if (cmd === 'stop') {
+    const result = stop({ ...opts, log });
+    return { code: result.stopped || ['not running', 'stale pidfile'].includes(result.reason) ? 0 : 1 };
+  }
+  if (cmd === 'restart') {
+    const result = restart({ ...opts, log });
+    return { code: result.restarted ? 0 : 1 };
+  }
   // Internal runtime commands used by service managers and MCP clients. They
   // are intentionally omitted from HELP and are not configuration surfaces.
   if (cmd === 'serve') {
@@ -766,62 +915,6 @@ function dispatch(argv, opts = {}) {
   return { code: 1 };
 }
 
-// nodes add|list|remove|test|up|down|restart|set-token (design §3, §4).
-function dispatchNodes(rest, flags, opts) {
-  const log = opts.log;
-  const sub = rest[1];
-  const name = rest[2];
-  const common = { ...opts, name };
-  switch (sub) {
-    case 'add':
-      return { code: nodesCmds.nodesAdd({
-        ...common, ssh: flags.ssh, sshPort: flags['ssh-port'], remotePort: flags['remote-port'],
-        key: flags.key, localPort: flags['local-port'], nodeId: flags['node-id'],
-      }).code };
-    case undefined:
-    case 'list':
-      return { code: nodesCmds.nodesList({ ...opts, json: !!flags.json }).code };
-    case 'remove':
-      return { code: nodesCmds.nodesRemove(common).code };
-    case 'up':
-      return { code: nodesCmds.nodesUp(common).code };
-    case 'down':
-      return { code: nodesCmds.nodesDown(common).code };
-    case 'restart':
-      return { code: nodesCmds.nodesRestart(common).code };
-    case 'set-token':
-      return { code: nodesCmds.nodesSetToken(common).code };
-    case 'test': {
-      // async: tieni vivo il processo finche' il probe non risolve, poi exit.
-      const exit = typeof opts.exit === 'function' ? opts.exit : ((c) => process.exit(c));
-      nodesCmds.nodesTest(common)
-        .then((r) => exit(r.code))
-        .catch((e) => { log(`nodes test: error — ${e && e.message ? e.message : e}`); exit(1); });
-      return { code: 0, keepAlive: true };
-    }
-    default:
-      log('usage: nexuscrew nodes add|list|remove|test|up|down|restart|set-token <name>');
-      return { code: 1 };
-  }
-}
-
-// node on|off — ruolo "nodo raggiungibile" (reverse tunnel). §4.
-function dispatchNode(rest, flags, opts) {
-  const log = opts.log;
-  const sub = rest[1];
-  if (sub === 'on') {
-    return { code: nodesCmds.nodeOn({
-      ...opts, rendezvousSsh: flags.rendezvous,
-      publishedPort: flags['published-port'], key: flags.key,
-    }).code };
-  }
-  if (sub === 'off') {
-    return { code: nodesCmds.nodeOff({ ...opts }).code };
-  }
-  log('usage: nexuscrew node on|off');
-  return { code: 1 };
-}
-
 module.exports = {
   dispatch, serve, start, stop, status, parseFlags, HELP,
   smartUp, url, tokenRotate, logs, doctor, update, restart,
@@ -829,5 +922,7 @@ module.exports = {
   servicePinsLegacyPort,
   isServiceRunning, readRoles,
   bootState, bootOn, bootOff, quickSummary,
+  stopManagedTunnels,
+  managedRuntimeState, portableRuntimeState, resolveRuntimeOwner,
   runFleetBoot, dispatchFleetBoot,
 };

package/lib/cli/doctor.js

@@ -1,8 +1,8 @@
 'use strict';
 // nexuscrew doctor: auto-diagnosi (design §3, §7). [A2]
 // Struttura ESTENSIBILE: una lista di check-fn, ognuna ritorna
-//   { name, ok, warn?, detail? }. B0 aggiungerà i check tunnel/ssh (permitlisten,
-//   OpenSSH ≥7.8 sul rendezvous) appendendo alla lista, senza toccare il resto.
+//   { name, ok, warn?, detail? }. SSH è un requisito locale; la policy del
+// server remoto si prova soltanto tentando il forwarding reale.
 // Exit code: 0 se tutti ok (i warn non falliscono), 1 se almeno un check è FAIL.
 // Nessun segreto nell'output (mai il token, solo il path + i permessi).
 const fs = require('node:fs');
@@ -87,22 +87,24 @@ function checkBoot(platform, home, execImpl) {
 // ssh client presente su PATH: prerequisito dei tunnel multi-node (design §4).
 function checkSshClient(existsImpl) {
   return existsImpl('ssh')
-    ? { name: 'ssh client presente', ok: true }
-    : { name: 'ssh client presente', ok: false, detail: 'ssh non trovato su PATH (necessario per i tunnel multi-node)' };
+    ? { name: 'OpenSSH transport', ok: true, detail: 'ssh presente · USATO dal supervisor NexusCrew' }
+    : { name: 'OpenSSH transport', ok: false, detail: 'ssh non trovato su PATH; autossh da solo non funziona senza OpenSSH' };
 }
 
-// OpenSSH >=7.8 per permitlisten (vincola i -R lato rendezvous; design §7 (a)).
-// Determinabile e <7.8 -> FAIL (il ruolo node non e' abilitabile). Non
-// determinabile -> WARN (verifica manuale), non blocca la diagnosi generale.
+function checkAutossh(existsImpl) {
+  return existsImpl('autossh')
+    ? { name: 'autossh', ok: true, detail: 'presente · NON usato (retry gia gestito dal supervisor NexusCrew)' }
+    : { name: 'autossh', ok: true, warn: true, detail: 'assente · opzionale, non necessario con SSH supervisionato' };
+}
+
+// Versione locale informativa. `permitlisten` e' una policy del server sshd e
+// NON puo' essere certificata guardando `ssh -V` sul client: Share la verifica
+// con un vero -R + health autenticato.
 function checkSshPermitlisten(sshVersionImpl) {
   const tun = require('../nodes/tunnel.js');
   const v = tun.readSshVersion(sshVersionImpl);
-  const supp = tun.sshSupportsPermitlisten(v);
-  if (supp === null) {
-    return { name: 'OpenSSH permitlisten (>=7.8)', ok: true, warn: true, detail: 'versione ssh non determinabile — verifica prima di abilitare il ruolo node' };
-  }
-  if (supp) return { name: 'OpenSSH permitlisten (>=7.8)', ok: true, detail: v.raw };
-  return { name: 'OpenSSH permitlisten (>=7.8)', ok: false, detail: `OpenSSH ${v.major}.${v.minor} < 7.8 — permitlisten non supportato (ruolo node non abilitabile)` };
+  if (!v) return { name: 'OpenSSH version', ok: true, warn: true, detail: 'versione non determinabile; Share verra verificato a runtime sul server' };
+  return { name: 'OpenSSH version', ok: true, detail: `${v.raw} · policy reverse verificata a runtime` };
 }
 
 function checkTokenPerms(tokenPath) {
@@ -141,6 +143,7 @@ function doctor(opts = {}) {
     checkBoot(platform, home, execImpl),
     checkTokenPerms(tokenPath),
     checkSshClient(existsImpl),
+    checkAutossh(existsImpl),
     checkSshPermitlisten(opts.sshVersion),
   ];
 
@@ -156,5 +159,5 @@ function doctor(opts = {}) {
 module.exports = {
   doctor, nodeMajor,
   checkNode, checkTmux, checkPty, checkService, checkBoot, checkTokenPerms,
-  checkSshClient, checkSshPermitlisten,
+  checkSshClient, checkAutossh, checkSshPermitlisten,
 };

package/lib/cli/init.js

@@ -115,13 +115,13 @@ function runInit(opts = {}) {
     }
   }
 
-  // Fleet app defaults: soltanto i tre client nativi. Provider cloud/Z.AI sono
+  // Fleet app defaults: soltanto i quattro client nativi. Provider cloud/Z.AI sono
   // disponibili nel catalogo managed ma vanno aggiunti esplicitamente.
   const fleetDefsPath = opts.fleetDefsPath || path.join(configDir, 'fleet.json');
   if (!dryRun && !fs.existsSync(fleetDefsPath)) {
     try {
       writeFleet(fleetDefsPath, defaultDefinitions());
-      actions.push(`created fleet defaults ${fleetDefsPath} (claude.native, codex.native, codex-vl.native)`);
+      actions.push(`created fleet defaults ${fleetDefsPath} (claude.native, codex.native, codex-vl.native, pi.native)`);
     } catch (e) {
       actions.push(`WARN: fleet defaults non creati: ${e.message}`);
     }

package/lib/cli/pidfile.js

@@ -19,9 +19,10 @@ function readPidfile(p) {
 }
 
 // Exclusive create (wx): fallisce se il pidfile esiste già (no overwrite silenzioso).
-function writePidfile(p, pid, cmd) {
+function writePidfile(p, pid, cmd, extra = {}) {
   fs.mkdirSync(path.dirname(p), { recursive: true });
-  const meta = JSON.stringify({ pid, cmd: cmd || '', startTs: Date.now() });
+  const safeExtra = extra && typeof extra === 'object' && !Array.isArray(extra) ? extra : {};
+  const meta = JSON.stringify({ pid, cmd: cmd || '', startTs: Date.now(), ...safeExtra });
   fs.writeFileSync(p, meta + '\n', { flag: 'wx', mode: 0o600 });
 }
 

package/lib/decks/store.js

@@ -9,6 +9,7 @@ const MAX_DECKS = 24;
 const MAX_TILES = 9;
 const NAME_RE = /^[a-z0-9-]{1,32}$/;
 const NODE_RE = /^[a-z0-9-]{1,32}(?:\/[a-z0-9-]{1,32}){0,3}$/;
+const OWNER_ID_RE = /^[a-f0-9]{16,64}$/;
 
 function validNodeRoute(node) {
   if (!NODE_RE.test(node)) return false;
@@ -48,15 +49,17 @@ function parseLayout(raw) {
     for (const t of c.tiles) {
       if (!t || typeof t !== 'object' || Array.isArray(t) || !validText(t.session, 128)) return null;
       if (t.node !== undefined && (typeof t.node !== 'string' || !validNodeRoute(t.node))) return null;
+      if (t.ownerId !== undefined && (typeof t.ownerId !== 'string' || !OWNER_ID_RE.test(t.ownerId))) return null;
       const height = Number(t.height);
       const fontSize = Number(t.fontSize);
       if (!Number.isFinite(height) || height < 0.2 || height > 100) return null;
       if (!Number.isFinite(fontSize) || fontSize < 9 || fontSize > 24) return null;
-      const key = t.node ? `${t.node}:${t.session}` : t.session;
+      const key = t.ownerId ? `${t.ownerId}:${t.session}` : t.node ? `${t.node}:${t.session}` : t.session;
       if (seen.has(key) || ++count > MAX_TILES) return null;
       seen.add(key);
       const tile = { session: t.session, height, fontSize };
       if (t.node) tile.node = t.node;
+      if (t.ownerId) tile.ownerId = t.ownerId;
       tiles.push(tile);
     }
     columns.push({ width, tiles });
@@ -118,6 +121,6 @@ function loadOrCreate(p) {
 }
 
 module.exports = {
-  SCHEMA_VERSION, MAX_DECKS, MAX_TILES, NAME_RE,
+  SCHEMA_VERSION, MAX_DECKS, MAX_TILES, NAME_RE, OWNER_ID_RE,
   defaultDecksPath, emptyStore, parseLayout, parseStore, loadStore, loadOrCreate, atomicWrite,
 };