@mmmbuto/nexuscrew 0.8.9 → 0.8.11

package/lib/cli/doctor.js

@@ -1,8 +1,8 @@
 'use strict';
 // nexuscrew doctor: auto-diagnosi (design §3, §7). [A2]
 // Struttura ESTENSIBILE: una lista di check-fn, ognuna ritorna
-//   { name, ok, warn?, detail? }. B0 aggiungerà i check tunnel/ssh (permitlisten,
-//   OpenSSH ≥7.8 sul rendezvous) appendendo alla lista, senza toccare il resto.
+//   { name, ok, warn?, detail? }. SSH è un requisito locale; la policy del
+// server remoto si prova soltanto tentando il forwarding reale.
 // Exit code: 0 se tutti ok (i warn non falliscono), 1 se almeno un check è FAIL.
 // Nessun segreto nell'output (mai il token, solo il path + i permessi).
 const fs = require('node:fs');
@@ -84,25 +84,45 @@ function checkBoot(platform, home, execImpl) {
   return { name: 'boot (launchd RunAtLoad)', ok: true, warn: !ok, detail: ok ? 'plist installato' : 'plist non installato' };
 }
 
+function checkTmuxSurvival(platform, execImpl) {
+  if (platform !== 'linux') {
+    return { name: 'tmux survival on service restart', ok: true, detail: `${platform}: systemd cgroup non applicabile` };
+  }
+  try {
+    const value = String(execImpl('systemctl', [
+      '--user', 'show', 'nexuscrew.service', '--property=KillMode', '--value',
+    ], { encoding: 'utf8' }) || '').trim();
+    const ok = value === 'process';
+    return {
+      name: 'tmux survival on service restart', ok,
+      detail: ok ? 'KillMode=process' : `KillMode=${value || 'sconosciuto'} (restart NexusCrew puo terminare tmux)`,
+    };
+  } catch (error) {
+    return { name: 'tmux survival on service restart', ok: false, detail: `KillMode non verificabile: ${error.message || error}` };
+  }
+}
+
 // ssh client presente su PATH: prerequisito dei tunnel multi-node (design §4).
 function checkSshClient(existsImpl) {
   return existsImpl('ssh')
-    ? { name: 'ssh client presente', ok: true }
-    : { name: 'ssh client presente', ok: false, detail: 'ssh non trovato su PATH (necessario per i tunnel multi-node)' };
+    ? { name: 'OpenSSH transport', ok: true, detail: 'ssh presente · USATO dal supervisor NexusCrew' }
+    : { name: 'OpenSSH transport', ok: false, detail: 'ssh non trovato su PATH; autossh da solo non funziona senza OpenSSH' };
+}
+
+function checkAutossh(existsImpl) {
+  return existsImpl('autossh')
+    ? { name: 'autossh', ok: true, detail: 'presente · NON usato (retry gia gestito dal supervisor NexusCrew)' }
+    : { name: 'autossh', ok: true, warn: true, detail: 'assente · opzionale, non necessario con SSH supervisionato' };
 }
 
-// OpenSSH >=7.8 per permitlisten (vincola i -R lato rendezvous; design §7 (a)).
-// Determinabile e <7.8 -> FAIL (il ruolo node non e' abilitabile). Non
-// determinabile -> WARN (verifica manuale), non blocca la diagnosi generale.
+// Versione locale informativa. `permitlisten` e' una policy del server sshd e
+// NON puo' essere certificata guardando `ssh -V` sul client: Share la verifica
+// con un vero -R + health autenticato.
 function checkSshPermitlisten(sshVersionImpl) {
   const tun = require('../nodes/tunnel.js');
   const v = tun.readSshVersion(sshVersionImpl);
-  const supp = tun.sshSupportsPermitlisten(v);
-  if (supp === null) {
-    return { name: 'OpenSSH permitlisten (>=7.8)', ok: true, warn: true, detail: 'versione ssh non determinabile — verifica prima di abilitare il ruolo node' };
-  }
-  if (supp) return { name: 'OpenSSH permitlisten (>=7.8)', ok: true, detail: v.raw };
-  return { name: 'OpenSSH permitlisten (>=7.8)', ok: false, detail: `OpenSSH ${v.major}.${v.minor} < 7.8 — permitlisten non supportato (ruolo node non abilitabile)` };
+  if (!v) return { name: 'OpenSSH version', ok: true, warn: true, detail: 'versione non determinabile; Share verra verificato a runtime sul server' };
+  return { name: 'OpenSSH version', ok: true, detail: `${v.raw} · policy reverse verificata a runtime` };
 }
 
 function checkTokenPerms(tokenPath) {
@@ -139,8 +159,10 @@ function doctor(opts = {}) {
     checkPty(ptyLoad),
     checkService(platform, home, execImpl, uidVal, opts.installPath),
     checkBoot(platform, home, execImpl),
+    checkTmuxSurvival(platform, execImpl),
     checkTokenPerms(tokenPath),
     checkSshClient(existsImpl),
+    checkAutossh(existsImpl),
     checkSshPermitlisten(opts.sshVersion),
   ];
 
@@ -156,5 +178,6 @@ function doctor(opts = {}) {
 module.exports = {
   doctor, nodeMajor,
   checkNode, checkTmux, checkPty, checkService, checkBoot, checkTokenPerms,
-  checkSshClient, checkSshPermitlisten,
+  checkTmuxSurvival,
+  checkSshClient, checkAutossh, checkSshPermitlisten,
 };

package/lib/cli/init.js

@@ -115,13 +115,13 @@ function runInit(opts = {}) {
     }
   }
 
-  // Fleet app defaults: soltanto i tre client nativi. Provider cloud/Z.AI sono
+  // Fleet app defaults: soltanto i quattro client nativi. Provider cloud/Z.AI sono
   // disponibili nel catalogo managed ma vanno aggiunti esplicitamente.
   const fleetDefsPath = opts.fleetDefsPath || path.join(configDir, 'fleet.json');
   if (!dryRun && !fs.existsSync(fleetDefsPath)) {
     try {
       writeFleet(fleetDefsPath, defaultDefinitions());
-      actions.push(`created fleet defaults ${fleetDefsPath} (claude.native, codex.native, codex-vl.native)`);
+      actions.push(`created fleet defaults ${fleetDefsPath} (claude.native, codex.native, codex-vl.native, pi.native)`);
     } catch (e) {
       actions.push(`WARN: fleet defaults non creati: ${e.message}`);
     }

package/lib/cli/pidfile.js

@@ -19,9 +19,10 @@ function readPidfile(p) {
 }
 
 // Exclusive create (wx): fallisce se il pidfile esiste già (no overwrite silenzioso).
-function writePidfile(p, pid, cmd) {
+function writePidfile(p, pid, cmd, extra = {}) {
   fs.mkdirSync(path.dirname(p), { recursive: true });
-  const meta = JSON.stringify({ pid, cmd: cmd || '', startTs: Date.now() });
+  const safeExtra = extra && typeof extra === 'object' && !Array.isArray(extra) ? extra : {};
+  const meta = JSON.stringify({ pid, cmd: cmd || '', startTs: Date.now(), ...safeExtra });
   fs.writeFileSync(p, meta + '\n', { flag: 'wx', mode: 0o600 });
 }
 

package/lib/cli/service.js

@@ -4,6 +4,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 const { execFileSync } = require('node:child_process');
 const { detectPlatform, uid } = require('./platform.js');
 
@@ -69,6 +70,9 @@ After=network-online.target
 
 [Service]
 Type=simple
+# The HTTP service may be the process that creates the shared tmux server.
+# Restart only NexusCrew itself; tmux sessions are independent user workloads.
+KillMode=process
 WorkingDirectory=${repo}
 Environment=PATH=${nodeDir}:/usr/local/bin:/usr/bin:/bin
 ExecStart=${node} ${repoBin} serve
@@ -153,6 +157,53 @@ function fileMode(platform) {
   return 0o644; // systemd unit + launchd plist
 }
 
+const LINUX_TMUX_SURVIVAL_DROPIN = `[Service]\n# NexusCrew owns the HTTP process, not the shared tmux server it may start.\nKillMode=process\n`;
+
+function linuxTmuxSurvivalPath(home) {
+  return path.join(home, '.config', 'systemd', 'user', 'nexuscrew.service.d', '10-tmux-survival.conf');
+}
+
+// Upgrade existing Linux installations before stop/restart.  Merely updating
+// the npm package does not rewrite an already-installed unit, so the new CLI
+// installs a narrow drop-in and reloads systemd before any destructive service
+// lifecycle operation.  The target is atomic and never follows a symlink.
+function ensureLinuxTmuxSurvival(opts = {}) {
+  const home = opts.home || os.homedir();
+  const target = opts.dropInPath || linuxTmuxSurvivalPath(home);
+  const execImpl = opts.execImpl || execFileSync;
+  let current = '';
+  try {
+    const st = fs.lstatSync(target);
+    if (st.isSymbolicLink() || !st.isFile()) throw new Error(`refusing unsafe systemd drop-in: ${target}`);
+    current = fs.readFileSync(target, 'utf8');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+
+  let written = false;
+  if (current !== LINUX_TMUX_SURVIVAL_DROPIN) {
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+    try {
+      fs.writeFileSync(tmp, LINUX_TMUX_SURVIVAL_DROPIN, { mode: 0o644, flag: 'wx' });
+      fs.chmodSync(tmp, 0o644);
+      fs.renameSync(tmp, target);
+      written = true;
+    } catch (error) {
+      try { fs.unlinkSync(tmp); } catch (_) {}
+      throw error;
+    }
+  }
+  execImpl('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
+  const effective = String(execImpl('systemctl', [
+    '--user', 'show', 'nexuscrew.service', '--property=KillMode', '--value',
+  ], { encoding: 'utf8' }) || '').trim();
+  if (effective !== 'process') {
+    throw new Error(`unsafe effective systemd KillMode=${effective || 'unknown'}; refusing NexusCrew lifecycle operation`);
+  }
+  return { target, written, killMode: effective };
+}
+
 // Install no-symlink + atomic rename. [M3]
 // - lstat target: reject symlink (no follow)
 // - write temp file nella stessa dir -> chmod mode -> atomic rename
@@ -230,6 +281,7 @@ function installCommands(platform, target, ctx) {
 module.exports = {
   generateService, generateLinux, generateMac, generateTermux,
   installService, installPath, installCommands, fileMode,
+  ensureLinuxTmuxSurvival, linuxTmuxSurvivalPath, LINUX_TMUX_SURVIVAL_DROPIN,
   escapeSystemdPath, escapeSystemdExec, escapeXml, shellQuote,
   assertSystemdSafe, SYSTEMD_FORBIDDEN,
 };

package/lib/decks/store.js

@@ -9,6 +9,7 @@ const MAX_DECKS = 24;
 const MAX_TILES = 9;
 const NAME_RE = /^[a-z0-9-]{1,32}$/;
 const NODE_RE = /^[a-z0-9-]{1,32}(?:\/[a-z0-9-]{1,32}){0,3}$/;
+const OWNER_ID_RE = /^[a-f0-9]{16,64}$/;
 
 function validNodeRoute(node) {
   if (!NODE_RE.test(node)) return false;
@@ -48,15 +49,17 @@ function parseLayout(raw) {
     for (const t of c.tiles) {
       if (!t || typeof t !== 'object' || Array.isArray(t) || !validText(t.session, 128)) return null;
       if (t.node !== undefined && (typeof t.node !== 'string' || !validNodeRoute(t.node))) return null;
+      if (t.ownerId !== undefined && (typeof t.ownerId !== 'string' || !OWNER_ID_RE.test(t.ownerId))) return null;
       const height = Number(t.height);
       const fontSize = Number(t.fontSize);
       if (!Number.isFinite(height) || height < 0.2 || height > 100) return null;
       if (!Number.isFinite(fontSize) || fontSize < 9 || fontSize > 24) return null;
-      const key = t.node ? `${t.node}:${t.session}` : t.session;
+      const key = t.ownerId ? `${t.ownerId}:${t.session}` : t.node ? `${t.node}:${t.session}` : t.session;
       if (seen.has(key) || ++count > MAX_TILES) return null;
       seen.add(key);
       const tile = { session: t.session, height, fontSize };
       if (t.node) tile.node = t.node;
+      if (t.ownerId) tile.ownerId = t.ownerId;
       tiles.push(tile);
     }
     columns.push({ width, tiles });
@@ -118,6 +121,6 @@ function loadOrCreate(p) {
 }
 
 module.exports = {
-  SCHEMA_VERSION, MAX_DECKS, MAX_TILES, NAME_RE,
+  SCHEMA_VERSION, MAX_DECKS, MAX_TILES, NAME_RE, OWNER_ID_RE,
   defaultDecksPath, emptyStore, parseLayout, parseStore, loadStore, loadOrCreate, atomicWrite,
 };

package/lib/fleet/builtin.js

@@ -371,6 +371,17 @@ async function createBuiltinFleet(cfg = {}) {
       throw httpError(/duplicate/i.test(launch.stderr) ? 409 : 500, why);
     }
 
+    // `tmux new-session -d` can return 0 even when the launched CLI exits a
+    // moment later (missing login, bad model, incompatible provider).  Without
+    // this readiness gate the PWA reported success and then showed nothing.
+    // Always verify liveness, including cells without a system prompt.
+    const readyMs = cfg.launchReadyMs != null ? cfg.launchReadyMs : 500;
+    const alive = await waitAlive(tmuxBin, cell.tmuxSession, { env: minimalEnv(), readyMs });
+    if (!alive) {
+      cache = { ...cache, at: 0 };
+      throw httpError(500, `client ${launchEngine.command} terminato subito: verifica login, provider, modello e argomenti dell'engine`);
+    }
+
     // (6) prompt send-keys: bracketed-paste best-effort, target = pane id esatto
     // (fallback al nome sessione con match esatto '=' se tmux non ha stampato l'id).
     let prompt = null;
@@ -379,7 +390,7 @@ async function createBuiltinFleet(cfg = {}) {
       const target = paneId.startsWith('%') ? paneId : `=${cell.tmuxSession}`;
       prompt = await injectPrompt(tmuxBin, cell.tmuxSession, cell.prompt, {
         env: minimalEnv(),
-        readyMs: cfg.sendKeysReadyMs != null ? cfg.sendKeysReadyMs : 400,
+        readyMs: cfg.sendKeysReadyMs != null ? cfg.sendKeysReadyMs : readyMs,
         target,
         engine: launchEngine, cell, // per la redazione del reason se paste-buffer fallisce (§9h)
       });

package/lib/mcp/server.js

@@ -71,6 +71,79 @@ function requireSession(session, tool) {
   );
 }
 
+// Deck layout is stored column-major, while the UI is read row-major. Preserve
+// the visual order so an agent sees the same neighbourhood as the operator.
+function orderedDeckMembers(deck) {
+  const columns = deck && deck.layout && Array.isArray(deck.layout.columns)
+    ? deck.layout.columns : [];
+  const rows = Math.max(0, ...columns.map((column) => (
+    column && Array.isArray(column.tiles) ? column.tiles.length : 0
+  )));
+  const out = [];
+  for (let row = 0; row < rows; row += 1) {
+    for (const column of columns) {
+      const tile = column && Array.isArray(column.tiles) ? column.tiles[row] : null;
+      if (!tile || typeof tile.session !== 'string' || !tile.session) continue;
+      const member = { tmuxSession: tile.session };
+      if (typeof tile.node === 'string' && tile.node) member.node = tile.node;
+      if (typeof tile.ownerId === 'string' && NODE_ID_RE.test(tile.ownerId)) member.ownerId = tile.ownerId;
+      out.push(member);
+    }
+  }
+  return out;
+}
+
+const NODE_PART_RE = /^[a-z0-9-]{1,32}$/;
+const NODE_ID_RE = /^[a-f0-9]{16,64}$/;
+function fleetStatusPath(node) {
+  if (!node) return '/api/fleet/status';
+  const parts = String(node).split('/');
+  if (!parts.length || parts.some((part) => !NODE_PART_RE.test(part))
+    || new Set(parts).size !== parts.length) return null;
+  return `/api/route/${parts.map(encodeURIComponent).join('/')}/_/fleet/status`;
+}
+
+function fleetCellsBySession(payload) {
+  const out = new Map();
+  if (!payload || payload.available !== true || !Array.isArray(payload.cells)) return out;
+  for (const cell of payload.cells) {
+    if (!cell || typeof cell.tmuxSession !== 'string' || !cell.tmuxSession
+      || typeof cell.cell !== 'string' || !cell.cell) continue;
+    out.set(cell.tmuxSession, cell.cell);
+  }
+  return out;
+}
+
+function routePath(route, resource) {
+  if (!Array.isArray(route) || !route.length || route.length > 4
+    || route.some((part) => !NODE_PART_RE.test(part)) || new Set(route).size !== route.length) return null;
+  return `/api/route/${route.map(encodeURIComponent).join('/')}/_/${resource}`;
+}
+
+function topologyOwners(payload) {
+  const out = [];
+  const seen = new Set();
+  for (const node of (payload && Array.isArray(payload.nodes) ? payload.nodes : [])) {
+    if (!node || !NODE_ID_RE.test(String(node.instanceId || '')) || seen.has(node.instanceId)
+      || !Array.isArray(node.route) || !routePath(node.route, 'decks')) continue;
+    seen.add(node.instanceId);
+    out.push({
+      instanceId: node.instanceId,
+      route: [...node.route],
+      label: typeof node.label === 'string' && node.label ? node.label : (node.name || node.route.join(' › ')),
+      stale: node.stale === true,
+    });
+  }
+  return out;
+}
+
+function memberOwnerId(member, deckOwner, ownerTopology) {
+  if (member.ownerId && NODE_ID_RE.test(member.ownerId)) return member.ownerId;
+  if (!member.node) return deckOwner.instanceId;
+  const found = ownerTopology.find((node) => Array.isArray(node.route) && node.route.join('/') === member.node);
+  return found ? found.instanceId : null;
+}
+
 // --- definizione tool (prefisso nc_ anti-collisione) ---------------------------
 // annotations.readOnlyHint:true sui tool che non mutano nulla (§1).
 const TOOLS = [
@@ -176,6 +249,94 @@ const TOOLS = [
       return { sessions, fleet };
     },
   },
+  {
+    name: 'nc_deck',
+    description: 'Contesto read-only del deck della sessione chiamante: restituisce i deck che la contengono e i relativi membri con nome cella Fleet, sessione tmux e route.',
+    inputSchema: { type: 'object', properties: {} },
+    annotations: { readOnlyHint: true },
+    async handler(_args, ctx) {
+      const tmuxSession = requireSession(await ctx.session(), 'nc_deck');
+      const [config, topology, localDecks] = await Promise.all([
+        ctx.api('GET', '/api/config'), ctx.api('GET', '/api/topology'), ctx.api('GET', '/api/decks'),
+      ]);
+      const localNodeId = String(config && config.instanceId || '');
+      if (!NODE_ID_RE.test(localNodeId)) throw new Error('instanceId locale non disponibile');
+      if (!localDecks || !Array.isArray(localDecks.decks)) throw new Error('risposta deck non valida');
+
+      const remotes = topologyOwners(topology).filter((owner) => !owner.stale && owner.instanceId !== localNodeId);
+      const viewerById = new Map([[localNodeId, []], ...remotes.map((owner) => [owner.instanceId, owner.route])]);
+      const sources = [{
+        owner: { instanceId: localNodeId, route: [], label: 'Local' },
+        ownerTopology: topologyOwners(topology), decks: localDecks.decks,
+      }];
+      await Promise.all(remotes.map(async (owner) => {
+        const decksPath = routePath(owner.route, 'decks');
+        const topologyPath = routePath(owner.route, 'topology');
+        if (!decksPath || !topologyPath) return;
+        try {
+          const [deckPayload, ownerTopology] = await Promise.all([
+            ctx.api('GET', decksPath), ctx.api('GET', topologyPath).catch(() => ({ nodes: [] })),
+          ]);
+          if (deckPayload && Array.isArray(deckPayload.decks)) {
+            sources.push({ owner, ownerTopology: topologyOwners(ownerTopology), decks: deckPayload.decks });
+          }
+        } catch (_) { /* owner offline/withdrawn: no stale deck disclosure */ }
+      }));
+
+      const decks = [];
+      for (const source of sources) {
+        for (const deck of source.decks) {
+          if (!deck || typeof deck.name !== 'string') continue;
+          const members = orderedDeckMembers(deck).map((member) => ({
+            ...member,
+            ownerId: memberOwnerId(member, source.owner, source.ownerTopology),
+          }));
+          if (!members.some((member) => member.ownerId === localNodeId && member.tmuxSession === tmuxSession)) continue;
+          decks.push({
+            id: `${source.owner.instanceId}:${deck.name}`,
+            name: deck.name,
+            owner: { instanceId: source.owner.instanceId, route: source.owner.route.length ? source.owner.route.join('/') : 'local', label: source.owner.label },
+            members,
+          });
+        }
+      }
+      decks.sort((a, b) => a.owner.route.localeCompare(b.owner.route) || a.name.localeCompare(b.name));
+
+      if (!decks.length) return { tmuxSession, nodeId: localNodeId, decks: [] };
+
+      const routes = new Set(['']);
+      for (const deck of decks) for (const member of deck.members) {
+        const route = member.ownerId && viewerById.has(member.ownerId)
+          ? viewerById.get(member.ownerId).join('/') : null;
+        member.viewerRoute = route;
+        if (route !== null) routes.add(route);
+      }
+      const cellsByRoute = new Map();
+      await Promise.all([...routes].map(async (route) => {
+        const apiPath = fleetStatusPath(route);
+        if (!apiPath) return;
+        try { cellsByRoute.set(route, fleetCellsBySession(await ctx.api('GET', apiPath))); }
+        catch (_) { cellsByRoute.set(route, new Map()); }
+      }));
+
+      return {
+        tmuxSession, nodeId: localNodeId,
+        decks: decks.map((deck) => ({
+          id: deck.id, name: deck.name, owner: deck.owner,
+          members: deck.members.map((member) => {
+            const route = member.viewerRoute;
+            return {
+              cell: route === null ? null : (cellsByRoute.get(route)?.get(member.tmuxSession) || null),
+              tmuxSession: member.tmuxSession,
+              ownerId: member.ownerId,
+              route: route === null ? 'unavailable' : (route || 'local'),
+              self: member.ownerId === localNodeId && member.tmuxSession === tmuxSession,
+            };
+          }),
+        })),
+      };
+    },
+  },
   {
     name: 'nc_inbox',
     description: 'Elenca i file ricevuti nell\'inbox NexusCrew di questa sessione (read-only).',