@mmmbuto/nexuscrew 0.9.24 → 0.9.26

package/lib/cli/commands.js

@@ -86,7 +86,7 @@ Lifecycle semantics:
 
 const CLI_VALUE_FLAGS = new Set([
   'label', 'ssh', 'ssh-port', 'autostart', 'visibility', 'selected',
-  'name', 'local-name', 'local-label', 'identity-file', 'port',
+  'name', 'local-name', 'local-label', 'identity-file', 'port', 'dir',
 ]);
 
 // valueFlags (Set|array opzionale): flag che consumano il token successivo nella
@@ -1508,6 +1508,38 @@ function dispatch(argv, opts = {}) {
     serve({ ...opts, pidfile: flags.pidfile, serverStart: opts.serverStart });
     return { code: 0, keepAlive: true }; // server.listen tiene il processo vivo; non exit
   }
+  if (cmd === 'identity') {
+    const sub = rest[1];
+    if (sub !== 'provision') {
+      log('usage: nexuscrew identity provision [--force] [--no-write-config] [--dir <path>]');
+      return { code: sub === undefined ? 0 : 1 };
+    }
+    const provision = require('../fleet/identity-provision.js').provisionIdentityAuthority;
+    const home = opts.home || require('node:os').homedir();
+    const result = provision({
+      home,
+      dir: flags.dir,
+      force: flags.force === true,
+      writeConfig: flags['no-write-config'] !== true,
+    });
+    if (!result.ok) {
+      log(`identity provision: ${result.message}`);
+      log(`  existing credential files:`);
+      for (const filePath of result.existing) log(`    ${filePath}`);
+      return { code: 1 };
+    }
+    log(`identity provision: credentials written under ${result.dir} (0600, dir 0700)`);
+    log('identity provision: fleet.identity.mode = "authority"');
+    if (result.configUpdated) {
+      log(`identity provision: config updated (${result.mode})`);
+    } else {
+      log('identity provision: config NOT written (--no-write-config). Apply manually:');
+      log('  fleet.identity.mode = "authority"');
+      log(`  keep both credential files in place under ${result.dir}`);
+    }
+    log('identity provision: restart the NexusCrew service to activate authority mode');
+    return { code: 0 };
+  }
   if (cmd === 'doctor') {
     if (flags.peers === true) return dispatchNodes(['nodes', 'doctor'], flags, opts);
     const r = doctor({ ...opts, log });

package/lib/cli/doctor.js

@@ -462,6 +462,24 @@ function checkMcpIdentity(env) {
   const e = env || process.env;
   const hasTmux = !!(typeof e.TMUX === 'string' && e.TMUX);
   const hasSession = !!(typeof e.NEXUSCREW_MCP_SESSION === 'string' && e.NEXUSCREW_MCP_SESSION.trim());
+  const verifiedNames = [
+    'NEXUSCREW_VERIFIED_ENV_VERSION',
+    'NEXUSCREW_VERIFIED_OWNER_INSTANCE_ID',
+    'NEXUSCREW_VERIFIED_CELL_ID',
+    'NEXUSCREW_VERIFIED_INCARNATION_ID',
+    'NEXUSCREW_VERIFIED_BINDING_ID',
+    'NEXUSCREW_VERIFIED_ORIGIN',
+    'NEXUSCREW_VERIFIED_THREAD_ID',
+  ];
+  const verifiedPresent = verifiedNames.filter((name) => typeof e[name] === 'string' && e[name]);
+  if (verifiedPresent.length) {
+    return {
+      name: 'MCP identity env',
+      ok: true,
+      detail: `metadati verified osservabili (${verifiedPresent.length}/7 nomi NEXUSCREW_VERIFIED_*): `
+        + 'identita attribuita solo dopo introspezione authority riuscita',
+    };
+  }
   if (hasTmux || hasSession) {
     const src = [];
     if (hasTmux) src.push('TMUX');
@@ -469,16 +487,80 @@ function checkMcpIdentity(env) {
     return {
       name: 'MCP identity env',
       ok: true,
-      detail: `identita osservabile (${src.join('+')})`,
+      detail: `identita legacy osservabile (${src.join('+')})`,
     };
   }
   return {
     name: 'MCP identity env',
     ok: true, // mai FAIL: PWA-only senza MCP configurato non deve rompere il doctor
     warn: true,
-    detail: 'nessuna identita MCP osservabile (TMUX/NEXUSCREW_MCP_SESSION assenti nel processo doctor); '
-      + 'se integri l\'MCP stdio allowlista i nomi (codex-vl mcp add --env-var) — PWA-only: ignorabile',
+    detail: 'nessuna identita MCP osservabile (nessun NEXUSCREW_VERIFIED_* e nessuna variabile legacy '
+      + 'nel processo doctor). Percorsi validi: sessione verified (codex-vl >= 0.154.0-vl.3 + NexusCrew '
+      + '>= 0.9.25 con authority mode provisionato) oppure sessione legacy con le tre variabili ereditate '
+      + 'dal client MCP. NON allowlistare i nomi legacy in env_vars del server MCP: con vl.3 lo spawn '
+      + 'verified fallisce — PWA-only: ignorabile',
+  };
+}
+
+// Stato dell'authority mode (registro flotta). Mostra mode e costruibilita' dell'
+// authority (file presenti, permessi) SENZA mai esporre valori.
+function checkIdentityAuthorityMode({ home, configPath, env } = {}) {
+  const e = env || process.env;
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const cfgPath = configPath
+    || process.env.NEXUSCREW_CONFIG_FILE
+    || path.join(home || os.homedir(), '.nexuscrew', 'config.json');
+  let cfg = {};
+  try { cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8')) || {}; } catch (_) { cfg = {}; }
+  const mode = cfg.fleetIdentityMode
+    || (cfg.fleet && cfg.fleet.identity && cfg.fleet.identity.mode)
+    || 'legacy';
+  const dir = cfg.identityAuthorityDir || path.join(home || os.homedir(), '.nexuscrew', 'identity-authority');
+  const files = ['daemon.credential', 'launcher.credential'];
+  const present = [];
+  const values = {};
+  const problems = [];
+  for (const name of files) {
+    const filePath = path.join(dir, name);
+    try {
+      const st = fs.lstatSync(filePath);
+      if (!st.isFile()) { problems.push(`${name}: non regolare`); continue; }
+      if ((st.mode & 0o777) !== 0o600) { problems.push(`${name}: permessi non 0600`); continue; }
+      const value = fs.readFileSync(filePath, 'utf8').trim();
+      if (!value) { problems.push(`${name}: vuoto`); continue; }
+      present.push(name);
+      values[name] = value;
+    } catch (_) { problems.push(`${name}: assente`); }
+  }
+  // The two credentials must be DISTINCT (constant-time comparison):
+  // identical means the authority is not constructible, fail-closed.
+  let distinctLine = 'credentials distinct: n/a (una o entrambe assenti)';
+  if (present.length === 2) {
+    const distinct = Buffer.from(values['daemon.credential'])
+      .compare(Buffer.from(values['launcher.credential'])) !== 0;
+    distinctLine = `credentials distinct: ${distinct ? 'yes' : 'no'}`;
+    if (!distinct) problems.push('credenziali daemon e launcher identiche');
+  }
+  const constructible = present.length === 2 && problems.length === 0;
+  const ok = mode !== 'authority' || constructible;
+  const out = {
+    name: 'Fleet identity authority mode',
+    ok,
+    detail: `mode=${mode}; credenziali: ${present.length === 2 ? 'entrambe presenti (0600)' : present.join('+') || 'nessuna'} `
+      + `(${dir}); ${distinctLine}${problems.length ? '; problemi: ' + problems.join(', ') : ''}`,
   };
+  if (mode !== 'authority') {
+    out.warn = true;
+    out.detail += ' — il launcher espone CODEX_APP_SERVER_IDENTITY_REQUIRED=0: provisiona con '
+      + '`nexuscrew identity provision` per attivare l\'authority mode';
+  } else if (!constructible) {
+    out.detail += ' — authority: configured but unavailable: '
+      + (problems.length ? problems.join(', ') : 'credentials not constructible')
+      + ' — le celle protette (codex-vl) non partono [IDENTITY_AUTHORITY_UNAVAILABLE]';
+  }
+  void e;
+  return out;
 }
 
 function checkFleetDefinitions(home, fleetDefsPath, enabled = true) {
@@ -578,6 +660,7 @@ function doctor(opts = {}) {
     checkAutossh(existsImpl),
     checkSshPermitlisten(opts.sshVersion),
     checkMcpIdentity(opts.env),
+    checkIdentityAuthorityMode({ home: opts.home, env: opts.env }),
     checkTmuxServerCwd(platform, execImpl, { tmuxBin: opts.tmuxBin, procCwdImpl: opts.procCwdImpl }),
     checkTmuxServerTermuxPreload(opts.env, execImpl, { platform, home, tmuxBin: opts.tmuxBin }),
   ];
@@ -601,6 +684,6 @@ module.exports = {
   checkFleetServiceWorkingDirectory,
   checkTmuxSurvival, checkUserLinger,
   checkSshClient, checkAutossh, checkSshPermitlisten,
-  checkMcpIdentity, checkTermuxExec,
+  checkMcpIdentity, checkIdentityAuthorityMode, checkTermuxExec,
   checkTmuxServerCwd, checkTmuxServerTermuxPreload,
 };

package/lib/config.js

@@ -135,8 +135,58 @@ function envOverrides() {
 }
 
 // Precedence: baseDefaults < config.json < env < opts. [B2]
+// Le credenziali authority vivono in due file 0600 nella dir
+// dell'authority (default ~/.nexuscrew/identity-authority). Se esistono vengono
+// caricate qui, senza MAI loggare i valori: builtin costruisce l'authority
+// solo quando ENTRAMBE sono presenti e distinte.
+function readIdentityAuthorityCredentials(cfg = {}) {
+  const fs = require('node:fs');
+  const crypto = require('node:crypto');
+  const dir = cfg.identityAuthorityDir
+    || path.join(cfg.home || os.homedir(), '.nexuscrew', 'identity-authority');
+  // Enforced AT LOAD. Identical credentials or wrong permissions
+  // (files != 0600, dir != 0700) => the credentials are NOT loaded: the
+  // authority is not constructed and the protected launch is refused instead.
+  // The reason travels in identityAuthorityFault, and never carries a value.
+  const faults = [];
+  let dirMode = null;
+  try { dirMode = fs.lstatSync(dir).mode & 0o777; } catch (_) { faults.push('authority dir missing'); }
+  if (dirMode !== null && dirMode !== 0o700) faults.push('authority dir mode is not 0700');
+  const readOne = (name) => {
+    try {
+      const st = fs.lstatSync(path.join(dir, name));
+      if (!st.isFile()) { faults.push(`${name}: not a regular file`); return undefined; }
+      if ((st.mode & 0o777) !== 0o600) { faults.push(`${name}: mode is not 0600`); return undefined; }
+      const value = fs.readFileSync(path.join(dir, name), 'utf8').trim();
+      if (!value) { faults.push(`${name}: empty`); return undefined; }
+      return value;
+    } catch (_) { faults.push(`${name}: missing`); return undefined; }
+  };
+  const daemon = readOne('daemon.credential');
+  const launcher = readOne('launcher.credential');
+  if (daemon && launcher) {
+    let distinct;
+    try {
+      distinct = !crypto.timingSafeEqual(Buffer.from(daemon), Buffer.from(launcher));
+    } catch (_) { distinct = false; }
+    if (!distinct) faults.push('daemon and launcher credentials are identical');
+  }
+  const out = {};
+  if (faults.length) {
+    out.identityAuthorityFault = faults.join('; ');
+    return out;
+  }
+  if (daemon) out.identityDaemonCredential = daemon;
+  if (launcher) out.identityLauncherCredential = launcher;
+  return out;
+}
+
 function loadConfig(opts = {}) {
-  return { ...baseDefaults(), ...readConfigJson(), ...envOverrides(), ...opts };
+  const merged = { ...baseDefaults(), ...readConfigJson(), ...envOverrides(), ...opts };
+  // I file di credenziale sono fallback: non sovrascrivono mai valori espliciti
+  // di config.json/env/opts (precedence invariata).
+  const creds = readIdentityAuthorityCredentials(merged);
+  return { ...merged, ...creds };
 }
 
 // Retrocompat: defaults() = baseDefaults + env (NO config.json — per test isolati

package/lib/fleet/builtin.js

@@ -700,11 +700,23 @@ async function createBuiltinFleet(cfg = {}) {
   // leaseManager e launchBroker. L'authority resta server-side: nessuna
   // credenziale o chiave HMAC attraversa il payload consegnato alla cella.
   const identityMode = cfg.fleetIdentityMode || cfg.fleet?.identity?.mode || 'legacy';
+  // Identical credentials => the authority is NOT constructed (consistent with
+  // identity-authority, which would reject at runtime anyway), and the reason
+  // goes to the log.
+  const identityCredentialsDistinct = (typeof cfg.identityDaemonCredential === 'string'
+      && typeof cfg.identityLauncherCredential === 'string')
+    ? Buffer.from(cfg.identityDaemonCredential).compare(Buffer.from(cfg.identityLauncherCredential)) !== 0
+    : !!(cfg.identityDaemonCredential && cfg.identityLauncherCredential);
+  if (identityMode === 'authority' && !identityCredentialsDistinct && cfg.log) {
+    cfg.log('fleet identity: authority mode requested but daemon and launcher credentials '
+      + 'are identical or missing; identity enforcement stays off (REQUIRED=0)');
+  }
   const identityOwnerInstanceId = typeof cfg.identityOwnerInstanceId === 'function'
     ? cfg.identityOwnerInstanceId()
     : (cfg.identityOwnerInstanceId || null);
   const identityAuthority = cfg.identityAuthority || (
-    cfg.identityDaemonCredential && cfg.identityLauncherCredential
+    identityCredentialsDistinct
+      && cfg.identityDaemonCredential && cfg.identityLauncherCredential
       ? createIdentityAuthority({
         dir: cfg.identityAuthorityDir || path.join(home, '.nexuscrew', 'identity-authority'),
         daemonCredential: cfg.identityDaemonCredential,

package/lib/fleet/catalogs/opencode-go.json

@@ -279,9 +279,102 @@
       "supports_search_tool": false
     },
     {
-      "slug": "glm-5",
-      "display_name": "glm-5",
-      "description": "OpenCode Go: glm-5",
+      "slug": "deepseek-v4-flash-vision-exp",
+      "display_name": "deepseek-v4-flash-vision-exp",
+      "description": "OpenCode Go: deepseek-v4-flash-vision-exp (vision)",
+      "default_reasoning_level": "high",
+      "supported_reasoning_levels": [
+        {
+          "effort": "low",
+          "description": "Fast responses with lighter reasoning"
+        },
+        {
+          "effort": "high",
+          "description": "Greater reasoning depth for complex problems"
+        },
+        {
+          "effort": "max",
+          "description": "Maximum reasoning depth"
+        }
+      ],
+      "shell_type": "default",
+      "visibility": "list",
+      "supported_in_api": true,
+      "priority": 57,
+      "availability_nux": null,
+      "upgrade": null,
+      "base_instructions": "",
+      "supports_reasoning_summaries": true,
+      "default_reasoning_summary": "none",
+      "support_verbosity": false,
+      "default_verbosity": null,
+      "apply_patch_tool_type": null,
+      "web_search_tool_type": "text",
+      "truncation_policy": {
+        "mode": "tokens",
+        "limit": 1000000
+      },
+      "supports_parallel_tool_calls": false,
+      "supports_image_detail_original": true,
+      "context_window": 1000000,
+      "effective_context_window_percent": 95,
+      "experimental_supported_tools": [],
+      "input_modalities": [
+        "text",
+        "image"
+      ],
+      "supports_search_tool": false
+    },
+    {
+      "slug": "deepseek-v4.1-flash",
+      "display_name": "deepseek-v4.1-flash",
+      "description": "OpenCode Go: deepseek-v4.1-flash",
+      "default_reasoning_level": "high",
+      "supported_reasoning_levels": [
+        {
+          "effort": "low",
+          "description": "Fast responses with lighter reasoning"
+        },
+        {
+          "effort": "high",
+          "description": "Greater reasoning depth for complex problems"
+        },
+        {
+          "effort": "max",
+          "description": "Maximum reasoning depth"
+        }
+      ],
+      "shell_type": "default",
+      "visibility": "list",
+      "supported_in_api": true,
+      "priority": 58,
+      "availability_nux": null,
+      "upgrade": null,
+      "base_instructions": "",
+      "supports_reasoning_summaries": true,
+      "default_reasoning_summary": "none",
+      "support_verbosity": false,
+      "default_verbosity": null,
+      "apply_patch_tool_type": null,
+      "web_search_tool_type": "text",
+      "truncation_policy": {
+        "mode": "tokens",
+        "limit": 1000000
+      },
+      "supports_parallel_tool_calls": false,
+      "supports_image_detail_original": false,
+      "context_window": 1000000,
+      "effective_context_window_percent": 95,
+      "experimental_supported_tools": [],
+      "input_modalities": [
+        "text"
+      ],
+      "supports_search_tool": false
+    },
+    {
+      "slug": "glm-5.3",
+      "display_name": "glm-5.3",
+      "description": "OpenCode Go: glm-5.3",
       "default_reasoning_level": "medium",
       "supported_reasoning_levels": [
         {
@@ -300,7 +393,7 @@
       "shell_type": "default",
       "visibility": "list",
       "supported_in_api": true,
-      "priority": 55,
+      "priority": 59,
       "availability_nux": null,
       "upgrade": null,
       "base_instructions": "",
@@ -312,11 +405,11 @@
       "web_search_tool_type": "text",
       "truncation_policy": {
         "mode": "tokens",
-        "limit": 202752
+        "limit": 1000000
       },
       "supports_parallel_tool_calls": false,
       "supports_image_detail_original": false,
-      "context_window": 202752,
+      "context_window": 1000000,
       "effective_context_window_percent": 95,
       "experimental_supported_tools": [],
       "input_modalities": [
@@ -325,28 +418,74 @@
       "supports_search_tool": false
     },
     {
-      "slug": "deepseek-v4-flash-vision-exp",
-      "display_name": "deepseek-v4-flash-vision-exp",
-      "description": "OpenCode Go: deepseek-v4-flash-vision-exp (vision)",
-      "default_reasoning_level": "high",
+      "slug": "glm-5.3-flash",
+      "display_name": "glm-5.3-flash",
+      "description": "OpenCode Go: glm-5.3-flash",
+      "default_reasoning_level": "medium",
       "supported_reasoning_levels": [
         {
           "effort": "low",
           "description": "Fast responses with lighter reasoning"
         },
+        {
+          "effort": "medium",
+          "description": "Balanced reasoning depth"
+        },
         {
           "effort": "high",
           "description": "Greater reasoning depth for complex problems"
+        }
+      ],
+      "shell_type": "default",
+      "visibility": "list",
+      "supported_in_api": true,
+      "priority": 60,
+      "availability_nux": null,
+      "upgrade": null,
+      "base_instructions": "",
+      "supports_reasoning_summaries": true,
+      "default_reasoning_summary": "none",
+      "support_verbosity": false,
+      "default_verbosity": null,
+      "apply_patch_tool_type": null,
+      "web_search_tool_type": "text",
+      "truncation_policy": {
+        "mode": "tokens",
+        "limit": 1000000
+      },
+      "supports_parallel_tool_calls": false,
+      "supports_image_detail_original": false,
+      "context_window": 1000000,
+      "effective_context_window_percent": 95,
+      "experimental_supported_tools": [],
+      "input_modalities": [
+        "text"
+      ],
+      "supports_search_tool": false
+    },
+    {
+      "slug": "longcat-2.0",
+      "display_name": "longcat-2.0",
+      "description": "OpenCode Go: longcat-2.0",
+      "default_reasoning_level": "medium",
+      "supported_reasoning_levels": [
+        {
+          "effort": "low",
+          "description": "Fast responses with lighter reasoning"
         },
         {
-          "effort": "max",
-          "description": "Maximum reasoning depth"
+          "effort": "medium",
+          "description": "Balanced reasoning depth"
+        },
+        {
+          "effort": "high",
+          "description": "Greater reasoning depth for complex problems"
         }
       ],
       "shell_type": "default",
       "visibility": "list",
       "supported_in_api": true,
-      "priority": 57,
+      "priority": 61,
       "availability_nux": null,
       "upgrade": null,
       "base_instructions": "",
@@ -361,13 +500,58 @@
         "limit": 1000000
       },
       "supports_parallel_tool_calls": false,
-      "supports_image_detail_original": true,
+      "supports_image_detail_original": false,
       "context_window": 1000000,
       "effective_context_window_percent": 95,
       "experimental_supported_tools": [],
       "input_modalities": [
-        "text",
-        "image"
+        "text"
+      ],
+      "supports_search_tool": false
+    },
+    {
+      "slug": "hy4-preview",
+      "display_name": "hy4-preview",
+      "description": "OpenCode Go: hy4-preview",
+      "default_reasoning_level": "medium",
+      "supported_reasoning_levels": [
+        {
+          "effort": "low",
+          "description": "Fast responses with lighter reasoning"
+        },
+        {
+          "effort": "medium",
+          "description": "Balanced reasoning depth"
+        },
+        {
+          "effort": "high",
+          "description": "Greater reasoning depth for complex problems"
+        }
+      ],
+      "shell_type": "default",
+      "visibility": "list",
+      "supported_in_api": true,
+      "priority": 62,
+      "availability_nux": null,
+      "upgrade": null,
+      "base_instructions": "",
+      "supports_reasoning_summaries": true,
+      "default_reasoning_summary": "none",
+      "support_verbosity": false,
+      "default_verbosity": null,
+      "apply_patch_tool_type": null,
+      "web_search_tool_type": "text",
+      "truncation_policy": {
+        "mode": "tokens",
+        "limit": 1024000
+      },
+      "supports_parallel_tool_calls": false,
+      "supports_image_detail_original": false,
+      "context_window": 1024000,
+      "effective_context_window_percent": 95,
+      "experimental_supported_tools": [],
+      "input_modalities": [
+        "text"
       ],
       "supports_search_tool": false
     }

package/lib/fleet/cell-exec.js

@@ -111,9 +111,14 @@ function validLease(value) {
 
 function validPayload(payload) {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false;
-  if (Object.keys(payload).some((key) => !['command', 'args', 'env', 'supervise', 'restartPrompt', 'lease', 'identity'].includes(key))) return false;
+  if (Object.keys(payload).some((key) => !['command', 'args', 'env', 'supervise', 'restartPrompt', 'lease', 'identity', 'identityChannel'].includes(key))) return false;
   if (typeof payload.command !== 'string' || !payload.command || !Array.isArray(payload.args)) return false;
   if (!payload.env || typeof payload.env !== 'object' || Array.isArray(payload.env)) return false;
+  // Il launcher decide se il canale identita' esiste (managed.js) e lo dichiara
+  // nel payload con `identityChannel`: il supervisore non lo ricalcola. La chiave
+  // va quindi ammessa qui, e SOLO come booleano: un valore di altro tipo e' un
+  // payload malformato, non un "canale assente" (assente = caller precedente).
+  if (payload.identityChannel !== undefined && typeof payload.identityChannel !== 'boolean') return false;
   return payload.args.every((v) => typeof v === 'string')
     && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string')
     && validSupervise(payload.supervise)
@@ -522,7 +527,16 @@ async function main(argv = process.argv.slice(2), seams = {}) {
   const sleep = seams.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const proc = seams.process || process;
   const writeError = seams.writeError || seams.stderrWrite || ((message) => process.stderr.write(message));
-  const childEnv = { ...payload.env, NEXUSCREW_IDENTITY_FD: '3:4' };
+  // Il canale identita' nasce SOLO se il launcher lo ha deciso: la stessa
+  // risoluzione che decide CODEX_APP_SERVER_IDENTITY_REQUIRED in managed.js
+  // viaggia nel payload come `identityChannel`. Derivarlo qui (aggiungere
+  // sempre fd 3:4) permetteva ai due di divergere: una cella standalone
+  // riceveva il canale, avviava l'handshake contro un lease server legacy che
+  // rispondeva 'revoked', e moriva. Un payload senza il campo (caller
+  // precedenti) conserva il comportamento di prima.
+  const identityChannel = payload.identityChannel !== false;
+  const childEnv = { ...payload.env };
+  if (identityChannel) childEnv.NEXUSCREW_IDENTITY_FD = '3:4';
   // tmux injects these only after the broker ticket was created. Preserve them
   // for the actual TUI and bind NexusCrew MCP callbacks to the owning session.
   if (process.env.TMUX) childEnv.TMUX = process.env.TMUX;
@@ -612,7 +626,11 @@ async function main(argv = process.argv.slice(2), seams = {}) {
       const promptCtl = startGenerationPrompt(payload.restartPrompt, generation, childState, seams);
       current = spawnImpl(payload.command, payload.args, {
         env: childEnv,
-        stdio: ['inherit', 'inherit', 'inherit', 'pipe', 'pipe'],
+        // Senza canale non si creano nemmeno le pipe: fd 3 e 4 chiusi nel
+        // child (non pipe aperte e inutilizzate).
+        stdio: identityChannel
+          ? ['inherit', 'inherit', 'inherit', 'pipe', 'pipe']
+          : ['inherit', 'inherit', 'inherit'],
       });
       // R1a (fix5): exit/error del figlio contano SUBITO, prima di qualunque
       // await — se il figlio esce durante l'handshake di generazione, l'evento
@@ -649,7 +667,15 @@ async function main(argv = process.argv.slice(2), seams = {}) {
           ),
           childExit.then(() => 'exited'),
         ]);
-        if (raced === 'ok' && !childSettled) {
+        if (!identityChannel) {
+          // Nessun canale da aprire: la transizione di generazione resta
+          // annunciata al lease (bookkeeping), ma l'identita' non esiste e
+          // non c'e' nessun fd da chiudere. L'uscita del figlio resta
+          // diagnostica.
+          if (raced === 'exited') {
+            writeError(`nexuscrew cell: figlio uscito durante l'handshake di generazione (gen ${generation})\n`);
+          }
+        } else if (raced === 'ok' && !childSettled) {
           identityCtl = createIdentityChannel({
             request: current && current.stdio && current.stdio[3],
             response: current && current.stdio && current.stdio[4],
@@ -671,7 +697,7 @@ async function main(argv = process.argv.slice(2), seams = {}) {
         } else {
           writeError(`nexuscrew cell: generazione ${generation} senza identita' (${raced})\n`);
         }
-      } else {
+      } else if (identityChannel) {
         identityCtl = createIdentityChannel({
           request: current && current.stdio && current.stdio[3],
           response: current && current.stdio && current.stdio[4],