@mmmbuto/nexuscrew 0.9.28 → 0.9.30

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.9.30 — 2026-09-16
+
+- Internal work references removed from the published package (enforced by the npm payload gate).
+- **Paired nodes exchange a federated event feed.** A subscriber opens a snapshot and then a stream per owner, attributed to the node that emitted it: an imported event is re-emitted locally only, so it can never travel back, and what a peer may see follows its granted access instead of what it asks for.
+- **A question from another node is answered through a durable receipt.** The receipt is written before the paste, so a crash leaves an uncertain attempt that the operator reconciles explicitly instead of a blind retry: the same request replays the stored outcome, a decision is bound to the generation of the outcomes it was taken on, and a terminal outcome refuses any further paste on every path.
+- **Imported notifications ring on the phone, once per event.** A relay with its own queue and alert budget sends the OS alert, keeps a durable per-owner registry so a replay of an already-recorded event or a restart does not ring again within the registry limits (4096 ids over 24 hours); senders remain best-effort, so a single alert per phone is not universally guaranteed (provider dedup and distinct PWA origins are out of contract), and the relay can be turned off per browser.
+- **An imported alert opens the question it came from.** The ask correlation travels from its creation to the alert payload, so the notification lands on that question instead of the owner's page alone.
+- **An imported file delivery stays inside its cell's alert budget.** The file notice keeps the cell it belongs to on the way in, and it is the same class of alert as a local one.
+
+## 0.9.29 — 2026-09-15
+
+- **The Live host of a node is chosen with an explicit command.** `Use as Live host` and `Remove Live host` sit in the cell menu and in the cell selector: the star is a pin only, and a small indicator shows the current host, so the choice and its outcome stay in sight.
+- **A designated Live host that lives on another node is reached through its owner.** The bridge is forwarded to the owner node and its answer — or a named refusal — comes back as it is, with no silent fallback to a local cell; federated bridge calls are rate-limited per sending node.
+- **`nexuscrew init` does not restart a service it does not own.** Run from a HOME that does not own the running service it warns and skips the activation instead of restarting someone else's service (`--no-activate` skips the activation on purpose).
+- **A federated request whose body was already read is refused by name.** A named 502 at once, instead of waiting 30 seconds for a body that nothing will send.
+
 ## 0.9.28 — 2026-09-15
 
 - **The terminal renderer toggle is an icon button** (GPU/DOM stay in the tooltip and in the accessible label), so it no longer widens the bar and squeezes the cell name on phones.

package/docs/LIVE_PROMPT.md

@@ -93,7 +93,7 @@ the pattern to extend if this contract ever changes:
 - `'NATIVA con cella OCCUPATA...'` — the ordinary case, file found and
   applied, identity header followed by the prompt text.
 - `'BUG prefisso: un device con prefisso diverso da cloud- deve trovare
-  comunque il prompt'` — a device whose sessions are named `macair-*`: the
+  comunque il prompt'` — a device whose sessions are named `labhost-*`: the
   file is written under that exact session name, not under `cloud-`, and the
   bridge is expected to find it there. This is the test that would have
   caught the original bug — it fails against the pre-fix bridge and passes

package/docs/NOTIFICATIONS.md

@@ -82,6 +82,43 @@ announces notifications.
 Only new live notification frames are spoken. Persisted questions and previous
 events are not replayed.
 
+## Imported events and one-browser alerts
+
+Events imported from a federated owner ring the operating system too, so a
+closed PWA still shows them. Three rules keep that trustworthy:
+
+- **One alert per event.** An event already alerted never rings twice, not after
+  a replay, not after the service worker is restarted: the identity is the
+  `(owner, eventId)` pair and it is written before the send. A re-import of a
+  known event, a state refresh or an ask closure updates the UI silently.
+- **A local link only.** The notification link is always a path inside this app;
+  an absolute or foreign URL in a payload is dropped and the app root is opened
+  instead. The full text stays in the card — the system alert carries a short
+  preview.
+- **A separate budget.** Imported alerts have their own queue and their own
+  per-minute allowance, apart from local notifications. A noisy or misbehaving
+  owner is dropped and counted; it cannot delay local alerts, and a failed
+  delivery never retries the live stream that already accepted the event.
+
+An alert names the ask it belongs to only when the source event carries one:
+an imported notification does not, because the ask itself arrives as its own
+event and that event deliberately stays silent. That notification therefore
+opens the owner's feed, without an `ask=` component.
+
+### Two PWAs on the same phone
+
+One phone can hold two installed PWAs (for example this node and an owner's).
+Each browser keeps its own subscription, so both can receive alerts. If you want
+the operating system to stay quiet for one of them:
+
+1. Open **Settings → Notifications** in that PWA.
+2. Choose **silence on this browser**.
+
+This is a browser-local choice, stored on the device only: it unsubscribes that
+browser, keeps the app fully usable, and never changes the other side's push
+setup. Turning it back on requires the same button, so a device that was asked
+to stay silent does not re-subscribe itself.
+
 ## Platform notes
 
 | Platform | Expected behavior |

package/docs/OPERATIONS.md

@@ -41,6 +41,26 @@ Termux pidfiles include process identity data. If Android reuses a PID under
 another app UID, NexusCrew removes only the stale pidfile, never signals the
 foreign process, and restarts only the configured OpenSSH supervisor.
 
+## Smoke runs and temporary prefixes
+
+The user service manager (systemd `--user`, launchd) is **per-UID, not
+per-HOME**: it resolves `nexuscrew` by name inside the namespace of the
+logged-in user. `init` writes the boot definition under the HOME it was given,
+so a run against a temporary HOME would otherwise install a definition the
+manager never loads while the activation commands still acted on the real
+installation -- restarting the production service.
+
+For a smoke run or a throwaway prefix, use one of:
+
+- `nexuscrew serve` -- start the runtime without touching the service manager;
+- `nexuscrew init --no-activate` -- write config, token and boot definitions but
+  run no service manager command at all.
+
+Without `--no-activate`, `init` reads back which definition the manager has
+loaded and skips activation with an explicit warning when that definition is not
+the one just written. `nexuscrew restart` from the owning HOME activates it
+afterwards.
+
 ## Backup and restore
 
 **Settings → Fleet** can export and restore selected cells, system prompts and