@mmmbuto/nexuscrew 0.9.30 → 0.9.32

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## Unreleased
+
+## 0.9.32 — 2026-09-19
+
+- **Column widths from another window no longer land on the wrong columns.** When a deck's poll merged a remote layout that had restructured its columns (tiles moved between columns, columns fused or split), a merged column could inherit the width of a local column that no longer existed in that shape — a narrow column could become wide and the widths no longer summed to the layout. A remote column now keeps the locally resized width only when it holds exactly the same set of tiles as a local column; a restructured column keeps the width the other window chose.
+- **A closure that reached only some of the peers is retried towards the others.** The retry queue used to take a closure only when *no* peer had received it, so as soon as one peer answered, an unreachable one dropped out of the queue for good — and its copy stayed open, because from that side there is no way to repair it. A closure now enters the queue with the peers that did not answer, a second delivery for the same closure merges the missing peers instead of being discarded, and a retry goes only to those, closing the entry when none is left.
+- **An engine now says where its credential came from, and warns when two files disagree.** Every "compatible" source used to look the same, so a key taken from the shell file, from `ai.env` or from `secure/.env` was indistinguishable — and a value in `secure/.env` silently overrides the canonical `ai.env`. The credential's origin is now reported (source, file path, modification time and the first 8 hex characters of the SHA-256 of the value; the value itself is never shown, logged or returned), and when the same variable is defined in more than one file with a *different* value the engine says so instead of looking healthy — including the case where a stale `providers.zsh` overrides the keys files, which is the same fault with the two sides swapped. The doctor gained an `engine credentials` section, and the engine status carries the same information.
+- **The credential precedence is written down.** `docs/CONFIGURATION.md` now states the real order — environment, NexusCrew store, `providers.zsh`, the keys files (`ai.env` then `secure/.env`, which wins), legacy file — and the per-engine `credentialSourcePolicy`, which until now existed in the code and in the UI but was documented nowhere.
+- **Removing a model now counts the cells that override it.** The "model in use" check looked only at engines, so a cell that pins the model for its own engine did not stop the removal: the engine kept working and the cell was left pointing at a model that no longer existed, which surfaced at the next start. The refusal now names both — the engines and the cells — and the model stays declared.
+- **The tmux server probe says when it could not look.** A server that is not running and a probe that was refused (a permission error on the socket, for instance) were reported as the same thing, so a missing answer read as a healthy server. They are now two distinct outcomes, the second naming its cause.
+- **An engine with its own endpoint is reported ready only if that endpoint answers.** A managed engine whose address is declared by hand used to be "ready" as soon as its binary and credential were in place: a router that was switched off looked healthy, and the mistake surfaced when the cell failed to start. NexusCrew now asks the address itself (`GET /v1/models`, 1.5 s budget, one probe per engine every 30 s) and says which host and port did not answer; an endpoint that answers with an authentication challenge counts as alive, because whether the key is the right one is the client's business, not this check's.
+- **A model can be tested on an engine with its own endpoint.** The model test used to answer "unknown profile" for any engine that is not in the public catalog — exactly the internal routers nobody watches. It now asks the engine's own address: the model is looked up in the endpoint's list, and where the list is absent or empty it falls back to a single-token completion, so "the model is there" and "the model is not there" stay distinguishable. The credential is used where the test runs and never appears in the outcome.
+- **Custom engines now list their declared models in the pickers.** A custom profile has no builtin catalog, so the model lists stayed empty even when models were declared for the engine; the engine list now joins the profile catalog with the declared models (for `pi` custom engines the pinned model stays first in the list).
+
+## 0.9.31 — 2026-09-18
+
+- **Deck layout edits survive with several windows open.** A save now rebases and retries instead of failing: the layout is merged per window, an in-flight save is awaited before the next one, a drag that ends with the pointer still down flushes its size, and a rejected save says so in the log instead of losing the change silently.
+- **A model in use is refused by the engine that declares it.** Removing a model now compares against the declaring engine's keys, so an unrelated engine sharing the name no longer blocks the removal — and the rejection names the limit it hit.
+- **The doctor separates the two tmux preload outcomes.** A missing `LD_PRELOAD` support and a tmux server that is not running are reported as different causes, each with its own remedy.
+- **Up to 128 declared models in the fleet catalog (was 64)**; the ceiling is named in the rejection instead of a silent stop.
+
 ## 0.9.30 — 2026-09-16
 
 - Internal work references removed from the published package (enforced by the npm payload gate).

package/docs/CONFIGURATION.md

@@ -30,6 +30,45 @@ Runtime values follow:
 defaults < config file < environment
 ```
 
+### Engine credentials
+
+A managed engine resolves its credential from the first source that has it, in
+this order:
+
+```text
+environment -> NexusCrew store -> user shell (providers.zsh)
+            -> keys files -> legacy file
+```
+
+The keys group is **two files**, read in this order:
+
+```text
+~/.config/keys/ai.env  ->  ~/.config/secure/.env
+```
+
+**The last one wins.** A value in `secure/.env` overrides the same variable in
+`ai.env`, on purpose: it is the place to put an override without touching the
+canonical file. Until now that precedence was not documented anywhere, so the
+only way to notice an override was to compare the files by hand — and an engine
+running on a revoked key looked exactly like an engine running on a good one.
+
+NexusCrew now reports the origin of the credential it resolved: the source, the
+file path, its modification time and the first 8 hex characters of the SHA-256
+of the value. **The value itself is never shown, logged or returned.** When the
+same variable is defined in more than one file with a *different* value, the
+engine stays configured but says so — in the doctor's `engine credentials`
+section, in the engine status `reason`, and in the `credentialConflict` field of
+`GET /fleet/status`.
+
+The order is fixed. An engine can change **where** it looks with
+`credentialSourcePolicy` in its managed profile:
+
+| Policy | Meaning |
+|---|---|
+| `auto` (default) | the order above |
+| `environment` | only the service environment |
+| `nexuscrew-store` | only the NexusCrew store (`~/.nexuscrew/credentials.json`) |
+
 Common overrides:
 
 | Variable | Purpose |