@mmmbuto/nexuscrew 0.9.43 → 0.9.46

package/frontend/dist/index.html

@@ -11,8 +11,8 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-CeN87Vib.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-DDw517fP.css">
+  <script type="module" crossorigin src="/assets/index-DN3krh50.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-BaqhMxzK.css">
 </head>
 <body>
   <div id="root"></div>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.43"}
+{"version":"0.9.46"}

package/lib/cli/commands.js

@@ -46,6 +46,15 @@ Usage:
   nexuscrew help     show this help
   nexuscrew version  show the installed version
 
+Runtime commands for service managers, MCP clients and the boot integration
+(not configuration surfaces):
+
+  nexuscrew serve    run the runtime in the foreground (--pidfile available)
+  nexuscrew mcp      serve the MCP bridge on stdio for AI sessions
+  nexuscrew fleet-boot  start the cells marked boot:true
+  nexuscrew identity provision [--force] [--no-write-config] [--dir <path>]
+                     write the node identity authority credentials
+
 Configuration, engines, models and advanced lifecycle also live in the PWA.
 NexusCrew binds only to 127.0.0.1 and automatically selects a free port.`;
 
@@ -1557,8 +1566,9 @@ function dispatch(argv, opts = {}) {
       waitDelayMs: opts.waitDelayMs === undefined ? 250 : opts.waitDelayMs,
     }).then(attesa);
   }
-  // Internal runtime commands used by service managers and MCP clients. They
-  // are intentionally omitted from HELP and are not configuration surfaces.
+  // Internal runtime commands used by service managers, MCP clients and the
+  // boot integration. They are not configuration surfaces: the help lists
+  // them under their own heading, apart from the public commands.
   if (cmd === 'serve') {
     serve({ ...opts, pidfile: flags.pidfile, serverStart: opts.serverStart });
     return { code: 0, keepAlive: true }; // server.listen tiene il processo vivo; non exit

package/lib/files/telemetry.js

@@ -1,8 +1,9 @@
 'use strict';
 // Telemetria per-cella: contesto LIBERO e tier 5h/7d USATI, letti dal file che
-// la statusline di Claude Code scrive in <root>/<sessione>/telemetry.json
-// (snippet documentato in docs/STATUSLINE_TELEMETRY.md, NON applicato: la
-// statusline e' dell'operatore). Il verso dei due dati e' OPPOSTO e i nomi del file lo
+// la statusline di Claude Code scrive in <root>/<sessione>/telemetry.json.
+// Quel file e' dell'operatore: NexusCrew non installa ne' modifica la sua
+// statusline, e legge solo cio' che lei ha gia' scritto. Il verso dei due dati
+// e' OPPOSTO e i nomi del file lo
 // portano scritto dentro: `contextFreePct` e' quanto RESTA, `tier*UsedPct` e'
 // quanto e' STATO CONSUMATO. Confondere i versi produce una riga che dice il
 // contrario del vero e fa prendere la decisione opposta a quella giusta.

package/lib/fleet/cell-lease-server.js

@@ -369,10 +369,10 @@ function createLeaseManager(cfg = {}, seams = {}) {
     return true;
   }
 
-  //  il canale verify espone l'enum COMPLETO del contratto v1
-  // (docs/identity/verify-channel-v1.md): a differenza del relay
-  // challenge-proof (che collassa i motivi sensibili), qui la diagnostica
-  // puntuale e' parte del contratto — il daemon decide il fail-closed.
+  // Il canale verify espone l'enum COMPLETO del contratto v1: a differenza
+  // del relay challenge-proof (che collassa i motivi sensibili), qui la
+  // diagnostica puntuale e' parte del contratto — il daemon decide il
+  // fail-closed.
   function identityVerifyReason(reason) {
     const known = new Set([
       'malformed', 'expired', 'bad-proof', 'replay', 'challenge-replay',

package/lib/proxy/node-proxy.js

@@ -150,7 +150,7 @@ function notFound(res) { res.status(404).json({ error: 'not found' }); }
 // passata (requireToken davanti). Ordine interno: name strict -> no-transitive ->
 // resolve -> readonly -> proxy.
 function createNodeProxy(deps) {
-  const { resolveNode, readonly = () => false, httpRequest = http.request } = deps;
+  const { resolveNode, readonly = () => false, httpRequest = http.request, proxyTimeoutMs = PROXY_TIMEOUT_MS } = deps;
   return function nodeProxy(req, res) {
     const parsed = splitNodePath(req.url);
     if (!parsed) return notFound(res);                       // no name
@@ -164,11 +164,11 @@ function createNodeProxy(deps) {
     if (readonly() && MUTATING.has(req.method)) {
       return res.status(403).json({ error: 'READONLY: mutazione verso nodo bloccata' });
     }
-    proxyHttp(req, res, node, parsed.rest, parsed.search, httpRequest);
+    proxyHttp(req, res, node, parsed.rest, parsed.search, httpRequest, proxyTimeoutMs);
   };
 }
 
-function proxyHttp(req, res, node, rest, search, httpRequest) {
+function proxyHttp(req, res, node, rest, search, httpRequest, timeoutMs) {
   const options = {
     host: '127.0.0.1',                 // upstream loopback ONLY, from config
     port: node.localPort,
@@ -193,10 +193,18 @@ function proxyHttp(req, res, node, rest, search, httpRequest) {
     if (!res.headersSent) res.status(502).json({ error: 'node non raggiungibile' });
     return;
   }
-  upstream.setTimeout(PROXY_TIMEOUT_MS, () => upstream.destroy(new Error('upstream timeout')));
-  upstream.on('error', () => {
-    if (!res.headersSent) res.status(502).json({ error: 'node non raggiungibile' });
-    else res.destroy();
+  upstream.setTimeout(timeoutMs || PROXY_TIMEOUT_MS, () => upstream.destroy(new Error("upstream timeout")));
+  upstream.on('error', (e) => {
+    // Il timeout di attesa (PROXY_TIMEOUT_MS) NON è un nodo morto: il nodo
+    // remoto può essere ancora al lavoro sulla richiesta (es. un avvio cella
+    // oltre i 30 s). Il `cause` distinto permette al client di trattarlo
+    // come attesa in corso e non come errore del nodo.
+    if (!res.headersSent) {
+      const waiting = e && e.message === 'upstream timeout';
+      res.status(502).json(waiting
+        ? { error: 'node non raggiungibile', cause: 'upstream-timeout' }
+        : { error: 'node non raggiungibile' });
+    } else res.destroy();
   });
   req.on('aborted', () => upstream.destroy());
   req.pipe(upstream);

package/mcp-companions.json

@@ -48,6 +48,9 @@
         "msa_index_batch",
         "msa_search",
         "msa_fetch_doc",
+        "msa_list_collections",
+        "msa_stats",
+        "msa_manifest",
         "msa_remember",
         "msa_forget",
         "msa_interleave_round"
@@ -72,7 +75,9 @@
         "cell_result",
         "cell_list",
         "cell_send",
-        "cell_ask"
+        "cell_ask",
+        "cell_await",
+        "cell_inbox"
       ]
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.9.43",
+  "version": "0.9.46",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {

package/skills/aidesktop/SKILL.md

@@ -91,6 +91,12 @@ project actually owns is the two added lines below and their reasons. It also
 means no registry to host, nothing to keep patched on your behalf, and a
 recipe you can read before you run it.
 
+The recipe needs a host that runs Docker with Compose v2 — see the
+dependencies at the end. On a platform without Docker, Android/Termux
+included, the container cannot build there: the `panelUrl` mechanics earlier
+in this skill still apply to any loopback web UI that node can reach, and the
+recipe simply runs on a different host.
+
 Build it yourself from [`docker/`](docker/):
 
 ```bash

package/skills/cellforge/references/definition.md

@@ -45,7 +45,7 @@ includes either is refused. Everything else is patchable.
 | `mcp` | no | **names only**, up to 64, each matching `[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}` |
 | `label`, `tmuxSession` | varies | display label ≤64 chars; session name ≤64 chars, immutable |
 
-Ceilings on the document as a whole: **32 cells**, **24 engines**. These are not
+Ceilings on the document as a whole: **32 cells**, **100 engines**. These are not
 close to most installs, but a restore that silently dropped entries would be
 worse than one that fails, so a document over the cap is rejected rather than
 truncated.

package/skills/cellforge/references/operations.md

@@ -66,10 +66,13 @@ operation or it does not, and the set is reported in `capabilities` from
 501  not supported by this fleet provider
 ```
 
-So the honest sequence is: read `capabilities`, and if the one you need
-(`define`, `edit`, `remove`, `restore`, `definitions`, `schema`) is missing,
-**say so to the user** rather than retrying. A `501` here is a statement about
-the provider, not about your payload — do not start rewriting the body.
+So the honest sequence is: read `capabilities`, and if the one you need is
+missing, **say so to the user** rather than retrying. The set varies by
+provider; the built-in one reports `status`, `up`, `down`, `restart`, `engine`,
+`boot`, `define`, `edit`, `remove`, `import`, `restore`, `schema`,
+`definitions`, `credentials`, `model-test` and `edit-model`. A `501` here is a
+statement about the provider, not about your payload — do not start rewriting
+the body.
 
 Separately, a provider in read-only mode refuses writes with `403`. Two
 different refusals with two different meanings: `501` says "this provider can

package/skills/nexuscrew/SKILL.md

@@ -46,9 +46,12 @@ Through the MCP bridge, when the tools are exposed in your session:
 | tell the human something, or ask | `nc_notify`, `nc_ask` | `nexuscrew-agent` |
 | read runtime state, identity, decks | `nc_status`, `nc_identity`, `nc_deck` | `nexuscrew-agent` |
 | find and message another cell | `nc_cells` then `nc_send_cell` | `nexuscrew-agent` |
+| manage a paired VL micro-device | `nc_vl_nodes`, then `nc_vl_command` (plus `nc_vl_invite` / `nc_vl_revoke`) | `nexuscrew-agent` |
 | speak on a node or audio group | `nc_speak`, `nc_speak_group` | `nexuscrew-agent` |
+| check or stop an utterance you started | `nc_speak_status`, `nc_speak_stop`, `nc_speak_group_status`, `nc_speak_group_stop` | `nexuscrew-agent` |
 | hand a file to the human | `nc_send_file`, `nc_inbox` | `nexuscrew-agent` |
 | find out why a cell will not start | `nc_cell_diagnostics` | `nexuscrew-agent` |
+| register, renew or recover this cell's Live lease | `nc_lease_register`, `nc_lease_refresh`, `nc_lease_recovery` | `nexuscrew-agent` |
 | keep state across sessions | Memory MCP | `memory` |
 | index and retrieve documents | MSA MCP | `vl-msa` |
 | delegate bounded work to workers | Crew MCP | `crew` |

package/skills/nexuscrew-agent/SKILL.md

@@ -31,6 +31,7 @@ When the client exposes the NexusCrew MCP server, use these tools directly:
 | Check or stop a group utterance you started | `nc_speak_group_status`, `nc_speak_group_stop` |
 | Read who the caller is, without a session or token | `nc_identity` |
 | Read why a local Fleet cell failed to start | `nc_cell_diagnostics` |
+| Register, renew or recover this cell's Live lease | `nc_lease_register`, `nc_lease_refresh`, `nc_lease_recovery` |
 
 Apply these rules:
 
@@ -50,6 +51,27 @@ Apply these rules:
 - `nc_cell_diagnostics` returns the redacted shell command and the last bounded spawn or start failure for one local Fleet cell. Use it when a cell will not come up, before reading state files.
 - Do not treat an MCP notification as a substitute for the final response required by the active client.
 
+### Live lease registration (`nc_lease_*`)
+
+A cell can hold a **Live lease registration** on the node: it registers once,
+then keeps the registration alive by presenting the proof it received. Three
+tools, one job each — their return values do not overlap:
+
+- `nc_lease_register {proof?}` — registers this cell under its own incarnation
+  and returns the first child proof. It can answer `{status:"pending"}` with a
+  `retryAfterMs` when the node is not tracking the cell yet: wait that long
+  and call it again rather than spinning.
+- `nc_lease_refresh {proof}` — renews a live registration. Pass the last
+  received proof object back unchanged. Answers `{status:"live"}` with a new
+  proof; it is never pending, and `{status:"no-registration"}` means
+  `nc_lease_register` is the next call, not a retry.
+- `nc_lease_recovery {proof}` — resumes the registration after a gap, keeping
+  the same incarnation; a proof that expired recently is still accepted. Every
+  attempt counts toward a cap — past it, register again.
+
+Use them only when your runtime asks this cell to hold a Live lease. Treat
+each status literally, and pass proofs through verbatim.
+
 The MCP server is the stdio command `nexuscrew mcp` and must be registered in the host AI client. If the `nc_*` tools are not exposed, report that the bridge is not configured in that session and use the fallback flows below where applicable.
 
 ## Optional capability companions
@@ -82,9 +104,14 @@ Per session, NexusCrew watches `<root>/<session>/{inbox,outbox}` (root = `$NEXUS
 When `nc_send_file` is unavailable, deliver with the helper (resolves the current tmux session, timestamps, never overwrites):
 
 ```bash
-bin/nc-deliver report.pdf chart.png      # → ~/NexusFiles/<session>/outbox/
+"$(npm root -g)/@mmmbuto/nexuscrew/skills/nexuscrew-agent/bin/nc-deliver" report.pdf chart.png
+# → ~/NexusFiles/<session>/outbox/
 ```
 
+The helpers ship inside the npm package and are **not linked on `PATH`** — the
+only global command is `nexuscrew` — so address them under the global package
+root; `npm root -g` prints that root for the Node installation in use.
+
 Don't hand-craft the path from a guessed session name — use `nc-deliver`, or derive the session with `tmux display-message -p '#S'`.
 
 ## Sending text to a tmux session
@@ -96,9 +123,10 @@ non-Fleet sessions; it must not bypass federation visibility or routing ACLs.
 `tmux send-keys 'msg' Enter` is **not** reliable: a TUI's paste-burst detector swallows the Enter and the message just sits in the composer, while exit code is still 0. Use the helper:
 
 ```bash
-bin/nc-send <session> "text"              # paste + submit
-bin/nc-send <session> --file prompt.txt   # from a file
-bin/nc-send <session> --no-submit "text"  # leave in composer, no Enter
+NC_SEND="$(npm root -g)/@mmmbuto/nexuscrew/skills/nexuscrew-agent/bin/nc-send"
+"$NC_SEND" <session> "text"              # paste + submit
+"$NC_SEND" <session> --file prompt.txt   # from a file
+"$NC_SEND" <session> --no-submit "text"  # leave in composer, no Enter
 ```
 
 It does: `load-buffer` → `paste-buffer -p` (bracketed paste) → burst-flush (`C-e`) → `Enter`. **Verify it landed** — never trust the exit code:
@@ -173,8 +201,11 @@ work. The setting is also applied to windows created later in that session.
 ## Dependencies
 
 **Bundled (installed with the package):** the `nexuscrew` CLI, `lib/`, these
-skills, and the `bin/nc-send` / `bin/nc-deliver` helpers arrive with
+skills, and the `nc-send` / `nc-deliver` helpers arrive with
 `npm install -g @mmmbuto/nexuscrew` (Node.js >= 18 required by `engines`).
+Only `nexuscrew` is linked on `PATH`; the helpers live inside the package at
+`skills/nexuscrew-agent/bin/` — reach them through `npm root -g` as shown in
+File exchange above.
 
 **External (you must provide):**