@mmmbuto/nexuscrew 0.9.73 → 0.9.74

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.9.74 — 2026-10-18
+
+- **Standard engines come in one fixed order, everywhere.** The standard clients now have a declared order that drives what the API, the panel and the MCP tools serve: engines are grouped under their client, clients outside the list close it in a stable order, and a new fleet is seeded in that same order. The ordering is applied when the list is served, so no existing fleet file is rewritten and nothing changes on disk.
+- **Engine selectors are split into standard and other.** The engine pickers of the cell editor, the import editor, the backup cell remap and the launch sheet render two groups — standard clients first, everything else under "other" — from a flag computed for each engine, never stored. Engine labels are lowercased on the way out, so the panel, the API and the MCP tools show lowercase even for labels written by hand in the fleet file, whose text is never modified.
+- **Restoring a backup accepts as many models as the file itself.** The restore path rejected backups declaring more than 64 models per engine while a fleet file is valid up to 128: the restore cap now follows the same limit as the file, and a rejection names the number it enforced.
+- **OpenCode joins the standard clients.** A cell can now run OpenCode: it starts in the cell's tmux pane like every other client, the chosen model travels as provider/model (the built-in gateway is prefixed when the id has no slash), the cell's prompt is pre-filled through the client's own prompt flag, and the unsafe policy maps to the client's auto-approve flag. Authentication stays in the operator's hands: NexusCrew never logs in, and never reads or stores OpenCode credentials; the gateway's free models answer even before a login. A per-cell configuration (MCP servers, custom providers) can be handed to the client with its own OPENCODE_CONFIG variable, opt-in per engine. The upgrade does not add OpenCode to existing fleets, and it is not part of a new fleet's defaults: it sits in the catalog and in the standard group, waiting to be added.
+- **The test suite no longer leaves processes behind — on Linux, where /proc is readable.** Test runs used to leave tmux servers and detached tunnel supervisors alive after a green run. Every test tmux server now comes from one factory that closes it by pid, and a containment gate at the end of the run enumerates anything left alive that *belongs to that run* — belonging proved by the process environment (HOME or TMPDIR under the run's root), never by where its pidfile happens to sit — closes it by signal and fails the suite. That proof is read again immediately before every signal, the forced SIGKILL included: a process that can no longer be attributed to the run — for example because its environment stops being readable in the meantime — receives no further signal, is reported as an anomaly with its pidfile left in place, and fails the run. The check reads `/proc/<pid>/environ`, so on a platform without /proc, or where it cannot be read, the gate treats an unreadable environment as no proof and fails closed instead of guessing; the containment tests that require a readable environment skip with that reason stated, while the fail-closed path itself is asserted by explicit negative tests. When the gate records an anomaly the run root is KEPT and its path is printed, so the pidfiles it preserved can still be inspected: that root is removed by hand after the analysis, while a run without anomalies still cleans up after itself. A leak can no longer pass unnoticed on Linux, and the limit is stated here instead of being promised away.
+
 ## 0.9.73 — 2026-10-16
 
 - **Delivering a file that is already in the outbox no longer duplicates it.** The delivery path (the MCP tool and the `nc-deliver` fallback) stamped and copied every source, including one already sitting in the destination outbox — a file the cell had written there directly, or a delivered copy being resent — leaving a prefixed duplicate next to the original, which the panel showed as two identical rows. When the realpath of the source directory is the realpath of the destination outbox, the existing file is the delivery: nothing is copied, the route answers with the existing name and `already: true`, and the notification still fires. Sources from anywhere else keep today's stamped copy, and historical duplicates are left untouched.