@mmmbuto/nexuscrew 0.9.75 → 0.9.76

package/frontend/dist/index.html

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-DMfpKI3n.js"></script>
+  <script type="module" crossorigin src="/assets/index-BURtPwUi.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-B9GW2LHm.css">
 </head>
 <body>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.75"}
+{"version":"0.9.76"}

package/lib/fleet/builtin.js

@@ -965,7 +965,7 @@ async function createBuiltinFleet(cfg = {}) {
   // I campi non-identita' che `parseModel` ammette per una dichiarazione:
   // id ed engine SONO l'identita' (il chiaro per cui esiste edit-model e' non
   // doverla ritoccare), tutto il resto e' patchabile con la stessa validazione.
-  const EDIT_MODEL_FIELDS = new Set(['label', 'contextWindow', 'maxTokens', 'reasoning']);
+  const EDIT_MODEL_FIELDS = new Set(['label', 'contextWindow', 'maxTokens', 'tools', 'vision', 'reasoning']);
 
   async function editModel(id, engine, patch) {
     if (readonly()) throw httpError(403, 'READONLY: edit-model bloccato');
@@ -984,12 +984,18 @@ async function createBuiltinFleet(cfg = {}) {
       }
     }
     for (const key of ['contextWindow', 'maxTokens']) {
-      if (patch[key] !== undefined && (!Number.isSafeInteger(patch[key]) || patch[key] < 1)) {
-        throw httpError(400, `${key} non valido: intero >= 1`);
+      // Stessa scala del parser: un valore che il dialogo accetta e il file
+      // rifiuta farebbe fallire l'intero salvataggio, non il solo campo.
+      if (patch[key] !== undefined && (!Number.isSafeInteger(patch[key]) || patch[key] < 1024 || patch[key] > 100000000)) {
+        throw httpError(400, `${key} non valido: intero fra 1024 e 100000000`);
       }
     }
-    if (patch.reasoning !== undefined && typeof patch.reasoning !== 'boolean') {
-      throw httpError(400, 'reasoning non valido: booleano');
+    // `tools` e `vision` sono booleani tipizzati come `reasoning`: `false` e'
+    // una risposta, quindi non si rifiuta e non si scambia per assenza.
+    for (const key of ['tools', 'vision', 'reasoning']) {
+      if (patch[key] !== undefined && typeof patch[key] !== 'boolean') {
+        throw httpError(400, `${key} non valido: booleano`);
+      }
     }
     const defs = reloadDefs();
     if (!(defs.models || []).some((m) => m.id === wantedId && m.engine === wantedEngine)) {
@@ -1605,6 +1611,8 @@ async function createBuiltinFleet(cfg = {}) {
         // arriverebbe al client come comportamento inspiegabile.
         contextWindow: { type: 'integer', required: false, min: 1024, max: 100000000 },
         maxTokens: { type: 'integer', required: false, min: 1024, max: 100000000 },
+        tools: { type: 'boolean', required: false },
+        vision: { type: 'boolean', required: false },
         reasoning: { type: 'boolean', required: false },
       },
       cell: {
@@ -1771,6 +1779,50 @@ async function createBuiltinFleet(cfg = {}) {
     const base = id.replace(/:[^:/]+$/, '');
     return base !== id && index.has(base) ? index.get(base) : null;
   }
+  // Curated authentication diagnosis of the LISTING attempt. The route sees
+  // only this block: the credential state, the env NAME (already public in
+  // the editor), whether an attempt happened, whether it carried the
+  // credential, and a fixed cause. Never the key value, its provenance, the
+  // endpoint, or any transport exception text. Config (state) and transport
+  // (attempt) stay separate: a present key is not a sent key, and a cached
+  // answer is neither. A fresh cache makes no claim at all about the key
+  // (attempted=false, no cause), and a SUCCESS never claims the endpoint does
+  // not need a key — it only says the listing came back without one.
+  function modelListingAuthDiagnosis(plan, result) {
+    const credentialState = plan && ['none', 'configured', 'missing', 'unavailable'].includes(plan.credentialState)
+      ? plan.credentialState : 'none';
+    const envKey = typeof plan?.envKey === 'string' && plan.envKey ? plan.envKey : '';
+    const attempt = result && result.attempt && typeof result.attempt === 'object' ? result.attempt : null;
+    const attempted = !!attempt;
+    const credentialSent = !!(attempt && attempt.credentialSent === true);
+    let cause = '';
+    if (attempt) {
+      if (result.status === 'api') {
+        // Success: the only outcome worth a line is the anonymous one, stated
+        // as a fact about THIS listing, never about the endpoint in general.
+        if (!credentialSent) cause = 'anonymous-success';
+      } else if (attempt.category === 'network' || attempt.category === 'timeout') {
+        cause = 'endpoint-unreachable';
+      } else if (attempt.category === 'invalid-response') {
+        cause = 'invalid-response';
+      } else if (attempt.category === 'http') {
+        const status = Number.isSafeInteger(attempt.status) ? attempt.status : 0;
+        if (status === 403) cause = 'access-denied'; // with OR without the key: permissions or policy
+        else if (status === 401) {
+          if (credentialSent) cause = 'key-rejected';
+          else if (credentialState === 'unavailable') cause = 'credential-unavailable';
+          else cause = 'missing-key';
+        } else cause = 'provider-error';
+      }
+    }
+    return {
+      credentialState,
+      ...(envKey ? { envKey } : {}),
+      attempted,
+      credentialSent,
+      ...(cause ? { cause } : {}),
+    };
+  }
   async function discoverEngineModels(engineId, opts = {}) {
     const id = String(engineId || '');
     if (!id || id.length > 64 || !/^[A-Za-z0-9._-]+$/.test(id)) {
@@ -1812,10 +1864,12 @@ async function createBuiltinFleet(cfg = {}) {
           id: m.id,
           ...(Number.isFinite(m.contextWindow) ? { contextWindow: m.contextWindow } : {}),
           ...(Number.isFinite(m.maxTokens) ? { maxTokens: m.maxTokens } : {}),
-          // definitions.js parses `reasoning` as a boolean: `false` is an
-          // explicit operator answer, not an absence. Keep it exactly like
-          // that, or a provider's `true` would override the user layer here
-          // (the merge itself already handles booleans correctly).
+          // definitions.js parses the three flags as typed booleans: `false`
+          // is an explicit operator answer, not an absence. Keep it exactly
+          // like that, or a provider's `true` would override the user layer
+          // here (the merge itself already handles booleans correctly).
+          ...(typeof m.tools === 'boolean' ? { tools: m.tools } : {}),
+          ...(typeof m.vision === 'boolean' ? { vision: m.vision } : {}),
           ...(typeof m.reasoning === 'boolean' ? { reasoning: m.reasoning } : {}),
         });
       }
@@ -1856,6 +1910,7 @@ async function createBuiltinFleet(cfg = {}) {
       status: result.status,
       stale: result.stale === true,
       error: result.error || '',
+      auth: modelListingAuthDiagnosis(plan, result),
       ...(result.fetchedAt ? { fetchedAt: result.fetchedAt } : {}),
       ...(result.publicCatalog ? { publicCatalog: result.publicCatalog } : {}),
       models,

package/lib/fleet/definitions.js

@@ -196,7 +196,7 @@ const MODEL_ID_MAX = 128;
 
 function parseModel(m) {
   if (!m || typeof m !== 'object' || Array.isArray(m)) return null;
-  const allowed = new Set(['id', 'engine', 'label', 'contextWindow', 'maxTokens', 'reasoning']);
+  const allowed = new Set(['id', 'engine', 'label', 'contextWindow', 'maxTokens', 'tools', 'vision', 'reasoning']);
   if (Object.keys(m).some((k) => !allowed.has(k))) return null;
   const id = typeof m.id === 'string' ? m.id.trim() : '';
   // Stessa forma accettata dal gate dei modelli: nessun byte di controllo, un
@@ -221,6 +221,15 @@ function parseModel(m) {
     if (typeof m.reasoning !== 'boolean') return null;
     out.reasoning = m.reasoning;
   }
+  // `tools` e `vision`: stessi booleani tipizzati di `reasoning`. `false` e'
+  // una RISPOSTA dell'operatore, non un'assenza: si conserva tale, cosi' la
+  // scoperta (user > api > public) non lascia salire il `true` di un catalogo
+  // sopra la parola esplicita di chi dichiara.
+  for (const key of ['tools', 'vision']) {
+    if (m[key] === undefined) continue;
+    if (typeof m[key] !== 'boolean') return null;
+    out[key] = m[key];
+  }
   return out;
 }
 

package/lib/fleet/managed.js

@@ -1334,10 +1334,30 @@ function engineModelDiscoveryPlan(profile, spec, cfg, home, engineId) {
   }
   if (!baseUrl) return null;
   const plan = { engine: engineId || profile.id, collector, baseUrl };
+  // The credential STATE travels with the plan, from the same resolution the
+  // launcher uses (the caller never re-reads the credential sources):
+  // none / configured / missing / unavailable, plus the env NAME when one
+  // exists and the editor already shows it. A file that exists but cannot be
+  // read is "unavailable", not "missing" — the same distinction describeManaged
+  // makes for launching. The value, its provenance paths/hashes and any
+  // exception text stay here: the plan hands the key to the collector in
+  // memory and nothing else leaves.
   try {
-    const cred = credential(profile, spec || {}, cfg, home);
+    const cred = credential(profile, spec || {}, cfg, home, { blocked: [] });
+    plan.credentialState = !cred ? 'unavailable'
+      : cred.value ? 'configured'
+        : cred.source === 'unreadable' ? 'unavailable'
+          : cred.source === 'missing' ? 'missing'
+            : 'none';
     if (cred && cred.value) plan.apiKey = cred.value;
-  } catch (_) { /* discovery without a key: key-less local endpoints still list */ }
+    const envKey = cred && typeof cred.envKey === 'string' ? cred.envKey : '';
+    // 'login'/'none' resolve to a pseudo key name: never invent one for them.
+    if (plan.credentialState !== 'none' && ENV_KEY_RE.test(envKey || '')) plan.envKey = envKey;
+  } catch (_) {
+    // Resolution itself failed: the key is not known to be missing — it is
+    // unavailable, and an anonymous rejection will say exactly that.
+    plan.credentialState = 'unavailable';
+  }
   return plan;
 }
 async function discoverOllamaModels(opts = {}) {