@mmmbuto/nexuscrew 0.9.76 → 0.9.78

package/lib/fleet/managed.js

@@ -15,6 +15,7 @@ const { argomentiHookCodex, gateVersione, gatePiattaforma, EVENTI_CODEX } = requ
 
 const OLLAMA_CLOUD_MODELS = Object.freeze([
   'glm-5.2', 'kimi-k2.7-code', 'deepseek-v4-pro', 'minimax-m3',
+  'minimax-m3.1-flash',
   'qwen3.5:397b', 'deepseek-v4-flash', 'mistral-large-3:675b', 'gemma4:31b',
   // glm-5.3-flash: disponibile su ollama.com/library (2026-08-27; glm-5.3
   // era ancora 404). Gia` usata da celle esistenti su questo engine: senza
@@ -62,6 +63,10 @@ const OLLAMA_CONTEXT = Object.freeze({
   // deepseek-v4-pro: scheda «1M context» (era 524288: META' del reale).
   'deepseek-v4-pro': 1048576,
   'minimax-m3': 524288,
+  // minimax-m3.1-flash: contesto dichiarato 1M (1000000); a differenza di
+  // minimax-m3 (dove il campo strutturato dice 512K -> 524288) qui la scheda
+  // dichiara 1M, quindi 1000000.
+  'minimax-m3.1-flash': 1000000,
   'qwen3.5:397b': 262144, 'deepseek-v4-flash': 1048576,
   'mistral-large-3:675b': 262144, 'gemma4:31b': 262144,
   // glm-5.3-flash: scheda «1M context» + concorde zhipuai/zai/opencode-go.
@@ -308,7 +313,7 @@ const ALIBABA_PI_MODELS = Object.freeze([
 const OPENCODE_GO_MESSAGES_MODELS = Object.freeze([
   // Misurati e2e 2026-08-11 (matrice completa nel commento sopra):
   'deepseek-v4-flash', 'deepseek-v4-flash-vision-exp', 'deepseek-v4-pro',
-  'glm-5.2', 'glm-5.1', 'minimax-m3', 'minimax-m2.7',
+  'glm-5.2', 'glm-5.1', 'minimax-m3', 'minimax-m3.1-flash', 'minimax-m2.7',
   'qwen3.8-max', 'qwen3.7-max', 'qwen3.7-plus', 'qwen3.6-plus',
   // Signal-only 2026-09-12 (CreditsError, nessun rifiuto formato):
   'glm-5.3', 'glm-5.3-flash', 'longcat-2.0', 'deepseek-v4.1-flash',
@@ -327,7 +332,7 @@ const OPENCODE_GO_CHAT_MODELS = Object.freeze([
   // Misurati e2e 2026-08-11:
   'deepseek-v4-flash', 'deepseek-v4-flash-vision-exp', 'deepseek-v4-pro',
   'glm-5.2', 'glm-5.1', 'kimi-k3', 'kimi-k2.7-code', 'kimi-k2.6',
-  'minimax-m3', 'minimax-m2.7', 'qwen3.8-max', 'qwen3.7-max',
+  'minimax-m3', 'minimax-m3.1-flash', 'minimax-m2.7', 'qwen3.8-max', 'qwen3.7-max',
   'qwen3.7-plus', 'qwen3.6-plus', 'mimo-v2.5', 'mimo-v2.5-pro', 'hy3',
   'gpt-5.6-luna',
   // Signal-only 2026-09-12:
@@ -359,6 +364,7 @@ const OPENCODE_GO_LIMITS = Object.freeze({
   'kimi-k2.7-code': { context: 262144, output: 262144 },
   'kimi-k2.6': { context: 262144, output: 65536 },
   'minimax-m3': { context: 1000000, output: 131072 },
+  'minimax-m3.1-flash': { context: 1000000, output: 131072 },
   'minimax-m2.7': { context: 204800, output: 131072 },
   'qwen3.8-max': { context: 1000000, output: 131072 },
   'qwen3.7-max': { context: 1000000, output: 65536 },
@@ -417,7 +423,29 @@ const OPENCODE_GO_PI_MODELS = Object.freeze(OPENCODE_GO_CHAT_MODELS.map((id) =>
 })));
 
 const CUSTOM_KEYS = ['displayName', 'protocol', 'baseUrl', 'envKey', 'providerId'];
-const MANAGED_KEYS = new Set(['client', 'provider', 'credentialProfile', 'model', 'permissionPolicy', 'credentialSourcePolicy', 'envPassthrough', ...CUSTOM_KEYS]);
+// VL-only engine fields (client 'vl'): resolved/validated at launch in the vl
+// branch of resolveManagedEngine, shaped here. See the vl section of
+// normalizeManagedSpec for the shape contract of each.
+const VL_KEYS = ['vlBinary', 'vlProfile', 'vlConfigFile', 'effort'];
+// VL_* env names that belong to the ENGINE's own choice channels (variant,
+// profile, model, effort, prompt file). An envPassthrough carrying one of
+// these would silently FIGHT the composed decision: the passthrough loop runs
+// after the vl branch, so its value would win over the operator's explicit
+// engine choice. For the client vl these names are refused in passthrough —
+// the operator declares the ENGINE field, not the env name. VL_API_KEY and the
+// key names read by the runtime's config pass normally, by name, as always.
+const VL_OWNED_ENV = new Set(['VL_PROVIDER', 'VL_BASE_URL', 'VL_MODEL', 'VL_EFFORT', 'VL_SYSTEM_APPEND_FILE']);
+// The per-cell XDG trio (XDG_STATE_HOME / XDG_DATA_HOME / XDG_CONFIG_HOME).
+// For the client vl these ARE the cell identity on the runtime host: the
+// runtime derives from them the server root, the control socket and the
+// session directory, so a shared value means a shared state tree. NexusCrew
+// composes them per cell (ensureVlCellDirs), therefore a passthrough
+// carrying one of these names is a way to defeat the per-cell identity: the
+// passthrough loop runs AFTER the vl branch, so its value would win in
+// silence and two cells would share one directory. For the client vl these
+// names are refused in passthrough, and the final assignment is protected.
+const VL_CELL_DIR_ENV = new Set(['XDG_STATE_HOME', 'XDG_DATA_HOME', 'XDG_CONFIG_HOME']);
+const MANAGED_KEYS = new Set(['client', 'provider', 'credentialProfile', 'model', 'permissionPolicy', 'credentialSourcePolicy', 'envPassthrough', ...CUSTOM_KEYS, ...VL_KEYS]);
 // Massimo numero di nomi in `envPassthrough`. L'allowlist e' opt-in e per
 // nome, mai un passthrough in blocco: un tetto basso ferma una lista incontrollata.
 const MAX_ENV_PASSTHROUGH = 32;
@@ -636,7 +664,7 @@ const CATALOG = Object.freeze([
   // entrano in questo client oggi: opencode.jsonc accetta `apiKey` SOLO come
   // stringa letterale (il riferimento {env:...} e' rifiutato, misurato), e
   // scrivere una chiave su disco viola la regola del repo (mai segreti nei
-  // file generati). Residuo dichiarato nel referto del lotto.
+  // file generati). Residuo dichiarato nel referto di lavorazione.
   { id: 'opencode.native', client: 'opencode', provider: 'native', label: 'OpenCode account (gateway + local login)', auth: 'login', protocol: 'opencode_native', core: true, notice: 'opencode-native' },
 
   // Agy: client gestito primario (Linux/macOS non-Termux). Auth delegata al
@@ -769,6 +797,59 @@ function normalizeManagedSpec(value, { extraModels = null, engineId = null, onIs
     if (!model || !(profile.protocols || [profile.protocol]).includes(protocol)) return issue('protocol', protocol, `protocollo non supportato dal profilo (ammessi: ${(profile.protocols || [profile.protocol]).join(', ')})`);
     Object.assign(out, { displayName, baseUrl, ...(envKey ? { envKey } : {}), protocol, providerId });
   }
+  // VL-only fields. Anything declared for another client is a configuration
+  // error, not a silent no-op: an engine that carries `effort` under a claude
+  // profile would look configured while doing nothing.
+  const vlFields = VL_KEYS.filter((k) => value[k] !== undefined);
+  if (vlFields.length && value.client !== 'vl') {
+    return issue(vlFields.join(','), value.client, 'campi vl* / effort ammessi solo sul client vl');
+  }
+  if (value.client === 'vl') {
+    // vlBinary/vlConfigFile: absolute paths on the EXECUTOR node, no control
+    // bytes, sane length. Spaces are legal and tested (argv is separated, no
+    // shell interpolation anywhere in the launch path). Existence, regular
+    // file and executability are verified at LAUNCH time (node-local), not
+    // here: normalize also runs on read-only views of a remote node.
+    for (const field of ['vlBinary', 'vlConfigFile']) {
+      if (value[field] === undefined) continue;
+      const v = value[field];
+      if (typeof v !== 'string' || !path.isAbsolute(v) || v.length > 4096 || /[\x00-\x1f\x7f]/.test(v)) {
+        return issue(field, v, 'percorso assoluto atteso (nessun byte di controllo, max 4096 caratteri)');
+      }
+      out[field] = v;
+    }
+    // vlProfile: a single `-p` token. Profile MODE means the catalog decides
+    // provider/base: on any other variant (vl.anthropic composes VL_PROVIDER,
+    // vl.custom carries its own protocol/baseUrl) the two choices would fight
+    // and one of them would run silently inactive — so the combination is
+    // rejected here, explicitly, instead of being resolved by precedence.
+    if (value.vlProfile !== undefined) {
+      const p = value.vlProfile;
+      if (typeof p !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(p)) {
+        return issue('vlProfile', p, 'nome profilo: un token [A-Za-z0-9][A-Za-z0-9._-]{0,63}');
+      }
+      if (profile.provider !== 'native') {
+        return issue('vlProfile', p, `incompatibile con la variante ${profile.id}: la variante compone gia' provider/base — profilo e variante si escludono`);
+      }
+      out.vlProfile = p;
+    }
+    // effort: only among the levels DECLARED for the effective model. A model
+    // without a declared effortLevels descriptor admits NO effort (fail-closed:
+    // the runtime rejects unknown levels, and inventing a default would send
+    // the cell up with a request its profile never made).
+    if (value.effort !== undefined) {
+      const effort = value.effort;
+      if (typeof effort !== 'string' || !/^[a-z0-9][a-z0-9-]{0,15}$/.test(effort)) {
+        return issue('effort', effort, 'livello effort: token [a-z0-9][a-z0-9-]{0,15}');
+      }
+      const descriptor = declaredModelsFor(extraModels, profile.id, engineId)
+        .find((m) => m && m.id === model && Array.isArray(m.effortLevels));
+      if (!descriptor || !descriptor.effortLevels.includes(effort)) {
+        return issue('effort', effort, 'livello non dichiarato per il modello (serve un modello con effortLevels che lo contenga)');
+      }
+      out.effort = effort;
+    }
+  }
   // EnvPassthrough e' un'allowlist di NOMI di variabili d'ambiente che il
   // child deve ricevere, risolti a runtime dalle credentialSources (dopo i rami
   // provider in resolveManagedEngine). E' opt-in e per nome: MAI un passthrough
@@ -789,6 +870,25 @@ function normalizeManagedSpec(value, { extraModels = null, engineId = null, onIs
     if (!names) return null;
     out.envPassthrough = names;
   }
+  // Client vl: i nomi VL_* delle scelte engine non passano dal passthrough.
+  // Si rifiuta QUI, alla validazione, perche' e' l'unico punto in cui la
+  // dichiarazione dell'operatore e' ancora separata dalla composizione: a
+  // valle il valore di passthrough vincerebbe in silenzio sulla scelta
+  // esplicita (il loop gira dopo il ramo vl).
+  if (out.client === 'vl' && out.envPassthrough && out.envPassthrough.length) {
+    const owned = out.envPassthrough.filter((n) => VL_OWNED_ENV.has(n));
+    if (owned.length) {
+      return issue('envPassthrough', owned.join(','), `per il client vl le variabili ${[...VL_OWNED_ENV].join('/')} esprimono scelte dell'engine (variante, profilo, modello, effort): dichiara il campo engine, non il nome env`);
+    }
+    // Il trio XDG e' l'identita' per cella nel runtime vl: lo compone
+    // NexusCrew, uno per cella, e un valore dichiarato in passthrough
+    // vincerebbe in silenzio (il loop gira dopo il ramo vl) riunendo due
+    // celle sulla stessa directory di stato.
+    const cellDirs = out.envPassthrough.filter((n) => VL_CELL_DIR_ENV.has(n));
+    if (cellDirs.length) {
+      return issue('envPassthrough', cellDirs.join(','), `per il client vl le variabili ${[...VL_CELL_DIR_ENV].join('/')} sono l'identita' per cella (stato, dati, config): NexusCrew le compone per cella, non si dichiarano in passthrough`);
+    }
+  }
   return out;
 }
 
@@ -1313,52 +1413,72 @@ const sharedModelDiscovery = createModelDiscovery();
 // (catalog engines) the profile id IS the engine id.
 function engineModelDiscoveryPlan(profile, spec, cfg, home, engineId) {
   if (!profile) return null;
-  const specBase = spec && typeof spec.baseUrl === 'string' && /^https?:\/\//i.test(spec.baseUrl) ? spec.baseUrl : '';
-  const profileBase = typeof profile.endpoint === 'string' && /^https?:\/\//i.test(profile.endpoint) ? profile.endpoint : '';
+  const httpUrl = (value) => (typeof value === 'string' && /^https?:\/\//i.test(value) ? value : '');
+  // Endpoint precedence follows the launcher: the normalized spec, the
+  // generated provider extension, then the profile's own endpoint. A native
+  // provider has no explicit endpoint here, and is never pointed at another
+  // client's profile.
+  const specBase = httpUrl(spec && spec.baseUrl);
+  const extensionBase = httpUrl(profile.piExtension && profile.piExtension.baseUrl);
+  const profileBase = httpUrl(profile.endpoint);
+  // The wire name may come hyphenated (`openai-completions`, the Pi form) or
+  // underscored (the normalized form). It is the same transport.
+  const rawWire = spec && typeof spec.protocol === 'string' && spec.protocol
+    ? spec.protocol : (typeof profile.protocol === 'string' ? profile.protocol : '');
+  const wire = rawWire.replace(/-/g, '_');
   let collector = null;
   let baseUrl = '';
   if (profile.provider === 'ollama' || profile.provider === 'ollama-cloud') {
+    // Ollama speaks its own listing API, whatever wire a client uses for chat.
     collector = 'ollama';
-    baseUrl = specBase || profileBase || 'http://127.0.0.1:11434';
+    baseUrl = specBase || extensionBase || profileBase || 'http://127.0.0.1:11434';
   } else if (profile.provider === 'lmstudio') {
     collector = 'lmstudio';
-    baseUrl = specBase || 'http://127.0.0.1:1234';
-  } else if (profile.protocol === 'anthropic_messages') {
+    baseUrl = specBase || extensionBase || 'http://127.0.0.1:1234';
+  } else if (wire === 'anthropic_messages') {
     collector = 'anthropic';
-    baseUrl = specBase || profileBase;
-  } else if (profile.protocol === 'openai_responses' || profile.protocol === 'openai_completions') {
+    baseUrl = specBase || extensionBase || profileBase;
+  } else if (wire === 'openai_responses' || wire === 'openai_completions') {
     collector = 'openai-compat';
-    baseUrl = specBase || profileBase;
+    baseUrl = specBase || extensionBase || profileBase;
   } else {
+    // `pi_native`, login flows and any other client-owned wire: no explicit
+    // listing contract, so no collector. An explicit endpoint alone is not
+    // proof of a listing API.
     return null;
   }
   if (!baseUrl) return null;
-  const plan = { engine: engineId || profile.id, collector, baseUrl };
-  // The credential STATE travels with the plan, from the same resolution the
-  // launcher uses (the caller never re-reads the credential sources):
-  // none / configured / missing / unavailable, plus the env NAME when one
-  // exists and the editor already shows it. A file that exists but cannot be
-  // read is "unavailable", not "missing" — the same distinction describeManaged
-  // makes for launching. The value, its provenance paths/hashes and any
-  // exception text stay here: the plan hands the key to the collector in
-  // memory and nothing else leaves.
+  return { engine: engineId || profile.id, collector, baseUrl, ...modelListingCredential(profile, spec, cfg, home) };
+}
+
+// Credential resolution for a model listing, from the same path the launcher
+// uses (the caller never re-reads the credential sources): none / configured /
+// missing / unavailable, plus the env NAME when one exists and the editor
+// already shows it. A file that exists but cannot be read is "unavailable",
+// not "missing" — the same distinction describeManaged makes for launching.
+// The value, its provenance paths/hashes and any exception text stay here:
+// the value is handed to a collector in memory and nothing else leaves. An
+// engine with no listing still gets the STATE: the diagnosis refers to the
+// listing only, never to the client's own login.
+function modelListingCredential(profile, spec, cfg, home) {
+  const out = { credentialState: 'unavailable' };
   try {
     const cred = credential(profile, spec || {}, cfg, home, { blocked: [] });
-    plan.credentialState = !cred ? 'unavailable'
+    out.credentialState = !cred ? 'unavailable'
       : cred.value ? 'configured'
         : cred.source === 'unreadable' ? 'unavailable'
           : cred.source === 'missing' ? 'missing'
             : 'none';
-    if (cred && cred.value) plan.apiKey = cred.value;
+    if (cred && cred.value) out.apiKey = cred.value;
     const envKey = cred && typeof cred.envKey === 'string' ? cred.envKey : '';
     // 'login'/'none' resolve to a pseudo key name: never invent one for them.
-    if (plan.credentialState !== 'none' && ENV_KEY_RE.test(envKey || '')) plan.envKey = envKey;
+    if (out.credentialState !== 'none' && ENV_KEY_RE.test(envKey || '')) out.envKey = envKey;
   } catch (_) {
     // Resolution itself failed: the key is not known to be missing — it is
     // unavailable, and an anonymous rejection will say exactly that.
-    plan.credentialState = 'unavailable';
+    out.credentialState = 'unavailable';
   }
-  return plan;
+  return out;
 }
 async function discoverOllamaModels(opts = {}) {
   const now = Date.now(); const ttl = opts.ttlMs === undefined ? 30000 : opts.ttlMs;
@@ -1486,9 +1606,27 @@ function describeManaged(spec, cfg = {}) {
   // in "not found" / "missing" (la stessa forma gia' chiusa in checkTermuxExec).
   const binaryBlocked = [];
   const credBlocked = [];
-  const binary = normalized.client === 'shell'
-    ? resolveInteractiveShell({ ...cfg, home }, { blocked: binaryBlocked })
-    : findBinary(normalized.client, home, { blocked: binaryBlocked });
+  // vl con `vlBinary` DICHIARATO: il binario dichiarato e' l'UNICO che conta
+  // e il PATH non viene neppure consultato. Dichiarare un binario e' una
+  // scelta esplicita dell'operatore: consultare il PATH in parallelo
+  // renderebbe la dichiarazione inaffidabile — un binario dichiarato rotto
+  // che si nasconde dietro un altro e' il difetto piu' pericoloso dei due,
+  // perche' l'operatore crede di avviare una cosa e ne parte un'altra.
+  //
+  // Qui la risoluzione e' la STESSA che fa il ramo vl di resolveManagedEngine
+  // (resolveVlBinary): stesso realpath, stesso file, quindi il gate che
+  // interroga la versione e lo spawn parlano con lo stesso eseguibile.
+  let binary = null;
+  let vlBinaryError = '';
+  if (normalized.client === 'vl' && normalized.vlBinary) {
+    const declared = resolveVlBinary(normalized.vlBinary);
+    if (declared.ok) binary = declared.resolved;
+    else vlBinaryError = declared.reason;
+  } else {
+    binary = normalized.client === 'shell'
+      ? resolveInteractiveShell({ ...cfg, home }, { blocked: binaryBlocked })
+      : findBinary(normalized.client, home, { blocked: binaryBlocked });
+  }
   // La scatola e' tenuta: dopo la chiamata porta anche i CONFLITTI fra file di
   // chiavi, calcolati dove i file si leggono in ordine.
   const credOut = { blocked: credBlocked };
@@ -1505,7 +1643,13 @@ function describeManaged(spec, cfg = {}) {
     || profile.client === 'vl' || !!cred.value;
   let configured = !!binary && authConfigured;
   let reason;
-  if (!binary) {
+  if (vlBinaryError) {
+    // Il binario dichiarato non e' utilizzabile: il motivo nomina il campo e
+    // dichiara che NON c'e' ripiego. Nessun `client vl not found` — quello
+    // direbbe il falso (il client c'e', e' il binario dichiarato a non
+    // esserlo) e lascerebbe credere a un ripiego che non c'e'.
+    reason = vlBinaryError;
+  } else if (!binary) {
     reason = binaryBlocked.length
       ? `client ${profile.client} not confirmed: ${binaryBlocked.length === 1 ? 'a candidate could not be verified' : 'some candidates could not be verified'} (${binaryBlocked.map((b) => `${b.path} (${b.code})`).join('; ')}) — not "absent"`
       : `client ${profile.client} not found`;
@@ -2359,6 +2503,351 @@ function vlSystemAppendGate(binary, cfg) {
   return { ok: true };
 }
 
+// ---------------------------------------------------------------------------
+// VL engine fields (vlBinary / vlProfile / vlConfigFile / effort) — the launch
+// side of the contract shaped in normalizeManagedSpec. Everything here runs on
+// the EXECUTOR node inside resolveManagedEngine: paths are node-local and are
+// never computed from a federated viewer.
+// ---------------------------------------------------------------------------
+
+// First vl runtime version that reads the VL_EFFORT capability. Until that
+// release ships, the gate below refuses an engine that declares `effort` with
+// a DECLARED error instead of ignoring the request:
+// a cell that silently runs at the wrong effort is worse than one that says
+// why it will not start. Align this constant with the real release.
+const VL_EFFORT_MIN = [0, 5, 0];
+
+// Field-compare version parse shared by the vl gates: '0.10.0' > '0.5.0'.
+function vlVersionFromOutput(out) {
+  const m = String(out).match(/\bvl\s+(\d+)\.(\d+)\.(\d+)/i);
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+
+function vlVersionAtLeast(v, minimum) {
+  for (let i = 0; i < 3; i += 1) {
+    if (v[i] !== minimum[i]) return v[i] > minimum[i];
+  }
+  return true;
+}
+
+// Effort gate: the chosen binary must advertise a runtime that reads
+// VL_EFFORT. Same shape as vlSystemAppendGate (probe + declared refusal), and
+// it receives the SAME binary that will be spawned.
+function vlEffortGate(binary, cfg) {
+  const out = vlBinaryVersionOutput(binary, cfg);
+  if (out === null) return { ok: false, reason: `versione di vl non determinabile (${binary} --version non risponde) — effort richiesto ma non promettibile` };
+  const v = vlVersionFromOutput(out);
+  if (!v) return { ok: false, reason: `versione di vl non riconosciuta da "${String(out).trim().slice(0, 60)}" — effort richiesto ma non promettibile` };
+  if (!vlVersionAtLeast(v, VL_EFFORT_MIN)) {
+    return { ok: false, reason: `vl ${v.join('.')} < ${VL_EFFORT_MIN.join('.')}: VL_EFFORT non letta dal runtime — effort rifiutato invece di essere ignorato` };
+  }
+  return { ok: true };
+}
+
+// Absolute-path validation for vlBinary: no PATH fallback, ever. The resolved
+// (realpath) binary is returned so probe and spawn interrogate/exec the same
+// file even through symlinks — the gate must never ask a different executable
+// than the one the supervisor spawns.
+function resolveVlBinary(declared) {
+  try {
+    const resolved = fs.realpathSync(declared);
+    const st = fs.statSync(resolved);
+    if (!st.isFile()) return { ok: false, reason: `vlBinary non e' un file regolare: ${declared}` };
+    const executable = (st.mode & 0o111) !== 0;
+    if (!executable) return { ok: false, reason: `vlBinary non eseguibile: ${declared}` };
+    return { ok: true, resolved };
+  } catch (e) {
+    return { ok: false, reason: `vlBinary non raggiungibile (${e.code || e.message}): ${declared} — nessun ripiego sul PATH` };
+  }
+}
+
+// Per-cell VL identity directory. Key = stable owner instanceId + cellId,
+// encoded as <slug>-<hash>: the slug keeps paths readable, the 10-hex hash of
+// `owner\0cell` makes collisions impossible — same cellId under two owners
+// lands in different directories, and two ids that slug to the same string
+// stay distinct. Independent of engine, model, display name, tmux session and
+// PID: a cell keeps its paths across restarts and engine switches.
+function vlCellBaseDir(home, ownerInstanceId, cellId) {
+  const owner = typeof ownerInstanceId === 'string' && ownerInstanceId ? ownerInstanceId : 'local';
+  const id = typeof cellId === 'string' ? cellId : '';
+  if (!id || id === '.' || id === '..' || id.includes('/')) throw new Error('unsafe vl cell id');
+  const slug = id.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32) || 'cell';
+  const hash = crypto.createHash('sha256').update(`${owner}\0${id}`).digest('hex').slice(0, 10);
+  return path.join(home, '.nexuscrew', 'vl-cells', `${slug}-${hash}`);
+}
+
+// Creates (0700, symlink-rejecting) the per-cell XDG trio and returns the env
+// values. The runtime owns one state host per directory: distinct directories
+// keep two cells isolated down to the host, not just at the env layer.
+// `selected.toml` lives inside the cell's own config tree and is NEVER touched
+// by NexusCrew (the cell's private preference).
+function ensureVlCellDirs(home, ownerInstanceId, cellId) {
+  const base = vlCellBaseDir(home, ownerInstanceId, cellId);
+  safePrivateDir(path.join(home, '.nexuscrew'), { create: true });
+  safePrivateDir(path.join(home, '.nexuscrew', 'vl-cells'), { create: true });
+  safePrivateDir(base, { create: true });
+  const state = path.join(base, 'state');
+  const data = path.join(base, 'data');
+  const config = path.join(base, 'config');
+  for (const dir of [state, data, config]) safePrivateDir(dir, { create: true });
+  return {
+    base,
+    env: { XDG_STATE_HOME: state, XDG_DATA_HOME: data, XDG_CONFIG_HOME: config },
+    configVlDir: path.join(config, 'vl'),
+  };
+}
+
+// Profile names declared by a vl config.toml catalog (`[profiles.<name>]`
+// tables — crates/vivling/src/config/profile.rs).
+//
+// The catalog is PARSED as TOML (smol-toml, already a dependency), not
+// scanned with a regex: a header with a quoted name (`[profiles."work"]`) or
+// a trailing comment (`[profiles.work] # il profilo di lavoro`) is valid
+// TOML, and a regex would call those profiles "inexistent" and refuse the
+// cell for a catalog that is perfectly valid.
+//
+// A catalog that is not valid TOML declares NO profile and says why: the
+// cell refuses the launch, declared, naming the file — never a guess and
+// never a silent start from the defaults.
+function vlCatalogProfileSet(text) {
+  const names = new Set();
+  let doc;
+  try {
+    doc = toml.parse(String(text));
+  } catch (e) {
+    return { ok: false, profiles: names, reason: `TOML non valido: ${e && e.message ? e.message : 'errore di parsing'}` };
+  }
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
+    return { ok: false, profiles: names, reason: 'il documento TOML non e\' un catalogo' };
+  }
+  const profiles = doc.profiles;
+  if (profiles === undefined || profiles === null) return { ok: true, profiles: names, reason: '' };
+  if (typeof profiles !== 'object' || Array.isArray(profiles)) {
+    return { ok: false, profiles: names, reason: 'la tabella [profiles] non e\' una tabella di profili' };
+  }
+  for (const [name, value] of Object.entries(profiles)) {
+    // Un profilo e' una TABELLA: `[profiles.<nome>]`. Una chiave di altro
+    // tipo (stringa, numero, lista) non e' un profilo e non lo si dichiara.
+    if (value && typeof value === 'object' && !Array.isArray(value)) names.add(name);
+  }
+  return { ok: true, profiles: names, reason: '' };
+}
+
+// I nomi dei profili dichiarati dal catalogo. Sotto un catalogo malformato
+// l'insieme e' vuoto: la cella non parte (vedi vlCatalogProfileSet).
+function vlCatalogProfiles(text) {
+  return vlCatalogProfileSet(text).profiles;
+}
+
+// Atomic copy (tmp + fsync + rename, mode 0600) of the engine-declared profile
+// catalog into the cell's private XDG_CONFIG_HOME/vl/config.toml. Written at
+// EVERY launch so the catalog follows the engine; secrets are never copied
+// because the catalog is the engine's declared vlConfigFile and vl reads keys
+// by NAME from the environment. `selected.toml` is never created nor touched.
+//
+// `text` is the ALREADY VALIDATED content of the source: the caller reads and
+// parses it first, and the copy writes exactly those bytes. Reading the file
+// again here would leave a window in which the source changes between the
+// check and the write — the cell would run a catalog nobody validated.
+function writeVlCellCatalog(configVlDir, sourcePath, text) {
+  let source = text;
+  if (source === undefined) {
+    try { source = fs.readFileSync(sourcePath, 'utf8'); } catch (e) {
+      throw new Error(`catalogo profili vl non leggibile (${sourcePath}): ${e.code || e.message}`);
+    }
+  }
+  if (typeof source !== 'string') {
+    throw new Error(`catalogo profili vl non leggibile (${sourcePath}): contenuto non testuale`);
+  }
+  safePrivateDir(configVlDir, { create: true });
+  const target = path.join(configVlDir, 'config.toml');
+  try {
+    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('refusing symlink vl catalog target');
+  } catch (e) { if (e.code !== 'ENOENT') throw e; }
+  const tmp = path.join(configVlDir, `.config.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  let fd;
+  try {
+    fd = fs.openSync(tmp, 'wx', 0o600);
+    fs.writeFileSync(fd, source);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd); fd = undefined;
+    fs.renameSync(tmp, target);
+  } catch (e) {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) {} }
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
+  return { target, source };
+}
+
+// Il tipo di un file che NON e' un catalogo leggibile. Serve a dichiarare
+// il rifiuto con il nome del tipo, non con un codice generico.
+function vlCatalogSourceType(st) {
+  if (st.isFIFO()) return 'FIFO';
+  if (st.isSocket()) return 'socket';
+  if (st.isBlockDevice()) return 'device a blocchi';
+  if (st.isCharacterDevice()) return 'device a caratteri';
+  if (st.isDirectory()) return 'directory';
+  return 'file non regolare';
+}
+
+// Le identita' (dev+inode) dell'overlay GENERATO con cui la sorgente viene
+// confrontata: l'overlay cosi' com'e', e l'overlay risolto (se al posto del
+// file generato c'e' un link simbolico). Il confronto e' su dev+inode, quindi
+// copre il percorso diretto, un hard link e un symlink.
+function vlOverlayIdentities(configVlDir) {
+  const target = path.join(configVlDir, 'config.toml');
+  const ids = [];
+  for (const modo of ['lstatSync', 'statSync']) {
+    let st;
+    try { st = fs[modo](target); } catch (_) { continue; }
+    ids.push({ dev: st.dev, ino: st.ino });
+  }
+  return ids;
+}
+
+// Legge e VERIFICA la sorgente del catalogo, una volta sola.
+//
+//  * REGOLARE: la sorgente deve essere un file regolare. FIFO, socket,
+//    device e directory sono rifiutati dichiarati, e il rifiuto avviene
+//    PRIMA di qualsiasi lettura: aprire una FIFO in lettura blocca il
+//    thread Node finche' non arriva uno scrittore, e la verifica non deve
+//    mai diventare un'attesa.
+//  * ESTERNA ALL'OVERLAY: la sorgente non puo' essere l'overlay generato
+//    della cella ne' un suo alias. Il confronto e' su dev+inode, quindi
+//    copre il percorso diretto, un hard link e un symlink (risolto prima
+//    del confronto): copiare l'overlay su se stesso non e' una sorgente,
+//    e' un autoriferimento.
+//  * STESSI BYTES: i byte letti sono quelli verificati con fstat sul
+//    descriptor, e sono gli stessi che il chiamante copia nella cella. Se
+//    il file cambia tra la verifica e la lettura, il lancio e' rifiutato.
+//
+// Il risultato e' {ok:true, text} oppure {ok:false, reason} con un rifiuto
+// dichiarato: niente catalogo precedente, niente default implicito.
+function readVlCatalogSource(sourcePath, configVlDir) {
+  const nonLegibile = (e) => ({
+    ok: false,
+    reason: `catalogo vl non leggibile (${sourcePath}): ${(e && (e.code || e.message)) || 'errore sconosciuto'} — avvio rifiutato invece di partire senza catalogo`,
+  });
+  // Il path risolto: un symlink verso un catalogo esterno resta una
+  // sorgente valida, un symlink verso l'overlay diventa l'overlay.
+  let resolved;
+  try {
+    resolved = fs.realpathSync(sourcePath);
+  } catch (e) {
+    return nonLegibile(e);
+  }
+  let st;
+  try {
+    st = fs.statSync(resolved);
+  } catch (e) {
+    return nonLegibile(e);
+  }
+  if (!st.isFile()) {
+    return {
+      ok: false,
+      reason: `catalogo vl non regolare (${sourcePath}): ${vlCatalogSourceType(st)} — avvio rifiutato invece di leggere una sorgente non regolare`,
+    };
+  }
+  const overlay = vlOverlayIdentities(configVlDir);
+  const overlayReason = `catalogo vl non esterno alla cella (${sourcePath}): è l'overlay generato o un suo alias — avvio rifiutato invece di copiare la sorgente su sé stessa`;
+  if (overlay.some((id) => id.dev === st.dev && id.ino === st.ino)) {
+    return { ok: false, reason: overlayReason };
+  }
+  let fd;
+  try {
+    // O_NOFOLLOW: il path e' gia' risolto, non c'e' nessun link da seguire.
+    // O_NONBLOCK: se il file e' stato sostituito da una FIFO, l'apertura
+    // non si blocca e fstat lo smaschera.
+    fd = fs.openSync(resolved, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
+  } catch (e) {
+    return nonLegibile(e);
+  }
+  try {
+    const fst = fs.fstatSync(fd);
+    if (!fst.isFile()) {
+      return {
+        ok: false,
+        reason: `catalogo vl non regolare (${sourcePath}): ${vlCatalogSourceType(fst)} — avvio rifiutato invece di leggere una sorgente non regolare`,
+      };
+    }
+    if (fst.dev !== st.dev || fst.ino !== st.ino) {
+      return {
+        ok: false,
+        reason: `catalogo vl cambiato durante la verifica (${sourcePath}) — avvio rifiutato invece di partire da una sorgente non verificata`,
+      };
+    }
+    if (overlay.some((id) => id.dev === fst.dev && id.ino === fst.ino)) {
+      return { ok: false, reason: overlayReason };
+    }
+    const text = fs.readFileSync(fd, 'utf8');
+    const after = fs.fstatSync(fd);
+    if (after.dev !== fst.dev || after.ino !== fst.ino || after.size !== fst.size || after.mtimeMs !== fst.mtimeMs) {
+      return {
+        ok: false,
+        reason: `catalogo vl modificato durante la lettura (${sourcePath}) — avvio rifiutato invece di partire da byte non verificati`,
+      };
+    }
+    return { ok: true, text };
+  } catch (e) {
+    return nonLegibile(e);
+  } finally {
+    try { fs.closeSync(fd); } catch (_) { /* il descriptor puo' essere gia' chiuso */ }
+  }
+}
+
+// La sorgente del catalogo di un engine vl, e il posto in cui si legge.
+//
+//  1. `vlConfigFile` dichiarato dall'engine: la fonte esplicita.
+//  2. `vl.native` SENZA quel campo: il catalogo dell'OPERATORE sul nodo
+//     esecutore. Si risolve dall'XDG_CONFIG_HOME ORIGINARIO del servizio —
+//     quello di chi ha avviato NexusCrew, non quello che la cella si vede
+//     assegnare un secondo dopo — con fallback su HOME/.config/vl/config.toml.
+//     E' il modo in cui la promessa "usa la tua configurazione" resta vera
+//     quando l'engine non dichiara un percorso: la configurazione
+//     dell'operatore e' la sorgente, non un overlay dimenticato.
+//  3. qualsiasi altro engine vl: nessuna sorgente. Il suo provider e'
+//     esplicito nelle credenziali, quindi non c'e' un default da ereditare —
+//     ma un catalogo vecchio sarebbe comunque un'eredit' invisibile.
+function vlOperatorCatalogPath(cfg, home) {
+  const serviceEnv = (cfg && cfg.env) || process.env || {};
+  const declared = typeof serviceEnv.XDG_CONFIG_HOME === 'string' ? serviceEnv.XDG_CONFIG_HOME.trim() : '';
+  const base = declared || path.join(home, '.config');
+  return path.join(base, 'vl', 'config.toml');
+}
+
+// Rimuove l'overlay GENERATO: solo `config.toml` nella directory vl della
+// cella. `selected.toml` — la preferenza privata della cella — non e' mai
+// toccato, e nessun altro file della directory viene coinvolto.
+//
+// Un symlink al posto dell'overlay non viene rimosso: non e' un file che
+// NexusCrew ha scritto, e toglierlo sarebbe mettere le mani su qualcosa che
+// non e' nostro. Il lancio che lo trova rifiuta, dichiarato.
+function removeVlCellCatalog(configVlDir) {
+  const target = path.join(configVlDir, 'config.toml');
+  let st;
+  try { st = fs.lstatSync(target); } catch (e) {
+    if (e.code === 'ENOENT') return { removed: false };
+    throw new Error(`overlay vl non ispezionabile (${target}): ${e.code || e.message}`);
+  }
+  if (st.isSymbolicLink()) {
+    throw new Error(`overlay vl generato non e' un file regolare (symlink: ${target})`);
+  }
+  try { fs.unlinkSync(target); } catch (e) {
+    throw new Error(`overlay vl non rimuovibile (${target}): ${e.code || e.message}`);
+  }
+  return { removed: true };
+}
+
+// Rimozione best-effort: usata sui percorsi di rifiuto, dove il lancio e'
+// gia' negato e l'errore che conta e' quello del catalogo, non quello della
+// pulizia. Se la rimozione fallisce, l'overlay resta — ma nessun lancio
+// parte con quel catalogo, quindi non e' un catalogo in uso.
+function removeVlCellCatalogQuietly(configVlDir) {
+  try { return removeVlCellCatalog(configVlDir); } catch (_) { return { removed: false }; }
+}
+
 // (fix definitivo — una revisione del pacchetto aveva bocciato la prima versione:
 // il test costruiva `spec.models` a mano, e in produzione quel campo non
 // esiste mai). `declaredModels` NON viene da `spec`: i descrittori sono
@@ -2521,6 +3010,16 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
   // hold it, or a file that cannot be written safely).
   // Empty string = delivered. Surfaces with the engine resolved as vlPromptDegraded.
   let vlPromptDegraded = '';
+  // vl profile mode: env names that must NOT reach the child even when they
+  // come back through envPassthrough or ambient inheritance. The profile owns
+  // provider/base (always) and model/effort (when NC has no explicit choice);
+  // key names like VL_API_KEY are deliberately NOT in this list.
+  let vlNeutralize = [];
+  // Il trio XDG per cella (client vl): lo compone il ramo vl sotto e resta
+  // l'assegnazione FINALE, cioe' quella che vince sul passthrough. Tenuto
+  // qui fuori dal ramo perche' la protezione dell'assegnazione avviene DOPO
+  // il loop di passthrough, che gira piu' avanti.
+  let vlCellEnv = null;
   // I due profili Claude con configurazione privata: perdono gli MCP del file
   // principale e vanno ricollegati (vedi `sharedMcpArgs`).
   let privateProfile = false;
@@ -2927,17 +3426,116 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
     // (config.toml / VL_API_KEY by name via envPassthrough), never
     // credentials on argv. The model chosen in the UI travels via VL_MODEL
     // and the per-cell prompt via a file on the runtime system
-    // (VL_SYSTEM_APPEND_FILE, gate below); `vl --profile` remains
-    // the operator's choice. No --model on argv: the TUI starts without arguments.
-    if (model) env.VL_MODEL = model;
-    // vl.native e' «usa la tua configurazione»: NESSUNA env provider/base_url.
-    // I default interni del runtime sono gia' openai-compat + localhost:11434,
-    // e le VL_* ambientali battono il config.toml — comporle qui non aggiunge
-    // nulla e cancella in silenzio default_profile. Le varianti remote invece
-    // compongono SEMPRE la coppia, anche senza modello: la' la variante e' la
-    // scelta, e un fallback silenzioso manderebbe la cella altrove mentre la
-    // UI dice il contrario.
-    if (spec.provider === 'custom') {
+    // (VL_SYSTEM_APPEND_FILE, gate below). No --model on argv: the TUI starts
+    // without arguments.
+    //
+    // Per-cell identity: every vl cell gets its OWN
+    // XDG_STATE/DATA/CONFIG trio under the NexusCrew state tree, keyed by
+    // owner instanceId + cellId (slug + hash: no collisions, no slugs
+    // traversing out). One state host per directory means two cells on the
+    // same engine are isolated down to the host — the shared-folder incident
+    // cannot repeat. Paths are computed HERE, on the executor
+    // node, never from a federated viewer.
+    let vlDirs;
+    try {
+      vlDirs = ensureVlCellDirs(home, cfg.vlOwnerInstanceId || null, cell?.id);
+    } catch (e) {
+      // The per-cell identity directory is not an optional nicety: without it
+      // the runtime would fall back to a SHARED state tree — exactly the
+      // cross-cell incident this closes. Unsafe id / hostile symlinks refuse
+      // the launch, declared, instead of degrading into a shared folder.
+      return { ok: false, info, reason: `directory identità vl per la cella non creabile in sicurezza: ${e.message}` };
+    }
+    Object.assign(env, vlDirs.env);
+    vlCellEnv = vlDirs.env;
+    // vlBinary: declared -> validated on this node and used for
+    // BOTH the version probes and the spawn (info.binary is what
+    // composeClientInvocation launches). Invalid -> the cell refuses, NEVER a
+    // silent PATH fallback. Absent -> the PATH binary, exactly as before.
+    if (spec.vlBinary) {
+      const resolvedBinary = resolveVlBinary(spec.vlBinary);
+      if (!resolvedBinary.ok) return { ok: false, info, reason: resolvedBinary.reason };
+      info.binary = resolvedBinary.resolved;
+    }
+    // Catalog copy: every launch REFRESHES the cell's private
+    // config/vl/config.toml (atomic, 0600) from the current source. The
+    // cell's selected.toml is never created nor touched; secrets are never
+    // copied (they only travel by NAME via envPassthrough), and the operator's
+    // selected.toml / secrets.env are never imported. A missing or unreadable
+    // source catalog refuses the launch, declared.
+    //
+    // La SORGENTE del catalogo e' una cosa sola, decisa qui: esplicita
+    // (vlConfigFile) o, per vl.native senza quel campo, il catalogo
+    // dell'operatore sul nodo esecutore. L'overlay generato viene
+    // RIGENERATO dalla sorgente corrente a ogni lancio: un cambio di engine
+    // o la rimozione del campo non lasciano un catalogo vecchio nella cella.
+    // Senza sorgente valida il lancio e' rifiutato, dichiarato: niente
+    // catalogo precedente e niente default implicito del provider.
+    const vlNativeEngine = spec.provider === 'native';
+    const vlSource = spec.vlConfigFile
+      ? { path: spec.vlConfigFile, kind: 'dichiarato' }
+      : (vlNativeEngine ? { path: vlOperatorCatalogPath(cfg, home), kind: "dell'operatore" } : null);
+    let vlCatalogSource = null;
+    if (vlSource) {
+      // Si VERIFICA, si LEGGE e si PARSA prima di scrivere: il contenuto
+      // copiato e' esattamente quello validato, e un catalogo rotto non
+      // lascia un overlay a meta'. La sorgente deve essere un file REGOLARE
+      // e stare FUORI dall'overlay generato: una FIFO bloccherebbe la
+      // lettura, e l'overlay (o un suo alias) copiato su se stesso non e'
+      // una sorgente.
+      const letto = readVlCatalogSource(vlSource.path, vlDirs.configVlDir);
+      if (!letto.ok) {
+        removeVlCellCatalogQuietly(vlDirs.configVlDir);
+        return { ok: false, info, reason: `${letto.reason} (fonte: ${vlSource.kind})` };
+      }
+      const text = letto.text;
+      const parsed = vlCatalogProfileSet(text);
+      if (!parsed.ok) {
+        removeVlCellCatalogQuietly(vlDirs.configVlDir);
+        return { ok: false, info, reason: `catalogo vl non valido (${vlSource.path}): ${parsed.reason} — avvio rifiutato invece di partire da un catalogo illeggibile (fonte: ${vlSource.kind})` };
+      }
+      try {
+        writeVlCellCatalog(vlDirs.configVlDir, vlSource.path, text);
+        vlCatalogSource = text;
+      } catch (e) {
+        removeVlCellCatalogQuietly(vlDirs.configVlDir);
+        return { ok: false, info, reason: `catalogo vl non copiabile (${vlSource.path}): ${e.message} — avvio rifiutato invece di partire senza catalogo (fonte: ${vlSource.kind})` };
+      }
+    } else {
+      // Nessuna sorgente: l'overlay generato NON sopravvive al cambio di
+      // engine. Un catalogo dell'engine precedente, rimasto nella cella, e'
+      // un'eredit' invisibile — e il motore di questa riga e' proprio
+      // l'overlay, non la sua copia.
+      try {
+        removeVlCellCatalog(vlDirs.configVlDir);
+      } catch (e) {
+        return { ok: false, info, reason: `overlay vl generato non rimosso (${vlDirs.configVlDir}): ${e.message} — avvio rifiutato invece di partire con un catalogo precedente` };
+      }
+    }
+    // vlProfile: single `-p <name>` argument; the profile
+    // decides provider/base/model/effort unless NC carries an explicit
+    // operator choice. Precedence, tested: explicit NC choice > profile >
+    // the cell's selected.toml. In profile mode the provider/base pair is
+    // NEUTRALIZED (not merely not-composed): inherited or envPassthrough
+    // reintroductions of VL_PROVIDER/VL_BASE_URL are dropped after this
+    // branch — as are VL_MODEL/VL_EFFORT when NC has no explicit choice.
+    // VL_API_KEY and the profile's key names are never touched.
+    if (spec.vlProfile) {
+      if (!vlCatalogSource) {
+        return { ok: false, info, reason: `vlProfile "${spec.vlProfile}" senza catalogo: nessuna sorgente (vlConfigFile o catalogo dell'operatore) in cui il profilo possa esistere` };
+      }
+      const catalogo = vlCatalogProfileSet(vlCatalogSource);
+      if (!catalogo.ok) {
+        return { ok: false, info, reason: `catalogo vl non valido (${vlSource.path}): ${catalogo.reason} — avvio rifiutato invece di partire da un catalogo illeggibile` };
+      }
+      if (!catalogo.profiles.has(spec.vlProfile)) {
+        return { ok: false, info, reason: `profilo vl "${spec.vlProfile}" non dichiarato nel catalogo (${vlSource.path}) — profilo inesistente rifiutato esplicitamente` };
+      }
+      args.push('-p', spec.vlProfile);
+      vlNeutralize.push('VL_PROVIDER', 'VL_BASE_URL');
+      if (!model) vlNeutralize.push('VL_MODEL');
+      if (!spec.effort) vlNeutralize.push('VL_EFFORT');
+    } else if (spec.provider === 'custom') {
       // il protocollo scelto nel custom E' il provider wire: il ramo custom di
       // normalizeManagedSpec ha gia' garantito che sia uno dei tre che il
       // runtime parla e che baseUrl esista (endpoint obbligatorio: un default
@@ -2960,6 +3558,28 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
       env.VL_PROVIDER = profile.vlProvider;
       env.VL_BASE_URL = profile.endpoint;
     }
+    // Explicit NC model choice beats the profile (env composed only when the
+    // operator actually chose; without a choice profile/selected.toml decides
+    // and any ambient VL_MODEL was neutralized above).
+    if (model) env.VL_MODEL = model;
+    // Effort: only declared levels (validated at normalize
+    // against the model descriptor), and only if the CHOSEN binary's runtime
+    // reads VL_EFFORT — version-gated like the prompt gate, fail-closed with a
+    // declared refusal instead of a silently ignored request.
+    if (spec.effort) {
+      const effortGate = vlEffortGate(info.binary, cfg);
+      if (!effortGate.ok) return { ok: false, info, reason: effortGate.reason };
+      env.VL_EFFORT = spec.effort;
+    }
+    // Diagnostics without secrets: which binary will run, which vl profile,
+    // which effort, where the cell state lives. Distinguishes engine (info
+    // already carries it), vl profile and effective model for the operator.
+    info.vlRuntime = {
+      binary: info.binary,
+      profile: spec.vlProfile || '',
+      effort: spec.effort || '',
+      stateDir: vlDirs.base,
+    };
     // Per-cell prompt: file composed on the runtime system
     // (VL_SYSTEM_APPEND_FILE). The version gate lives in code, not in hope:
     // below 0.3.1 the variable is silently ignored, and a cell starting without
@@ -3087,6 +3707,22 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
   if (spec.envPassthrough && spec.envPassthrough.length) {
     const sources = credentialSources(cfg, home);
     for (const name of spec.envPassthrough) {
+      // vl profile mode: a neutralized name is DROPPED, not resolved — the
+      // profile (or the explicit NC choice) owns that field, and an ambient or
+      // passthrough value would silently override the catalog the operator
+      // pointed the cell at. Dropping also skips the fail-closed "name not
+      // set" refusal: the value is not supposed to arrive at all.
+      if (vlNeutralize.includes(name)) continue;
+      // Defense in depth: normalizeManagedSpec already refuses a vl spec whose
+      // passthrough carries a VL_* engine-choice name; this guard keeps the
+      // promise even for callers that bypass normalization (the value would be
+      // composed AFTER the vl branch and silently win over the engine choice).
+      if (spec.client === 'vl' && VL_OWNED_ENV.has(name)) continue;
+      // Idem per il trio XDG: sono l'identita' per cella, non una credenziale.
+      // normalizeManagedSpec li rifiuta gia' alla sorgente; qui la difesa in
+      // profondita' tiene la promessa anche per chi chiama questa funzione
+      // senza passare dalla validazione.
+      if (spec.client === 'vl' && VL_CELL_DIR_ENV.has(name)) continue;
       const value = sources.runtime[name] || sources.local[name] || sources.shell[name]
         || sources.keys[name] || sources.legacy[name];
       if (!value) {
@@ -3095,6 +3731,15 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
       env[name] = value;
     }
   }
+  // Same neutralization applied to the composed env itself: defense in depth
+  // for any future path that reintroduces these names after the vl branch.
+  for (const name of vlNeutralize) delete env[name];
+  // Assegnazione FINALE del trio XDG per cella: riassegnata qui, dopo il
+  // loop di passthrough e dopo la neutralizzazione, cosi' l'ultima parola e'
+  // di NexusCrew. Senza questo, un valore di passthrough (o un'eredità
+  // ambientale iniettata piu' a valle) sovrascriverebbe in silenzio
+  // l'identita' per cella e due celle finirebbero sulla stessa directory.
+  if (vlCellEnv) Object.assign(env, vlCellEnv);
   if (spec.client === 'codex-vl' && env[CODEX_APP_SERVER_IDENTITY_REQUIRED] !== resolvedIdentityRequired) {
     return { ok: false, info, reason: 'Fleet identity environment passthrough conflicts with the resolved launch decision' };
   }
@@ -3165,10 +3810,13 @@ module.exports = {
   OPENCODE_GO_MESSAGES_MODELS, OPENCODE_GO_RESPONSES_MODELS, OPENCODE_GO_CHAT_MODELS, OPENCODE_GO_LIMITS,
   OPENCODE_GO_ANTHROPIC_ROOT, OPENCODE_GO_API_BASE,
   CLIENT_LABELS, CLIENT_ORDER, engineClient, ordinaEngine, isStandardClient, normalizeManagedSpec, profileFor,
-  defaultDefinitions, defaultShellEngine, defaultAgyEngine, defaultKimiEngine, defaultGrokEngine, defaultVlEngine, describeManaged, describeCatalogCredential, discoverOllamaModels, engineModelDiscoveryPlan, resolveManagedEngine, needsExplicitNode,
+  defaultDefinitions, defaultShellEngine, defaultAgyEngine, defaultKimiEngine, defaultGrokEngine, defaultVlEngine, describeManaged, describeCatalogCredential, discoverOllamaModels, engineModelDiscoveryPlan, modelListingCredential, resolveManagedEngine, needsExplicitNode,
   discoverPiModels, EXTERNAL_DISCOVERY_TIMEOUT_MS, parseEnvFile, parseProviderShellFile, findBinary, publicCatalog, writePiProviderExtension, customCatalogFor,
   codexSurfaceNames, writeCellCodexProfile,
   writeVlCellPrompt, vlSystemAppendGate,
+  ensureVlCellDirs, vlCellBaseDir, writeVlCellCatalog, vlCatalogProfiles,
+  vlOperatorCatalogPath, removeVlCellCatalog,
+  resolveVlBinary, vlEffortGate, vlEffortMinVersion: () => [...VL_EFFORT_MIN], vlVersionAtLeast,
   extraModelsFrom, declaredModelsFor, declaredFor,
   providerKeyPaths, parseProviderKeyFiles, credentialSources, credential, CREDENTIAL_SOURCE_VALUES,
   credentialEnvNeutralizeSet, applyStoreNeutralization,