flowviant 0.102.2 → 0.104.0

package/bin/lib/safeFileName.mjs

@@ -0,0 +1,74 @@
+/**
+ * THE EXTENSION-PRESERVING 80-CHARACTER NAME, daemon side (2026-09-26, split
+ * out of knowledge.mjs, artifacts.mjs and work.mjs — SOLID F043).
+ *
+ * The rule is the server's `safeFileName` (apps/api/src/routes/
+ * sessionsAttachments.routes.ts), and it had THREE hand-kept daemon copies —
+ * one per caller — each re-stating the FNV-1a hash and the stem cut. A copy
+ * that drifted by one character would store a file under one name while the
+ * server re-derived another, which is exactly the disagreement the rule was
+ * adopted to end (2026-09-24: a bare `slice(0, 80)` cut an 84-character
+ * `….html` mockup to `….` and its bytes were discarded).
+ *
+ * Two layers, because the callers need different context rules around one
+ * common cut:
+ *   - `cutKeepingExtension(clean)` — the cut alone, over an ALREADY sanitised
+ *     name. Artifacts use only this: a bundle path is cut per component and
+ *     keeps its safe spaces (see `safeArtifactName`).
+ *   - `safeFileName(raw, fallback)` — the server's whole rule: last path
+ *     component, `[^A-Za-z0-9._-]` → `_`, no leading dot or dash, then the cut.
+ *     Each caller names its own fallback for an empty name ('file' for the
+ *     knowledge library, 'attachment' for turn uploads — the server's).
+ *
+ * The server keeps its own independent validation (the daemon is published
+ * separately and a server deploy cannot upgrade it); `safeFileName.test.mjs`
+ * and the API's `sessionsAttachments.routes.test.ts` pin the SAME table of
+ * canonical outputs, so a change on one side fails the other's release check.
+ */
+
+/** The longest name either function returns. */
+export const SAFE_NAME_MAX = 80;
+/** What counts as an extension worth keeping through a cut. */
+const SAFE_EXT_RE = /^[A-Za-z0-9]{1,10}$/;
+
+/** FNV-1a, 32-bit, as 8 hex — deterministic, so the same long name always maps
+ *  to the same stored name. Verbatim against the server's `fnv1a8`. */
+export function fnv1a8(s) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(16).padStart(8, '0');
+}
+
+/**
+ * An over-long name is its stem, cut, plus an 8-hex hash of the WHOLE name,
+ * plus the extension: stable across calls, at most 80 characters, and a name
+ * that already fits is returned unchanged — so it is idempotent over its own
+ * output and the server's re-application is a no-op.
+ */
+export function cutKeepingExtension(clean) {
+  if (clean.length <= SAFE_NAME_MAX) return clean;
+  const dot = clean.lastIndexOf('.');
+  const ext = dot > 0 && SAFE_EXT_RE.test(clean.slice(dot + 1)) ? clean.slice(dot + 1) : '';
+  const stem = ext ? clean.slice(0, dot) : clean;
+  const tag = `-${fnv1a8(clean)}`;
+  const room = SAFE_NAME_MAX - tag.length - (ext ? ext.length + 1 : 0);
+  return `${stem.slice(0, room)}${tag}${ext ? `.${ext}` : ''}`;
+}
+
+/**
+ * The server's `safeFileName`: drops every path separator, never starts with a
+ * dot or a dash, keeps the extension through a cut. `fallback` answers a name
+ * that sanitises to nothing.
+ */
+export function safeFileName(raw, fallback) {
+  const clean = String(raw ?? '')
+    .split(/[\\/]/)
+    .pop()
+    .replace(/[^A-Za-z0-9._-]/g, '_')
+    .replace(/^[.-]+/, '');
+  if (!clean) return fallback;
+  return cutKeepingExtension(clean);
+}

package/bin/lib/shipMerge.mjs

@@ -40,6 +40,34 @@ export function mergeOutward({
       /* not there — fine */
     }
   };
+  const hasOrigin = () => {
+    try { git(['remote', 'get-url', 'origin'], repoRoot); return true; } catch { return false; }
+  };
+  /**
+   * A REPOSITORY WITH NO REMOTE (2026-09-25). There is nowhere to push, so the
+   * merge lands on the local base branch itself. If base is checked out in the
+   * project folder it FAST-FORWARDS there, and only over a tree with no
+   * uncommitted tracked changes (refused in words otherwise: moving a branch
+   * under someone's edits is not a merge anybody approved); if it is not
+   * checked out, the ref moves by compare-and-swap. Either way nothing is
+   * rewritten, and `--no-ff` above kept every receipt's commit.
+   */
+  const landLocally = () => {
+    const base = baseBranchName(baseRef());
+    const merged = String(git(['rev-parse', 'HEAD'], tmpDir)).trim();
+    const before = String(git(['rev-parse', `refs/heads/${base}`], repoRoot)).trim();
+    let current = null;
+    try { current = String(git(['symbolic-ref', '--quiet', '--short', 'HEAD'], repoRoot)).trim(); } catch { /* detached */ }
+    if (current === base) {
+      const dirty = String(git(['status', '--porcelain', '--untracked-files=no'], repoRoot)).trim();
+      if (dirty) {
+        throw new Error(`this repository has no remote, so the merge lands on ${base} in ${repoRoot} itself, and that checkout has uncommitted changes. Commit or stash them, then approve again.`);
+      }
+      git(['merge', '--ff-only', merged], repoRoot);
+    } else {
+      git(['update-ref', `refs/heads/${base}`, merged, before], repoRoot);
+    }
+  };
   const attempt = () => {
     dropTmp();
     git(['worktree', 'add', '--detach', tmpDir, baseRef()], repoRoot);
@@ -47,7 +75,8 @@ export function mergeOutward({
       ['merge', '--no-ff', tip, '-m', `ship(${label}): ${count} commit${count === 1 ? '' : 's'}`],
       tmpDir
     );
-    gitNet(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmpDir, 120_000);
+    if (hasOrigin()) gitNet(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmpDir, 120_000);
+    else landLocally();
   };
   try {
     try {
@@ -132,5 +161,7 @@ export function mergeOutward({
  */
 export function isRaceRejection(e) {
   const d = `${e?.stdout ?? ''}\n${e?.stderr ?? ''}\n${e?.message ?? ''}`;
-  return /non-fast-forward|\[rejected\]|fetch first|stale info/i.test(d);
+  // `but expected` is update-ref's compare-and-swap losing (a repo with no
+  // remote, where the base ref moved between our read and our write).
+  return /non-fast-forward|\[rejected\]|fetch first|stale info|but expected/i.test(d);
 }

package/bin/lib/standDownExit.mjs

@@ -0,0 +1,181 @@
+/**
+ * THE ONE WAY A STANDING-DOWN DAEMON LEAVES: AFTER ITS DEPLOYS HAVE REPORTED.
+ *
+ * ── A STAND-DOWN LETS AN IN-FLIGHT DEPLOY FINISH AND REPORT (owner ruling
+ *    2026-09-26) ──
+ *
+ * The stand-downs are Ctrl+C (SIGINT), a service manager's or a takeover's
+ * SIGTERM, a commanded stop, a displaced box, a removed box and a revoked
+ * credential. Every one of them used to reach `process.exit` straight after
+ * the teardown. The deploy's command survived (it runs in its own process
+ * group, deployRunner.mjs, and only its timeout kills that group), but the
+ * process that held the claim did not — so its outcome was never posted, the
+ * heartbeat stopped, and three minutes later the server handed the same
+ * irreversible job out again.
+ *
+ * So the exit waits. The teardown still runs first and in full (tabs, the
+ * wiki, previews — none of those is a deploy), and it closes the work lanes
+ * before it kills anything (standDownGate.mjs): no CLI turn or check starts
+ * again, and a turn it killed never hands its output back, so it settles
+ * nothing and retries nothing, exactly as when `process.exit` followed on the
+ * same tick. The roster loop stops taking work (fleet.mjs checks
+ * `leave.leaving()` at the top of every tick and after every await in it, so a
+ * signal mid-tick ends the tick too), and a deploy claim answered after the
+ * stand-down began is not run (deploy.mjs). What stays alive is only the
+ * deploy lane: the command, its heartbeat and its report. While it waits:
+ *
+ *  - the instance lock stays HELD and is marked draining, so a takeover waits
+ *    for it and a `flowviant stop` says so — neither signals it (instance.mjs
+ *    reads the mark BEFORE it signals);
+ *  - `busy` keeps being written to the daemon state file, and the lock's mark
+ *    is read into `status --json` as `draining`, so the tray shows the box as
+ *    working until the outcome lands. A `draining` machine event says so at
+ *    once: the `stopped` event the stand-down already sent must not leave the
+ *    tray reading the box as idle;
+ *  - the report still goes out if the credential was rotated under it (a
+ *    Disconnect, which the app now refuses while a deploy is in flight): the
+ *    API's own refusal is said in words by the lease, never thrown.
+ *
+ * A SIGTERM while waiting changes nothing — a service manager, a takeover or
+ * `flowviant stop` asking again is the same stand-down asked twice. Only a
+ * person at the terminal can insist: a SECOND Ctrl+C leaves at once, after
+ * one best-effort post that settles each deploy as `unknown` ("outcome
+ * unknown: operator left mid-deploy"), so the server marks it terminal and
+ * never hands it out again. Nothing here ever kills the deploy; that is the
+ * timeout's alone.
+ *
+ * STATED RESIDUALS (no code answers them):
+ *  - A service manager. No unit file is shipped or documented (checked
+ *    2026-09-26). A unit that runs this daemon must set `KillMode=mixed` (the
+ *    stop's SIGTERM goes to the daemon alone, not to the deploy command in its
+ *    cgroup) and `TimeoutStopSec=2100` (35 minutes, above the deploy's
+ *    30-minute timeout); systemd's defaults SIGTERM the command itself and
+ *    SIGKILL the whole group after 90 s.
+ *  - An older daemon's takeover or `flowviant stop` does not read the draining
+ *    mark and SIGKILLs a newer draining daemon after its 20 s grace; the
+ *    report is then lost and the server requeues the job, as before this
+ *    ruling, until the release carrying this has spread.
+ *  - A SIGKILL (or a second Ctrl+C whose `unknown` post does not land) loses
+ *    the outcome the same way.
+ *  - A deploy claim still on the wire when a second Ctrl+C leaves gets no
+ *    `unknown` post (nothing was run, and this process has no job to settle);
+ *    if the server granted it, its stale sweep hands it out again after three
+ *    minutes, which is right, because nothing ran.
+ *
+ * Every dependency is injected, so the wait can be driven without a process to
+ * exit; fleet.mjs builds the live one.
+ */
+
+export const DRAIN_BUSY_BEAT_MS = 30_000;
+/** How long a second Ctrl+C waits for its `unknown` post before it leaves
+ *  anyway — a person insisting is not kept waiting on the network. */
+export const ABANDON_POST_MS = 5_000;
+
+/**
+ * @param {object} deps
+ * @param {() => number}   deps.inFlight     how many deploys this process holds
+ * @param {() => string[]} deps.labels       what they deploy, `target → env`
+ * @param {() => Promise<void>} deps.settled resolves once every one reported
+ * @param {() => Promise<void>} deps.abandon settle each as `unknown` (deploy.mjs)
+ * @param {(what: string) => void} deps.markDraining  mark the instance lock
+ * @param {(what: string) => void} [deps.announce]    the `draining` machine event
+ * @param {() => void} deps.reportBusy       write `busy` to the state file
+ * @param {(code: number) => void} deps.exit
+ * @param {{ note: (m: string) => void, warn: (m: string) => void }} deps.log
+ * @returns {((code: number, opts?: { signal?: 'SIGINT' | 'SIGTERM' | null }) => Promise<void>)
+ *   & { leaving: () => boolean, drained: () => Promise<void> }}
+ */
+export function createLeave({
+  inFlight,
+  labels,
+  settled,
+  abandon = async () => {},
+  markDraining,
+  announce = () => {},
+  reportBusy,
+  exit,
+  log,
+  beatMs = DRAIN_BUSY_BEAT_MS,
+  abandonMs = ABANDON_POST_MS,
+}) {
+  let waiting = null;
+  let interrupts = 0;
+  let gone = false;
+  const exitOnce = (code) => {
+    if (gone) return;
+    gone = true;
+    exit(code);
+  };
+  leave.leaving = () => waiting != null;
+  /** Resolves when the stand-down has finished waiting (at once when none began). */
+  leave.drained = () => waiting ?? Promise.resolve();
+  return leave;
+  function leave(code, { signal = null } = {}) {
+    if (signal === 'SIGINT') interrupts++;
+    if (waiting) {
+      // A SIGTERM or a second roster command while draining is the same
+      // stand-down asked again and changes nothing. Only a person at the
+      // terminal insists, and only with a SECOND Ctrl+C.
+      if (signal !== 'SIGINT' || gone) return waiting;
+      if (interrupts < 2) {
+        log.note('still waiting for the deploy to report. Ctrl+C again leaves now, without its outcome.');
+        return waiting;
+      }
+      log.warn(
+        'leaving without seeing the deploy end — its command keeps running on this box; ' +
+          'the app is told its outcome is unknown, so it is never run again.'
+      );
+      const bounded = new Promise((r) => {
+        const t = setTimeout(r, abandonMs);
+        t.unref?.();
+      });
+      Promise.race([Promise.resolve().then(abandon).catch(() => {}), bounded]).then(() => exitOnce(code));
+      return waiting;
+    }
+    if (inFlight() === 0) {
+      waiting = Promise.resolve();
+      exitOnce(code);
+      return waiting;
+    }
+    const n = inFlight();
+    const what = labels().join(', ');
+    log.note(
+      `waiting for ${n === 1 ? 'a deploy' : `${n} deploys`} (${what}) to finish and report before stopping — ` +
+        `the command is not stopped.${signal === 'SIGINT' ? ' Ctrl+C again leaves now, without its outcome.' : ''}`
+    );
+    try {
+      markDraining(what);
+    } catch {
+      /* a lock we cannot mark still drains; an older daemon's takeover may force it */
+    }
+    try {
+      announce(what);
+    } catch {
+      /* a local readout must never interrupt a stand-down */
+    }
+    const beat = () => {
+      try {
+        reportBusy();
+      } catch {
+        /* a local readout must never interrupt a stand-down */
+      }
+    };
+    beat();
+    const timer = setInterval(beat, beatMs);
+    timer.unref?.();
+    waiting = settled().then(
+      () => {
+        clearInterval(timer);
+        if (gone) return;
+        beat();
+        log.note(`${n === 1 ? 'the deploy is' : 'the deploys are'} done — stopping.`);
+        exitOnce(code);
+      },
+      () => {
+        clearInterval(timer);
+        exitOnce(code);
+      }
+    );
+    return waiting;
+  }
+}

package/bin/lib/standDownGate.mjs

@@ -0,0 +1,48 @@
+/**
+ * THE WORK LANES STOP AT THE TEARDOWN, EVEN WHILE THE PROCESS LIVES ON (second
+ * review of ruling 2026-09-26: deploy during stand-down).
+ *
+ * Before the drain, every stand-down ran the teardown and then `process.exit`
+ * on the same tick. The teardown SIGTERMed the live CLIs, and the code waiting
+ * on them never ran again, so a killed turn never settled: it stayed pending on
+ * the server and resumed in place on the next run ("Worktrees are kept:
+ * in-flight work resumes next run").
+ *
+ * The drain keeps the process alive after the teardown for as long as a
+ * deploy is in flight (standDownExit.mjs). Every continuation that was waiting
+ * on a killed CLI would then run. A tab turn's resume-fresh retry would spawn a
+ * new CLI that nobody kills. An agent turn would settle as `nothing` and send
+ * the agent to Stuck. The wiki would sync a half-written vault.
+ *
+ * So the teardown closes this gate FIRST, and the two places the daemon spawns
+ * a lane's work ask it: runTurn.mjs (every CLI turn: tab, agent, plan,
+ * pre-review, wiki) and workAgentCheck.mjs (the project check). Once it is
+ * closed, a lane's spawn never starts, and a lane's child that ends never hands
+ * back its output. The promise the lane awaits stays pending, which is exactly
+ * where `process.exit` used to leave it: no settle, no retry, no sync. A pending
+ * promise holds no handle, so it never keeps the process up on its own.
+ *
+ * The deploy lane runs past the gate: it is what the drain exists for. It asks
+ * the gate once, when a claim's answer comes back after the stand-down began,
+ * and then does not run the deploy (deploy.mjs).
+ *
+ * Process-wide by design: there is one teardown per process, and it closes
+ * once and for good.
+ */
+
+let stopped = false;
+
+/** The teardown's first act (fleet.mjs). Idempotent; never reopens. */
+export function stopWorkLanes() {
+  stopped = true;
+}
+
+/** Whether the teardown has run in this process. */
+export function workLanesStopped() {
+  return stopped;
+}
+
+/** What a lane awaits once the gate is closed: an answer that never comes. */
+export function never() {
+  return new Promise(() => {});
+}

package/bin/lib/startProject.mjs

@@ -0,0 +1,279 @@
+/**
+ * THE START PATH'S PROJECT: which stored credential a bare `flowviant` serves
+ * here, said, asked, or refused — never guessed — and the repo binding the
+ * person consented to, handed back DEFERRED.
+ *
+ * SPLIT OUT OF cli.mjs (SOLID audit 2026-09-26, F053): the entrypoint changed
+ * for terminal dispatch, for the `machines` menu, and for this policy. The
+ * picker, the single-unbound confirm, every refusal and the tray folder check
+ * are one decision with one reason to change, so they live here and cli.mjs
+ * asks `resolveStartProject` once and passes its answer to runFleetDaemon.
+ * Moved verbatim; the refusals still end the process in the same words.
+ *
+ * THE BINDING IS NEVER WRITTEN HERE. What this returns is `afterLock` — the
+ * store write, or null — and runFleetDaemon runs it only once the instance
+ * lock refused nothing (startBind.test.mjs pins the order and that this is
+ * the one home of both writes).
+ */
+import { FLEET_TOKEN, CREDENTIAL, adoptStoredCredential } from './config.mjs';
+import { runLogin } from './login.mjs';
+import { terminalCommand } from './launchCommand.mjs';
+import { canPrompt, askWithTimeout, selectMenu, menuSupported } from './tty.mjs';
+
+/** Re-exec a plain `flowviant` after an inline login — the login command's own
+ *  pattern: config.mjs read the store at IMPORT time, before the credential
+ *  existed, so this process cannot serve; the child can. */
+async function reexecAfterLogin() {
+  const login = await runLogin({ thenStart: false });
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
+  const { spawn } = await import('node:child_process');
+  const child = spawn(process.execPath, process.argv[1]?.startsWith('/$bunfs/') ? [] : [process.argv[1]], { stdio: 'inherit', env: process.env });
+  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
+}
+
+// TWO ROWS THAT READ ALIKE ARE NOT A CHOICE. `projectRowLabel` adds the id and
+// the connected date to the COLLIDING rows only — production held two projects
+// both called "BRIF AI", both bound to the same checkout, so this picker
+// offered two identical lines and the only way to answer was to guess. See
+// credentials.mjs for why the suffix is not on every row. (That exact case is
+// a refusal now rather than a picker — a directory serves one project — but
+// two same-named projects can still meet in the no-match picker.)
+function listLines(entries, { projectRowLabel }) {
+  return entries
+    .map(
+      (e, i) =>
+        `  ${i + 1}. ${projectRowLabel(e, entries)}` +
+        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet')
+    )
+    .join('\n');
+}
+
+/**
+ * Resolve the project this start serves. Returns the deferred binding (or
+ * null); every refusal exits the process in words, as the entrypoint did.
+ * `dirGiven`: the start named its checkout with `--dir` (the tray's form).
+ */
+export async function resolveStartProject({ dirGiven }) {
+  // ── WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
+  //
+  // The store holds many projects since 0.55.0 and resolution is BY REPO
+  // (credentials.mjs). What is left here is the human half: an ambiguous store
+  // on a TTY becomes a PICKER, a single unbound credential gets ONE confirm that
+  // binds it, and a headless start with no unambiguous answer refuses in words
+  // that name every stored project and every way out. The one thing this block
+  // must never do is serve a project the resolution did not name — "it said
+  // skadooble in my calendar repo" is the confusion this exists to end.
+  // A RESTART IS NOT A PERSON. `reexec` (update.mjs) inherits stdio, so an
+  // auto-updated daemon's child sees two TTYs; without this it would stop on the
+  // binding confirm below and the machine would stay dark until somebody typed a
+  // key. Same reasoning as the headless case, and the same answer.
+  // `canPrompt()`, not a bare isTTY pair: a BACKGROUNDED job (`flowviant &`) has
+  // two TTYs and cannot be asked anything — the first read raises SIGTTIN and the
+  // kernel STOPS the process, which is why 0.55.2's timeout did not save it (a
+  // stopped process runs no timers). See tty.mjs.
+  const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
+
+  /** NO ANSWER TIME LIMIT on the start path (2026-09-20, the owner: "why is
+   *  there an answer time limit, remove that"). The confirm below carried 20s
+   *  and the picker 60s, each arguing that a restart nobody is watching must
+   *  not sit dark on a prompt — but `interactive` already excludes exactly that
+   *  case (no foreground terminal, or a self-update re-exec, and nothing is
+   *  asked). What was left was a person reading a list being told "no answer
+   *  in 60s — nothing started". A prompt a person can see waits for the
+   *  person; tty.mjs's header carries the argument. */
+  const externalToken =
+    process.argv.includes('--fleet') ||
+    Boolean(process.env.FLOWVIANT_MACHINE_TOKEN) ||
+    Boolean(process.env.FLOWVIANT_FLEET);
+
+  /** A repo binding the person just consented to, persisted by runFleetDaemon
+   *  only after the instance lock is taken — never before a refusal. */
+  let afterLock = null;
+
+  if (!FLEET_TOKEN) {
+    if (CREDENTIAL.error) {
+      console.error(`error: ${CREDENTIAL.error}. \`${terminalCommand('projects')}\` lists what is stored.`);
+      process.exit(1);
+    }
+    // A DIRECTORY SERVES ONE PROJECT (2026-09-23, the owner, verbatim: "a
+    // directory cannot have more than one project on flowviant. if one already
+    // exists, it would warn the user and ask them to delete the project on
+    // flowviant first. because 2 projects shouldnt be able to edit a directory
+    // at the same time."). This used to be a PICKER — two projects bound to one
+    // checkout, choose which this daemon serves — which is a control offering to
+    // do the forbidden thing politely. It is a refusal now, on a TTY and
+    // headless alike, naming both projects and the remedy. `credentialRefusal`
+    // is the same sentence login prints when it declines to bind a second one.
+    if (CREDENTIAL.reason === 'multiple-bound') {
+      const { directoryTakenRefusal } = await import('./credentials.mjs');
+      console.error(directoryTakenRefusal(CREDENTIAL.choices, CREDENTIAL.repoRoot));
+      process.exit(1);
+    }
+    if (CREDENTIAL.choices?.length && interactive) {
+      const creds = await import('./credentials.mjs');
+      const { originSlug } = await import('./git.mjs');
+      const { basename } = await import('node:path');
+      const { choices, repoRoot } = CREDENTIAL;
+      console.log(
+        CREDENTIAL.reason === 'outside-repo'
+          ? 'flowviant is not inside a git repo, and more than one project is connected here.'
+          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+      );
+
+      const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (${terminalCommand('login')})`;
+      // WHICH ONE LOOKS RIGHT — a pre-selection, never an auto-serve. The resolver
+      // refuses to serve a project the repo PATH did not name (the skadooble law);
+      // this only decides which row the cursor starts on, using the repo's folder
+      // name and its github repo-name against the stored project names. A unique
+      // match becomes ONE keypress; a wrong guess costs nothing, because the human
+      // still confirms. (Two projects bound to THIS repo never reach here: that
+      // is a refusal above, since 2026-09-23.)
+      const slug = repoRoot ? originSlug(repoRoot) : null;
+      const likely = creds.likelyChoiceIndex(choices, {
+        repoBasename: repoRoot ? basename(repoRoot) : null,
+        repoSlugName: slug ? slug.split('/')[1] : null,
+      });
+
+      // Bounded like the confirm below, and for the same reason — but silence
+      // means something DIFFERENT here and the difference is load-bearing. There
+      // is a real ambiguity to resolve; serving a guess is the skadooble bug.
+      // So no answer REFUSES, which is exactly what this branch already does
+      // headless, and the message says how to answer without being present.
+      let chosen = null; // 0-based into [...choices, login]
+      if (menuSupported()) {
+        const rowLabel = (e) =>
+          creds.projectRowLabel(e, choices) +
+          (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet');
+        const options = [...choices.map(rowLabel), loginLabel];
+        // Say WHY the cursor starts where it does — "intuitive" made visible.
+        if (likely >= 0) options[likely] += '   ← looks like this repo';
+        const res = await selectMenu({
+          options,
+          defaultIndex: likely >= 0 ? likely : 0,
+        });
+        if (res.cancelled) {
+          console.error('nothing chosen — nothing started.');
+          process.exit(1);
+        }
+        if (!res.unsupported) chosen = res.index;
+      }
+      if (chosen === null) {
+        // Numeric fallback — a pipe, or a terminal without raw mode. Empty Enter
+        // takes the likely default when there is one, so it is one keystroke here
+        // too.
+        console.log(listLines(choices, creds));
+        console.log(`  ${choices.length + 1}. ${loginLabel}`);
+        const hint = likely >= 0 ? ` (enter for ${creds.projectLabel(choices[likely])})` : '';
+        const raw = await askWithTimeout(
+          `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `
+        );
+        if (raw === null) {
+          // The read itself failed — stdin closed, or the terminal went away
+          // mid-question. Not a timeout: there is none.
+          console.error(
+            `\ncould not read an answer — nothing started. ` +
+              `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
+          );
+          process.exit(1);
+        }
+        const n = raw === '' && likely >= 0 ? likely + 1 : Number.parseInt(raw, 10);
+        chosen = Number.isInteger(n) ? n - 1 : -1;
+      }
+
+      if (chosen === choices.length) await reexecAfterLogin();
+      const picked = chosen >= 0 ? choices[chosen] : undefined;
+      if (!picked) {
+        console.error('nothing chosen — nothing started.');
+        process.exit(1);
+      }
+      // An answered question is consent: adopt it, and BIND it to this repo so
+      // the next start needs no prompt. Repointing is legitimate and said aloud.
+      if (repoRoot && picked.repoRoot && picked.repoRoot !== repoRoot) {
+        console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
+      }
+      adoptStoredCredential(picked);
+      // BOUND ONLY ONCE THE START HAS THE LOCK. Written here, the answer moved
+      // the binding even when the instance lock then refused the start — a live
+      // daemon for the same project in its own checkout — and that daemon's next
+      // unattended self-update re-exec'd into a store that no longer bound its
+      // repo, found no match headless, and exited with the machine dark.
+      afterLock = () => creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
+      console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
+    } else if (CREDENTIAL.choices?.length) {
+      const creds = await import('./credentials.mjs');
+      console.error(
+        'error: more than one project is connected on this machine and this repo is not bound to any of them:\n' +
+          listLines(CREDENTIAL.choices, creds) +
+          `\nPick one with \`--project <name|id>\`, bind this repo by running \`${terminalCommand()}\` here in a terminal once,\n` +
+          `or connect this repo to its own project with \`${terminalCommand('login')}\`.`
+      );
+      process.exit(1);
+    } else {
+      console.error(
+        'error: no credential found. Easiest:\n' +
+          `  ${terminalCommand('login')}      (approve in the app — recommended)\n` +
+          'Or set:\n' +
+          '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
+      );
+      process.exit(1);
+    }
+  } else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
+    // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
+    // yes binds and every later start is silent. This is the exact question
+    // whose absence had a calendar checkout serving skadooble.
+    //
+    // AND IT TIMES OUT, because a prompt on a start path is a way for a machine
+    // to go dark. `FLOWVIANT_REEXEC` above covers the restart THIS version
+    // performs, but it cannot cover the one that matters most: the hop that
+    // installs a fixed daemon is spawned by the OLD one, which never sets it.
+    // 0.55.0 → 0.55.1 was exactly that — an auto-update landing unattended would
+    // stop here with the machine serving nothing. A guard that only works once
+    // everyone already has it is not a guard.
+    //
+    // IF THE READ FAILS WE SERVE, AND WE DO NOT BIND. (This used to say "on
+    // timeout"; there is no timeout since 2026-09-20 — a person at the prompt
+    // is waited for. `null` now means stdin closed under the question.) Those
+    // are two decisions:
+    //  · SERVE, because it is what every version before 0.55.0 did with this
+    //    exact store, so the silent path is the status quo rather than a new
+    //    risk — and a daemon that answers is strictly better than one that does
+    //    not, which is the whole reason this product has exactly one refusal.
+    //  · DO NOT BIND, because binding is the thing the question was FOR. Nobody
+    //    answered, so nothing is cemented; the next human start asks again. That
+    //    keeps the skadooble case fixed for the person who is actually looking,
+    //    which is the only person it could ever have been fixed for.
+    const creds = await import('./credentials.mjs');
+    const label = creds.projectLabel(CREDENTIAL.entry);
+    const answered = await askWithTimeout(
+      `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `
+    );
+    const raw = answered === null ? null : answered.toLowerCase(); // null = the read failed
+    if (raw === null) {
+      console.log(
+        `\n  could not read an answer — serving ${label} for this run ` +
+          `without tying it to this repo. Run \`${terminalCommand()}\` here and answer to make it stick.`
+      );
+    } else if (raw === '' || raw === 'y' || raw === 'yes') {
+      // After the lock, for the reason the picker's bind gives above.
+      afterLock = () => creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
+    } else {
+      console.error(
+        `nothing started. Connect this repo to its own project with \`${terminalCommand('login')}\`, ` +
+          `or see what is stored with \`${terminalCommand('projects')}\`.`
+      );
+      process.exit(1);
+    }
+  }
+
+  if (process.argv.includes('--json-events') && dirGiven && CREDENTIAL?.entry) {
+    const { detectRepoRoot, listStoredProjects, boundElsewhere } = await import('./credentials.mjs');
+    const repo = detectRepoRoot();
+    const entry = CREDENTIAL.entry;
+    if (!repo || entry.repoRoot !== repo || boundElsewhere(listStoredProjects(), repo, entry.projectId).length) {
+      console.error('error: this project is not connected to this repository. Run `flowviant login` for the selected folder.');
+      process.exit(1);
+    }
+  }
+
+  return afterLock;
+}

package/bin/lib/trace.mjs

@@ -59,7 +59,7 @@
  * tail of a trace, never the settle behind it.
  */
 
-import { THINK_MARKER } from './runtimes.mjs';
+import { THINK_MARKER } from './runtimeEvents.mjs';
 
 /** One batch every two seconds — the discipline the tab's narrator keeps, for
  *  the same reason: a turn emits hundreds of entries and nobody is reading them
@@ -190,7 +190,7 @@ export function makeTraceRelay({ agentId, turnId, post, scrub = (s) => s, run =
   return {
     /**
      * A prose line from the stream. `kind` is the daemon's activity vocabulary
-     * (runtimes.mjs); anything that is not thinking or the model speaking is a
+     * (runtimeEvents.mjs); anything that is not thinking or the model speaking is a
      * `note` — the honest bucket for a codex error line or an agy tool name,
      * rather than a wire value invented per runtime.
      *
@@ -225,7 +225,7 @@ export function makeTraceRelay({ agentId, turnId, post, scrub = (s) => s, run =
        * real transcripts: 93 blocks, all of them empty) carries no text in any
        * of them — so the trace filled with the identical marker repeated, which
        * is noise standing exactly where the thought would have been. The wiki
-       * feed collapses the same run for the same reason (fleet.mjs: "Collapse
+       * feed collapses the same run for the same reason (wikiRunner.mjs: "Collapse
        * runs of bare 'thinking…' so the feed doesn't fill with it").
        *
        * ONLY THE BARE MARKER, and that is the whole safety of it: a think WITH