flowviant 0.103.0 → 0.104.0

package/bin/cli.mjs

@@ -64,9 +64,12 @@
  * inside the git repo you want worked. `gh` is optional.
  *
  * Implementation lives in ./lib/: config, ui, preflight, install, update,
- * instance, login, mcp-cli; fleet (the roster loop) and work (session turns);
+ * instance, login, mcp-cli; startProject (which project a start serves) and
+ * machinesCommand (the `machines` listing and menu); fleet (the roster loop)
+ * and work (session turns);
  * claude + runtimes + prompts + stream (spawning a CLI and reading its events);
- * git + worktreeDiff + patch; localSessions, listeners, preview + authproxy;
+ * git + worktreeDiff + patch; localSessions (+ claudeSessions, agySessions), listeners, preview + authproxy
+ * (+ previewGatePolicy, previewFramePolicy);
  * env (the box keypair, the uplink scrubber, the env-comparison scan) + vault
  * (the knowledge wiki, not secrets), resources, deploy, shot.
  */
@@ -81,9 +84,11 @@ if (process.argv[2] === 'start' && !process.argv.slice(3).some((arg) => arg ===
 
 // Resolve --dir before config reads the project bound to cwd. A tray process
 // starts outside the checkout; its explicit folder is the daemon's checkout.
+// Which words work on the checkout is the command table's (commandSpecs.mjs,
+// import-free, so it is safe to read before config.mjs loads).
+const { commandUsesCheckout, findCommand } = await import('./lib/commandSpecs.mjs');
 const dirAt = process.argv.indexOf('--dir');
-const noCheckoutCommand = new Set(['--version', '-v', 'version', 'status', 'stop', 'uninstall', 'machines', 'projects', 'update', 'shot', 'clean', 'gh-auth', 'mcp', 'help', '--help', '-h']);
-if (dirAt >= 0 && !noCheckoutCommand.has(process.argv[2])) {
+if (dirAt >= 0 && commandUsesCheckout(process.argv[2])) {
   const dir = process.argv[dirAt + 1];
   try {
     if (!dir || dir.startsWith('--')) throw new Error('missing directory');
@@ -96,7 +101,7 @@ if (dirAt >= 0 && !noCheckoutCommand.has(process.argv[2])) {
     process.exit(1);
   }
 }
-const { FLEET_TOKEN, CREDENTIAL, VERSION, adoptStoredCredential } = await import('./lib/config.mjs');
+const { CREDENTIAL, VERSION } = await import('./lib/config.mjs');
 const { runFleetDaemon } = await import('./lib/fleet.mjs');
 const { runLogin } = await import('./lib/login.mjs');
 const { launchCommand, terminalCommand } = await import('./lib/launchCommand.mjs');
@@ -120,18 +125,18 @@ if (process.argv.includes('--remote') && !(process.argv[2] === 'status' && proce
 // long-running process.
 // `flowviant --version` prints and exits — the first thing a person runs after
 // a curl install, and it must never start a daemon.
-if (process.argv[2] === '--version' || process.argv[2] === '-v' || process.argv[2] === 'version') {
+if (findCommand(process.argv[2])?.name === 'version') {
   console.log(VERSION);
   process.exit(0);
 }
 
 // `flowviant help`, `--help`/`-h`, and `<command> --help`. Before any command
-// runs, so asking about one never runs it (bin/lib/help.mjs has the table).
+// runs, so asking about one never runs it (bin/lib/commandSpecs.mjs has the table).
 {
   const asksHelp = (arg) => arg === '--help' || arg === '-h';
   const first = process.argv[2];
   if (first === 'help' || asksHelp(first) || process.argv.slice(3).some(asksHelp)) {
-    const { findCommand, renderCommandHelp, renderHelp, unknownCommandMessage } = await import('./lib/help.mjs');
+    const { renderCommandHelp, renderHelp, unknownCommandMessage } = await import('./lib/help.mjs');
     const topic = first === 'help' ? process.argv[3] : asksHelp(first) ? undefined : first?.startsWith('-') ? 'start' : first;
     if (!topic) { console.log(renderHelp(VERSION)); process.exit(0); }
     const cmd = findCommand(topic);
@@ -141,7 +146,7 @@ if (process.argv[2] === '--version' || process.argv[2] === '-v' || process.argv[
   }
 }
 
-if (process.argv[2] === 'login') {
+async function loginCommand() {
   const noStart = process.argv.includes('--no-start');
   const json = process.argv.includes('--json');
   const login = await runLogin({ thenStart: !noStart, json, dir: process.cwd() });
@@ -169,17 +174,18 @@ if (process.argv[2] === 'login') {
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
 }
 
-if (process.argv[2] === 'status' && process.argv.includes('--json')) {
-  // The tray polls this every 30 s: the fixed per-user bin dirs only, no shell.
-  await (await import('./lib/loginPath.mjs')).adoptLoginPathForProcess({ shell: false });
-  const { desktopStatus, desktopStatusRemote } = await import('./lib/desktopContract.mjs');
-  const status = process.argv.includes('--remote') ? await desktopStatusRemote() : desktopStatus();
-  process.stdout.write(`${JSON.stringify(status)}\n`);
-  process.exit(0);
-}
-
-// `flowviant status` — the same facts, for a person.
-if (process.argv[2] === 'status') {
+// `flowviant status` — each project connected here. `--json` is the tray's
+// form (and `--remote` adds the server's answer); plain is the same facts, for
+// a person.
+async function statusCommand() {
+  if (process.argv.includes('--json')) {
+    // The tray polls this every 30 s: the fixed per-user bin dirs only, no shell.
+    await (await import('./lib/loginPath.mjs')).adoptLoginPathForProcess({ shell: false });
+    const { desktopStatus, desktopStatusRemote } = await import('./lib/desktopContract.mjs');
+    const status = process.argv.includes('--remote') ? await desktopStatusRemote() : desktopStatus();
+    process.stdout.write(`${JSON.stringify(status)}\n`);
+    process.exit(0);
+  }
   await (await import('./lib/loginPath.mjs')).adoptLoginPathForProcess();
   const { runStatus } = await import('./lib/views.mjs');
   await runStatus();
@@ -187,21 +193,21 @@ if (process.argv[2] === 'status') {
 }
 
 // `flowviant logs [-f]` — this repo's daemon log.
-if (process.argv[2] === 'logs') {
+async function logsCommand() {
   const { runLogs } = await import('./lib/views.mjs');
   await runLogs(process.argv);
   process.exit(0);
 }
 
 // `flowviant open` — this repo's board, in the browser.
-if (process.argv[2] === 'open') {
+async function openCommand() {
   const { runOpen } = await import('./lib/views.mjs');
   runOpen(process.argv);
   process.exit(0);
 }
 
 // `flowviant doctor` — what this computer needs, checked.
-if (process.argv[2] === 'doctor') {
+async function doctorCommand() {
   await (await import('./lib/loginPath.mjs')).adoptLoginPathForProcess();
   const { runDoctor } = await import('./lib/views.mjs');
   process.exit((await runDoctor()) > 0 ? 1 : 0);
@@ -209,7 +215,7 @@ if (process.argv[2] === 'doctor') {
 
 // `flowviant update` — install the latest published version now. The daemon also
 // self-updates on its own (at startup + when idle); this is the manual path.
-if (process.argv[2] === 'update') {
+async function updateCommand() {
   const { runUpdateCommand } = await import('./lib/update.mjs');
   await runUpdateCommand();
   process.exit(0);
@@ -217,7 +223,7 @@ if (process.argv[2] === 'update') {
 
 // `flowviant gh-auth` — sign in the gh CLI (incl. a copy we bundled into
 // ~/.flowviant/bin), so the isolated install doesn't need gh on your global PATH.
-if (process.argv[2] === 'gh-auth') {
+async function ghAuthCommand() {
   const { addLocalBinToPath } = await import('./lib/install.mjs');
   const { execFileSync } = await import('node:child_process');
   addLocalBinToPath();
@@ -233,13 +239,13 @@ if (process.argv[2] === 'gh-auth') {
 // They're kept across runs so in-flight work survives Ctrl+C; this is the drain.
 // Repos self-heal: the daemon runs `git worktree prune` if a stale registration
 // blocks re-adding a path.
-if (process.argv[2] === 'clean') {
+async function cleanCommand() {
   const { rmSync, existsSync } = await import('node:fs');
   const { join } = await import('node:path');
   const { homedir } = await import('node:os');
   const { execFileSync } = await import('node:child_process');
   // Also reap any preview dev-server/tunnel groups a crashed daemon left running.
-  const { reapOrphanPreviews } = await import('./lib/preview.mjs');
+  const { reapOrphanPreviews } = await import('./lib/previewRegistry.mjs');
   reapOrphanPreviews((m) => console.log(m));
   const dir = join(homedir(), '.flowviant', 'worktrees');
   if (!existsSync(dir)) {
@@ -263,7 +269,7 @@ if (process.argv[2] === 'clean') {
 // page. A session's agent shells out to this to SEE the change it just made.
 // Self-contained + graceful (no browser → exit 1, and the agent carries on in
 // text); needs no credential, so it runs before the auth gate.
-if (process.argv[2] === 'shot') {
+async function shotCommand() {
   const { runShot } = await import('./lib/shot.mjs');
   await runShot(process.argv.slice(3));
   process.exit(0);
@@ -287,7 +293,7 @@ if (process.argv[2] === 'shot') {
 // EXIT 0 when it stopped something AND when it found nothing: "no flowviant
 // daemon is running on this machine." is the answer the asker came for, not an
 // error. Non-zero only when something was alive and could not be stopped.
-if (process.argv[2] === 'stop') {
+async function stopCommand() {
   const { stopAllDaemons, stopDaemonFor } = await import('./lib/instance.mjs');
   let result;
   if (process.argv.includes('--project')) {
@@ -301,7 +307,7 @@ if (process.argv[2] === 'stop') {
   process.exit(failed > 0 ? 1 : 0);
 }
 
-if (process.argv[2] === 'uninstall') {
+async function uninstallCommand() {
   const { runUninstall } = await import('./lib/uninstall.mjs');
   const { askWithTimeout } = await import('./lib/tty.mjs');
   const result = await runUninstall({
@@ -319,8 +325,9 @@ if (process.argv[2] === 'uninstall') {
 // network: it reads the store, which is the exact thing a confused person is
 // trying to see. The remedies are named because this listing IS the moment of
 // confusion ("why did it say skadooble?"), not documentation.
-if (process.argv[2] === 'projects') {
+async function projectsCommand() {
   const { listStoredProjects, projectLabel } = await import('./lib/credentials.mjs');
+  const { connectedOn } = await import('./lib/credentialDate.mjs');
   const entries = listStoredProjects();
   if (entries.length === 0) {
     console.log(`no projects connected on this machine yet — run \`${terminalCommand('login')}\` inside a repo.`);
@@ -332,11 +339,8 @@ if (process.argv[2] === 'projects') {
     // did I set up last month" is the same question one step on. Absent when
     // nothing recorded one (a credential stored before the field existed);
     // nothing is invented.
-    const savedOn = e.savedAt ? new Date(e.savedAt) : null;
-    const connected =
-      savedOn && !Number.isNaN(savedOn.getTime())
-        ? `, connected ${savedOn.toLocaleDateString('en-US', { month: 'short', day: 'numeric' })}`
-        : '';
+    const on = connectedOn(e.savedAt);
+    const connected = on ? `, connected ${on}` : '';
     console.log(
       `  ${projectLabel(e)}  (${e.projectId.slice(0, 8)}…${connected})` +
         `${e.repoRoot ? `\n      repo · ${e.repoRoot}` : '\n      repo · not bound yet — first start or login in its repo binds it'}` +
@@ -350,192 +354,12 @@ if (process.argv[2] === 'projects') {
   process.exit(0);
 }
 
-// ── `flowviant machines` — every project connected on THIS box, and every box
-//    that has polled each of them; and, on a terminal, a menu over them.
-//
-// A THIRD COMMAND, and the owner's ruling it amends is his own: the terminal
-// surface is `npx flowviant` and `npx flowviant login`, full stop — which is
-// what deleted the old terminal flag for moving a machine — and he asked for
-// this one directly ("the CLI gets a command to list connections"). It shipped
-// VIEW-ONLY, and on 2026-09-23 he asked for the rest: "it seems to be only a
-// read cmd but I want to be able to interact with it and use arrow keys to
-// select the machines or to remove them." So: the listing, then — only where a
-// person can drive one — a menu. Its verbs act on THIS BOX'S OWN CONNECTIONS
-// (stop the daemon here, leave the project's list in the app, forget the
-// credential here) and never on another computer's daemon; machines.mjs
-// carries the argument.
-//
-// The question is the owner's, verbatim: "is there a way to view ALL the
-// connected flowviants? because im not sure if i have any duplicate or
-// redundant daemons running". It needs the NETWORK, unlike `projects` next
-// door, because the boxes are the server's answer — this box cannot see a
-// daemon running on somebody else's computer, and guessing would be worse than
-// asking.
-//
-// ONE CALL PER STORED CREDENTIAL, because the CLI has NO PERSON IDENTITY: every
-// request it can make is `Bearer <machine token>`, so "all my machines" has to
-// be assembled from the credentials this box holds. That is also the limit the
-// footer states out loud — the app's Home is where the whole account's answer
-// lives.
-//
-// EXIT 0 whatever it finds, including nothing: the listing is the answer the
-// asker came for, and a non-zero code over "you have no projects connected"
-// would make this command unusable in anything that checks one. `--remove`
-// is the one exit that can be 1, when the daemon it had to stop would not.
-if (process.argv[2] === 'machines') {
-  const creds = await import('./lib/credentials.mjs');
-  const machineJson = process.argv.includes('--json');
-  const forgetAt = process.argv.indexOf('--forget');
-  if (forgetAt >= 0) {
-    if (machineJson && !process.argv.includes('--yes')) {
-      process.stdout.write(`${JSON.stringify({ ok: false, error: '--yes is required with --json' })}\n`);
-      process.exit(1);
-    }
-    // THE LOCAL-ONLY WRITE. Named explicitly, matched by full id or a ≥6
-    // prefix, and AMBIGUITY REFUSES rather than guessing — this deletes a
-    // credential, and two projects that look alike is the case that produced
-    // the command.
-    const res = creds.forgetStoredProject(process.argv[forgetAt + 1]);
-    if (res.error) {
-      if (machineJson) { process.stdout.write(`${JSON.stringify({ ok: false, error: res.error })}\n`); process.exit(1); }
-      console.error(`error: ${res.error}`);
-      process.exit(1);
-    }
-    if (machineJson) { process.stdout.write(`${JSON.stringify({ ok: true, action: 'forget', projectId: res.entry.projectId })}\n`); process.exit(0); }
-    console.log(
-      `forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box.\n` +
-        `  Nothing was stopped or deleted anywhere else — \`${terminalCommand('login')}\` connects it again.`
-    );
-    process.exit(0);
-  }
-  const { boxesUrlFrom, leaveUrlFrom, fetchBoxesFor, renderMachines, disconnectHere, realDisconnectDeps, MACHINES_FOOTER, MACHINES_FLAGS_FOOTER } =
-    await import('./lib/machines.mjs');
-  const { FLEET_URL } = await import('./lib/config.mjs');
-  const removeAt = process.argv.indexOf('--remove');
-  if (removeAt >= 0) {
-    if (machineJson && !process.argv.includes('--yes')) {
-      process.stdout.write(`${JSON.stringify({ ok: false, error: '--yes is required with --json' })}\n`);
-      process.exit(1);
-    }
-    // THE SCRIPTED DISCONNECT — the menu's first verb, named by id for a
-    // terminal nobody is sitting at. Same matcher and the same refusal of an
-    // ambiguous prefix as --forget: a name two projects share is exactly the
-    // input this command exists to untangle, and it must not pick one.
-    const m = creds.matchStoredProject(process.argv[removeAt + 1]);
-    if (m.error) {
-      if (machineJson) { process.stdout.write(`${JSON.stringify({ ok: false, error: m.error })}\n`); process.exit(1); }
-      console.error(`error: ${m.error}. \`${terminalCommand('machines')}\` lists what is stored.`);
-      process.exit(1);
-    }
-    const res = await disconnectHere(m.entry, await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL), log: machineJson ? () => {} : undefined }), { log: machineJson ? () => {} : undefined });
-    if (machineJson) process.stdout.write(`${JSON.stringify({ ok: res.ok, action: 'disconnect', projectId: m.entry.projectId })}\n`);
-    process.exit(res.ok ? 0 : 1);
-  }
-
-  let entries = creds.listStoredProjects();
-  if (entries.length === 0) {
-    console.log(`no projects connected on this machine yet — run \`${terminalCommand('login')}\` inside a repo.`);
-    process.exit(0);
-  }
-  // OUR OWN BOX ID, so the listing can mark "← this box".
-  //
-  // READ, NEVER CREATED. This called `ensureKeypair()` until 2026-09-19, which
-  // MINTS a keypair when there is no file — a 0600 write establishing this
-  // machine's durable identity, performed by a command whose entire job is to
-  // print a list. A view-only command is what let a third terminal command
-  // exist at all, and enrolling a box as a side effect of looking at one is not
-  // that. `readStoredPubB64` reads or answers null.
-  //
-  // NULL COSTS ONLY THE MARK, and that is the honest outcome: a box that has
-  // never run a daemon has never polled, so it is not in this listing to be
-  // marked in the first place.
-  let me;
-  try {
-    const env = await import('./lib/env.mjs');
-    me = env.readStoredPubB64() ?? undefined;
-  } catch {
-    /* unreadable keypair — nothing is marked, and nothing is claimed */
-  }
-  const url = boxesUrlFrom(FLEET_URL);
-  const listing = async () => {
-    const results = {};
-    // SEQUENTIAL, not a fan-out: this is a handful of credentials on somebody's
-    // laptop, and a parallel burst against the API buys nothing a person
-    // waiting two seconds can perceive.
-    for (const e of entries) {
-      results[e.projectId] = await fetchBoxesFor(e, { url, envpub: me });
-    }
-    console.log('');
-    for (const line of renderMachines(entries, results)) console.log(line);
-    console.log('');
-  };
-  await listing();
-
-  // THE MENU, only where a person can drive one. `canPrompt()` is the same
-  // gate the start path keeps — a backgrounded job or a pipe gets the listing
-  // and the flags, never a prompt that stops the process — and `menuSupported`
-  // is whether ↑/↓ can be read at all. Without both this is the command it was.
-  const { canPrompt, menuSupported, selectMenu, askWithTimeout } = await import('./lib/tty.mjs');
-  if (!(canPrompt() && menuSupported())) {
-    for (const line of MACHINES_FOOTER) console.log(line);
-    for (const line of MACHINES_FLAGS_FOOTER) console.log(line);
-    process.exit(0);
-  }
-  const deps = await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL) });
-  for (;;) {
-    // A ROW PER PROJECT connected on this box — the things this box can act on.
-    // The other computers under each project are printed above for the
-    // duplicate to be visible, and are not rows here: stopping or removing
-    // THEM is the app's verb, and a menu row that answers "not from here" is
-    // a control wired to a refusal.
-    console.log('  projects connected on this box — enter one for what you can do about it:');
-    const rowLabel = (e) => creds.projectRowLabel(e, entries) + (e.repoRoot ? `  — ${e.repoRoot}` : '  — not tied to a repo');
-    const pick = await selectMenu({ options: [...entries.map(rowLabel), 'done'] });
-    if (pick.cancelled || pick.unsupported || pick.index === entries.length) break;
-    const picked = entries[pick.index];
-    const who = creds.projectRowLabel(picked, entries);
-    // TWO VERBS, each row saying its whole consequence — the app's ⋯ menu on a
-    // machine row says the same two things, and a menu whose rows are verbs
-    // with the outcome in a manual somewhere is one you have to be sure about
-    // before you can use it.
-    const action = await selectMenu({
-      options: [
-        `disconnect this box from ${who} — stops its daemon here, removes this box from its machines list in the app, forgets its credential here`,
-        `forget ${who} here only — nothing is stopped; the app keeps listing this box until it goes quiet`,
-        'back',
-      ],
-    });
-    if (action.cancelled || action.unsupported || action.index === 2) continue;
-    // ONE CONFIRM, in words, because both verbs delete a credential and the
-    // arrow keys make a slip cheap. A read that failed (stdin gone) is "no".
-    const verb = action.index === 0 ? 'Disconnect this box from' : 'Forget';
-    const answer = await askWithTimeout(`  ${verb} ${who}? [y/N] `);
-    if (!/^y(es)?$/i.test(answer ?? '')) {
-      console.log('  left as it was.\n');
-      continue;
-    }
-    if (action.index === 0) {
-      await disconnectHere(picked, deps, { log: (m) => console.log(`  ${m}`) });
-    } else {
-      const res = creds.forgetStoredProject(picked.projectId);
-      console.log(
-        res.error
-          ? `  ${res.error}`
-          : `  forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box. Nothing was stopped or deleted anywhere else — \`${terminalCommand('login')}\` connects it again.`
-      );
-    }
-    entries = creds.listStoredProjects();
-    if (entries.length === 0) {
-      console.log('\n  no projects are connected on this box now.\n');
-      break;
-    }
-    // THE LISTING AGAIN, re-asked: the server's rows are the only true account
-    // of what the leave did, and a menu redrawn over a stale listing would be
-    // this command asserting the outcome it hoped for.
-    await listing();
-  }
-  for (const line of MACHINES_FOOTER) console.log(line);
-  process.exit(0);
+// `flowviant machines` — every project connected on THIS box, every box that
+// has polled each of them, and on a terminal a menu over them. The command's
+// body and its argument live in machinesCommand.mjs.
+async function machinesCommand() {
+  const { runMachinesCommand } = await import('./lib/machinesCommand.mjs');
+  await runMachinesCommand();
 }
 
 // `flowviant env <import|set|show>` IS DELETED (2026-09-21), with the
@@ -550,12 +374,41 @@ if (process.argv[2] === 'machines') {
 // the terminal. Mints a `cli` credential: a separate principal from the
 // per-session tokens, with only the management tools and no way to work or ship
 // a card.
-if (process.argv[2] === 'mcp') {
+async function mcpCommand() {
   const { runMcpCommand } = await import('./lib/mcp-cli.mjs');
   await runMcpCommand(process.argv.slice(3));
   process.exit(0);
 }
 
+// ── DISPATCH: one handler per row of the command table (commandSpecs.mjs).
+// `version` and `help` were answered above and `start` is everything below;
+// help.test.mjs pins that every other row has exactly one handler here.
+const HANDLERS = {
+  login: loginCommand,
+  status: statusCommand,
+  logs: logsCommand,
+  open: openCommand,
+  doctor: doctorCommand,
+  update: updateCommand,
+  'gh-auth': ghAuthCommand,
+  clean: cleanCommand,
+  shot: shotCommand,
+  stop: stopCommand,
+  uninstall: uninstallCommand,
+  projects: projectsCommand,
+  machines: machinesCommand,
+  mcp: mcpCommand,
+};
+{
+  const handler = HANDLERS[findCommand(process.argv[2])?.name];
+  if (handler) {
+    await handler();
+    // Every handler exits on its own; a command never falls through into
+    // starting the daemon.
+    process.exit(0);
+  }
+}
+
 // A WORD THAT IS NOT A COMMAND IS REFUSED, not served. Every word used to fall
 // through to here, so `flowviant hlep` started the daemon. Flags still reach
 // the start path (`--project`, `--dir`, `--json-events`, …).
@@ -569,255 +422,15 @@ if (process.argv[2] && !process.argv[2].startsWith('-')) {
 // this through `wsl.exe --`, which reads no shell startup file (loginPath.mjs).
 await (await import('./lib/loginPath.mjs')).adoptLoginPathForProcess();
 
-// ── WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
-//
-// The store holds many projects since 0.55.0 and resolution is BY REPO
-// (credentials.mjs). What is left here is the human half: an ambiguous store
-// on a TTY becomes a PICKER, a single unbound credential gets ONE confirm that
-// binds it, and a headless start with no unambiguous answer refuses in words
-// that name every stored project and every way out. The one thing this block
-// must never do is serve a project the resolution did not name — "it said
-// skadooble in my calendar repo" is the confusion this exists to end.
-// A RESTART IS NOT A PERSON. `reexec` (update.mjs) inherits stdio, so an
-// auto-updated daemon's child sees two TTYs; without this it would stop on the
-// binding confirm below and the machine would stay dark until somebody typed a
-// key. Same reasoning as the headless case, and the same answer.
-// `canPrompt()`, not a bare isTTY pair: a BACKGROUNDED job (`flowviant &`) has
-// two TTYs and cannot be asked anything — the first read raises SIGTTIN and the
-// kernel STOPS the process, which is why 0.55.2's timeout did not save it (a
-// stopped process runs no timers). See tty.mjs.
-const { canPrompt, askWithTimeout, selectMenu, menuSupported } = await import('./lib/tty.mjs');
-const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
-
-/** NO ANSWER TIME LIMIT on the start path (2026-09-20, the owner: "why is
- *  there an answer time limit, remove that"). The confirm below carried 20s
- *  and the picker 60s, each arguing that a restart nobody is watching must
- *  not sit dark on a prompt — but `interactive` already excludes exactly that
- *  case (no foreground terminal, or a self-update re-exec, and nothing is
- *  asked). What was left was a person reading a list being told "no answer
- *  in 60s — nothing started". A prompt a person can see waits for the
- *  person; tty.mjs's header carries the argument. */
-const externalToken =
-  process.argv.includes('--fleet') ||
-  Boolean(process.env.FLOWVIANT_MACHINE_TOKEN) ||
-  Boolean(process.env.FLOWVIANT_FLEET);
-
-/** Re-exec a plain `flowviant` after an inline login — the login command's own
- *  pattern: config.mjs read the store at IMPORT time, before the credential
- *  existed, so this process cannot serve; the child can. */
-async function reexecAfterLogin() {
-  const login = await runLogin({ thenStart: false });
-  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
-  const { spawn } = await import('node:child_process');
-  const child = spawn(process.execPath, process.argv[1]?.startsWith('/$bunfs/') ? [] : [process.argv[1]], { stdio: 'inherit', env: process.env });
-  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
-}
-
-// TWO ROWS THAT READ ALIKE ARE NOT A CHOICE. `projectRowLabel` adds the id and
-// the connected date to the COLLIDING rows only — production held two projects
-// both called "BRIF AI", both bound to the same checkout, so this picker
-// offered two identical lines and the only way to answer was to guess. See
-// credentials.mjs for why the suffix is not on every row. (That exact case is
-// a refusal now rather than a picker — a directory serves one project — but
-// two same-named projects can still meet in the no-match picker.)
-function listLines(entries, { projectRowLabel }) {
-  return entries
-    .map(
-      (e, i) =>
-        `  ${i + 1}. ${projectRowLabel(e, entries)}` +
-        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet')
-    )
-    .join('\n');
-}
-
-/** A repo binding the person just consented to, persisted by runFleetDaemon
- *  only after the instance lock is taken — never before a refusal. */
-let afterLock = null;
-
-if (!FLEET_TOKEN) {
-  if (CREDENTIAL.error) {
-    console.error(`error: ${CREDENTIAL.error}. \`${terminalCommand('projects')}\` lists what is stored.`);
-    process.exit(1);
-  }
-  // A DIRECTORY SERVES ONE PROJECT (2026-09-23, the owner, verbatim: "a
-  // directory cannot have more than one project on flowviant. if one already
-  // exists, it would warn the user and ask them to delete the project on
-  // flowviant first. because 2 projects shouldnt be able to edit a directory
-  // at the same time."). This used to be a PICKER — two projects bound to one
-  // checkout, choose which this daemon serves — which is a control offering to
-  // do the forbidden thing politely. It is a refusal now, on a TTY and
-  // headless alike, naming both projects and the remedy. `credentialRefusal`
-  // is the same sentence login prints when it declines to bind a second one.
-  if (CREDENTIAL.reason === 'multiple-bound') {
-    const { directoryTakenRefusal } = await import('./lib/credentials.mjs');
-    console.error(directoryTakenRefusal(CREDENTIAL.choices, CREDENTIAL.repoRoot));
-    process.exit(1);
-  }
-  if (CREDENTIAL.choices?.length && interactive) {
-    const creds = await import('./lib/credentials.mjs');
-    const { originSlug } = await import('./lib/git.mjs');
-    const { basename } = await import('node:path');
-    const { choices, repoRoot } = CREDENTIAL;
-    console.log(
-      CREDENTIAL.reason === 'outside-repo'
-        ? 'flowviant is not inside a git repo, and more than one project is connected here.'
-        : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
-    );
-
-    const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (${terminalCommand('login')})`;
-    // WHICH ONE LOOKS RIGHT — a pre-selection, never an auto-serve. The resolver
-    // refuses to serve a project the repo PATH did not name (the skadooble law);
-    // this only decides which row the cursor starts on, using the repo's folder
-    // name and its github repo-name against the stored project names. A unique
-    // match becomes ONE keypress; a wrong guess costs nothing, because the human
-    // still confirms. (Two projects bound to THIS repo never reach here: that
-    // is a refusal above, since 2026-09-23.)
-    const slug = repoRoot ? originSlug(repoRoot) : null;
-    const likely = creds.likelyChoiceIndex(choices, {
-      repoBasename: repoRoot ? basename(repoRoot) : null,
-      repoSlugName: slug ? slug.split('/')[1] : null,
-    });
-
-    // Bounded like the confirm below, and for the same reason — but silence
-    // means something DIFFERENT here and the difference is load-bearing. There
-    // is a real ambiguity to resolve; serving a guess is the skadooble bug.
-    // So no answer REFUSES, which is exactly what this branch already does
-    // headless, and the message says how to answer without being present.
-    let chosen = null; // 0-based into [...choices, login]
-    if (menuSupported()) {
-      const rowLabel = (e) =>
-        creds.projectRowLabel(e, choices) +
-        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet');
-      const options = [...choices.map(rowLabel), loginLabel];
-      // Say WHY the cursor starts where it does — "intuitive" made visible.
-      if (likely >= 0) options[likely] += '   ← looks like this repo';
-      const res = await selectMenu({
-        options,
-        defaultIndex: likely >= 0 ? likely : 0,
-      });
-      if (res.cancelled) {
-        console.error('nothing chosen — nothing started.');
-        process.exit(1);
-      }
-      if (!res.unsupported) chosen = res.index;
-    }
-    if (chosen === null) {
-      // Numeric fallback — a pipe, or a terminal without raw mode. Empty Enter
-      // takes the likely default when there is one, so it is one keystroke here
-      // too.
-      console.log(listLines(choices, creds));
-      console.log(`  ${choices.length + 1}. ${loginLabel}`);
-      const hint = likely >= 0 ? ` (enter for ${creds.projectLabel(choices[likely])})` : '';
-      const raw = await askWithTimeout(
-        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `
-      );
-      if (raw === null) {
-        // The read itself failed — stdin closed, or the terminal went away
-        // mid-question. Not a timeout: there is none.
-        console.error(
-          `\ncould not read an answer — nothing started. ` +
-            `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
-        );
-        process.exit(1);
-      }
-      const n = raw === '' && likely >= 0 ? likely + 1 : Number.parseInt(raw, 10);
-      chosen = Number.isInteger(n) ? n - 1 : -1;
-    }
-
-    if (chosen === choices.length) await reexecAfterLogin();
-    const picked = chosen >= 0 ? choices[chosen] : undefined;
-    if (!picked) {
-      console.error('nothing chosen — nothing started.');
-      process.exit(1);
-    }
-    // An answered question is consent: adopt it, and BIND it to this repo so
-    // the next start needs no prompt. Repointing is legitimate and said aloud.
-    if (repoRoot && picked.repoRoot && picked.repoRoot !== repoRoot) {
-      console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
-    }
-    adoptStoredCredential(picked);
-    // BOUND ONLY ONCE THE START HAS THE LOCK. Written here, the answer moved
-    // the binding even when the instance lock then refused the start — a live
-    // daemon for the same project in its own checkout — and that daemon's next
-    // unattended self-update re-exec'd into a store that no longer bound its
-    // repo, found no match headless, and exited with the machine dark.
-    afterLock = () => creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
-    console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
-  } else if (CREDENTIAL.choices?.length) {
-    const creds = await import('./lib/credentials.mjs');
-    console.error(
-      'error: more than one project is connected on this machine and this repo is not bound to any of them:\n' +
-        listLines(CREDENTIAL.choices, creds) +
-        `\nPick one with \`--project <name|id>\`, bind this repo by running \`${terminalCommand()}\` here in a terminal once,\n` +
-        `or connect this repo to its own project with \`${terminalCommand('login')}\`.`
-    );
-    process.exit(1);
-  } else {
-    console.error(
-      'error: no credential found. Easiest:\n' +
-        `  ${terminalCommand('login')}      (approve in the app — recommended)\n` +
-        'Or set:\n' +
-        '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
-    );
-    process.exit(1);
-  }
-} else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
-  // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
-  // yes binds and every later start is silent. This is the exact question
-  // whose absence had a calendar checkout serving skadooble.
-  //
-  // AND IT TIMES OUT, because a prompt on a start path is a way for a machine
-  // to go dark. `FLOWVIANT_REEXEC` above covers the restart THIS version
-  // performs, but it cannot cover the one that matters most: the hop that
-  // installs a fixed daemon is spawned by the OLD one, which never sets it.
-  // 0.55.0 → 0.55.1 was exactly that — an auto-update landing unattended would
-  // stop here with the machine serving nothing. A guard that only works once
-  // everyone already has it is not a guard.
-  //
-  // IF THE READ FAILS WE SERVE, AND WE DO NOT BIND. (This used to say "on
-  // timeout"; there is no timeout since 2026-09-20 — a person at the prompt
-  // is waited for. `null` now means stdin closed under the question.) Those
-  // are two decisions:
-  //  · SERVE, because it is what every version before 0.55.0 did with this
-  //    exact store, so the silent path is the status quo rather than a new
-  //    risk — and a daemon that answers is strictly better than one that does
-  //    not, which is the whole reason this product has exactly one refusal.
-  //  · DO NOT BIND, because binding is the thing the question was FOR. Nobody
-  //    answered, so nothing is cemented; the next human start asks again. That
-  //    keeps the skadooble case fixed for the person who is actually looking,
-  //    which is the only person it could ever have been fixed for.
-  const creds = await import('./lib/credentials.mjs');
-  const label = creds.projectLabel(CREDENTIAL.entry);
-  const answered = await askWithTimeout(
-    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `
-  );
-  const raw = answered === null ? null : answered.toLowerCase(); // null = the read failed
-  if (raw === null) {
-    console.log(
-      `\n  could not read an answer — serving ${label} for this run ` +
-        `without tying it to this repo. Run \`${terminalCommand()}\` here and answer to make it stick.`
-    );
-  } else if (raw === '' || raw === 'y' || raw === 'yes') {
-    // After the lock, for the reason the picker's bind gives above.
-    afterLock = () => creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
-  } else {
-    console.error(
-      `nothing started. Connect this repo to its own project with \`${terminalCommand('login')}\`, ` +
-        `or see what is stored with \`${terminalCommand('projects')}\`.`
-    );
-    process.exit(1);
-  }
-}
-
-if (process.argv.includes('--json-events') && dirAt >= 0 && CREDENTIAL?.entry) {
-  const { detectRepoRoot, listStoredProjects, boundElsewhere } = await import('./lib/credentials.mjs');
-  const repo = detectRepoRoot();
-  const entry = CREDENTIAL.entry;
-  if (!repo || entry.repoRoot !== repo || boundElsewhere(listStoredProjects(), repo, entry.projectId).length) {
-    console.error('error: this project is not connected to this repository. Run `flowviant login` for the selected folder.');
-    process.exit(1);
-  }
-}
-const { installDaemonLogging } = await import('./lib/desktopContract.mjs');
-installDaemonLogging(CREDENTIAL?.entry?.projectId, { jsonEvents: process.argv.includes('--json-events') });
+// WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
+// startProject.mjs owns the picker, the one binding confirm and the refusals;
+// what it hands back is the binding the person consented to, deferred until
+// runFleetDaemon holds the instance lock (a refused start moves nothing).
+const { resolveStartProject } = await import('./lib/startProject.mjs');
+const afterLock = await resolveStartProject({ dirGiven: dirAt >= 0 });
+
+const { installDaemonLogging } = await import('./lib/daemonLogging.mjs');
+const { daemonLogPath } = await import('./lib/daemonState.mjs');
+const logProjectId = CREDENTIAL?.entry?.projectId;
+installDaemonLogging(logProjectId ? daemonLogPath(logProjectId) : null, { jsonEvents: process.argv.includes('--json-events') });
 await runFleetDaemon({ afterLock });