flowviant 0.115.0 → 0.117.0

package/bin/lib/workPreviews.mjs

@@ -1,10 +1,11 @@
 /** Session preview claims, tunnels, and retirement. */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { isSafePathSegment } from './git.mjs';
 import { originFor as measuredOrigin } from './listeners.mjs';
 import { openTunnel as openLiveTunnel } from './preview.mjs';
 import { note } from './ui.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, settleLease } from './fleetPost.mjs';
 
 /** `originFor` and `openTunnel` are injectable only so the lane can be driven
  *  without a dev server or cloudflared (workPreviews.test.mjs); work.mjs passes
@@ -19,7 +20,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // generated password, on a quick tunnel. This daemon never starts an app: the
   // deleted live-preview feature ran a repo-declared command through a shell,
   // and that is the reason it is deleted. Here the human runs their own server,
-  // `listenersIn` notices it, and this only ever wraps a port that measurement
+  // `measureListeners` notices it, and this only ever wraps a port that measurement
   // already named for that session.
   //
   // CLAIM BEFORE ACTING. Two daemons legitimately share one fleet credential —
@@ -35,47 +36,26 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // Returns the parsed JSON (or null on any failure) rather than discarding
   // it — an OPEN settle's caller needs to see `data.settled === false`, the
   // sharper share-id check on the server's side of a re-share racing the
-  // open's own round trip (see the openTunnel call site below).
-  const postPreview = async (body) => {
-    try {
-      const res = await fetch(PREVIEW_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
-      });
-      return await res.json().catch(() => null);
-    } catch {
-      /* the row stops being confirmed and reads as ended — which is true */
-      return null;
-    }
-  };
+  // open's own round trip (see the openTunnel call site below). On a failure
+  // the row stops being confirmed and reads as ended — which is true.
+  const postPreview = (body) => settleLease(PREVIEW_DONE_URL, body, { timeoutMs: 30_000 });
 
   // `shareId` is the share the daemon was OFFERED, echoed off the job. A
   // re-share inside the claim's round trip rotates the id server-side, so a
   // claim naming the old one matches nothing and this daemon opens no tunnel
   // for a request that no longer exists. Absent-safe: an older server that
   // does not read the field just claims on the place alone, the old rule.
-  const claimPreview = async (sessionId, shareId) => {
+  // Could not claim → do nothing at all. The other daemon may have.
+  const claimPreview = (sessionId, shareId) =>
+    claimFleetLease(PREVIEW_CLAIM_URL, { sessionId, ...(shareId ? { shareId } : {}) });
+
+  /** Stop a tunnel (a live entry or an open's result) without letting its
+   *  teardown throw into the lane: the stop is best-effort everywhere. */
+  const stopQuietly = (live) => {
     try {
-      const res = await fetch(PREVIEW_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ sessionId, instance: DAEMON_INSTANCE, ...(shareId ? { shareId } : {}) }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
+      live?.stop();
     } catch {
-      return false; // could not claim → do nothing at all. The other daemon may have.
+      /* best-effort */
     }
   };
 
@@ -85,13 +65,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   const stopPreview = async (sessionId, reason) => {
     const live = livePreviews.get(sessionId);
     livePreviews.delete(sessionId);
-    if (live) {
-      try {
-        live.stop();
-      } catch {
-        /* best-effort */
-      }
-    }
+    stopQuietly(live);
     // Confirm only a teardown we actually PERFORMED. The stop job is a
     // broadcast — every daemon on the credential gets it — and the one holding
     // nothing used to answer instantly, flipping the row to 'ended' so the
@@ -115,6 +89,15 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
       });
   };
 
+  /** One teardown per session at a time: a session mid-claim (an open or
+   *  another stop on its way) is left to that claim, and the next tick asks
+   *  again. The stop job and a closed tab share this guard. */
+  const stopOnce = (sessionId, reason) => {
+    if (previewClaiming.has(sessionId)) return;
+    previewClaiming.add(sessionId);
+    void stopPreview(sessionId, reason).finally(() => previewClaiming.delete(sessionId));
+  };
+
   const processPreviewJobs = (jobs) => {
     if (!Array.isArray(jobs) || jobs.length === 0) return;
     for (const job of jobs.slice(0, 5)) {
@@ -123,9 +106,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
       if (!isSafePathSegment(sessionId)) continue;
 
       if (job?.action === 'stop') {
-        if (previewClaiming.has(sessionId)) continue;
-        previewClaiming.add(sessionId);
-        void stopPreview(sessionId, 'stopped').finally(() => previewClaiming.delete(sessionId));
+        stopOnce(sessionId, 'stopped');
         continue;
       }
 
@@ -171,6 +152,13 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
       if (previewClaiming.has(sessionId)) continue;
       previewClaiming.add(sessionId);
 
+      // EVERY report about this job's share names the share (F017,
+      // 2026-09-26): an un-scoped `ended` or `error` could end a replacement
+      // share opened on the same session in the meantime. One spelling, so a
+      // new teardown callback cannot forget it (audit 2026-10-10, F162).
+      // Absent when the job carried none (an older server), the old rule.
+      const settleShare = (body) => postPreview({ sessionId, ...body, ...(shareId ? { shareId } : {}) });
+
       void (async () => {
         try {
           if (!(await claimPreview(sessionId, shareId))) return; // somebody else has it
@@ -188,21 +176,13 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
           // machine never measured. A wire string, not a field — no floor.
           const refusal = originFor(wt, port).error;
           if (refusal) {
-            await postPreview({
-              sessionId,
-              error: refusal,
-              ...(shareId ? { shareId } : {}),
-            });
+            await settleShare({ error: refusal });
             return;
           }
           // Replace anything this session already had — one tab, one door.
           const prev = livePreviews.get(sessionId);
           if (prev) {
-            try {
-              prev.stop();
-            } catch {
-              /* best-effort */
-            }
+            stopQuietly(prev);
             livePreviews.delete(sessionId);
           }
           const t = await openTunnel({
@@ -218,12 +198,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
             // without this the app would print "live" over a 502.
             onDead: () => {
               livePreviews.delete(sessionId);
-              void postPreview({
-                sessionId,
-                ended: true,
-                endedReason: 'origin_gone',
-                ...(shareId ? { shareId } : {}),
-              });
+              void settleShare({ ended: true, endedReason: 'origin_gone' });
             },
             // ATTRIBUTION rides the probe, not just the open: a freed default
             // port (5173…) rebound by any other process on the box would keep
@@ -236,38 +211,27 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
             // owner can re-share the port without restarting the daemon.
             onAbuse: () => {
               livePreviews.delete(sessionId);
-              void postPreview({
-                sessionId,
-                ended: true,
-                endedReason: 'abuse',
-                ...(shareId ? { shareId } : {}),
-              });
+              void settleShare({ ended: true, endedReason: 'abuse' });
             },
             // cloudflared died AFTER publishing (quick tunnels get dropped).
             // Without this the daemon kept heartbeating a hostname that 530s.
             onTunnelGone: () => {
               livePreviews.delete(sessionId);
-              void postPreview({
-                sessionId,
-                error: 'the tunnel dropped — share it again to reopen.',
-                ...(shareId ? { shareId } : {}),
-              });
+              void settleShare({ error: 'the tunnel dropped — share it again to reopen.' });
             },
           });
           if (t.error) {
-            await postPreview({ sessionId, error: t.error, ...(shareId ? { shareId } : {}) });
+            await settleShare({ error: t.error });
             return;
           }
           livePreviews.set(sessionId, { port, shareId, url: t.url, stop: t.stop });
           // The gate we ACTUALLY installed, so the app never asserts a door
           // nobody observed. An older server ignores the field.
-          const settled = await postPreview({
-            sessionId,
+          const settled = await settleShare({
             url: t.url,
             user: t.user,
             password: t.password,
             gate: t.gateMode,
-            ...(shareId ? { shareId } : {}),
           });
           // A re-share (or a Stop) can land inside this open's own round
           // trip and rotate the share id server-side — the settle is then
@@ -279,11 +243,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
           // settle for an older one).
           if (settled?.data?.settled === false) {
             if (livePreviews.get(sessionId)?.stop === t.stop) livePreviews.delete(sessionId);
-            try {
-              t.stop();
-            } catch {
-              /* best-effort */
-            }
+            stopQuietly(t);
           }
         } finally {
           previewClaiming.delete(sessionId);
@@ -292,26 +252,6 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
     }
   };
 
-  /** The sessionIds this machine is still serving — sent on the poll so the
-   *  server can tell a live share from one whose machine went away. Silence
-   *  must never read as "live". */
-  /**
-   * The daemon's own shape check on an argv the server parsed.
-   *
-   * Deliberately a SHAPE check and not a re-parse: the server owns the policy
-   * (which argv[0] are allowed, the install refusal, the length caps) and the
-   * machine owns the refusal to EXECUTE something malformed. It is duplicated
-   * rather than imported because this package ships standalone and cannot
-   * depend on the monorepo — the mirror is small, and `devCommand.ts` is where
-   * the real rules live.
-   */
-  const isPlausibleDevArgv = (argv) =>
-    Array.isArray(argv) &&
-    argv.length > 0 &&
-    argv.length <= 8 &&
-    argv.every((a) => typeof a === 'string' && a.length > 0 && a.length <= 200) &&
-    !argv.some((a) => /[&|;<>`$(){}*?~\\]/.test(a));
-
   // ── DEV RUNS ARE DELETED (2026-08-26) ─────────────────────────────────
   //
   // The machine no longer starts application processes. It never learned to
@@ -321,7 +261,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // per ecosystem forever.
   //
   // Nothing downstream is lost, because SHARING NEVER DEPENDED ON US STARTING
-  // IT. `listenersIn` attributes a listening socket to a place by the cwd of
+  // IT. `measureListeners` attributes a listening socket to a place by the cwd of
   // the process holding it, so a server the driver's own agent started in the
   // tab is measured exactly like one this file used to spawn. The web renders
   // that measured list and a person picks which port to share.
@@ -331,6 +271,9 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // and its adopt-across-re-exec dance. If supervision is ever wanted back it
   // returns as "supervise this process", never as "run dev".
 
+  /** The sessionIds this machine is still serving — sent on the poll so the
+   *  server can tell a live share from one whose machine went away. Silence
+   *  must never read as "live". */
   const livePreviewIds = () => [...livePreviews.keys()];
 
   /**
@@ -349,9 +292,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
     const live = new Set(activeIds);
     for (const sessionId of [...livePreviews.keys()]) {
       if (live.has(sessionId)) continue;
-      if (previewClaiming.has(sessionId)) continue;
-      previewClaiming.add(sessionId);
-      void stopPreview(sessionId, 'tab_closed').finally(() => previewClaiming.delete(sessionId));
+      stopOnce(sessionId, 'tab_closed');
     }
   };
 
@@ -359,13 +300,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
    *  them would strand a public hostname until the box rebooted — the exact
    *  case `reapOrphanPreviews` exists to clean up after an UNgraceful death. */
   const shutdownPreviews = () => {
-    for (const [, live] of livePreviews) {
-      try {
-        live.stop();
-      } catch {
-        /* best-effort */
-      }
-    }
+    for (const [, live] of livePreviews) stopQuietly(live);
     livePreviews.clear();
   };
 

package/bin/lib/workProcesses.mjs

@@ -1,10 +1,11 @@
 /** Claims and execution for stopping a measured session process. */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { isSafePathSegment } from './git.mjs';
 import { measureListeners } from './listeners.mjs';
 import { measureProcesses, liveGroups, processesSupported } from './processes.mjs';
 import { processAlive } from './procRegistry.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, settleLease } from './fleetPost.mjs';
 
 export function createWorkProcesses({ placeDir, reportPlaceWorktrees, sessionGroups }) {
   const KILL_DONE_URL = fleetEndpoint('kill-done', FLEET_URL);
@@ -47,41 +48,13 @@ export function createWorkProcesses({ placeDir, reportPlaceWorktrees, sessionGro
   // is the failure this whole comment is about.
   const killing = new Set(); // job ids in flight on this tick
 
-  const postKill = async (body) => {
-    try {
-      await fetch(KILL_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
-      });
-    } catch {
-      /* unsettled, and the server expires it — the asker is told, never spun */
-    }
-  };
+  // Unsettled on any failure, and the server expires it — the asker is told,
+  // never spun.
+  const postKill = (body) => settleLease(KILL_DONE_URL, body, { timeoutMs: 30_000 });
 
-  const claimKill = async (id) => {
-    try {
-      const res = await fetch(KILL_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
-    } catch {
-      return false; // the peer may hold it; doing nothing is the safe answer
-    }
-  };
+  // Could not claim → do nothing: the peer may hold it (fleetPost.mjs's
+  // `claimFleetLease`, the one double-run guard).
+  const claimKill = (id) => claimFleetLease(KILL_CLAIM_URL, { id });
 
   /**
    * Is this pid, RIGHT NOW, one of the things we told the browser about for

package/bin/lib/workPullRequests.mjs

@@ -8,25 +8,26 @@
  * shared with the agent approve path.
  */
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
-import { git, gitNet as gitNetIn, baseBranchName, isSafePathSegment } from './git.mjs';
+import { FLEET_URL } from './config.mjs';
+import { git, gitNet as gitNetIn, baseBranchName, isSafePathSegment, sessionBranch } from './git.mjs';
 import {
   ensureOpenPr,
   findOpenPr,
-  ghFirstLine,
   ghReady,
   mergeAndVerifyTip,
   PR_URL_RE,
   prTargetsOtherBase,
+  relayedFailure,
 } from './prWorkflow.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, settleLease } from './fleetPost.mjs';
 import { REPO_PLACE } from './workPlaces.mjs';
 
 export function createWorkPullRequests({
   placeOf,
+  placeDir,
+  branchAt,
   repoRoot,
-  baseDir,
   baseRef,
   gitNet,
   landed,
@@ -43,40 +44,11 @@ export function createWorkPullRequests({
   // one branch would open two PRs. NOTHING here closes a card — done is
   // observed by the landed walk when the merge reaches base.
   const prWorking = new Set();
-  const claimPr = async (id) => {
-    try {
-      const res = await fetch(PR_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
-    } catch {
-      return false; // could not claim → do nothing. The other daemon may have.
-    }
-  };
-  const settlePr = async (body) => {
-    try {
-      await fetch(PR_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(20_000),
-        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
-      });
-    } catch {
-      /* the row expires into an honest no_answer; the re-request is the retry */
-    }
-  };
+  // Could not claim → do nothing. The other daemon may have.
+  const claimPr = (id) => claimFleetLease(PR_CLAIM_URL, { id });
+  // Twenty seconds, this lane's own ceiling; on any failure the row expires
+  // into an honest no_answer and the re-request is the retry.
+  const settlePr = (body) => settleLease(PR_DONE_URL, body, { timeoutMs: 20_000 });
   const runPrJob = async (job) => {
     const id = String(job.id);
     if (!(await claimPr(id))) return;
@@ -97,20 +69,17 @@ export function createWorkPullRequests({
       return;
     }
     // The branch is whatever the session's own worktree HEAD says — the same
-    // resolution ship uses, for the same reason (the branch is where the
-    // driver left it, not where we put it).
+    // resolution ship uses (`branchAt`, workPlaces.mjs), for the same reason
+    // (the branch is where the driver left it, not where we put it). A place
+    // whose directory is gone falls back to the branch that place was CUT on,
+    // `session/<place>` — a person's `u-` place lives on `session/u-<id>`,
+    // never on `session/<this tab's id>` (audit 2026-10-10, F168).
+    // (The checkout always exists, so its fallback is never read and keeps
+    // the tab's own name.)
     const sessionId = String(job.sessionId);
     const place = placeOf(sessionId);
-    const wt = place === REPO_PLACE ? repoRoot : join(baseDir, 'sessions', place);
-    let branch = `session/${sessionId}`;
-    let detached = false;
-    if (existsSync(wt)) {
-      try {
-        branch = git(['symbolic-ref', '--short', 'HEAD'], wt);
-      } catch {
-        detached = true;
-      }
-    }
+    const wt = placeDir(sessionId);
+    const { branch, detached } = branchAt(wt, sessionBranch(place === REPO_PLACE ? sessionId : place));
     if (detached) {
       await settlePr({
         id,
@@ -146,7 +115,9 @@ export function createWorkPullRequests({
       try {
         gitNetIn(['push', '-u', 'origin', branch], pushCwd, 120_000);
       } catch (e) {
-        await settlePr({ id, outcome: 'failed', detail: ghFirstLine(e) });
+        // SCRUBBED (relayedFailure): this line lands on every delivered card's
+        // record and in the tab chat, and a push names the remote URL.
+        await settlePr({ id, outcome: 'failed', detail: relayedFailure(e) });
         return;
       }
       const pr = ensureOpenPr(branch, baseName, { cwd: repoRoot });
@@ -167,9 +138,8 @@ export function createWorkPullRequests({
     // cards over commits that never reached base.
     // No --delete-branch: the local branch may be a live worktree's HEAD.
     // THE BASE IS RE-ASKED BEFORE THE MERGE, never trusted from the open step:
-    // somebody can retarget a PR between Deliver and Approve, and `gh pr merge
-    // <branch>` merges whichever open PR the branch has, into whatever it
-    // targets now.
+    // somebody can retarget a PR between Deliver and Approve, and the merge
+    // acts on whichever open PR the branch has, into whatever it targets now.
     const wrongBase = otherBase(prTargetsOtherBase(findOpenPr(branch, { cwd: repoRoot }), baseName));
     if (wrongBase) {
       await settlePr({ id, outcome: 'failed', detail: wrongBase });
@@ -178,7 +148,7 @@ export function createWorkPullRequests({
     try {
       gitNetIn(['push', 'origin', branch], pushCwd, 120_000);
     } catch (e) {
-      await settlePr({ id, outcome: 'failed', detail: ghFirstLine(e) });
+      await settlePr({ id, outcome: 'failed', detail: relayedFailure(e) });
       return;
     }
     // The tip is the LOCAL branch — the state the reviewer approved and the
@@ -201,6 +171,17 @@ export function createWorkPullRequests({
       await settlePr({ id, outcome: 'failed', detail: merged.error });
       return;
     }
+    // GitHub lists no open pull request FROM this branch in this repository,
+    // so nothing was merged — never a PR picked by a selector that only looks
+    // like this branch (prWorkflow.mjs).
+    if (merged.noPr) {
+      await settlePr({
+        id,
+        outcome: 'failed',
+        detail: `there is no open pull request from ${branch} in this repository to merge — deliver again to open one`,
+      });
+      return;
+    }
     if (merged.notOnBase) {
       await settlePr({
         id,