flowviant 0.116.0 → 0.117.0

package/bin/lib/prWorkflow.mjs

@@ -17,6 +17,14 @@
  *  - ADOPT ONLY AN OPEN PR. gh's branch finder falls back to the most recent
  *    MERGED/CLOSED PR when no open one exists, and adopting a dead PR turns
  *    every later delivery on a long-lived branch into a silent black hole.
+ *  - NEVER A BARE BRANCH AS A PR SELECTOR (audit 2026-10-10, F166). gh reads a
+ *    selector that parses as a number (`42`, `#42`) as PR #42, whatever its
+ *    head — so `gh pr view <branch>` / `gh pr merge <branch>` on a branch
+ *    named after a ticket adopted, and then MERGED, somebody else's pull
+ *    request under the operator's login. The PR is found by `gh pr list
+ *    --head`, kept only when its head is exactly this branch in this
+ *    repository (a fork's same-named branch is not ours), and merged by that
+ *    verified URL. No verified PR, no merge.
  *  - …AND ONLY ONE THAT TARGETS THE PROJECT'S BASE. A PR somebody opened by
  *    hand into another branch would be merged INTO that branch. Refused only
  *    on a MEASURED mismatch: an absent or empty `baseRefName` adopts as
@@ -44,13 +52,28 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { git } from './git.mjs';
+import { git, stripUrlUserinfo } from './git.mjs';
+import { scrub } from './uplinkScrub.mjs';
 
-/** gh's own first line of complaint, capped — the words a failure relays. */
+/**
+ * gh's (or git's) own first line of complaint, capped — the words a failure
+ * relays. USERINFO STRIPPED (audit 2026-10-10, F153): a push writes the remote
+ * URL to stderr and a remote can carry a token as `//user:token@host`, and
+ * this line is stored where the whole project reads it.
+ */
 export const ghFirstLine = (e) =>
-  ((e?.stderr?.toString?.() || e?.message || 'failed').split('\n').find((l) => l.trim()) ||
-    'failed')
-    .slice(0, 400);
+  stripUrlUserinfo(
+    (e?.stderr?.toString?.() || e?.message || 'failed').split('\n').find((l) => l.trim()) || 'failed'
+  ).slice(0, 400);
+
+/**
+ * A FAILURE LINE FIT TO LEAVE THIS MACHINE — userinfo stripped and every
+ * known secret scrubbed. Every git or gh failure relayed to a team-visible
+ * record (a card's activity, the tab chat, an agent's mergeError) goes
+ * through here: the session PR lane relayed git's push stderr unscrubbed
+ * while the agent lane scrubbed the same line (audit 2026-10-10, F153/F167).
+ */
+export const relayedFailure = (e) => scrub(ghFirstLine(e));
 
 /** A pull request URL worth storing. Anything else gh printed is not one. */
 export const PR_URL_RE = /^https:\/\/github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+$/;
@@ -67,19 +90,53 @@ export function ghReady({ gh = runGh } = {}) {
     gh(['auth', 'status'], { timeout: 20_000 });
     return null;
   } catch (e) {
-    return { missing: e?.code === 'ENOENT', error: ghFirstLine(e) };
+    return { missing: e?.code === 'ENOENT', error: relayedFailure(e) };
   }
 }
 
-/** The OPEN pull request for `head`, as `{ url, base }` — or null when there
- *  is none, or only a merged/closed one. `base` is null when gh did not say. */
+/** A PR URL gh may be handed as a selector: a web address, never a bare
+ *  number or a leading-dash value. Host-agnostic, so GitHub Enterprise merges. */
+const SELECTOR_URL_RE = /^https?:\/\/\S+$/;
+
+/**
+ * The OPEN pull request whose head is exactly `head` in THIS repository, as
+ * `{ url, base, number }` — or null when gh lists none. THROWS when gh itself
+ * fails, so a caller can tell "GitHub says there is none" from "we could not
+ * ask"; `findOpenPr` folds the two for the callers that only adopt.
+ */
+function verifiedOpenPr(head, { cwd, gh }) {
+  const rows = JSON.parse(
+    gh(
+      [
+        'pr', 'list', '--head', head, '--state', 'open',
+        '--json', 'number,url,baseRefName,headRefName,isCrossRepository',
+        '--limit', '30',
+      ],
+      { cwd, timeout: 30_000 }
+    ).toString()
+  );
+  const pr = (Array.isArray(rows) ? rows : []).find(
+    (r) =>
+      r?.headRefName === head &&
+      r?.isCrossRepository === false &&
+      typeof r?.url === 'string' &&
+      SELECTOR_URL_RE.test(r.url.trim())
+  );
+  if (!pr) return null;
+  return {
+    url: pr.url.trim(),
+    base: typeof pr.baseRefName === 'string' ? pr.baseRefName : null,
+    number: Number.isInteger(pr.number) ? pr.number : null,
+  };
+}
+
+/** The OPEN pull request for `head`, as `{ url, base, number }` — or null when
+ *  there is none (or gh could not say). `base` is null when gh did not say. */
 export function findOpenPr(head, { cwd, gh = runGh } = {}) {
   try {
-    const j = JSON.parse(gh(['pr', 'view', head, '--json', 'url,state,baseRefName'], { cwd, timeout: 30_000 }).toString());
-    if (j?.state !== 'OPEN' || typeof j?.url !== 'string') return null;
-    return { url: j.url.trim(), base: typeof j?.baseRefName === 'string' ? j.baseRefName : null };
+    return verifiedOpenPr(head, { cwd, gh });
   } catch {
-    return null; // no PR for the branch at all
+    return null; // gh could not list — nothing to adopt
   }
 }
 
@@ -107,7 +164,7 @@ export function ensureOpenPr(head, base, { cwd, gh = runGh } = {}) {
       .trim();
     return { url: out.split('\n').filter(Boolean).pop() ?? null, adopted: false };
   } catch (e) {
-    return { error: ghFirstLine(e) };
+    return { error: relayedFailure(e) };
   }
 }
 
@@ -141,15 +198,35 @@ export async function tipReachedBase({ tip, baseRef, repoRoot, fetchOrigin, slee
 /**
  * MERGE `head`'s PR with a merge commit and VERIFY the tip reached base.
  * Answers `{ ok: true }`, `{ error }` (gh refused, in its own words — an
- * "already merged" is not a refusal), or `{ notOnBase: true }` (gh said yes
- * and base does not have the tip: an older PR merged, or a queue holds it).
+ * "already merged" is not a refusal), `{ noPr: true }` (GitHub lists no open
+ * PR from `head` in this repository, so nothing was merged — the caller says
+ * so in its own words), or `{ notOnBase: true }` (gh said yes and base does
+ * not have the tip: an older PR merged, or a queue holds it).
+ *
+ * The PR is looked up HERE, by its head, and merged by its URL — never by
+ * `head` itself, which gh would read as a PR number if it looks like one. So
+ * no caller can hand the merge an unverified selector.
+ *
  * The push that must precede it is the caller's: GitHub merges the REMOTE tip.
  */
 export async function mergeAndVerifyTip(head, { cwd, tip, baseRef, repoRoot, fetchOrigin, gh = runGh, sleep, gitImpl }) {
+  let pr;
+  try {
+    pr = verifiedOpenPr(head, { cwd, gh });
+  } catch (e) {
+    return { error: relayedFailure(e) };
+  }
+  if (!pr) {
+    // Nothing open to merge — and a PR that already MERGED leaves nothing
+    // open either (a re-offered job whose report was lost). "Already merged"
+    // stays a success only when it is measured: the tip on base.
+    const landed = await tipReachedBase({ tip, baseRef, repoRoot, fetchOrigin, sleep, gitImpl });
+    return landed ? { ok: true } : { noPr: true };
+  }
   try {
-    gh(['pr', 'merge', head, '--merge'], { cwd, timeout: 120_000 });
+    gh(['pr', 'merge', pr.url, '--merge'], { cwd, timeout: 120_000 });
   } catch (e) {
-    const line = ghFirstLine(e);
+    const line = relayedFailure(e);
     if (!/already merged/i.test(line)) return { error: line };
   }
   const landed = await tipReachedBase({ tip, baseRef, repoRoot, fetchOrigin, sleep, gitImpl });

package/bin/lib/preflight.mjs

@@ -4,31 +4,13 @@
  * what's missing, rather than failing cryptically mid-run.
  */
 
-import { execFileSync } from 'node:child_process';
 import { ok, warn, info, c } from './ui.mjs';
-import { addLocalBinToPath, promptYesNo, installClaude, installGh } from './install.mjs';
-import { RUNTIMES, mediatedSafeGap } from './runtimes.mjs';
+import { addLocalBinToPath, commandPresent as present, promptYesNo, installClaude, installGh } from './install.mjs';
+import { ghReady } from './prWorkflow.mjs';
+import { RUNTIMES, mediatedSafeGap, runtimeById } from './runtimes.mjs';
 import { detectRuntimes } from './runtimeDetection.mjs';
 import { terminalCommand } from './launchCommand.mjs';
 
-function present(cmd) {
-  try {
-    execFileSync(cmd, ['--version'], { stdio: 'ignore' });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function ghAuthed() {
-  try {
-    execFileSync('gh', ['auth', 'status'], { stdio: 'ignore', timeout: 20_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /** Prints a checklist and, when a missing prereq is auto-installable, OFFERS to
  *  install it (consent-based, never silent). Returns false only if a *fatal*
  *  prereq (SOME drivable runtime, or git when worktrees are used) is still
@@ -53,7 +35,7 @@ export async function preflight({ needGit = true } = {}) {
   let detected = detectRuntimes({ refresh: true });
   const shown = detected.filter((r) => r.installed || r.id === 'claude');
   for (const r of shown) {
-    const rt = RUNTIMES[r.id];
+    const rt = runtimeById(r.id);
     if (r.dispatchable) {
       ok(
         `${rt.bin} installed ${c.dim(`· ${rt.label} · must be signed in — run \`${rt.login}\` once if you haven’t`)}`
@@ -77,9 +59,10 @@ export async function preflight({ needGit = true } = {}) {
   // permission control is all-or-nothing. Say so at startup rather than letting
   // an operator believe a setting is in force that isn't.
   for (const r of drivable) {
-    if (mediatedSafeGap(RUNTIMES[r.id])) {
+    const rt = runtimeById(r.id);
+    if (mediatedSafeGap(rt)) {
       warn(
-        `${RUNTIMES[r.id].bin}: FLOWVIANT_SAFE cannot narrow this runtime — it has no per-invocation permission control, so its builds run unrestricted`
+        `${rt.bin}: FLOWVIANT_SAFE cannot narrow this runtime — it has no per-invocation permission control, so its builds run unrestricted`
       );
     }
   }
@@ -98,7 +81,7 @@ export async function preflight({ needGit = true } = {}) {
   // agent, not a requirement. Hence the offer no longer defaults to yes: an
   // install nobody asked for, defaulted on, is how a preflight installs
   // software on a machine whose operator only wanted a status line.
-  if (gh && ghAuthed()) {
+  if (gh && ghReady() === null) {
     ok('gh authenticated');
   } else if (gh) {
     warn('gh not signed in — run: gh auth login');

package/bin/lib/preview.mjs

@@ -32,10 +32,12 @@ import { spawn, execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { writeFileSync, renameSync, existsSync, mkdirSync, chmodSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
-import { homedir, platform, arch } from 'node:os';
+import { platform, arch } from 'node:os';
 import { startAuthProxy } from './authproxy.mjs';
+import { LOCAL_BIN, commandPresent } from './install.mjs';
 import { forgetInfraPid, isListening, noteInfraPid, originFor } from './listeners.mjs';
 import { forgetPreviewPid, recordPreviewPid } from './previewRegistry.mjs';
+import { killGroup } from './processGroup.mjs';
 
 // ── cloudflared: pinned, verified, or not fetched at all ───────────────────
 
@@ -53,15 +55,6 @@ const CF_SHA256 = {
   'darwin-arm64': '9042c2c5d8b2de78e60f313d5fb31b6c5c1cebde787a3caf1f2c9588084ac442',
 };
 
-function onPath() {
-  try {
-    execFileSync('cloudflared', ['--version'], { stdio: 'ignore' });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Resolve a cloudflared binary: PATH → previously fetched → download.
  *
@@ -74,12 +67,12 @@ function onPath() {
  * to be relayed verbatim rather than replaced with a Flowviant-authored one.
  */
 async function ensureCloudflared(log) {
-  if (onPath()) return { bin: 'cloudflared' };
+  if (commandPresent('cloudflared')) return { bin: 'cloudflared' };
 
   const os = platform();
   const a = arch() === 'arm64' ? 'arm64' : 'amd64';
   const key = `${os === 'darwin' ? 'darwin' : 'linux'}-${a}`;
-  const dir = join(homedir(), '.flowviant', 'bin');
+  const dir = LOCAL_BIN;
   // Version-stamped, so a pin bump fetches rather than reusing the old binary.
   const bin = join(dir, `cloudflared-${CF_VERSION}${os === 'win32' ? '.exe' : ''}`);
   if (existsSync(bin)) return { bin };
@@ -162,7 +155,7 @@ const TAIL_BYTES = 2000;
  * Flowviant asserting a state it never measured.
  *
  * `stillServing` (optional, async → boolean) is the ATTRIBUTION check — the
- * same `listenersIn(worktree)` predicate the caller ran at the boundary —
+ * same `originFor(worktree, port)` attribution the caller ran at the boundary —
  * and it guards EVERY gate in here, not just the probe: the open-time
  * re-validation, one more look immediately before cloudflared spawns, and the
  * recurring probe. Ports are global to a box and a worktree is not: when the
@@ -245,15 +238,7 @@ export async function openTunnel({
       /* best-effort */
     }
     if (tunnel?.pid) {
-      try {
-        process.kill(-tunnel.pid, 'SIGKILL'); // the whole detached group
-      } catch {
-        try {
-          tunnel.kill('SIGKILL');
-        } catch {
-          /* already gone */
-        }
-      }
+      killGroup(tunnel, 'SIGKILL'); // the whole detached group
       forgetPreviewPid(tunnel.pid);
       forgetInfraPid(tunnel.pid);
     }
@@ -301,7 +286,15 @@ export async function openTunnel({
     return { error: `nothing is listening on port ${port} in this worktree any more.` };
   }
 
-  const args = ['tunnel', '--url', `http://localhost:${gate.port}`];
+  // DIAL THE ADDRESS THE GATE BOUND (audit 2026-10-10, F757). The gate
+  // listens on 127.0.0.1 only; `localhost` resolves IPv6-first on macOS and
+  // on some Linux setups, and Go's dialer tries [::1]:<port> first — where
+  // any other local process could bind the same port number (it is readable
+  // from /proc/net/tcp and from this argv) and receive every public request,
+  // grant cookies and the automation password included. The same
+  // two-loopback-families hazard `originFor` closes on the origin side.
+  const gateUrl = `http://127.0.0.1:${gate.port}`;
+  const args = ['tunnel', '--url', gateUrl];
   // Send the origin the Host it expects. Vite and Next reject a Host they do
   // not recognise, so without this the tunnel resolves and then 403s.
   args.push('--http-host-header', 'localhost');
@@ -310,8 +303,9 @@ export async function openTunnel({
   // The signature names THIS tunnel's gate port, not the bare word
   // 'cloudflared': the reap matches cmdline.includes(sig), and the generic
   // word would let a recycled pid land on an operator's own unrelated
-  // cloudflared and group-SIGKILL it.
-  recordPreviewPid(tunnel.pid, `--url http://localhost:${gate.port}`);
+  // cloudflared and group-SIGKILL it. Entries written before 2026-10-10 keep
+  // their own `--url http://localhost:<port>` signature and still reap.
+  recordPreviewPid(tunnel.pid, `--url ${gateUrl}`);
   // Keep our own plumbing out of the listeners measurement (see listeners.mjs:
   // cloudflared's metrics socket lives in the checkout's cwd).
   noteInfraPid(tunnel.pid);

package/bin/lib/previewGatePolicy.mjs

@@ -63,10 +63,21 @@ export const sourceOf = (req) =>
  * says is cross-site is refused unless it is a plain navigation GET/HEAD —
  * the two shapes this product legitimately serves cross-site (the Open
  * link, the Workbench frame's own src; a rendered attacker frame is then
- * stopped by the frame-ancestors rewrite). Applies ONLY to grant-cookie
- * auth: a password in an Authorization header is never attached cross-site
- * by a browser, and clients that send no Sec-Fetch headers never held a
- * None cookie, so absence stays permitted.
+ * stopped by the frame-ancestors rewrite). Applied in full to grant-cookie
+ * auth; clients that send no Sec-Fetch headers never held a None cookie, so
+ * absence stays permitted.
+ *
+ * The PASSWORD is not exempt from CSRF (corrected 2026-10-10, F116). It was
+ * held that "a password in an Authorization header is never attached
+ * cross-site by a browser" — false for HTTP Basic: the gate's own 401 makes
+ * the browser prompt, and the browser then replays the cached credentials on
+ * later requests to the origin, a cross-site auto-submitted form POST
+ * included (the classic router CSRF). So a password-authenticated request —
+ * and every request on a password-only share — is refused when it is
+ * cross-site AND not a safe method (`crossSiteWrite`). Cross-site
+ * GET/HEAD/OPTIONS still ride (a frontend preview calling an API preview on
+ * another tunnel), and so does anything without Sec-Fetch headers (curl,
+ * native tools, the automation the password exists for).
  *
  * Why a backstop at all: Chromium 76–113 (and same-vintage webviews/forks)
  * sends Sec-Fetch-Dest — so it takes the framed-cookie branch — while
@@ -85,6 +96,16 @@ export const crossSiteAbuse = (req) => {
   return !(req.method === 'GET' || req.method === 'HEAD');
 };
 
+/** Methods a cross-site page may send with a cached Basic credential: none
+ *  of them changes state on a well-behaved origin. */
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+/** A cross-site request that can change state — the shape Basic-auth CSRF
+ *  rides (see `crossSiteAbuse`'s second paragraph). */
+export const crossSiteWrite = (req) =>
+  String(req.headers['sec-fetch-site'] || '').toLowerCase() === 'cross-site' &&
+  !SAFE_METHODS.has(String(req.method || '').toUpperCase());
+
 /** A top-level browser navigation, and nothing else. A 302 is re-issued as
  *  GET and drops the body, so bouncing a POST would turn an unauthenticated
  *  write into a mystery GET; and this is what keeps curl and native clients
@@ -207,15 +228,18 @@ export function createGatePolicy({ grants, grantSecret, shareId, expected, log,
   };
 
   /** True when THIS request authenticated with the password rather than the
-   *  cookie — the credential class CSRF cannot ride. */
+   *  cookie. Not a CSRF exemption: a cached Basic credential rides a
+   *  cross-site navigation too (see `crossSiteAbuse`). */
   const viaPassword = (req) => sameSecret(req.headers['authorization'], expected);
 
   /**
    * THE ONE ADMISSION ORDER both transports ask: the credential first, then —
-   * only for a caller who HAS one — the cross-site backstop. The grant is a
-   * cookie, and a cookie can be ridden (header rule 4a's backstop); a
-   * refusal there is never a bounce, because the caller has a credential and
-   * the request SHAPE is what is refused.
+   * only for a caller who HAS one — the cross-site backstops. The grant is a
+   * cookie, and a cookie can be ridden (header rule 4a's backstop: every
+   * cross-site shape but a GET/HEAD navigation); a cached Basic password can
+   * be ridden too, by a cross-site write (2026-10-10, F116). A refusal there
+   * is never a bounce, because the caller has a credential and the request
+   * SHAPE is what is refused.
    *
    * Returns the credential verdict ('blocked', 'none', 'expired', 'forged',
    * 'badpass'), 'cross-site', or 'ok'.
@@ -224,6 +248,7 @@ export function createGatePolicy({ grants, grantSecret, shareId, expected, log,
     const verdict = credential(req);
     if (verdict !== 'ok') return verdict;
     if (grants && crossSiteAbuse(req) && !viaPassword(req)) return 'cross-site';
+    if (crossSiteWrite(req)) return 'cross-site';
     return 'ok';
   };
 

package/bin/lib/previewRegistry.mjs

@@ -56,6 +56,7 @@ import { execFileSync } from 'node:child_process';
 import { join } from 'node:path';
 import { homedir, platform } from 'node:os';
 import { mutateRegistry, processAlive, processStartTime, readRegistry } from './procRegistry.mjs';
+import { killGroup } from './processGroup.mjs';
 
 const FLOWVIANT_DIR = join(homedir(), '.flowviant');
 const PREVIEW_REGISTRY = join(FLOWVIANT_DIR, 'previews.json');
@@ -218,17 +219,9 @@ export function reapOrphanPreviews(log) {
     if (ours === null) continue;
     handled.add(pid);
     if (!ours) continue;
-    try {
-      process.kill(-pid, 'SIGKILL'); // whole group
-      killed++;
-    } catch {
-      try {
-        process.kill(pid, 'SIGKILL');
-        killed++;
-      } catch {
-        /* already gone */
-      }
-    }
+    // The whole group, else the pid — by number, as `process.kill` always
+    // coerced a row's pid (processGroup.mjs refuses anything that is not one).
+    if (killGroup(Number(pid), 'SIGKILL')) killed++;
   }
   if (handled.size) mutatePreviews((cur) => cur.filter((e) => !handled.has(e.pid)));
   if (killed) log?.(`reaped ${killed} orphaned preview tunnel${killed === 1 ? '' : 's'} from a previous run.`);

package/bin/lib/printable.mjs

@@ -6,8 +6,8 @@
  * the server's own `parseBoxName`/`parseCheckoutPath` did — an escape
  * sequence in a project or box name can clear the screen or, via OSC 52,
  * rewrite the terminal's clipboard — but it stopped at C1 and never scrubbed
- * the BIDI/format controls (U+200E/U+200F, U+202A–U+202E, U+2066–U+2069) that
- * reorder a line to hide or forge part of it: a box named
+ * the BIDI/format controls (U+061C, U+200E/U+200F, U+202A–U+202E,
+ * U+2066–U+2069) that reorder a line to hide or forge part of it: a box named
  * `evil‮txt.crt⁦` reads backwards on a bidi-aware terminal, so
  * "evil" can visually swap places with an extension that was never there.
  *
@@ -19,10 +19,17 @@
  * with zero imports is the one shape both can depend on without adding an
  * edge neither wants.
  *
- * THE CHARACTER CLASS IS THE SERVER'S OWN (`stripDisplayControl`,
- * machineBoxes.ts, 2026-09-24) — copied rather than re-derived, because the
- * point of a BELT is that the two ends agree about what counts as printable
- * without either one trusting the other to have applied it. The server scrub
+ * THE CHARACTER CLASS IS THE SERVER'S OWN (`stripDisplayControl`, now
+ * `packages/shared/src/displayText.ts`; machineBoxes.ts when it was copied,
+ * 2026-09-24) — copied rather than re-derived, because the point of a BELT is
+ * that the two ends agree about what counts as printable without either one
+ * trusting the other to have applied it. The copy fell behind once: the
+ * server's set gained U+061C, the Arabic letter mark (the one Bidi_Control
+ * code point it lacked), on 2026-10-10 (audit F231), and this copy gained it
+ * in the audit's final cleanup the same day. The release gate
+ * (`scripts/check-app-parity.mjs`, rule 28) now walks every code point
+ * through `printable`, `printableText` and the shared `stripDisplayControl`,
+ * so the sets cannot drift apart unnoticed again. The server scrub
  * is the primary fix (it is what a stale stored row, upserted before this
  * belt existed, is read back through); this is defence in depth, because the
  * terminal is where the harm happens and the CLI should not trust that every
@@ -32,7 +39,7 @@
  * `safeName`.
  */
 // eslint-disable-next-line no-control-regex
-const DISPLAY_CONTROL = /[\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]/g;
+const DISPLAY_CONTROL = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
 
 /** Strip the class above. Non-strings pass through unchanged — this is a
  *  scrub, not a coercion, and a caller that hands it `undefined` should get
@@ -40,3 +47,59 @@ const DISPLAY_CONTROL = /[\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]/g;
 export function printable(raw) {
   return typeof raw === 'string' ? raw.replace(DISPLAY_CONTROL, '') : raw;
 }
+
+/**
+ * ONE LINE OF SOMEBODY ELSE'S PROSE, made safe to print (2026-10-10, the
+ * audit's F084) — the CLI twin of the server's `normalizeStopReason`.
+ *
+ * A SENTENCE, so the class is BLANKED to a space rather than stripped (two
+ * words must not run together where a newline or a control sat between them),
+ * then whitespace collapses to one line, and the cap counts CODE POINTS: a
+ * `slice` on UTF-16 units can end on half a surrogate pair, and half a pair is
+ * what would be printed. The commanded stop's reason had its own copy of this
+ * that stopped at C0 and DEL — the 8-bit CSI `\u009b` and every bidi override
+ * went straight to the operator's terminal whenever the server-side scrub was
+ * bypassed (the column is also written by hand, machineStop.ts).
+ *
+ * Not a string in, '' out: every caller prints the result, and a sentence
+ * nobody wrote has no words.
+ */
+export function printableLine(raw, maxCodePoints) {
+  if (typeof raw !== 'string') return '';
+  const line = raw.replace(DISPLAY_CONTROL, ' ').replace(/\s+/g, ' ').trim();
+  return [...line].slice(0, maxCodePoints).join('').trim();
+}
+
+/**
+ * OUTPUT A CLI OR A MODEL WROTE, made safe for the operator's terminal and log
+ * (2026-10-10, the audit's F133/F097): the same class, minus the two controls
+ * multi-line text is made of — `\n` and `\t` survive, so a CLI's stderr and a
+ * replayed log keep their shape.
+ *
+ * The ESC-introduced sequences go WHOLE first — CSI (`ESC [ … final`, which
+ * includes a colour) and OSC (`ESC ] …` ended by BEL or ST, which includes the
+ * OSC 52 clipboard write and the OSC 8 link) — so their parameter bytes do not
+ * survive as litter; any lone or unterminated ESC, every other C0 (a carriage
+ * return overwrites the line above it), DEL, C1 (the 8-bit CSI/OSC need no
+ * ESC at all) and the bidi controls then go one by one.
+ *
+ * NEVER APPLIED INSIDE ui.mjs's `line()`. The daemon colours its own words
+ * with SGR (`c.*`) around text it has already composed, so a sink-wide scrub
+ * would have to keep SGR — and cannot tell the daemon's from an attacker's.
+ * Text is cleaned where it ENTERS instead: server strings at their intake
+ * (`printable`), and CLI/model output at the one sink that writes it raw
+ * (runTurn's `emit`, before the daemon's coloured prefix is added). The one
+ * other reader is `flowviant logs` (views.mjs), which replays a log file that
+ * an older daemon may have written raw — so a replay loses the log's colours
+ * along with anybody else's sequences.
+ */
+// eslint-disable-next-line no-control-regex
+const ESC_SEQUENCE = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b\u009c]*(?:\x07|\x1b\\|\u009c)/g;
+// eslint-disable-next-line no-control-regex
+const TEXT_CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
+
+/** Strip the class above, keeping `\n` and `\t`. Non-strings pass through
+ *  unchanged, as `printable` does. */
+export function printableText(raw) {
+  return typeof raw === 'string' ? raw.replace(ESC_SEQUENCE, '').replace(TEXT_CONTROL, '') : raw;
+}

package/bin/lib/procRegistry.mjs

@@ -30,6 +30,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from 'node:fs';
+import { procStat } from './procStat.mjs';
 
 const LOCK_STALE_MS = 15_000;
 const MAX_ENTRIES = 32;
@@ -132,23 +133,21 @@ export function sameBoot(mark, now = bootMark()) {
  * WHEN A PROCESS STARTED, as an opaque token — so a lock that remembers a pid
  * can tell the process it meant from one that inherited the number.
  *
- * Linux: field 22 of `/proc/<pid>/stat` (start time in clock ticks since boot),
- * read after the LAST `)` because the comm field may itself contain one.
+ * Linux: `starttime` (field 22 of `/proc/<pid>/stat`, clock ticks since boot),
+ * read through procStat.mjs, the one parser of that line.
  * macOS: `ps -o lstart=`. Null when it cannot be read, which callers treat as
  * "cannot tell" — never as a mismatch.
+ *
+ * The darwin token keeps the reader's locale (no LC_ALL pin, 2026-10-10): it is
+ * compared for EQUALITY against tokens older daemons already wrote into live
+ * turn locks, and pinning it would read every one of those holders as a
+ * different process for one upgrade.
  */
 export function processStartTime(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return null;
-  try {
-    const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
-    const rest = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
-    // `rest[0]` is field 3 (state), so field 22 is rest[19].
-    const st = rest[19];
-    return st && /^\d+$/.test(st) ? `${bootMark()}:${st}` : null;
-  } catch {
-    /* not Linux, or the pid is gone */
-  }
-  if (platform() !== 'darwin') return null;
+  const linux = procStat(pid);
+  if (linux) return `${bootMark()}:${linux.starttime}`;
+  if (platform() !== 'darwin') return null; // not Linux, or the pid is gone
   try {
     const out = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
       encoding: 'utf8',
@@ -161,7 +160,12 @@ export function processStartTime(pid) {
   }
 }
 
-/** Signal-0 liveness. EPERM means alive and not ours, which is still alive. */
+/**
+ * Signal-0 liveness — THE probe (2026-10-10, F050/F090: instance.mjs kept a
+ * byte-for-byte copy and uninstall a drifted one). EPERM means alive and not
+ * ours, which is still alive: a reader deciding whether something may be
+ * removed or replaced from under a process errs toward the process.
+ */
 export function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -172,6 +176,22 @@ export function processAlive(pid) {
   }
 }
 
+/**
+ * Alive AND signalable by us — the reading for a pid that can only ever be a
+ * process THIS uid spawned (the turn lock's CLI, turnLock.mjs). There EPERM is
+ * by definition not ours: a pid we may not signal was recycled to another
+ * uid, so the record naming it is stale. Everywhere else, `processAlive`.
+ */
+export function aliveAndOurs(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false; // ESRCH: gone. EPERM: another uid's process — never ours.
+  }
+}
+
 /**
  * THE DEFAULT PRUNE: a row whose pid is alive, or dead for less than a week,
  * capped at the newest `MAX_ENTRIES`. An entry whose pid has been dead for a

package/bin/lib/procScan.mjs

@@ -34,7 +34,7 @@
  */
 
 import { readdirSync, readlinkSync, realpathSync } from 'node:fs';
-import { sep } from 'node:path';
+import { isPathInside } from './repoPath.mjs';
 
 /** Rows collected per scan before the walk stops early — a bound on the ROWS
  *  held (and the per-row work: an fd walk, a stat read) for one pathological
@@ -75,8 +75,7 @@ export function insideDir(dir) {
   } catch {
     return null;
   }
-  const prefix = root.endsWith(sep) ? root : root + sep;
-  return (p) => p === root || p.startsWith(prefix);
+  return (p) => isPathInside(p, root);
 }
 
 function cwdOf(raw) {