flowviant 0.116.0 → 0.117.0

package/bin/lib/workCommandAudit.mjs

@@ -8,7 +8,7 @@
  * blocking the turn.
  */
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { scrub as envScrub } from './uplinkScrub.mjs';
+import { scrubCut } from './uplinkScrub.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 
 // THE COMMAND AUDIT — every `$ …` the CLI's stream reports, batched
@@ -21,6 +21,10 @@ import { fleetEndpoint } from './fleetWire.mjs';
 // a kill, and again at settle. Best-effort: a failed post drops the
 // batch rather than blocking the turn — the surface says it is the
 // machine's report, not a syscall trace.
+/** The server's own cap on one audited command (sessionCommands.ts
+ *  `MAX_COMMAND_CHARS`), applied here AFTER the scrub. */
+const MAX_COMMAND_CHARS = 2000;
+
 export function createCommandAudit({ sessionId, turnId, runtime, cwd }) {
   const SESSION_COMMANDS_URL = fleetEndpoint('session-commands', FLEET_URL);
   const auditBatch = [];
@@ -55,7 +59,12 @@ export function createCommandAudit({ sessionId, turnId, runtime, cwd }) {
     // `PGPASSWORD=… psql` — and the audit is stored 30 days and rendered
     // in the admin view, so the one uplink that omitted scrub was the
     // one most likely to carry a plaintext secret.
-    auditBatch.push({ command: envScrub(a.command), at: new Date().toISOString() });
+    //
+    // SCRUBBED WHOLE, THEN CUT (2026-10-10, the audit's F128): the parsers
+    // used to cut the command at 2000 before it reached this scrub, so a
+    // secret straddling that character kept its prefix. They now hand a
+    // bounded window, and the server's cap is applied here, last.
+    auditBatch.push({ command: scrubCut(a.command, MAX_COMMAND_CHARS), at: new Date().toISOString() });
     if (auditBatch.length >= 25) flushAudit();
   };
   return { flushAudit, auditCommand };

package/bin/lib/workDiffs.mjs

@@ -1,7 +1,25 @@
 /** Commit diff requests and their bounded reports. */
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { git } from './git.mjs';
+import { git, GIT_WIDE_BUFFER, OBJECT_ID_RE } from './git.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { scrub, scrubCut } from './uplinkScrub.mjs';
+
+/**
+ * A PATCH BIGGER THAN NODE'S 1 MiB DEFAULT BUFFER (2026-10-10, the audit's
+ * F150). `git()` (git.mjs) defaults to Node's 1 MiB `maxBuffer`, so any
+ * commit whose patch passed 1 MiB failed `ENOBUFS` and the viewer was told it
+ * errored, when it should have been shown the first 256 KB marked truncated.
+ * The same call with room for GIT_WIDE_BUFFER (8 MiB); past that, what git
+ * printed up to the bound is still a patch to truncate, never an error.
+ */
+function gitBig(args, cwd) {
+  try {
+    return git(args, cwd, { maxBuffer: GIT_WIDE_BUFFER });
+  } catch (e) {
+    if (e?.code === 'ENOBUFS' && typeof e.stdout === 'string' && e.stdout) return e.stdout;
+    throw e;
+  }
+}
 
 export function createWorkDiffs({ repoRoot }) {
   const DIFF_DONE_URL = fleetEndpoint('diff-done', FLEET_URL);
@@ -23,6 +41,18 @@ export function createWorkDiffs({ repoRoot }) {
    * machine" is a real answer, and a viewer spinning forever is the worst thing
    * this can do. The one thing never sent is a guess — an empty patch would
    * tell a reader the commit changed nothing.
+   *
+   * ONLY A COMMIT, AND SCRUBBED (2026-10-10, the audit's F150). The sha is a
+   * server-named hex string, and `git show <sha>` prints whatever object it
+   * names — a blob, a tree, a tag — so it is first resolved as
+   * `<sha>^{commit}` and anything else is answered "no such commit on this
+   * machine" with no content. (The hex check below already keeps it from
+   * reading as an option, so no `--end-of-options`, which git before 2.30
+   * does not take in `rev-parse`.) No reachability check: the run page asks
+   * for unpushed agent commits on load, and a remote-branch bound would refuse
+   * them. And the patch is the one repository uplink that skipped `scrub`; it
+   * now passes through it WHOLE, before the line-boundary cut — the
+   * scrub-then-cut order every other lane keeps.
    */
   const MAX_PATCH_BYTES = 256 * 1024;
   const servedDiffs = new Set();
@@ -48,7 +78,7 @@ export function createWorkDiffs({ repoRoot }) {
       const sha = String(job?.sha || '').toLowerCase();
       // A sha becomes a `git` argument. The server validates too; one place
       // doing this check is one deploy away from being zero places.
-      if (!/^[0-9a-f]{7,64}$/.test(sha)) continue;
+      if (!OBJECT_ID_RE.test(sha)) continue;
       // In-flight guard, not a cache: the server stops offering a sha the
       // moment it settles, so this only stops the SAME poll's job being
       // started twice while its `git show` is still running.
@@ -56,6 +86,22 @@ export function createWorkDiffs({ repoRoot }) {
       servedDiffs.add(sha);
       void (async () => {
         try {
+          let commit = '';
+          try {
+            commit = gitBig(['rev-parse', '--verify', '--quiet', `${sha}^{commit}`], repoRoot);
+          } catch (e) {
+            // Exit 1 is `--verify --quiet`'s "not a commit here" (absent,
+            // ambiguous, or another object type); anything else is git's own
+            // failure, relayed in its words as before.
+            if (e?.status !== 1) {
+              await postDiff({ sha, error: scrubCut(e?.message || e, 500) });
+              return;
+            }
+          }
+          if (!/^[0-9a-f]{40,64}$/.test(commit)) {
+            await postDiff({ sha, error: 'no such commit on this machine' });
+            return;
+          }
           let patch = '';
           const files = [];
           try {
@@ -63,13 +109,13 @@ export function createWorkDiffs({ repoRoot }) {
             // date already reached the card on the worktree sweep, and
             // repeating them inside the patch would put a second copy above
             // every hunk.
-            patch = git(['show', '--patch', '--format=', sha], repoRoot);
+            patch = scrub(gitBig(['show', '--patch', '--format=', commit], repoRoot));
           } catch (e) {
-            await postDiff({ sha, error: String(e?.message || e).slice(0, 500) });
+            await postDiff({ sha, error: scrubCut(e?.message || e, 500) });
             return;
           }
           try {
-            const raw = git(['show', '--numstat', '--format=', sha], repoRoot);
+            const raw = gitBig(['show', '--numstat', '--format=', commit], repoRoot);
             for (const line of raw.split('\n')) {
               if (!line.trim()) continue;
               const [a, d, ...rest] = line.split('\t');
@@ -77,7 +123,7 @@ export function createWorkDiffs({ repoRoot }) {
               if (!path) continue;
               const binary = a === '-' || d === '-';
               files.push({
-                path: path.slice(0, 300),
+                path: scrubCut(path, 300),
                 added: binary ? 0 : Number(a) || 0,
                 deleted: binary ? 0 : Number(d) || 0,
                 ...(binary ? { binary: true } : {}),

package/bin/lib/workIntake.mjs

@@ -1,9 +1,10 @@
 /** One leased incoming ticket, drafted by this machine's read-only CLI. */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { FLEET_URL, DAEMON_INSTANCE } from './config.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease } from './fleetPost.mjs';
 import { runTurn as defaultRunTurn } from './runTurn.mjs';
 import { pickRuntimeFor as defaultPickRuntimeFor } from './runtimeDetection.mjs';
-import { removeProbeTranscript } from './runtimeCapabilities.mjs';
+import { runCappedTurn } from './workCappedTurn.mjs';
 import { REPO_PLACE } from './workPlaces.mjs';
 import { SYSTEM_INTAKE, INTAKE_KICKOFF } from './prompts.mjs';
 import { parseIntakeDraft } from './intakeDraft.mjs';
@@ -31,25 +32,12 @@ export function createWorkIntake({
   const done = fleetEndpoint(INTAKE_DONE_ENDPOINT, FLEET_URL);
   const intake = new Set();
 
-  const claim = async (id) => {
-    try {
-      const res = await fetch(claiming, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
-      });
-      // A 409 means another holder (or a dismissed/landed ticket). No CLI and
-      // no settle: this machine never acquired the right to answer for it.
-      return res.status === 200 && (await res.json().catch(() => null))?.ok === true;
-    } catch {
-      return false;
-    }
-  };
+  // The intake route answers `{ ok: true }` on a 200, not `data.claimed`
+  // (machineIntake.routes.ts) — the same lease rule with its own winner test.
+  // A 409 means another holder (or a dismissed/landed ticket). No CLI and no
+  // settle: this machine never acquired the right to answer for it.
+  const claim = (id) =>
+    claimFleetLease(claiming, { id }, { won: (r) => r.status === 200 && r.json?.ok === true });
 
   const report = async (body) => {
     await postBestEffort(done, { ...body, instance: DAEMON_INSTANCE });
@@ -68,56 +56,43 @@ export function createWorkIntake({
     }
 
     let out = '';
-    let child = null;
-    let session = null;
-    let timer = null;
     let wedged = false;
+    let spawned = false;
     let usage = null;
     // A spawned CLI can fail before reporting counters. Null records that the
     // spend is unmeasured; four zeroes would falsely say it spent nothing.
-    const spent = () => child ? { usage } : {};
+    const spent = () => spawned ? { usage } : {};
     try {
       await inPlace(REPO_PLACE, false, async () => {
-        let stopWaiting = () => {};
-        const capped = new Promise((resolve) => { stopWaiting = resolve; });
-        const turn = runTurn({
-          prompt: INTAKE_KICKOFF(job),
-          system: SYSTEM_INTAKE,
-          profile: 'consult',
-          cwd: repoRoot,
-          runtime,
-          streamJson: true,
-          answerFromResult: true,
-          label: c.cyan('[intake]'),
-          // There is no MCP principal for a ticket, and no model or effort pin:
-          // this one-shot reader uses the machine's consult defaults.
-          onInit: (i) => {
-            if (typeof i?.sessionId === 'string' && i.sessionId.trim()) session = i.sessionId.trim();
-          },
-          onUsage: (u) => { usage = addUsage(usage, { ...u, runtime }); },
-          onSpawn: (ch) => {
-            child = ch;
-            workChildren.set(ch, null);
-            releaseSlot();
-            // Start the cap at spawn, never while a checkout writer holds the
-            // reader lock; SIGKILL and resolve even if a grandchild holds stdio.
-            timer = setTimeout(() => {
-              wedged = true;
-              try { ch.kill('SIGKILL'); } catch { /* already gone */ }
-              stopWaiting('');
-            }, 10 * 60_000);
-            timer.unref?.();
+        // One capped consult turn (workCappedTurn.mjs): the cap starts at
+        // spawn, never while a checkout writer holds the reader lock, and
+        // SIGKILLs the child and resolves even if a grandchild holds stdio.
+        ({ out, wedged } = await runCappedTurn({
+          runTurn,
+          capMs: 10 * 60_000,
+          workChildren,
+          releaseSlot,
+          transcriptCwd: repoRoot,
+          turnArgs: {
+            prompt: INTAKE_KICKOFF(job),
+            system: SYSTEM_INTAKE,
+            profile: 'consult',
+            cwd: repoRoot,
+            runtime,
+            answerFromResult: true,
+            label: c.cyan('[intake]'),
+            // There is no MCP principal for a ticket, and no model or effort pin:
+            // this one-shot reader uses the machine's consult defaults.
+            onUsage: (u) => { usage = addUsage(usage, { ...u, runtime }); },
           },
-        });
-        out = await Promise.race([turn, capped]);
+          // Marked by the lane itself, so a turn that throws after its spawn
+          // still reports what it measured.
+          onSpawn: () => { spawned = true; },
+        }));
       });
     } catch (e) {
       await report({ id, outcome: INTAKE_OUTCOMES.nothing, error: envScrub(String(e?.message || e)).slice(0, 500), ...spent() });
       return;
-    } finally {
-      if (timer) clearTimeout(timer);
-      if (child) workChildren.delete(child);
-      if (session) setTimeout(() => removeProbeTranscript(repoRoot, session), 750).unref?.();
     }
 
     if (wedged) {

package/bin/lib/workPlaceReports.mjs

@@ -12,14 +12,15 @@
  */
 import { readFileSync } from 'node:fs';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, MACHINE_HOST } from './config.mjs';
-import { gitNetAsync, isSafePathSegment } from './git.mjs';
+import { gitNetAsync } from './git.mjs';
 import { measureListeners, listenersSupported } from './listeners.mjs';
 import { processesSupported } from './processes.mjs';
 import { titleForSession } from './claudeSessions.mjs';
+import { RESUME_MARKERS } from './conversationIds.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { myPubB64 } from './boxIdentity.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
-import { REPO_PLACE } from './workPlaces.mjs';
+import { isValidPlace } from './workPlaces.mjs';
 
 export function createWorkPlaceReports({
   repoRoot,
@@ -94,7 +95,9 @@ export function createWorkPlaceReports({
     // The session's PLACE, not its name: a tab in the checkout is measured in
     // the checkout, and a tab sharing another tab's worktree is measured there.
     const place = placeOf(sessionId);
-    if (place !== REPO_PLACE && !isSafePathSegment(place)) return null;
+    // The one validity rule (`isValidPlace`, workPlaces.mjs, audit 2026-10-10
+    // F141) — not a third spelling of it.
+    if (!isValidPlace(place)) return null;
     const wt = placeDir(sessionId);
     const d = worktreeDiff(wt, baseRef());
     if (!d) return null;
@@ -138,7 +141,7 @@ export function createWorkPlaceReports({
     // exactly as it found it.
     let title = null;
     try {
-      const marker = sessionMetaPath(wt, 'flowviant-claude-session', sessionId);
+      const marker = sessionMetaPath(wt, RESUME_MARKERS.claude, sessionId);
       if (marker) title = titleForSession(wt, readFileSync(marker, 'utf8').trim());
     } catch {
       /* no marker yet — this tab has not spoken, or is not Claude */

package/bin/lib/workPlaces.mjs

@@ -7,18 +7,62 @@
  * one of these four questions, and they have to agree: a tab in the checkout
  * measured against `sessions/<id>` reports nothing, and a marker written
  * unscoped hands one tab another's conversation. One home keeps them one
- * answer. The trust boundary (`isSafePathSegment` / `REPO_PLACE`) lives here
- * with the map it guards; the session lane is the only other writer and keeps
- * the same check (its comment says why).
+ * answer. The trust boundary (`isValidPlace`) lives here with the map it
+ * guards, and `notePlace` is the map's ONLY writer: the roster's intake and
+ * the session lane's turn intake both go through it (audit 2026-10-10, F141),
+ * so a lane that learns a place cannot store one unvalidated.
  */
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { git, isSafePathSegment, hasCommits, gitFailure } from './git.mjs';
+import { git, isSafePathSegment, hasCommits, gitFailure, sessionBranch } from './git.mjs';
 
 /** The place id meaning "the checkout", not a worktree. Must match the
- *  server's REPO_PLACE — it is a wire value, not a local convention. */
+ *  server's REPO_PLACE — it is a wire value, not a local convention. The
+ *  release parity gate holds it there (2026-10-10, audit F163). */
 export const REPO_PLACE = 'repo';
 
+/** A PERSON's place starts with this — the server's `userPlace(userId)` is
+ *  `u-<userId>` — which is how the worktree sweep tells a person's manual copy
+ *  (fast-forwarded) from an agent's or a session's (never touched). A wire
+ *  value too, held to `userPlace` by the release parity gate (2026-10-10,
+ *  audit F163). */
+export const PERSON_PLACE_PREFIX = 'u-';
+
+/**
+ * A PLACE THIS MACHINE WILL RESOLVE: the checkout, or a safe path segment.
+ *
+ * The value becomes the directory a turn is SPAWNED in and a preview port is
+ * measured against — the security boundary for the whole preview feature. The
+ * server resolves place to an enum (never a path), but a server bug or
+ * compromise sending `../../etc` would otherwise point a session's measured
+ * directory anywhere on the box. REPO_PLACE resolves to repoRoot, so it is
+ * allowed through despite not being a path segment.
+ */
+export function isValidPlace(place) {
+  return typeof place === 'string' && (place === REPO_PLACE || isSafePathSegment(place));
+}
+
+/**
+ * A PLACE'S OWN WORKTREE DIRECTORY — `sessions/<place>` under the worktrees
+ * root — or null for an id that is not a safe path segment. Pure.
+ *
+ * No REPO_PLACE arm, on purpose: the agent lanes hold an AGENT's place, which
+ * is never the checkout, so a stray `'repo'` there keeps naming a directory
+ * that does not exist rather than becoming the operator's checkout.
+ */
+export function worktreePath(baseDir, place) {
+  return isSafePathSegment(place) ? join(baseDir, 'sessions', place) : null;
+}
+
+/**
+ * THE DIRECTORY A PLACE RESOLVES TO: the checkout for REPO_PLACE, its own
+ * worktree otherwise, null for an unsafe id. Pure — `placeDir` is this over
+ * the session map, and nothing else spells the rule.
+ */
+export function placePath({ repoRoot, baseDir }, place) {
+  return place === REPO_PLACE ? repoRoot : worktreePath(baseDir, place);
+}
+
 export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged }) {
   /**
    * WHERE EACH SESSION WORKS, learned from the turns we are handed.
@@ -66,36 +110,59 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
    * Absence of the whole map still means "an older server said nothing", which
    * is the only thing absence can safely mean.
    */
+  /**
+   * THE MAP'S ONE WRITER — validate, then store; false (and nothing stored)
+   * for a place this machine refuses.
+   *
+   * VALIDATED AT THE TRUST BOUNDARY (`isValidPlace` says why). There were two
+   * writers — the roster's intake below and the session lane's turn intake —
+   * each spelling the check, with a comment keeping them in step by hand:
+   * validating one intake and not the other is one deploy away from
+   * validating neither. Now there is one door, and the map is not handed out.
+   */
+  const notePlace = (sessionId, place) => {
+    if (!isValidPlace(place)) return false;
+    sessionPlaces.set(sessionId, place);
+    return true;
+  };
   const learnPlaces = (map) => {
     if (!map || typeof map !== 'object') return;
     for (const [sid, place] of Object.entries(map)) {
-      // VALIDATE AT THE TRUST BOUNDARY. `placeDir` joins this value straight
-      // into `sessions/<place>` and it is the directory a turn is SPAWNED in
-      // and a preview port is measured against — the security boundary for the
-      // whole preview feature. The server resolves place to an enum (never a
-      // path), but a server bug or compromise sending `../../etc` would
-      // otherwise point a session's measured directory anywhere on the box and
-      // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
-      // already reject an unsafe segment; checking at the intake covers the
-      // consumers that do not (the preview-claim `placeDir` did not re-check).
-      // NOT the only writer: `processWorkTurns` stores a turn job's place too,
-      // and keeps the same check — validating one intake and not the other is
-      // one deploy away from validating neither. REPO_PLACE resolves to
-      // repoRoot, so it is allowed through despite not being a path segment.
-      if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
-        sessionPlaces.set(sid, place);
+      // `sessionWorktreeReport` and `placeWtFor` already reject an unsafe
+      // segment; checking at the intake covers the consumers that do not (the
+      // preview-claim `placeDir` did not re-check).
       // null / '' / an unsafe value: the server is telling us this tab is in its
       // OWN worktree (or is malformed). Falling back to the default requires
       // forgetting, not ignoring.
-      else sessionPlaces.delete(sid);
+      if (!notePlace(sid, place)) sessionPlaces.delete(sid);
     }
   };
+  /** The directory a PLACE resolves to, on this machine's roots. */
+  const dirOfPlace = (place) => placePath({ repoRoot, baseDir }, place);
   /** The DIRECTORY a session works in. Every path that used to build
    *  `sessions/<id>` by hand goes through here, or a tab in the checkout gets
-   *  measured against a directory that does not exist. */
-  const placeDir = (sessionId) => {
-    const place = placeOf(sessionId);
-    return place === REPO_PLACE ? repoRoot : join(baseDir, 'sessions', place);
+   *  measured against a directory that does not exist. Null for a session id
+   *  that is not a safe segment and has learnt no place. */
+  const placeDir = (sessionId) => dirOfPlace(placeOf(sessionId));
+
+  /**
+   * THE BRANCH STANDING IN `wt` — what is actually checked out, not what we
+   * named it at birth — as `{ branch }`, or `{ detached: true }` when HEAD
+   * names no branch. A directory that is gone (a retired or closed tab) cannot
+   * be asked, so `fallback` is the answer: the one case where the recorded
+   * name is the only thing there is.
+   *
+   * Moved verbatim out of ship and the PR lane (audit 2026-10-10, F141), which
+   * spelled it twice so that "which branch would ship" and "which branch would
+   * open a PR" agreed only by hand.
+   */
+  const branchAt = (wt, fallback) => {
+    if (!existsSync(wt)) return { branch: fallback };
+    try {
+      return { branch: git(['symbolic-ref', '--short', 'HEAD'], wt) };
+    } catch {
+      return { detached: true };
+    }
   };
 
   /**
@@ -132,12 +199,11 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
       // caller may treat this as a newly-cut branch.
       return { wt: repoRoot, fresh: false };
     }
-    if (!isSafePathSegment(placeId)) return null;
-    const sessionId = placeId;
-    const wt = join(baseDir, 'sessions', sessionId);
+    const wt = worktreePath(baseDir, placeId);
+    if (!wt) return null;
     const fresh = !existsSync(wt);
     if (fresh) {
-      const branch = `session/${sessionId}`;
+      const branch = sessionBranch(placeId);
       // `baseAt` is the adoption override: a tab born from a terminal session
       // branches from THAT checkout's HEAD, because the conversation being
       // resumed was had against those commits — putting it on the project base
@@ -224,5 +290,5 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
     }
   };
 
-  return { sessionPlaces, placeOf, learnPlaces, placeDir, placeWtFor, sessionMetaPath };
+  return { placeOf, notePlace, learnPlaces, placeDir, branchAt, placeWtFor, sessionMetaPath };
 }