flowviant 0.116.0 → 0.117.0

package/bin/lib/config.mjs

@@ -69,6 +69,10 @@ function argFlag(name) {
  */
 const API_BASE = process.env.FLOWVIANT_API_URL || 'https://api.flowviant.com/api';
 export const MCP_URL = process.env.FLOWVIANT_MCP_URL || `${API_BASE}/mcp`;
+/** The web app a terminal view or a device login sends a person to. One
+ *  declaration (audit 2026-10-10, F753): login.mjs and views.mjs each held a
+ *  copy of this line. */
+export const APP_URL = process.env.FLOWVIANT_APP_URL || 'https://app.flowviant.com';
 export const FLEET_URL = process.env.FLOWVIANT_FLEET_URL || `${API_BASE}/fleet/agents`;
 // Push channel: the daemon holds this WebSocket open and the server nudges it
 // the instant a job lands, so dispatch is ~a round-trip instead of a full poll.
@@ -76,7 +80,6 @@ export const FLEET_URL = process.env.FLOWVIANT_FLEET_URL || `${API_BASE}/fleet/a
 export const STREAM_URL =
   process.env.FLOWVIANT_STREAM_URL ||
   FLEET_URL.replace(/\/agents(\/?)$/, '/stream$1').replace(/^http/, 'ws');
-export const POLL_SECONDS = Number(process.env.POLL_SECONDS || 20);
 
 // What this machine can actually be given — the cgroup's limits before the
 // host's. The rule and its reader live in machineLimits.mjs; this is the
@@ -147,16 +150,42 @@ export const MACHINE = measureMachineLimits();
  *    every agent. `cores * 2` lets the scheduler do what it is for, and memory
  *    stays the bound that actually refuses.
  *
- * `min(32, …)` and the env override are untouched: the hard 32 is a runaway
- * bound on a box, not a product decision, and an operator who typed a number at
- * the machine gets exactly that number.
+ * `min(TURN_CEILING_MAX, …)` and the env override are untouched: the hard 32 is
+ * a runaway bound on a box, not a product decision, and an operator who typed
+ * a number at the machine gets exactly that number.
  */
 export function deriveMaxConcurrent(memBytes, cores) {
   const byMem = Math.floor(memBytes / 2 ** 30 - 2);
   const byCpu = Number(cores) * 2;
-  return Math.max(1, Math.min(32, byMem, byCpu));
+  return Math.max(1, Math.min(TURN_CEILING_MAX, byMem, byCpu));
 }
 
+/**
+ * THE RUNAWAY BOUND ON TURNS AT ONCE, AND THE ONE READING OF A CEILING
+ * (2026-10-10, audit F070).
+ *
+ * Every author of the ceiling — the env var, the server's dial, the
+ * derivation and an admission's own read — goes through `clampTurnCeiling`,
+ * which was five hand copies of one rule across this file and admission.mjs:
+ * a usable ceiling is a finite number ≥ 1, floored and capped at
+ * `TURN_CEILING_MAX`; anything else is ABSENT (null), never 0 or NaN — a 0
+ * refuses every spawn forever, and `live >= NaN` is no ceiling at all.
+ *
+ * 32 is the server's own bound on the dial (`machineTurnsSchema.maxTurns`,
+ * `max(32)` in the shared agent-runner schema): the release parity gate
+ * (`scripts/check-app-parity.mjs`) holds this copy to it, so the app never
+ * stores a dial no machine honours, and no machine caps one it would.
+ */
+export const TURN_CEILING_MAX = 32;
+export function clampTurnCeiling(raw) {
+  const v = Number(raw);
+  return Number.isFinite(v) && v >= 1 ? Math.min(Math.floor(v), TURN_CEILING_MAX) : null;
+}
+
+/** The operator's `FLOWVIANT_MAX_CONCURRENT`, read once through the one clamp:
+ *  null when unset or unusable (the derivation stands). */
+const MAX_CONCURRENT_ASKED = clampTurnCeiling(process.env.FLOWVIANT_MAX_CONCURRENT);
+
 /**
  * WAS THE ENV VAR THE SOURCE? — the one fact the precedence rule cannot
  * reconstruct afterwards.
@@ -166,20 +195,10 @@ export function deriveMaxConcurrent(memBytes, cores) {
  * last word and must outrank the app's dial, the other is a default the app may
  * override. See `pickMaxTurns` in admission.mjs for what is done with it.
  */
-export const MAX_CONCURRENT_FROM_ENV = (() => {
-  const asked = Number(process.env.FLOWVIANT_MAX_CONCURRENT);
-  return Number.isFinite(asked) && asked >= 1;
-})();
+export const MAX_CONCURRENT_FROM_ENV = MAX_CONCURRENT_ASKED !== null;
 
-export const MAX_CONCURRENT = (() => {
-  const asked = Number(process.env.FLOWVIANT_MAX_CONCURRENT);
-  if (Number.isFinite(asked) && asked >= 1) return Math.min(Math.floor(asked), 32);
-  return deriveMaxConcurrent(MACHINE.memBytes, MACHINE.cores);
-})();
-export const IDLE_SECONDS = Number(process.env.IDLE_SECONDS || 30);
-// Live mode: after this long idle-parked on a blocker, tear the session down to
-// free the Claude process (the intent stays claimed; it resumes when answered).
-export const PARK_TIMEOUT_SECONDS = Number(process.env.PARK_TIMEOUT_SECONDS || 900);
+export const MAX_CONCURRENT =
+  MAX_CONCURRENT_ASKED ?? deriveMaxConcurrent(MACHINE.memBytes, MACHINE.cores);
 export const RECONCILE_SECONDS = Number(process.env.RECONCILE_SECONDS || 10);
 // Proactively refresh a worker token this many seconds before its lease lapses,
 // so a long-lived daemon never silently 401s on an expired token.
@@ -190,12 +209,6 @@ export const SAFE = process.env.FLOWVIANT_SAFE === '1';
 // keeps it nag-only (it still tells you to update, never installs). Below the
 // server's MIN version it updates regardless, since live mode won't work.
 export const AUTO_UPDATE = process.env.FLOWVIANT_NO_UPDATE !== '1';
-// Live mode (DEFAULT since 0.8.0): persistent Agent-SDK session per task —
-// streams into the task channel, injectable mid-task, blocker-parks in place,
-// delivery card on complete, branch preview tunnels. The legacy poll/sentinel
-// path (one-shot `claude -p` turns) survives behind FLOWVIANT_POLL=1 as the
-// escape hatch; FLOWVIANT_LIVE=1 is still honored for old scripts.
-export const LIVE = process.env.FLOWVIANT_POLL !== '1';
 // Sent on the daemon's own HTTP calls so Cloudflare Bot Fight Mode doesn't 403
 // them (Node's default UA is treated as a bot). Claude Code sends its own UA.
 export const USER_AGENT = `flowviant/${VERSION}`;

package/bin/lib/conversationIds.mjs

@@ -0,0 +1,51 @@
+/**
+ * WHICH CONVERSATION A TAB RESUMES — the shape each CLI's conversation id must
+ * have, and the marker each tab pins it under (audit 2026-10-10, F157).
+ *
+ * A LEAF ON PURPOSE: no imports. These regexes are argv-injection and
+ * path-traversal guards — an id rides argv as `--resume <id>`, `resume <id>`
+ * or `--conversation <id>`, and Claude's is joined into a transcript path the
+ * probe cleanup then REMOVES — and they were written out by hand: Claude's
+ * four times, Antigravity's twice. A CLI that changes its id format would
+ * have had someone loosen one copy and miss the one guarding `rmSync`. The
+ * readers (claudeSessions, agySessions, runtimeCapabilities, runtimeLimits)
+ * sit below the work lanes, so the shapes cannot live in a lane module.
+ *
+ * THE MARKER NAMES ARE HERE FOR THE SAME REASON. `workSessionTurns.mjs`
+ * WRITES them (`sessionMetaPath(wt, <name>, sessionId)`), workPlaceReports
+ * reads Claude's for the tab's title, and localSessions READS all of them to
+ * know which conversations are the daemon's own — a drift between the writer
+ * and that fence is silent, and offers somebody their own tab back as an
+ * adoptable terminal session.
+ */
+
+/**
+ * Claude Code's session id, as `system.init` reports it. Conservative: word
+ * characters and dash, 8–64 of them, so it can neither climb a path nor
+ * carry whitespace into argv.
+ */
+export const CLAUDE_SESSION_RE = /^[A-Za-z0-9_-]{8,64}$/;
+
+/**
+ * The shape a codex thread id must have before it is written to disk or —
+ * decisive — pushed into argv as `resume <id>`. Conservative on purpose:
+ * alphanumeric plus dash/underscore, never a leading dash (an argv that
+ * parses as a flag), never whitespace. Anything else is dropped and the
+ * session simply runs fresh in its own worktree.
+ */
+export const CODEX_THREAD_RE = /^[0-9a-zA-Z][0-9a-zA-Z_-]{7,63}$/;
+
+/** agy conversation ids are plain UUIDs (the db filename IS the identity —
+ *  measured: a renamed copy fails "trajectory not found"). Guarded the same
+ *  way as the codex id: it rides in argv as `--conversation <id>`. */
+export const AGY_CONV_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Each runtime's per-tab conversation marker (scoped by the session id). */
+export const RESUME_MARKERS = Object.freeze({
+  claude: 'flowviant-claude-session',
+  codex: 'flowviant-codex-thread',
+  antigravity: 'flowviant-agy-conversation',
+});
+
+/** Every tab's conversation marker — what the adopt fence reads back. */
+export const SESSION_MARKERS = Object.freeze(Object.values(RESUME_MARKERS));

package/bin/lib/credentials.mjs

@@ -44,7 +44,6 @@
  * mistake permanent.
  */
 
-import { execFileSync } from 'node:child_process';
 import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -52,6 +51,7 @@ import { printable } from './printable.mjs';
 import { connectedOn } from './credentialDate.mjs';
 import { terminalCommand } from './launchCommand.mjs';
 import { samePath } from './repoPath.mjs';
+import { git } from './git.mjs';
 
 const CRED_DIR = join(homedir(), '.flowviant');
 const CRED_FILE = join(CRED_DIR, 'credentials.json');
@@ -76,12 +76,7 @@ function writeFile(v) {
 /** The repo root of `cwd`, realpath'd, or null when not inside a git repo. */
 export function detectRepoRoot(cwd = process.cwd()) {
   try {
-    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], {
-      cwd,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 5000,
-    }).trim();
+    const root = git(['rev-parse', '--show-toplevel'], cwd, { stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
     return root ? realpathSync(root) : null;
   } catch {
     return null;

package/bin/lib/daemonLocks.mjs

@@ -0,0 +1,88 @@
+/**
+ * THE DAEMON LOCK FILE — its name, its record, and the one scan of them
+ * (audit 2026-10-10, F090/F123).
+ *
+ * instance.mjs arbitrates with these files; the status readout
+ * (daemonState.mjs, desktopContract.mjs) and `flowviant uninstall` only READ
+ * them. Each of those readers used to keep its own copy of the filename
+ * pattern or the record parse, and they had drifted: uninstall carried its own
+ * regex and pid read, the readout returned a pid that was not a positive
+ * integer, and `daemonRunningFor` re-implemented `readHolder` line for line. The
+ * FILENAME PATTERN is the thing that must not drift between them: it is what
+ * separates our locks from anything else living in ~/.flowviant, and a scan
+ * that stops matching sees an empty machine — so `uninstall --others` would
+ * remove the copy a live daemon runs from.
+ *
+ * A leaf (node builtins only), so a reader never has to load instance.mjs's
+ * takeover machinery to look at a file; instance.mjs re-exports all of it.
+ */
+
+import * as nodeFs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+/** Every daemon lock's file name: `daemon-` + 12 hex of the credential's hash. */
+export const DAEMON_LOCK_RE = /^daemon-[0-9a-f]{12}\.lock$/;
+
+/** Deliberately a HASH: a credential must never become a filename. */
+export function instanceLockPath(fleetToken, home = homedir()) {
+  const key = createHash('sha256').update(String(fleetToken || 'anon')).digest('hex').slice(0, 12);
+  return join(home, '.flowviant', `daemon-${key}.lock`);
+}
+
+/**
+ * A lock record, or null: absent, truncated, half-written, or naming no
+ * positive integer pid (a pid of '12' is not a pid). Everything else the
+ * record carries — repoRoot, startedAt, entry, version, draining — is the
+ * caller's to read; none of it is required.
+ */
+export function parseLockRecord(text) {
+  try {
+    const v = JSON.parse(text);
+    return v && Number.isInteger(v.pid) && v.pid > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The record in the lock file at `path`, or null (see parseLockRecord). */
+export function readLockFile(path, { fs = nodeFs } = {}) {
+  try {
+    return parseLockRecord(fs.readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** The record in this credential's lock, or null. */
+export function readLockHolder(fleetToken) {
+  return readLockFile(instanceLockPath(fleetToken));
+}
+
+/**
+ * Every daemon lock on this machine, sorted by name for a stable read:
+ * `[{ path, holder }]`, where `holder` is null for a file with no readable
+ * record (no caller reads that as a daemon). ONE scan, because three callers
+ * walk this directory for different reasons — instance.mjs looking for a
+ * neighbour in the same repo, `flowviant stop` sweeping the lot, uninstall
+ * protecting the copy a live daemon runs from. An unreadable (or absent)
+ * directory is not an error here, it is an empty machine. `fs` and `home` are
+ * injectable for uninstall's test seams.
+ */
+export function listDaemonLocks({ fs = nodeFs, home = homedir() } = {}) {
+  const dir = join(home, '.flowviant');
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  return names
+    .filter((name) => DAEMON_LOCK_RE.test(name))
+    .sort()
+    .map((name) => {
+      const path = join(dir, name);
+      return { path, holder: readLockFile(path, { fs }) };
+    });
+}

package/bin/lib/daemonState.mjs

@@ -13,7 +13,7 @@ import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { emitMachineEvent } from './daemonLogging.mjs';
-import { instanceLockPath } from './instance.mjs';
+import { readLockHolder } from './daemonLocks.mjs';
 
 const store = () => join(homedir(), '.flowviant');
 const key = (projectId) => createHash('sha256').update(String(projectId)).digest('hex').slice(0, 16);
@@ -56,9 +56,9 @@ export function setRuntimeLimit(projectId, runtime, words) {
   return true;
 }
 
-/** The pid in the instance lock for this credential, or null. */
+/** The pid in the instance lock for this credential, or null — read through
+ *  the lock's one record parse, so a pid that is not a positive integer is no
+ *  pid (2026-10-10, F090). */
 export function daemonLockPid(token) {
-  try {
-    return JSON.parse(readFileSync(instanceLockPath(token), 'utf8')).pid;
-  } catch { return null; }
+  return readLockHolder(token)?.pid ?? null;
 }

package/bin/lib/deploy.mjs

@@ -16,13 +16,13 @@
  *   - deployRunner.mjs    the commands, their environment and log scrubbing,
  *                         the health check (and why a deploy's secrets are
  *                         the machine's own environment)
- *   - deployWire.mjs      the one `/fleet/deploy-*` POST
+ *   - deployWire.mjs      the lane's `/fleet/deploy-*` wire (post, claim)
  */
 
 import { DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { scrub } from './uplinkScrub.mjs';
-import { post } from './deployWire.mjs';
+import { claim, post } from './deployWire.mjs';
 import { runDeploy } from './deployRunner.mjs';
 import { workLanesStopped } from './standDownGate.mjs';
 
@@ -99,16 +99,13 @@ export function processDeployJobs(jobs, ctx) {
     void (async () => {
       let beat = null;
       try {
-        // `instance` names THIS PROCESS. The pubkey cannot: it is the env
+        // `instance` names THIS PROCESS — the shared lease claim stamps it
+        // (fleetPost.mjs's `claimFleetLease`). The pubkey cannot: it is the env
         // keypair read from one file per home directory, so two daemons on one
         // box share it and a pubkey-only read-back let both "win" the claim
         // and run the same deploy twice concurrently.
-        const claimed = await post('deploy-claim', {
-          jobId: job.id,
-          pubkey: ctx.myPubB64(),
-          instance: DAEMON_INSTANCE,
-        }).catch(() => null);
-        if (!claimed?.claimed) return; // another daemon won the claim
+        const claimed = await claim('deploy-claim', { jobId: job.id, pubkey: ctx.myPubB64() });
+        if (!claimed) return; // another daemon won the claim, or none was made
         /**
          * A CLAIM THAT COMES BACK AFTER THE STAND-DOWN BEGAN IS NOT RUN. The
          * loop gate cannot see it (the claim was already on the wire), and the

package/bin/lib/deployCheckout.mjs

@@ -22,9 +22,12 @@ import {
   symlinkSync,
   unlinkSync,
 } from 'node:fs';
-import { homedir } from 'node:os';
-import { basename, isAbsolute, join, relative, sep } from 'node:path';
+import { isAbsolute, join, relative, sep } from 'node:path';
 import { git, gitNetAsync } from './git.mjs';
+import { worktreeHomeDir } from './statePaths.mjs';
+// WHICH FILES ARE ENV FILES has one home, beside the report's own narrower
+// rule; that block says why the two differ (2026-10-10, the audit's F085).
+import { isCheckoutEnvFile } from './env.mjs';
 
 /**
  * A DEPLOY BUILDS THE BASE COMMIT, NEVER THE OPERATOR'S WORKING TREE
@@ -60,7 +63,6 @@ import { git, gitNetAsync } from './git.mjs';
  * a workspace package's own CLI still runs from the checkout. Submodules are
  * not initialised. The code and the commands no longer come from the checkout.
  */
-const ENV_FILE_RE = /^(?:\.env(?:\..+)?|\.dev\.vars)$/;
 const lexists = (p) => {
   try {
     lstatSync(p);
@@ -71,11 +73,15 @@ const lexists = (p) => {
 };
 
 /** Bring the checkout's untracked environment into a deploy worktree. Returns
- *  every path it created, so the cleanup can unlink them BEFORE the worktree
- *  is removed (a recursive delete must never be handed a symlink into the
- *  operator's own node_modules). */
+ *  `{ made, envFiles }`: `made` is every path it created, so the cleanup can
+ *  unlink them BEFORE the worktree is removed (a recursive delete must never
+ *  be handed a symlink into the operator's own node_modules); `envFiles` is
+ *  every env file it COPIED (2026-10-10, the audit's F085), so the deploy lane
+ *  can teach the scrubber the values its own build is about to be able to
+ *  print — nested files the root-only env scan never reads. */
 export function linkCheckoutEnvironment(repoRoot, dir) {
   const made = [];
+  const envFiles = [];
   let realRoot = repoRoot;
   try {
     realRoot = realpathSync(repoRoot);
@@ -149,11 +155,12 @@ export function linkCheckoutEnvironment(repoRoot, dir) {
         if (e.isDirectory() && !lexists(dst)) linkNodeModules(src, dst, 0);
         continue;
       }
-      if (e.isFile() && ENV_FILE_RE.test(e.name)) {
+      if (e.isFile() && isCheckoutEnvFile(e.name)) {
         if (!lexists(dst)) {
           try {
             copyFileSync(src, dst);
             made.push(dst);
+            envFiles.push(dst);
           } catch {
             /* unreadable — the build says so if it needed it */
           }
@@ -168,15 +175,18 @@ export function linkCheckoutEnvironment(repoRoot, dir) {
     }
   };
   walk('', 0);
-  return made;
+  return { made, envFiles };
 }
 
 /**
- * Cut the deploy worktree at the base tip. Returns `{ dir, sha, cleanup }`, or
+ * Cut the deploy worktree at the base tip. Returns `{ dir, sha, cleanup,
+ * envFiles }` (`envFiles`: the env files copied in — see
+ * `linkCheckoutEnvironment`), or
  * throws with a sentence when base does not resolve. `worktreeDir` defaults to
- * the daemon's own worktree home for this repo (fleetStartup.mjs keys it the same
- * way); the job id is hashed into the path, never joined raw — it is a
- * server-named string.
+ * the daemon's own worktree home for this repo — statePaths.mjs's one
+ * derivation, the same one fleetStartup.worktreeHome makes and reaps — and the
+ * deploy lane relies on that default rather than passing it; the job id is
+ * hashed into the path, never joined raw — it is a server-named string.
  */
 export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir }) {
   if (!baseRef) throw new Error('no base branch resolved, so there is nothing to deploy from');
@@ -195,14 +205,7 @@ export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir
   } catch {
     throw new Error(`the base branch ${baseRef} does not resolve on this machine`);
   }
-  const home =
-    worktreeDir ??
-    join(
-      homedir(),
-      '.flowviant',
-      'worktrees',
-      `${basename(repoRoot)}-${createHash('sha256').update(repoRoot).digest('hex').slice(0, 8)}`
-    );
+  const home = worktreeDir ?? worktreeHomeDir(repoRoot);
   const dir = join(home, 'deploy', createHash('sha256').update(String(jobId)).digest('hex').slice(0, 16));
   mkdirSync(join(home, 'deploy'), { recursive: true });
   const drop = (made = [], target = dir) => {
@@ -256,10 +259,11 @@ export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir
   }
   git(['worktree', 'add', '--detach', dir, sha], repoRoot);
   let made = [];
+  let envFiles = [];
   try {
-    made = linkCheckoutEnvironment(repoRoot, dir);
+    ({ made, envFiles } = linkCheckoutEnvironment(repoRoot, dir));
   } catch {
     /* the build says so if it needed any of it */
   }
-  return { dir, sha, cleanup: () => drop(made) };
+  return { dir, sha, envFiles, cleanup: () => drop(made) };
 }

package/bin/lib/deployRunner.mjs

@@ -61,19 +61,35 @@
  * files, and this box's shell is not one). Deriving the redaction list from the
  * admission list is what stops the two drifting the next time a name is added.
  *
- * The honest residue, stated: a credential that is neither in `DEPLOY_KEEP` nor
- * in a checkout `.env*` — one a `build` script fetches for itself, say — is not
+ * AND THE NESTED ENV FILES THIS DAEMON COPIES IN ITSELF (2026-10-10, the
+ * audit's F085). The root scan reads only the checkout root's `.env*`
+ * (env.mjs states that limit), while `openDeployCheckout` copies every
+ * `.env*` and `.dev.vars` from tracked directories three levels deep into the
+ * worktree the build runs in — `apps/api/.dev.vars` among them — so a build
+ * that printed its config relayed values the scrubber had never been told.
+ * The checkout now reports which files it copied, and `runDeploy` teaches the
+ * scrubber their values for that job's life only (`learnExtraSecrets`), then
+ * forgets them with the worktree. The root-only report scan is unchanged.
+ * Well-known vendor token SHAPES are redacted too (uplinkScrub.mjs).
+ *
+ * The honest residue, stated: a credential that is in none of those — one a
+ * `build` script fetches for itself, say, in a shape nobody listed — is not
  * redacted, because this daemon has never seen it.
  */
 
 import { spawn } from 'node:child_process';
-import { scrub } from './uplinkScrub.mjs';
+import { forgetExtraSecrets, learnExtraSecrets, scrubTail } from './uplinkScrub.mjs';
 import { childEnv } from './childEnv.mjs';
 import { readDeployConfig } from './deployConfig.mjs';
 import { openDeployCheckout } from './deployCheckout.mjs';
+import { readEnvFileValues } from './env.mjs';
+import { killGroup } from './processGroup.mjs';
 
 /** How long one deploy command may run before it is stopped. */
 const DEPLOY_COMMAND_TIMEOUT_MS = 30 * 60_000;
+/** How much of a command's output is kept — a memory bound; only the tail is
+ *  ever read (`tailLines`, the version id). */
+const DEPLOY_OUTPUT_KEEP = 512 * 1024;
 
 /** Run a shell command ASYNC (never blocks the daemon's event loop — the
  *  reconcile poll + the deploy heartbeat must keep firing during a long
@@ -88,7 +104,8 @@ const DEPLOY_COMMAND_TIMEOUT_MS = 30 * 60_000;
  *  `deploysInFlight` holding off every self-update). Measured: `sleep 30 &
  *  wait` held the job past its timeout. So the command runs as its own process
  *  group (the shape `gitNetAsync` in git.mjs and the project check in
- *  workAgentCheck.mjs already use), the timer kills the group, and the timer
+ *  workAgentCheck.mjs already use), the timer kills the group (`killGroup`,
+ *  processGroup.mjs — one home since 2026-10-10), and the timer
  *  itself resolves rather than waiting on a pipe a survivor could still hold.
  *  The output gains one line saying so, which reaches the server in the
  *  report's `message` — a relayed fact, not a new wire field.
@@ -131,27 +148,40 @@ export function run(command, { cwd, env, timeoutMs = DEPLOY_COMMAND_TIMEOUT_MS }
       clearTimeout(timer);
       resolve(v);
     };
+    /**
+     * SCRUBBED BEFORE IT IS CUT (2026-10-10, the audit's F143) — workAgentCheck's
+     * order. This used to keep the last 512 KB per chunk and scrub only at
+     * settle, so a secret straddling the window's edge was cut first and its
+     * surviving half matched nothing. Now the window is cut only from text
+     * that has been scrubbed whole (`scrubTail`); a secret still arriving at
+     * the END of the buffer is not cut, and the next scrub sees it whole.
+     *
+     * Amortised rather than per chunk, unlike the check's 4000-character tail:
+     * re-scrubbing a 512 KB buffer on every small write of a chatty build is
+     * quadratic, so the buffer may grow to twice the window before it is
+     * scrubbed and cut. The settle-time scrub stays as the second pass over
+     * what ships.
+     *
+     * A DECODER PER STREAM: `setEncoding` hands whole characters, where
+     * `d.toString()` split a multi-byte character across two chunks into
+     * replacement characters — and a secret holding one could then never
+     * match.
+     */
     const cap = (d) => {
-      buf += d.toString();
-      if (buf.length > 512 * 1024) buf = buf.slice(-512 * 1024); // bound memory
+      buf += d;
+      if (buf.length > 2 * DEPLOY_OUTPUT_KEEP) buf = scrubTail(buf, DEPLOY_OUTPUT_KEEP);
     };
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
     child.stdout.on('data', cap);
     child.stderr.on('data', cap);
     const timer = setTimeout(() => {
-      try {
-        process.kill(-child.pid, 'SIGKILL'); // the whole group
-      } catch {
-        try {
-          child.kill('SIGKILL');
-        } catch {
-          /* already gone */
-        }
-      }
+      killGroup(child, 'SIGKILL'); // the whole group
       const limit = timeoutMs >= 60_000 ? `${Math.round(timeoutMs / 60_000)} minutes` : `${timeoutMs}ms`;
       settle({
         ok: false,
         code: -1,
-        out: scrub(`${buf}\n[flowviant] the command ran past ${limit} and was stopped`),
+        out: scrubTail(`${buf}\n[flowviant] the command ran past ${limit} and was stopped`, DEPLOY_OUTPUT_KEEP),
       });
     }, timeoutMs);
     // A broken pipe (a child that exits before its stdin is closed) surfaces as
@@ -166,10 +196,10 @@ export function run(command, { cwd, env, timeoutMs = DEPLOY_COMMAND_TIMEOUT_MS }
     child.stdin.on('error', () => {});
     child.stdin.end();
     child.on('close', (code) => {
-      settle({ ok: code === 0, code: code ?? -1, out: scrub(buf) });
+      settle({ ok: code === 0, code: code ?? -1, out: scrubTail(buf, DEPLOY_OUTPUT_KEEP) });
     });
     child.on('error', (e) => {
-      settle({ ok: false, code: -1, out: scrub(`${buf}\n${e.message}`) });
+      settle({ ok: false, code: -1, out: scrubTail(`${buf}\n${e.message}`, DEPLOY_OUTPUT_KEEP) });
     });
   });
 }
@@ -203,7 +233,12 @@ export async function runDeploy(job, ctx) {
   } catch (e) {
     return { ok: false, message: `deploy not run — ${e.message}`, logs: [] };
   }
+  // THE FILES THIS JOB COPIED IN, TAUGHT TO THE SCRUBBER FOR ITS LIFE ONLY
+  // (2026-10-10, the audit's F085) — see the header. Keyed per job, so two
+  // deploys never forget each other's.
+  const secretsKey = `deploy:${job.id}`;
   try {
+    learnExtraSecrets(secretsKey, (checkout.envFiles ?? []).flatMap((f) => readEnvFileValues(f)));
     const targets = readDeployConfig(ctx.repoRoot, checkout.sha);
     const target = targets.find((t) => t.id === job.targetId);
     if (!target) {
@@ -213,6 +248,7 @@ export async function runDeploy(job, ctx) {
     const short = checkout.sha.slice(0, 12);
     return { ...outcome, sha: checkout.sha, message: `${outcome.message} (${short})` };
   } finally {
+    forgetExtraSecrets(secretsKey); // first: it cannot throw, and the cleanup can
     checkout.cleanup();
   }
 }

package/bin/lib/deployWire.mjs

@@ -1,41 +1,50 @@
 /**
- * THE DEPLOY LANE'S ONE POST — `/fleet/deploy-*`, with the machine credential.
+ * THE DEPLOY LANE'S WIRE — `/fleet/deploy-*`, with the machine credential.
  *
  * Split out of deploy.mjs (SOLID F060) because two halves of the lane speak
  * it: the config report (deployConfig.mjs) and the job lease (deploy.mjs —
  * claim, heartbeat, outcome). A leaf, so neither has to import the other to
- * reach the wire, and a change to how the lane authenticates or times out is
- * one edit.
+ * reach the wire.
+ *
+ * The request itself is fleetPost.mjs's (audit 2026-10-10, F082): this was a
+ * byte-identical copy of `postToFleet`'s skeleton that differed only in what it
+ * returned. What stays here is the lane's own CONTRACT over that request — a
+ * throw on anything but an accepted answer, carrying whether it was the API's
+ * own refusal of the credential — and the lane's 30-second ceiling.
  */
 
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
-import { isCredentialRejection } from './authReject.mjs';
+import { claimFleetLease, fleetRequest } from './fleetPost.mjs';
 
 const deployUrl = (tail) => fleetEndpoint(tail, FLEET_URL);
+const DEPLOY_TIMEOUT_MS = 30_000;
 
+/** POST to `/fleet/<tail>` and return the reply's `data`. A network error or
+ *  timeout is rethrown as `fetch` threw it; a refusal (a non-2xx, or a 2xx
+ *  saying `success: false`) throws an Error carrying `status` and
+ *  `credentialRejected`. */
 export async function post(tail, body) {
-  const res = await fetch(deployUrl(tail), {
-    method: 'POST',
-    headers: {
-      Authorization: `Bearer ${FLEET_TOKEN}`,
-      'User-Agent': USER_AGENT,
-      'Content-Type': 'application/json',
-    },
-    signal: AbortSignal.timeout(30_000),
-    body: JSON.stringify(body),
-  });
-  const json = await res.json().catch(() => ({}));
-  if (!res.ok || json?.success === false) {
+  const r = await fleetRequest(deployUrl(tail), { body, timeoutMs: DEPLOY_TIMEOUT_MS });
+  if (r.error) throw r.error;
+  const json = r.json;
+  if (!r.ok || json?.success === false) {
     // The sentence is unchanged. What rides beside it is whether this was the
     // API's OWN refusal of the credential (a Disconnect rotates it, even
-    // mid-deploy) — authReject.mjs's one rule, never the bare status: an edge
-    // 401/403 (Cloudflare's bot checks, which this client class trips) is a
-    // blip and is retried like any other failed post.
-    const e = new Error(`${tail} failed (${res.status}${json?.error ? `: ${json.error}` : ''})`);
-    e.status = res.status;
-    e.credentialRejected = isCredentialRejection(res.status, res.headers.get('content-type'), json);
+    // mid-deploy) — authReject.mjs's one rule, asked by fleetRequest, never
+    // the bare status: an edge 401/403 (Cloudflare's bot checks, which this
+    // client class trips) is a blip and is retried like any other failed post.
+    const e = new Error(`${tail} failed (${r.status}${json?.error ? `: ${json.error}` : ''})`);
+    e.status = r.status;
+    e.credentialRejected = r.credentialRejected;
     throw e;
   }
   return json?.data;
 }
+
+/** Claim a deploy job — the shared lease rule (fleetPost.mjs's
+ *  `claimFleetLease`: this process's `instance` stamped, the winner read from
+ *  `data.claimed`, any failure "not claimed"), on this lane's ceiling. */
+export function claim(tail, fields) {
+  return claimFleetLease(deployUrl(tail), fields, { timeoutMs: DEPLOY_TIMEOUT_MS });
+}