flowviant 0.116.0 → 0.117.0

package/bin/lib/knowledgeFiles.mjs

@@ -20,7 +20,15 @@ import {
   unlinkSync,
 } from 'node:fs';
 import { join } from 'node:path';
-import { isCurrent, localSha, syncVerifiedFile, writeAtomic } from './knowledgeFileSync.mjs';
+import {
+  isCurrent,
+  localSha,
+  recordSyncState,
+  syncVerifiedFile,
+  writeAtomic,
+  writeTextIfChanged,
+} from './knowledgeFileSync.mjs';
+import { ensureOwnDir, flowviantParentState, realDirState } from './ownedDirs.mjs';
 import {
   INSTRUCTIONS_FILE,
   KNOWLEDGE_DIR,
@@ -50,29 +58,15 @@ const MARKER = '.flowviant/knowledge.rev';
  * So the parent is checked, never repaired.
  */
 function flowviantDirOk(checkoutDir) {
-  try {
-    const st = lstatSync(join(checkoutDir, '.flowviant'));
-    return st.isDirectory() && !st.isSymbolicLink();
-  } catch {
-    return true; // absent — ours to create
-  }
+  // Absent is ours to create; the three states are ownedDirs.mjs's (2026-10-10).
+  return flowviantParentState(checkoutDir) !== 'other';
 }
 
 /** The library directory, as a real directory. The PARENT is checked by the
  *  caller; the library path itself is OURS, so a symlink or a file planted
- *  there is removed (unlinked — the link, never its target) rather than
- *  followed. */
-function ensureDir(checkoutDir) {
-  const dir = join(checkoutDir, KNOWLEDGE_DIR);
-  try {
-    const st = lstatSync(dir);
-    if (st.isSymbolicLink() || !st.isDirectory()) unlinkSync(dir);
-  } catch {
-    /* absent */
-  }
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
+ *  there is removed (the link, never its target) rather than followed —
+ *  `ensureOwnDir`, ownedDirs.mjs. */
+const ensureDir = (checkoutDir) => ensureOwnDir(join(checkoutDir, KNOWLEDGE_DIR));
 
 /**
  * THE MARKER SAYS WHICH REV WAS WRITTEN, AND WHETHER THE LIBRARY WAS PART OF
@@ -109,6 +103,10 @@ export function knowledgeMarkerHasLibrary(checkoutDir) {
 }
 
 export function writeKnowledgeMarker(checkoutDir, rev, lib = false) {
+  // The sync's own parent rule, here too (2026-10-10, the audit's F100): its
+  // one caller runs after a sync that refused a linked `.flowviant`, but the
+  // marker is a write, and a write checks for itself.
+  if (!flowviantDirOk(checkoutDir)) return;
   try {
     mkdirSync(join(checkoutDir, '.flowviant'), { recursive: true });
     writeAtomic(join(checkoutDir, MARKER), `${rev}${lib ? ':lib' : ''}\n`);
@@ -120,17 +118,7 @@ export function writeKnowledgeMarker(checkoutDir, rev, lib = false) {
 
 /** A library subdirectory as a real directory — ours, like the library's own
  *  path: a symlink or a file planted there is removed, never followed. */
-function ensureSubdir(dir, name) {
-  const path = join(dir, name);
-  try {
-    const st = lstatSync(path);
-    if (st.isSymbolicLink() || !st.isDirectory()) unlinkSync(path);
-  } catch {
-    /* absent */
-  }
-  mkdirSync(path, { recursive: true });
-  return path;
-}
+const ensureSubdir = (dir, name) => ensureOwnDir(join(dir, name));
 
 function ensureLibraryParents(dir, relativePath) {
   const parts = relativePath.split('/');
@@ -231,34 +219,19 @@ export async function syncKnowledge({ checkoutDir, manifest, fetchFile, maxBytes
       maxBytes: knowledgeMaxFor(f.name, maxBytes),
       fetch: () => fetchFile(f.id),
     });
-    if (state === 'refused') {
+    // Stale or failed clears `ok` and is retried (a stale file is better than
+    // a missing one until the retry lands); a refusal is listed as one.
+    if (recordSyncState(result, state, f.local) === 'refused') {
       // Permanent for this rev, and NOT a reason to delete the rest. Any stale
       // local copy under this name goes, because it is not the file the
       // manifest now names.
-      result.refused.push(f.local);
       keep.delete(f.local);
-    } else if (state === 'wrote') {
-      result.wrote.push(f.local);
-    } else if (!isCurrent(state)) {
-      // A stale file is better than a missing one until the retry lands.
-      result.ok = false;
-      result.failed.push(f.local);
     }
   }
 
   if (instructions) {
-    const path = join(dir, INSTRUCTIONS_FILE);
     const body = instructions.endsWith('\n') ? instructions : `${instructions}\n`;
-    let same = false;
-    try {
-      same = lstatSync(path).isFile() && readFileSync(path, 'utf8') === body;
-    } catch {
-      /* absent */
-    }
-    if (!same) {
-      writeAtomic(path, body);
-      result.wrote.push(INSTRUCTIONS_FILE);
-    }
+    if (writeTextIfChanged(join(dir, INSTRUCTIONS_FILE), body)) result.wrote.push(INSTRUCTIONS_FILE);
   }
 
   if (library !== null) {
@@ -329,16 +302,10 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
       fetch: () => fetchFile(it.id, { library: true }),
       beforeWrite: () => ensureLibraryParents(dir, it.path),
     });
-    if (entryState === 'refused') {
-      result.refused.push(it.path);
+    if (recordSyncState(result, entryState, it.path) === 'refused') {
       wanted[sub].delete(file);
       continue;
     }
-    if (entryState === 'wrote') result.wrote.push(it.path);
-    else if (!isCurrent(entryState)) {
-      result.ok = false;
-      result.failed.push(it.path);
-    }
     let complete = isCurrent(entryState);
     // THE PREVIEW: measured by the server, ours to cap — an oversized one is
     // a failure to retry, never a refusal. Not required for the catalog: the
@@ -353,11 +320,7 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
         fetch: () => fetchFile(it.id, { library: true, preview: true }),
         beforeWrite: () => ensureLibraryParents(dir, it.previewPath),
       });
-      if (previewState === 'wrote') result.wrote.push(it.previewPath);
-      else if (!isCurrent(previewState)) {
-        result.ok = false;
-        result.failed.push(it.previewPath);
-      }
+      recordSyncState(result, previewState, it.previewPath);
     }
     // THE BUNDLE'S SIDECARS are REQUIRED: a design whose model failed to land
     // is not a complete current design, so it is not catalogued as one. The hash
@@ -375,14 +338,7 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
         fetch: () => fetchFile(it.id, { library: true, fileIndex: f.index }),
         beforeWrite: () => ensureLibraryParents(dir, f.path),
       });
-      if (fileState === 'refused') {
-        result.refused.push(f.path);
-        wanted[sub].delete(rel);
-      } else if (fileState === 'wrote') result.wrote.push(f.path);
-      else if (!isCurrent(fileState)) {
-        result.ok = false;
-        result.failed.push(f.path);
-      }
+      if (recordSyncState(result, fileState, f.path) === 'refused') wanted[sub].delete(rel);
       // A REFUSED sidecar is permanent for this rev and said in `refused`, the
       // way `libraryStale` already stops expecting it — blocking the catalog on
       // it would leave LIBRARY.md missing and re-sync the rev every poll.
@@ -401,17 +357,7 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
   const catalog = renderLibraryCatalog(onDisk);
   if (catalog) {
     keep.add(LIBRARY_FILE);
-    const path = join(dir, LIBRARY_FILE);
-    let same = false;
-    try {
-      same = lstatSync(path).isFile() && readFileSync(path, 'utf8') === catalog;
-    } catch {
-      /* absent */
-    }
-    if (!same) {
-      writeAtomic(path, catalog);
-      result.wrote.push(LIBRARY_FILE);
-    }
+    if (writeTextIfChanged(join(dir, LIBRARY_FILE), catalog)) result.wrote.push(LIBRARY_FILE);
   }
 }
 
@@ -474,8 +420,7 @@ export function libraryStale(checkoutDir, manifest, { synced, refused }) {
       let parent = dir;
       for (const part of p.slice(dir.length + 1).split('/').slice(0, -1)) {
         parent = join(parent, part);
-        const st = lstatSync(parent);
-        if (st.isSymbolicLink() || !st.isDirectory()) return false;
+        if (realDirState(parent) !== 'dir') return false;
       }
       return lstatSync(p).isFile();
     } catch {

package/bin/lib/landed.mjs

@@ -23,16 +23,16 @@
  * report nothing — ignorance is never turned into a state.
  */
 
-import { execFileSync } from 'node:child_process';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
-import { git, baseBranchName } from './git.mjs';
+import { git, baseBranchName, GIT_WIDE_BUFFER, OBJECT_ID_RE } from './git.mjs';
 import { commitRecord, stripDelims, taskIdsFromMessage } from './worktreeDiff.mjs';
 import { warn } from './ui.mjs';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { fleetEndpoint } from './fleetWire.mjs';
+import { FLEET_URL } from './config.mjs';
+import { fleetEndpoint, isConsideredRefusal, isNotNow } from './fleetWire.mjs';
+import { postFleetJson } from './fleetPost.mjs';
 
 const LANDED_URL = fleetEndpoint('base-landed', FLEET_URL);
 /** The server accepts 50 per report. A bigger range walks OLDEST-FIRST in
@@ -40,11 +40,15 @@ const LANDED_URL = fleetEndpoint('base-landed', FLEET_URL);
  *  so the remainder is picked up on the next beat rather than skipped forever
  *  — a trailered card in commit 51 of a big catch-up still closes. */
 const MAX_COMMITS = 50;
-const SHA_RE = /^[0-9a-f]{7,64}$/i;
+/** The shape a tip or a walked sha must have — git.mjs's named object-id
+ *  shape (7–64 hex, either case), the one this module always used. */
+const SHA_RE = OBJECT_ID_RE;
 
 export function createLandedObserver({ repoRoot, baseRef }) {
-  // Keyed like the worktree base dir: one state file per checkout, so two
-  // repos on one box never share a tip.
+  // One state file per checkout, so two repos on one box never share a tip.
+  // Its own 8-hex key — NOT the worktree home's `<basename>-<8 hex>`
+  // (statePaths.mjs) — and it stays as it is, so a persisted tip is never
+  // orphaned by a rename.
   const key = createHash('sha256').update(String(repoRoot)).digest('hex').slice(0, 8);
   const stateFile = join(homedir(), '.flowviant', `landed-${key}.json`);
   let unsupported = false; // 404 once → an older server; quiet until restart
@@ -79,16 +83,10 @@ export function createLandedObserver({ repoRoot, baseRef }) {
   /** git with the buffer the WALK needs. git.mjs's call takes execFileSync's
    *  default 1MiB cap, and a catch-up range's `%B` bodies blew through it —
    *  the throw landed in the reseed catch below, which skipped the whole range
-   *  and silently lost every trailer in it. 8MB is repoState's number for the
-   *  same reason; rev-list output at 41 bytes a commit clears ~200k commits
-   *  before it matters. */
-  const gitWide = (args) =>
-    execFileSync('git', args, {
-      cwd: repoRoot,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-      maxBuffer: 8 * 1024 * 1024,
-    }).trim();
+   *  and silently lost every trailer in it. GIT_WIDE_BUFFER (8MB, git.mjs) is
+   *  the shared number for the same reason; rev-list output at 41 bytes a
+   *  commit clears ~200k commits before it matters. */
+  const gitWide = (args) => git(args, repoRoot, { maxBuffer: GIT_WIDE_BUFFER });
 
   /** New non-merge commits in from..to, OLDEST FIRST — the next batch of at
    *  most MAX_COMMITS, plus the tip the state should advance to when the range
@@ -175,16 +173,11 @@ export function createLandedObserver({ repoRoot, baseRef }) {
     const reportedTip = walked.tipAfter ?? tip;
     inFlight = true;
     try {
-      const res = await fetch(LANDED_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(20_000),
-        body: JSON.stringify({ base: baseBranchName(ref), tip: reportedTip, commits }),
-      });
+      const res = await postFleetJson(
+        LANDED_URL,
+        { base: baseBranchName(ref), tip: reportedTip, commits },
+        { timeoutMs: 20_000 }
+      );
       if (res.status === 404) {
         unsupported = true;
         return;
@@ -201,14 +194,14 @@ export function createLandedObserver({ repoRoot, baseRef }) {
         for (const r of j?.data?.deployRefused ?? []) {
           warn(`deploy-on-merge refused for target "${r?.targetId}": ${r?.reason}`);
         }
-      } else if (res.status === 408 || res.status === 429) {
+      } else if (isNotNow(res.status)) {
         // A TIMEOUT OR A RATE LIMIT IS "NOT NOW", NOT "NEVER". Both used to
         // land in the drop below, so one 429 — a busy operator IP past the
         // limiter — skipped the range for good: its trailers and receipt shas
         // never closed their cards (in PR mode the observer is the ONLY road
         // to Done) and deploy-on-merge for that tip was never queued. Keep the
         // stored tip, exactly as a 5xx does; the next beat re-walks it.
-      } else if (res.status >= 400 && res.status < 500) {
+      } else if (isConsideredRefusal(res.status)) {
         // A persistent 4xx (deploy skew, a payload this server refuses) would
         // otherwise re-send the same poison range on every beat forever.
         // Drop THIS BATCH — to `reportedTip`, the last commit it carried, never

package/bin/lib/launchCommand.mjs

@@ -1,4 +1,6 @@
+import { spawn as nodeSpawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { terminalForeground } from './tty.mjs';
 
 /** The updater and terminal advice share one detection of the launch channel. */
 export function runningViaNpx() {
@@ -13,6 +15,17 @@ export function runningViaNpx() {
   return /\bnpx\b/.test(ua) || /[\\/]_npx[\\/]/.test(argv1) || /[\\/]_npx[\\/]/.test(self);
 }
 
+/** Bun marks compiled entrypoints with a virtual /$bunfs/ script path. */
+export function runningCompiledBinary() {
+  return Boolean(process.versions.bun && process.argv[1]?.startsWith('/$bunfs/'));
+}
+
+/** How this copy was installed — the tray's `installChannel` and the updater's
+ *  branch read the same answer. */
+export function installChannel() {
+  return runningCompiledBinary() ? 'binary' : runningViaNpx() ? 'npx' : 'npm-g';
+}
+
 /** Name the command that launched this process when giving a person a next step. */
 export function launchCommand() {
   return 'flowviant';
@@ -21,3 +34,81 @@ export function launchCommand() {
 export function terminalCommand(args = '') {
   return `${launchCommand()}${args ? ` ${args}` : ''}`;
 }
+
+/**
+ * The argv that starts THIS flowviant again with `args`: the script path under
+ * node (`process.execPath` is node), nothing under the compiled binary (where
+ * `process.execPath` IS flowviant and argv[1] is Bun's virtual /$bunfs/ path).
+ */
+export function selfArgv(args = []) {
+  return [...(runningCompiledBinary() ? [] : [process.argv[1]]), ...args];
+}
+
+/** The signals a relaunch proxy passes on to the process it stands in for. */
+export const RELAY_SIGNALS = Object.freeze(['SIGINT', 'SIGTERM', 'SIGHUP']);
+
+/**
+ * RELAUNCH, AND STAND IN FOR THE CHILD UNTIL IT EXITS (2026-10-10, F068/F124).
+ *
+ * Four paths restart flowviant as a child and keep this process alive as a
+ * thin foreground proxy, so the person's shell (or the tray, or a service
+ * manager) keeps watching one process: login then start, the start path's
+ * inline login, the Bun PATH adoption (loginPath.mjs) and the self-update
+ * (update.mjs). They were four hand copies, and only one of them passed
+ * signals on or reported a signal death as a failure.
+ *
+ * EXIT `status ?? (signal ? 1 : 0)`. A child killed by a signal (the OOM
+ * killer, a SIGKILL) is a FAILURE: the daemon's exit codes are argued against
+ * `Restart=on-failure` (holder.mjs, fleet.mjs — 0 means asked for, nonzero
+ * means relaunch), and a proxy that read a killed successor as 0 left the
+ * machine dark after any auto-update.
+ *
+ * SIGINT, SIGTERM AND SIGHUP REACH THE CHILD. A tray or supervisor that
+ * signals only this pid would otherwise leave the child running orphaned. Every
+ * listener already on those signals is removed first: on the self-update path
+ * the fleet's own handlers are still attached, and they would run a second
+ * stand-down and exit here without ever telling the child.
+ *
+ * …EXCEPT A Ctrl+C THE TERMINAL ALREADY DELIVERED. The child shares this
+ * process group, so when this proxy is MEASURED in its terminal's foreground
+ * group, a terminal SIGINT reached the child directly; relaying it as well
+ * would be a SECOND Ctrl+C, which the daemon reads as "leave now, without the
+ * deploy's outcome" (standDownExit.mjs). No terminal, a background job, or an
+ * unknown answer relays it. SIGTERM and SIGHUP are always relayed: a repeated
+ * SIGTERM changes nothing in the daemon, and SIGHUP ends it on the first.
+ *
+ * Every seam is injectable for the tests; nothing in the daemon passes them.
+ */
+export function relaunchSelf({
+  cmd = process.execPath,
+  argv,
+  env = process.env,
+  cwd,
+  forwardSignals = true,
+  spawn = nodeSpawn,
+  exit = (code) => process.exit(code),
+  signals = process,
+  terminalDelivers = () => terminalForeground() === true,
+} = {}) {
+  const child = spawn(cmd, argv, { stdio: 'inherit', env, ...(cwd ? { cwd } : {}) });
+  if (forwardSignals) {
+    for (const signal of RELAY_SIGNALS) {
+      signals.removeAllListeners(signal);
+      signals.on(signal, () => {
+        if (signal === 'SIGINT' && terminalDelivers()) return;
+        try {
+          child.kill(signal);
+        } catch {
+          /* gone */
+        }
+      });
+    }
+  }
+  return new Promise((resolve) => {
+    child.on('exit', (status, signal) => {
+      const code = status ?? (signal ? 1 : 0);
+      exit(code);
+      resolve(code);
+    });
+  });
+}

package/bin/lib/listeners.mjs

@@ -449,11 +449,6 @@ export function measureListeners(worktree, io) {
   };
 }
 
-/** The capped rows alone, for callers with nowhere to put a total. */
-export function listenersIn(worktree) {
-  return measureListeners(worktree).rows;
-}
-
 /** Does this platform measure listeners at all? The web must render no preview
  *  affordance where the answer is no, rather than an empty one. */
 export function listenersSupported() {

package/bin/lib/localSessions.mjs

@@ -20,9 +20,11 @@
 
 import { readdirSync, readFileSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
-import { execFileSync } from 'node:child_process';
 import { scanClaudeSessions } from './claudeSessions.mjs';
 import { scanAgyConversations } from './agySessions.mjs';
+import { isPathInside } from './repoPath.mjs';
+import { SESSION_MARKERS } from './conversationIds.mjs';
+import { git } from './git.mjs';
 
 const REPORT_CAP = 30;
 // ENDED sessions are the adoptable inventory, and the useful ones are FRESH:
@@ -32,21 +34,47 @@ const REPORT_CAP = 30;
 // and the strip read as session history instead of presence.)
 const ENDED_WINDOW_MS = 48 * 60 * 60 * 1000;
 
-/** Path-prefix containment on already-realpath'd absolute paths. */
-const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
-
 /**
- * THE MARKER NAMES THE DAEMON PINS A TAB'S CONVERSATION UNDER.
+ * THE ADOPT FENCE — inside the repo, outside the daemon's own worktrees — on
+ * BOTH sides of an adoption: this scan OFFERS what passes it, and the session
+ * lane re-checks the cwd the server hands back before it forks anything
+ * (workSessionTurns.mjs). The two used to be written separately, each with
+ * its own realpath-or-literal resolution and its own containment predicate,
+ * agreeing only by hand; a drift would offer sessions the machine then
+ * refuses, or accept one it would never have offered (audit 2026-10-10, F106).
  *
- * One owner, because two things read them and a drift here is silent: `workSessionTurns.mjs`
- * WRITES them (`sessionMetaPath(wt, <name>, sessionId)`) and this file READS
- * them to know which conversations are its own.
+ * `repoRoot` and each excluded directory are realpath'd ONCE here, falling
+ * back to the literal spelling when they cannot be resolved (`resolved` says
+ * which, for the agy reader whose cwd registry is global). `check(p)` takes an
+ * already-resolved path and answers:
+ *   'outside' — not inside the repo (or the repo has no usable root)
+ *   'ours'    — inside the repo AND inside one of the daemon's own directories
+ *   'ok'      — a human's checkout in this repo: adoptable
  */
-export const SESSION_MARKERS = [
-  'flowviant-claude-session',
-  'flowviant-codex-thread',
-  'flowviant-agy-conversation',
-];
+export function adoptFence({ repoRoot, excludeDirs = [] }) {
+  let realRoot;
+  let resolved = true;
+  try {
+    realRoot = realpathSync(repoRoot);
+  } catch {
+    resolved = false;
+    realRoot = String(repoRoot ?? '');
+  }
+  const excludes = [];
+  for (const d of excludeDirs) {
+    if (!d) continue;
+    try {
+      excludes.push(realpathSync(d));
+    } catch {
+      excludes.push(String(d)); // not on disk yet — keep the literal fence
+    }
+  }
+  const check = (p) => {
+    if (!realRoot || !isPathInside(p, realRoot)) return 'outside';
+    return excludes.some((e) => isPathInside(p, e)) ? 'ours' : 'ok';
+  };
+  return { realRoot, resolved, check };
+}
 
 /**
  * EVERY CONVERSATION THIS DAEMON STARTED, so the adopt strip never offers you
@@ -65,19 +93,19 @@ export const SESSION_MARKERS = [
  * be offered at all.
  *
  * Excluded by conversation ID rather than by directory, because the directory
- * is shared with exactly the sessions we want to keep offering.
+ * is shared with exactly the sessions we want to keep offering. The ids are
+ * read off the markers the session lane pins each tab's conversation under —
+ * `SESSION_MARKERS`, the one list the writer's names come from too
+ * (conversationIds.mjs, audit 2026-10-10 F157), so the two cannot drift.
  */
 export function ourConversationIds(repoRoot, gitDirs = []) {
   const ids = new Set();
   const dirs = new Set(gitDirs.filter(Boolean));
   try {
-    dirs.add(
-      execFileSync('git', ['rev-parse', '--absolute-git-dir'], {
-        cwd: repoRoot,
-        encoding: 'utf8',
-        timeout: 5_000,
-      }).trim()
-    );
+    // Bounded, and QUIET since 2026-10-10 (F107): this used to set no
+    // `stdio`, so git's "not a git repository" for a vanished cwd landed on
+    // the daemon's terminal from inside the poll loop's best-effort tail.
+    dirs.add(git(['rev-parse', '--absolute-git-dir'], repoRoot, { timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] }));
   } catch {
     /* not a repo, or git unavailable — the fence is simply empty */
   }
@@ -119,25 +147,10 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
     const mine = excludeIds instanceof Set ? excludeIds : new Set(excludeIds ?? []);
     // Claude falls back to the literal root when it cannot be resolved; agy,
     // whose cwd registry is global, reports nothing for an unresolvable root.
-    let realRoot;
-    let resolved = true;
-    try {
-      realRoot = realpathSync(repoRoot);
-    } catch {
-      resolved = false;
-      realRoot = String(repoRoot ?? '');
-    }
+    const fence = adoptFence({ repoRoot, excludeDirs });
+    const { realRoot, resolved } = fence;
     if (!realRoot) return [];
-    const excludes = [];
-    for (const d of excludeDirs) {
-      if (!d) continue;
-      try {
-        excludes.push(realpathSync(d));
-      } catch {
-        excludes.push(String(d)); // not on disk yet — keep the literal fence
-      }
-    }
-    const ours = (p) => inside(p, realRoot) && !excludes.some((e) => inside(p, e));
+    const ours = (p) => fence.check(p) === 'ok';
     const cutoff = Date.now() - ENDED_WINDOW_MS;
     const claude = scanClaudeSessions({ realRoot, ours, mine, cutoff, cap: REPORT_CAP });
     // agy rides in whatever room the cap leaves — Claude sessions first, they

package/bin/lib/login.mjs

@@ -6,18 +6,17 @@
  * plain `flowviant` just runs — no token, no env var.
  */
 
-import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
+import { APP_URL, FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
 import { saveLogin, detectRepoRoot, projectLabel, safeName, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
-import { sleep } from './claude.mjs';
+import { sleep } from './sleep.mjs';
 import { launchCommand, terminalCommand } from './launchCommand.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 
 const DEVICE_START = fleetEndpoint('device/start', FLEET_URL);
 const DEVICE_POLL = fleetEndpoint('device/poll', FLEET_URL);
-const APP_URL = process.env.FLOWVIANT_APP_URL || 'https://app.flowviant.com';
 
-async function post(url, body) {
+async function postJson(url, body) {
   const res = await fetch(url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', 'User-Agent': USER_AGENT },
@@ -29,7 +28,9 @@ async function post(url, body) {
   return j.data ?? j;
 }
 
-export async function runLogin({ thenStart = false, json = false, dir = process.cwd() } = {}) {
+/** `post` is injectable so the device-code protocol can be driven without a
+ *  server (login.test.mjs); every caller leaves it at the real one. */
+export async function runLogin({ thenStart = false, json = false, dir = process.cwd(), post = postJson } = {}) {
   const event = (value) => { if (json) process.stdout.write(`${JSON.stringify(value)}\n`); };
   const selectedRepo = json ? detectRepoRoot(dir) : null;
   if (json && !selectedRepo) { event({ event: 'error', message: `No git repository found in ${dir}.` }); return { saved: false }; }
@@ -42,10 +43,18 @@ export async function runLogin({ thenStart = false, json = false, dir = process.
     fail(`couldn't reach Flowviant (${e.message}).`);
     process.exit(1);
   }
-  const { deviceCode, userCode, intervalSeconds = 5, expiresInSeconds = 600 } = start;
-  if (json && (typeof deviceCode !== 'string' || typeof userCode !== 'string' || userCode.length < 8)) {
-    event({ event: 'error', message: 'Flowviant returned an invalid login code.' });
-    return { saved: false };
+  const { deviceCode, userCode, intervalSeconds = 5, expiresInSeconds = 600 } = start ?? {};
+  // BOTH PRESENTERS CHECK THE SERVER'S ANSWER (2026-10-10, F109). The shape
+  // checks here and on the approval below were written for the tray's JSON
+  // path only, so the terminal path sliced an absent code into a TypeError
+  // stack and saved an approval with no project — `projects["undefined"]`,
+  // with the legacy mirror's working token overwritten by nothing. A
+  // malformed answer is a sentence and exit 1 in the terminal, as an
+  // unreachable server already was.
+  if (typeof deviceCode !== 'string' || typeof userCode !== 'string' || userCode.length < 8) {
+    if (json) { event({ event: 'error', message: 'Flowviant returned an invalid login code.' }); return { saved: false }; }
+    fail('Flowviant returned an invalid login code.');
+    process.exit(1);
   }
   const pretty = `${userCode.slice(0, 4)}-${userCode.slice(4)}`;
   // Where the control ACTUALLY is. It was "the Agents panel", a settings
@@ -73,9 +82,10 @@ export async function runLogin({ thenStart = false, json = false, dir = process.
       continue; // transient — keep polling
     }
     if (poll.status === 'approved') {
-      if (json && (!poll.projectId || !(poll.machineToken ?? poll.fleetToken))) {
-        event({ event: 'error', message: 'Flowviant did not return a project credential.' });
-        return { saved: false };
+      if (!poll.projectId || !(poll.machineToken ?? poll.fleetToken)) {
+        if (json) { event({ event: 'error', message: 'Flowviant did not return a project credential.' }); return { saved: false }; }
+        fail('Flowviant did not return a project credential.');
+        process.exit(1);
       }
       // `machineToken` is the wire's new name; `fleetToken` is the one every
       // published daemon reads. The server dual-sends until DAEMON_MIN clears