flowviant 0.116.0 → 0.124.0

package/bin/lib/workArtifactReconcile.mjs

@@ -0,0 +1,79 @@
+/**
+ * AN IDLE AGENT'S DELIVERY, RECONCILED WITHOUT A TURN (2026-10-11).
+ *
+ * A local discard reached the server only when a turn settled, so an agent
+ * waiting in Review kept every stored file a daemon had not relayed removing:
+ * the marketing imagery card showed nine images while its worktree held the
+ * two the person kept, and nothing would change until somebody sent another
+ * message. So each agent worktree this machine holds is measured against its
+ * stored inventory once per process, under the place's writer lock and never
+ * beside a turn — the reporter's own evidence rule (artifactIteration.mjs)
+ * decides what is a discard. Only agents: a tab's next turn is the natural
+ * moment to reconcile a conversation, and a delivery in Review has none.
+ *
+ * A failure is said in the log and tried again on a later beat, a bounded
+ * number of times; the stored files stay listed, which is the truth.
+ */
+import { existsSync } from 'node:fs';
+
+/** Attempts per agent per process, and the wait between two of them. */
+const MAX_TRIES = 4;
+const RETRY_MS = 60_000;
+
+export function createWorkArtifactReconcile({
+  artifacts,
+  placeLocks,
+  inPlace,
+  placeDir,
+  beforeArtifacts,
+  getArtifactsAccepted,
+  log = () => {},
+  now = Date.now,
+}) {
+  const done = new Set(); // agent places reconciled by this process
+  const tries = new Map(); // agent place -> { n, at }
+  let sweeping = null;
+
+  const reconcileOne = async (place) => {
+    const wt = placeDir(place);
+    if (!wt || !existsSync(wt)) return;
+    const agentId = place.slice(2);
+    try {
+      await inPlace(place, true, () => artifacts.reconcile({ placeDir: wt, before: beforeArtifacts(wt), agentId }));
+      done.add(place);
+      tries.delete(place);
+    } catch (error) {
+      const n = (tries.get(place)?.n ?? 0) + 1;
+      tries.set(place, { n, at: now() });
+      log(`agent ${agentId}: artifact cleanup incomplete — ${error?.message ?? error}` +
+        (n >= MAX_TRIES ? ' (not retried again until the daemon restarts)' : ''));
+    }
+  };
+
+  /** The roster's live places; agent ones are `a-<agentId>`. Never awaited by the poll. */
+  const reconcileIdleArtifacts = (activeIds) => {
+    if (!Array.isArray(activeIds) || !getArtifactsAccepted()) return null;
+    if (sweeping) return sweeping;
+    const live = new Set(activeIds);
+    for (const id of done) if (!live.has(id)) done.delete(id);
+    for (const id of tries.keys()) if (!live.has(id)) tries.delete(id);
+    const due = activeIds.filter((place) => {
+      if (typeof place !== 'string' || !place.startsWith('a-') || place.length <= 2) return false;
+      if (done.has(place) || placeLocks.has(place)) return false; // a turn or a merge is there
+      const t = tries.get(place);
+      return !t || (t.n < MAX_TRIES && now() - t.at >= RETRY_MS);
+    });
+    if (due.length === 0) return null;
+    // One place at a time: each is an inventory read and its removals.
+    sweeping = (async () => {
+      try {
+        for (const place of due) await reconcileOne(place);
+      } finally {
+        sweeping = null;
+      }
+    })();
+    return sweeping;
+  };
+
+  return { reconcileIdleArtifacts };
+}

package/bin/lib/workAttachments.mjs

@@ -9,8 +9,9 @@
  * serves both, so the two lanes cannot disagree about what a safe name is.
  * The name rule itself is safeFileName.mjs's.
  */
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { ensureRealSubdir, realDirState } from './ownedDirs.mjs';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
 import { excludeInWorktree } from './git.mjs';
 import { FLOWVIANT_OWN_PATHS } from './knowledgeLibrary.mjs';
@@ -59,13 +60,60 @@ export function createWorkAttachments() {
   // and the two sides never disagree about the cut. An empty name is
   // `attachment`, the server's own fallback.
   const safeUploadName = (raw) => safeFileName(raw, 'attachment');
-  /** The file at `path` holds exactly `buf` — read only when the sizes agree. */
+  /**
+   * NO LINK UNDER `.flowviant/` IS FOLLOWED, AND NOTHING THERE IS REPLACED
+   * (2026-10-10, the audit's F080). This lane writes a MEMBER'S bytes under a
+   * member's name, and it was the one `.flowviant/` writer with no guard:
+   * `mkdirSync` and `writeFileSync` went through a committed `.flowviant ->
+   * ~/.ssh` or `.flowviant/uploads -> ../../../.ssh`, and `existsSync` answered
+   * "absent" for a dangling link at the file's own name, which the write then
+   * followed to create its target — an attachment named `authorized_keys`
+   * landing in the operator's `~/.ssh`. Now: both directories must be real
+   * (ownedDirs.mjs `ensureRealSubdir`, the artifacts directory's rule — refused,
+   * never replaced), every look at a name is an `lstat` or an `O_NOFOLLOW`
+   * open, and each file is CREATED (`O_EXCL`): anything already at the name,
+   * a dangling link included, is never written through.
+   */
+  const NEW_FILE = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+  /** Anything at all at `path` — a dangling link too. */
+  const taken = (path) => {
+    try {
+      lstatSync(path);
+      return true;
+    } catch (e) {
+      return e?.code !== 'ENOENT';
+    }
+  };
+  /** The REGULAR file at `path` holds exactly `buf` — read only when the sizes
+   *  agree, and never through a link. Non-blocking, so a fifo at the name is
+   *  answered "no" rather than waited on. */
   const holds = (path, buf) => {
+    let fd;
     try {
-      return statSync(path).size === buf.byteLength && readFileSync(path).equals(buf);
+      const at = lstatSync(path);
+      if (!at.isFile() || at.size !== buf.byteLength) return false;
+      fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+      const st = fstatSync(fd);
+      return st.isFile() && st.size === buf.byteLength && readFileSync(fd).equals(buf);
     } catch {
       return false;
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+    }
+  };
+  /** A NEW regular file at `path` holding `buf`, at the mode `writeFileSync`
+   *  used. Throws (EEXIST) when anything is already there; a write that fails
+   *  part-way takes its own half-file with it. */
+  const createFile = (path, buf) => {
+    const fd = openSync(path, NEW_FILE, 0o666);
+    try {
+      writeFileSync(fd, buf);
+    } catch (e) {
+      closeSync(fd);
+      rmSync(path, { force: true });
+      throw e;
     }
+    closeSync(fd);
   };
   /**
    * THE ONE DOWNLOAD LOOP. Each entry's relative path, or null where it did
@@ -81,11 +129,10 @@ export function createWorkAttachments() {
    */
   const landFiles = async (wt, list, endpoint, sameBytesKept) => {
     const dir = join(wt, UPLOAD_DIR);
-    try {
-      mkdirSync(dir, { recursive: true });
-    } catch {
-      return list.map(() => null);
-    }
+    // A `.flowviant` or `uploads` that is a link or not a directory refuses
+    // the whole batch before anything is fetched: every file is a miss the
+    // turn is told about, and the repository's content is left as it is.
+    if (!ensureRealSubdir(wt, UPLOAD_DIR)) return list.map(() => null);
     // "Never committed by us" has to be true for GIT, not just for this code:
     // an untracked `.flowviant/` makes the whole worktree dirty, which refuses
     // every ship, exempts the tree from closed-tab retirement forever, and
@@ -115,14 +162,22 @@ export function createWorkAttachments() {
         // silently overwriting one with the other loses a file the human sent.
         let name = safeUploadName(a.name);
         let already = sameBytesKept && holds(join(dir, name), buf);
-        if (!already && existsSync(join(dir, name))) {
+        if (!already && taken(join(dir, name))) {
           const dot = name.lastIndexOf('.');
           const stem = dot > 0 ? name.slice(0, dot) : name;
           const ext = dot > 0 ? name.slice(dot) : '';
           name = `${stem}-${String(a.id).slice(0, 6)}${ext}`;
-          already = sameBytesKept && holds(join(dir, name), buf);
+          // The id-suffixed name is this file's own: holding these bytes, it
+          // IS this file, on either lane (it used to be rewritten with them).
+          // Anything else there is a miss — never replaced, never followed.
+          already = holds(join(dir, name), buf);
+        }
+        if (!already) {
+          // Looked at again right before the write: the batch's first check
+          // is up to a download old.
+          if (realDirState(join(wt, '.flowviant')) !== 'dir' || realDirState(dir) !== 'dir') continue;
+          createFile(join(dir, name), buf);
         }
-        if (!already) writeFileSync(join(dir, name), buf);
         landed[landed.length - 1] = `${UPLOAD_DIR}/${name}`;
       } catch {
         /* one file failing must not fail the turn — the prompt lists what

package/bin/lib/workBrain.mjs

@@ -7,7 +7,7 @@
  * — each importing it directly — and it is pure over the job and the runtime
  * table, so its home is a module of its own rather than either lane.
  */
-import { RUNTIMES } from './runtimes.mjs';
+import { runtimeById } from './runtimes.mjs';
 
 /**
  * The shape a per-tab model name must have before it rides argv as
@@ -15,8 +15,13 @@ import { RUNTIMES } from './runtimes.mjs';
  * (below): it comes off the wire and lands in a child process's arguments —
  * alphanumerics plus dot/dash/underscore, at most 40 characters, and NEVER a
  * leading dash, which is an argv that parses as a flag.
+ *
+ * The server's route schemas copy it as `AGENT_MODEL_RE` (shared
+ * agent-runner.schema.ts), and the release parity gate holds the two equal
+ * (2026-10-10, audit F613): a server that accepts a name this drops has the
+ * board assert a pin the machine silently replaces with its default.
  */
-const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
+export const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
 
 /**
  * WHICH BRAIN, AT WHICH EFFORT — the tab's own pick, off the roster.
@@ -39,7 +44,7 @@ const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
  * One global ladder once accepted `max` for every runtime, and Codex has no
  * `max`: a skewed or previously queued Codex job reached argv as a
  * `model_reasoning_effort` its CLI refuses. The per-CLI list lives beside each
- * runtime's argv builder (`RUNTIMES[id].efforts`, runtime{Claude,Codex,Antigravity}.mjs); a runtime this
+ * runtime's argv builder (`runtimeById(id).efforts`, runtime{Claude,Codex,Antigravity}.mjs); a runtime this
  * daemon does not define runs nothing, so it spells no effort either.
  */
 export function brainFor(job, runtimeId) {
@@ -47,7 +52,7 @@ export function brainFor(job, runtimeId) {
   const model = typeof job?.model === 'string' ? job.model.trim() : '';
   if (model && WORK_MODEL_RE.test(model)) out.model = model;
   const effort = typeof job?.effort === 'string' ? job.effort.trim() : '';
-  const efforts = RUNTIMES[runtimeId]?.efforts ?? [];
+  const efforts = runtimeById(runtimeId)?.efforts ?? [];
   if (effort && efforts.includes(effort)) out.effort = effort;
   return out;
 }

package/bin/lib/workCappedTurn.mjs

@@ -0,0 +1,119 @@
+/**
+ * ONE CAPPED READ-ONLY CONSULT TURN — the process plumbing the unattended
+ * one-shot lanes share: the Deploy-press planner (workAgentPlans.mjs), the AI
+ * pre-review (workAgentPrecheck.mjs) and intake (workIntake.mjs).
+ *
+ * ONE HOME (2026-10-10, the audit). Each lane carried its own forty-to-eighty
+ * lines of this, and the copies had already begun to drift. Every step below
+ * is a rule some incident taught, and a lane that copied the wrong one would
+ * show it only as a daemon that never auto-updates again:
+ *  · THE CHILD IS REGISTERED IN `workChildren`, AND REMOVED IN A `finally`.
+ *    It is what `workBusy()` counts and what counts against the machine's
+ *    ceiling (liveTurnCount); a leaked entry keeps the daemon "busy" forever,
+ *    which blocks every auto-update, silently, until a restart. No task id: a
+ *    consult turn belongs to no card, and the snapshot's per-task rows must
+ *    not invent one.
+ *  · THE ADMISSION RESERVATION IS RELEASED AT THE SPAWN, and again in the
+ *    `finally` for a turn that never spawned — release is idempotent, so
+ *    doing both is the normal case (admission.mjs).
+ *  · THE CAP IS ARMED AT THE SPAWN, not at entry: time spent waiting for a
+ *    checkout lock is not a wedged CLI. It SIGKILLs the CHILD and never its
+ *    group — the rule teardown keeps: a read-only turn starts no server, so
+ *    there is nothing behind it worth signalling and everything to lose by
+ *    signalling somebody else's.
+ *  · THE CAP RESOLVES THE WAIT ITSELF rather than waiting for `close` after
+ *    the kill: a SIGKILLed process whose stdio a grandchild still holds can be
+ *    slow to emit `close`, or never emit it, and the caller is holding a
+ *    claimed job (or a place's writer lock) open behind this promise.
+ *  · THE TURN'S TRANSCRIPT IS REMOVED ON EVERY EXIT — settled, wedged or
+ *    thrown. `claude -p` writes `~/.claude/projects/<munged-cwd>/<id>.jsonl`,
+ *    and the CLI's `--continue` is cwd-keyed: left in the checkout it displaces
+ *    the operator's own conversation from the `+` adopt menu and is what their
+ *    `claude --continue` resumes; left in an agent's worktree it is what the
+ *    agent's next turn resumes, under build permissions. The id is the one the
+ *    CLI reports at `system.init`, so the file is ours by name.
+ *
+ * WHAT STAYS WITH EACH LANE is policy, never plumbing: its lock, its prompt,
+ * profile and brain, its usage callback (set or accumulate is a per-lane
+ * choice), its cap length, its narration, and the words it settles with.
+ */
+import { removeTranscriptSoon } from './runtimeCapabilities.mjs';
+
+/**
+ * Run `runTurn(turnArgs)` under a `capMs` cap. Resolves
+ * `{ out, wedged, spawned, sessionId }`: `out` is the turn's answer, or `''`
+ * when the cap fired (`wedged`); `spawned` says a CLI process existed; the
+ * session id is the conversation the CLI named, or null. A turn that throws
+ * rethrows here, after the same cleanup.
+ *
+ * `onSpawn` and `onInit` are the caller's own hooks, run after this file's
+ * bookkeeping — which is why they ride beside `turnArgs` and never inside it.
+ * `removeTranscript` is a test's.
+ */
+export async function runCappedTurn({
+  runTurn,
+  turnArgs,
+  capMs,
+  workChildren,
+  releaseSlot = () => {},
+  transcriptCwd,
+  onSpawn = () => {},
+  onInit = () => {},
+  removeTranscript = removeTranscriptSoon,
+  signal,
+}) {
+  // Wiring mistakes, refused before anything spawns: a hook inside turnArgs
+  // would be silently replaced below, and a missing cap would fire at once.
+  if (turnArgs && ('onSpawn' in turnArgs || 'onInit' in turnArgs))
+    throw new TypeError('runCappedTurn: pass onSpawn/onInit beside turnArgs, never inside it');
+  if (!(Number.isFinite(capMs) && capMs > 0)) throw new TypeError('runCappedTurn: capMs must be a positive number');
+  let child = null;
+  let timer = null;
+  let wedged = false;
+  let sessionId = null;
+  let stopWaiting = () => {};
+  const capped = new Promise((resolve) => {
+    stopWaiting = resolve;
+  });
+  const cancel = () => {
+    wedged = true;
+    try { child?.kill('SIGKILL'); } catch { /* already gone */ }
+    stopWaiting('');
+  };
+  signal?.addEventListener('abort', cancel, { once: true });
+  try {
+    if (signal?.aborted) { cancel(); return { out: '', wedged, spawned: false, sessionId }; }
+    const turn = runTurn({
+      ...turnArgs,
+      onInit: (i) => {
+        if (typeof i?.sessionId === 'string' && i.sessionId.trim()) sessionId = i.sessionId.trim();
+        onInit(i);
+      },
+      onSpawn: (ch) => {
+        child = ch;
+        workChildren.set(ch, null);
+        releaseSlot();
+        timer = setTimeout(() => {
+          wedged = true;
+          try {
+            ch.kill('SIGKILL');
+          } catch {
+            /* already gone */
+          }
+          stopWaiting('');
+        }, capMs);
+        timer.unref?.();
+        onSpawn(ch);
+        if (signal?.aborted) cancel();
+      },
+    });
+    const out = await Promise.race([turn, capped]);
+    return { out, wedged, spawned: child !== null, sessionId };
+  } finally {
+    signal?.removeEventListener('abort', cancel);
+    if (timer) clearTimeout(timer);
+    if (child) workChildren.delete(child);
+    releaseSlot();
+    if (sessionId) removeTranscript(transcriptCwd, sessionId);
+  }
+}

package/bin/lib/workChildren.mjs

@@ -10,6 +10,7 @@
  * on this box" belong together — and apart from any one lane.
  */
 import { createAdmission } from './admission.mjs';
+import { killGroup } from './processGroup.mjs';
 
 export function createWorkChildren({ extraLiveTurns }) {
   /**
@@ -54,11 +55,10 @@ export function createWorkChildren({ extraLiveTurns }) {
   const groupKillChildren = new Set();
   const shutdownWork = () => {
     for (const [ch] of workChildren) {
-      try {
-        if (groupKillChildren.has(ch) && ch.pid) process.kill(-ch.pid, 'SIGTERM');
-        else ch.kill('SIGTERM');
-      } catch {
-        // A group that has already gone, or a pid that is no longer a leader.
+      // A group that has already gone, or a pid that is no longer a leader,
+      // falls back to the child (processGroup.mjs).
+      if (groupKillChildren.has(ch)) killGroup(ch, 'SIGTERM');
+      else {
         try {
           ch.kill('SIGTERM');
         } catch {

package/bin/lib/workCommandAudit.mjs

@@ -8,7 +8,7 @@
  * blocking the turn.
  */
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { scrub as envScrub } from './uplinkScrub.mjs';
+import { scrubCut } from './uplinkScrub.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 
 // THE COMMAND AUDIT — every `$ …` the CLI's stream reports, batched
@@ -21,6 +21,10 @@ import { fleetEndpoint } from './fleetWire.mjs';
 // a kill, and again at settle. Best-effort: a failed post drops the
 // batch rather than blocking the turn — the surface says it is the
 // machine's report, not a syscall trace.
+/** The server's own cap on one audited command (sessionCommands.ts
+ *  `MAX_COMMAND_CHARS`), applied here AFTER the scrub. */
+const MAX_COMMAND_CHARS = 2000;
+
 export function createCommandAudit({ sessionId, turnId, runtime, cwd }) {
   const SESSION_COMMANDS_URL = fleetEndpoint('session-commands', FLEET_URL);
   const auditBatch = [];
@@ -55,7 +59,19 @@ export function createCommandAudit({ sessionId, turnId, runtime, cwd }) {
     // `PGPASSWORD=… psql` — and the audit is stored 30 days and rendered
     // in the admin view, so the one uplink that omitted scrub was the
     // one most likely to carry a plaintext secret.
-    auditBatch.push({ command: envScrub(a.command), at: new Date().toISOString() });
+    //
+    // SCRUBBED WHOLE, THEN CUT (2026-10-10, the audit's F128): the parsers
+    // used to cut the command at 2000 before it reached this scrub, so a
+    // secret straddling that character kept its prefix. They now hand a
+    // bounded window, and the server's cap is applied here, last.
+    auditBatch.push({ command: scrubCut(a.command, MAX_COMMAND_CHARS), at: new Date().toISOString(),
+      ...(a.observation ? { observation: {
+        ...(a.observation.id ? { id: scrubCut(a.observation.id, 160) } : {}),
+        outcome: a.observation.outcome ?? 'unknown',
+        ...(Number.isSafeInteger(a.observation.exitCode) ? { exitCode: a.observation.exitCode } : {}),
+        ...(a.observation.errorCategory ? { errorCategory: a.observation.errorCategory } : {}),
+      } } : {}),
+    });
     if (auditBatch.length >= 25) flushAudit();
   };
   return { flushAudit, auditCommand };

package/bin/lib/workDiffs.mjs

@@ -1,7 +1,25 @@
 /** Commit diff requests and their bounded reports. */
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { git } from './git.mjs';
+import { git, GIT_WIDE_BUFFER, OBJECT_ID_RE } from './git.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { scrub, scrubCut } from './uplinkScrub.mjs';
+
+/**
+ * A PATCH BIGGER THAN NODE'S 1 MiB DEFAULT BUFFER (2026-10-10, the audit's
+ * F150). `git()` (git.mjs) defaults to Node's 1 MiB `maxBuffer`, so any
+ * commit whose patch passed 1 MiB failed `ENOBUFS` and the viewer was told it
+ * errored, when it should have been shown the first 256 KB marked truncated.
+ * The same call with room for GIT_WIDE_BUFFER (8 MiB); past that, what git
+ * printed up to the bound is still a patch to truncate, never an error.
+ */
+function gitBig(args, cwd) {
+  try {
+    return git(args, cwd, { maxBuffer: GIT_WIDE_BUFFER });
+  } catch (e) {
+    if (e?.code === 'ENOBUFS' && typeof e.stdout === 'string' && e.stdout) return e.stdout;
+    throw e;
+  }
+}
 
 export function createWorkDiffs({ repoRoot }) {
   const DIFF_DONE_URL = fleetEndpoint('diff-done', FLEET_URL);
@@ -23,6 +41,18 @@ export function createWorkDiffs({ repoRoot }) {
    * machine" is a real answer, and a viewer spinning forever is the worst thing
    * this can do. The one thing never sent is a guess — an empty patch would
    * tell a reader the commit changed nothing.
+   *
+   * ONLY A COMMIT, AND SCRUBBED (2026-10-10, the audit's F150). The sha is a
+   * server-named hex string, and `git show <sha>` prints whatever object it
+   * names — a blob, a tree, a tag — so it is first resolved as
+   * `<sha>^{commit}` and anything else is answered "no such commit on this
+   * machine" with no content. (The hex check below already keeps it from
+   * reading as an option, so no `--end-of-options`, which git before 2.30
+   * does not take in `rev-parse`.) No reachability check: the run page asks
+   * for unpushed agent commits on load, and a remote-branch bound would refuse
+   * them. And the patch is the one repository uplink that skipped `scrub`; it
+   * now passes through it WHOLE, before the line-boundary cut — the
+   * scrub-then-cut order every other lane keeps.
    */
   const MAX_PATCH_BYTES = 256 * 1024;
   const servedDiffs = new Set();
@@ -48,7 +78,7 @@ export function createWorkDiffs({ repoRoot }) {
       const sha = String(job?.sha || '').toLowerCase();
       // A sha becomes a `git` argument. The server validates too; one place
       // doing this check is one deploy away from being zero places.
-      if (!/^[0-9a-f]{7,64}$/.test(sha)) continue;
+      if (!OBJECT_ID_RE.test(sha)) continue;
       // In-flight guard, not a cache: the server stops offering a sha the
       // moment it settles, so this only stops the SAME poll's job being
       // started twice while its `git show` is still running.
@@ -56,6 +86,22 @@ export function createWorkDiffs({ repoRoot }) {
       servedDiffs.add(sha);
       void (async () => {
         try {
+          let commit = '';
+          try {
+            commit = gitBig(['rev-parse', '--verify', '--quiet', `${sha}^{commit}`], repoRoot);
+          } catch (e) {
+            // Exit 1 is `--verify --quiet`'s "not a commit here" (absent,
+            // ambiguous, or another object type); anything else is git's own
+            // failure, relayed in its words as before.
+            if (e?.status !== 1) {
+              await postDiff({ sha, error: scrubCut(e?.message || e, 500) });
+              return;
+            }
+          }
+          if (!/^[0-9a-f]{40,64}$/.test(commit)) {
+            await postDiff({ sha, error: 'no such commit on this machine' });
+            return;
+          }
           let patch = '';
           const files = [];
           try {
@@ -63,13 +109,13 @@ export function createWorkDiffs({ repoRoot }) {
             // date already reached the card on the worktree sweep, and
             // repeating them inside the patch would put a second copy above
             // every hunk.
-            patch = git(['show', '--patch', '--format=', sha], repoRoot);
+            patch = scrub(gitBig(['show', '--patch', '--format=', commit], repoRoot));
           } catch (e) {
-            await postDiff({ sha, error: String(e?.message || e).slice(0, 500) });
+            await postDiff({ sha, error: scrubCut(e?.message || e, 500) });
             return;
           }
           try {
-            const raw = git(['show', '--numstat', '--format=', sha], repoRoot);
+            const raw = gitBig(['show', '--numstat', '--format=', commit], repoRoot);
             for (const line of raw.split('\n')) {
               if (!line.trim()) continue;
               const [a, d, ...rest] = line.split('\t');
@@ -77,7 +123,7 @@ export function createWorkDiffs({ repoRoot }) {
               if (!path) continue;
               const binary = a === '-' || d === '-';
               files.push({
-                path: path.slice(0, 300),
+                path: scrubCut(path, 300),
                 added: binary ? 0 : Number(a) || 0,
                 deleted: binary ? 0 : Number(d) || 0,
                 ...(binary ? { binary: true } : {}),

package/bin/lib/workIntake.mjs

@@ -1,9 +1,10 @@
 /** One leased incoming ticket, drafted by this machine's read-only CLI. */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { FLEET_URL, DAEMON_INSTANCE } from './config.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease } from './fleetPost.mjs';
 import { runTurn as defaultRunTurn } from './runTurn.mjs';
 import { pickRuntimeFor as defaultPickRuntimeFor } from './runtimeDetection.mjs';
-import { removeProbeTranscript } from './runtimeCapabilities.mjs';
+import { runCappedTurn } from './workCappedTurn.mjs';
 import { REPO_PLACE } from './workPlaces.mjs';
 import { SYSTEM_INTAKE, INTAKE_KICKOFF } from './prompts.mjs';
 import { parseIntakeDraft } from './intakeDraft.mjs';
@@ -31,25 +32,12 @@ export function createWorkIntake({
   const done = fleetEndpoint(INTAKE_DONE_ENDPOINT, FLEET_URL);
   const intake = new Set();
 
-  const claim = async (id) => {
-    try {
-      const res = await fetch(claiming, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
-      });
-      // A 409 means another holder (or a dismissed/landed ticket). No CLI and
-      // no settle: this machine never acquired the right to answer for it.
-      return res.status === 200 && (await res.json().catch(() => null))?.ok === true;
-    } catch {
-      return false;
-    }
-  };
+  // The intake route answers `{ ok: true }` on a 200, not `data.claimed`
+  // (machineIntake.routes.ts) — the same lease rule with its own winner test.
+  // A 409 means another holder (or a dismissed/landed ticket). No CLI and no
+  // settle: this machine never acquired the right to answer for it.
+  const claim = (id) =>
+    claimFleetLease(claiming, { id }, { won: (r) => r.status === 200 && r.json?.ok === true });
 
   const report = async (body) => {
     await postBestEffort(done, { ...body, instance: DAEMON_INSTANCE });
@@ -68,56 +56,43 @@ export function createWorkIntake({
     }
 
     let out = '';
-    let child = null;
-    let session = null;
-    let timer = null;
     let wedged = false;
+    let spawned = false;
     let usage = null;
     // A spawned CLI can fail before reporting counters. Null records that the
     // spend is unmeasured; four zeroes would falsely say it spent nothing.
-    const spent = () => child ? { usage } : {};
+    const spent = () => spawned ? { usage } : {};
     try {
       await inPlace(REPO_PLACE, false, async () => {
-        let stopWaiting = () => {};
-        const capped = new Promise((resolve) => { stopWaiting = resolve; });
-        const turn = runTurn({
-          prompt: INTAKE_KICKOFF(job),
-          system: SYSTEM_INTAKE,
-          profile: 'consult',
-          cwd: repoRoot,
-          runtime,
-          streamJson: true,
-          answerFromResult: true,
-          label: c.cyan('[intake]'),
-          // There is no MCP principal for a ticket, and no model or effort pin:
-          // this one-shot reader uses the machine's consult defaults.
-          onInit: (i) => {
-            if (typeof i?.sessionId === 'string' && i.sessionId.trim()) session = i.sessionId.trim();
-          },
-          onUsage: (u) => { usage = addUsage(usage, { ...u, runtime }); },
-          onSpawn: (ch) => {
-            child = ch;
-            workChildren.set(ch, null);
-            releaseSlot();
-            // Start the cap at spawn, never while a checkout writer holds the
-            // reader lock; SIGKILL and resolve even if a grandchild holds stdio.
-            timer = setTimeout(() => {
-              wedged = true;
-              try { ch.kill('SIGKILL'); } catch { /* already gone */ }
-              stopWaiting('');
-            }, 10 * 60_000);
-            timer.unref?.();
+        // One capped consult turn (workCappedTurn.mjs): the cap starts at
+        // spawn, never while a checkout writer holds the reader lock, and
+        // SIGKILLs the child and resolves even if a grandchild holds stdio.
+        ({ out, wedged } = await runCappedTurn({
+          runTurn,
+          capMs: 10 * 60_000,
+          workChildren,
+          releaseSlot,
+          transcriptCwd: repoRoot,
+          turnArgs: {
+            prompt: INTAKE_KICKOFF(job),
+            system: SYSTEM_INTAKE,
+            profile: 'consult',
+            cwd: repoRoot,
+            runtime,
+            answerFromResult: true,
+            label: c.cyan('[intake]'),
+            // There is no MCP principal for a ticket, and no model or effort pin:
+            // this one-shot reader uses the machine's consult defaults.
+            onUsage: (u) => { usage = addUsage(usage, { ...u, runtime }); },
           },
-        });
-        out = await Promise.race([turn, capped]);
+          // Marked by the lane itself, so a turn that throws after its spawn
+          // still reports what it measured.
+          onSpawn: () => { spawned = true; },
+        }));
       });
     } catch (e) {
       await report({ id, outcome: INTAKE_OUTCOMES.nothing, error: envScrub(String(e?.message || e)).slice(0, 500), ...spent() });
       return;
-    } finally {
-      if (timer) clearTimeout(timer);
-      if (child) workChildren.delete(child);
-      if (session) setTimeout(() => removeProbeTranscript(repoRoot, session), 750).unref?.();
     }
 
     if (wedged) {