flowviant 0.116.0 → 0.124.0

package/bin/lib/workShip.mjs

@@ -1,13 +1,14 @@
 /** Session branch shipping and settlement. */
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { git, baseBranchName, isSafePathSegment } from './git.mjs';
+import { git, baseBranchName, isSafePathSegment, sessionBranch, stripUrlUserinfo } from './git.mjs';
 import { mergeOutward as shipMergeOutward } from './shipMerge.mjs';
 import { gitMergeIn } from './gitMergeIdentity.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { REPO_PLACE } from './workPlaces.mjs';
 import { turnLockedByLivePid } from './turnLock.mjs';
+import { printable } from './printable.mjs';
 
 export function createWorkShipper({
   inPlace,
@@ -17,6 +18,8 @@ export function createWorkShipper({
   baseDir,
   gitNet,
   baseRef,
+  placeDir,
+  branchAt,
   placeWtFor,
   sessionMetaPath,
   shipping,
@@ -55,6 +58,11 @@ export function createWorkShipper({
       // delivers it; re-running the ship would misread its own success.
       if (pendingShipReports.has(job.sessionId)) continue;
       shipping.add(job.sessionId);
+      // A TAB'S NAME, which its person wrote, printed on this console and put
+      // in the merge commit's subject — scrubbed here, where the job is read,
+      // so no line below can print an escape sequence (2026-10-10, the audit's
+      // F097; see printable.mjs). The id is checked as a path segment below.
+      const sessionName = printable(job.sessionName);
       // A WRITER, keyed by PLACE: ship folds and merges with git in this
       // directory, and no CLI running here can coordinate with that. Keyed by
       // place rather than by session id, which is what this used to do while
@@ -74,7 +82,7 @@ export function createWorkShipper({
             await done({ ok: false, error: 'invalid session id' });
             return;
           }
-          note(`${c.cyan('ship')} ${c.dim(`— "${job.sessionName || job.sessionId}"`)}`);
+          note(`${c.cyan('ship')} ${c.dim(`— "${sessionName || job.sessionId}"`)}`);
           /**
            * WHAT IS ACTUALLY CHECKED OUT — not what we named it at birth.
            *
@@ -99,20 +107,20 @@ export function createWorkShipper({
            *
            * A directory that is gone (a retired or closed tab) cannot be asked,
            * so the recorded name is the fallback — the one case where the name
-           * is the only thing there is.
+           * is the only thing there is. The recorded name is the branch the
+           * PLACE was cut on, `session/<place>`: a person's `u-` place lives on
+           * `session/u-<id>`, and falling back to `session/<this tab's id>`
+           * answered "nothing to ship" over its committed work (audit
+           * 2026-10-10, F168). The checkout always exists, so its fallback is
+           * never read and keeps the tab's own name.
            */
           // The session's PLACE — the directory it actually works in.
           const shipPlace = placeOf(job.sessionId);
-          const wt = shipPlace === REPO_PLACE ? repoRoot : join(baseDir, 'sessions', shipPlace);
-          let branch = `session/${job.sessionId}`;
-          let detached = false;
-          if (existsSync(wt)) {
-            try {
-              branch = git(['symbolic-ref', '--short', 'HEAD'], wt);
-            } catch {
-              detached = true;
-            }
-          }
+          const wt = placeDir(job.sessionId);
+          const { branch, detached } = branchAt(
+            wt,
+            sessionBranch(shipPlace === REPO_PLACE ? job.sessionId : shipPlace)
+          );
           // THE ONE REFUSAL LEFT, and it is not policy. A detached HEAD names
           // no branch, so there is nothing to merge and nothing to record —
           // that is an ambiguity in git, not a rule of ours.
@@ -177,13 +185,19 @@ export function createWorkShipper({
               tip,
               count,
               branch,
-              label: job.sessionName || job.sessionId.slice(0, 8),
+              label: sessionName || job.sessionId.slice(0, 8),
               git,
               gitMerge,
               repoRoot,
               tmpDir: join(baseDir, 'ship', job.sessionId),
               baseRef,
-              workingTree: placeWtFor(shipPlace)?.wt ?? null,
+              // A QUERY, never `placeWtFor`: that one re-cuts a missing
+              // worktree, and on the ENDED path the directory is retired on
+              // purpose — the branch is the session now. Re-attaching it here
+              // resurrected a closed tab's directory with its branch checked
+              // out, which then blocked the merged-branch sweep (audit
+              // 2026-10-10, F160). The live path below opened it already.
+              workingTree: existsSync(wt) ? wt : null,
               warn,
             });
           // Idempotency: base already contains the branch tip. A re-offered
@@ -245,10 +259,14 @@ export function createWorkShipper({
                     'conflicts with main — the tab is closed, so open a new session from this branch to resolve them, then ship again',
                 });
               } else {
+                // Userinfo stripped as well as scrubbed (2026-10-10, F153): the
+                // outward merge pushes to `origin`, and a push names the remote.
                 const line = envScrub(
-                  String(detail)
-                    .split('\n')
-                    .find((l) => l.trim()) ?? 'git merge failed'
+                  stripUrlUserinfo(
+                    String(detail)
+                      .split('\n')
+                      .find((l) => l.trim()) ?? 'git merge failed'
+                  )
                 );
                 await done({ ok: false, error: `the merge failed: ${line.slice(0, 300)}` });
               }
@@ -273,7 +291,7 @@ export function createWorkShipper({
           // path, and the job re-offers next poll.
           if (turnLockedByLivePid(sessionMetaPath(dir.wt, 'flowviant-turn.lock'))) {
             warn(
-              `a turn is still running in "${job.sessionName || job.sessionId}" — ship waits for it`
+              `a turn is still running in "${sessionName || job.sessionId}" — ship waits for it`
             );
             deferred = true;
             return;
@@ -313,9 +331,11 @@ export function createWorkShipper({
               // An honest error beats a fabricated conflict — the human can
               // only fix what they are told about.
               const line = envScrub(
-                String(detail)
-                  .split('\n')
-                  .find((l) => l.trim()) ?? 'git merge failed'
+                stripUrlUserinfo(
+                  String(detail)
+                    .split('\n')
+                    .find((l) => l.trim()) ?? 'git merge failed'
+                )
               );
               await done({ ok: false, error: `the merge failed: ${line.slice(0, 300)}` });
             }
@@ -347,7 +367,7 @@ export function createWorkShipper({
           warn(`ship failed: ${e?.message ?? e}`);
           await done({
             ok: false,
-            error: envScrub(String(e?.message ?? 'the merge failed')).slice(0, 500),
+            error: envScrub(stripUrlUserinfo(e?.message ?? 'the merge failed')).slice(0, 500),
           });
         } finally {
           if (!settled && !deferred) {

package/bin/lib/workToolLog.mjs

@@ -8,7 +8,7 @@
  * the stream. Tested directly (workToolLog.test.mjs).
  */
 import { toolEventOf } from './runtimeEvents.mjs';
-import { scrub as envScrub } from './uplinkScrub.mjs';
+import { scrubCut, scrub as envScrub } from './uplinkScrub.mjs';
 
 /**
  * THE TURN'S TOOL LOG — the structured relay behind the transcript's
@@ -30,14 +30,74 @@ import { scrub as envScrub } from './uplinkScrub.mjs';
  *     because it is current state rather than scrollback.
  */
 export function createToolLog(cwd) {
-  const toolLog = { ev: [], dropped: 0 };
-  const pushToolEvent = (name, input) => {
+  const toolLog = { ev: [], dropped: 0, state: 'unknown' };
+  // IDs are correlation keys, never model-authored citations. Keep only bounded
+  // metadata; output supplies a fixed category and allowlisted reader diagnostic.
+  // Arbitrary output and file contents are discarded.
+  const correlated = new Map();
+  const refresh = () => {
+    toolLog.state = toolLog.state === 'partial' || toolLog.dropped || toolLog.recoveryDropped ? 'partial' :
+      toolLog.ev.length && toolLog.ev.every(e => e.outcome && e.outcome !== 'unknown') ? 'complete' : 'unknown';
+    const retained = new Set([...toolLog.ev, toolLog.firstFailure, ...(toolLog.recovery ?? [])]);
+    for (const [id, row] of correlated) if (!retained.has(row)) correlated.delete(id);
+  };
+  const observe = (e, meta) => {
+    const code = Number.isSafeInteger(meta.exitCode) ? meta.exitCode : undefined;
+    const failed = meta.isError === true || (code !== undefined && code !== 0);
+    e.outcome = !meta.result ? 'unknown' : failed ? 'failed' :
+      meta.runtime === 'codex' && code === undefined ? 'unknown' : 'success';
+    if (code !== undefined) e.exitCode = code;
+    if (failed) {
+      const output = scrubCut(meta.output ?? '', 16_384);
+      const guardAt = output.indexOf('flowviant: this turn is read-only, so ');
+      const guard = guardAt >= 0 ? output.slice(guardAt).split('\n', 1)[0] : undefined;
+      const diagnostic = guard ?? output.split('\n', 80).find(line => /^(?:[\w./ -]{1,160}: ){1,2}(?:No such file or directory|Permission denied|command not found)\.?$/.test(line) || (e.t === 'read' && /^(?:Error: )?(?:File does not exist|File not found|Permission denied)\.?(?: Note: your current working directory is [^\n]{1,400}\.)?$/.test(line)));
+      if (diagnostic) {
+        e.errorMessage = diagnostic.slice(0, 500);
+        if (diagnostic.length > 500) { e.errorTruncated = true; toolLog.state = 'partial'; }
+      }
+      e.errorCategory = guard && /a pipe|a glob|a redirect|a second command|an expansion|command substitution|brace expansion|a subshell/.test(guard) ? 'syntax_refusal' : /permission|denied|approval|not allowed|refus/i.test(output) ? 'denied' :
+        /command not found|not recognized|executable.*not found/i.test(output) ? 'unavailable_tool' :
+        /no such file|not found|does not exist|cannot find/i.test(output) ? 'missing_path' : 'tool_error';
+      if (!toolLog.firstFailure) {
+        toolLog.firstFailure = { ...e };
+        toolLog.recovery = [];
+      }
+    }
+  };
+  const pushToolEvent = (name, input, meta = {}) => {
+    const id = typeof meta.id === 'string' && meta.id && meta.id.length <= 160 ? meta.id : undefined;
+    const existing = id && correlated.get(id);
+    if (existing) {
+      if (meta.result) observe(existing, meta);
+      refresh();
+      return existing;
+    }
+    if (!name) {
+      toolLog.dropped = Math.min(1_000_000, toolLog.dropped + 1);
+      refresh();
+      return;
+    }
     // envScrub rides INTO the builder, which scrubs over a bounded
     // window BEFORE its caps — scrubbing after the cut both leaked a
     // boundary-straddling secret's prefix and grew a capped field
     // past the server's limits (review, 2026-09-01).
     const e = toolEventOf(name, input, cwd, envScrub);
     if (!e) return;
+    if (e.t !== 'plan') {
+      if (id) { e.id = scrubCut(id, 160); correlated.set(id, e); }
+      if (name === 'Read') for (const key of ['offset', 'limit']) {
+        if (Number.isSafeInteger(input?.[key]) && input[key] >= 0) e[key] = input[key];
+      }
+      if (toolLog.firstFailure) {
+        toolLog.recovery.push(e);
+        if (toolLog.recovery.length > 12) {
+          toolLog.recovery.shift();
+          toolLog.recoveryDropped = Math.min(1_000_000, (toolLog.recoveryDropped ?? 0) + 1);
+        }
+      }
+      observe(e, meta);
+    }
     if (e.t === 'plan') {
       const i = toolLog.ev.findIndex((x) => x.t === 'plan');
       if (i >= 0) toolLog.ev.splice(i, 1);
@@ -46,6 +106,11 @@ export function createToolLog(cwd) {
       const last = toolLog.ev[toolLog.ev.length - 1];
       const sameKey =
         last &&
+        !id && !last.id &&
+        last.outcome === e.outcome &&
+        last.exitCode === e.exitCode &&
+        last.errorCategory === e.errorCategory &&
+        last.offset === e.offset && last.limit === e.limit &&
         last.t === e.t &&
         last.p === e.p &&
         last.q === e.q &&
@@ -71,6 +136,8 @@ export function createToolLog(cwd) {
       const [shed] = toolLog.ev.splice(i, 1);
       toolLog.dropped = Math.min(1_000_000, toolLog.dropped + (shed?.n ?? 1));
     }
+    refresh();
+    return e;
   };
   return { toolLog, pushToolEvent };
 }

package/bin/lib/workTurnShape.mjs

@@ -0,0 +1,165 @@
+import { discoveryGuide } from './discoveryContract.mjs';
+/**
+ * WHAT A TERMINAL TAB'S TURN IS — plain, plan, capture or build — decided
+ * once, as data (audit 2026-10-10, F159). Pure: no I/O, no state.
+ *
+ * What a turn mounts and says is ONE decision over the runtime, the job's
+ * plan and capture switches and whether it adopts, and it was spelled as six
+ * parallel ternaries through the lane's lifecycle — the MCP mount, the
+ * kickoff, the profile, the system prompt, its artifacts paragraph, the
+ * display — plus runtime ids hard-coded where the RUNTIMES row should answer. Missing one of them gave an
+ * incoherent turn (a mounted MCP under a plain prompt, a plan profile beside
+ * the build contract), and nothing could show it short of a run. So the lane
+ * (workSessionTurns.mjs) asks `sessionTurnShape` once, the moment its runtime
+ * resolves, settles its refusal in words if it has one, and reads every
+ * other answer off it; the prompt pair is composed here too.
+ *
+ * The runtime facts come off the row (runtime{Claude,Codex,Antigravity}.mjs):
+ * `tab` ('plain' runs no MCP), `planTurns` (the CLI can spell plan mode) and
+ * `adopt` ('fork' | 'move' | null). The LIFECYCLE stays the lane's — its
+ * refusal order is the contract — and only this composition moved.
+ */
+import { runtimeById } from './runtimes.mjs';
+import {
+  SYSTEM_WORK,
+  SYSTEM_CAPTURE,
+  SYSTEM_WORK_PLAIN,
+  WORK_TURN_KICKOFF,
+  CAPTURE_TURN_KICKOFF,
+  WORK_TURN_KICKOFF_PLAIN,
+  withProjectContext,
+} from './prompts.mjs';
+
+/**
+ * THE ONE SENTENCE A PLAN TURN'S SYSTEM PROMPT GAINS (0.97.0), composed here
+ * rather than in prompts.mjs because it is a MODIFIER on whichever contract
+ * the tab runs, not a contract of its own.
+ *
+ * The enforcement is not this sentence — it is `--permission-mode plan`, under
+ * which the CLI itself refuses every write (claudePosture.mjs, PLAN_MODE_PERM). What
+ * the sentence buys is the ANSWER: the plain contract above it says "edit
+ * freely, commit", and a turn told only that would spend itself discovering
+ * refusals. It also says not to reach for `ExitPlanMode` (measured: disabled
+ * under `-p`, and the probe turn then asked the person to leave plan mode
+ * themselves) — leaving plan mode is the person's switch in the tab.
+ */
+export const PLAN_TURN_SENTENCE =
+  'THIS IS A PLANNING TURN: the person switched this tab to plan mode, so read what you need, decide, and answer with the plan itself as your reply — change nothing (the CLI refuses every write this turn, whatever the mechanics above say about editing, committing or artifacts), and do not try to leave plan mode; they switch it off in the tab when they want the plan carried out.';
+
+/**
+ * The turn's shape. `runtime` is the resolved RUNTIMES id; `job` is the
+ * roster's job, whose `planMode` and `capture` switches count only when
+ * exactly `true` (the job is handed whole rather than its switches spelled
+ * as keys: `planMode` is also a retired runTurn switch, and a lane that
+ * spells it is caught by turnProfile's ban); `adopting` is the lane's
+ * verdict that this first turn adopts a terminal session.
+ *
+ * Returns `{ refusal?, plain, plan, capture, kickoff, systemBase,
+ * planSentence, artifacts, profile, mountMcp, display }`:
+ *   refusal      — the sentence the turn settles in, unrun, when it has one;
+ *   kickoff /
+ *   systemBase   — which contract the prompt pair runs: 'plain' | 'capture' | 'work';
+ *   planSentence — PLAN_TURN_SENTENCE is appended to the system prompt;
+ *   artifacts    — this turn's contract may carry the artifacts paragraph
+ *                  (`sessionTurnSystem` adds it only while the server takes
+ *                  one, as the lane reads it at spawn);
+ *   profile      — the permission profile: 'build' | 'plan' | 'plan-mode';
+ *   mountMcp     — the session's MCP config is mounted;
+ *   display      — the CLI keeps its environment's display.
+ */
+export function sessionTurnShape({ runtime, adopting = false, job = null }) {
+  const row = runtimeById(runtime);
+  // A PLAIN tab (agy) mounts no MCP: no credential to mint, no config to
+  // write. The trade is stated in SYSTEM_WORK_PLAIN — no cards, no streaming
+  // — and the honesty survives on the existing rails: the answer lands via
+  // work-turn-done, the rail says "no card yet", and ship-time reconciliation
+  // books every branch commit.
+  const plain = row?.tab === 'plain';
+  // A CAPTURE chat (the board's New task conversation): its own system
+  // prompt, its own kickoff, and the scratch planner's READ-ONLY permission
+  // profile — the prompt says stage-never-file and the profile is what makes
+  // "read-only" true rather than asserted. Server-flagged per job; a server
+  // too old to flag it simply runs an ordinary tab, which the web's version
+  // floor prevents ever being offered.
+  const isCapture = job?.capture === true;
+  /**
+   * A PLAN TURN (0.97.0): the tab's switch, off the job. Only on a CLI whose
+   * row can spell it (`planTurns` — Claude Code's `--permission-mode plan`); a
+   * codex or agy turn is refused in words rather than run as a build turn
+   * wearing the word. The server never sends the key for a non-Claude tab;
+   * this is the machine's own half. Never on a capture chat, which is
+   * read-only by its own profile already.
+   *
+   * A PLAN TURN RUNS PLAIN TOO: measured on 2.1.281, plan mode refuses every
+   * `mcp__flowviant` call ("Cannot call … while in plan mode") unless the
+   * tool is annotated read-only, and none of the session tools are — so
+   * mounting the control plane would hand the turn a list of tools it can
+   * only fail at. The lane still mints the credential: its lease answers
+   * (held elsewhere, gone) are about the SESSION, and a plan turn needs them
+   * as much as any other.
+   */
+  const plan = job?.planMode === true && !isCapture;
+  // An adopt id names a conversation in ITS OWN CLI's store: claude forks it
+  // (--resume --fork-session), agy moves it (--conversation). A CLI whose row
+  // declares no adoption (Codex: no adoptable store yet) is refused here —
+  // its args builder backstops this with a loud throw, but a sentence beats
+  // a stack. Checked BEFORE plan mode: the order the lane always settled in.
+  const refusal =
+    adopting && !row?.adopt
+      ? 'adopting this terminal session needs its own CLI on the machine — install it, then try again'
+      : plan && !row?.planTurns
+        ? `plan mode runs on Claude Code only, and this tab is ${runtime} — turn plan off in the tab, then send the message again`
+        : null;
+  // ONE CONTRACT for the prompt pair: a plain tab and a plan turn run the
+  // plain one (no Flowviant tools to name, one complete report instead of a
+  // stream), a capture chat its own, every other tab the work contract.
+  const contract = plain || plan ? 'plain' : isCapture ? 'capture' : 'work';
+  return {
+    ...(refusal ? { refusal } : {}),
+    plain,
+    plan,
+    capture: isCapture,
+    kickoff: contract,
+    systemBase: contract,
+    planSentence: plan,
+    // ARTIFACTS (0.94.0): every tab but the read-only capture chat — and not
+    // a plan turn, which cannot write one.
+    artifacts: !isCapture && !plan,
+    // ONE PROFILE (turnProfile.mjs): the capture chat's read-only `plan`
+    // list; or a plan turn's `plan-mode` — `--permission-mode plan` INSTEAD
+    // of the build posture, never beside `--dangerously-skip-permissions`,
+    // which silently wins (claudePosture.mjs, PLAN_MODE_PERM); else the build
+    // posture.
+    profile: isCapture ? 'plan' : plan ? 'plan-mode' : 'build',
+    mountMcp: !plain && !plan,
+    // A PERSON AT THE KEYBOARD MAY ASK FOR A WINDOW (2026-09-29): a Terminal
+    // tab keeps its environment's display. The capture chat does not — it
+    // only reads and stages cards, and the person talking to it may be on a
+    // phone (noWindowEnv.mjs).
+    display: !isCapture,
+  };
+}
+
+const KICKOFFS = { plain: WORK_TURN_KICKOFF_PLAIN, capture: CAPTURE_TURN_KICKOFF, work: WORK_TURN_KICKOFF };
+const SYSTEMS = { plain: SYSTEM_WORK_PLAIN, capture: SYSTEM_CAPTURE, work: SYSTEM_WORK };
+
+/** The turn's opening message under its contract. The plain kickoff names no
+ *  session id (WORK_TURN_KICKOFF_PLAIN takes none) — it has no tools to pass
+ *  one to. */
+export const sessionTurnKickoff = (shape, { sessionId, sessionName, message, askedByName, interrupted = false }) =>
+  KICKOFFS[shape.kickoff]({ sessionId, sessionName, message, askedByName, interrupted });
+
+/**
+ * The turn's system prompt: its contract with the project's knowledge
+ * paragraph, the artifacts paragraph only where the shape allows one AND the
+ * server can show one (`artifactsAccepted`, read by the lane at spawn), and a
+ * plan turn's sentence appended.
+ */
+export const sessionTurnSystem = (shape, { knowledgeDir, artifactsAccepted, runtime }) => {
+  const contract = withProjectContext(SYSTEMS[shape.systemBase], {
+    knowledgeDir,
+    artifacts: shape.artifacts && artifactsAccepted,
+  });
+  const discovery = shape.systemBase === 'capture' && runtime ? `\n\n${discoveryGuide(runtime, 'capture')}` : '';
+  return shape.planSentence ? `${contract}\n\n${PLAN_TURN_SENTENCE}` : contract + discovery;
+};

package/npm-shrinkwrap.json

@@ -0,0 +1,69 @@
+{
+  "name": "flowviant",
+  "version": "0.124.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "flowviant",
+      "version": "0.124.0",
+      "license": "MIT",
+      "dependencies": {
+        "libsodium-wrappers-sumo": "^0.8.4",
+        "ws": "^8.18.0"
+      },
+      "bin": {
+        "flowviant": "bin/cli.mjs"
+      },
+      "devDependencies": {
+        "three": "0.180.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/libsodium-sumo": {
+      "version": "0.8.4",
+      "resolved": "https://registry.npmjs.org/libsodium-sumo/-/libsodium-sumo-0.8.4.tgz",
+      "integrity": "sha512-TMtHShQfVVsaxDygyapvUC3o7YsPgXa/hRWeIgzyFz6w5k/1hirGptCxp1U7XwW3rCskaTTYKgV10v86UiGgNw==",
+      "license": "ISC"
+    },
+    "node_modules/libsodium-wrappers-sumo": {
+      "version": "0.8.4",
+      "resolved": "https://registry.npmjs.org/libsodium-wrappers-sumo/-/libsodium-wrappers-sumo-0.8.4.tgz",
+      "integrity": "sha512-ql7hcgulKZ3ekfa2DGAogcCKsWU0diA/0nArz1CFzh93WQdb46/Kj18ka/Hifq6uA3Ush34Pc6vU/6HXeRwUkg==",
+      "license": "ISC",
+      "dependencies": {
+        "libsodium-sumo": "^0.8.0"
+      }
+    },
+    "node_modules/three": {
+      "version": "0.180.0",
+      "resolved": "https://registry.npmjs.org/three/-/three-0.180.0.tgz",
+      "integrity": "sha512-o+qycAMZrh+TsE01GqWUxUIKR1AL0S8pq7zDkYOQw8GqfX8b8VoCKYUoHbhiX5j+7hr8XsuHDVU6+gkQJQKg9w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/ws": {
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.116.0",
+  "version": "0.124.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
@@ -10,7 +10,8 @@
     "bin",
     "!bin/lib/*.test.mjs",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "npm-shrinkwrap.json"
   ],
   "engines": {
     "node": ">=20"
@@ -34,10 +35,14 @@
   "homepage": "https://flowviant.com",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/flowviant/cli.git"
+    "url": "git+https://github.com/Flowviant/flowviant.git",
+    "directory": "cli"
   },
   "license": "MIT",
   "bugs": {
-    "url": "https://github.com/flowviant/cli/issues"
+    "url": "https://github.com/Flowviant/flowviant/issues"
+  },
+  "devDependencies": {
+    "three": "0.180.0"
   }
 }

package/bin/lib/fleetJobs.mjs

@@ -1,120 +0,0 @@
-/**
- * TWO ROSTER JOB LANES THAT ACT ON THIS CHECKOUT AND SETTLE BACK: patch
- * reverts and task-restart cleanups.
- *
- * Split out of fleet.mjs (SOLID audit 2026-09-26, F038). Each lane dedups its
- * in-flight job ids, does its work fire-and-forget, and ALWAYS reports the job
- * done — the roster re-serves a job until it is reported, so a lane that could
- * wedge on a failure would redo it every poll. The loop in fleet.mjs only
- * hands each lane its roster array.
- *
- * Factories rather than module state because each lane is bound to the
- * checkout this daemon serves (and cleanup to the live base ref, read at call
- * time — the roster can move it mid-run).
- */
-
-import { execFileSync } from 'node:child_process';
-import { FLEET_URL } from './config.mjs';
-import { gitNetAsync, originSlug, isValidPrUrl, isValidBranch } from './git.mjs';
-import { c, note, ok, warn } from './ui.mjs';
-import { revertPatch, withPatchLock } from './patchRevert.mjs';
-import { fleetEndpoint } from './fleetWire.mjs';
-import { postToFleet } from './fleetPost.mjs';
-
-export function createPatchRevertLane({ repoRoot }) {
-  // Patch reverts: a patch landed straight in this checkout, and a human took it
-  // back. The commits are HERE, not on the server, so the reverse-apply happens
-  // here too — a revert, never a reset, because the owner has almost certainly
-  // worked on top by now. Serialised through the same lock as applies.
-  const PATCH_REVERT_DONE_URL = fleetEndpoint('patch-revert-done', FLEET_URL);
-  const reverting = new Set();
-  const processPatchRevertJobs = (jobs) => {
-    for (const job of jobs ?? []) {
-      if (!job || typeof job.id !== 'string' || !Array.isArray(job.shas)) continue;
-      if (reverting.has(job.id)) continue;
-      reverting.add(job.id);
-      (async () => {
-        try {
-          note(`${c.cyan('revert')} ${c.dim(`— ${job.title}`)}`);
-          const res = await withPatchLock(() =>
-            Promise.resolve(revertPatch({ repoRoot, shas: job.shas }))
-          );
-          if (res.ok) ok(`${c.dim('reverted')} ${job.title}`);
-          else warn(`revert failed for "${job.title}": ${res.error}`);
-          // ALWAYS report, success or not. Without this the flag stays set, the
-          // roster re-serves the job every poll, and each pass reverts the
-          // revert — the change flapping in and out of the owner's tree forever.
-          await postToFleet(PATCH_REVERT_DONE_URL, {
-            taskId: job.id,
-            ok: res.ok,
-            error: res.ok ? undefined : String(res.error ?? 'revert failed'),
-          });
-        } finally {
-          reverting.delete(job.id);
-        }
-      })();
-    }
-  };
-  return processPatchRevertJobs;
-}
-
-export function createCleanupLane({ repoRoot, getBaseRef }) {
-  // Cleanup jobs (task restarts): close the abandoned PR + delete its remote
-  // branch on the user's own gh, so a restart doesn't litter the repo.
-  const CLEANUP_DONE_URL = fleetEndpoint('cleanup-done', FLEET_URL);
-  const cleaning = new Set();
-  const processCleanupJobs = (jobs) => {
-    for (const job of jobs ?? []) {
-      if (!job || typeof job.id !== 'string') continue; // a null element would wedge the loop
-      if (cleaning.has(job.id)) continue;
-      cleaning.add(job.id);
-      (async () => {
-        try {
-          note(`${c.cyan('cleanup')} ${c.dim(`— ${job.title} (restarted)`)}`);
-          // Same guards as merge: only close a PR in THIS repo, only delete a
-          // well-formed non-base branch. A bad server must not close a stranger's
-          // PR or delete `main` (`--delete` with `main`) via a cleanup job.
-          if (job.prUrl && isValidPrUrl(job.prUrl, originSlug(repoRoot))) {
-            try {
-              execFileSync(
-                'gh',
-                [
-                  'pr',
-                  'close',
-                  job.prUrl,
-                  '--comment',
-                  'Task restarted in Flowviant — this attempt was discarded.',
-                  '--delete-branch',
-                ],
-                { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
-              );
-            } catch (e) {
-              // Already closed/merged/missing = fine; anything else we still
-              // report done — a restart must never wedge on stale remotes.
-              const err = e.stderr?.toString?.() || e.message || '';
-              warn(`cleanup for "${job.title}": ${err.split('\n')[0] || 'gh pr close failed'}`);
-            }
-          } else if (job.branch && isValidBranch(job.branch, repoRoot, getBaseRef())) {
-            try {
-              // Explicit refspec form so a leading '-' can't be a git flag.
-              // NETWORK call, so timed and non-interactive (2026-09-24, the
-              // audit): a bare execFileSync here had no timeout and could
-              // prompt on /dev/tty, freezing every poll and lease on the
-              // machine behind this cleanup's own async loop.
-              await gitNetAsync(['push', 'origin', `:refs/heads/${job.branch}`], repoRoot);
-            } catch {
-              /* branch already gone — fine */
-            }
-          } else if (job.prUrl || job.branch) {
-            warn(`cleanup REFUSED for "${job.title}": untrusted PR/branch value`);
-          }
-          await postToFleet(CLEANUP_DONE_URL, { taskId: job.id });
-          ok(`${c.cyan('cleaned')} ${c.dim(`— ${job.title}`)}`);
-        } finally {
-          cleaning.delete(job.id);
-        }
-      })();
-    }
-  };
-  return processCleanupJobs;
-}