flowviant 0.116.0 → 0.124.0

package/bin/lib/codexProjectRead.mjs

@@ -0,0 +1,63 @@
+/** Actual project files and Git history, with no host-wide read fallback.
+ * The CLI retains its provider/MCP login outside the tool sandbox. Shells
+ * receive neither that environment nor native image reads/shell snapshots.
+ */
+import { execFileSync } from 'node:child_process';
+import { lstatSync, readdirSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, dirname } from 'node:path';
+import { git } from './git.mjs';
+import { codexResearchHelper } from './codexResearch.mjs';
+import { unattendedEnv } from './noWindowEnv.mjs';
+
+export function projectReadBoundary({ cwd, knowledgeDir, env = process.env }) {
+  if (process.platform !== 'linux') throw new Error('Project-scoped Codex reads require Linux or WSL.');
+  if (!isAbsolute(cwd ?? '')) throw new Error('Project-scoped Codex reads require an absolute project directory.');
+  const helper = codexResearchHelper(env);
+  const version = execFileSync(helper, ['--version'], { encoding: 'utf8', timeout: 10000, env: unattendedEnv(env) }).match(/^codex-cli (\d+)\.(\d+)\.(\d+)/);
+  if (!version || version.slice(1).map(Number).reduce((n, v) => n * 1000 + v, 0) < 159002)
+    throw new Error('Project-scoped reads need Codex CLI 0.159.2 or newer. Update Codex before retrying.');
+  const project = realpathSync(cwd);
+  // Resolve both: linked worktrees have their own HEAD/index and shared
+  // objects/refs in the common directory. Never grant the parent checkout.
+  const gitOpts = { timeout: 10000, env: { PATH: env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' } };
+  const local = realpathSync(git(['rev-parse', '--absolute-git-dir'], project, gitOpts));
+  const common = realpathSync(git(['rev-parse', '--path-format=absolute', '--git-common-dir'], project, gitOpts));
+  const paths = [project, local, common];
+  // Git directories also hold daemon login/thread/browser stores. They are
+  // not history. Mask non-Git directories, including other worktree stores.
+  const metadata = new Set(['HEAD', 'index', 'commondir', 'gitdir', 'config', 'config.worktree', 'objects', 'refs', 'logs', 'packed-refs', 'shallow', 'description', 'info', 'branches']);
+  const denied = [];
+  for (const dir of new Set([local, common])) {
+    for (const name of readdirSync(dir)) {
+      if (dir === common && name === 'worktrees' && local !== common) {
+        for (const sibling of readdirSync(join(common, name))) {
+          const path = join(common, name, sibling);
+          if (path !== local && path !== dirname(local)) denied.push(path);
+        }
+      } else if (!metadata.has(name) && lstatSync(join(dir, name)).isDirectory()) denied.push(join(dir, name));
+    }
+  }
+  if (knowledgeDir) paths.push(realpathSync(knowledgeDir));
+  return { paths: [...new Set(paths)], denied, helper };
+}
+
+export function projectReadFence({ paths, denied = [], helper }) {
+  const rules = { ':root': 'deny', ':minimal': 'read', [helper]: 'read' };
+  for (const path of paths) {
+    if (!isAbsolute(path) || path === '/') throw new Error('Invalid project read boundary.');
+    rules[path] = 'read';
+  }
+  for (const path of denied) rules[path] = 'deny';
+  const table = '{' + Object.entries(rules).map(([path, access]) => `${JSON.stringify(path)}=${JSON.stringify(access)}`).join(',') + '}';
+  return [
+    '-c', `permissions.flowviantproject.filesystem=${table}`,
+    '-c', 'permissions.flowviantproject.network.enabled=false',
+    '-c', 'default_permissions="flowviantproject"',
+    '-c', 'approval_policy="never"',
+    '-c', 'project_doc_max_bytes=0',
+    '-c', 'features.shell_snapshot=false', '-c', 'allow_login_shell=false',
+    '-c', 'shell_environment_policy.inherit="none"',
+    '-c', 'shell_environment_policy.set={PATH="/usr/bin:/bin",HOME="/nonexistent",GIT_CONFIG_NOSYSTEM="1",GIT_CONFIG_GLOBAL="/dev/null",GIT_PAGER="cat",BROWSER="none"}',
+    '--disable', 'view_image',
+  ];
+}

package/bin/lib/codexRelay.mjs

@@ -20,7 +20,7 @@
  * classifier. The sentence names what was measured and the one remedy the
  * machine's own CLI offers; Codex's own words stay beside it.
  */
-import { scrub as envScrub } from './uplinkScrub.mjs';
+import { scrub as envScrub, scrubCut } from './uplinkScrub.mjs';
 import { CODEX_RUNTIME } from './runtimeCodex.mjs';
 
 const NO_LOGIN = /unexpected status 401 Unauthorized: Missing bearer or basic authentication/;
@@ -55,9 +55,25 @@ export function codexApprovalSentence(refused) {
   return `Codex on the machine refused ${n} tool call${n === 1 ? '' : 's'} in this turn${which} — "MCP tool call requires approval, but approval policy is never" — so nothing ${n === 1 ? 'it' : 'they'} would have done was done.`;
 }
 
+/**
+ * WHAT A TERMINAL OR NEW TASK REPLY MAY CARRY BACK (2026-10-10, the audit's
+ * final cleanup; F042's daemon half). The server's `SESSION_ANSWER_MAX`
+ * (shared `fieldCaps.ts`): the settle route (`/fleet/work-turn-done`) cuts an
+ * answer there and the session writer clamps every message to it. The daemon
+ * cuts there too before it sends — `withRelay` below and the plain reply in
+ * `workSessionTurns.mjs` — so nothing past it crosses the wire. It was a bare
+ * `16000` in both; the release gate (`scripts/check-app-parity.mjs`, rule 29)
+ * holds this copy equal to the shared one.
+ */
+export const SESSION_ANSWER_MAX = 16_000;
+
 /** A reply with the sentence first and Codex's own words kept under it,
- *  scrubbed like every reply and cut to the lane's cap. */
-export function withRelay(sentence, raw, cap = 16000) {
-  const words = envScrub(String(raw ?? '')).trim();
-  return (words ? `${sentence}\n\n${words}` : sentence).slice(0, cap);
+ *  scrubbed like every reply and cut to the lane's cap — the words scrubbed
+ *  whole before they are trimmed, and the reply cut only after (`scrubCut`). */
+export function withRelay(sentence, raw, cap = SESSION_ANSWER_MAX) {
+  const reply = (s) => {
+    const words = envScrub(s).trim();
+    return words ? `${sentence}\n\n${words}` : sentence;
+  };
+  return scrubCut(raw, cap, reply);
 }

package/bin/lib/codexResearch.mjs

@@ -0,0 +1,193 @@
+/** Codex research reads a copied view, never the host checkout or login store.
+ * Linux/WSL only: the CLI process retains its login outside its tool sandbox;
+ * tools get root-denied reads, a clean environment and no shell snapshots.
+ * Web search is a CLI tool, not direct shell network access.
+ */
+import { execFileSync } from 'node:child_process';
+import { codexHome } from './codexHome.mjs';
+import { git } from './git.mjs';
+import { ensureRealSubdir, realDirState } from './ownedDirs.mjs';
+import { closeSync, constants, copyFileSync, existsSync, fstatSync, openSync, readFileSync, readSync, lstatSync, mkdirSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+
+const MAX_FILES = 20_000;
+const MAX_BYTES = 128 * 1024 * 1024;
+const omitted = (name) => /^(\.git|\.env.*|\.claude|\.codex|\.mcp\.json|node_modules|credentials(?:\..*)?|auth\.json)$/i.test(name) || /\.(pem|key|p12|pfx)$/i.test(name);
+
+/** Fresh copies also break hardlinks. Symlinks, devices and sockets never ride.
+ * Refuse over the bound instead of presenting a silently incomplete repo.
+ */
+export function copyResearchView(source, destination, budget = { files: 0, bytes: 0 }) {
+  mkdirSync(destination, { recursive: true, mode: 0o700 });
+  for (const entry of readdirSync(source, { withFileTypes: true })) {
+    if (omitted(entry.name)) continue;
+    const from = join(source, entry.name);
+    const to = join(destination, entry.name);
+    const stat = lstatSync(from);
+    if (stat.isSymbolicLink()) continue;
+    if (stat.isDirectory()) {
+      // Only the card's files and kept library are inputs from .flowviant.
+      if (entry.name === '.flowviant') {
+        for (const input of ['uploads', 'knowledge', 'artifacts']) {
+          const dir = join(from, input);
+          if (realDirState(dir) === 'dir')
+            copyResearchView(dir, join(to, input), budget);
+        }
+      } else copyResearchView(from, to, budget);
+    } else if (stat.isFile()) {
+      budget.files += 1;
+      budget.bytes += stat.size;
+      if (budget.files > MAX_FILES || budget.bytes > MAX_BYTES)
+        throw new Error('The isolated research copy exceeds 20,000 files or 128 MB. Narrow the repository inputs before trying again.');
+      // A file replaced by a symlink between enumeration and copy must not
+      // bring host data into the readable view. Copy through a no-follow fd.
+      const fd = openSync(from, constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        if (!fstatSync(fd).isFile()) throw new Error('A research input changed while copying.');
+        copyFileSync(`/proc/self/fd/${fd}`, to);
+      } finally { closeSync(fd); }
+    }
+  }
+}
+
+/** Resolve the actual sandbox helper without granting the person's bin/home.
+ * Support native installs and the npm wrapper's platform package. Unknown
+ * installations refuse; granting the whole home to find a helper is no fence.
+ */
+export function codexResearchHelper(env = process.env) {
+  const command = (env.PATH ?? '').split(':').map((dir) => join(dir, 'codex')).find((file) => existsSync(file));
+  if (!command) throw new Error('Codex is not installed on PATH.');
+  const executable = realpathSync(command);
+  const fd = openSync(executable, 'r');
+  const magic = Buffer.alloc(4);
+  try { readSync(fd, magic, 0, 4, 0); } finally { closeSync(fd); }
+  if (magic.equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46]))) return executable;
+  const target = process.arch === 'arm64' ? 'aarch64-unknown-linux-musl' : 'x86_64-unknown-linux-musl';
+  const platform = `@openai/codex-linux-${process.arch === 'arm64' ? 'arm64' : 'x64'}`;
+  let root;
+  try { root = dirname(createRequire(executable).resolve(`${platform}/package.json`)); }
+  catch { root = resolve(dirname(executable), '..'); }
+  const binary = join(root, 'vendor', target, 'bin', 'codex');
+  if (!existsSync(binary)) throw new Error('This Codex installation has no measured Linux research sandbox helper.');
+  return realpathSync(binary);
+}
+
+/** The research posture's own pairs: the copied view's filesystem table, no
+ * shell network, live web, a clean shell environment. runtimeCodex.mjs ends it
+ * in the shared fenced tail (sub-agents, browser, image generation, the
+ * person's config and rules), with the web left on: it is this posture's tool.
+ */
+export function researchFence({ cwd, helper, generatedImages }) {
+  if (process.platform !== 'linux' || !isAbsolute(cwd ?? '') || !isAbsolute(helper ?? ''))
+    throw new Error('Isolated Codex research requires Linux or WSL and absolute sandbox paths.');
+  const artifacts = join(cwd, '.flowviant/artifacts');
+  const scratch = join(cwd, '.flowviant/tmp');
+  const rules = { ':root': 'deny', ':minimal': 'read', [helper]: 'read', [cwd]: 'read', [artifacts]: 'write', [scratch]: 'write' };
+  if (generatedImages) {
+    if (!isAbsolute(generatedImages)) throw new Error('Generated image directory must be absolute.');
+    rules[generatedImages] = 'read';
+  }
+  const table = '{' + Object.entries(rules).map(([path, access]) => `${JSON.stringify(path)}=${JSON.stringify(access)}`).join(',') + '}';
+  return [
+    '-c', `permissions.flowviantresearch.filesystem=${table}`,
+    '-c', 'permissions.flowviantresearch.network.enabled=false',
+    '-c', 'default_permissions="flowviantresearch"',
+    '-c', 'approval_policy="never"',
+    '-c', 'web_search="live"', '-c', 'tools.web_search=true',
+    '-c', 'features.shell_snapshot=false', '-c', 'allow_login_shell=false',
+    '-c', 'shell_environment_policy.inherit="none"',
+    '-c', `shell_environment_policy.set={PATH="/usr/bin:/bin",HOME=${JSON.stringify(scratch)},TMPDIR=${JSON.stringify(scratch)},BROWSER="none"}`,
+    '--disable', 'view_image', // native host-file reads bypass the tool fence
+    '--skip-git-repo-check',
+  ];
+}
+
+/** Copy only regular Markdown outputs back. Never follow a model-written link,
+ * nor one standing in the worktree: a destination directory must be a real one
+ * or absent (ownedDirs.mjs, the daemon's one link rule), and a file is written
+ * only where nothing or a regular file stands, created exclusively so a link
+ * swapped in after the look is never followed. A write-up already holding
+ * these exact bytes is left alone: the copied view carried it in, and its
+ * mtime is the artifact scan's evidence that the turn did not write it
+ * (artifacts.mjs `writtenSince`), so a turn that wrote nothing delivers
+ * nothing. Artifact publication stays in the original worktree for the
+ * existing uploader.
+ */
+export function publishResearch(source, destination) {
+  if (realDirState(destination) === 'none') mkdirSync(destination, { recursive: true });
+  if (realDirState(destination) !== 'dir') throw new Error('The research artifact destination is not a real directory.');
+  for (const entry of readdirSync(source, { withFileTypes: true })) {
+    const from = join(source, entry.name);
+    const to = join(destination, entry.name);
+    const stat = lstatSync(from);
+    if (stat.isSymbolicLink()) throw new Error('An isolated research output is a symlink; nothing was accepted through it.');
+    if (stat.isDirectory()) publishResearch(from, to);
+    else if (stat.isFile() && /\.md$/i.test(entry.name)) {
+      if (stat.size > 2 * 1024 * 1024) throw new Error('The research Markdown output exceeds 2 MB.');
+      let there = null;
+      try {
+        there = lstatSync(to);
+      } catch (e) {
+        if (e?.code !== 'ENOENT') throw e;
+      }
+      if (there && !there.isFile()) throw new Error('The research output would overwrite a non-file.');
+      const bytes = readFileSync(from);
+      if (there && there.size === bytes.length && readFileSync(to).equals(bytes)) continue;
+      if (there) unlinkSync(to);
+      writeFileSync(to, bytes, { flag: 'wx' });
+    }
+  }
+}
+
+export async function runIsolatedResearch(opts, run, {
+  resolveHelper = codexResearchHelper,
+  readVersion = (helper) => execFileSync(helper, ['--version'], { encoding: 'utf8', timeout: 10_000 }),
+} = {}) {
+  if (process.platform !== 'linux') throw new Error('Isolated Codex research requires Linux or WSL.');
+  const original = realpathSync(opts.cwd);
+  const helper = resolveHelper();
+  const version = readVersion(helper).match(/codex-cli (\d+)\.(\d+)\.(\d+)/);
+  if (!version || version.slice(1).map(Number).reduce((n, v) => n * 1000 + v, 0) < 159002)
+    throw new Error('Isolated research needs Codex CLI 0.159.2 or newer. Restart after updating Codex.');
+  // Both publication parents must be real directories in this checkout, or
+  // absent — never a link, dangling or not (ownedDirs.mjs).
+  for (const dir of [join(original, '.flowviant'), join(original, '.flowviant/artifacts')])
+    if (realDirState(dir) === 'other')
+      throw new Error('The research artifact destination is not a real directory.');
+  // Kept path across resumes, outside the source tree and separate from Codex's
+  // login/thread home. The caller's agent lock serializes turns in this place.
+  const gitDir = git(['rev-parse', '--absolute-git-dir'], original);
+  const isolation = join(gitDir, 'flowviant-research');
+  if (existsSync(isolation) && lstatSync(isolation).isSymbolicLink()) throw new Error('The research isolation directory is a symlink.');
+  rmSync(isolation, { recursive: true, force: true });
+  const snapshot = join(isolation, 'repo');
+  try {
+    copyResearchView(original, snapshot);
+    let knowledge = null;
+    if (opts.knowledgeDir) {
+      knowledge = join(snapshot, '.flowviant/knowledge');
+      copyResearchView(realpathSync(opts.knowledgeDir), knowledge);
+    }
+    for (const dir of ['artifacts', 'tmp']) mkdirSync(join(snapshot, '.flowviant', dir), { recursive: true, mode: 0o700 });
+    const rewrite = (text) => typeof text === 'string'
+      ? text.replaceAll(original, snapshot).replaceAll(opts.knowledgeDir || '\0', knowledge || '\0') : text;
+    const intro = 'This fresh research turn uses an isolated read-only copy. Prior reports are available under .flowviant/artifacts/; previous CLI conversations are not resumed because they may contain host secrets. Git metadata, .env files, credential files, symlinks and personal CLI settings are omitted. Write the Markdown report only under .flowviant/artifacts/. Web search is available; shell networking is disabled. Use exec_command with shell=/bin/bash and login=false; personal shells are outside the fence.\n\n';
+    // Only native output pixels, never the surrounding login/config home.
+    let generatedImages;
+    if (opts.mcpEnv?.CODEX_HOME) {
+      const imageHome = realpathSync(codexHome({ ...process.env, ...opts.mcpEnv }));
+      if (!ensureRealSubdir(imageHome, 'generated_images'))
+        throw new Error('The native generated image directory is not a real directory.');
+      generatedImages = join(imageHome, 'generated_images');
+    }
+    const result = await run({ ...opts, resume: false, resumeThreadId: null, resumeConversationId: null, cwd: snapshot, knowledgeDir: knowledge,
+      prompt: intro + rewrite(opts.prompt), system: rewrite(opts.system),
+      researchIsolation: { cwd: snapshot, helper, generatedImages } });
+    // Made, or found, real at publication too: every component checked again.
+    if (!ensureRealSubdir(original, '.flowviant/artifacts'))
+      throw new Error('The research artifact destination is not a real directory.');
+    publishResearch(join(snapshot, '.flowviant/artifacts'), join(original, '.flowviant/artifacts'));
+    return typeof result === 'string' ? result.replaceAll(snapshot, original) : result;
+  } finally { rmSync(isolation, { recursive: true, force: true }); }
+}

package/bin/lib/commandSpecs.mjs

@@ -21,6 +21,12 @@
  */
 
 export const COMMANDS = [
+  {
+    name: 'maintenance', usesCheckout: false, hidden: true,
+    usage: 'flowviant maintenance <request|release> <token>',
+    summary: 'Hold new runs for a manual WSL restart; existing work finishes.',
+    group: 'manage',
+  },
   {
     name: 'start',
     usesCheckout: true,

package/bin/lib/config.mjs

@@ -69,6 +69,10 @@ function argFlag(name) {
  */
 const API_BASE = process.env.FLOWVIANT_API_URL || 'https://api.flowviant.com/api';
 export const MCP_URL = process.env.FLOWVIANT_MCP_URL || `${API_BASE}/mcp`;
+/** The web app a terminal view or a device login sends a person to. One
+ *  declaration (audit 2026-10-10, F753): login.mjs and views.mjs each held a
+ *  copy of this line. */
+export const APP_URL = process.env.FLOWVIANT_APP_URL || 'https://app.flowviant.com';
 export const FLEET_URL = process.env.FLOWVIANT_FLEET_URL || `${API_BASE}/fleet/agents`;
 // Push channel: the daemon holds this WebSocket open and the server nudges it
 // the instant a job lands, so dispatch is ~a round-trip instead of a full poll.
@@ -76,7 +80,6 @@ export const FLEET_URL = process.env.FLOWVIANT_FLEET_URL || `${API_BASE}/fleet/a
 export const STREAM_URL =
   process.env.FLOWVIANT_STREAM_URL ||
   FLEET_URL.replace(/\/agents(\/?)$/, '/stream$1').replace(/^http/, 'ws');
-export const POLL_SECONDS = Number(process.env.POLL_SECONDS || 20);
 
 // What this machine can actually be given — the cgroup's limits before the
 // host's. The rule and its reader live in machineLimits.mjs; this is the
@@ -147,16 +150,42 @@ export const MACHINE = measureMachineLimits();
  *    every agent. `cores * 2` lets the scheduler do what it is for, and memory
  *    stays the bound that actually refuses.
  *
- * `min(32, …)` and the env override are untouched: the hard 32 is a runaway
- * bound on a box, not a product decision, and an operator who typed a number at
- * the machine gets exactly that number.
+ * `min(TURN_CEILING_MAX, …)` and the env override are untouched: the hard 32 is
+ * a runaway bound on a box, not a product decision, and an operator who typed
+ * a number at the machine gets exactly that number.
  */
 export function deriveMaxConcurrent(memBytes, cores) {
   const byMem = Math.floor(memBytes / 2 ** 30 - 2);
   const byCpu = Number(cores) * 2;
-  return Math.max(1, Math.min(32, byMem, byCpu));
+  return Math.max(1, Math.min(TURN_CEILING_MAX, byMem, byCpu));
 }
 
+/**
+ * THE RUNAWAY BOUND ON TURNS AT ONCE, AND THE ONE READING OF A CEILING
+ * (2026-10-10, audit F070).
+ *
+ * Every author of the ceiling — the env var, the server's dial, the
+ * derivation and an admission's own read — goes through `clampTurnCeiling`,
+ * which was five hand copies of one rule across this file and admission.mjs:
+ * a usable ceiling is a finite number ≥ 1, floored and capped at
+ * `TURN_CEILING_MAX`; anything else is ABSENT (null), never 0 or NaN — a 0
+ * refuses every spawn forever, and `live >= NaN` is no ceiling at all.
+ *
+ * 32 is the server's own bound on the dial (`machineTurnsSchema.maxTurns`,
+ * `max(32)` in the shared agent-runner schema): the release parity gate
+ * (`scripts/check-app-parity.mjs`) holds this copy to it, so the app never
+ * stores a dial no machine honours, and no machine caps one it would.
+ */
+export const TURN_CEILING_MAX = 32;
+export function clampTurnCeiling(raw) {
+  const v = Number(raw);
+  return Number.isFinite(v) && v >= 1 ? Math.min(Math.floor(v), TURN_CEILING_MAX) : null;
+}
+
+/** The operator's `FLOWVIANT_MAX_CONCURRENT`, read once through the one clamp:
+ *  null when unset or unusable (the derivation stands). */
+const MAX_CONCURRENT_ASKED = clampTurnCeiling(process.env.FLOWVIANT_MAX_CONCURRENT);
+
 /**
  * WAS THE ENV VAR THE SOURCE? — the one fact the precedence rule cannot
  * reconstruct afterwards.
@@ -166,20 +195,10 @@ export function deriveMaxConcurrent(memBytes, cores) {
  * last word and must outrank the app's dial, the other is a default the app may
  * override. See `pickMaxTurns` in admission.mjs for what is done with it.
  */
-export const MAX_CONCURRENT_FROM_ENV = (() => {
-  const asked = Number(process.env.FLOWVIANT_MAX_CONCURRENT);
-  return Number.isFinite(asked) && asked >= 1;
-})();
+export const MAX_CONCURRENT_FROM_ENV = MAX_CONCURRENT_ASKED !== null;
 
-export const MAX_CONCURRENT = (() => {
-  const asked = Number(process.env.FLOWVIANT_MAX_CONCURRENT);
-  if (Number.isFinite(asked) && asked >= 1) return Math.min(Math.floor(asked), 32);
-  return deriveMaxConcurrent(MACHINE.memBytes, MACHINE.cores);
-})();
-export const IDLE_SECONDS = Number(process.env.IDLE_SECONDS || 30);
-// Live mode: after this long idle-parked on a blocker, tear the session down to
-// free the Claude process (the intent stays claimed; it resumes when answered).
-export const PARK_TIMEOUT_SECONDS = Number(process.env.PARK_TIMEOUT_SECONDS || 900);
+export const MAX_CONCURRENT =
+  MAX_CONCURRENT_ASKED ?? deriveMaxConcurrent(MACHINE.memBytes, MACHINE.cores);
 export const RECONCILE_SECONDS = Number(process.env.RECONCILE_SECONDS || 10);
 // Proactively refresh a worker token this many seconds before its lease lapses,
 // so a long-lived daemon never silently 401s on an expired token.
@@ -190,12 +209,6 @@ export const SAFE = process.env.FLOWVIANT_SAFE === '1';
 // keeps it nag-only (it still tells you to update, never installs). Below the
 // server's MIN version it updates regardless, since live mode won't work.
 export const AUTO_UPDATE = process.env.FLOWVIANT_NO_UPDATE !== '1';
-// Live mode (DEFAULT since 0.8.0): persistent Agent-SDK session per task —
-// streams into the task channel, injectable mid-task, blocker-parks in place,
-// delivery card on complete, branch preview tunnels. The legacy poll/sentinel
-// path (one-shot `claude -p` turns) survives behind FLOWVIANT_POLL=1 as the
-// escape hatch; FLOWVIANT_LIVE=1 is still honored for old scripts.
-export const LIVE = process.env.FLOWVIANT_POLL !== '1';
 // Sent on the daemon's own HTTP calls so Cloudflare Bot Fight Mode doesn't 403
 // them (Node's default UA is treated as a bot). Claude Code sends its own UA.
 export const USER_AGENT = `flowviant/${VERSION}`;

package/bin/lib/conversationIds.mjs

@@ -0,0 +1,51 @@
+/**
+ * WHICH CONVERSATION A TAB RESUMES — the shape each CLI's conversation id must
+ * have, and the marker each tab pins it under (audit 2026-10-10, F157).
+ *
+ * A LEAF ON PURPOSE: no imports. These regexes are argv-injection and
+ * path-traversal guards — an id rides argv as `--resume <id>`, `resume <id>`
+ * or `--conversation <id>`, and Claude's is joined into a transcript path the
+ * probe cleanup then REMOVES — and they were written out by hand: Claude's
+ * four times, Antigravity's twice. A CLI that changes its id format would
+ * have had someone loosen one copy and miss the one guarding `rmSync`. The
+ * readers (claudeSessions, agySessions, runtimeCapabilities, runtimeLimits)
+ * sit below the work lanes, so the shapes cannot live in a lane module.
+ *
+ * THE MARKER NAMES ARE HERE FOR THE SAME REASON. `workSessionTurns.mjs`
+ * WRITES them (`sessionMetaPath(wt, <name>, sessionId)`), workPlaceReports
+ * reads Claude's for the tab's title, and localSessions READS all of them to
+ * know which conversations are the daemon's own — a drift between the writer
+ * and that fence is silent, and offers somebody their own tab back as an
+ * adoptable terminal session.
+ */
+
+/**
+ * Claude Code's session id, as `system.init` reports it. Conservative: word
+ * characters and dash, 8–64 of them, so it can neither climb a path nor
+ * carry whitespace into argv.
+ */
+export const CLAUDE_SESSION_RE = /^[A-Za-z0-9_-]{8,64}$/;
+
+/**
+ * The shape a codex thread id must have before it is written to disk or —
+ * decisive — pushed into argv as `resume <id>`. Conservative on purpose:
+ * alphanumeric plus dash/underscore, never a leading dash (an argv that
+ * parses as a flag), never whitespace. Anything else is dropped and the
+ * session simply runs fresh in its own worktree.
+ */
+export const CODEX_THREAD_RE = /^[0-9a-zA-Z][0-9a-zA-Z_-]{7,63}$/;
+
+/** agy conversation ids are plain UUIDs (the db filename IS the identity —
+ *  measured: a renamed copy fails "trajectory not found"). Guarded the same
+ *  way as the codex id: it rides in argv as `--conversation <id>`. */
+export const AGY_CONV_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Each runtime's per-tab conversation marker (scoped by the session id). */
+export const RESUME_MARKERS = Object.freeze({
+  claude: 'flowviant-claude-session',
+  codex: 'flowviant-codex-thread',
+  antigravity: 'flowviant-agy-conversation',
+});
+
+/** Every tab's conversation marker — what the adopt fence reads back. */
+export const SESSION_MARKERS = Object.freeze(Object.values(RESUME_MARKERS));

package/bin/lib/credentials.mjs

@@ -44,7 +44,6 @@
  * mistake permanent.
  */
 
-import { execFileSync } from 'node:child_process';
 import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -52,6 +51,7 @@ import { printable } from './printable.mjs';
 import { connectedOn } from './credentialDate.mjs';
 import { terminalCommand } from './launchCommand.mjs';
 import { samePath } from './repoPath.mjs';
+import { git } from './git.mjs';
 
 const CRED_DIR = join(homedir(), '.flowviant');
 const CRED_FILE = join(CRED_DIR, 'credentials.json');
@@ -76,12 +76,7 @@ function writeFile(v) {
 /** The repo root of `cwd`, realpath'd, or null when not inside a git repo. */
 export function detectRepoRoot(cwd = process.cwd()) {
   try {
-    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], {
-      cwd,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 5000,
-    }).trim();
+    const root = git(['rev-parse', '--show-toplevel'], cwd, { stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
     return root ? realpathSync(root) : null;
   } catch {
     return null;

package/bin/lib/daemonLocks.mjs

@@ -0,0 +1,90 @@
+/**
+ * THE DAEMON LOCK FILE — its name, its record, and the one scan of them
+ * (audit 2026-10-10, F090/F123).
+ *
+ * instance.mjs arbitrates with these files; the status readout
+ * (daemonState.mjs, desktopContract.mjs) and `flowviant uninstall` only READ
+ * them. Each of those readers used to keep its own copy of the filename
+ * pattern or the record parse, and they had drifted: uninstall carried its own
+ * regex and pid read, the readout returned a pid that was not a positive
+ * integer, and `daemonRunningFor` re-implemented `readHolder` line for line. The
+ * FILENAME PATTERN is the thing that must not drift between them: it is what
+ * separates our locks from anything else living in ~/.flowviant, and a scan
+ * that stops matching sees an empty machine — so `uninstall --others` would
+ * remove the copy a live daemon runs from.
+ *
+ * A leaf (node builtins only), so a reader never has to load instance.mjs's
+ * takeover machinery to look at a file; instance.mjs re-exports all of it.
+ */
+
+import * as nodeFs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+/** Every daemon lock's file name: `daemon-` + 12 hex of the credential's hash. */
+export const DAEMON_LOCK_RE = /^daemon-[0-9a-f]{12}\.lock$/;
+
+/** Deliberately a HASH: a credential must never become a filename. */
+export function instanceLockPath(fleetToken, home = homedir()) {
+  const key = createHash('sha256').update(String(fleetToken || 'anon')).digest('hex').slice(0, 12);
+  return join(home, '.flowviant', `daemon-${key}.lock`);
+}
+
+/**
+ * A lock record, or null: absent, truncated, half-written, or naming no
+ * positive integer pid (a pid of '12' is not a pid). Everything else the
+ * record carries — repoRoot, startedAt, entry, version, draining — is the
+ * caller's to read; none of it is required.
+ */
+export function parseLockRecord(text) {
+  try {
+    const v = JSON.parse(text);
+    return v && Number.isInteger(v.pid) && v.pid > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The record in the lock file at `path`, or null (see parseLockRecord). */
+export function readLockFile(path, { fs = nodeFs } = {}) {
+  try {
+    return parseLockRecord(fs.readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** The record in this credential's lock, or null. */
+export function readLockHolder(fleetToken) {
+  return readLockFile(instanceLockPath(fleetToken));
+}
+
+/**
+ * Every daemon lock on this machine, sorted by name for a stable read:
+ * `[{ path, holder }]`, where `holder` is null for a file with no readable
+ * record (no caller reads that as a daemon). ONE scan, because three callers
+ * walk this directory for different reasons — instance.mjs looking for a
+ * neighbour in the same repo, `flowviant stop` sweeping the lot, uninstall
+ * protecting the copy a live daemon runs from. An unreadable (or absent)
+ * directory is not an error here, it is an empty machine. `fs` and `home` are
+ * injectable for uninstall's test seams. The manual WSL restart asks for
+ * `strict`: only a missing directory is empty; other scan failures throw.
+ */
+export function listDaemonLocks({ fs = nodeFs, home = homedir(), strict = false } = {}) {
+  const dir = join(home, '.flowviant');
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch (error) {
+    if (strict && error.code !== 'ENOENT') throw error;
+    return [];
+  }
+  return names
+    .filter((name) => DAEMON_LOCK_RE.test(name))
+    .sort()
+    .map((name) => {
+      const path = join(dir, name);
+      return { path, holder: readLockFile(path, { fs }) };
+    });
+}

package/bin/lib/daemonState.mjs

@@ -13,7 +13,7 @@ import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { emitMachineEvent } from './daemonLogging.mjs';
-import { instanceLockPath } from './instance.mjs';
+import { readLockHolder } from './daemonLocks.mjs';
 
 const store = () => join(homedir(), '.flowviant');
 const key = (projectId) => createHash('sha256').update(String(projectId)).digest('hex').slice(0, 16);
@@ -56,9 +56,9 @@ export function setRuntimeLimit(projectId, runtime, words) {
   return true;
 }
 
-/** The pid in the instance lock for this credential, or null. */
+/** The pid in the instance lock for this credential, or null — read through
+ *  the lock's one record parse, so a pid that is not a positive integer is no
+ *  pid (2026-10-10, F090). */
 export function daemonLockPid(token) {
-  try {
-    return JSON.parse(readFileSync(instanceLockPath(token), 'utf8')).pid;
-  } catch { return null; }
+  return readLockHolder(token)?.pid ?? null;
 }

package/bin/lib/deploy.mjs

@@ -16,13 +16,13 @@
  *   - deployRunner.mjs    the commands, their environment and log scrubbing,
  *                         the health check (and why a deploy's secrets are
  *                         the machine's own environment)
- *   - deployWire.mjs      the one `/fleet/deploy-*` POST
+ *   - deployWire.mjs      the lane's `/fleet/deploy-*` wire (post, claim)
  */
 
 import { DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { scrub } from './uplinkScrub.mjs';
-import { post } from './deployWire.mjs';
+import { claim, post } from './deployWire.mjs';
 import { runDeploy } from './deployRunner.mjs';
 import { workLanesStopped } from './standDownGate.mjs';
 
@@ -99,16 +99,13 @@ export function processDeployJobs(jobs, ctx) {
     void (async () => {
       let beat = null;
       try {
-        // `instance` names THIS PROCESS. The pubkey cannot: it is the env
+        // `instance` names THIS PROCESS — the shared lease claim stamps it
+        // (fleetPost.mjs's `claimFleetLease`). The pubkey cannot: it is the env
         // keypair read from one file per home directory, so two daemons on one
         // box share it and a pubkey-only read-back let both "win" the claim
         // and run the same deploy twice concurrently.
-        const claimed = await post('deploy-claim', {
-          jobId: job.id,
-          pubkey: ctx.myPubB64(),
-          instance: DAEMON_INSTANCE,
-        }).catch(() => null);
-        if (!claimed?.claimed) return; // another daemon won the claim
+        const claimed = await claim('deploy-claim', { jobId: job.id, pubkey: ctx.myPubB64() });
+        if (!claimed) return; // another daemon won the claim, or none was made
         /**
          * A CLAIM THAT COMES BACK AFTER THE STAND-DOWN BEGAN IS NOT RUN. The
          * loop gate cannot see it (the claim was already on the wire), and the