flowviant 0.116.0 → 0.124.0

package/bin/lib/fleet.mjs

@@ -10,8 +10,8 @@
  * what order. What a lane DOES lives beside it — the poll's query string
  * (fleetRoster.mjs), the machine's own reports (fleetReports.mjs), holdership
  * and the terminal signals (holder.mjs), the wiki runner (wikiRunner.mjs), the
- * checkout job lanes (fleetJobs.mjs), the start steps (fleetStartup.mjs), the
- * reconcile wait (fleetWake.mjs), and session/agent work (work.mjs).
+ * start steps (fleetStartup.mjs), the reconcile wait (fleetWake.mjs), and
+ * session/agent work (work.mjs).
  *
  * Over the 500-line mark as ONE LIFECYCLE, not as debt: what is left is the
  * intake order over roster keys, and most of its length is the argument for
@@ -36,9 +36,10 @@ import { handleVersionSignal } from './update.mjs';
 import { compareVersions } from './versionOrder.mjs';
 import { emitMachineEvent } from './daemonLogging.mjs';
 import { writeDaemonState } from './daemonState.mjs';
+import { maintenanceTick, readMaintenance } from './maintenance.mjs';
 import { repoRootOrDie, detectBaseRef, baseBranchName, excludeInWorktree, usableBaseRef } from './git.mjs';
 import { c, info, note, ok, warn, fail } from './ui.mjs';
-import { sleep } from './claude.mjs';
+import { sleep } from './sleep.mjs';
 import { reapOrphanPreviews } from './previewRegistry.mjs';
 import { preflight } from './preflight.mjs';
 import { connectStream } from './stream.mjs';
@@ -56,6 +57,7 @@ import { createLeave } from './standDownExit.mjs';
 import { stopWorkLanes } from './standDownGate.mjs';
 import { markLockDraining } from './instance.mjs';
 import { reportDeployConfig } from './deployConfig.mjs';
+import { mcpInstallsInFlight, processMcpInstallJobs } from './mcpInstall.mjs';
 import { probeSkillsOnce } from './runtimeCapabilities.mjs';
 import { createWorkManager } from './work.mjs';
 import { INTAKE_ROSTER_KEY } from './workIntake.mjs';
@@ -70,12 +72,12 @@ import {
   maybeReportLocalSessions,
   maybeReportRepoState,
   maybeReportTools,
+  recheckProjectMcp,
   repoStateChanged,
   reportMachine,
 } from './fleetReports.mjs';
 import { createHolderWatch, obeyRosterCommands } from './holder.mjs';
 import { createWikiRunner } from './wikiRunner.mjs';
-import { createCleanupLane, createPatchRevertLane } from './fleetJobs.mjs';
 import { installSignalHandlers, takeInstanceLockOrExit, tidyWorktreeHome, worktreeHome } from './fleetStartup.mjs';
 import { createReconcileWait } from './fleetWake.mjs';
 
@@ -235,7 +237,10 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   // never-squash law — and every server since the pivot sends `mergeJobs: []`
   // (a wire fossil, `rosterResponse.ts`). Merges run through `prWorkflow.mjs`
   // (session PR job, agent approve) and `shipMerge.mjs`, and nowhere else.
-  const processPatchRevertJobs = createPatchRevertLane({ repoRoot });
+  // Its two checkout siblings went the same way (audit 2026-10-10, F083): no
+  // server sends `patchRevertJobs` (a `git revert` in this checkout) or
+  // `cleanupJobs` (`gh pr close --delete-branch`, a remote branch delete), and
+  // their settle routes died with dispatch, so nothing here reads either key.
 
   // ── Work sessions — the Workbench tabs ─────────────────────────────────────
   //
@@ -247,6 +252,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     flushWorkReports,
     learnPlaces,
     processWorkTurns,
+    interruptWorkTurns,
     processShipJobs,
     processDiffJobs,
     processKillJobs,
@@ -254,6 +260,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     processAgentPlanJobs,
     processIntakeJobs,
     processAgentTurnJobs,
+    interruptAgentTurns,
     processAgentMergeJobs,
     freshenManualPlaces,
     heldSessionIds,
@@ -263,9 +270,11 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     shutdownPreviews,
     retireWorkSessions,
     reportWorktrees,
+    reconcileIdleArtifacts,
     shutdownWork,
     settleAgentTurns,
     workBusy,
+    runningAgentCount,
     admit,
     liveTurns,
   } = createWorkManager({
@@ -314,8 +323,6 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   });
   workShutdown = shutdownWork; // teardown can now reach the live session CLIs
 
-  const processCleanupJobs = createCleanupLane({ repoRoot, getBaseRef });
-
   // Living-wiki work: one cartographer turn at a time, off the agents'
   // checkouts (wikiRunner.mjs). Wiki work needs no agent online.
   wiki = createWikiRunner({ repoRoot, baseDir, repoKey, getBaseRef, admit });
@@ -331,9 +338,9 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
    * from the server's list of WORKING AGENTS, which cannot see a Workbench
    * turn, a ship or a deploy.
    */
-  const machineBusy = () => wiki.busy() || workBusy() || deploysInFlight() > 0;
+  const machineBusy = () => wiki.busy() || workBusy() || deploysInFlight() > 0 || mcpInstallsInFlight() > 0;
   const reportBusy = () =>
-    writeDaemonState(desktopProjectId, { busy: machineBusy(), busyAt: new Date().toISOString() });
+    writeDaemonState(desktopProjectId, { busy: machineBusy(), liveAgents: runningAgentCount(), maintenance: null, busyAt: new Date().toISOString() });
   /**
    * HOW EVERY STAND-DOWN LEAVES — after the teardown, and after any deploy in
    * flight has finished and reported (standDownExit.mjs, ruling 2026-09-26).
@@ -379,6 +386,16 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   // share, no new deploy — only the deploys already claimed run on to their
   // report (standDownExit.mjs).
   const standingDown = () => leave.leaving();
+  let lastAgentJobs = [];
+  const reportMaintenance = (jobs = lastAgentJobs) => maintenanceTick({
+    busy: machineBusy,
+    agents: runningAgentCount,
+    flush: async () => {
+      await flushWorkReports();
+      processAgentTurnJobs(jobs, { reportsOnly: true });
+    },
+    report: (state) => writeDaemonState(desktopProjectId, state),
+  });
   for (;;) {
     if (standingDown()) return leave.drained();
     let roster;
@@ -412,7 +429,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
       }
       warn(`roster poll failed: ${e.message} — retrying in ${RECONCILE_SECONDS}s`);
       // Work already running keeps running offline; the measurement keeps up.
-      reportBusy();
+      if (!await reportMaintenance()) reportBusy();
       await sleep(RECONCILE_SECONDS);
       continue;
     }
@@ -490,7 +507,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
       // same one the desktop app's auto-install reads — which is how a deploy
       // in flight joined this gate (2026-09-26): re-exec'ing under one would
       // stop its heartbeat mid-run.
-      const safeToUpdate = !machineBusy();
+      const safeToUpdate = !machineBusy() && !readMaintenance();
       const updating = handleVersionSignal({
         latest: roster.daemon.latest,
         min: roster.daemon.min,
@@ -501,11 +518,23 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
       if (await updating) return;
       if (standingDown()) return leave.drained();
     }
+    // Keep polling to renew the running agents' leases and honour stops and
+    // interrupts. A paused tick admits no roster jobs, even after becoming
+    // idle; only held answers are retried until the tray releases its lease.
+    // Interrupts precede both paths so a stop arriving while paused still
+    // reaches its running CLI, and a successor sees the stop before intake.
+    interruptWorkTurns(roster.interruptTurns);
+    interruptAgentTurns(roster.interruptAgentTurns);
+    lastAgentJobs = roster.agentTurnJobs;
+    if (await reportMaintenance()) {
+      reportMachine({ worktreeDir: baseDir, liveTurns });
+      await sleep(RECONCILE_SECONDS);
+      continue;
+    }
     // Settle any turn/ship answers whose earlier report POST failed BEFORE
     // taking new work — the skip-if-pending guards make the ordering safe, but
     // delivering first keeps the tab honest a poll sooner.
     void flushWorkReports();
-    processPatchRevertJobs(roster.patchRevertJobs);
     // WHERE each live tab works, BEFORE anything measures one: the sweep below
     // and every preview check ask `placeOf`, and a tab nobody has typed into
     // yet has taught it nothing.
@@ -595,6 +624,10 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // themselves from a browser, relayed. After retirement so a directory that
     // just went away is not reported as a place.
     reportWorktrees(roster.activeWorkSessions);
+    // …and an idle agent's delivery against what its worktree still holds:
+    // once per process, beside no turn (workArtifactReconcile.mjs). After the
+    // turn intake above, so a card about to run in a place is not raced.
+    void reconcileIdleArtifacts(roster.activeWorkSessions)?.catch(() => {});
     // Terminal-session presence, throttled + dedup'd inside; never awaited —
     // the daemon's own worktrees are carved out (a session the daemon spawned
     // is already a tab, not something to offer adopting).
@@ -617,7 +650,6 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // startup on purpose: a daemon that has been up since before this release
     // gets measured too, without needing a restart to earn its own menu.
     probeSkillsOnce(repoRoot);
-    processCleanupJobs(roster.cleanupJobs);
     // Announce roster membership only when it changes (not every poll).
     const sig = [...new Set(roster.agents.map((a) => a.agentId))].sort().join(',');
     if (sig !== rosterSig) {
@@ -659,6 +691,14 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // This is what replaced the vault's sync tick — see `maybeReportEnv`.
     void maybeReportEnv(repoRoot);
     void maybeReportTools(repoRoot, getBaseRef());
+    // INSTALLS AN OWNER CONFIRMED FOR THIS BOX (mcpInstall.mjs) — handed to
+    // the picked box whether it holds the machine or stands by; each is
+    // claimed, run exactly as confirmed, and followed by a re-check.
+    processMcpInstallJobs(roster.mcpInstallJobs, {
+      repoRoot,
+      myPubB64,
+      recheck: () => recheckProjectMcp(repoRoot, getBaseRef()),
+    });
 
     // Tell the app what this machine is doing with itself (fleetReports.mjs).
     reportMachine({ worktreeDir: baseDir, liveTurns });

package/bin/lib/fleetPost.mjs

@@ -1,40 +1,187 @@
 /**
- * ONE DAEMON→SERVER POST THAT ANSWERS ONLY "WAS IT ACCEPTED" — the settle a
- * job lane sends when it is done (`patch-revert-done`, `cleanup-done`,
- * `reground-done`) and the machine telemetry beat (`/fleet/machine`).
+ * THE DAEMON'S MACHINE-CREDENTIAL REQUEST — the headers, the timeout and the
+ * body every `/fleet/*` call shares, and the few answers built on it: a settle
+ * that says only "was it accepted" (`postToFleet`), the lease claim that stops
+ * two daemons acting on one job (`claimFleetLease`), the lease settle that
+ * follows it (`settleLease`), and the bounded best-effort settle
+ * (`postBestEffort`).
  *
- * Split out of fleet.mjs (SOLID audit 2026-09-26, F038) because four lanes in
- * three modules share it — the job lanes (fleetJobs.mjs), the wiki runner
- * (wikiRunner.mjs) and the machine report (fleetReports.mjs) — and it was a
- * closure inside `runFleetDaemon` that only one of them could reach. It was
- * called `reportMergeOutcome` there, a name left over from the deleted
- * dispatch-era merge lane; the body is unchanged.
+ * Split out of fleet.mjs (SOLID audit 2026-09-26, F038) because lanes in
+ * other modules share `postToFleet` — today the wiki runner (wikiRunner.mjs)
+ * and the machine report (fleetReports.mjs) — and it was a closure inside
+ * `runFleetDaemon` that only one of them could reach. It was called
+ * `reportMergeOutcome` there, a name left over from the deleted dispatch-era
+ * merge lane. The patch-revert and cleanup lanes that also settled through it
+ * were deleted with their dead roster keys (audit 2026-10-10, F083).
  *
- * A DAEMON→SERVER REPORT, so no floor: the report's presence is the
+ * ONE REQUEST SKELETON (audit 2026-10-10, F071/F082/F102/F136/F138/F154/F744).
+ * The `Authorization: Bearer …` / `User-Agent` / `Content-Type` block and its
+ * `AbortSignal.timeout` were hand-built at ~37 sites in 23 files, and the
+ * copies had drifted (mcp-cli's had no timeout at all; wikiRunner's abandon
+ * post was a near copy of `postToFleet`). The lease claim — the double-run
+ * guard — was five byte-identical copies. Each caller still passes its OWN
+ * timeout and keeps its OWN status policy; only the request and the claim's
+ * winner test moved here.
+ *
+ * `fetch` is the global, resolved at CALL time inside each function — tests
+ * swap `globalThis.fetch` after import, and that must keep working.
+ *
+ * A DAEMON→SERVER REPORT needs no floor: the report's presence is the
  * capability, and a lane that gets `false` back retries on its own beat.
  */
 
-import { FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { isCredentialRejection } from './authReject.mjs';
+import { isConsideredRefusal, isNotNow, retryAfterMs } from './fleetWire.mjs';
+
+/** The machine credential's headers. `token` defaults to the LIVE binding
+ *  (config.mjs's `let FLEET_TOKEN`, which a project switch re-points), read
+ *  at call time. `json: false` for a GET or a multipart body. */
+export function fleetHeaders({ json = true, token = FLEET_TOKEN } = {}) {
+  return {
+    Authorization: `Bearer ${token}`,
+    'User-Agent': USER_AGENT,
+    ...(json ? { 'Content-Type': 'application/json' } : {}),
+  };
+}
+
+/** A body as it goes on the wire: a string is already serialised (the
+ *  readout lanes dedup on the exact string they post), anything else is
+ *  JSON-encoded, and `undefined` sends no body. */
+const wireBody = (body) => (body === undefined || typeof body === 'string' ? body : JSON.stringify(body));
+
+/**
+ * A JSON POST with the machine credential, returning the RESPONSE — for a
+ * caller that reads it itself. Rejects on a network error or a timeout
+ * exactly as `fetch` does.
+ */
+export async function postFleetJson(url, body, { timeoutMs = 30_000, token, signal } = {}) {
+  return fetch(url, {
+    method: 'POST',
+    headers: fleetHeaders({ token }),
+    signal: signal ?? AbortSignal.timeout(timeoutMs),
+    body: wireBody(body),
+  });
+}
+
+/**
+ * ONE REQUEST, ANSWERED AS A SHAPE — never a throw.
+ *
+ *   { ok, status, json, credentialRejected, retryAfterMs, error }
+ *
+ * `status` is null (and `error` set) when nothing answered: a network error
+ * or the timeout. `json` is the parsed body, or null when it was not JSON.
+ * `credentialRejected` is authReject.mjs's one rule — a 401/403 wearing the
+ * API's own `{ success: false }` envelope, never the bare status (an edge
+ * 403 is somebody else's answer). `retryAfterMs` is the server's Retry-After,
+ * capped, or null when it sent none.
+ */
+export async function fleetRequest(url, { method = 'POST', body, timeoutMs = 30_000, token, signal } = {}) {
+  let res;
+  try {
+    const sent = wireBody(body);
+    res = await fetch(url, {
+      method,
+      headers: fleetHeaders({ json: sent !== undefined, token }),
+      signal: signal ?? AbortSignal.timeout(timeoutMs),
+      ...(sent !== undefined ? { body: sent } : {}),
+    });
+  } catch (error) {
+    return { ok: false, status: null, json: null, credentialRejected: false, retryAfterMs: null, error };
+  }
+  let json = null;
+  try {
+    json = typeof res.json === 'function' ? await res.json() : null;
+  } catch {
+    json = null; // not JSON — an edge page, an empty body
+  }
+  return {
+    ok: Boolean(res.ok),
+    status: res.status,
+    json,
+    credentialRejected: isCredentialRejection(res.status, res.headers?.get?.('content-type'), json),
+    retryAfterMs: retryAfterMs(res, null),
+    error: null,
+  };
+}
 
 /** Returns whether the server actually accepted it. Callers that spend a
  *  Claude turn per attempt need to know: swallowing the failure silently made
  *  an unreachable endpoint look identical to a settled job, so the turn
- *  re-ran on every poll. */
-export async function postToFleet(url, body) {
+ *  re-ran on every poll. Never throws — the job reappears next poll if this
+ *  failed. */
+export async function postToFleet(url, body, { timeoutMs = 30_000 } = {}) {
+  return (await fleetRequest(url, { body, timeoutMs })).ok;
+}
+
+/**
+ * CLAIM A LEASE BEFORE ACTING — the double-run guard (audit 2026-10-10,
+ * F138). Two daemons legitimately share one credential and are handed the
+ * same job array, so a lane that opens a tunnel, signals a pid, pushes a
+ * branch or runs a deploy claims the job first and does NOTHING unless it
+ * won. The rules, which were five hand copies:
+ *   - the body names this PROCESS (`instance: DAEMON_INSTANCE`), never only
+ *     the credential — a token cannot tell two holders apart;
+ *   - the winner is read from the BODY (`data.claimed === true`), never
+ *     inferred from the status;
+ *   - any failure — a network error, a timeout, a non-JSON answer — is "not
+ *     claimed": the peer may hold it, and doing nothing is the safe answer.
+ * `won` is for a route that answers in another shape (intake's `{ ok: true }`
+ * on a 200); it is handed `fleetRequest`'s result.
+ */
+export async function claimFleetLease(
+  url,
+  fields,
+  { timeoutMs = 15_000, won = (r) => r.json?.data?.claimed === true } = {}
+) {
   try {
-    const res = await fetch(url, {
-      method: 'POST',
-      headers: {
-        Authorization: `Bearer ${FLEET_TOKEN}`,
-        'User-Agent': USER_AGENT,
-        'Content-Type': 'application/json',
-      },
-      signal: AbortSignal.timeout(30_000),
-      body: JSON.stringify(body),
-    });
-    return res.ok;
+    const r = await fleetRequest(url, { body: { ...fields, instance: DAEMON_INSTANCE }, timeoutMs });
+    if (r.error) return false;
+    return won(r) === true;
   } catch {
-    /* best-effort — the job reappears next poll if this failed */
     return false;
   }
 }
+
+/**
+ * SETTLE A HELD LEASE — the outcome POST that follows a claim, stamped with
+ * the same `instance` (only the holder may settle). Returns the parsed reply
+ * (a preview open reads `data.settled`), or null when nothing usable came
+ * back. Never throws: an unsettled lease expires server-side and the asker
+ * is told, never spun.
+ */
+export async function settleLease(url, body, { timeoutMs = 30_000 } = {}) {
+  const r = await fleetRequest(url, { body: { ...body, instance: DAEMON_INSTANCE }, timeoutMs });
+  return r.json ?? null;
+}
+
+/**
+ * A best-effort settle POST, AWAITED INLINE by a caller with no per-poll
+ * queue of its own to retry from — unlike workReportQueue's `postSettle`,
+ * whose callers requeue a 'retry'/'reject' outcome themselves. Bounded
+ * attempts: 408/429 retry honouring Retry-After, 5xx retries on a short fixed
+ * backoff, and any OTHER 4xx is the server's considered answer — retrying it
+ * would just spend the same refusal again, so it counts as delivered, the
+ * existing trace convention. A network error retries the same way and is
+ * then swallowed: unsettled, and the server expires the job so the asker is
+ * told, never spun.
+ *
+ * Moved here from inside `createWorkReportQueue` (audit 2026-10-10, F136): it
+ * closed over nothing of the queue's. work.mjs still INJECTS it into the
+ * plan, check and intake lanes, so their tests hand in fakes.
+ */
+export async function postBestEffort(url, body, { attempts = 4, timeoutMs = 30_000 } = {}) {
+  for (let i = 0; i < attempts; i += 1) {
+    const r = await fleetRequest(url, { body, timeoutMs });
+    if (r.ok) return true;
+    if (isConsideredRefusal(r.status)) return true; // the server's considered answer
+    const notNow = isNotNow(r.status);
+    // Only a network error, 408/429 or a 5xx retries; anything else (a stray
+    // 1xx/3xx) was never retried and still is not.
+    if (!r.error && !notNow && r.status < 500) return true;
+    if (i === attempts - 1) return false;
+    const backoff = 2_000 * (i + 1);
+    await new Promise((done) => setTimeout(done, notNow ? (r.retryAfterMs ?? backoff) : backoff));
+  }
+  return false;
+}