flowviant 0.117.0 → 0.124.1

package/bin/lib/fleet.mjs

@@ -18,6 +18,7 @@
  * that order. Moving the order out would move the reconciliation itself.
  */
 
+import { existsSync } from 'node:fs';
 import {
   VERSION,
   FLEET_URL,
@@ -36,6 +37,7 @@ import { handleVersionSignal } from './update.mjs';
 import { compareVersions } from './versionOrder.mjs';
 import { emitMachineEvent } from './daemonLogging.mjs';
 import { writeDaemonState } from './daemonState.mjs';
+import { maintenanceTick, readMaintenance } from './maintenance.mjs';
 import { repoRootOrDie, detectBaseRef, baseBranchName, excludeInWorktree, usableBaseRef } from './git.mjs';
 import { c, info, note, ok, warn, fail } from './ui.mjs';
 import { sleep } from './sleep.mjs';
@@ -56,7 +58,9 @@ import { createLeave } from './standDownExit.mjs';
 import { stopWorkLanes } from './standDownGate.mjs';
 import { markLockDraining } from './instance.mjs';
 import { reportDeployConfig } from './deployConfig.mjs';
+import { mcpInstallsInFlight, processMcpInstallJobs } from './mcpInstall.mjs';
 import { probeSkillsOnce } from './runtimeCapabilities.mjs';
+import { createProjectRepositories, storedProject } from './projectRepositories.mjs';
 import { createWorkManager } from './work.mjs';
 import { INTAKE_ROSTER_KEY } from './workIntake.mjs';
 import { createKnowledgeSync } from './knowledge.mjs';
@@ -70,6 +74,7 @@ import {
   maybeReportLocalSessions,
   maybeReportRepoState,
   maybeReportTools,
+  recheckProjectMcp,
   repoStateChanged,
   reportMachine,
 } from './fleetReports.mjs';
@@ -87,7 +92,10 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   console.log('');
   console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`machine daemon · v${VERSION}`)}`);
   console.log(`  ${c.dim('──────────────────────────────────────────────')}`);
-  const repoRoot = repoRootOrDie();
+  const launchRoot = repoRootOrDie();
+  const projectEntry = storedProject(FLEET_TOKEN);
+  const repoRoot = projectEntry?.repoRoot && existsSync(projectEntry.repoRoot) ? projectEntry.repoRoot : launchRoot;
+  const repositories = createProjectRepositories({ entry: projectEntry, repoRoot, getEntry: () => storedProject(FLEET_TOKEN) });
   /**
    * WHERE SHIP LANDS. Detected at startup, then OVERRIDDEN by the roster when a
    * human has chosen one (`projects.baseBranch`).
@@ -132,7 +140,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   info(`server · ${FLEET_URL}`);
   console.log('');
 
-  takeInstanceLockOrExit(repoRoot);
+  takeInstanceLockOrExit(launchRoot, projectEntry?.projectId);
   // The repo binding the start path's picker or confirm was answered with.
   // Persisted HERE, after the lock, so a refused start moves nothing: moving it
   // first stranded the daemon already serving that project's own checkout at
@@ -173,7 +181,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   // running (detached children survive an ungraceful exit) before we start fresh.
   reapOrphanPreviews((m) => info(m));
 
-  const { repoKey, baseDir } = worktreeHome(repoRoot);
+  const { repoKey, baseDir } = worktreeHome(projectEntry?.repoRoot ?? repoRoot, projectEntry?.projectId, Object.values(projectEntry?.repositories ?? {}));
 
   // WHAT THE DELETED VAULT LEFT ON THIS DISK — once, here, because this is the
   // first point at which both directories it wrote into are known. Deleting the
@@ -249,6 +257,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     flushWorkReports,
     learnPlaces,
     processWorkTurns,
+    interruptWorkTurns,
     processShipJobs,
     processDiffJobs,
     processKillJobs,
@@ -256,6 +265,8 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     processAgentPlanJobs,
     processIntakeJobs,
     processAgentTurnJobs,
+    processAgentRecoveryJobs,
+    interruptAgentTurns,
     processAgentMergeJobs,
     freshenManualPlaces,
     heldSessionIds,
@@ -265,13 +276,16 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     shutdownPreviews,
     retireWorkSessions,
     reportWorktrees,
+    reconcileIdleArtifacts,
     shutdownWork,
     settleAgentTurns,
     workBusy,
+    runningAgentCount,
     admit,
     liveTurns,
   } = createWorkManager({
     repoRoot,
+    repositories,
     baseDir,
     getBaseRef,
     getMcpUrl: () => mcpUrl,
@@ -331,9 +345,9 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
    * from the server's list of WORKING AGENTS, which cannot see a Workbench
    * turn, a ship or a deploy.
    */
-  const machineBusy = () => wiki.busy() || workBusy() || deploysInFlight() > 0;
+  const machineBusy = () => wiki.busy() || workBusy() || deploysInFlight() > 0 || mcpInstallsInFlight() > 0;
   const reportBusy = () =>
-    writeDaemonState(desktopProjectId, { busy: machineBusy(), busyAt: new Date().toISOString() });
+    writeDaemonState(desktopProjectId, { busy: machineBusy(), liveAgents: runningAgentCount(), maintenance: null, busyAt: new Date().toISOString() });
   /**
    * HOW EVERY STAND-DOWN LEAVES — after the teardown, and after any deploy in
    * flight has finished and reported (standDownExit.mjs, ruling 2026-09-26).
@@ -379,6 +393,16 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   // share, no new deploy — only the deploys already claimed run on to their
   // report (standDownExit.mjs).
   const standingDown = () => leave.leaving();
+  let lastAgentJobs = [];
+  const reportMaintenance = (jobs = lastAgentJobs) => maintenanceTick({
+    busy: machineBusy,
+    agents: runningAgentCount,
+    flush: async () => {
+      await flushWorkReports();
+      processAgentTurnJobs(jobs, { reportsOnly: true });
+    },
+    report: (state) => writeDaemonState(desktopProjectId, state),
+  });
   for (;;) {
     if (standingDown()) return leave.drained();
     let roster;
@@ -412,7 +436,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
       }
       warn(`roster poll failed: ${e.message} — retrying in ${RECONCILE_SECONDS}s`);
       // Work already running keeps running offline; the measurement keeps up.
-      reportBusy();
+      if (!await reportMaintenance()) reportBusy();
       await sleep(RECONCILE_SECONDS);
       continue;
     }
@@ -490,7 +514,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
       // same one the desktop app's auto-install reads — which is how a deploy
       // in flight joined this gate (2026-09-26): re-exec'ing under one would
       // stop its heartbeat mid-run.
-      const safeToUpdate = !machineBusy();
+      const safeToUpdate = !machineBusy() && !readMaintenance();
       const updating = handleVersionSignal({
         latest: roster.daemon.latest,
         min: roster.daemon.min,
@@ -501,6 +525,19 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
       if (await updating) return;
       if (standingDown()) return leave.drained();
     }
+    // Keep polling to renew the running agents' leases and honour stops and
+    // interrupts. A paused tick admits no roster jobs, even after becoming
+    // idle; only held answers are retried until the tray releases its lease.
+    // Interrupts precede both paths so a stop arriving while paused still
+    // reaches its running CLI, and a successor sees the stop before intake.
+    interruptWorkTurns(roster.interruptTurns);
+    interruptAgentTurns(roster.interruptAgentTurns);
+    lastAgentJobs = roster.agentTurnJobs;
+    if (await reportMaintenance()) {
+      reportMachine({ worktreeDir: baseDir, liveTurns });
+      await sleep(RECONCILE_SECONDS);
+      continue;
+    }
     // Settle any turn/ship answers whose earlier report POST failed BEFORE
     // taking new work — the skip-if-pending guards make the ordering safe, but
     // delivering first keeps the tab honest a poll sooner.
@@ -508,6 +545,8 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // WHERE each live tab works, BEFORE anything measures one: the sweep below
     // and every preview check ask `placeOf`, and a tab nobody has typed into
     // yet has taught it nothing.
+    repositories.learn(roster.repositories);
+    for (const repository of repositories.list()) if (repository.repoRoot) scanEnvForScrub(repository.repoRoot);
     learnPlaces(roster.sessionPlaces);
     processWorkTurns(roster.workTurnJobs);
     // The roster's live-session list rides along: an ENDED session's ship
@@ -534,8 +573,10 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
      * Announced on change, because a silent switch of merge target is the one
      * thing worse than not offering the choice at all.
      */
-    if (typeof roster.baseBranch === 'string' && roster.baseBranch.trim()) {
-      const want = usableBaseRef(repoRoot, `origin/${baseBranchName(roster.baseBranch.trim())}`);
+    const servedBaseBranch = Array.isArray(roster.repositories)
+      ? repositories.list().find((r) => r.repoRoot === repoRoot)?.baseBranch : roster.baseBranch;
+    if (typeof servedBaseBranch === 'string' && servedBaseBranch.trim()) {
+      const want = usableBaseRef(repoRoot, `origin/${baseBranchName(servedBaseBranch.trim())}`);
       if (want !== baseRef) {
         note(`base   · ${want} ${c.dim('(set for this project)')}`);
         baseRef = want;
@@ -581,7 +622,9 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     processIntakeJobs(roster[INTAKE_ROSTER_KEY]);
     // …and an agent's next card. After the plan jobs because a press becoming
     // agents is the thing that produces these.
-    processAgentTurnJobs(roster.agentTurnJobs);
+    const recovering = await processAgentRecoveryJobs(roster.agentRecoveryJobs);
+    processAgentTurnJobs(Array.isArray(roster.agentTurnJobs)
+      ? roster.agentTurnJobs.filter((job) => !recovering.has(job.agentId)) : roster.agentTurnJobs);
     // …and a branch somebody approved. After the turns: a merge takes the
     // place's WRITER lock, and writer preference means it goes ahead of any
     // reader queued behind it anyway.
@@ -594,6 +637,10 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // themselves from a browser, relayed. After retirement so a directory that
     // just went away is not reported as a place.
     reportWorktrees(roster.activeWorkSessions);
+    // …and an idle agent's delivery against what its worktree still holds:
+    // once per process, beside no turn (workArtifactReconcile.mjs). After the
+    // turn intake above, so a card about to run in a place is not raced.
+    void reconcileIdleArtifacts(roster.activeWorkSessions)?.catch(() => {});
     // Terminal-session presence, throttled + dedup'd inside; never awaited —
     // the daemon's own worktrees are carved out (a session the daemon spawned
     // is already a tab, not something to offer adopting).
@@ -657,6 +704,14 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // This is what replaced the vault's sync tick — see `maybeReportEnv`.
     void maybeReportEnv(repoRoot);
     void maybeReportTools(repoRoot, getBaseRef());
+    // INSTALLS AN OWNER CONFIRMED FOR THIS BOX (mcpInstall.mjs) — handed to
+    // the picked box whether it holds the machine or stands by; each is
+    // claimed, run exactly as confirmed, and followed by a re-check.
+    processMcpInstallJobs(roster.mcpInstallJobs, {
+      repoRoot,
+      myPubB64,
+      recheck: () => recheckProjectMcp(repoRoot, getBaseRef()),
+    });
 
     // Tell the app what this machine is doing with itself (fleetReports.mjs).
     reportMachine({ worktreeDir: baseDir, liveTurns });

package/bin/lib/fleetReports.mjs

@@ -27,8 +27,11 @@ import { detectRuntimes } from './runtimeDetection.mjs';
 import { scanLocalSessions } from './localSessions.mjs';
 import { repoState } from './repoState.mjs';
 import { claudeAuthContext } from './claudeAuth.mjs';
-import { readBaseTools, toolReadout } from './projectTools.mjs';
+import { prepareAgentTools, readBaseTools, toolReadout } from './projectTools.mjs';
 import { runnerToolCapabilities } from './projectToolRuntimes.mjs';
+import { buildMcpInventory } from './mcpInventory.mjs';
+import { knownClaudeMcpInventory, probeMcpNow } from './runtimeCapabilities.mjs';
+import { codexMcpServers } from './runtimeOfferings.mjs';
 
 /**
  * ONE READOUT LANE (audit 2026-10-10, F087/F752). The four readouts below —
@@ -292,7 +295,15 @@ export function maybeReportEnv(repoRoot) {
 // Latches on the env lane's short list for the same reason: a 401 or a 429 is
 // a "later", and a lane that dies invisibly must not die for one.
 const toolsLane = createReportLane({ endpoint: 'tools-report', isPermanent: envReportIsPermanent });
-/** Repo tool readiness is a per-box daemon report. Never include env values. */
+/**
+ * Repo tool readiness is a per-box daemon report. Never include env values.
+ *
+ * `mcp` (2026-10-13) is this box's MCP inventory — every server each installed
+ * CLI has, by name, source and status, with a connected server's tool names
+ * (mcpInventory.mjs). It rides here rather than on the poll because tool names
+ * do not fit a URL, and this lane already posts only on change. An older
+ * server's schema strips the key.
+ */
 export function maybeReportTools(repoRoot, baseRef) {
   return toolsLane(() => {
     const pubkey = myPubB64();
@@ -300,10 +311,40 @@ export function maybeReportTools(repoRoot, baseRef) {
     const snapshot = readBaseTools(repoRoot, baseRef);
     const installed = detectRuntimes().filter((r) => r.installed);
     const runner = installed.find((r) => runnerToolCapabilities(r.id).mcp)?.id ?? installed[0]?.id ?? 'none';
-    return JSON.stringify({ pubkey, tools: toolReadout(snapshot, runner) });
+    const ids = installed.map((r) => r.id);
+    let codex = null;
+    if (ids.includes('codex')) {
+      try { codex = codexMcpServers(); } catch { /* a failed local read is unknown */ }
+    }
+    const mcp = buildMcpInventory({ installed: ids, snapshot, claude: knownClaudeMcpInventory(), codex });
+    return JSON.stringify({ pubkey, tools: toolReadout(snapshot, runner), mcp });
   });
 }
 
+/**
+ * LOOK AGAIN AT THIS BOX'S MCP SERVERS, NOW (2026-10-13) — after a confirmed
+ * install (mcpInstall.mjs). Codex's list is re-read, Claude Code is probed
+ * with the base branch's servers mounted (`probeMcpNow`), and the tool report
+ * — whose "command not on PATH" was measured before the install — is rescanned
+ * and posted without waiting for its beat. Every step is best-effort.
+ */
+export async function recheckProjectMcp(repoRoot, baseRef) {
+  try {
+    if (detectRuntimes().some((r) => r.id === 'codex' && r.installed)) codexMcpServers({ refresh: true });
+  } catch { /* unknown stays unknown */ }
+  if (detectRuntimes().some((r) => r.id === 'claude' && r.installed)) {
+    let tools = null;
+    try {
+      tools = prepareAgentTools(readBaseTools(repoRoot, baseRef), 'claude');
+      await probeMcpNow(repoRoot, tools.mcpPath);
+    } catch { /* no base read, or no claude: the next turn teaches it */ } finally {
+      tools?.cleanup();
+    }
+  }
+  toolsLane.rescan();
+  await maybeReportTools(repoRoot, baseRef);
+}
+
 /**
  * "THE REPO JUST CHANGED — look again." Clears the repo-state throttle so the
  * next reconcile rescans on the beat it already runs; the work manager calls

package/bin/lib/fleetRoster.mjs

@@ -45,65 +45,6 @@ let warnedEnvIdentity = false;
  */
 const POLL_URL_BUDGET = 14_000;
 
-/**
- * HAS THIS PROCESS ALREADY ASKED FOR THE MACHINE? (0.91.0)
- *
- * The owner's ruling on two boxes running one project: "it should kill the
- * first one and take over". So a daemon asks on the FIRST poll of its life and
- * never again, and this pair is the whole of that "never again".
- *
- * ONE ASK PER PROCESS IS THE SAFETY, NOT A POLITENESS. A param that kept asking
- * would be two boxes trading a machine back and forth every ten seconds. Asked
- * once, the story ends at the first exchange, because the box that loses
- * SETTLES ITS TURNS AND EXITS rather than restarting — and a process that has
- * exited sends no more first polls.
- *
- * THAT LAST SENTENCE IS TRUE OF THE PROCESS AND NOT OF THE UNIT, which is why
- * the server stopped relying on it (2026-09-19). Under `Restart=always`, pm2 or
- * docker, exit 0 is a relaunch and the relaunch's first poll is a genuine one.
- * `takeMachineHolderNow` refuses a take by the box it just displaced for the
- * length of the displaced window, so the ping-pong is bounded on the side that
- * can see both boxes. This module still keeps its half of the bargain.
- *
- * SPENT ON A DELIVERED POLL, NOT ON AN ATTEMPTED ONE, which is why this is two
- * functions instead of one consuming read. A daemon that starts while the wire
- * is down retries every ten seconds; spending the ask on the failed attempt
- * would mean the box you walked over to and started never takes the machine,
- * and nothing anywhere would say why.
- *
- * IT IS NOT THE DELETED FLAG COMING BACK. There is still nothing to type: the
- * terminal surface is `npx flowviant` and `npx flowviant login`, and what
- * claims here is starting the daemon, which is already one of those two.
- *
- * Exported so both properties can be proved without a server, a credential or a
- * second box — they are the contract, and nothing else in the file states them.
- */
-/**
- * AND A RESTART IS NOT A PERSON (2026-09-19, the review).
- *
- * `update.mjs` re-execs the daemon with `FLOWVIANT_REEXEC='1'` after an
- * UNATTENDED auto-update, which is on by default. Born `false`, the new process
- * would then spend a fresh ask and TAKE THE PROJECT'S MACHINE — so a standby
- * sitting quietly on somebody's second computer would seize the machine off the
- * live holder in the middle of the night, settling its running turns as moved,
- * because npm published a patch. Nobody was at either keyboard, and nothing on
- * any surface would say why.
- *
- * The ask belongs to the GESTURE, not to the process: what claims a machine is
- * a person typing `npx flowviant`, and a re-exec is the same start continuing.
- * So a re-executed daemon is born with the ask already spent and behaves
- * exactly as it did before the update — it keeps the machine if it had it (arm
- * (a) stamps it), and stands by if it did not.
- */
-let machineAskSpent = process.env.FLOWVIANT_REEXEC === '1';
-export function machineAskPending() {
-  return !machineAskSpent;
-}
-export function spendMachineAsk() {
-  machineAskSpent = true;
-}
-
-
 export async function fetchRoster(
   livePreviewSessionIds = [],
   heldSessionIds = [],
@@ -170,30 +111,7 @@ export async function fetchRoster(
   if (repoRoot) url.searchParams.set('cp', String(repoRoot).slice(0, 256));
   url.searchParams.set('pid', String(process.pid));
   url.searchParams.set('st', PROCESS_STARTED_AT);
-  /**
-   * THE FIRST POLL OF THIS PROCESS ASKS FOR THE MACHINE (`claim`, 0.91.0).
-   *
-   * The owner, on two boxes running one project: "it should kill the first one
-   * and take over." Starting the daemon on the computer in front of you IS the
-   * gesture — there is no flag, no env var and no third command, so the ruling
-   * that deleted the old machine-moving flag ("i dont intend to run or do
-   * anything in the terminal besides npx flowviant or npx flowviant login")
-   * stands untouched.
-   *
-   * SENT ONCE PER PROCESS, and that is the safety rather than a politeness: see
-   * `askForMachineOnce`. The server takes holdership there and then, the box it
-   * displaces learns through the existing named-and-windowed `displaced` signal
-   * and exits 0, and nothing restarts to ask again.
-   *
-   * AN OLDER SERVER IGNORES IT and the old standby behaviour stands, which is
-   * why this needs no floor of its own — the server applies one (it will not
-   * take a machine from a box too old to be told it lost it).
-   */
-  if (machineAskPending()) url.searchParams.set('claim', '1');
-  // A poll reports what this box IS. Moving the project's machine onto it, when
-  // this process has already spent its one ask above, is a gesture a person
-  // makes in the app — and the daemon learns that outcome on its next poll like
-  // every other holder fact.
+  // Only Make it the machine in the app moves an existing holder.
   // Which shares this machine is still serving. It rides the poll rather than
   // taking an endpoint of its own: one beat, no floor, and the stale window is
   // the reconcile interval instead of minutes — which matters, because a share
@@ -430,12 +348,6 @@ export async function fetchRoster(
     throw new Error(`fleet poll refused by something in front of the API (${res.status})`);
   }
   if (!res.ok) throw new Error(`fleet poll failed (${res.status})`);
-  // THE ASK IS SPENT HERE AND NOWHERE ELSE — on a poll the server actually
-  // answered. Spending it where the param is SET would lose the claim of a
-  // daemon that started while the wire was down: it would retry, silently
-  // without `claim`, and the box somebody walked over to and started would
-  // never take the machine.
-  spendMachineAsk();
   const body = await res.json();
   // Validate the shape here so a malformed 200 (deploy hiccup, error envelope)
   // throws a NORMAL retryable error inside the loop's try/catch, instead of a

package/bin/lib/fleetStartup.mjs

@@ -18,16 +18,13 @@ import { info, note, warn, fail } from './ui.mjs';
 import { acquireInstanceLock } from './instance.mjs';
 import { emitMachineEvent } from './daemonLogging.mjs';
 import { worktreeHomeDir, worktreeHomeKey } from './statePaths.mjs';
+import { projectWorktreeHome } from './projectWorktreeHome.mjs';
 
 /** Takes the lock, or says why not and exits 1. Returns only on success. */
-export function takeInstanceLockOrExit(repoRoot) {
-  // ONE DAEMON PER CREDENTIAL. Before preflight, before the preview reap,
-  // before anything with a side effect — a second daemon must not so much as
-  // install a CLI or clear a registry on its way to being refused. Keyed on the
-  // credential rather than the repo, because two checkouts on one credential is
-  // the SAME project served twice, and the worst version of this: their session
-  // worktrees are in different directories, so the per-turn lock cannot even see
-  // across them. See instance.mjs for why that lock is not enough on its own.
+export function takeInstanceLockOrExit(repoRoot, projectId) {
+  // One project lock before any side effect. daemonLocks resolves stored
+  // credentials to the project id; legacy explicit credentials retain their
+  // credential key. Different checkouts therefore find the same holder.
   // Same repo -> this run replaces whatever was serving it. Different repo ->
   // refused, and nothing is signalled. See instance.mjs's header for the rule.
   //
@@ -55,18 +52,18 @@ export function takeInstanceLockOrExit(repoRoot) {
     } else if (instance.sameRepo) {
       fail('a flowviant daemon is already running in this repo.');
     } else {
-      fail('a flowviant daemon is already running for this credential.');
+      fail(projectId ? 'a flowviant daemon is already running for this project.' : 'a flowviant daemon is already running for this credential.');
     }
     if (h?.pid) info(`holder · pid ${h.pid}${h.repoRoot ? ` in ${h.repoRoot}` : ''}`);
     // The two-checkouts case is the one nobody spots on their own: both tabs
     // look healthy, and the damage is doubled cards and doubled edits in a repo
     // you are not looking at. Name the other repo when it is a different one.
     if (!instance.sameRepo && h?.repoRoot && h.repoRoot !== repoRoot) {
-      warn('that is a DIFFERENT checkout — one credential serves one project, so both would answer the same tabs.');
+      info('the running daemon serves this project’s connected checkouts.');
       // Not offered lightly: that daemon is serving other work, and this
       // command was run somewhere else. Replacing it is a decision, not a
       // restart, so it takes a word.
-      note('run with --takeover to stop it and serve this repo instead.');
+      note('run with --takeover to replace the running daemon.');
     }
     // WITHHELD when we could not identify the holder. ALLOW_MULTI runs this
     // daemon unguarded beside one we just admitted we cannot see, and in the
@@ -87,12 +84,12 @@ export function takeInstanceLockOrExit(repoRoot) {
 /**
  * The persistent worktree home for this checkout, created if missing.
  */
-export function worktreeHome(repoRoot) {
+export function worktreeHome(repoRoot, projectId, roots) {
   // Persistent worktree home (0.9.0) — survives daemon restarts AND reboots,
   // so Ctrl+C mid-task never loses local work. Keyed per repo path, by the
   // one derivation deploy checkouts and `flowviant clean` share (statePaths.mjs).
-  const repoKey = worktreeHomeKey(repoRoot);
-  const baseDir = worktreeHomeDir(repoRoot);
+  const { repoKey, baseDir } = projectId ? projectWorktreeHome(repoRoot, projectId, roots)
+    : { repoKey: worktreeHomeKey(repoRoot), baseDir: worktreeHomeDir(repoRoot) };
   mkdirSync(baseDir, { recursive: true });
   return { repoKey, baseDir };
 }

package/bin/lib/holder.mjs

@@ -117,10 +117,9 @@ export function agoLabel(ms) {
  *   · mine: true    -> we are the machine. Announce it only if we have been
  *                      inactive, so an ordinary daemon prints nothing new.
  *   · mine: false   -> GO INACTIVE. Keep polling quietly; the restricted roster
- *                      serves us nothing, the auto-handover makes this box the
- *                      machine when the holder dies, and the app is where a
- *                      person moves it sooner. Never exit: an inactive box that
- *                      quits is one somebody has to go and restart by hand.
+ *                      serves us no work. A person moves it with Make it the
+ *                      machine in the app; silence never moves it. Never exit:
+ *                      an inactive box that quits is one somebody has to go and restart by hand.
  *
  * THE WORD A PERSON READS IS `inactive` (2026-09-21) — the owner replaced
  * "standing by" outright: *"no, it can [be] inactive instead"*. The server's
@@ -207,41 +206,9 @@ export function createHolderWatch({ say = () => {} } = {}) {
         // took, printed at the one moment the person is deciding whether to
         // wait.
         //
-        // THE PROMISE IS GONE (0.91.0), and its absence is the honest half.
-        // This sentence used to end "It moves here automatically once that
-        // machine has been quiet 10 minutes", which was true while starting a
-        // daemon did nothing but wait. Since 0.91.0 a process START asks for
-        // the machine on its first poll — the owner's ruling, "it should kill
-        // the first one and take over" — so reaching this branch at all means
-        // the ask was REFUSED or never spent. Four ways: an older server that
-        // does not honour it; a daemon this server will not hand a machine to;
-        // an UNATTENDED RE-EXEC, which is born with the ask spent because a
-        // restart is not a person; and — the one worth naming — a box this
-        // credential DISPLACED inside the last ten minutes, which the server
-        // refuses so that two supervised daemons cannot trade a machine back
-        // and forth forever (see `takeMachineHolderNow`). In that last case the
-        // right next move is a decision, not a wait, which is exactly what this
-        // sentence already points at. Restating the staleness clock instead
-        // would promise a handover on the one path where it is least likely to
-        // be what happens. So the line relays the fact and points at the door,
-        // which is the same door it always pointed at.
-        //
-        // THE WORD IS `inactive` (2026-09-21). It was "standing by" until the
-        // owner replaced it — asked whether a box should keep saying that, he
-        // answered *"no, it can [be] inactive instead"* — and the server's role
-        // enum moved in the same pass (`serving` / `inactive`, which is why
-        // `machineListing.mjs` no longer respells anything). A terminal saying one
-        // word about this box while the app says another about the same box is
-        // the confusion these readouts exist to end, so the two ends say the
-        // same thing.
-        //
-        // THE POINTER SURVIVES THE REWORD. The sentence still ends at the app's
-        // project settings rather than at "another machine is serving this
-        // project", which the line's first half has already said — restating it
-        // would spend the only clause the person can act on repeating a fact.
         say(
           `This project's machine is ${name ?? 'another machine'}${ago ? ` (heard ${ago} ago)` : ''}. ` +
-            "This one is inactive — move it here from the app's project settings."
+            "This one is inactive — choose Make it the machine in Project settings › Machines in the app."
         );
       }
       return 'standby';

package/bin/lib/hooks/mcpAllow.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+/**
+ * THE MACHINE'S MCP SERVERS, ALLOWED ON A FENCED AGENT TURN (2026-10-11, the
+ * owner: "the server that is running flowviant's claude HAS these MCPs yet the
+ * agents are not using them").
+ *
+ * A write-up or mockup/3D-model/deck turn runs under an `--allowedTools` list,
+ * and an MCP tool the list does not name is refused ("Claude requested
+ * permissions to use mcp__…, but you haven't granted it yet"). The project's
+ * base servers are named by the lane; the machine's own servers and claude.ai
+ * connectors are not knowable before the CLI connects them (a connector's tools
+ * are `mcp__claude_ai_<Name>__<tool>`, from the account), and `mcp__*` is not a
+ * rule this CLI admits (measured, Claude Code 2.1.290: refused). So this
+ * `PreToolUse` hook, matched on `mcp__.*`, answers `allow` for an MCP tool call.
+ * MEASURED on 2.1.290 under the research and design lists: the project server
+ * and a claude.ai connector each answered with no per-name rule, and Bash
+ * `touch`, an outside Write and WebFetch were refused exactly as without the
+ * hook.
+ *
+ * It decides MCP calls and nothing else: any other tool, and Flowviant's own
+ * control plane (`mcp__flowviant`, never mounted on an agent turn), get no
+ * decision, and the posture's list decides. A hook that fails gives no
+ * decision either, so a broken hook leaves MCP calls refused — closed.
+ */
+import { pathToFileURL } from 'node:url';
+
+/** The decision for one PreToolUse payload, or null for "not ours". */
+export function mcpAllowDecision(payload) {
+  const name = payload?.tool_name;
+  if (typeof name !== 'string' || !name.startsWith('mcp__')) return null;
+  if (name === 'mcp__flowviant' || name.startsWith('mcp__flowviant__')) return null;
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'allow',
+      permissionDecisionReason: 'an MCP server this machine mounted for the card',
+    },
+  };
+}
+
+let started = false;
+export function main() {
+  if (started) return;
+  started = true;
+  let buf = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (d) => (buf += d));
+  process.stdin.on('end', () => {
+    let decision = null;
+    try {
+      decision = mcpAllowDecision(JSON.parse(buf));
+    } catch {
+      decision = null;
+    }
+    if (decision) process.stdout.write(JSON.stringify(decision));
+    process.exit(0);
+  });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main();

package/bin/lib/hooks/readGuard.mjs

@@ -77,8 +77,11 @@
  * way they could turn off anything on their own box; the prefix list is still
  * the first fence and this is the second.
  *
- * Run by the CLI as `node readGuard.mjs`, the hook JSON on stdin. Imported by
- * the tests for `readGuardRefusal`, which is the whole decision.
+ * Run by the CLI as `<daemon's node> readGuard.mjs` from npm, and as
+ * `flowviant __hook read-guard` under the compiled binary (bin/cli.mjs calls
+ * `main`), the hook JSON on stdin either way (claudePosture.mjs
+ * `hookCommand`). Imported by the tests for `readGuardRefusal`, which is the
+ * whole decision.
  */
 
 import { pathToFileURL } from 'node:url';
@@ -161,9 +164,15 @@ export function readGuardRefusal(command) {
 /** The sentence the model reads when a call is refused. */
 export const readGuardSentence = (why) =>
   `flowviant: this turn is read-only, so ${why} is refused here — it can write a file, run a program or read past this turn's fence. ` +
-  'Run one plain read command at a time with no redirects, pipes or expansions, or use the Read, Grep and Glob tools.';
+  'Run one plain read command at a time with no redirects, pipes or expansions, or use the Read, Grep and Glob tools. ' +
+  'Quoted pipe/bracket syntax is still refused: try separate literal git log -S searches, native Read for the working-tree path, or a plain scoped parent-path history read. Keep the guard enabled; do not bypass secret/path denials.';
 
-function main() {
+/** Run once per process: the CLI's `__hook read-guard` (the compiled binary)
+ *  calls it, and so may the direct-run check below. */
+let started = false;
+export function main() {
+  if (started) return;
+  started = true;
   // A hook that CRASHES is not a hook that refused: Claude Code treats any
   // exit other than 2 as a non-blocking error and runs the command anyway. So
   // every way out of this process that is not a verdict is a refusal.