flowviant 0.117.0 → 0.124.1

package/bin/lib/imageArtifact.mjs

@@ -0,0 +1,74 @@
+import { inflateSync } from 'node:zlib';
+import { buildArtifactUpload } from './artifacts.mjs';
+
+/** Read through the artifact scanner's bounded, no-follow reader. A filename
+ * alone cannot prove that generated textures are usable. */
+export function usableImageArtifact(entry) {
+  const bytes = buildArtifactUpload(entry, { agentId: 'validation' })?.bytes;
+  if (!bytes) return false;
+  if (/\.webp$/i.test(entry.name)) {
+    return bytes.length >= 20 && bytes.toString('ascii', 0, 4) === 'RIFF'
+      && bytes.toString('ascii', 8, 12) === 'WEBP'
+      && bytes.readUInt32LE(4) + 8 === bytes.length;
+  }
+  return usablePng(bytes);
+}
+
+const crc32 = (bytes) => {
+  let crc = 0xffffffff;
+  for (const byte of bytes) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit++) crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+};
+
+/** PNG structure, checksums and decoded scanlines, bounded at 64 MiB. Supports
+ * all standard colour types/bit depths and Adam7; no canvas or network needed. */
+export function usablePng(bytes) {
+  try {
+    if (!bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) return false;
+    let header = null;
+    const data = [];
+    let ended = false;
+    for (let at = 8; at < bytes.length;) {
+      if (at + 12 > bytes.length) return false;
+      const size = bytes.readUInt32BE(at);
+      const end = at + 8 + size;
+      if (end + 4 > bytes.length || crc32(bytes.subarray(at + 4, end)) !== bytes.readUInt32BE(end)) return false;
+      const type = bytes.toString('ascii', at + 4, at + 8);
+      if (!header && (type !== 'IHDR' || size !== 13)) return false;
+      if (type === 'IHDR') {
+        if (header || size !== 13) return false;
+        header = bytes.subarray(at + 8, end);
+      }
+      if (type === 'IDAT') data.push(bytes.subarray(at + 8, end));
+      if (type === 'IEND') {
+        if (size !== 0 || end + 4 !== bytes.length) return false;
+        ended = true;
+      }
+      at = end + 4;
+    }
+    if (!header || !ended || !data.length) return false;
+    const width = header.readUInt32BE(0), height = header.readUInt32BE(4);
+    const depth = header[8], colour = header[9], interlace = header[12];
+    const depths = { 0: [1, 2, 4, 8, 16], 2: [8, 16], 3: [1, 2, 4, 8], 4: [8, 16], 6: [8, 16] };
+    if (!width || !height || !depths[colour]?.includes(depth) || header[10] || header[11] || interlace > 1) return false;
+    const channels = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 }[colour];
+    const passes = interlace ? [[0, 0, 8, 8], [4, 0, 8, 8], [0, 4, 4, 8], [2, 0, 4, 4], [0, 2, 2, 4], [1, 0, 2, 2], [0, 1, 1, 2]] : [[0, 0, 1, 1]];
+    const rows = passes.map(([x, y, dx, dy]) => {
+      const w = Math.max(0, Math.ceil((width - x) / dx));
+      const h = Math.max(0, Math.ceil((height - y) / dy));
+      return { h: w ? h : 0, stride: 1 + Math.ceil(w * channels * depth / 8) };
+    });
+    const expected = rows.reduce((n, { h, stride }) => n + h * stride, 0);
+    if (expected > 64 * 1024 * 1024) return false;
+    const pixels = inflateSync(Buffer.concat(data), { maxOutputLength: expected });
+    if (pixels.length !== expected) return false;
+    let at = 0;
+    for (const { h, stride } of rows) {
+      for (let row = 0; row < h; row++, at += stride) if (pixels[at] > 4) return false;
+    }
+    return true;
+  } catch { return false; }
+}

package/bin/lib/instance.mjs

@@ -1,5 +1,5 @@
 /**
- * ONE DAEMON PER REPO (and per credential), ARBITRATED at startup — a second
+ * ONE DAEMON PER PROJECT (and per checkout), ARBITRATED at startup — a second
  * run in the same repo takes the first one's place rather than being turned
  * away. See "WHAT A SECOND RUN DOES" below for the whole rule.
  *
@@ -20,7 +20,7 @@
  * deploys and every worktree operation the server never sees are still first
  * come, first served.
  *
- * The per-worktree `flowviant-turn.lock` cannot save it. That lock is written
+ * The per-tab `flowviant-turn.lock` cannot save it. That lock is written
  * AFTER the work token is minted and the attachments are fetched — a window
  * containing a network round trip — so both daemons clear the check and both
  * spawn a CLI into one held conversation. It was built for a RESTARTED daemon
@@ -84,6 +84,7 @@
 
 import { execFileSync } from 'node:child_process';
 import {
+  linkSync,
   closeSync,
   mkdirSync,
   openSync,
@@ -98,7 +99,7 @@ import { join } from 'node:path';
 import { VERSION, PROCESS_STARTED_AT } from './config.mjs';
 import { compareVersions } from './versionOrder.mjs';
 import { samePath } from './repoPath.mjs';
-import { instanceLockPath, listDaemonLocks, readLockFile, readLockHolder } from './daemonLocks.mjs';
+import { legacyInstanceLockPath, instanceLockPath, listDaemonLocks, readLockFile, readLockHolder } from './daemonLocks.mjs';
 import { processAlive } from './procRegistry.mjs';
 import { procStat } from './procStat.mjs';
 
@@ -263,7 +264,7 @@ function neighbourLockPath(holder, fallback) {
 export function daemonInSameRepo(repoRoot, ownPath) {
   for (const { path, holder } of listDaemonLocks()) {
     if (path === ownPath) continue; // our own credential — the lock above owns that question
-    if (!holder || !processAlive(holder.pid)) continue;
+    if (!holder || holder.pid === process.pid || !processAlive(holder.pid)) continue;
     if (isOurReexecParent(holder.pid)) continue; // ourselves mid self-update re-exec
     if (samePath(holder.repoRoot, repoRoot)) {
       NEIGHBOUR_PATHS.set(holder, path);
@@ -747,6 +748,12 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
   const { takeover: force = false, noTakeover = false, allowDowngrade = false, log } = opts;
   if (process.env.FLOWVIANT_ALLOW_MULTI === '1') return { ok: true, release: () => {} };
   const path = instanceLockPath(fleetToken);
+  // Atomically adopt the pre-project lock if one survives an upgrade. A hard
+  // link cannot replace a new holder and preserves its ownership record.
+  const legacy = legacyInstanceLockPath(fleetToken);
+  if (legacy !== path) {
+    try { linkSync(legacy, path); } catch { /* absent or already adopted */ }
+  }
   try {
     mkdirSync(join(homedir(), '.flowviant'), { recursive: true });
   } catch {
@@ -786,7 +793,10 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       fd = openSync(path, 'wx');
     } catch (e) {
       if (e.code !== 'EEXIST') return { ok: true, release: () => {}, unguarded: true };
-      const holder = readHolder(path);
+      let holder = readHolder(path);
+      const legacyHolder = legacy !== path ? readHolder(legacy) : null;
+      const holderPath = legacyHolder?.pid === holder?.pid && legacyHolder ? legacy : path;
+      if (legacyHolder && holderPath === legacy) holder = legacyHolder;
       if (!holder || !processAlive(holder.pid)) {
         // A crashed daemon's leftover. Clear it and take it on the next pass —
         // ownership-verified, because a concurrent start may have cleared and
@@ -826,7 +836,7 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       const here = samePath(holder.repoRoot, repoRoot);
       const wanted = force || (here && !noTakeover);
       if (wanted) {
-        const bad = takeOverFrom(holder, path, log, { allowDowngrade });
+        const bad = takeOverFrom(holder, holderPath, log, { allowDowngrade });
         if (bad?.stale) {
           // Measured: the lock's writer is gone and its pid was recycled to a
           // stranger. A corpse is cleared, never "refused" — refusing bricked
@@ -930,7 +940,10 @@ function makeRelease(path) {
  * rest are what the caller reports.
  */
 function stopLock(path, log, tally) {
-  const holder = readHolder(path);
+  let holder = readHolder(path);
+  // An upgraded CLI may have adopted an old credential lock. The old
+  // daemon still writes its drain mark to that alias by rename.
+  if (holder) holder = listDaemonLocks().find((row) => row.holder?.pid === holder.pid && row.holder?.draining)?.holder ?? holder;
   if (!holder) return; // absent, truncated, half-written — no claim to answer
   const where = holder.repoRoot ? ` in ${holder.repoRoot}` : '';
   const what = holder.version ? ` ${holder.version}` : '';

package/bin/lib/landed.mjs

@@ -44,7 +44,7 @@ const MAX_COMMITS = 50;
  *  shape (7–64 hex, either case), the one this module always used. */
 const SHA_RE = OBJECT_ID_RE;
 
-export function createLandedObserver({ repoRoot, baseRef }) {
+export function createLandedObserver({ repoRoot, baseRef, repo }) {
   // One state file per checkout, so two repos on one box never share a tip.
   // Its own 8-hex key — NOT the worktree home's `<basename>-<8 hex>`
   // (statePaths.mjs) — and it stays as it is, so a persisted tip is never
@@ -175,7 +175,7 @@ export function createLandedObserver({ repoRoot, baseRef }) {
     try {
       const res = await postFleetJson(
         LANDED_URL,
-        { base: baseBranchName(ref), tip: reportedTip, commits },
+        { base: baseBranchName(ref), tip: reportedTip, commits, ...(repo ? { repo } : {}) },
         { timeoutMs: 20_000 }
       );
       if (res.status === 404) {

package/bin/lib/login.mjs

@@ -7,23 +7,28 @@
  */
 
 import { APP_URL, FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
-import { saveLogin, detectRepoRoot, projectLabel, safeName, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
+import { saveLogin, detectRepoRoot, projectLabel, safeName, listStoredProjects, boundElsewhere, directoryTakenRefusal, isStoredRepo } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './sleep.mjs';
 import { launchCommand, terminalCommand } from './launchCommand.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { checkoutIdentity } from './checkoutIdentity.mjs';
+import { printableLine } from './printable.mjs';
 
 const DEVICE_START = fleetEndpoint('device/start', FLEET_URL);
 const DEVICE_POLL = fleetEndpoint('device/poll', FLEET_URL);
 
-async function postJson(url, body) {
+async function postJson(url, body, token) {
   const res = await fetch(url, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'User-Agent': USER_AGENT },
+    headers: { 'Content-Type': 'application/json', 'User-Agent': USER_AGENT, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
     signal: AbortSignal.timeout(30_000),
     body: JSON.stringify(body),
   });
-  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(printableLine(body?.error?.message, 2000) || `HTTP ${res.status}`);
+  }
   const j = await res.json();
   return j.data ?? j;
 }
@@ -69,6 +74,7 @@ export async function runLogin({ thenStart = false, json = false, dir = process.
   else {
     console.log(`  Open ${c.cyan(approveUrl)}`);
     console.log(`  and approve this computer for your project. Check the code there is ${c.bold(c.green(pretty))}.\n`);
+    if (listStoredProjects().length) info('Choose an existing project to add this checkout to its board.');
     info('waiting for you to approve…');
   }
 
@@ -123,6 +129,35 @@ export async function runLogin({ thenStart = false, json = false, dir = process.
         console.log('');
         return { saved: false };
       }
+      if (repoRoot) {
+        const previous = listStoredProjects().find((p) => p.projectId === entry.projectId);
+        try {
+          if (poll.repositoryRegistration === true) {
+            // A pre-multi-repo project may never have reported its remote.
+            // Fill its migrated primary from the checkout already bound by a
+            // person before registering the newly approved second checkout.
+            entry.repositoryBindings = [];
+            for (const [name, root] of Object.entries(previous?.repositoriesRegistered ? {} : previous?.repositories ?? {})) {
+              if (isStoredRepo({ repoRoot: root }, repoRoot)) continue;
+              const old = await post(fleetEndpoint('repositories/register', FLEET_URL), { ...checkoutIdentity(root), name }, entry.fleetToken);
+              if (typeof old?.name !== 'string' || !/^[a-z0-9][a-z0-9_-]*$/.test(old.name)) throw new Error('Flowviant returned an invalid repository.');
+              entry.repositoryBindings.push({ name: old.name, repoRoot: root, isPrimary: old.isPrimary === true });
+            }
+            const repo = await post(fleetEndpoint('repositories/register', FLEET_URL), checkoutIdentity(repoRoot), entry.fleetToken);
+            if (typeof repo?.name !== 'string' || !/^[a-z0-9][a-z0-9_-]*$/.test(repo.name)) throw new Error('Flowviant returned an invalid repository.');
+            entry.repositoryName = repo.name;
+            entry.isPrimary = repo.isPrimary === true;
+            entry.repositoriesRegistered = true;
+          } else if (previous?.repoRoot && !isStoredRepo(previous, repoRoot)) {
+            throw new Error('This Flowviant server does not support adding repositories yet.');
+          }
+        } catch (e) {
+          const message = `Could not connect this repository: ${e.message}`;
+          if (json) event({ event: 'error', message });
+          else warn(message);
+          return { saved: false };
+        }
+      }
       try { saveLogin(entry); }
       catch (e) {
         if (json) { event({ event: 'error', message: `Could not save this connection: ${e.message}` }); return { saved: false }; }

package/bin/lib/maintenance.mjs

@@ -0,0 +1,47 @@
+/** A manual tray restart drains intake without signalling any existing run.
+ * The lease expires if the tray crashes. A daemon acknowledges only at the
+ * reconcile boundary, after all previously admitted work has been counted. */
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const MAINTENANCE_LEASE_MS = 120_000;
+const pathFor = (home) => join(home, '.flowviant', 'maintenance.json');
+export function readMaintenanceRequest({ home = homedir(), now = Date.now() } = {}) {
+  try {
+    const value = JSON.parse(readFileSync(pathFor(home), 'utf8'));
+    return typeof value.token === 'string' && /^[a-zA-Z0-9-]{1,100}$/.test(value.token) && typeof value.epoch === 'string' &&
+      Number.isFinite(value.expires) && value.expires > now && value.expires <= now + MAINTENANCE_LEASE_MS
+      ? value : null;
+  } catch { return null; }
+}
+export function readMaintenance(options) { return readMaintenanceRequest(options)?.token ?? null; }
+export function requestMaintenance(token, { home = homedir(), now = Date.now() } = {}) {
+  if (typeof token !== 'string' || !/^[a-zA-Z0-9-]{1,100}$/.test(token)) throw new Error('Invalid restart request');
+  const current = readMaintenanceRequest({ home, now });
+  if (current && current.token !== token) throw new Error('Another WSL restart is pending');
+  mkdirSync(join(home, '.flowviant'), { recursive: true });
+  const path = pathFor(home);
+  const tmp = `${path}.${process.pid}.tmp`;
+  const epoch = current?.epoch ?? randomUUID();
+  writeFileSync(tmp, JSON.stringify({ token, epoch, expires: now + MAINTENANCE_LEASE_MS }), { mode: 0o600 });
+  renameSync(tmp, path);
+  return epoch;
+}
+export function releaseMaintenance(token, { home = homedir(), now = Date.now() } = {}) {
+  if (readMaintenance({ home, now }) === token) rmSync(pathFor(home), { force: true });
+}
+
+/** The paused branch does only reporting. In particular, an acknowledgement
+ * can never be copied from a pre-pause idle measurement. */
+export async function maintenanceTick({ request = readMaintenanceRequest, busy, agents, flush, report }) {
+  const lease = request();
+  if (!lease) return false;
+  await flush();
+  // A slow network flush can outlive the request. Never acknowledge an
+  // expired generation whose next reconcile is allowed to admit work again.
+  if (request()?.epoch !== lease.epoch) return true;
+  report({ maintenance: lease.token, maintenanceEpoch: lease.epoch, busy: busy(), liveAgents: agents(), busyAt: new Date().toISOString() });
+  return true;
+}

package/bin/lib/maintenanceInventory.mjs

@@ -0,0 +1,39 @@
+/** The restart must also see live locks not backed by a stored project, and
+ * unguarded processes recorded in state. Neither is an empty machine. */
+import { instanceLockPath, listDaemonLocks } from './daemonLocks.mjs';
+import { daemonLockPid, readDaemonState } from './daemonState.mjs';
+import { listStoredProjects } from './credentials.mjs';
+import { processAlive } from './procRegistry.mjs';
+
+export function unknownMaintenanceDaemons({ entries = listStoredProjects(), locks = listDaemonLocks(),
+  stateFor = readDaemonState, pidFor = daemonLockPid, alive = processAlive } = {}) {
+  const known = new Set();
+  const unknown = new Set();
+  for (const entry of entries) {
+    const state = stateFor(entry.projectId);
+    const pid = pidFor(entry.fleetToken);
+    if (pid != null && pid === state.pid) known.add(pid);
+    if (Number.isInteger(state.pid) && state.pid > 0 && state.pid !== pid && alive(state.pid)) unknown.add(state.pid);
+  }
+  for (const { path, holder } of locks) {
+    if (!holder) unknown.add(path); // unreadable is not absent
+    else if (alive(holder.pid) && !known.has(holder.pid)) unknown.add(holder.pid);
+  }
+  return unknown.size;
+}
+
+/** The ordinary tray status reserves null for an absent lock. For a global
+ * restart we additionally measure the whole lock directory: no lock and no
+ * live state PID means this stored project's daemon is stopped. Unreadable
+ * directories throw rather than becoming a fabricated empty machine. */
+export function maintenanceInventory(status, { entries = listStoredProjects(), locks = listDaemonLocks({ strict: true }),
+  stateFor = readDaemonState, pidFor = daemonLockPid, alive = processAlive } = {}) {
+  const paths = new Set(locks.map(lock => lock.path));
+  const projects = status.projects.map(row => {
+    const entry = entries.find(entry => entry.projectId === row.id);
+    if (row.running !== null || !entry || paths.has(instanceLockPath(entry.fleetToken))) return row;
+    const pid = stateFor(row.id).pid;
+    return Number.isInteger(pid) && pid > 0 && alive(pid) ? row : { ...row, running: false };
+  });
+  return { projects, unknownDaemons: unknownMaintenanceDaemons({ entries, locks, stateFor, pidFor, alive }) };
+}

package/bin/lib/mcpInstall.mjs

@@ -0,0 +1,163 @@
+/**
+ * A CONFIRMED MCP INSTALL (2026-10-13, the owner; the app's half is
+ * packages/shared `mcpSetup.ts`). A project owner pressed "Install on <this
+ * machine>" on the Machines page and confirmed the exact command; the roster
+ * hands it to THIS box as `mcpInstallJobs`.
+ *
+ * WHAT THIS DOES, AND ALL IT DOES:
+ *  · claims the job (single-flight across processes, bound to this box);
+ *  · refuses, without running anything, a command its own copy of the rule
+ *    refuses (`mcpInstallCommandRefusal` — a privilege word, more than one
+ *    line, over the cap; parity rule 36 holds it to the server's);
+ *  · runs EXACTLY the text it was handed through `/bin/sh -c`, in the
+ *    project's checkout, as this daemon's own user, never with sudo, stdin
+ *    closed, as an unattended child (no machine credential, no display), in
+ *    its own process group killed whole at the timeout;
+ *  · streams the output's tail back about once a second, and at the end the
+ *    exit code;
+ *  · then looks again (`recheck`): the tool report is rescanned and posted,
+ *    and Claude Code is probed with the base branch's servers mounted, so the
+ *    page's checklist clears when the server starts.
+ *
+ * The command is never rewritten, prefixed or appended to.
+ */
+import { spawn } from 'node:child_process';
+import { DAEMON_INSTANCE, FLEET_URL } from './config.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, postBestEffort, settleLease } from './fleetPost.mjs';
+import { killGroup } from './processGroup.mjs';
+import { unattendedEnv } from './noWindowEnv.mjs';
+import { scrubTail } from './uplinkScrub.mjs';
+import { c, note, ok, warn } from './ui.mjs';
+import { printableLine } from './printable.mjs';
+
+/** The server's bounds (shared `mcpSetup.ts`; parity rule 36). */
+export const MCP_INSTALL_COMMAND_MAX = 500;
+export const MCP_INSTALL_OUTPUT_MAX = 16_000;
+export const MCP_INSTALL_TIMEOUT_MS = 10 * 60_000;
+export const MCP_INSTALL_PRIVILEGE_WORDS = Object.freeze(['sudo', 'doas', 'su', 'pkexec', 'run0']);
+
+/** Why this command cannot run, or null — the shared rule, word for word. */
+export function mcpInstallCommandRefusal(command) {
+  if (typeof command !== 'string' || !command.trim()) return 'The install command is empty.';
+  if (command.length > MCP_INSTALL_COMMAND_MAX) return `The install command is over ${MCP_INSTALL_COMMAND_MAX} characters.`;
+  if (/[\r\n\0]/.test(command)) return 'The install command must be one line.';
+  const words = command.split(/[^A-Za-z0-9_-]+/);
+  const word = MCP_INSTALL_PRIVILEGE_WORDS.find((w) => words.includes(w));
+  if (word) return `Flowviant never installs with ${word}. Use a command that installs as the machine's own user.`;
+  return null;
+}
+
+const url = (tail) => fleetEndpoint(tail, FLEET_URL);
+const tail = (text) => (text.length > MCP_INSTALL_OUTPUT_MAX ? text.slice(text.length - MCP_INSTALL_OUTPUT_MAX) : text);
+
+/**
+ * Run one command and hand back `{ code, out }`. `onOutput(out)` hears the
+ * tail as it grows. `spawnChild` is a test's.
+ */
+export function runInstallCommand(command, { cwd, timeoutMs = MCP_INSTALL_TIMEOUT_MS, env = unattendedEnv(), onOutput = () => {}, spawnChild = spawn } = {}) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnChild('/bin/sh', ['-c', command], { cwd, env, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch (error) {
+      resolve({ code: -1, out: `[flowviant] could not start the command: ${error?.message ?? error}` });
+      return;
+    }
+    let buf = '';
+    let settled = false;
+    const settle = (v) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(v);
+    };
+    const take = (d) => {
+      buf += d;
+      if (buf.length > 2 * MCP_INSTALL_OUTPUT_MAX) buf = scrubTail(buf, MCP_INSTALL_OUTPUT_MAX);
+      onOutput(scrubTail(buf, MCP_INSTALL_OUTPUT_MAX));
+    };
+    child.stdout?.setEncoding('utf8');
+    child.stderr?.setEncoding('utf8');
+    child.stdout?.on('data', take);
+    child.stderr?.on('data', take);
+    const timer = setTimeout(() => {
+      killGroup(child, 'SIGKILL');
+      const minutes = Math.round(timeoutMs / 60_000);
+      settle({ code: -1, out: scrubTail(`${buf}\n[flowviant] the command ran past ${minutes >= 1 ? `${minutes} minutes` : `${timeoutMs}ms`} and was stopped`, MCP_INSTALL_OUTPUT_MAX) });
+    }, timeoutMs);
+    timer.unref?.();
+    child.on('error', (error) => settle({ code: -1, out: scrubTail(`${buf}\n[flowviant] ${error?.message ?? error}`, MCP_INSTALL_OUTPUT_MAX) }));
+    child.on('close', (code) => settle({ code: code ?? -1, out: scrubTail(buf, MCP_INSTALL_OUTPUT_MAX) }));
+  });
+}
+
+/** Job ids this process has taken — never run twice in one process. */
+const seen = new Set();
+let running = 0;
+/** Installs this process is running — the machine is busy while one is. */
+export const mcpInstallsInFlight = () => running;
+
+/**
+ * The roster's `mcpInstallJobs` for this box. `ctx` = { repoRoot, myPubB64,
+ * recheck }, and for tests `run`, `claim`, `report` and `final`.
+ */
+export function processMcpInstallJobs(jobs, ctx) {
+  if (!Array.isArray(jobs)) return;
+  for (const job of jobs) {
+    if (!job || typeof job.id !== 'string' || typeof job.command !== 'string' || seen.has(job.id)) continue;
+    seen.add(job.id);
+    void runJob(job, ctx);
+  }
+}
+
+async function runJob(job, ctx) {
+  const pubkey = ctx.myPubB64?.();
+  if (!pubkey) return;
+  const claim = ctx.claim ?? ((fields) => claimFleetLease(url('mcp-install-claim'), fields));
+  const report = ctx.report ?? ((body) => settleLease(url('mcp-install-report'), body, { timeoutMs: 15_000 }));
+  const final = ctx.final ?? ((body) => postBestEffort(url('mcp-install-report'), { ...body, instance: DAEMON_INSTANCE }));
+  const run = ctx.run ?? runInstallCommand;
+  if (!(await claim({ jobId: job.id, pubkey }))) return;
+  const name = printableLine(String(job.serverName ?? 'MCP server'), 60);
+  const refusal = mcpInstallCommandRefusal(job.command);
+  if (refusal) {
+    warn(`${c.cyan('mcp')} ${c.dim(`— not installing ${name}: ${refusal}`)}`);
+    await final({ jobId: job.id, pubkey, output: `[flowviant] ${refusal}`, done: true, exitCode: -1 });
+    return;
+  }
+  running += 1;
+  note(`${c.cyan('mcp')} ${c.dim(`— installing ${name}, as confirmed in the app: ${printableLine(job.command, 200)}`)}`);
+  let latest = '';
+  let sentAt = 0;
+  let sending = false;
+  const beat = () => {
+    if (sending || latest === '' || Date.now() - sentAt < 1000) return;
+    sending = true;
+    sentAt = Date.now();
+    const output = latest;
+    void Promise.resolve(report({ jobId: job.id, pubkey, output, done: false, exitCode: null })).catch(() => {}).finally(() => { sending = false; });
+  };
+  const timer = setInterval(beat, 1000);
+  timer.unref?.();
+  try {
+    const timeoutMs = Number.isInteger(job.timeoutMs) && job.timeoutMs > 0 ? Math.min(job.timeoutMs, MCP_INSTALL_TIMEOUT_MS) : MCP_INSTALL_TIMEOUT_MS;
+    const { code, out } = await run(job.command, { cwd: ctx.repoRoot, timeoutMs, onOutput: (o) => { latest = tail(o); } });
+    clearInterval(timer);
+    await final({ jobId: job.id, pubkey, output: tail(out), done: true, exitCode: code });
+    if (code === 0) ok(`${c.cyan('mcp')} ${c.dim(`— installed ${name}; checking it again`)}`);
+    else warn(`${c.cyan('mcp')} ${c.dim(`— installing ${name} exited ${code}`)}`);
+  } finally {
+    clearInterval(timer);
+    running -= 1;
+    try {
+      await ctx.recheck?.();
+    } catch { /* a re-check is best-effort; the next beat looks anyway */ }
+  }
+}
+
+/** Tests only. */
+export function resetMcpInstallsForTest() {
+  seen.clear();
+  running = 0;
+}

package/bin/lib/mcpInventory.mjs

@@ -0,0 +1,119 @@
+/**
+ * EVERY MCP SERVER EACH CLI ON THIS BOX HAS, FOR THE MACHINES PAGE (2026-10-13,
+ * the owner: "see at a glance what Flowviant can do on this project, from what
+ * the serving machine's CLIs actually have").
+ *
+ * Per installed CLI, one list: the servers the CLI itself reported (Claude
+ * Code's init, harvested in runtimeCapabilities.mjs; Codex's `mcp list`, read
+ * in runtimeOfferings.mjs) and every server the base branch's `.mcp.json`
+ * declares (projectTools.mjs). Rides this box's own `tools-report`
+ * (fleetReports.mjs), so its 60-second beat and write-on-change dedup are the
+ * lane's; the server stores it per box (packages/shared `mcpInventory.ts`,
+ * the shape and the bounds, held equal by parity rule 35).
+ *
+ * DECLARED IS NOT PRESENT. A base `.mcp.json` server the CLI did not report
+ * running is `declared`, with the reason this daemon would leave it unmounted
+ * (`env X unset`, `command y not on PATH`, a transport the CLI refuses) when
+ * there is one — never shown as available because the file lists it.
+ *
+ * Names, statuses, sources, reasons and tool names only: no env value, header,
+ * token, URL or path leaves the box.
+ */
+import { toolReadout } from './projectTools.mjs';
+import { MCP_NAME_MAX } from './runtimeCapabilities.mjs';
+
+/** The server's bounds (shared `mcpInventory.ts`; parity rule 35). */
+export const MCP_INVENTORY_MAX_SERVERS = 80;
+export const MCP_INVENTORY_NAME_MAX = MCP_NAME_MAX;
+export const MCP_INVENTORY_TOOLS_PER_SERVER = 100;
+export const MCP_INVENTORY_TOOLS_PER_CLI = 1000;
+export const MCP_INVENTORY_TOOL_NAME_MAX = 64;
+export const MCP_INVENTORY_REASON_MAX = 200;
+
+const SOURCE_ORDER = { project: 0, personal: 1, claudeai: 2 };
+const TOOL_NAME = /^[A-Za-z0-9_.:-]+$/;
+
+/**
+ * Claude Code's scope word → the page's source. `project` is a checkout's
+ * `.mcp.json`; `claudeai` an account connector; `dynamic` is a server named on
+ * the command line, which on a turn the harvest records is the base copy when
+ * the name is declared and otherwise this daemon's own — not the person's.
+ * Every other scope (user, local, plugin, enterprise, managed, agent) is the
+ * CLI's own config on this box.
+ */
+function claudeSource(scope, name, declared) {
+  if (scope === 'claudeai' || name.startsWith('claude.ai ')) return 'claudeai';
+  if (scope === 'project') return 'project';
+  if (scope === 'dynamic') return declared.has(name) ? 'project' : null;
+  return 'personal';
+}
+
+const declaredRows = (snapshot, runner) =>
+  snapshot ? toolReadout(snapshot, runner).filter((t) => t.kind === 'mcp') : [];
+
+/** One CLI's list, bounded the way the server re-applies it. */
+function bound(servers) {
+  let budget = MCP_INVENTORY_TOOLS_PER_CLI;
+  const seen = new Set();
+  return servers
+    .map((s) => ({ ...s, name: s.name.trim().slice(0, MCP_INVENTORY_NAME_MAX).trim() }))
+    .filter((s) => s.name && s.name !== 'flowviant' && !seen.has(s.name) && seen.add(s.name))
+    .sort((a, b) => SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source] || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+    .slice(0, MCP_INVENTORY_MAX_SERVERS)
+    .map((s) => {
+      let tools = null;
+      if (Array.isArray(s.tools)) {
+        tools = [...new Set(s.tools.filter((t) => typeof t === 'string' && t.length <= MCP_INVENTORY_TOOL_NAME_MAX && TOOL_NAME.test(t)))]
+          .sort()
+          .slice(0, Math.min(MCP_INVENTORY_TOOLS_PER_SERVER, budget));
+        budget -= tools.length;
+      }
+      return { name: s.name, source: s.source, status: s.status, reason: s.reason == null ? null : String(s.reason).slice(0, MCP_INVENTORY_REASON_MAX), tools };
+    });
+}
+
+/** Claude Code: what its init reported, then each declaration it did not. */
+export function claudeInventory(harvested, snapshot) {
+  const declared = new Map(declaredRows(snapshot, 'claude').map((t) => [t.name, t]));
+  const servers = [];
+  for (const h of harvested ?? []) {
+    const source = claudeSource(h.scope, h.name, declared);
+    if (!source) continue;
+    const why = source === 'project' && h.status !== 'connected' ? declared.get(h.name)?.reason ?? null : null;
+    servers.push({ name: h.name, source, status: h.status, reason: why, tools: h.status === 'connected' ? h.tools ?? [] : null });
+  }
+  const running = new Set(servers.filter((s) => s.source === 'project').map((s) => s.name));
+  for (const [name, d] of declared) {
+    if (!running.has(name)) servers.push({ name, source: 'project', status: 'declared', reason: d.reason, tools: null });
+  }
+  return { reported: harvested != null, servers: bound(servers) };
+}
+
+/**
+ * Codex: its own config's servers, then each declaration. A declared server
+ * replaces a personal one of the same name on a card's turn
+ * (projectToolRuntimes.mjs `isolatedCodexHome`), so the declaration is the
+ * row. Codex names no tools without starting a server, so `tools` is null.
+ */
+export function codexInventory(rows, snapshot) {
+  const declared = declaredRows(snapshot, 'codex');
+  const names = new Set(declared.map((d) => d.name));
+  const servers = [
+    ...declared.map((d) => ({ name: d.name, source: 'project', status: 'declared', reason: d.reason, tools: null })),
+    ...(rows ?? []).filter((r) => !names.has(r.name)).map((r) => ({ name: r.name, source: 'personal', status: r.status, reason: r.reason, tools: null })),
+  ];
+  return { reported: rows != null, servers: bound(servers) };
+}
+
+/**
+ * The `mcp` key of the tools report: `{ claude?, codex? }`, a CLI only when it
+ * is installed here. `snapshot` is the base-branch read (null when it could
+ * not be read — the declarations are then unknown, and only the CLI's own
+ * list is said).
+ */
+export function buildMcpInventory({ installed, snapshot, claude, codex }) {
+  const out = {};
+  if (installed.includes('claude')) out.claude = claudeInventory(claude, snapshot);
+  if (installed.includes('codex')) out.codex = codexInventory(codex, snapshot);
+  return out;
+}

package/bin/lib/placeLock.mjs

@@ -39,12 +39,13 @@ export function createPlaceLock() {
  * so the two never shared a chain and the guarantee was not held. Both sides
  * key on the place now.
  *
- * The cross-process pid lock (`flowviant-turn.lock`) is UNCHANGED and stays
- * per-place: it is a crash backstop for an orphaned CLI a dead daemon left
- * behind, not the parallelism policy. It is more conservative than this lock
- * — two sessions sharing one place still serialize across processes — which
- * costs nothing in practice, since a place holds one session unless somebody
- * deliberately points a second one at it.
+ * The cross-process pid lock (`flowviant-turn.lock`) is a crash backstop for
+ * an orphaned CLI a dead daemon left behind, not the parallelism policy. It
+ * was per-place and so MORE conservative than this lock, on the claim that a
+ * place holds one session — but every tab a person opens shares the checkout,
+ * so it serialized all of their tabs and undid this lock's readers. It is per
+ * TAB since 2026-10-14 (turnLock.mjs): one CLI per conversation, any number
+ * per place, and ship still reads every tab's.
  */
 const placeLocks = new Map(); // placeId -> { readers, writing, waiters: [] }
 
@@ -80,12 +81,13 @@ const pumpPlace = (id) => {
  * contract above is what guarantees a turn is answered, and hiding a throw
  * here would let a turn fail silently while holding nothing.
  */
-const inPlace = async (placeId, write, fn) => {
+const inPlace = async (placeId, write, fn, onWaiting) => {
   let st = placeLocks.get(placeId);
   if (!st) {
     st = { readers: 0, writing: false, waiters: [] };
     placeLocks.set(placeId, st);
   }
+  if (st.writing || st.waiters.some(waiter => waiter.write) || (write && st.readers > 0)) onWaiting?.();
   await new Promise((go) => {
     st.waiters.push({ write, go });
     pumpPlace(placeId);