flowviant 0.125.13 → 0.125.15

package/bin/lib/workSessionTurns.mjs

@@ -46,6 +46,15 @@ import { sessionTurnKickoff, sessionTurnShape, sessionTurnSystem } from './workT
 import { createToolLog } from './workToolLog.mjs';
 import { createCommandAudit } from './workCommandAudit.mjs';
 import { APPROVAL_REFUSED, codexApprovalSentence, codexLoginFailure, codexLoginSentence, withRelay } from './codexRelay.mjs';
+import { createReadOnlyCoordination, readOnlyCoordinationSafe, watchReadOnlyAttempt } from './readOnlyRun.mjs';
+import { createCaptureAuthority } from './captureAuthority.mjs';
+import { captureOrchestratorContract } from './orchestratorPrompt.mjs';
+import { runCappedTurn } from './workCappedTurn.mjs';
+import { measuredRuntimeVersion } from './runtimeDetection.mjs';
+import { knownCodexModels } from './runtimeOfferings.mjs';
+import { FLEET_URL, DAEMON_INSTANCE, MODEL } from './config.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
+const defaultWatchCapture = job => watchReadOnlyAttempt(fleetEndpoint('capture-run-state', FLEET_URL), job);
 
 /**
  * HOW LONG, AND HOW MANY, SETTLED TURNS THE LANE REMEMBERS (2026-09-29) — see
@@ -91,6 +100,9 @@ export function createWorkSessionTurns({
   // The real CLI driver; injectable only so the lane can be driven in a test
   // without spending a model turn (the wiki runner's shape).
   runTurn = defaultRunTurn,
+  runtimeVersion = id => measuredRuntimeVersion(id)?.version,
+  coordinate = createReadOnlyCoordination,
+  watchCapture = defaultWatchCapture,
   // The clock `settledHere` ages by; injectable only for its bound's test.
   now = Date.now,
   makeLiveMessages = createLiveMessages,
@@ -140,14 +152,17 @@ export function createWorkSessionTurns({
    * be delivered by `pendingWorkReports`, and this covers the one that was.
    */
   const settledHere = new Map(); // turnId -> when this lane settled it, oldest first
+  const settledAttempts = new Map(); // only measured execution generations
   const forgetStale = (at) => {
     for (const [id, when] of settledHere) {
       if (settledHere.size <= SETTLED_HERE_MAX && at - when < SETTLED_HERE_TTL_MS) break;
       settledHere.delete(id);
+      settledAttempts.delete(id);
     }
   };
-  const settledRecently = (turnId) => {
+  const settledRecently = (turnId, attempt) => {
     forgetStale(now());
+    if (Number.isInteger(attempt) && settledAttempts.has(turnId) && settledAttempts.get(turnId) !== attempt) return false;
     return settledHere.has(turnId);
   };
   const settleTurn = (turnId, payload) => {
@@ -156,6 +171,7 @@ export function createWorkSessionTurns({
     const at = now();
     settledHere.delete(turnId); // re-inserted at the end: the map stays in time order
     settledHere.set(turnId, at);
+    if (Number.isInteger(run?.job?.attempt)) settledAttempts.set(turnId, run.job.attempt);
     forgetStale(at);
     const liveMessages = runs.get(turnId)?.live?.receipts();
     return settleWorkTurn(turnId, { ...payload, ...(liveMessages?.ids.length ? { liveMessages } : {}) });
@@ -185,13 +201,18 @@ export function createWorkSessionTurns({
       if (!job || typeof job.id !== 'string' || !job.body || !job.sessionId) continue;
       if (rosterInterrupts.has(job.id)) continue;
       if (workAnswering.has(job.id)) {
-        const reason = runs.get(job.id)?.waitingReason;
+        const previous = runs.get(job.id);
+        if (job.captureOrchestrationVersion === 1 && Number.isInteger(job.attempt) && Number.isInteger(previous?.job.attempt) && job.attempt !== previous.job.attempt) {
+          previous.interrupted = true; previous.abort.abort();
+          for (const child of previous.spawned) interruptThenKill(child);
+        }
+        const reason = previous?.waitingReason;
         if (reason) reportDelivery('session', job, 'queued', reason);
         continue;
       }
       // Settled by this lane already: a roster read from before the settle
       // landed. See `settledHere`.
-      if (settledRecently(job.id)) continue;
+      if (settledRecently(job.id, job.attempt)) continue;
       // The turn already RAN and its answer sits in the delivery queue — never
       // run it again while the report is merely undelivered.
       if (pendingWorkReports.has(job.id)) continue;
@@ -225,9 +246,10 @@ export function createWorkSessionTurns({
         continue;
       }
       const releaseSlot = admit.reserve();
+      if (Number.isInteger(job.attempt) && settledAttempts.has(job.id) && settledAttempts.get(job.id) !== job.attempt) workAttempts.delete(job.id);
       lastDeferSaid.delete(job.sessionId);
       workAnswering.add(job.id);
-      const run = { interrupted: false, spawned: [], sessionId: job.sessionId, live: null, job };
+      const run = { interrupted: false, spawned: [], sessionId: job.sessionId, live: null, job, abort: new AbortController() };
       runs.set(job.id, run);
       /** The execution generation the server handed, echoed on every settle
        *  so the server can tell this execution's answer from an older one's. */
@@ -644,17 +666,29 @@ export function createWorkSessionTurns({
           // without one — see workTurnShape.mjs). A plan turn's credential is
           // still minted above: its lease answers (held elsewhere, gone) are
           // about the SESSION, and a plan turn needs them as much as any other.
-          const mcp = shape.mountMcp
-            ? mcpFor(rt.id, mint.token, getMcpUrl())
-            : { args: [], env: null, dir: null };
+          let mcp = { args: [], env: null, dir: null };
           // The tab's model/effort, if it named any. Spread into turnArgs so
           // BOTH runTurn calls below carry it — the retry is the same turn on
           // the same brain, not a quieter second opinion.
           const brain = brainFor(job, rt.id);
+          const childBrain = { ...brain, runtime: rt.id, model: brain.model ?? (rt.id === 'claude' ? MODEL : null),
+            ...(rt.id === 'codex' ? { catalog: knownCodexModels() } : {}) };
+          const version = shape.capture && job.captureOrchestrationVersion === 1 ? runtimeVersion(rt.id) : null;
+          const delegated = shape.capture && job.captureOrchestrationVersion === 1 && Number.isSafeInteger(job.attempt)
+            && job.attempt >= 0 && readOnlyCoordinationSafe(rt.id, version);
+          let coordination = null, control = null;
+          let captureSignal = run.abort.signal;
+          const makeCoordination = () => coordinate({ enabled: true, runtime: rt.id, version, admit,
+            identity: { scope: 'capture', id: job.id, attempt: job.attempt }, signal: captureSignal,
+            children: childBrain,
+            rootTools: createCaptureAuthority({ url: getMcpUrl(), token: mint.token, sessionId: job.sessionId,
+              turnId: job.id, attempt: job.attempt, signal: captureSignal }),
+          });
           // Attempts count RUNS: the infra refusals above consumed nothing and
           // settled on their own terms.
           workAttempts.set(job.id, tries + 1);
           let out;
+          let turnReturned = false;
           let seenThreadId = null; // codex's conversation id, off thread.started
           let seenClaudeSession = null; // claude's own conversation id, off system.init
           // What a Codex turn's own events say went wrong (codexRelay.mjs):
@@ -678,9 +712,8 @@ export function createWorkSessionTurns({
           const turnLog = createToolLog(dir.wt);
           toolLog = turnLog.toolLog;
           const { pushToolEvent } = turnLog;
-          const narrator = makeNarrator(job.sessionId, job.id, () =>
-            toolLog
-          );
+          const narrator = makeNarrator(job.sessionId, job.id, () => toolLog,
+            delegated ? { attempt: job.attempt, instance: DAEMON_INSTANCE } : {});
 
 
           // THE COMMAND AUDIT — see workCommandAudit.mjs.
@@ -691,6 +724,19 @@ export function createWorkSessionTurns({
             cwd: dir.wt,
           });
           try {
+            if (delegated) {
+              control = await watchCapture(job);
+              captureSignal = AbortSignal.any([run.abort.signal, control.signal]);
+              const stopped = () => { run.interrupted = true; run.abort.abort(); };
+              if (captureSignal.aborted) stopped();
+              else control.signal.addEventListener('abort', stopped, { once: true });
+              if (!run.interrupted) coordination = await makeCoordination();
+            }
+            // A safe native gate replaces the credential mount, keeping the
+            // actual capture credential entirely outside the CLI's children.
+            // Unsupported/gate-unavailable turns retain the original solo path.
+            if (!coordination && shape.mountMcp) mcp = mcpFor(rt.id, mint.token, getMcpUrl());
+            const captureContract = coordination ? captureOrchestratorContract(childBrain) : '';
             // Files first, then the message that references them: the agent
             // must be able to open what it is being told about. Only the ones
             // that actually landed are named.
@@ -750,7 +796,7 @@ export function createWorkSessionTurns({
                       knowledgeDir,
                       artifactsAccepted: getArtifactsAccepted(),
                       runtime: rt.id,
-                    }) + (toolLog.baseline ? '\n\n' + REPOSITORY_BASELINE_PARAGRAPH(toolLog.baseline) : '') + (artifactScan?.instructions ? `\n\n${artifactScan.instructions}` : '');
+                    }) + (toolLog.baseline ? '\n\n' + REPOSITORY_BASELINE_PARAGRAPH(toolLog.baseline) : '') + (artifactScan?.instructions ? `\n\n${artifactScan.instructions}` : '') + (captureContract ? `\n\n${captureContract}` : '');
                     contractSent = !codexContractKnown(contractPath, codexResumeId, turnSystem);
                     return contractSent ? turnSystem : '';
                   })(),
@@ -862,7 +908,43 @@ export function createWorkSessionTurns({
                 }
               },
             };
-            out = await runCli({
+            const invoke = async (args, retry = false) => {
+              if (run.interrupted) return '';
+              if (!captureContract) return runCli(args);
+              let releaseRetry = () => {};
+              if (retry) {
+                // The prior process no longer counts. Reserve its replacement
+                // against the SAME pool before awaiting a new local gate.
+                while (!run.interrupted) {
+                  const hold = admit('interactive');
+                  if (!hold) { releaseRetry = admit.reserve(); break; }
+                  narrator.line(hold.reason);
+                  await new Promise(resolve => setTimeout(resolve, 1_000));
+                }
+              }
+              try {
+                if (retry && !run.interrupted) coordination = await makeCoordination();
+                if (run.interrupted) return '';
+                if (!coordination) {
+                  if (!mcp.env) mcp = mcpFor(rt.id, mint.token, getMcpUrl());
+                  return await runCli({ ...args, mcpArgs: mcp.args, mcpEnv: mcp.env,
+                    onSpawn: ch => { releaseRetry(); args.onSpawn?.(ch); } });
+                }
+                const { onSpawn, onInit, ...turnArgs } = coordination.wrap({ ...args, mcpArgs: [], mcpEnv: null });
+                const result = await runCappedTurn({ runTurn: runCli, turnArgs, capMs: 15 * 60_000, workChildren,
+                  releaseSlot: () => { releaseSlot(); releaseRetry(); }, onSpawn, onInit,
+                  signal: captureSignal, killChild: coordination.kill,
+                  // This is the ongoing conversation, never a scratch consult.
+                  removeTranscript: () => {},
+                });
+                if (result.wedged && !run.interrupted) { cliFailed = true; return 'The capture turn timed out. Continue in this conversation; read list_staged before changing any proposals.'; }
+                return envScrub(result.out);
+              } finally {
+                releaseRetry();
+                await coordination?.close(run.interrupted); coordination = null;
+              }
+            };
+            out = await invoke({
               ...turnArgs,
               resume,
               resumeThreadId: codexResumeId || claudeResumeId || undefined,
@@ -913,9 +995,15 @@ export function createWorkSessionTurns({
               cliFailed = false;
               badExit = null;
               contractSent = true;
-              out = await runCli({ ...turnArgs, resume: false, system: turnSystem });
+              out = await invoke({ ...turnArgs, resume: false, system: turnSystem }, true);
             }
+            turnReturned = true;
           } finally {
+            await coordination?.close(run.interrupted);
+            control?.stop();
+            // The cap can resolve before a wedged provider closes stdout.
+            // Its live-input relay must not keep taking the next prompt.
+            if (delegated) await run.live?.stop();
             // The CLI has stopped printing, so stop relaying. The LINE itself
             // is cleared server-side at settle — clearing it here would race
             // the settle and blank the tab a beat before the reply lands.
@@ -930,15 +1018,13 @@ export function createWorkSessionTurns({
               }
             }
             if (mcp.dir) rmSync(mcp.dir, { recursive: true, force: true });
-          }
-          // Persist the codex thread id AFTER the turn ends, so the next turn
-          // resumes exactly the conversation that just spoke. Shape-guarded
-          // before it ever touches disk — it later rides in argv as
-          // `resume <id>` — and best-effort, like the runtime pin: an
-          // unwritable marker just means the tab runs fresh next turn.
-          if (rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
-            pinId(sessionMetaPath(dir.wt, RESUME_MARKERS.codex, job.sessionId), CODEX_THREAD_RE, seenThreadId);
-            recordCodexContract(contractPath, seenThreadId, turnSystem, contractSent);
+            // Keep the exact native conversation on failures too. A later
+            // capture continuation must reconcile its own staged rows, not
+            // silently start a second conversation after a provider throws.
+            if ((shape.capture || turnReturned) && rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
+              pinId(sessionMetaPath(dir.wt, RESUME_MARKERS.codex, job.sessionId), CODEX_THREAD_RE, seenThreadId);
+              recordCodexContract(contractPath, seenThreadId, turnSystem, contractSent);
+            }
           }
           /**
            * A PERSON INTERRUPTED IT. Whatever the CLI printed was cut off, so
@@ -1116,6 +1202,7 @@ export function createWorkSessionTurns({
       if (run) {
         if (!run.interrupted) note(`${c.cyan('tab')} ${c.dim('— interrupting the running turn')}`);
         run.interrupted = true;
+        run.abort.abort();
         for (const ch of run.spawned) interruptThenKill(ch);
         continue;
       }

package/bin/lib/workToolLog.mjs

@@ -84,6 +84,8 @@ export function createToolLog(cwd) {
     // past the server's limits (review, 2026-09-01).
     const e = toolEventOf(name, input, cwd, envScrub);
     if (!e) return;
+    if (typeof meta.agentId === 'string' && meta.agentId) e.agentId = scrubCut(meta.agentId, 160);
+    if (e.agentId && typeof meta.agentTitle === 'string' && meta.agentTitle) e.agentTitle = scrubCut(meta.agentTitle, 120);
     if (e.t !== 'plan') {
       if (id) { e.id = scrubCut(id, 160); correlated.set(id, e); }
       if (name === 'Read') for (const key of ['offset', 'limit']) {
@@ -106,6 +108,7 @@ export function createToolLog(cwd) {
       const last = toolLog.ev[toolLog.ev.length - 1];
       const sameKey =
         last &&
+        last.agentId === e.agentId &&
         !id && !last.id &&
         last.outcome === e.outcome &&
         last.exitCode === e.exitCode &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.13",
+  "version": "0.125.15",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {