flowviant 0.125.2 → 0.125.3

package/README.md

@@ -223,5 +223,8 @@ this package version, builds, attests and attaches the binaries and manifest.
 R2 publication remains opt-in through `PUBLISH_R2` and the `r2` environment.
 For a manual upload run `sh cli/scripts/upload-binaries.sh` from the root; it
 checks all four binaries against the manifest and publishes `latest.json` last.
-`(cd cli && npm publish)` retains the prepublish parity gate and npm shrinkwrap.
+`(cd cli && npm exec --yes --package=npm@11.17.0 -- npm publish)` retains
+the prepublish parity gate and includes the npm shrinkwrap. The publisher is
+pinned because [npm 12 removed shrinkwrap support](https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-lock-json.md#npm-shrinkwrapjson)
+and omits it from tarballs; npm 12 consumers also ignore that lockfile.
 No sibling repository or separate app deploy key is required.

package/bin/lib/hooks/orchestrator.mjs

@@ -1,22 +1,28 @@
 /** Native gate; a full pool refuses only this spawn, preserving the turn. */
 import { fileURLToPath } from 'node:url';
 import { callOrchestrator } from '../orchestratorClient.mjs';
+import { OrchestratorInputTooLarge, readOrchestratorInput } from '../orchestratorInput.mjs';
+import { runningCompiledBinary } from '../launchCommand.mjs';
 
 export async function main() {
   try {
-    let raw = ''; for await (const chunk of process.stdin) { raw += chunk; if (Buffer.byteLength(raw) > 64 * 1024) throw new Error('Hook input is too large.'); }
-    const event = JSON.parse(raw);
+    const event = await readOrchestratorInput(process.stdin);
     const result = await callOrchestrator('hook', event);
     const output = result.deny ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: result.deny } }
       : result.updatedInput || result.context ? { hookSpecificOutput: { hookEventName: event.hook_event_name,
         ...(result.updatedInput ? { permissionDecision: 'allow', updatedInput: result.updatedInput } : {}),
         ...(result.context ? { additionalContext: result.context } : {}) } } : {};
-    process.stdout.write(`${JSON.stringify(output)}\n`);
-  } catch {
+    // __hook exits as soon as main returns. A large rewritten child prompt
+    // must reach the pipe before that exit, not stop partway through JSON.
+    await new Promise((resolve, reject) => process.stdout.write(`${JSON.stringify(output)}\n`, error => error ? reject(error) : resolve()));
+  } catch (error) {
     // Both CLIs interpret exit 2 as a tool refusal. A failed capability must
     // never let a native spawn escape the shared admission pool.
-    process.stderr.write('The run’s orchestration gate is unavailable. Keep the work in the orchestrator until it reconnects.\n');
+    process.stderr.write(error instanceof OrchestratorInputTooLarge ? `${error.message}\n`
+      : 'The run’s orchestration gate is unavailable. Keep the work in the orchestrator until it reconnects.\n');
     process.exitCode = 2;
   }
 }
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main();
+// Bun bundles this module at the virtual entrypoint too. Only cli.mjs may
+// dispatch it there; otherwise importing it consumes stdin before dispatch.
+if (!runningCompiledBinary() && process.argv[1] === fileURLToPath(import.meta.url)) await main();

package/bin/lib/orchestrator.mjs

@@ -10,6 +10,7 @@ import { DAEMON_INSTANCE, FLEET_URL } from './config.mjs';
 import { runningCompiledBinary } from './launchCommand.mjs';
 import { scrubNativeText } from './runtimeEvents.mjs';
 import { scrub, learnExtraSecrets, forgetExtraSecrets } from './uplinkScrub.mjs';
+import { OrchestratorInputTooLarge, readOrchestratorInput } from './orchestratorInput.mjs';
 
 const WAIT = 'Waiting for a free slot on the machine';
 // Codex 0.160 V2 serializes the namespace without punctuation in hook
@@ -224,11 +225,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   const server = createServer(async (req, res) => {
     if (closed || req.method !== 'POST' || req.url !== '/' || !sameSecret(req.headers.authorization, `Bearer ${capability}`)) { res.writeHead(403).end(); return; }
     try {
-      let raw = ''; for await (const chunk of req) { raw += chunk; if (Buffer.byteLength(raw) > 64 * 1024) throw new Error('Orchestration input is too large.'); }
-      const { action, args } = JSON.parse(raw);
+      const { action, args } = await readOrchestratorInput(req);
       const result = await handle(action, args ?? {});
       res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }).end(JSON.stringify(result));
-    } catch (error) { res.writeHead(409, { 'Content-Type': 'application/json' }).end(JSON.stringify({ error: text(error.message, 300) })); }
+    } catch (error) { res.writeHead(error instanceof OrchestratorInputTooLarge ? 413 : 409,
+      { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }).end(JSON.stringify({
+        error: text(error.message, 300), ...(error instanceof OrchestratorInputTooLarge ? { code: error.code } : {}),
+      })); }
   });
   server.requestTimeout = 5_000;
   await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });

package/bin/lib/orchestratorClient.mjs

@@ -1,12 +1,16 @@
 import { createInterface } from 'node:readline';
 import { ORCHESTRATOR_TOOLS } from './orchestratorProtocol.mjs';
+import { ORCHESTRATOR_REQUEST_BYTES, ORCHESTRATOR_INPUT_TOO_LARGE, OrchestratorInputTooLarge } from './orchestratorInput.mjs';
 
 export async function callOrchestrator(action, args) {
   const url = new URL(process.env.FLOWVIANT_ORCHESTRATOR_URL);
   if (url.hostname !== '127.0.0.1' || url.protocol !== 'http:') throw new Error('No held run is available.');
+  const body = JSON.stringify({ action, args });
+  if (Buffer.byteLength(body) > ORCHESTRATOR_REQUEST_BYTES) throw new OrchestratorInputTooLarge();
   const response = await fetch(url, { method: 'POST', headers: { Authorization: `Bearer ${process.env.FLOWVIANT_ORCHESTRATOR_CAPABILITY}`, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ action, args }), signal: AbortSignal.timeout(15_000) });
+    body, signal: AbortSignal.timeout(15_000) });
   const result = await response.json();
+  if (result.code === ORCHESTRATOR_INPUT_TOO_LARGE) throw new OrchestratorInputTooLarge();
   if (!response.ok) throw new Error(result.error ?? 'This run is no longer held.');
   return result;
 }

package/bin/lib/orchestratorInput.mjs

@@ -0,0 +1,47 @@
+// A whole-event memory guard, aligned with the authenticated API's 24 MiB
+// request budget. It is not an allowance on a prompt or tool-result field.
+export const ORCHESTRATOR_REQUEST_BYTES = 24 * 1024 * 1024;
+export const ORCHESTRATOR_INPUT_TOO_LARGE = 'ORCHESTRATOR_INPUT_TOO_LARGE';
+
+export class OrchestratorInputTooLarge extends Error {
+  constructor() {
+    super('The orchestration hook request exceeds the 24 MiB transport limit.');
+    this.code = ORCHESTRATOR_INPUT_TOO_LARGE;
+  }
+}
+
+/** Read bounded raw bytes before decoding: pipe/HTTP chunks can split UTF-8.
+ * On refusal, drain without buffering so HTTP can still return its reason. */
+export function readOrchestratorInput(stream) {
+  return new Promise((resolve, reject) => {
+    let chunks = [], bytes = 0;
+    const cleanup = () => {
+      stream.off('data', data); stream.off('end', end);
+      stream.off('error', fail); stream.off('close', closed);
+    };
+    const fail = error => {
+      cleanup(); chunks = [];
+      // The producer can abort after seeing the refusal. That late stream
+      // error must not crash the controller while the remainder is drained.
+      const ignore = () => {};
+      stream.on('error', ignore);
+      stream.once('close', () => stream.off('error', ignore));
+      stream.resume(); reject(error);
+    };
+    const closed = () => fail(new Error('The orchestration input closed before completion.'));
+    const data = chunk => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buffer.length;
+      if (bytes > ORCHESTRATOR_REQUEST_BYTES) { fail(new OrchestratorInputTooLarge()); return; }
+      chunks.push(buffer);
+    };
+    const end = () => {
+      cleanup();
+      try { resolve(JSON.parse(Buffer.concat(chunks, bytes).toString('utf8'))); }
+      catch (error) { reject(error); }
+      chunks = [];
+    };
+    stream.on('data', data); stream.once('end', end);
+    stream.once('error', fail); stream.once('close', closed);
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.2",
+  "version": "0.125.3",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {