flowviant 0.125.22 → 0.125.24

package/bin/lib/workAgentTurnExecution.mjs

@@ -31,6 +31,8 @@ import { finishRepositoryDelivery, allResolutionsCommitted } from './repositoryD
 import { MODEL, PROJECT_ID } from './config.mjs';
 import { setRuntimeLimit } from './daemonState.mjs';
 import { gitOrNull } from './git.mjs';
+import { assertWorktree } from './worktreeHealth.mjs';
+import { placeTurnLockedByLivePid, recordTurnLock } from './turnLock.mjs';
 import { turnCommits } from './turnReceipts.mjs';
 import { addUsage } from './turnUsage.mjs';
 import { stashCard, stashGaps } from './agentCards.mjs';
@@ -67,6 +69,7 @@ import { codexSubagentsSafe } from './runtimeCodex.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
 import { createIntermediateArtifacts } from './intermediateArtifacts.mjs';
 import { createUiReview } from './uiReview.mjs';
+import { createVideoRender } from './videoRender.mjs';
 import { withUiReview, appendUiReviewEvidence } from './uiReviewTurn.mjs';
 
 export function createAgentTurnExecution({
@@ -98,6 +101,7 @@ export function createAgentTurnExecution({
   runTurnImpl = runTurn,
   exportModel,
   makeUiReview = createUiReview,
+  makeVideoRender = createVideoRender,
 }) {
   const reportDelivery = createDeliveryReporter();
   /** How long the final flush may hold the settle. Bounded because the settle
@@ -146,6 +150,10 @@ export function createAgentTurnExecution({
       return;
     }
     const wt = dir.wt;
+    const worktreeRepo = repositoryRun?.sources.find(r => r.wt === wt)?.repoRoot ?? repoRoot;
+    assertWorktree(wt, worktreeRepo);
+    const turnLock = sessionMetaPath(wt, 'flowviant-turn.lock', place);
+    if (placeTurnLockedByLivePid(sessionMetaPath(wt, 'flowviant-turn.lock'))) return;
     /**
      * NEITHER OF THESE MAY THROW. `git()` throws on a non-zero exit, and both
      * of these exit non-zero in states a real worktree reaches: `symbolic-ref`
@@ -404,9 +412,18 @@ export function createAgentTurnExecution({
     let uiReview = null;
     let uiReviewNote = '';
     let uiReviewEvidence = '';
+    // A video card's render tool (videoRender.mjs), and the words a turn
+    // gets when it could not be held, so it stops rather than guesses.
+    let videoRender = null;
+    let videoNote = '';
     const runCli = (args) => {
       if (run.interrupted) return Promise.resolve('');
+      // Preparation awaits external work; remeasure before each fresh or
+      // resumed spawn, before replacing Codex's own repository discovery.
+      assertWorktree(wt, worktreeRepo);
+      args.verifiedWorktree = true;
       args = withUiReview(args, uiReviewNote, uiReview?.env);
+      args = withUiReview(args, videoNote);
       return runTurnImpl(args);
     };
     /**
@@ -468,6 +485,10 @@ export function createAgentTurnExecution({
           uiReviewEvidence = uiReviewNote;
         }
       }
+      if (taskKind === 'video') {
+        try { videoRender = await makeVideoRender({ wt, signal: setupController.signal }); }
+        catch (error) { videoNote = `The card_video render tool could not be started on this machine: ${envScrub(error.message)}. Without it no GIF, MP4 or WebM can be rendered: say so in your answer and stop.`; }
+      }
       if (orchestrating) {
         orchestrator = await createOrchestrator({ turnId, runtime: rt, trace, admit,
           assignmentContext: () => agentChildScope(job),
@@ -478,7 +499,7 @@ export function createAgentTurnExecution({
           notify: message => liveInput ? run.live?.inject(message) === true : false,
           taken: id => run.live?.onTaken(id) });
       }
-      const tools = prepareCardTools({ rt, posture, wt, repoRoot, baseRef, sources: repositoryRun?.sources ?? [], repositoryTool: repositoryRun?.tool ?? null, orchestratorConfig: orchestrator?.config ?? null, uiReviewConfig: uiReview?.config, orchestrated: Boolean(orchestrator), codexHome: agentResume.codexHome });
+      const tools = prepareCardTools({ rt, posture, wt, repoRoot, baseRef, sources: repositoryRun?.sources ?? [], repositoryTool: repositoryRun?.tool ?? null, orchestratorConfig: orchestrator?.config ?? null, uiReviewConfig: uiReview?.config, videoConfig: videoRender?.config ?? null, orchestrated: Boolean(orchestrator), codexHome: agentResume.codexHome });
       projectTools = tools.projectTools;
       localCleanup?.begin(turnId);
       const { toolsNote } = tools;
@@ -656,6 +677,10 @@ export function createAgentTurnExecution({
         // (runTurn.mjs, `initHarvestFor`). An agent-only box learns from the
         // startup probe and its Terminal tabs.
         onSpawn: (ch) => {
+          let releaseTurnLock;
+          try { releaseTurnLock = recordTurnLock(turnLock, ch.pid); }
+          catch (error) { killGroup(ch); throw error; }
+          ch.once('close', releaseTurnLock);
           if (orchestrator && rt === 'codex') run.live?.connect((id, body) => orchestrator.input(id, body));
           if (rt !== 'claude') reportDelivery('agent', job, 'taken');
           brief?.running(true);
@@ -733,6 +758,7 @@ export function createAgentTurnExecution({
       // The builder has finished its fix/recheck loop. Close only resources
       // owned by its review tool, then bind evidence to the final source
       // before the existing artifact upload and delivery settlement.
+      try { await videoRender?.close(); } catch { /* a closed listener */ }
       try { await uiReview?.close(); }
       finally {
         try { uiReviewEvidence = uiReview?.finalize() ?? uiReviewEvidence; }

package/bin/lib/workPlaces.mjs

@@ -13,9 +13,10 @@
  * so a lane that learns a place cannot store one unvalidated.
  */
 import { readRepositoryPlace } from './repositoryPlaces.mjs';
-import { existsSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { git, isSafePathSegment, hasCommits, gitFailure, sessionBranch } from './git.mjs';
+import { assertWorktree } from './worktreeHealth.mjs';
 
 /** The place id meaning "the checkout", not a worktree. Must match the
  *  server's REPO_PLACE — it is a wire value, not a local convention. The
@@ -213,6 +214,7 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
    * same way adoption resolves a cwd, and for the same reason.
    */
   const placeWtFor = (placeId, baseAt) => {
+    placeWtFor.lastError = null;
     if (placeId === REPO_PLACE) {
       // The checkout. `fresh: false` on purpose — nothing was opened, so no
       // caller may treat this as a newly-cut branch.
@@ -220,7 +222,14 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
     }
     const wt = worktreePath(baseDir, placeId);
     if (!wt) return null;
-    const fresh = !existsSync(wt);
+    let fresh;
+    try {
+      fresh = !existsSync(wt) || readdirSync(wt).length === 0;
+      if (!fresh) assertWorktree(wt, repoRoot);
+    } catch (error) {
+      placeWtFor.lastError = error.message;
+      return null;
+    }
     if (fresh) {
       const branch = sessionBranch(placeId);
       // `baseAt` is the adoption override: a tab born from a terminal session
@@ -276,6 +285,8 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
       // always did (runTurn.mjs spawns with `{...process.env}`), so anything
       // exported in the shell the daemon was started from is present here.
     }
+    try { assertWorktree(wt, repoRoot); }
+    catch (error) { placeWtFor.lastError = error.message; return null; }
     return { wt, fresh };
   };
 

package/bin/lib/workRetire.mjs

@@ -12,6 +12,7 @@ import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { git, isSafePathSegment } from './git.mjs';
 import { PERSON_PLACE_PREFIX } from './workPlaces.mjs';
+import { placeTurnLockedByLivePid } from './turnLock.mjs';
 
 export function createWorkRetire({
   repositoryPlaces,
@@ -24,6 +25,7 @@ export function createWorkRetire({
   workTokens,
   agentChildren,
   sweepMergedSessionBranch,
+  sessionMetaPath,
 }) {
   /**
    * Retire the worktrees of sessions the server says are CLOSED.
@@ -111,6 +113,8 @@ export function createWorkRetire({
       if (placeLocks.has(placeOf(id)) || shipping.has(id)) continue; // still draining here
       const wt = join(dir, id);
       try {
+        const places = repositoryPlaces?.stateFor(id) ? repositoryPlaces.entries(id).filter(r => r.writable).map(r => r.wt) : [wt];
+        if (places.some(path => placeTurnLockedByLivePid(sessionMetaPath?.(path, 'flowviant-turn.lock')))) continue;
         // Uncommitted work is the human's — a resource sweep does not outrank
         // it, closed tab or not. (The non-force remove would refuse anyway;
         // the explicit check keeps the intent legible.)
@@ -179,6 +183,7 @@ export function createWorkRetire({
       if (placeLocks.has(place)) continue;
       const wt = join(baseDir, 'sessions', place);
       try {
+        if (placeTurnLockedByLivePid(sessionMetaPath?.(wt, 'flowviant-turn.lock'))) continue;
         if (git(['status', '--porcelain'], wt).trim() !== '') continue;
         git(['merge', '--ff-only', baseRef()], wt);
       } catch {

package/bin/lib/worktreeDiff.mjs

@@ -13,6 +13,17 @@
  * uncommitted work in the same total. Untracked files count too: git calls them
  * nothing until they are added, and a human calls them new work.
  *
+ * …AND THAT WHOLE SPLIT IN TWO (2026-10-25). The agent page's Changes counts
+ * the branch's COMMITS, so beside the whole it read as a disagreement: "Native
+ * 3D viewer" said +78 −12 in Changes and +114 −15 on the branch row (a running
+ * card's commit on top), and "New task submission" said "Nothing committed
+ * yet" beside +613 −294 of work nobody had committed. `committed` is
+ * `<merge-base>..HEAD` — the figure Changes agrees with — and `uncommitted` is
+ * HEAD against the working tree, untracked files again counted as additions,
+ * with its own rows so the page can list it apart. The halves need not sum to
+ * the whole: a line a commit changed and the working tree changed back counts
+ * in both and in neither, which is git's arithmetic, relayed.
+ *
  * It also carries THIS BRANCH'S OWN COMMITS and the cards they name — see
  * `branchCommits` below. That rides here rather than on a route of its own
  * because this sweep is already standing in the right directory on the right
@@ -252,16 +263,104 @@ function countLines(buf) {
   return s.endsWith('\n') ? n - 1 : n;
 }
 
+/** One diffstat row. The path is clamped to the server's zod cap (file path ≤
+ *  300 — see the caps at worktreeDiff's return): one over-cap string would 400
+ *  the whole report batch, and a readout must degrade to a shorter label, never
+ *  to silence. Null for an empty path, which names nothing. */
+function fileRow(path, added, deleted, binary = false) {
+  if (!path) return null;
+  path = path.slice(0, 300);
+  return binary ? { path, added, deleted, binary } : { path, added, deleted };
+}
+
+/**
+ * `git diff --numstat -z <revs…> --`, read as rows — the one reader of that
+ * output, for the whole and both halves alike. Throws when git does.
+ *
+ * `-z`, for the reason gitRaw exists: git's LINE-based output C-quotes any path
+ * that is not plain ASCII, so an accented filename arrives as "n\303\251w.txt"
+ * — a string that is not the path and reads as escaped garbage in the rail.
+ * And `--numstat -z` frames a normal change as one field, "added\tdeleted\tpath",
+ * but a RENAME as three: "added\tdeleted\t" (empty path), then the old path,
+ * then the new one. An empty path is therefore the rename marker and the next
+ * two fields belong to it — read line-wise, a rename would report a file
+ * literally named "old => new".
+ */
+function numstatRows(revs, wt) {
+  const rows = [];
+  const fields = splitNul(gitRaw(['diff', '--numstat', '-z', ...revs, '--'], wt));
+  for (let i = 0; i < fields.length; i++) {
+    const [a, d, ...rest] = fields[i].split('\t');
+    let path = rest.join('\t');
+    if (!path) {
+      path = fields[i + 2] ?? fields[i + 1]; // the post-rename name is what exists now
+      i += 2;
+      if (!path) continue;
+    }
+    const binary = a === '-' || d === '-';
+    const row = fileRow(path, binary ? 0 : Number(a) || 0, binary ? 0 : Number(d) || 0, binary);
+    if (row) rows.push(row);
+  }
+  return rows;
+}
+
+/** The same rows, or NULL when git would not answer — kept apart from an
+ *  empty diff, so a failed read omits its half rather than reporting zeros. */
+function numstatOrNull(revs, wt) {
+  try {
+    return numstatRows(revs, wt);
+  } catch {
+    return null;
+  }
+}
+
+/** A diffstat summed from its rows: totals and `fileCount` over ALL of them,
+ *  and the biggest MAX_FILES as the rows reported, `truncated` saying how many
+ *  were left out. */
+function diffstat(rows) {
+  // Biggest first: with a 20-row cap, the rows that survive should be the ones
+  // worth looking at. Ties break by path so the list doesn't shuffle per sweep.
+  const files = [...rows].sort(
+    (x, y) => y.added + y.deleted - (x.added + x.deleted) || (x.path < y.path ? -1 : 1)
+  );
+  let additions = 0;
+  let deletions = 0;
+  for (const f of files) {
+    additions += f.added;
+    deletions += f.deleted;
+  }
+  return {
+    additions,
+    deletions,
+    fileCount: files.length,
+    truncated: Math.max(0, files.length - MAX_FILES),
+    files: files.slice(0, MAX_FILES),
+  };
+}
+
 /**
  * @param {string} wt   the worktree directory
  * @param {string} baseRef  the project's base ref (e.g. `origin/main`)
- * @returns {null | {branch:string, path:string, ahead:number, behind:number,
- *   baseLabel:string, baseCommits:{sha:string, subject:string, author:string}[],
+ * @returns {null | {branch:string, headSha?:string, path:string, ahead:number,
+ *   behind:number, baseLabel:string,
+ *   baseCommits:{sha:string, subject:string, author:string}[],
  *   dirty:boolean, additions:number, deletions:number, fileCount:number,
  *   truncated:number,
  *   files:{path:string, added:number, deleted:number, binary?:boolean}[],
+ *   committed?:{additions:number, deletions:number, fileCount:number},
+ *   uncommitted?:{additions:number, deletions:number, fileCount:number,
+ *     truncated:number,
+ *     files:{path:string, added:number, deleted:number, binary?:boolean}[]},
  *   commits:{sha:string, subject:string, author:string, at:string,
  *     additions:number, deletions:number, taskIds:string[]}[]}}
+ *
+ * The top-level additions/deletions/fileCount/truncated/files are the WHOLE
+ * (merge-base against the working tree, untracked included) — what the tab
+ * rails read. `committed` (`<merge-base>..HEAD`) and `uncommitted` (HEAD
+ * against the working tree, untracked included, with its own rows) split it
+ * for the agent page, which agrees with the first and lists the second apart.
+ * `committed` is absent without a merge-base; either half is absent when its
+ * git read failed — unknown, never a fabricated zero.
  */
 export function worktreeDiff(wt, baseRef) {
   if (!wt || !existsSync(wt)) return null;
@@ -289,52 +388,24 @@ export function worktreeDiff(wt, baseRef) {
        HEAD below, which still reports the uncommitted half honestly */
   }
 
-  const files = [];
-  let additions = 0;
-  let deletions = 0;
-  const push = (path, added, deleted, binary = false) => {
-    if (!path) return;
-    // Clamped to the server's zod cap (file path ≤ 300 — see the caps at the
-    // return, below): one over-cap string would 400 the whole report batch,
-    // and a readout must degrade to a shorter label, never to silence.
-    path = path.slice(0, 300);
-    files.push(binary ? { path, added, deleted, binary } : { path, added, deleted });
-    additions += added;
-    deletions += deleted;
-  };
-
   // Tracked: working tree vs base. `git diff <base>` (no --cached, no second
-  // ref) is exactly "everything this session did", committed or not. `-z`, for
-  // the reason gitRaw exists: git's LINE-based output C-quotes any path that
-  // is not plain ASCII, so an accented filename arrives as "n\303\251w.txt" —
-  // a string that is not the path and reads as escaped garbage in the rail.
-  try {
-    // `--numstat -z` frames a normal change as one field, "added\tdeleted\tpath",
-    // but a RENAME as three: "added\tdeleted\t" (empty path), then the old path,
-    // then the new one. An empty path is therefore the rename marker and the
-    // next two fields belong to it — read line-wise, a rename would report a
-    // file literally named "old => new".
-    const fields = splitNul(gitRaw(['diff', '--numstat', '-z', base || 'HEAD', '--'], wt));
-    for (let i = 0; i < fields.length; i++) {
-      const [a, d, ...rest] = fields[i].split('\t');
-      let path = rest.join('\t');
-      if (!path) {
-        path = fields[i + 2] ?? fields[i + 1]; // the post-rename name is what exists now
-        i += 2;
-        if (!path) continue;
-      }
-      const binary = a === '-' || d === '-';
-      push(path, binary ? 0 : Number(a) || 0, binary ? 0 : Number(d) || 0, binary);
-    }
-  } catch {
-    /* report what we have */
-  }
+  // ref) is exactly "everything this session did", committed or not. Without a
+  // merge-base it is HEAD, which is the uncommitted half alone — kept as rows
+  // OR NULL, so that half can reuse this read below without mistaking a failed
+  // one for a clean tree.
+  const trackedRows = numstatOrNull([base || 'HEAD'], wt);
 
   // Untracked, minus everything gitignored — new files are the most visible
   // work a session does and they would otherwise show as nothing at all. `-z`
   // here is not cosmetic: a C-quoted untracked name fails the statSync below,
   // and the catch swallowed the row — a session's brand-new `café.txt` simply
-  // vanished from the rail.
+  // vanished from the rail. Scanned ONCE: these rows belong to the whole and to
+  // the uncommitted half alike, and the scan opens files.
+  const untracked = [];
+  const pushUntracked = (path, added, binary = false) => {
+    const row = fileRow(path, added, 0, binary);
+    if (row) untracked.push(row);
+  };
   try {
     const others = splitNul(gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], wt));
     for (const path of others.slice(0, MAX_UNTRACKED_SCAN)) {
@@ -343,12 +414,12 @@ export function worktreeDiff(wt, baseRef) {
         const st = statSync(full);
         if (!st.isFile()) continue;
         if (st.size > MAX_COUNT_BYTES) {
-          push(path, 0, 0, true);
+          pushUntracked(path, 0, true);
           continue;
         }
         const lines = countLines(readFileSync(full));
-        if (lines === null) push(path, 0, 0, true);
-        else push(path, lines, 0);
+        if (lines === null) pushUntracked(path, 0, true);
+        else pushUntracked(path, lines);
       } catch {
         /* vanished between listing and reading — it wasn't there to report */
       }
@@ -357,6 +428,37 @@ export function worktreeDiff(wt, baseRef) {
     /* report what we have */
   }
 
+  const whole = diffstat([...(trackedRows ?? []), ...untracked]);
+
+  // THE WHOLE, SPLIT IN TWO — see the header. Each half is its own git read
+  // and each degrades alone: a half git would not answer is OMITTED, because
+  // a zero there would claim a clean side nobody measured.
+  //
+  // Committed: `git diff <merge-base> HEAD`, only with a merge-base. Without
+  // one there is no "this branch's commits" to count, and the fallback above
+  // already diffed HEAD, which is the other half.
+  let committed = null;
+  if (base) {
+    const rows = numstatOrNull([base, 'HEAD'], wt);
+    if (rows) {
+      const { additions, deletions, fileCount } = diffstat(rows);
+      committed = { additions, deletions, fileCount };
+    }
+  }
+  // Uncommitted: `git diff HEAD` plus the untracked rows. An UNBORN HEAD has
+  // no commit, so everything there is uncommitted and the half is the whole —
+  // `git diff HEAD` fails on it, and that failure must not drop the half
+  // (defensive today: the branch read above already returns null on an unborn
+  // HEAD). With no merge-base the whole's tracked read already WAS `git diff
+  // HEAD`, so it is reused rather than run twice.
+  let uncommitted = null;
+  if (!headSha) {
+    uncommitted = { ...whole };
+  } else {
+    const rows = base ? numstatOrNull(['HEAD'], wt) : trackedRows;
+    if (rows) uncommitted = diffstat([...rows, ...untracked]);
+  }
+
   let ahead = 0;
   try {
     if (base) ahead = Number(git(['rev-list', '--count', `${base}..HEAD`], wt)) || 0;
@@ -403,11 +505,6 @@ export function worktreeDiff(wt, baseRef) {
     /* leave at false */
   }
 
-  // Biggest first: with a 20-row cap, the rows that survive should be the ones
-  // worth looking at. Ties break by path so the list doesn't shuffle per sweep.
-  files.sort(
-    (x, y) => y.added + y.deleted - (x.added + x.deleted) || (x.path < y.path ? -1 : 1)
-  );
   // Every string here is clamped to the server's own zod caps (branch ≤ 200,
   // baseLabel ≤ 120, subject ≤ 200, author ≤ 80, file path ≤ 300): the report
   // rides in a BATCH, so a single over-cap string — a generated branch name, a
@@ -421,11 +518,13 @@ export function worktreeDiff(wt, baseRef) {
     baseLabel: String(baseRef).replace(/^origin\//, '').slice(0, 120),
     baseCommits,
     dirty,
-    additions,
-    deletions,
-    fileCount: files.length,
-    truncated: Math.max(0, files.length - MAX_FILES),
-    files: files.slice(0, MAX_FILES),
+    additions: whole.additions,
+    deletions: whole.deletions,
+    fileCount: whole.fileCount,
+    truncated: whole.truncated,
+    files: whole.files,
+    ...(committed ? { committed } : {}),
+    ...(uncommitted ? { uncommitted } : {}),
     commits: branchCommits(wt, base),
   };
 }

package/bin/lib/worktreeHealth.mjs

@@ -0,0 +1,23 @@
+/** Verify the directory itself, rather than a parent git happened to discover. */
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { git } from './git.mjs';
+
+export function assertWorktree(wt, repoRoot) {
+  try {
+    const top = realpathSync(git(['rev-parse', '--show-toplevel'], wt));
+    if (top !== realpathSync(wt)) throw new Error('the directory is not a git worktree root');
+    const common = (dir) => realpathSync(resolve(dir, git(['rev-parse', '--git-common-dir'], dir)));
+    if (common(wt) !== common(repoRoot)) throw new Error('the worktree belongs to another repository');
+    const registered = git(['worktree', 'list', '--porcelain', '-z'], repoRoot).split('\0')
+      .some(line => {
+        if (!line.startsWith('worktree ')) return false;
+        try { return realpathSync(line.slice(9)) === top; } catch { return false; }
+      });
+    if (!registered) throw new Error('the worktree is not registered with this repository');
+    git(['rev-parse', '--verify', 'HEAD'], wt);
+  } catch (error) {
+    const why = error.stderr?.toString().trim() || error.message;
+    throw new Error(`The worktree at ${wt} is unavailable: ${why}`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.22",
+  "version": "0.125.24",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {