flowviant 0.125.26 → 0.125.27

package/README.md

@@ -328,6 +328,15 @@ pinned because [npm 12 removed shrinkwrap support](https://github.com/npm/cli/bl
 and omits it from tarballs; npm 12 consumers also ignore that lockfile.
 No sibling repository or separate app deploy key is required.
 
+### Artifact cleanup and retry recovery (0.125.27)
+
+Iteration declarations accept the shared agent retention bound for removals
+and replacements and a full inventory of nested file names. Oversized counts
+report their count separately from malformed paths. An acknowledged turn id
+cannot be started again by a stale roster response, leaving the actual retry
+free to run and stream under its own id. Publication checks the actual pinned
+npm 11 publisher before uploading so npm 12 cannot omit the shrinkwrap again.
+
 ### UI review evidence retention (0.125.26)
 
 Review reports and screenshots stay attached to their run without filling the
@@ -336,9 +345,10 @@ evidence. Identical captures within one review share a file and retain their
 scenario, viewport, phase and hash references. Producer receipts use the shared
 agent storage limit and report cumulative overflow before upload.
 
-0.125.26 includes the npm dependency shrinkwrap with the pinned npm 11
-publisher. The earlier 0.125.25 npm package contains the same runtime fix but
-was published by npm 12 without that lockfile.
+The 0.125.25 and 0.125.26 npm packages contain the runtime fix but omit the
+dependency shrinkwrap. The pinned npm 11 dry-run includes that lockfile;
+use the pinned publisher command above for future releases. All four
+standalone 0.125.26 downloads were verified against their SHA-256 manifest.
 
 ### Agent worktree startup and restart protection (0.125.24)
 

package/bin/lib/artifactIteration.mjs

@@ -5,8 +5,12 @@ import { join, dirname, resolve, sep } from 'node:path';
 import { createHash } from 'node:crypto';
 import { flowviantParentState, realDirState } from './ownedDirs.mjs';
 import { ARTIFACT_DIR, artifactStoredName, walkArtifactDir } from './artifacts.mjs';
+import { ARTIFACT_MAX_PER_AGENT } from './artifactPolicy.mjs';
 
 const MANIFEST = '.iteration.json';
+// An agent can retain 400 files. The former 32 KiB read bound silently
+// ignored valid declarations for a full inventory of nested file names.
+const MANIFEST_MAX_BYTES = 1024 * 1024;
 const safeName = (name) => typeof name === 'string' && name.length <= 500 &&
   name.split('/').every((p) => p && p !== '.' && p !== '..' && !p.startsWith('.') && !p.includes('\\'));
 
@@ -16,7 +20,7 @@ const manifestText = (placeDir) => {
   try {
     fd = openSync(join(placeDir, ARTIFACT_DIR, MANIFEST), constants.O_RDONLY | constants.O_NOFOLLOW);
     const st = fstatSync(fd);
-    if (!st.isFile() || st.size > 32 * 1024) return null;
+    if (!st.isFile() || st.size > MANIFEST_MAX_BYTES) return null;
     return { text: readFileSync(fd, 'utf8'), stamp: `${st.size}:${st.mtimeMs}` };
   } catch { return null; }
   finally { if (fd !== undefined) closeSync(fd); }
@@ -50,8 +54,12 @@ export function iterationChanges(placeDir, before) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Artifact iteration declaration must be an object.');
   const remove = value.remove ?? [];
   const replace = value.replace ?? {};
-  if (!Array.isArray(remove) || remove.length > 40 || !remove.every(safeName) ||
-      !replace || typeof replace !== 'object' || Array.isArray(replace) || Object.keys(replace).length > 40 ||
+  if (Array.isArray(remove) && remove.length > ARTIFACT_MAX_PER_AGENT)
+    throw new Error(`Artifact iteration has ${remove.length} removal names; the declaration supports at most ${ARTIFACT_MAX_PER_AGENT}. Narrow the removal set before retrying.`);
+  if (replace && typeof replace === 'object' && !Array.isArray(replace) && Object.keys(replace).length > ARTIFACT_MAX_PER_AGENT)
+    throw new Error(`Artifact iteration has ${Object.keys(replace).length} replacement names; the declaration supports at most ${ARTIFACT_MAX_PER_AGENT}. Narrow the replacement set before retrying.`);
+  if (!Array.isArray(remove) || !remove.every(safeName) ||
+      !replace || typeof replace !== 'object' || Array.isArray(replace) ||
       !Object.entries(replace).every(([from, to]) => safeName(from) && safeName(to) && from !== to)) {
     throw new Error('Artifact iteration needs remove names and explicit old-to-new replacement names.');
   }

package/bin/lib/workAgentTurnReports.mjs

@@ -55,6 +55,11 @@ export function createAgentTurnReports({ REJECT_RETRY_MS, baseDir = null }) {
   const persistRecovery = () => journal?.save(new Map(agentReported), new Map()); // turnId -> { body, at }
   const agentRejectedUntil = new Map(); // turnId -> earliest re-POST of a refused body
   const AGENT_REPORT_GRACE_MS = 30 * 60_000;
+  // A roster read can race the settle's acknowledgement. Forgetting the
+  // completed id with its outbox body let that stale offer run a second CLI
+  // under an already answered turn, hiding its output from the real retry.
+  // These ids are not pending reports and must not keep the machine busy.
+  const settledAt = new Map();
 
   /** Returns the server's reply, because it carries ONE instruction the machine
    *  can act on immediately: `review: true` means the agent's queue just
@@ -81,6 +86,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS, baseDir = null }) {
        * re-POST backs off instead of hammering a body the server just refused.
        */
       if (res.ok && (body.mergeResolved === undefined || typeof j?.data?.settled === 'boolean')) {
+        settledAt.set(turnId, Date.now());
         agentReported.delete(turnId);
         agentRejectedUntil.delete(turnId);
         persistRecovery();
@@ -165,9 +171,12 @@ export function createAgentTurnReports({ REJECT_RETRY_MS, baseDir = null }) {
    * the grace only covers its POST racing a final offer.
    */
   const pruneHeldReports = (list) => {
-    if (!agentReported.size) return;
     const offered = new Set(list.map((j) => String(j?.id || '')));
     const now = Date.now();
+    for (const [id, at] of settledAt) {
+      if (offered.has(id)) settledAt.set(id, now);
+      else if (now - at > AGENT_REPORT_GRACE_MS) settledAt.delete(id);
+    }
     for (const [id, held] of agentReported) {
       if (offered.has(id)) held.at = now;
       else if (now - held.at > AGENT_REPORT_GRACE_MS) {
@@ -187,5 +196,6 @@ export function createAgentTurnReports({ REJECT_RETRY_MS, baseDir = null }) {
     pruneHeldReports,
     agentReported,
     agentRejectedUntil,
+    hasSettledTurn: id => settledAt.has(id),
   };
 }

package/bin/lib/workAgentTurns.mjs

@@ -73,6 +73,7 @@ export function createWorkAgentTurns({
     pruneHeldReports,
     agentReported,
     agentRejectedUntil,
+    hasSettledTurn,
   } = createAgentTurnReports({ REJECT_RETRY_MS, baseDir });
 
   // ── AGENT TURNS: one task per prompt ───────────────────────────────────────
@@ -300,6 +301,7 @@ export function createWorkAgentTurns({
     for (const job of list.slice(0, 4)) {
       const id = String(job?.id || '');
       if (!id) continue;
+      if (hasSettledTurn(id)) continue;
       if (agentTurns.has(id)) {
         const reason = agentRuns.get(id)?.waitingReason;
         if (reason) reportDelivery('agent', job, 'queued', reason);

package/npm-shrinkwrap.json

@@ -0,0 +1,69 @@
+{
+  "name": "flowviant",
+  "version": "0.125.27",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "flowviant",
+      "version": "0.125.27",
+      "license": "MIT",
+      "dependencies": {
+        "libsodium-wrappers-sumo": "^0.8.4",
+        "ws": "^8.18.0"
+      },
+      "bin": {
+        "flowviant": "bin/cli.mjs"
+      },
+      "devDependencies": {
+        "three": "0.180.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/libsodium-sumo": {
+      "version": "0.8.4",
+      "resolved": "https://registry.npmjs.org/libsodium-sumo/-/libsodium-sumo-0.8.4.tgz",
+      "integrity": "sha512-TMtHShQfVVsaxDygyapvUC3o7YsPgXa/hRWeIgzyFz6w5k/1hirGptCxp1U7XwW3rCskaTTYKgV10v86UiGgNw==",
+      "license": "ISC"
+    },
+    "node_modules/libsodium-wrappers-sumo": {
+      "version": "0.8.4",
+      "resolved": "https://registry.npmjs.org/libsodium-wrappers-sumo/-/libsodium-wrappers-sumo-0.8.4.tgz",
+      "integrity": "sha512-ql7hcgulKZ3ekfa2DGAogcCKsWU0diA/0nArz1CFzh93WQdb46/Kj18ka/Hifq6uA3Ush34Pc6vU/6HXeRwUkg==",
+      "license": "ISC",
+      "dependencies": {
+        "libsodium-sumo": "^0.8.0"
+      }
+    },
+    "node_modules/three": {
+      "version": "0.180.0",
+      "resolved": "https://registry.npmjs.org/three/-/three-0.180.0.tgz",
+      "integrity": "sha512-o+qycAMZrh+TsE01GqWUxUIKR1AL0S8pq7zDkYOQw8GqfX8b8VoCKYUoHbhiX5j+7hr8XsuHDVU6+gkQJQKg9w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/ws": {
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.26",
+  "version": "0.125.27",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "test": "node --test bin/lib/*.test.mjs",
-    "prepublishOnly": "bun scripts/check-app-parity.mjs"
+    "prepublishOnly": "node scripts/check-publisher.mjs && bun scripts/check-app-parity.mjs"
   },
   "dependencies": {
     "libsodium-wrappers-sumo": "^0.8.4",