flowviant 0.125.5 → 0.125.7

package/bin/lib/workSessionTurns.mjs

@@ -16,10 +16,10 @@
  * what the turn IS, plain, plan, capture or build, with its prompt pair
  * (workTurnShape.mjs, audit 2026-10-10 F159).
  */
-import { existsSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { git } from './git.mjs';
 import { measureRepositoryBaseline } from './repositoryBaseline.mjs';
-import { REPOSITORY_BASELINE_PARAGRAPH } from './prompts.mjs';
+import { REPOSITORY_BASELINE_PARAGRAPH, tabFilesNote } from './prompts.mjs';
 import { processStartTime } from './procRegistry.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor } from './claude.mjs';
@@ -31,13 +31,15 @@ import { isTerminalSessionLive } from './claudeSessions.mjs';
 import { isAgyConversationLive } from './agySessions.mjs';
 import { adoptFence } from './localSessions.mjs';
 import { resumeRetriesFresh } from './resumeLost.mjs';
+import { CODEX_CONTRACT_MARKER, codexContractKnown, recordCodexContract } from './codexContract.mjs';
 import { turnLockedByLivePid } from './turnLock.mjs';
 import { createDeliveryReporter } from './workDelivery.mjs';
 import { createLiveMessages } from './workLiveMessages.mjs';
-import { killGroup } from './processGroup.mjs';
+import { interruptThenKill, killGroup } from './processGroup.mjs';
 import { printable } from './printable.mjs';
 import { brainFor } from './workBrain.mjs';
 import { AGY_CONV_RE, CLAUDE_SESSION_RE, CODEX_THREAD_RE, RESUME_MARKERS } from './conversationIds.mjs';
+import { pinId, readPinnedId } from './resumeMarker.mjs';
 import { sessionTurnKickoff, sessionTurnShape, sessionTurnSystem } from './workTurnShape.mjs';
 import { createToolLog } from './workToolLog.mjs';
 import { createCommandAudit } from './workCommandAudit.mjs';
@@ -75,6 +77,9 @@ export function createWorkSessionTurns({
   agyRegistryLookup,
   carryDirtyState,
   fetchAttachments,
+  // Each file landed or named as missed (workAttachments.mjs); a caller that
+  // hands only `fetchAttachments` (an older test) has its paths as landed.
+  fetchTabFiles = async (wt, attachments) => (await fetchAttachments(wt, attachments)).map((path) => ({ path })),
   makeNarrator,
   sayTurnDeferred,
   lastDeferSaid,
@@ -584,48 +589,16 @@ export function createWorkSessionTurns({
            * directory belongs to this tab alone, which is the one case it was
            * ever right for.
            */
-          let claudeResumeId = null;
-          if (rt.id === 'claude') {
-            const convMarker = sessionMetaPath(dir.wt, RESUME_MARKERS.claude, job.sessionId);
-            if (convMarker && existsSync(convMarker)) {
-              try {
-                const v = readFileSync(convMarker, 'utf8').trim();
-                if (CLAUDE_SESSION_RE.test(v)) claudeResumeId = v;
-              } catch {
-                /* unreadable marker — run fresh */
-              }
-            }
-          }
-          let codexResumeId = null;
-          if (rt.id === 'codex') {
-            const threadMarker = sessionMetaPath(dir.wt, RESUME_MARKERS.codex, job.sessionId);
-            if (threadMarker && existsSync(threadMarker)) {
-              try {
-                const v = readFileSync(threadMarker, 'utf8').trim();
-                if (CODEX_THREAD_RE.test(v)) codexResumeId = v;
-              } catch {
-                /* unreadable marker — run fresh */
-              }
-            }
-          }
+          // An unreadable or misshapen marker is unknown: run fresh (resumeMarker.mjs).
+          const claudeResumeId = rt.id === 'claude' ? readPinnedId(sessionMetaPath(dir.wt, RESUME_MARKERS.claude, job.sessionId), CLAUDE_SESSION_RE) : null;
+          const codexResumeId = rt.id === 'codex' ? readPinnedId(sessionMetaPath(dir.wt, RESUME_MARKERS.codex, job.sessionId), CODEX_THREAD_RE) : null;
           // AGY RESUMES BY CONVERSATION ID, learned once and pinned beside the
           // runtime marker: an adopted tab knows it from the adopt hint; a new
           // tab learns it from agy's own cwd registry after its first turn.
           // The marker beats `--continue` because it is the tab's OWN identity
           // — the registry maps a cwd to whatever ran there LAST, and a
           // dispatch sharing the machine could overwrite that between turns.
-          let agyConvId = null;
-          if (rt.id === 'antigravity' && !adopting) {
-            const convMarker = sessionMetaPath(dir.wt, RESUME_MARKERS.antigravity, job.sessionId);
-            if (convMarker && existsSync(convMarker)) {
-              try {
-                const v = readFileSync(convMarker, 'utf8').trim();
-                if (AGY_CONV_RE.test(v)) agyConvId = v;
-              } catch {
-                /* unreadable marker — run fresh */
-              }
-            }
-          }
+          const agyConvId = rt.id === 'antigravity' && !adopting ? readPinnedId(sessionMetaPath(dir.wt, RESUME_MARKERS.antigravity, job.sessionId), AGY_CONV_RE) : null;
           // Resume iff a conversation is known to live in THIS directory. For
           // Claude that proof is the server's sessionRef — only ever a path
           // some turn actually SPOKE from (see the settle below), and it must
@@ -685,6 +658,17 @@ export function createWorkSessionTurns({
           // refused for want of an approval, by `server.tool`.
           let codexSpoke = false;
           const approvalRefused = [];
+          // WHAT THE CLI SAID OF ITS OWN RUN (2026-10-19): a failed result or
+          // error event, or an exit that was not a clean one. A usage limit, a
+          // signed-out CLI or a crash printed its words and settled as the
+          // tab's REPLY; they settle as the failure they are now, in the same
+          // words. Reset for the fresh retry, which is its own run.
+          let cliFailed = false;
+          let badExit = null;
+          // A Codex tab's contract and whether this turn sent it (codexContract.mjs).
+          const contractPath = rt.id === 'codex' ? sessionMetaPath(dir.wt, CODEX_CONTRACT_MARKER, job.sessionId) : null;
+          let turnSystem = '';
+          let contractSent = true;
           const spawned = []; // this turn's children, for the teardown registry
           // THE TURN'S TOOL LOG — see workToolLog.mjs for its shape rules.
           const turnLog = createToolLog(dir.wt);
@@ -706,22 +690,16 @@ export function createWorkSessionTurns({
             // Files first, then the message that references them: the agent
             // must be able to open what it is being told about. Only the ones
             // that actually landed are named.
-            const files = await fetchAttachments(dir.wt, job.attachments);
-            const filesNote = files.length
-              ? `[FILES THE HUMAN ATTACHED TO THIS MESSAGE — already on disk in this worktree]\n${files
-                  .map((f) => `- ${f}`)
-                  .join('\n')}`
-              : '';
+            const filesNote = tabFilesNote(await fetchTabFiles(dir.wt, job.attachments));
             const message = [job.body, filesNote, adoptNote, carryNote]
               .filter(Boolean)
               .join('\n\n');
             const turnArgs = {
-              ...(rt.id === 'claude' ? { liveMessages: (run.live = makeLiveMessages({
+              ...(shape.liveInput ? { liveMessages: (run.live = makeLiveMessages({
                 scope: 'session', turnId: job.id, attempt: job.attempt, cwd: dir.wt, sessionMetaPath,
                 interrupted: () => run.interrupted,
                 format: async (followup) => {
-                  const paths = await fetchAttachments(dir.wt, followup.attachments);
-                  const note = paths.length ? `[FILES THE HUMAN ATTACHED TO THIS MESSAGE — already on disk in this worktree]\n${paths.map((f) => `- ${f}`).join('\n')}` : '';
+                  const note = tabFilesNote(await fetchTabFiles(dir.wt, followup.attachments));
                   const words = shape.capture ? (followup.libraryPrompt ?? '') + followup.body : followup.body + (followup.libraryPrompt ?? '');
                   return sessionTurnKickoff(shape, { sessionId: job.sessionId, sessionName: job.sessionName,
                     askedByName: followup.askedByName, message: [words, note].filter(Boolean).join('\n\n') });
@@ -759,11 +737,18 @@ export function createWorkSessionTurns({
                   // artifacts paragraph, the planning sentence appended). The
                   // artifacts paragraph also waits on the server — ARTIFACTS
                   // (0.94.0): only while it can show one, read here at spawn.
-                  system: sessionTurnSystem(shape, {
-                    knowledgeDir,
-                    artifactsAccepted: getArtifactsAccepted(),
-                    runtime: rt.id,
-                  }) + (toolLog.baseline ? '\n\n' + REPOSITORY_BASELINE_PARAGRAPH(toolLog.baseline) : '') + (artifactScan?.instructions ? `\n\n${artifactScan.instructions}` : ''),
+                  // …and a Codex thread that already holds it is sent none
+                  // (codexContract.mjs); `turnSystem` keeps the text for a
+                  // fresh retry and the marker.
+                  system: (() => {
+                    turnSystem = sessionTurnSystem(shape, {
+                      knowledgeDir,
+                      artifactsAccepted: getArtifactsAccepted(),
+                      runtime: rt.id,
+                    }) + (toolLog.baseline ? '\n\n' + REPOSITORY_BASELINE_PARAGRAPH(toolLog.baseline) : '') + (artifactScan?.instructions ? `\n\n${artifactScan.instructions}` : '');
+                    contractSent = !codexContractKnown(contractPath, codexResumeId, turnSystem);
+                    return contractSent ? turnSystem : '';
+                  })(),
                   // The directory is OUTSIDE a worktree's cwd; Claude Code is
                   // told it may read there (`--add-dir`) rather than left to
                   // refuse a read-only capture turn a path it was just handed.
@@ -805,6 +790,15 @@ export function createWorkSessionTurns({
               onModel: (m) => {
                 model = m;
               },
+              // The CLI's own context measure, live while the turn runs
+              // (claudeInput.mjs); the server clears it at settle.
+              onContext: (ctx) => narrator.context(ctx),
+              onCliFailure: () => {
+                cliFailed = true;
+              },
+              onExit: (code, signal) => {
+                badExit = signal || (code ? `exit ${code}` : null);
+              },
               // What this CLI says it can be asked for by name, and which of
               // its connectors need a sign-in, are harvested off this init by
               // runTurn itself (`initHarvestFor`, runtimeCapabilities.mjs) —
@@ -815,10 +809,7 @@ export function createWorkSessionTurns({
                 // same conversation and recover its native message UUIDs.
                 if (typeof i.sessionId === 'string' && i.sessionId.trim()) {
                   seenClaudeSession = i.sessionId.trim();
-                  if (CLAUDE_SESSION_RE.test(seenClaudeSession)) {
-                    const marker = sessionMetaPath(dir.wt, RESUME_MARKERS.claude, job.sessionId);
-                    if (marker) try { writeFileSync(marker, seenClaudeSession); } catch { /* best effort */ }
-                  }
+                  if (CLAUDE_SESSION_RE.test(seenClaudeSession)) pinId(sessionMetaPath(dir.wt, RESUME_MARKERS.claude, job.sessionId), CLAUDE_SESSION_RE, seenClaudeSession);
                 }
               },
               cwd: dir.wt,
@@ -838,7 +829,7 @@ export function createWorkSessionTurns({
               },
               onSpawn: (ch) => {
                 if (!ch) return;
-                if (rt.id !== 'claude') reportDelivery('session', job, 'taken');
+                if (!shape.liveInput) reportDelivery('session', job, 'taken');
                 spawned.push(ch);
                 run.spawned.push(ch);
                 // Asked to stop between the check and the spawn.
@@ -905,9 +896,19 @@ export function createWorkSessionTurns({
              */
             if (
               !adopting &&
-              resumeRetriesFresh({ resume, out, runtime: rt.id, sawInit: Boolean(seenClaudeSession) })
+              resumeRetriesFresh({
+                resume,
+                out,
+                runtime: rt.id,
+                // The CLI's own word that it found the conversation: Claude's
+                // init, Codex's `thread.started` naming the pinned thread.
+                sawInit: rt.id === 'codex' ? Boolean(codexResumeId && seenThreadId === codexResumeId) : Boolean(seenClaudeSession),
+              })
             ) {
-              out = await runCli({ ...turnArgs, resume: false });
+              cliFailed = false;
+              badExit = null;
+              contractSent = true;
+              out = await runCli({ ...turnArgs, resume: false, system: turnSystem });
             }
           } finally {
             // The CLI has stopped printing, so stop relaying. The LINE itself
@@ -931,14 +932,8 @@ export function createWorkSessionTurns({
           // `resume <id>` — and best-effort, like the runtime pin: an
           // unwritable marker just means the tab runs fresh next turn.
           if (rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
-            const threadMarker = sessionMetaPath(dir.wt, RESUME_MARKERS.codex, job.sessionId);
-            if (threadMarker) {
-              try {
-                writeFileSync(threadMarker, seenThreadId);
-              } catch {
-                /* best-effort */
-              }
-            }
+            pinId(sessionMetaPath(dir.wt, RESUME_MARKERS.codex, job.sessionId), CODEX_THREAD_RE, seenThreadId);
+            recordCodexContract(contractPath, seenThreadId, turnSystem, contractSent);
           }
           /**
            * A PERSON INTERRUPTED IT. Whatever the CLI printed was cut off, so
@@ -984,16 +979,8 @@ export function createWorkSessionTurns({
           // the registry is never trusted again.
           if (rt.id === 'antigravity' && answer.length > 0) {
             const convMarker = sessionMetaPath(dir.wt, RESUME_MARKERS.antigravity, job.sessionId);
-            if (convMarker && !existsSync(convMarker)) {
-              const learned = adopting ? job.adopt.id : agyRegistryLookup(dir.wt);
-              if (learned && AGY_CONV_RE.test(learned)) {
-                try {
-                  writeFileSync(convMarker, learned);
-                } catch {
-                  /* best-effort — an unpinned tab resumes via --continue's cwd key */
-                }
-              }
-            }
+            // Best-effort — an unpinned tab resumes via --continue's cwd key.
+            if (convMarker && !existsSync(convMarker)) pinId(convMarker, AGY_CONV_RE, adopting ? job.adopt.id : agyRegistryLookup(dir.wt));
           }
           /**
            * NO WORDS, SAID AS MEASURED (2026-09-29). Claude's init event means
@@ -1025,7 +1012,7 @@ export function createWorkSessionTurns({
               artifactFailure = `Artifact delivery is incomplete: ${error.message}`;
             }
           }
-          const spoke = answer.length > 0 && !loginFailure;
+          const spoke = answer.length > 0 && !loginFailure && !cliFailed && !badExit;
           await settleTurn(job.id, {
               ...attempt,
             ok: spoke && !artifactFailure,
@@ -1048,6 +1035,7 @@ export function createWorkSessionTurns({
           });
           if (spoke) ok(`${c.cyan('tab')} ${c.dim('— replied in the session')}`);
           else if (loginFailure) warn('codex answered 401 for this session turn — settled as failed, in words');
+          else if (answer && (cliFailed || badExit)) warn(`the CLI reported its turn failed${badExit ? ` (${badExit})` : ''} — settled as failed, in its words`);
           else warn('session turn produced no output — settled as failed');
         } catch (e) {
           if (toolLog) toolLog.state = 'partial';
@@ -1123,7 +1111,7 @@ export function createWorkSessionTurns({
       if (run) {
         if (!run.interrupted) note(`${c.cyan('tab')} ${c.dim('— interrupting the running turn')}`);
         run.interrupted = true;
-        for (const ch of run.spawned) killGroup(ch);
+        for (const ch of run.spawned) interruptThenKill(ch);
         continue;
       }
       if (pendingWorkReports.has(id) || settledRecently(id) || notRunningSaid.has(id)) continue;

package/bin/lib/workShip.mjs

@@ -1,11 +1,12 @@
 /** Session branch shipping and settlement. */
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { git, baseBranchName, isSafePathSegment, sessionBranch, stripUrlUserinfo } from './git.mjs';
+import { git, baseBranchName, isSafePathSegment, sessionBranch } from './git.mjs';
 import { mergeOutward as shipMergeOutward } from './shipMerge.mjs';
 import { gitMergeIn } from './gitMergeIdentity.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
+import { relayedText } from './prWorkflow.mjs';
 import { REPO_PLACE } from './workPlaces.mjs';
 import { placeTurnLockHolder } from './turnLock.mjs';
 import { printable } from './printable.mjs';
@@ -272,15 +273,10 @@ export function createWorkShipper({
                     'conflicts with main — the tab is closed, so open a new session from this branch to resolve them, then ship again',
                 });
               } else {
-                // Userinfo stripped as well as scrubbed (2026-10-10, F153): the
-                // outward merge pushes to `origin`, and a push names the remote.
-                const line = envScrub(
-                  stripUrlUserinfo(
-                    String(detail)
-                      .split('\n')
-                      .find((l) => l.trim()) ?? 'git merge failed'
-                  )
-                );
+                // Userinfo stripped as well as scrubbed (2026-10-10, F153), by
+                // relayedText: the outward merge pushes to `origin`, and a push
+                // names the remote.
+                const line = relayedText(String(detail).split('\n').find((l) => l.trim()) ?? 'git merge failed');
                 await done({ ok: false, error: `the merge failed: ${line.slice(0, 300)}` });
               }
               return;
@@ -331,13 +327,7 @@ export function createWorkShipper({
             } else {
               // An honest error beats a fabricated conflict — the human can
               // only fix what they are told about.
-              const line = envScrub(
-                stripUrlUserinfo(
-                  String(detail)
-                    .split('\n')
-                    .find((l) => l.trim()) ?? 'git merge failed'
-                )
-              );
+              const line = relayedText(String(detail).split('\n').find((l) => l.trim()) ?? 'git merge failed');
               await done({ ok: false, error: `the merge failed: ${line.slice(0, 300)}` });
             }
             return;
@@ -368,7 +358,7 @@ export function createWorkShipper({
           warn(`ship failed: ${e?.message ?? e}`);
           await done({
             ok: false,
-            error: envScrub(stripUrlUserinfo(e?.message ?? 'the merge failed')).slice(0, 500),
+            error: relayedText(e?.message ?? 'the merge failed').slice(0, 500),
           });
         } finally {
           if (!settled && !deferred) {

package/bin/lib/workTurnShape.mjs

@@ -15,8 +15,8 @@ import { discoveryGuide } from './discoveryContract.mjs';
  * other answer off it; the prompt pair is composed here too.
  *
  * The runtime facts come off the row (runtime{Claude,Codex,Antigravity}.mjs):
- * `tab` ('plain' runs no MCP), `planTurns` (the CLI can spell plan mode) and
- * `adopt` ('fork' | 'move' | null). The LIFECYCLE stays the lane's — its
+ * `tab` ('plain' runs no MCP), `planTurns` (the CLI can spell plan mode),
+ * `adopt` ('fork' | 'move' | null) and `liveInput` (follow-ups on stdin). The LIFECYCLE stays the lane's — its
  * refusal order is the contract — and only this composition moved.
  */
 import { runtimeById } from './runtimes.mjs';
@@ -55,7 +55,7 @@ export const PLAN_TURN_SENTENCE =
  * verdict that this first turn adopts a terminal session.
  *
  * Returns `{ refusal?, plain, plan, capture, kickoff, systemBase,
- * planSentence, artifacts, profile, mountMcp, display }`:
+ * planSentence, artifacts, profile, mountMcp, display, liveInput }`:
  *   refusal      — the sentence the turn settles in, unrun, when it has one;
  *   kickoff /
  *   systemBase   — which contract the prompt pair runs: 'plain' | 'capture' | 'work';
@@ -65,7 +65,8 @@ export const PLAN_TURN_SENTENCE =
  *                  one, as the lane reads it at spawn);
  *   profile      — the permission profile: 'build' | 'plan' | 'plan-mode';
  *   mountMcp     — the session's MCP config is mounted;
- *   display      — the CLI keeps its environment's display.
+ *   display      — the CLI keeps its environment's display;
+ *   liveInput    — follow-ups reach the running CLI on stdin.
  */
 export function sessionTurnShape({ runtime, adopting = false, job = null }) {
   const row = runtimeById(runtime);
@@ -137,6 +138,7 @@ export function sessionTurnShape({ runtime, adopting = false, job = null }) {
     // only reads and stages cards, and the person talking to it may be on a
     // phone (noWindowEnv.mjs).
     display: !isCapture,
+    liveInput: row?.liveInput === true,
   };
 }
 

package/bin/lib/worktreeDiff.mjs

@@ -191,14 +191,38 @@ function branchCommits(wt, base) {
         .split('\n')
         .filter(Boolean)
     );
+    // EVERY COMMIT ON THE BRANCH, NOT ONLY THE CARDED ONES (2026-10-19). A
+    // Terminal tab's prompt says a commit for no named card needs no trailer,
+    // so its own commits were never reported and the rail said "N commits
+    // ahead" with none of them listed or openable. One more exec names the
+    // rest — sha, author, date and the folded subject, NUL-separated (git
+    // allows a NUL in none of them) and one per line (`%s` folds its
+    // newlines), keyed by sha from the rev-list set with the first line
+    // winning, the same membership rule the trailered read keeps. No body and
+    // no numstat: the rail lists a commit by its subject, and its patch is the
+    // commit-diff job's.
+    const listed = new Map();
+    for (const line of git(['log', '--no-merges', '-n', String(MAX_COMMITS), '--format=%H%x00%an%x00%aI%x00%s', `${base}..HEAD`], wt).split('\n')) {
+      const [sha, author, at, subject] = line.split('\0');
+      if (real.includes(sha) && !listed.has(sha)) listed.set(sha, { author, at, subject });
+    }
     for (const sha of real) {
-      if (!named.has(sha)) continue;
       // A commit we cannot stat (a numstat past the pipe's buffer) still names
       // its cards — send it with zero counts rather than drop it, as before.
-      const rec = commitRecord(sha, wt, { numstat: true }) ?? commitRecord(sha, wt);
-      if (!rec) continue;
-      const taskIds = taskIdsFromMessage(stripDelims(rec.body));
-      if (taskIds.length === 0) continue;
+      const rec = named.has(sha) ? commitRecord(sha, wt, { numstat: true }) ?? commitRecord(sha, wt) : null;
+      const taskIds = rec ? taskIdsFromMessage(stripDelims(rec.body)) : [];
+      if (taskIds.length === 0) {
+        const row = listed.get(sha);
+        if (!row) continue;
+        out.push({
+          sha: sha.slice(0, 64),
+          subject: stripDelims(row.subject).slice(0, 200),
+          author: stripDelims(row.author).slice(0, 80),
+          at: stripDelims(row.at).slice(0, 40),
+          taskIds: [],
+        });
+        continue;
+      }
       out.push({
         // Clamped to the server's zod caps, same rule as everything else in
         // this file: one over-cap string 400s the whole batch.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.5",
+  "version": "0.125.7",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {