flowviant 0.23.0 → 0.25.0

package/bin/lib/claude.mjs

@@ -8,7 +8,7 @@ import { spawn } from 'node:child_process';
 import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { SAFE } from './config.mjs';
+import { SAFE, MODEL } from './config.mjs';
 
 // Multi-task loop (TOKEN / TOKENS modes): drain the whole queue in one session.
 export const SYSTEM_MULTI = `You are a Flowviant build agent running FULLY AUTONOMOUSLY via the "flowviant" MCP
@@ -291,6 +291,9 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn
     const args = [];
     if (resume) args.push('--continue');
     args.push('-p', prompt, '--mcp-config', mcpConfig, '--append-system-prompt', system);
+    // Pin the model — never inherit the user's global default (which may be a
+    // 1M/long-context tier their subscription can't bill autonomous work on).
+    args.push('--model', MODEL);
     if (streamJson) args.push('--output-format', 'stream-json', '--verbose');
     args.push(...PERM);
     // Force the user's Claude Code subscription — never the API. A key exported in

package/bin/lib/config.mjs

@@ -4,7 +4,15 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-export const VERSION = '0.23.0';
+export const VERSION = '0.25.0';
+
+// The model EVERY daemon Claude turn runs on — pinned so autonomous work never
+// inherits your interactive `~/.claude/settings.json` default. That matters: a
+// default of `opus[1m]` puts big prompts (wiki-gen over a whole repo, >200K
+// tokens) onto the 1M long-context premium tier, which a Max plan does NOT cover
+// — the turn dies with "usage credits required for this model". Standard `opus`
+// is fully covered. Override with FLOWVIANT_MODEL (e.g. `sonnet` for cheaper/faster).
+export const MODEL = process.env.FLOWVIANT_MODEL || 'opus';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.
@@ -25,6 +33,12 @@ function argFlag(name) {
 const API_BASE = process.env.FLOWVIANT_API_URL || 'https://api.flowviant.com/api/v2';
 export const MCP_URL = process.env.FLOWVIANT_MCP_URL || `${API_BASE}/mcp`;
 export const FLEET_URL = process.env.FLOWVIANT_FLEET_URL || `${API_BASE}/fleet/agents`;
+// Push channel: the daemon holds this WebSocket open and the server nudges it
+// the instant a job lands, so dispatch is ~a round-trip instead of a full poll.
+// Derived from FLEET_URL (…/fleet/agents → …/fleet/stream, http→ws) unless set.
+export const STREAM_URL =
+  process.env.FLOWVIANT_STREAM_URL ||
+  FLEET_URL.replace(/\/agents(\/?)$/, '/stream$1').replace(/^http/, 'ws');
 export const POLL_SECONDS = Number(process.env.POLL_SECONDS || 20);
 export const IDLE_SECONDS = Number(process.env.IDLE_SECONDS || 30);
 // Live mode: after this long idle-parked on a blocker, tear the session down to

package/bin/lib/fleet.mjs

@@ -53,6 +53,7 @@ import {
 import { runLiveWorker } from './live.mjs';
 import { reapOrphanPreviews } from './preview.mjs';
 import { preflight } from './preflight.mjs';
+import { connectStream } from './stream.mjs';
 
 async function fetchRoster(haveIds) {
   const url = new URL(FLEET_URL);
@@ -206,12 +207,20 @@ export async function runFleetDaemon() {
   let leaseTtlSeconds = 24 * 60 * 60; // updated from each roster response
   let mcpUrl = MCP_URL;
   const workers = new Map(); // agentId -> { state, promise, wt, label }
+  let daemonAlive = true; // flipped false on shutdown so the stream stops reconnecting
+  let stream = null; // push channel handle (set once the loop is set up)
 
   // Shutdown KEEPS the worktrees: in-flight local work survives Ctrl+C and
   // resumes in place on the next run (the task marker matches). Worktrees are
   // only removed when an agent is deleted from the roster, or by
   // `flowviant clean`.
   const teardown = () => {
+    daemonAlive = false;
+    try {
+      stream?.close();
+    } catch {
+      /* best-effort */
+    }
     for (const [, w] of workers) {
       w.state.alive = false;
       try {
@@ -603,6 +612,38 @@ export async function runFleetDaemon() {
   let idleBeatAt = 0; // throttle the "still alive" idle heartbeat
   let joinCount = 0; // for stable per-agent label colours
 
+  // ── Push channel: a server wake short-circuits the reconcile sleep so a job is
+  // picked up in ~a round trip instead of on the next poll. The socket only
+  // nudges — we still fetch the roster below — so it's pure latency, and the
+  // poll stays the fallback whenever the socket is down. `waitReconcile()`
+  // resolves on either a wake or the RECONCILE_SECONDS timeout, whichever first.
+  let wakeSignal = null; // { resolve, timer } while the loop is idling
+  let pendingWake = false; // a wake that landed mid-reconcile — honored next wait
+  const fireWake = () => {
+    if (wakeSignal) {
+      clearTimeout(wakeSignal.timer);
+      const { resolve } = wakeSignal;
+      wakeSignal = null;
+      resolve();
+    } else {
+      pendingWake = true; // not idling right now; don't lose the wake
+    }
+  };
+  const waitReconcile = () => {
+    if (pendingWake) {
+      pendingWake = false;
+      return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        wakeSignal = null;
+        resolve();
+      }, RECONCILE_SECONDS * 1000);
+      wakeSignal = { resolve, timer };
+    });
+  };
+  stream = connectStream({ onWake: () => fireWake(), isAlive: () => daemonAlive });
+
   // Which agents to tell the server we already hold a good token for. We keep
   // our token (omit a re-mint) UNLESS it's near expiry AND the worker is idle
   // (no child mid-turn) — then we drop it from `have` to force a fresh token,
@@ -776,6 +817,7 @@ export async function runFleetDaemon() {
       }
     }
 
-    await sleep(RECONCILE_SECONDS);
+    // Idle until the next poll deadline OR a push wake — whichever comes first.
+    await waitReconcile();
   }
 }

package/bin/lib/live.mjs

@@ -22,6 +22,7 @@ import { query } from '@anthropic-ai/claude-agent-sdk';
 import {
   MCP_URL,
   SAFE,
+  MODEL,
   POLL_SECONDS,
   IDLE_SECONDS,
   PARK_TIMEOUT_SECONDS,
@@ -419,6 +420,9 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
     options: {
       cwd,
       env,
+      // Pin the model — never inherit the user's global default (which may be a
+      // 1M/long-context tier their subscription can't bill autonomous work on).
+      model: MODEL,
       permissionMode: SAFE ? 'default' : 'bypassPermissions',
       ...(SAFE ? { allowedTools: SAFE_TOOLS } : {}),
       systemPrompt: { type: 'preset', preset: 'claude_code', append: SYSTEM_LIVE },

package/bin/lib/stream.mjs

@@ -0,0 +1,152 @@
+/**
+ * Fleet daemon push channel — the best-practice endgame for dispatch latency.
+ *
+ * Holds a hibernatable WebSocket open to the server. When a job lands (a wiki
+ * regen, a dispatch, a merge request, an @mention), the server pushes a
+ * `{type:'wake'}` frame and the daemon reconciles IMMEDIATELY — its normal
+ * roster fetch — instead of waiting out the poll. That collapses pickup latency
+ * from ≤RECONCILE_SECONDS to ~a round trip.
+ *
+ * The socket carries NO authority: it's a dumb nudge, the roster HTTP fetch is
+ * the source of truth (notify-then-reconcile, à la k8s watch). So a dropped or
+ * duplicate frame is harmless, and if the socket can't connect we reconnect with
+ * backoff while the roster poll stays the fallback the entire time.
+ *
+ * Keepalive uses an APP-LEVEL "ping"/"pong" the server answers via its socket
+ * auto-response — that proves liveness both ways WITHOUT waking the hibernated
+ * Durable Object, so an idle connection stays cheap.
+ */
+
+import WebSocket from 'ws';
+import { STREAM_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { c, info, note, warn } from './ui.mjs';
+
+const PING_MS = 30_000; // app-level ping cadence — NAT keepalive + liveness probe
+const DEAD_AFTER_MS = 75_000; // no frame at all for this long → recycle the socket
+const BACKOFF_MS = [1_000, 2_000, 5_000, 10_000, 15_000]; // reconnect backoff, capped
+const HANDSHAKE_TIMEOUT_MS = 15_000;
+
+/**
+ * Open the push channel and keep it open (auto-reconnecting) until close().
+ *
+ * @param {object}   opts
+ * @param {(reasons: string[]) => void} opts.onWake  called on each wake frame
+ * @param {() => boolean}               opts.isAlive daemon still running?
+ * @returns {{ close: () => void }}
+ */
+export function connectStream({ onWake, isAlive }) {
+  let ws = null;
+  let attempt = 0;
+  let pingTimer = null;
+  let lastRxAt = 0;
+  let closed = false;
+  let announcedDown = false; // only warn once per outage, not per retry
+
+  const clearPing = () => {
+    if (pingTimer) {
+      clearInterval(pingTimer);
+      pingTimer = null;
+    }
+  };
+
+  const scheduleReconnect = () => {
+    if (closed || !isAlive()) return;
+    const delay = BACKOFF_MS[Math.min(attempt, BACKOFF_MS.length - 1)];
+    attempt += 1;
+    setTimeout(open, delay);
+  };
+
+  const open = () => {
+    if (closed || !isAlive()) return;
+    try {
+      ws = new WebSocket(STREAM_URL, {
+        headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+        handshakeTimeout: HANDSHAKE_TIMEOUT_MS,
+      });
+    } catch (e) {
+      // Bad URL / construction failure — treat as a disconnect and back off.
+      scheduleReconnect();
+      return;
+    }
+
+    ws.on('open', () => {
+      attempt = 0;
+      lastRxAt = Date.now();
+      if (announcedDown) {
+        announcedDown = false;
+        info(c.dim('push channel reconnected — instant dispatch back on'));
+      } else {
+        note(c.dim('push channel connected — instant dispatch on'));
+      }
+      clearPing();
+      pingTimer = setInterval(() => {
+        // If we've heard nothing (not even a pong) for too long, the connection
+        // is a zombie behind NAT — force it closed so 'close' triggers a
+        // reconnect. Otherwise send the app-level ping (auto-answered server-side).
+        if (Date.now() - lastRxAt > DEAD_AFTER_MS) {
+          try {
+            ws.terminate();
+          } catch {
+            /* already gone */
+          }
+          return;
+        }
+        try {
+          ws.send('ping');
+        } catch {
+          /* send after close — 'close' handler will reconnect */
+        }
+      }, PING_MS);
+    });
+
+    ws.on('message', (data) => {
+      lastRxAt = Date.now();
+      const text = typeof data === 'string' ? data : data.toString('utf8');
+      if (text === 'pong') return; // keepalive ack
+      let msg = null;
+      try {
+        msg = JSON.parse(text);
+      } catch {
+        return; // ignore non-JSON noise
+      }
+      if (msg && msg.type === 'wake') {
+        try {
+          onWake?.(Array.isArray(msg.reasons) ? msg.reasons : []);
+        } catch {
+          /* never let a handler throw kill the socket */
+        }
+      }
+    });
+
+    ws.on('close', (code) => {
+      clearPing();
+      // 1008/4401-ish auth closes can't be fixed by retrying, but the roster
+      // poll hits the same credential and exits the daemon cleanly — so we just
+      // back off here and let that path own the shutdown. Keep it quiet.
+      if (!announcedDown && !closed && isAlive()) {
+        announcedDown = true;
+        warn(c.dim(`push channel down (${code ?? '—'}) — falling back to polling, retrying`));
+      }
+      scheduleReconnect();
+    });
+
+    ws.on('error', () => {
+      // 'error' is always followed by 'close' — do the reconnect there so we
+      // don't double-schedule. Swallow to avoid an unhandled 'error' crash.
+    });
+  };
+
+  open();
+
+  return {
+    close: () => {
+      closed = true;
+      clearPing();
+      try {
+        ws?.close();
+      } catch {
+        /* best-effort */
+      }
+    },
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {
@@ -15,7 +15,8 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.0"
+    "@anthropic-ai/claude-agent-sdk": "^0.3.0",
+    "ws": "^8.18.0"
   },
   "keywords": [
     "flowviant",