flowviant 0.27.0 → 0.28.0

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-export const VERSION = '0.27.0';
+export const VERSION = '0.28.0';
 
 // The model EVERY daemon Claude turn runs on — pinned so autonomous work never
 // inherits your interactive `~/.claude/settings.json` default. That matters: a

package/bin/lib/deploy.mjs

@@ -0,0 +1,252 @@
+/**
+ * Cloudflare DevOps — the daemon runs the user's own `wrangler`. Broker-not-
+ * host: no cloud credential ever reaches Flowviant. A deploy-authorized daemon
+ * claims deploy jobs off the roster, runs build → push prod secrets → deploy →
+ * verify, and reports the outcome. It also reports its parsed
+ * .flowviant/deploy.json so the app can list targets, and (basic) observes
+ * out-of-band deployments.
+ *
+ * Every log line that leaves the machine passes through the env scrubber —
+ * wrangler output routinely echoes secrets.
+ */
+
+import { readFileSync, existsSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { c, note, ok, warn } from './ui.mjs';
+import { deployCreds, appSecretsFor, scrub, myPubB64 } from './env.mjs';
+
+const deployUrl = (tail) => FLEET_URL.replace(/\/agents\/?$/, `/${tail}`);
+
+async function post(tail, body) {
+  const res = await fetch(deployUrl(tail), {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${FLEET_TOKEN}`,
+      'User-Agent': USER_AGENT,
+      'Content-Type': 'application/json',
+    },
+    signal: AbortSignal.timeout(30_000),
+    body: JSON.stringify(body),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok || json?.success === false) {
+    throw new Error(`${tail} failed (${res.status}${json?.error ? `: ${json.error}` : ''})`);
+  }
+  return json?.data;
+}
+
+/** Read + parse .flowviant/deploy.json from the repo root. Returns [] if none. */
+export function readDeployConfig(repoRoot) {
+  const path = join(repoRoot, '.flowviant', 'deploy.json');
+  if (!existsSync(path)) return [];
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    const targets = Array.isArray(parsed?.targets) ? parsed.targets : [];
+    // Keep only fields the server + runner need; the daemon holds the commands.
+    return targets
+      .filter((t) => t && typeof t.id === 'string' && typeof t.command === 'string')
+      .slice(0, 20);
+  } catch (e) {
+    warn(`deploy: .flowviant/deploy.json is not valid JSON — ${e.message}`);
+    return [];
+  }
+}
+
+/** Report the parsed config to the server (only when it changed). */
+let lastConfigJson = null;
+export async function reportDeployConfig(repoRoot) {
+  const targets = readDeployConfig(repoRoot);
+  const json = JSON.stringify(targets);
+  if (json === lastConfigJson) return;
+  // Strip commands/secrets before the server sees the config (metadata only).
+  const meta = targets.map((t) => ({
+    id: t.id,
+    label: t.label,
+    provider: t.provider || 'cloudflare',
+    command: t.command,
+    build: t.build,
+    commands: t.commands,
+    healthcheck: t.healthcheck,
+    healthStatus: t.healthStatus,
+    pushSecrets: t.pushSecrets,
+  }));
+  try {
+    await post('deploy-config', { pubkey: myPubB64(), targets: meta });
+    lastConfigJson = json;
+  } catch (e) {
+    warn(`deploy: could not report config — ${e.message}`);
+  }
+}
+
+/** Run a shell command ASYNC (never blocks the daemon's event loop — the
+ *  reconcile poll + the deploy heartbeat must keep firing during a long
+ *  deploy). Captures combined + scrubbed output; resolves {ok,out,code}. */
+function run(command, { cwd, env, input }) {
+  return new Promise((resolve) => {
+    const child = spawn(command, { cwd, env, shell: true, stdio: ['pipe', 'pipe', 'pipe'] });
+    let buf = '';
+    const cap = (d) => {
+      buf += d.toString();
+      if (buf.length > 512 * 1024) buf = buf.slice(-512 * 1024); // bound memory
+    };
+    child.stdout.on('data', cap);
+    child.stderr.on('data', cap);
+    const timer = setTimeout(() => {
+      try {
+        child.kill('SIGKILL');
+      } catch {
+        /* already gone */
+      }
+    }, 30 * 60_000);
+    if (input != null) {
+      try {
+        child.stdin.write(input);
+        child.stdin.end();
+      } catch {
+        /* stdin closed */
+      }
+    } else {
+      child.stdin.end();
+    }
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      resolve({ ok: code === 0, code: code ?? -1, out: scrub(buf) });
+    });
+    child.on('error', (e) => {
+      clearTimeout(timer);
+      resolve({ ok: false, code: -1, out: scrub(`${buf}\n${e.message}`) });
+    });
+  });
+}
+
+const tailLines = (s, n = 40) => s.split('\n').filter(Boolean).slice(-n);
+
+/** Health-check a deployed target: GET the URL, expect `status`. Retries a few
+ *  times for propagation lag. */
+async function verifyHealth(url, status) {
+  for (let i = 0; i < 4; i++) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(10_000), redirect: 'manual' });
+      if (res.status === status) return true;
+    } catch {
+      /* not up yet */
+    }
+    await new Promise((r) => setTimeout(r, 3000));
+  }
+  return false;
+}
+
+const claiming = new Set(); // in-flight guard (single-flight per daemon process)
+
+/**
+ * Process queued deploy jobs from the roster. `ctx` = { repoRoot, baseRef,
+ * myPubB64 }. Each job: claim → build → push prod secrets → deploy → verify →
+ * report. Runs concurrently but one-per-jobId.
+ */
+export function processDeployJobs(jobs, ctx) {
+  if (!Array.isArray(jobs) || !jobs.length) return;
+  for (const job of jobs) {
+    if (claiming.has(job.id)) continue;
+    claiming.add(job.id);
+    void (async () => {
+      let beat = null;
+      try {
+        const claimed = await post('deploy-claim', { jobId: job.id, pubkey: ctx.myPubB64() }).catch(() => null);
+        if (!claimed?.claimed) return; // another daemon won the claim
+        // Keep the claim fresh while we run — a long deploy must never be
+        // re-queued out from under us (that would double-deploy). The async
+        // run() below keeps the event loop free so this fires.
+        beat = setInterval(() => {
+          void post('deploy-heartbeat', { jobId: job.id, pubkey: ctx.myPubB64() }).catch(() => {});
+        }, 60_000);
+        const targets = readDeployConfig(ctx.repoRoot);
+        const target = targets.find((t) => t.id === job.targetId);
+        if (!target) {
+          await report(job, ctx, { ok: false, message: `target "${job.targetId}" not in .flowviant/deploy.json` });
+          return;
+        }
+        note(`${c.cyan('deploy')} ${c.dim(`— ${job.kind} ${job.targetId} → ${job.env}…`)}`);
+        const outcome = await runDeploy(job, target, ctx);
+        await report(job, ctx, outcome);
+        if (outcome.ok) ok(`${c.cyan('deploy')} ${c.dim(`— ${job.targetId} → ${job.env} done${outcome.healthOk === false ? ' (health failed)' : ''}`)}`);
+        else warn(`deploy: ${job.targetId} → ${job.env} failed — ${outcome.message}`);
+      } catch (e) {
+        warn(`deploy job ${job.id} errored: ${e.message}`);
+        await report(job, ctx, { ok: false, message: e.message }).catch(() => {});
+      } finally {
+        if (beat) clearInterval(beat);
+        claiming.delete(job.id);
+      }
+    })();
+  }
+}
+
+async function runDeploy(job, target, ctx) {
+  const env = { ...process.env, ...deployCreds() }; // inject infra creds; never a file
+  const logs = [];
+  // Rollback is a single wrangler command; deploy is build → secrets → deploy.
+  if (job.kind === 'rollback') {
+    const cmd = target.commands?.[`rollback:${job.env}`] || `npx wrangler rollback`;
+    const r = await run(cmd, { cwd: ctx.repoRoot, env });
+    logs.push(...tailLines(r.out));
+    return { ok: r.ok, message: r.ok ? 'rolled back' : logs.slice(-6).join('\n'), logs };
+  }
+
+  if (target.build) {
+    const b = await run(target.build, { cwd: ctx.repoRoot, env });
+    logs.push(...tailLines(b.out));
+    if (!b.ok) return { ok: false, message: `build failed:\n${logs.slice(-6).join('\n')}`, logs };
+  }
+
+  // Push prod app secrets to the provider's secret store (never written local).
+  // `name` is always a validated vault key (alnum/underscore) or skipped, and
+  // the VALUE goes only via stdin — never argv (no prod plaintext in ps).
+  if (job.env === 'prod' && Array.isArray(target.pushSecrets) && target.pushSecrets.length) {
+    const secrets = appSecretsFor('prod');
+    for (const name of target.pushSecrets) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || !(name in secrets)) {
+        warn(`deploy: pushSecret "${name}" invalid or not in the vault at prod scope — skipping`);
+        continue;
+      }
+      const putCmd = target.commands?.['secretPut']
+        ? target.commands['secretPut'].replace('{name}', name)
+        : `npx wrangler secret put ${name} --env production`;
+      const s = await run(putCmd, { cwd: ctx.repoRoot, env, input: secrets[name] });
+      if (!s.ok) return { ok: false, message: `pushing secret ${name} failed`, logs };
+    }
+  }
+
+  const cmd = target.commands?.[job.env] || target.command;
+  const d = await run(cmd, { cwd: ctx.repoRoot, env });
+  logs.push(...tailLines(d.out));
+  if (!d.ok) return { ok: false, message: `deploy failed:\n${logs.slice(-8).join('\n')}`, logs };
+
+  // Extract the wrangler version/deployment id if present.
+  const idMatch = d.out.match(/Current Version ID:\s*([0-9a-f-]+)/i);
+  const deploymentId = idMatch ? idMatch[1] : null;
+
+  let healthOk = null;
+  if (target.healthcheck) {
+    healthOk = await verifyHealth(target.healthcheck, target.healthStatus ?? 200);
+  }
+  return {
+    ok: true,
+    healthOk,
+    deploymentId,
+    message: healthOk === false ? 'deployed, but health check failed' : 'deployed',
+    logs,
+  };
+}
+
+function report(job, ctx, outcome) {
+  return post('deploy-report', {
+    jobId: job.id,
+    pubkey: ctx.myPubB64(),
+    ok: !!outcome.ok,
+    deploymentId: outcome.deploymentId ?? null,
+    healthOk: outcome.healthOk ?? null,
+    message: scrub(outcome.message || ''),
+  }).catch((e) => warn(`deploy: could not report outcome — ${e.message}`));
+}

package/bin/lib/env.mjs

@@ -64,18 +64,27 @@ export async function sodiumReady() {
 /** 6-emoji key fingerprint — algorithm MUST match the web's pubkeyEmoji
  *  (EnvironmentSettings.tsx) so the human can compare terminal ↔ approve card. */
 // MUST stay byte-identical to the web's pubkeyEmoji (EnvironmentSettings.tsx) —
-// the human compares the two. 32 glyphs × 8 positions ≈ 40 bits; each position
-// mixes the whole key so no byte is mute (a compromised-server pubkey swap must
-// grind a full collision, not just the tail).
-const FP_EMOJI = ['🦊','🐙','🦕','🐝','🦉','🐬','🦁','🐸','🦄','🐢','🦋','🐺','🦜','🐳','🦔','🐌','🦩','🐿️','🦥','🐨','🦦','🐇','🦡','🐝','🦨','🐜','🦢','🐋','🦭','🐞','🦚','🐊'];
+// the human compares the two strings. 32 glyphs × 8 positions, effective ~40
+// bits. Two FNV-1a rolling hashes over the whole key + a murmur3 finalizer per
+// glyph (a plain additive sum collapsed the space to ~10 bits — grindable).
+const FP_EMOJI = ['🦊','🐙','🦕','🐝','🦉','🐬','🦁','🐸','🦄','🐢','🦋','🐺','🦜','🐳','🦔','🐌','🦩','🐿️','🦥','🐨','🦦','🐇','🦡','🦂','🦨','🐜','🦢','🐋','🦭','🐞','🦚','🐊'];
 export function pubkeyEmoji(pubkeyB64) {
+  let h1 = 0x811c9dc5 >>> 0;
+  let h2 = 0xc2b2ae35 >>> 0;
+  for (let i = 0; i < pubkeyB64.length; i++) {
+    const ch = pubkeyB64.charCodeAt(i);
+    h1 = Math.imul(h1 ^ ch, 0x01000193) >>> 0;
+    h2 = Math.imul(h2 ^ ch, 0x85ebca6b) >>> 0;
+  }
   let out = '';
   for (let i = 0; i < 8; i++) {
-    let acc = i + 1;
-    for (let j = 0; j < pubkeyB64.length; j++) {
-      acc = (acc * 31 + pubkeyB64.charCodeAt(j) * (i + 2)) % 1_000_003;
-    }
-    out += FP_EMOJI[acc % FP_EMOJI.length];
+    let x = (((i < 4 ? h1 : h2) + i * 0x9e3779b1) >>> 0);
+    x ^= x >>> 16;
+    x = Math.imul(x, 0x7feb352d) >>> 0;
+    x ^= x >>> 15;
+    x = Math.imul(x, 0x846ca68b) >>> 0;
+    x ^= x >>> 16;
+    out += FP_EMOJI[x & 31];
   }
   return out;
 }
@@ -186,13 +195,15 @@ function readCache(projectId) {
   }
 }
 
-/** Offline start: materialize from the encrypted cache before the first poll. */
+/** Offline start: materialize from the encrypted cache before the first poll.
+ *  Also seeds knownTargetFiles so stale-file cleanup survives a restart. */
 export async function loadCachedEnv(projectId) {
   await ensureKeypair();
   const cached = readCache(projectId);
   if (!cached) return false;
   values = cached.values ?? [];
   bundleVersion = cached.bundleVersion ?? -1;
+  knownTargetFiles = new Set(cached.knownFiles ?? values.map((v) => v.targetFile));
   cachedProjectId = projectId;
   return values.length > 0;
 }
@@ -253,9 +264,16 @@ function isTrackedInGit(wt, relPath) {
   }
 }
 
-// Per-worktree: the target files we last materialized, so a file that lost all
-// its keys (or a key that moved files) gets its stale copy removed.
+// Per-worktree: the target files we last materialized THIS SESSION.
 const lastFilesByWorktree = new Map();
+// Project-global union of every target file we've ever materialized — PERSISTED
+// in the cache and seeded on load, so a file whose key was deleted while the
+// daemon was down still gets its stale plaintext copy cleaned on the next
+// materialize (lastFilesByWorktree alone is empty after a restart, and
+// `git clean -fd` never removes an info/exclude'd file).
+let knownTargetFiles = new Set();
+
+const MATERIALIZE_HEADER = '# Materialized by flowviant env sync';
 
 /** Render KEY=value with values that contain newlines/= safely quoted so one
  *  value can't fabricate another key line. */
@@ -266,14 +284,47 @@ function renderEnvFile(list) {
     const esc = v.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '');
     return `${v.name}="${esc}"`;
   });
-  return `# Materialized by flowviant env sync — DO NOT COMMIT.\n${lines.join('\n')}\n`;
+  return `${MATERIALIZE_HEADER} — DO NOT COMMIT.\n${lines.join('\n')}\n`;
 }
 
-/** Write the decrypted env into ONE worktree. Never call on the wiki worktree. */
+/** Delete a materialized file from a worktree, but ONLY if it's ours (carries
+ *  our header) and not git-tracked — never touch a file we didn't write. */
+function removeStaleEnvFile(wt, rel) {
+  if (isTrackedInGit(wt, rel)) return;
+  const abs = join(wt, rel);
+  try {
+    if (existsSync(abs) && readFileSync(abs, 'utf8').startsWith(MATERIALIZE_HEADER)) {
+      rmSync(abs, { force: true });
+    }
+  } catch {
+    /* best-effort */
+  }
+}
+
+/** Deploy-scope credentials (e.g. CLOUDFLARE_API_TOKEN) as a NAME→value map —
+ *  injected into the deploy command's process env, NEVER written to a file. */
+export function deployCreds() {
+  const out = {};
+  for (const v of values) if (v.scope === 'deploy' && v.value) out[v.name] = v.value;
+  return out;
+}
+
+/** app-scope secrets for one environment as a NAME→value map — for pushing to
+ *  the provider's secret store on a prod deploy (`wrangler secret put`). */
+export function appSecretsFor(env) {
+  const out = {};
+  for (const v of values) if (v.scope === 'app' && v.env === env && v.value) out[v.name] = v.value;
+  return out;
+}
+
+/** Write the decrypted env into ONE worktree. Never call on the wiki worktree.
+ *  v1 materializes the 'dev' app env (agent test runs + local preview); prod
+ *  app secrets go to the provider at deploy, deploy creds are injected only. */
 export function materializeInto(wt) {
   if (!wt || !existsSync(wt)) return;
   const byFile = new Map();
   for (const v of values) {
+    if (v.scope !== 'app' || v.env !== 'dev') continue; // only local dev secrets hit a worktree file
     if (!isSafeTarget(v.targetFile)) continue;
     const list = byFile.get(v.targetFile) ?? [];
     list.push(v);
@@ -305,18 +356,15 @@ export function materializeInto(wt) {
     }
   }
 
-  // Remove files we materialized last time that have no keys now (all deleted,
-  // or every key moved elsewhere) — a stale secret file must not linger.
-  const prevFiles = lastFilesByWorktree.get(wt) ?? [];
-  for (const stale of prevFiles) {
-    if (!written.includes(stale) && !isTrackedInGit(wt, stale)) {
-      try {
-        rmSync(join(wt, stale), { force: true });
-      } catch {
-        /* best-effort */
-      }
-    }
+  // Remove any file we ever materialized (this session OR a prior one, via the
+  // persisted knownTargetFiles) that has no keys now — a deleted secret's
+  // plaintext file must not linger, even across a daemon restart.
+  const writtenSet = new Set(written);
+  const candidates = new Set([...(lastFilesByWorktree.get(wt) ?? []), ...knownTargetFiles]);
+  for (const stale of candidates) {
+    if (!writtenSet.has(stale)) removeStaleEnvFile(wt, stale);
   }
+  for (const f of written) knownTargetFiles.add(f);
   lastFilesByWorktree.set(wt, written);
   if (written.length) excludeInWorktree(wt, written);
 }
@@ -359,7 +407,18 @@ export async function handleRosterEnv(env, { projectId } = {}) {
     // wedge registration until restart.
     if (env.status === 'none' && !registeredOnce) {
       const label = hostname() || 'daemon';
-      await post('register', { pubkey: myPubB64(), label });
+      try {
+        await post('register', { pubkey: myPubB64(), label });
+      } catch (e) {
+        // A 429 = the project is at its machine cap; retrying every poll would
+        // just hammer it. Stop for this session (a restart re-tries).
+        if (/\(429/.test(e.message)) {
+          registeredOnce = true;
+          warn('env: this project is at its machine limit — env access not requested. Ask an admin to remove an old machine.');
+          return { changed: false };
+        }
+        throw e; // transient — retry next poll (registeredOnce still false)
+      }
       registeredOnce = true;
       const fp = pubkeyEmoji(myPubB64());
       info(`${c.cyan('env')}    · this machine requested env access as ${c.bold(label)}`);
@@ -405,7 +464,7 @@ export async function handleRosterEnv(env, { projectId } = {}) {
     for (const k of bundle.keys) {
       try {
         const plain = openSealed(k.ciphertext, projectPub, projectPriv);
-        opened.push({ name: k.name, env: k.env, targetFile: k.targetFile, value: sodium.to_string(plain), version: k.version });
+        opened.push({ name: k.name, env: k.env, scope: k.scope ?? 'app', targetFile: k.targetFile, value: sodium.to_string(plain), version: k.version });
       } catch {
         allOpened = false;
         warn(`env: could not open ${k.name} (epoch ${k.keyEpoch}) — skipping; a rotation should heal it`);
@@ -443,7 +502,10 @@ export async function handleRosterEnv(env, { projectId } = {}) {
     if (needSync) {
       values = opened;
       bundleVersion = bundle.bundleVersion;
-      if (cachedProjectId) writeCache(cachedProjectId, { values, bundleVersion });
+      // Fold the current target files into the persisted known set so stale
+      // cleanup survives a restart (a key deleted while down still gets swept).
+      for (const v of values) knownTargetFiles.add(v.targetFile);
+      if (cachedProjectId) writeCache(cachedProjectId, { values, bundleVersion, knownFiles: [...knownTargetFiles] });
       ok(`${c.cyan('env')} ${c.dim(`— synced ${values.length} secret${values.length === 1 ? '' : 's'} (env v${bundleVersion})`)}`);
       return { changed: true };
     }

package/bin/lib/fleet.mjs

@@ -59,8 +59,10 @@ import {
   envQueryParams,
   handleRosterEnv,
   materializeInto,
+  myPubB64,
   scrub as envScrub,
 } from './env.mjs';
+import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 
 async function fetchRoster(haveIds) {
   const url = new URL(FLEET_URL);
@@ -905,6 +907,14 @@ export async function runFleetDaemon() {
       }
     });
 
+    // Deploy: a deploy-authorized daemon reports its .flowviant/deploy.json and
+    // runs queued deploy jobs (the server only sends deployJobs to authorized
+    // machines). Config report is cheap + dedup'd; jobs are single-flight.
+    if (roster.env?.deployAuthorized) {
+      void reportDeployConfig(repoRoot);
+      processDeployJobs(roster.deployJobs, { repoRoot, baseRef, myPubB64 });
+    }
+
     // Stop workers whose agent left the roster (removed in the app).
     for (const [id, w] of [...workers]) {
       if (!rosterIds.has(id)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {