flowviant 0.34.0 → 0.34.2

package/bin/cli.mjs

@@ -42,11 +42,37 @@ import { runWorker, runStaticFleet } from './lib/single.mjs';
 import { runLogin } from './lib/login.mjs';
 import { preflight } from './lib/preflight.mjs';
 
-// `flowviant login` — device auth (recommended): approve a code in the
-// app, the credential is stored locally, then plain `flowviant` just runs.
+// `flowviant login` — device auth (recommended): approve a code in the app, the
+// credential is stored locally, and then we KEEP GOING into the daemon.
+//
+// It used to print "Now just run: npx flowviant" and exit. Everything about that
+// was technically correct and practically a dead end: the line scrolled past in
+// a terminal the user had already stopped reading (they were in the browser,
+// typing a code), and the app told them their machine would "come online
+// shortly" — which it never did, because nothing was running. The product
+// promise is install once; a second command you have to notice is not that.
+//
+// `--no-start` for scripts and CI, which want the credential and not a
+// long-running process.
 if (process.argv[2] === 'login') {
-  await runLogin();
-  process.exit(0);
+  const noStart = process.argv.includes('--no-start');
+  await runLogin({ thenStart: !noStart });
+  if (noStart) process.exit(0);
+  // Re-exec as a plain `flowviant` rather than falling through. config.mjs reads
+  // the credential at IMPORT time — which was before the login we just did — so
+  // this process still has an empty FLEET_TOKEN and would exit with "no
+  // credential found" seconds after saving one. Same shape as the self-update
+  // re-exec: stay alive as a thin proxy so the user's shell keeps one foreground
+  // process.
+  const { spawn } = await import('node:child_process');
+  const child = spawn(process.execPath, [process.argv[1]], {
+    stdio: 'inherit',
+    env: process.env,
+  });
+  // AWAIT it. Registering an exit handler and falling through would run the rest
+  // of this file in the parent — which has no credential — and print "no
+  // credential found" over the daemon that just started in the child.
+  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
 }
 
 // `flowviant update` — install the latest published version now. The daemon also

package/bin/lib/login.mjs

@@ -45,7 +45,7 @@ async function post(url, body) {
   return j.data ?? j;
 }
 
-export async function runLogin() {
+export async function runLogin({ thenStart = false } = {}) {
   console.log(`\n  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`login · v${VERSION}`)}\n`);
   let start;
   try {
@@ -72,7 +72,14 @@ export async function runLogin() {
     if (poll.status === 'approved') {
       store({ fleetToken: poll.fleetToken, projectId: poll.projectId, mcpUrl: poll.mcpUrl });
       ok('connected — credential saved to ~/.flowviant/credentials.json');
-      console.log(`\n  Now just run:  ${c.bold('npx flowviant')}\n`);
+      // The daemon starts right here unless the caller opted out; telling
+      // someone to run a second command was the step that got missed, since by
+      // this point they are looking at the browser, not this terminal.
+      console.log(
+        thenStart
+          ? `\n  ${c.dim('starting your agent — leave this running')}\n`
+          : `\n  Now run:  ${c.bold('npx flowviant')}\n`
+      );
       return;
     }
     if (poll.status === 'expired') {

package/bin/lib/preview.mjs

@@ -28,6 +28,7 @@
  */
 
 import { spawn, execFileSync } from 'node:child_process';
+import { createServer } from 'node:net';
 import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir, platform, arch } from 'node:os';
@@ -216,6 +217,33 @@ const TUNNEL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
 // Where a dev server announces it bound — "Local: http://localhost:3001/".
 const BIND_RE = /https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0):(\d+)/i;
 
+/**
+ * A port nobody is on right now — bind :0, read what the kernel handed us, let
+ * it go. Inherently a RACE (someone could take it in the gap), which is fine:
+ * this is a hint passed as $PORT, and the tunnel still aims at whatever the
+ * server ACTUALLY announces. Worst case we lose the hint and land back on
+ * today's behaviour.
+ *
+ * Why this exists: previews only survived concurrency by luck. vite/next hop to
+ * the next free port when theirs is taken, so two tasks in one repo happened to
+ * work. Anything that binds a FIXED port and exits on EADDRINUSE — the `api`
+ * preview kind, an explicit `port` in preview.json, a plain app.listen(3000) —
+ * had its second preview die outright, reported as "dev server exited before it
+ * was reachable" with the real cause buried in the tail. That's not an edge
+ * case on a machine running up to MAX_CONCURRENT tasks, and it stops being one
+ * at all once the box is shared.
+ */
+async function freePort() {
+  return new Promise((resolve) => {
+    const srv = createServer();
+    srv.once('error', () => resolve(null)); // no port to be had — fall through
+    srv.listen(0, '127.0.0.1', () => {
+      const p = srv.address()?.port ?? null;
+      srv.close(() => resolve(p));
+    });
+  });
+}
+
 // ── Orphan reaping ─────────────────────────────────────────────────────────
 // Preview children (dev server + tunnel) are detached so we can kill the whole
 // group — but that also means they SURVIVE an ungraceful daemon death (SIGKILL,
@@ -307,6 +335,10 @@ export async function startPreview({
 }) {
   const cf = await ensureCloudflared(log);
   if (!cf) return null; // fall back to captured evidence
+  // Ask for a port nobody's on, and TELL the dev server about it (below) rather
+  // than hoping its framework hops. Null if we couldn't get one — everything
+  // downstream then behaves exactly as before.
+  const bindPort = await freePort();
   // Host the origin sees. Default 'localhost' (what a local browser sends) so
   // dev servers that validate Host — Vite server.allowedHosts, webpack, Next's
   // allowedDevOrigins — accept the tunnel. `hostHeader: false` in preview.json
@@ -320,10 +352,18 @@ export async function startPreview({
     // a reused/uncleaned worktree still previews. Harmless to tools that ignore
     // these vars; BROWSER=none stops any auto-open. A repo's preview.json `env`
     // is layered last, so it can override any of these.
+    // PORT is a HINT, deliberately: honoured by Next, Remix, Nuxt, CRA and any
+    // conventional `app.listen(process.env.PORT)`, ignored by Vite (which uses
+    // server.port and hops on its own) and overridden by an explicit --port in
+    // the dev script. All three outcomes are fine — the tunnel aims at the port
+    // the server ANNOUNCES, not at what we asked for, so a disregarded hint
+    // costs nothing and an honoured one is what makes two concurrent previews
+    // of one repo possible. Placed BEFORE extraEnv so preview.json still wins.
     const env = {
       ...process.env,
       VINEXT_NO_DEV_LOCK: '1',
       BROWSER: 'none',
+      ...(bindPort ? { PORT: String(bindPort) } : null),
       ...(extraEnv && typeof extraEnv === 'object' ? extraEnv : {}),
     };
     // detached so each gets its own process group — `bun run dev` via a shell
@@ -444,9 +484,11 @@ export async function startPreview({
       finish(null);
     });
 
-    // If the server never prints a URL we recognize (quiet server), tunnel to the
-    // configured port as a last resort.
-    bindTimer = setTimeout(() => void openTunnel(port), 30_000);
+    // If the server never prints a URL we recognize (quiet server), guess. Prefer
+    // the port we HANDED it over the one we inferred from its framework: a server
+    // quiet enough to reach this line is usually a plain node/express one, and
+    // those are exactly the ones that read $PORT.
+    bindTimer = setTimeout(() => void openTunnel(bindPort ?? port), 30_000);
     timer = setTimeout(() => {
       log?.(
         `preview tunnel did not come up in ${Math.round(timeoutMs / 1000)}s — skipping.${

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.34.0",
+  "version": "0.34.2",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {