flowviant 0.35.0 → 0.37.0

package/bin/lib/claude.mjs

@@ -89,8 +89,18 @@ export const RESUME =
   'Resume. First call get_blocker_resolution for any blocker you reported; if resolved, ' +
   'apply the human’s answer and continue. Otherwise keep picking up and completing ' +
   'the tasks you were @mentioned on, per your instructions.';
-export const SINGLE_KICKOFF =
-  'Pick up and complete exactly ONE Flowviant task per your instructions, then stop.';
+// `intentId` is the task the SERVER says this lane is next in line for. Naming
+// it matters beyond saving a lookup: the daemon has already spawned this Claude
+// with that task's --model and --effort, and those cannot change once the
+// process exists. Left to pick freely, a lane could claim a sibling task and
+// run it under settings its owner chose for something else. Omitted (older
+// server, or nothing waiting) it falls back to the original free pick.
+export const SINGLE_KICKOFF = (intentId) =>
+  intentId
+    ? `Pick up Flowviant task ${intentId} — call claim_next_intent with intentId "${intentId}" — ` +
+      'complete exactly that ONE task per your instructions, then stop. If that ' +
+      'claim comes back unavailable, claim whatever is next for you instead.'
+    : 'Pick up and complete exactly ONE Flowviant task per your instructions, then stop.';
 export const SINGLE_RESUME =
   'Resume your current task. Call get_blocker_resolution for the blocker you reported; ' +
   'if resolved, apply the human’s answer and finish this one intent, then stop.';
@@ -521,7 +531,10 @@ export function humanizeToolUse(name, input = {}, cwd = '') {
     case 'Edit': {
       const p = String(input.file_path ?? '');
       const tail = p.split('/').slice(-2).join('/');
-      return { kind: 'write', label: `${name === 'Write' ? '+ page' : '~ page'} ${tail}` };
+      // `path` is what lets a caller count DISTINCT pages: a page written once
+      // and then edited twice is one page, and the label alone cannot say that
+      // (it changes between '+ page' and '~ page' for the same file).
+      return { kind: 'write', path: p, label: `${name === 'Write' ? '+ page' : '~ page'} ${tail}` };
     }
     case 'Grep':
       return {
@@ -590,7 +603,7 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText }) {
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn, streamJson, onActivity, wikiPerm, readOnly }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, model, effort }) {
   return new Promise((resolve) => {
     const args = [];
     if (resume) args.push('--continue');
@@ -599,7 +612,12 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn
     if (mcpConfig) args.push('--mcp-config', mcpConfig);
     // Pin the model — never inherit the user's global default (which may be a
     // 1M/long-context tier their subscription can't bill autonomous work on).
-    args.push('--model', MODEL);
+    // A per-task override (chosen in the app, validated server-side against a
+    // fixed list before it ever reaches this argv) wins over the machine pin;
+    // absent, the pin stands. Effort has no machine-level pin at all: unset
+    // means Claude Code's own default, which is the honest resting state.
+    args.push('--model', model || MODEL);
+    if (effort) args.push('--effort', effort);
     if (streamJson) args.push('--output-format', 'stream-json', '--verbose');
     // readOnly wins over wikiPerm: a consult must never inherit write tools.
     args.push(...(readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM));

package/bin/lib/env.mjs

@@ -213,19 +213,39 @@ export async function loadCachedEnv(projectId) {
 
 // ── Materialization ────────────────────────────────────────────────────────
 
-/** Per-worktree git exclude — untracked AND unstageable. A git worktree's
- *  `.git` is a FILE pointing at its private gitdir; info/exclude there applies
- *  to that worktree only and never touches the user's repo. */
+/**
+ * Add the materialized paths to the exclude file git ACTUALLY READS.
+ *
+ * This used to resolve the worktree's own gitdir (`.git/worktrees/<name>`) and
+ * write `info/exclude` there, on the belief that it "applies to that worktree
+ * only and never touches the user's repo". Git does not read that file: it
+ * resolves `info/exclude` against $GIT_COMMON_DIR — the main `.git` — so in
+ * every linked worktree the daemon creates, the exclusion did nothing at all.
+ * The plaintext secret files stayed visible to `git add -A`, which is what
+ * `checkpointWip` runs before force-pushing a WIP commit to the remote.
+ *
+ * `--git-common-dir` is asked of git rather than derived, because that is the
+ * one answer that cannot drift from what git itself will consult. The file is
+ * local to the clone and never committed.
+ *
+ * This is a CONVENIENCE, not the guarantee. The guarantee is the check-ignore
+ * verification in materializeInto, which refuses to write a secret that git can
+ * still see.
+ */
 function excludeInWorktree(wt, relPaths) {
   try {
-    const dotGit = join(wt, '.git');
-    let gitdir = dotGit;
+    let gitdir;
     try {
-      const content = readFileSync(dotGit, 'utf8');
-      const m = content.match(/^gitdir:\s*(.+)\s*$/m);
-      if (m) gitdir = resolve(wt, m[1].trim());
+      gitdir = resolve(
+        wt,
+        execFileSync('git', ['rev-parse', '--git-common-dir'], {
+          cwd: wt,
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim()
+      );
     } catch {
-      /* .git is a directory (main checkout) — use it directly */
+      return; // not a repo — materializeInto's check-ignore gate will refuse anyway
     }
     const excludePath = join(gitdir, 'info', 'exclude');
     mkdirSync(dirname(excludePath), { recursive: true });
@@ -267,6 +287,27 @@ function isTrackedInGit(wt, relPath) {
   }
 }
 
+/**
+ * Will git hide this path? Asked of git, never inferred.
+ *
+ * This is the gate that makes writing a secret safe, and it is asked AFTER the
+ * exclude file is updated so it reflects the state the agent will actually run
+ * under. It fails CLOSED: any error — not a repo, git missing, a weird
+ * pathspec — reads as "not ignored", so the secret is not written. A wrong
+ * "yes" here puts plaintext on a remote branch; a wrong "no" costs a warning.
+ */
+function isIgnoredInGit(wt, relPath) {
+  try {
+    execFileSync('git', ['check-ignore', '-q', '--', relPath], {
+      cwd: wt,
+      stdio: 'ignore',
+    });
+    return true; // exit 0 = ignored
+  } catch {
+    return false;
+  }
+}
+
 // Per-worktree: the target files we last materialized THIS SESSION.
 const lastFilesByWorktree = new Map();
 // Project-global union of every target file we've ever materialized — PERSISTED
@@ -334,12 +375,25 @@ export function materializeInto(wt) {
     byFile.set(v.targetFile, list);
   }
 
+  // Exclude BEFORE writing, not after. The old order wrote plaintext first and
+  // tried to hide it afterwards, so every failure mode — and the exclude file
+  // being the wrong one, which it was — left a readable secret in a tree that
+  // `checkpointWip` force-pushes.
+  excludeInWorktree(wt, [...byFile.keys()]);
+
   const written = [];
   for (const [file, list] of byFile) {
     if (isTrackedInGit(wt, file)) {
       warn(`env: "${file}" is tracked in git — refusing to write secrets there (gitignore it). Its keys are NOT materialized.`);
       continue;
     }
+    // The load-bearing check. A materialized secret sits in a worktree whose
+    // whole tree gets `git add -A`'d and force-pushed by the WIP checkpoint, so
+    // "git cannot see this file" is a precondition for writing it, not a nicety.
+    if (!isIgnoredInGit(wt, file)) {
+      warn(`env: "${file}" is not gitignored — refusing to write secrets there. Add it to .gitignore. Its keys are NOT materialized.`);
+      continue;
+    }
     try {
       const abs = join(wt, file);
       mkdirSync(dirname(abs), { recursive: true });
@@ -369,7 +423,18 @@ export function materializeInto(wt) {
   }
   for (const f of written) knownTargetFiles.add(f);
   lastFilesByWorktree.set(wt, written);
-  if (written.length) excludeInWorktree(wt, written);
+}
+
+/**
+ * The secret files this daemon has materialized into `wt`.
+ *
+ * Exists so anything that stages the whole tree can subtract them by pathspec.
+ * Belt to the check-ignore braces: `git add -A` obeys .gitignore, so a properly
+ * ignored file is already safe — but "already safe" was the assumption that put
+ * plaintext on a remote branch, and a second, independent mechanism is cheap.
+ */
+export function materializedFiles(wt) {
+  return [...(lastFilesByWorktree.get(wt) ?? [])];
 }
 
 // ── Uplink scrubbing ───────────────────────────────────────────────────────

package/bin/lib/fleet.mjs

@@ -38,6 +38,7 @@ import {
   isValidPrUrl,
   isValidBranch,
   isSafePathSegment,
+  worktreeDiffstat,
 } from './git.mjs';
 import { c, LABEL_COLORS, info, note, ok, warn, fail } from './ui.mjs';
 import { revertPatch, withPatchLock } from './patch.mjs';
@@ -122,11 +123,87 @@ async function fetchRoster(haveIds) {
   return data; // { mcpUrl, leaseTtlSeconds, agents: [{agentId,name,token,reviewGate,hasWork}] }
 }
 
+const RUN_DIFFSTAT_URL = FLEET_URL.replace(/\/agents\/?$/, '/run-diffstat');
+
+/**
+ * Post what a run has changed, every 20s, until the returned stop() is called.
+ *
+ * Daemon-side rather than an MCP tool the agent calls: the agent forgets, each
+ * call costs tokens, and anything the agent reports about itself is downstream
+ * of whatever it is currently reading. The daemon owns the worktree, so it can
+ * just look.
+ *
+ * Posts when the numbers MOVED, and otherwise once every couple of minutes to
+ * say the worktree is still being watched. Both halves are needed. Writing the
+ * same row every 20s would make a wedged turn look busy; never re-writing it
+ * makes a HEALTHY run look dead, because the reader treats a sample it has not
+ * seen refreshed in three minutes as a daemon that stopped — and an agent that
+ * finishes editing and then spends fifteen minutes running the test suite
+ * produces exactly the same silence as one that died. REFRESH_MS sits well
+ * inside that window so an idle-but-live worktree keeps its panel.
+ */
+const DIFFSTAT_REFRESH_MS = 120_000;
+
+function sampleDiffstat(cwd, baseRef, intentId, agentId) {
+  let last = '';
+  let lastSentAt = 0;
+  let alive = true;
+  const post = async () => {
+    if (!alive) return;
+    let stat = null;
+    try {
+      stat = worktreeDiffstat(cwd, baseRef);
+    } catch {
+      return; // a worktree mid-reset is not an error worth reporting
+    }
+    if (!stat) return;
+    const key = JSON.stringify(stat);
+    if (key === last && Date.now() - lastSentAt < DIFFSTAT_REFRESH_MS) return;
+    try {
+      const res = await fetch(RUN_DIFFSTAT_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        // The lane, not just the task: the server matches the run on both, so a
+        // sample can only ever overwrite the diffstat of THIS lane's own run.
+        body: JSON.stringify({ intentId, agentId, diffstat: stat }),
+      });
+      // Only a sample the server ACCEPTED counts as sent. Marking it delivered
+      // before the round-trip meant a dropped request suppressed every retry
+      // for as long as the numbers held still — which is precisely when the
+      // reader is about to expire the panel.
+      if (res.ok) {
+        last = key;
+        lastSentAt = Date.now();
+      }
+    } catch {
+      /* best-effort: `last` is untouched, so the next tick tries again */
+    }
+  };
+  const t = setInterval(() => void post(), 20_000);
+  // Kick once after a beat so a fast task still reports something before it ends.
+  const first = setTimeout(() => void post(), 5_000);
+  return () => {
+    alive = false;
+    clearInterval(t);
+    clearTimeout(first);
+  };
+}
+
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
 // base between tasks (fresh conversation), resume in place while on a blocker.
-async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWork, getMcpUrl, isAlive, onChild, onTokenSuspect }) {
+async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWork, getNext, getMcpUrl, isAlive, onChild, onTokenSuspect }) {
   let resuming = false;
   let needsReset = true; // reset to base before a FRESH task, not on idle polls
+  // The task this lane is currently holding. `next` only arrives on a FRESH
+  // turn, but a run that comes back from a blocker is still building the same
+  // intent — without remembering it here, the entire post-blocker half of a run
+  // reports no diffstat and the tray blanks mid-build.
+  let heldIntentId = null;
   let phase = ''; // '', 'idle', 'blocked' — log each transition once, not per poll
   const enter = (p, fn, msg) => {
     if (phase !== p) {
@@ -154,18 +231,41 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
       needsReset = false;
     }
     const { dir, path: mcpConfig } = mcpConfigFor(token, getMcpUrl());
+    // The task the server says is next for this lane, read ONCE per turn: the
+    // model and effort below become process flags, so they must describe the
+    // same task the kickoff tells Claude to claim. Re-reading the map mid-turn
+    // could pair one task's flags with another's work.
+    const next = resuming ? null : getNext?.(agentId) || null;
+    if (next?.intentId) heldIntentId = next.intentId;
     let out = '';
+    // Report what this run is changing, while it is changing it. The commits
+    // endpoint can only describe work that has already reached the provider, so
+    // without this the app has nothing to say about a task for the whole time it
+    // is being built. Only when we know WHICH task this turn is for — the same
+    // hint that carries its model and effort — because a diffstat attributed to
+    // the wrong run is worse than none. On a resume that is the intent this
+    // lane already holds; the worktree it is about to keep editing is the same
+    // one, so the samples describe the same run.
+    const stopDiffstat = heldIntentId
+      ? sampleDiffstat(cwd, baseRef, heldIntentId, agentId)
+      : null;
     try {
       out = await runTurn({
-        prompt: resuming ? SINGLE_RESUME : SINGLE_KICKOFF,
+        prompt: resuming ? SINGLE_RESUME : SINGLE_KICKOFF(next?.intentId),
         resume: resuming,
         system: SYSTEM_SINGLE,
         cwd,
         mcpConfig,
         label,
+        // Per-task overrides — null/absent means this machine's own defaults
+        // (FLOWVIANT_MODEL, and Claude Code's own effort). A resume keeps the
+        // session it already has, so there is nothing to re-pick there.
+        model: next?.model || undefined,
+        effort: next?.effort || undefined,
         onSpawn: (ch) => onChild?.(ch),
       });
     } finally {
+      stopDiffstat?.();
       rmSync(dir, { recursive: true, force: true });
       onChild?.(null);
     }
@@ -179,6 +279,7 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
     if (sawSentinel(out, 'NOTHING')) {
       enter('idle', info, 'idle — no work assigned');
       resuming = false;
+      heldIntentId = null; // let go of the task, and of its diffstat
       await sleep(IDLE_SECONDS);
       continue;
     }
@@ -187,6 +288,7 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
       phase = '';
       resuming = false;
       needsReset = true;
+      heldIntentId = null;
       continue;
     }
     // No sentinel — the turn didn't complete the protocol. Almost always the
@@ -199,7 +301,10 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
     // failure, not completion — retry in place and KEEP the worktree. Resetting
     // here would wipe the blocked task's uncommitted changes. Only a fresh-task
     // turn (not resuming) warrants a clean slate next time.
-    if (!resuming) needsReset = true;
+    if (!resuming) {
+      needsReset = true;
+      heldIntentId = null; // fresh slate next turn — nothing held to sample
+    }
     await sleep(IDLE_SECONDS);
   }
   info(`${label} stopped`);
@@ -298,6 +403,13 @@ export async function runFleetDaemon() {
   const tokenByAgent = new Map(); // agentId -> latest worker token
   const mintedAt = new Map(); // agentId -> ms when we last got a fresh token
   const hasWorkByAgent = new Map(); // agentId -> server says it has claimable work
+  // agentId -> the intent the server would hand this lane next: { intentId,
+  // title, model, effort }. `--model`/`--effort` are fixed when Claude starts,
+  // and by then nothing has been claimed — so the server names the task first
+  // and the turn pins its claim to that id. Absent on older servers, in which
+  // case the lane behaves exactly as it did before: generic kickoff, machine
+  // defaults.
+  const nextByAgent = new Map();
   let leaseTtlSeconds = 24 * 60 * 60; // updated from each roster response
   let mcpUrl = MCP_URL;
   const workers = new Map(); // agentId -> { state, promise, wt, label }
@@ -1061,6 +1173,14 @@ export async function runFleetDaemon() {
         const startedAt = Date.now();
         let filesRead = 0;
         let phase = 'reading';
+        // Distinct vault pages this turn has written. Counted HERE, from the
+        // stream, because it is the only place that knows mid-turn: the daemon
+        // syncs the vault to the server once, AFTER the turn returns, so a
+        // server-side count of "rows touched since the turn began" is zero for
+        // the entire writing phase — which is exactly how long the bar needs it.
+        // A Set, not a counter: pages get written once and then edited, and
+        // three tool calls on one page are one page.
+        const pagesSeen = new Set();
         const feed = [];
         const frame = (extra) => ({
           mode,
@@ -1068,12 +1188,16 @@ export async function runFleetDaemon() {
           activity: feed[feed.length - 1] ?? '',
           recent: feed.slice(-24),
           filesRead,
+          pagesWritten: pagesSeen.size,
           elapsedSec: Math.round((Date.now() - startedAt) / 1000),
           ...extra,
         });
         const onActivity = (a) => {
           if (a.kind === 'read') filesRead++;
-          if (a.kind === 'write') phase = 'writing';
+          if (a.kind === 'write') {
+            phase = 'writing';
+            pagesSeen.add(a.path || a.label);
+          }
           // Collapse runs of bare "thinking…" so the feed doesn't fill with it.
           if (!(a.label === 'thinking…' && feed[feed.length - 1] === 'thinking…')) {
             feed.push(a.label);
@@ -1359,6 +1483,8 @@ export async function runFleetDaemon() {
         mintedAt.set(a.agentId, Date.now());
       }
       hasWorkByAgent.set(a.agentId, !!a.hasWork);
+      if (a.next && typeof a.next.intentId === 'string') nextByAgent.set(a.agentId, a.next);
+      else nextByAgent.delete(a.agentId);
       if (!workers.has(a.agentId)) {
         // Local ceiling, enforced and not merely requested. The roster can carry
         // more lanes than this machine asked for — someone added capacity by
@@ -1409,7 +1535,14 @@ export async function runFleetDaemon() {
 
           getToken: (id) => tokenByAgent.get(id),
           getHasWork: (id) => hasWorkByAgent.get(id) ?? false,
+          getNext: (id) => nextByAgent.get(id) ?? null,
           getMcpUrl: () => mcpUrl,
+          // Injected rather than imported: fleet.mjs imports live.mjs, so live
+          // cannot import back. The live worker is the DEFAULT one, and until
+          // this was passed down the whole run-diffstat pipeline was reachable
+          // only under FLOWVIANT_POLL=1 — the app's live-changes panel had no
+          // data source at all for the path everybody actually runs.
+          sampleDiffstat,
           isAlive: () => state.alive,
           onChild: (ch) => {
             state.child = ch;
@@ -1524,6 +1657,7 @@ export async function runFleetDaemon() {
         workers.delete(id);
         tokenByAgent.delete(id);
         hasWorkByAgent.delete(id);
+        nextByAgent.delete(id);
         mintedAt.delete(id); // was leaked on removal (finding 14)
       }
     }

package/bin/lib/git.mjs

@@ -1,10 +1,11 @@
 /** Git worktree helpers (fleet & static-fleet modes). */
 
 import { execFileSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { resolve, join } from 'node:path';
 import { rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { materializedFiles } from './env.mjs';
 
 export function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
@@ -185,6 +186,14 @@ function gitWithEnv(args, cwd, extraEnv) {
  * world untouched — it cannot tell this happened.
  *
  * Returns the commit sha, or null if there was nothing dirty / no remote.
+ *
+ * This PUSHES, so what it stages is a security boundary, not a detail: the
+ * daemon materializes plaintext env-vault secrets into this same worktree.
+ * They are gitignored (materializeInto refuses to write them otherwise), and
+ * `git add -A` honours .gitignore — but the whole point of the bug this guards
+ * against was an exclusion mechanism that silently did nothing, so the paths
+ * are ALSO subtracted by pathspec here. Two independent mechanisms, because one
+ * of them failing quietly is exactly what put secrets on a remote branch.
  */
 export function checkpointWip(wt, intentId, baseRef) {
   if (!isSafePathSegment(intentId)) return null;
@@ -201,7 +210,11 @@ export function checkpointWip(wt, intentId, baseRef) {
   try {
     const head = git(['rev-parse', 'HEAD'], wt);
     gitWithEnv(['read-tree', head], wt, env);
-    gitWithEnv(['add', '-A'], wt, env);
+    gitWithEnv(
+      ['add', '-A', '--', '.', ...materializedFiles(wt).map((p) => `:(exclude)${p}`)],
+      wt,
+      env
+    );
     const tree = gitWithEnv(['write-tree'], wt, env);
     // Nothing changed since HEAD — no snapshot worth pushing.
     if (tree === git(['rev-parse', `${head}^{tree}`], wt)) return null;
@@ -274,3 +287,107 @@ export function resetWorktree(wt, baseRef) {
     console.error(`  (worktree reset to ${baseRef} failed: ${e.message})`);
   }
 }
+
+/**
+ * What has changed in this worktree since `baseRef` — committed or not.
+ *
+ * The definition matters. `git diff --numstat <base>` (no `..HEAD`) compares the
+ * base against the WORKING TREE, so it covers commits the agent has made, staged
+ * work, and edits it has not committed yet. Anything narrower would go blank at
+ * the exact moments you look: right after a commit, or before the first one.
+ *
+ * Untracked files are added separately — they are invisible to `git diff` and
+ * are usually the most interesting thing an agent has done (a new module, a new
+ * test). Their line counts are read here rather than inferred; a file too large
+ * to be source is reported as a path with no counts instead of being read into
+ * memory.
+ *
+ * PATHS AND COUNTS ONLY. Nothing in here returns file content.
+ *
+ * Both git calls are `-z`, for the reason gitRaw exists: git's line-based output
+ * QUOTES any path that is not plain ASCII, so an accented filename arrives as
+ * "n\303\251w.txt" — a string that is not the path, cannot be stat'd, and reads
+ * as garbage in the tray. `-z` emits paths verbatim.
+ */
+export function worktreeDiffstat(cwd, baseRef, { maxFiles = 200 } = {}) {
+  const files = [];
+  let additions = 0;
+  let deletions = 0;
+
+  const add = (path, added, removed) => {
+    additions += added;
+    deletions += removed;
+    files.push({ path, added, removed });
+  };
+
+  try {
+    // `--numstat -z` frames a normal change as one field, "added\tdeleted\tpath",
+    // but a RENAME as three: "added\tdeleted\t" (empty path), then the old path,
+    // then the new one. An empty path is therefore the rename marker, and the
+    // next two fields belong to it — read line-wise instead, a rename would
+    // report a file literally named "old => new".
+    const fields = splitNul(gitRaw(['diff', '--numstat', '-z', baseRef, '--'], cwd));
+    for (let i = 0; i < fields.length; i++) {
+      const [a, d, ...rest] = fields[i].split('\t');
+      let path = rest.join('\t');
+      if (!path) {
+        path = fields[i + 2] ?? fields[i + 1]; // the post-rename name is what exists now
+        i += 2;
+        if (!path) continue;
+      }
+      // Binary files report '-' for both counts; they changed, but not by lines.
+      add(path, a === '-' ? 0 : Number(a) || 0, d === '-' ? 0 : Number(d) || 0);
+    }
+  } catch {
+    // No base ref yet, or not a repo — nothing to report rather than a crash.
+    return null;
+  }
+
+  try {
+    const untracked = splitNul(
+      gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], cwd)
+    );
+    for (const path of untracked) {
+      let added = 0;
+      // Past the cap this path will not be shown, so do not pay to read it.
+      // This is the one place the totals can undercount, and reaching it takes
+      // an untracked tree bigger than the list itself — a generated directory
+      // .gitignore missed. Statting and reading all of it on a 20s interval
+      // would block the roster poll and every other lane on this daemon.
+      if (files.length < maxFiles) {
+        try {
+          const st = statSync(join(cwd, path));
+          // Regular files ONLY. `git ls-files --others` will happily name a
+          // symlink or a fifo, and readFileSync on a fifo or a character device
+          // BLOCKS — on a 20s interval, on the daemon's single thread, that is
+          // the whole process wedged waiting for a device that may never write.
+          // 2 MB: past that it is a build artifact or a binary, and reading it
+          // to count newlines would be the most expensive thing this daemon does.
+          if (st.isFile() && st.size <= 2_000_000) {
+            const text = readFileSync(join(cwd, path), 'utf8');
+            // A NUL byte means binary. Counting "lines" in a PNG produces a
+            // number that is not wrong so much as meaningless, and it was being
+            // summed into the total shown beside git's real counts.
+            if (text.includes('\0')) throw new Error('binary');
+            // Lines, not segments. A file ending in a newline — i.e. essentially
+            // every source file an agent writes — splits into one more piece
+            // than it has lines, and that +1 was landing in the totals shown
+            // beside git's own counts.
+            added = text ? text.split('\n').length - (text.endsWith('\n') ? 1 : 0) : 0;
+          }
+        } catch {
+          /* vanished between listing and reading — report the path, no counts */
+        }
+      }
+      add(path, added, 0);
+    }
+  } catch {
+    /* untracked listing failed — the tracked half still stands */
+  }
+
+  if (files.length === 0) return null;
+  // Totals stay whole while the LIST is capped: a truncated list must never
+  // quietly shrink the number printed beside it.
+  const truncated = Math.max(0, files.length - maxFiles);
+  return { files: files.slice(0, maxFiles), additions, deletions, truncated };
+}

package/bin/lib/live.mjs

@@ -565,6 +565,8 @@ export async function runLiveTask({
   resumeIntentId,
   onChild,
   onIntent,
+  sampleDiffstat,
+  agentId,
 }) {
   const claim = await mcpCall(mcpUrl, token, 'claim_next_intent', {}).catch(() => null);
   if (!claim || claim.claimed !== true) return { outcome: 'nothing' };
@@ -753,15 +755,31 @@ export async function runLiveTask({
   }, CHECKPOINT_MS);
   checkpointTimer.unref?.();
 
+  // Report what this run is changing WHILE it changes it. Started here, beside
+  // the checkpoint timer, because both want the same two facts — a worktree and
+  // the task it belongs to — and both must be torn down on every exit from this
+  // function. Unlike poll mode there is nothing to predict: the claim above
+  // already told us the real intent.
+  const stopDiffstat = sampleDiffstat?.(cwd, baseRef, intentId, agentId) ?? null;
+
   const input = makeInput(seedPrompt(runId, brief, transcript, resumedInPlace));
   const session = query({
     prompt: input.stream(),
     options: {
       cwd,
       env,
-      // Pin the model — never inherit the user's global default (which may be a
-      // 1M/long-context tier their subscription can't bill autonomous work on).
-      model: MODEL,
+      // Per-task first, this machine's default second. The task's own choice
+      // comes off the BRIEF rather than the roster hint, because the claim has
+      // already happened here — this is the task we actually got, not the one
+      // the server guessed we would get.
+      //
+      // Still pinned either way: never inherit the user's global default, which
+      // may be a 1M/long-context tier their subscription cannot bill autonomous
+      // work on.
+      model: brief.agentModel || MODEL,
+      // Omitted entirely when unset — Claude Code's own default is the right
+      // answer, and passing undefined effort is not the same as not passing it.
+      ...(brief.agentEffort ? { effort: brief.agentEffort } : {}),
       permissionMode: SAFE ? 'default' : 'bypassPermissions',
       ...(SAFE ? { allowedTools: SAFE_TOOLS } : {}),
       systemPrompt: { type: 'preset', preset: 'claude_code', append: SYSTEM_LIVE },
@@ -972,6 +990,10 @@ export async function runLiveTask({
     return { outcome: 'error', error: e?.message ?? String(e), title, intentId };
   } finally {
     clearInterval(checkpointTimer);
+    // Same finally as the checkpoint: every path out of this task — done,
+    // parked, rate-limited, thrown — must stop reporting a worktree that is
+    // about to stop being this run's.
+    stopDiffstat?.();
     // Last word on this task's state. If the work landed (branch pushed, PR
     // open, patch applied) the checkpoint has served its purpose and the ref is
     // deleted — otherwise it accumulates one hidden ref per task, forever, on
@@ -1046,6 +1068,11 @@ export async function runLiveWorker({
   onChild,
   onIntent,
   onPreview,
+  /** Start posting this run's worktree diffstat; returns stop(). Injected from
+   *  fleet.mjs (which imports this module, so the dependency cannot go the
+   *  other way). Optional so a caller without it degrades to no panel rather
+   *  than crashing. */
+  sampleDiffstat,
 }) {
   // The intent this worker is holding across iterations. When a task parks on a
   // blocker its worktree keeps uncommitted work; on the resume claim we must NOT
@@ -1198,6 +1225,8 @@ export async function runLiveWorker({
         isAlive,
         resumeIntentId: lastIntentId,
         onChild,
+        sampleDiffstat,
+        agentId,
       });
     } catch (e) {
       enter('error', warn, `${c.yellow('error')} ${c.dim(`— ${e?.message ?? e}`)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {