flowviant 0.40.0 → 0.40.1

package/bin/lib/live.mjs

@@ -673,6 +673,33 @@ SECRETS: env files (.env, .dev.vars, …) hold the team's synced secrets. Their
 VALUES must NEVER appear in the summary, in commits, or in a PR — reference keys
 by NAME only. Never commit an env file.`;
 
+/**
+ * Walk forward from an opening brace to its MATCHING close, or null.
+ *
+ * String-aware, because the thing being matched is JSON and this object's whole
+ * job is to carry human prose: a summary reading `fixed the {x} case` would
+ * otherwise close the object early, and an escaped quote inside it would end the
+ * string early. Depth counting alone is not enough.
+ */
+function balancedSpan(text, start) {
+  let depth = 0;
+  let inStr = false;
+  let esc = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (ch === '\\') esc = true;
+      else if (ch === '"') inStr = false;
+      continue;
+    }
+    if (ch === '"') inStr = true;
+    else if (ch === '{') depth++;
+    else if (ch === '}' && --depth === 0) return text.slice(start, i + 1);
+  }
+  return null;
+}
+
 /** Pull the result object out of a turn's output. */
 function parseMediatedResult(out) {
   const text = String(out ?? '').trim();
@@ -683,10 +710,35 @@ function parseMediatedResult(out) {
   // build. Last rather than first: any preamble comes before the answer.
   const direct = tryJson(text);
   if (direct) return direct;
-  const start = text.lastIndexOf('{');
-  for (let i = start; i >= 0; i = text.lastIndexOf('{', i - 1)) {
-    const cand = tryJson(text.slice(i, text.lastIndexOf('}') + 1));
-    if (cand) return cand;
+  // Each candidate open brace gets its OWN close, found by scanning forward.
+  // The previous version anchored every attempt on `text.lastIndexOf('}')` —
+  // recomputed per iteration but loop-INVARIANT, so it was always the final `}`
+  // of the whole output. Only the start moved; the end never retreated. Any
+  // sentence after the object containing a brace (`Note: the } above closes it`)
+  // therefore made every slice unparseable, and a FINISHED build came back as
+  // `stalled` after two nudges. Reproduced before fixing.
+  let tried = 0;
+  for (let i = text.lastIndexOf('{'); i >= 0; i = text.lastIndexOf('{', i - 1)) {
+    // A candidate must OPEN ITS OWN LINE (whitespace aside). A form echoed
+    // mid-sentence is how a hypothetical became a delivery card: `I would
+    // return {"outcome":"done",…} once done. But I could not…` parsed as done
+    // and posted a completed card for a failed build (reproduced). A real form
+    // — bare, fenced, or followed by notes — opens at a line start, and a
+    // wrapper that inlines it gets the nudge, which asks for the bare object
+    // anyway. A wrong card has no recovery; a nudge does. Skipped candidates
+    // don't count against the bound, which also keeps a trailing prose brace
+    // from burning slots the real object needs.
+    const bol = text.lastIndexOf('\n', i - 1) + 1;
+    if (!text.slice(bol, i).trim()) {
+      // Bounded: an unbalanced brace scans to end-of-text, and a build's output
+      // can be very long. The real object is at the end — 200 candidates is far
+      // past any honest wrapper and keeps a pathological output from stalling
+      // the turn loop instead of the model.
+      if (++tried > 200) break;
+      const span = balancedSpan(text, i);
+      const cand = span && tryJson(span);
+      if (cand) return cand;
+    }
     if (i === 0) break;
   }
   return null;
@@ -700,6 +752,77 @@ function tryJson(s) {
   }
 }
 
+/**
+ * The server's own rule for a PR URL (`mcpAttachPrSchema`), checked BEFORE the
+ * call instead of discovered as a swallowed rejection after it.
+ *
+ * The result schema can only say `prUrl: string` — the model writes the value
+ * freehand — and the server's zod REJECTS a non-github or non-pull URL, so a
+ * plausible-looking mistake meant the PR was never linked and the task never
+ * moved to `review`, with nothing anywhere saying so. Deliberately NOT expressed
+ * as a `pattern` in MEDIATED_RESULT_SCHEMA: the mediated path is the one whose
+ * schema enforcement is a vendor flag we verified empirically on exactly one
+ * version, and adding a keyword that CLI may not implement risks the working
+ * case to defend the broken one. Validate on our side, where we know the rules.
+ */
+const PR_URL_RE = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+/;
+
+/**
+ * Coerce the model's criteria self-report into the shape `complete` accepts.
+ *
+ * MEDIATED_RESULT_SCHEMA can only say `index: number`; the server says
+ * `int().min(0)`, note ≤500, array ≤50 — and ONE bad row makes the whole
+ * `complete` call throw, which on this path means no delivery card at all. So
+ * repairable rows are repaired and the rest dropped: a self-report missing an
+ * entry is worth far more than a card that never arrives.
+ */
+function sanitizeCriteria(criteria) {
+  if (!Array.isArray(criteria)) return null;
+  const rows = criteria
+    // A negative index is DROPPED, not clamped: Math.max(0, …) would silently
+    // re-attribute the row to criterion 0, which is a wrong self-report rather
+    // than a missing one.
+    .filter((c) => c && Number.isFinite(c.index) && c.index >= 0 && typeof c.met === 'boolean')
+    .map((c) => ({
+      index: Math.trunc(c.index),
+      met: c.met,
+      ...(typeof c.note === 'string' && c.note ? { note: c.note.slice(0, 500) } : {}),
+    }))
+    .slice(0, 50);
+  return rows.length ? rows : null;
+}
+
+/**
+ * Post the delivery card, and get one honest retry at it.
+ *
+ * The retry drops `criteria` on purpose. runId, outcome and summary are all
+ * daemon-controlled and already clamped, so the only argument that can still be
+ * rejected is the one the model wrote — and dropping it also re-enters
+ * `complete`'s idempotent branch, which is what recovers the OTHER failure the
+ * server documents here (`task_status_failed`: the run row moved but the task's
+ * status write didn't, and the fix is to call again).
+ *
+ * Returns false only on an EXPLICIT `ok: false`. An unparseable or empty
+ * response is treated as success: this verdict decides whether the run is left
+ * for the stale sweep to roll back and rebuild, and a transient hiccup is not
+ * worth rebuilding a finished task over.
+ */
+async function postComplete({ mcpUrl, token, runId, outcome, summary, criteria }) {
+  const rows = sanitizeCriteria(criteria);
+  const call = (args) =>
+    mcpCall(mcpUrl, token, 'complete', args).catch((e) => ({
+      ok: false,
+      reason: e?.message ?? String(e),
+    }));
+  const base = { runId, outcome, summary };
+  let res = await call(rows ? { ...base, criteria: rows } : base);
+  if (res?.ok === false && rows) {
+    warn(`complete rejected (${res.reason ?? 'unknown'}) — retrying without the criteria self-report`);
+    res = await call(base);
+  }
+  return res?.ok !== false;
+}
+
 /**
  * Drive a task with a runtime that cannot reach the MCP server at all.
  *
@@ -746,7 +869,6 @@ async function driveMediated({
   const rt = runtimeById(runtimeId);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-schema-'));
   const schemaPath = join(dir, 'result.schema.json');
-  writeFileSync(schemaPath, JSON.stringify(MEDIATED_RESULT_SCHEMA), { mode: 0o600 });
 
   // The agent cannot call report_progress, so the daemon narrates for it off the
   // parsed activity stream. Throttled: a build touches hundreds of files and the
@@ -768,6 +890,9 @@ async function driveMediated({
   let resume = false;
   let nudges = 0;
   try {
+    // Inside the try so a failed write (disk full) still removes `dir` in the
+    // finally instead of leaking one temp directory per attempt.
+    writeFileSync(schemaPath, JSON.stringify(MEDIATED_RESULT_SCHEMA), { mode: 0o600 });
     for (;;) {
       if (!isAlive()) return { outcome: 'blocked', title, intentId };
       let out = '';
@@ -814,18 +939,50 @@ async function driveMediated({
       }
 
       if (result.outcome === 'blocked') {
-        const q = String(result.blockerQuestion ?? result.summary ?? '').trim();
-        const posted = await mcpCall(mcpUrl, token, 'report_blocker', {
-          runId,
-          taskId: intentId,
-          type: 'question',
-          payload: {
-            question: q || 'The agent stopped and did not say why.',
-            options: Array.isArray(result.blockerOptions) ? result.blockerOptions : undefined,
-          },
-        }).catch(() => null);
+        // Clamp AND scrub, same discipline as postComplete below, and for the
+        // same reason: on this path the DAEMON is the caller, so the model never
+        // sees the server's zod rejection and cannot self-correct. The server
+        // caps question at 2000 and options at 10×500 (questionPayloadSchema) —
+        // an oversize value posted raw is a rejected post, i.e. a question that
+        // silently never reaches the human. And the question is model narration
+        // leaving the box, exactly what the uplink scrub exists for.
+        const q =
+          envScrub(String(result.blockerQuestion ?? result.summary ?? '').trim()).slice(0, 2000) ||
+          'The agent stopped and did not say why.';
+        const options = (Array.isArray(result.blockerOptions) ? result.blockerOptions : [])
+          .filter((o) => typeof o === 'string' && o.trim())
+          .map((o) => envScrub(o.trim()).slice(0, 500))
+          .filter(Boolean)
+          .slice(0, 10);
+        const post = () =>
+          mcpCall(mcpUrl, token, 'report_blocker', {
+            runId,
+            taskId: intentId,
+            type: 'question',
+            payload: { question: q, ...(options.length ? { options } : {}) },
+          }).catch(() => null);
+        // One retry: reportBlockerOnce is idempotent server-side, and a dropped
+        // response is the documented reason it is.
+        let posted = await post();
+        if (!posted?.blockerId && !posted?.id) {
+          await sleep(2);
+          posted = await post();
+        }
         const blockerId = posted?.blockerId ?? posted?.id ?? null;
-        if (!blockerId) return { outcome: 'blocked', title, intentId };
+        if (!blockerId) {
+          // The question exists only in this process. Say why on the way out —
+          // silence here reads identically to a human who has not answered yet.
+          //
+          // 'error', NOT 'blocked': on every driver 'blocked' means "shutting
+          // down mid-park", and runLiveWorker BREAKS on it — a lane that ends
+          // its loop is never respawned (workers.delete fires only on roster
+          // removal), so returning it here turned one failed post into a lane
+          // that sat dead-but-listed until the daemon restarted. 'error' takes
+          // the refresh-token-and-retry path, and the shared finally's
+          // checkpoint keeps the work for whoever picks the task back up.
+          warn(`report_blocker did not return an id (${posted?.reason ?? posted?.raw ?? 'no response'}) — the question was not posted`);
+          return { outcome: 'error', error: 'report_blocker failed', title, intentId };
+        }
         const res = await waitForResolution(mcpUrl, token, blockerId, isAlive);
         if (res.status === 'resolved') {
           prompt = `The human answered your blocker: ${JSON.stringify(res.answer)}\nApply it and continue, then return the result form.`;
@@ -837,25 +994,61 @@ async function driveMediated({
       }
 
       // done / failed — either way the turn is over and the thread gets a card.
+      //
+      // NOTHING FROM HERE DOWN IS BEST-EFFORT, and that is the difference this
+      // path has to make up for. On the direct-MCP paths the AGENT makes these
+      // calls and sees the rejection, so it corrects and retries; a mediated
+      // agent never learns that the daemon's call failed. Swallowing them (which
+      // is what this shipped as) produced the worst available outcome: the PR
+      // silently unlinked, the task never moved to `review`, no delivery card —
+      // and `markLanded()` firing anyway, so the shared `finally` DELETED the WIP
+      // checkpoint for work the control plane had never been told about.
       if (result.prUrl && !isPatch) {
-        await mcpCall(mcpUrl, token, 'attach_pr', {
-          runId,
-          prUrl: String(result.prUrl),
-          ...(result.branch ? { branch: String(result.branch) } : {}),
-        }).catch(() => {});
+        const prUrl = String(result.prUrl).trim();
+        if (!PR_URL_RE.test(prUrl)) {
+          // The model can fix this one, so ask it to — it already opened the PR.
+          if (nudges < 2) {
+            nudges++;
+            prompt =
+              `"${prUrl}" is not a GitHub pull request URL (expected https://github.com/<owner>/<repo>/pull/<number>). ` +
+              'Do NOT redo any work and do NOT open another PR. Return the result form again with the real URL of the ' +
+              'pull request you already opened, or omit prUrl entirely if you did not open one.';
+            continue;
+          }
+          warn(`attach_pr skipped: unusable prUrl ${prUrl}`);
+        } else {
+          const attached = await mcpCall(mcpUrl, token, 'attach_pr', {
+            runId,
+            prUrl,
+            ...(result.branch ? { branch: String(result.branch) } : {}),
+          }).catch((e) => ({ ok: false, reason: e?.message ?? String(e) }));
+          if (attached?.ok === false) warn(`attach_pr rejected: ${attached.reason ?? 'unknown'}`);
+        }
       }
       clearTaskMarker(cwd);
-      if (result.outcome === 'done' && isPatch) {
+      const done = result.outcome === 'done';
+      if (done && isPatch) {
         await landPatch({ mcpUrl, token, runId, intentId, repoRoot, cwd, patchBase, baseRef });
       }
-      await mcpCall(mcpUrl, token, 'complete', {
+      const carded = await postComplete({
+        mcpUrl,
+        token,
         runId,
-        outcome: result.outcome === 'done' ? 'completed' : 'failed',
+        outcome: done ? 'completed' : 'failed',
         summary: envScrub(String(result.summary ?? '').slice(0, 4000)),
-        ...(Array.isArray(result.criteria) ? { criteria: result.criteria } : {}),
-      }).catch(() => {});
-      if (result.outcome === 'done') markLanded();
-      return { outcome: result.outcome === 'done' ? 'done' : 'stalled', title, intentId };
+        criteria: result.criteria,
+      });
+      if (!carded) {
+        // No delivery card exists, so this run is not done however the work
+        // ended. `landed` deliberately stays false: the shared finally takes one
+        // last checkpoint instead of deleting the WIP ref, and the run is left
+        // active for the stale sweep to roll back and re-dispatch — recoverable,
+        // unlike reporting success into a thread that shows nothing.
+        warn('complete failed — leaving the run for the server to reclaim');
+        return { outcome: 'error', error: 'complete rejected', title, intentId };
+      }
+      if (done) markLanded();
+      return { outcome: done ? 'done' : 'stalled', title, intentId };
     }
   } finally {
     rmSync(dir, { recursive: true, force: true });
@@ -1355,6 +1548,25 @@ export async function runLiveTask({
     lastBeat = Date.now();
     void mcpCall(mcpUrl, token, 'heartbeat', { runId }).catch(() => {});
   };
+  // AND ON A TIMER, because "activity" is not a signal every driver has.
+  //
+  // `beat()` used to be called from exactly ONE place — the live session's
+  // message loop, below — and the two other drivers return before they ever
+  // reach it. So a mediated or subprocess turn renewed the task lease only
+  // incidentally: `report_progress`, which fires only when the CLI happens to
+  // emit a tool activity and is throttled to one per 8s. Meanwhile Antigravity
+  // is handed `--print-timeout 60m` and AGENT_LEASE_TTL_MINUTES is 30, so a
+  // quiet stretch INSIDE a turn we explicitly permitted made the task stale to
+  // `isEligible` and claimable by another worker while it was still building it.
+  // `heartbeat` renews the task lease server-side (refreshTaskLeaseRemote), not
+  // just this token's last-seen, which is exactly the thing that goes stale.
+  //
+  // Fires at half the throttle window; `beat()`'s own guard is what rate-limits
+  // the wire, so session traffic and this timer cannot double up. Started here
+  // rather than in each driver for the same reason the checkpoint timer is
+  // shared: three drivers with three answers is how this diverged once already.
+  const heartbeatTimer = setInterval(beat, 30_000);
+  heartbeatTimer.unref?.();
 
   const flush = async () => {
     if (turnId && turnText.trim()) {
@@ -1574,6 +1786,7 @@ export async function runLiveTask({
     return { outcome: 'error', error: e?.message ?? String(e), title, intentId };
   } finally {
     clearInterval(checkpointTimer);
+    clearInterval(heartbeatTimer);
     // Same finally as the checkpoint: every path out of this task — done,
     // parked, rate-limited, thrown — must stop reporting a worktree that is
     // about to stop being this run's.

package/bin/lib/runtimes.mjs

@@ -650,8 +650,13 @@ export const RUNTIMES = {
   },
 };
 
-/** Runtimes this daemon can actually put a task on. */
-export const DISPATCHABLE = Object.values(RUNTIMES).filter((r) => r.mcp && r.args);
+// DELETED: `DISPATCHABLE`, a `mcp && args` filter last described as "runtimes
+// this daemon can actually put a task on". It had no importers left — `canRun`
+// replaced it — but it was the exact predicate the per-profile split exists to
+// correct, still exported under a name that invites reuse, and it answers FALSE
+// for Antigravity on every job. The next caller to reach for the obvious-looking
+// constant would have silently undone this release. `canRun(rt, profile)` /
+// `drivableHere(rt)` below are the answers.
 
 export const runtimeById = (id) => RUNTIMES[id] ?? RUNTIMES.claude;
 
@@ -761,7 +766,7 @@ export function pickRuntimeFor(profile, { detected } = {}) {
 // ── Detection ──────────────────────────────────────────────────────────────
 
 /**
- * Which of these is on this machine, asked once.
+ * Which of these is on this machine, asked at most once per DETECT_TTL_MS.
  *
  * `--version` rather than `which`: a binary on PATH that cannot execute (a
  * broken install, a wrong-arch download, a shell alias pointing at nothing) is
@@ -774,8 +779,18 @@ export function pickRuntimeFor(profile, { detected } = {}) {
  * account, no quota, no entitlement. Flowviant relays; it does not enforce.
  */
 let detectedCache = null;
+let detectedAt = 0;
+// The cache EXPIRES rather than living for the process: pickRuntimeFor's whole
+// premise is "a CLI can be installed while the daemon runs", and both it and
+// the roster poll read this cache — a forever-cache made that comment a lie
+// (nothing after preflight ever passed refresh, so a mid-run install was
+// invisible until restart, to the server included). 5 minutes keeps the probes
+// (3 sync --version execs) off the hot path while an install still surfaces on
+// the next poll or job.
+const DETECT_TTL_MS = 5 * 60 * 1000;
 export function detectRuntimes({ refresh = false } = {}) {
-  if (detectedCache && !refresh) return detectedCache;
+  if (detectedCache && !refresh && Date.now() - detectedAt < DETECT_TTL_MS) return detectedCache;
+  detectedAt = Date.now();
   detectedCache = Object.values(RUNTIMES).map((rt) => {
     let version = null;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.40.0",
+  "version": "0.40.1",
   "description": "Run your own coding CLIs as headless build agents for Flowviant — Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {