flowviant 0.44.1 → 0.45.0

package/bin/lib/claude.mjs

@@ -233,7 +233,7 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText }) {
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort, adoptResumeId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
     if (!rt.args) {
@@ -276,6 +276,11 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       resume,
       streamJson,
       profile,
+      // Adopting a terminal session (work.mjs): Claude turns it into
+      // `--resume <id> --fork-session`; every other runtime THROWS on it, so a
+      // mis-wired adoption fails as a loud turn error rather than a silent
+      // fresh conversation wearing an adopted session's name.
+      adoptResumeId,
       // Only the wiki profile uses it, but it is passed unconditionally: a
       // runtime that can path-scope its writes needs to know WHERE the vault is,
       // and Claude — which cannot — simply ignores it.

package/bin/lib/fleet.mjs

@@ -84,6 +84,7 @@ import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 import { machineSnapshot } from './resources.mjs';
 import { detectRuntimes, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
 import { createWorkManager } from './work.mjs';
+import { scanLocalSessions } from './localSessions.mjs';
 
 async function fetchRoster(haveIds) {
   const url = new URL(FLEET_URL);
@@ -222,6 +223,69 @@ function sampleDiffstat(cwd, baseRef, intentId, agentId) {
   };
 }
 
+/**
+ * Terminal-session presence: tell the server which Claude sessions exist in
+ * this repo (localSessions.mjs reads them off Claude's own on-disk state), so
+ * the Workbench can offer "adopt this terminal session as a tab". Best-effort
+ * in exactly the way the env/runtimes blocks are — a presence report that can
+ * fail a poll is worse than no presence at all — with three quiet economies:
+ * the scan runs at most once a minute (the reconcile loop ticks far faster), a
+ * report identical to the last DELIVERED one is not re-sent, and a 404 means
+ * an older server that has never heard of the endpoint, after which this
+ * process stops asking (a deploy that adds it also restarts nothing on this
+ * machine, so silence-until-restart costs one daemon restart, not a feature).
+ */
+const LOCAL_SESSIONS_URL = FLEET_URL.replace(/\/agents\/?$/, '/local-sessions');
+const LOCAL_SESSIONS_SCAN_MS = 60_000;
+// The web hides a report older than 10 minutes (presence must not linger as
+// fact after the machine dies), so an UNCHANGED report is re-sent inside that
+// window anyway — the re-send is the machine's heartbeat on this fact, and
+// suppressing it entirely would blank the strip while everything still holds.
+const LOCAL_SESSIONS_RESEND_MS = 5 * 60_000;
+let localSessionsUnsupported = false; // the server 404'd — quiet until restart
+let localSessionsScanAt = 0;
+let localSessionsSent = null; // last payload the server ACCEPTED, stringified
+let localSessionsSentAt = 0;
+async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
+  if (localSessionsUnsupported) return;
+  if (Date.now() - localSessionsScanAt < LOCAL_SESSIONS_SCAN_MS) return;
+  localSessionsScanAt = Date.now();
+  let payload;
+  try {
+    // scanLocalSessions orders deterministically, so this string only changes
+    // when the facts on disk do — the dedup below compares whole payloads.
+    payload = JSON.stringify({ sessions: scanLocalSessions({ repoRoot, excludeDirs }) });
+  } catch {
+    return; // presence must never throw into the poll loop
+  }
+  if (payload === localSessionsSent && Date.now() - localSessionsSentAt < LOCAL_SESSIONS_RESEND_MS)
+    return;
+  try {
+    const res = await fetch(LOCAL_SESSIONS_URL, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${FLEET_TOKEN}`,
+        'User-Agent': USER_AGENT,
+        'Content-Type': 'application/json',
+      },
+      signal: AbortSignal.timeout(15_000),
+      body: payload,
+    });
+    if (res.status === 404) {
+      localSessionsUnsupported = true; // older server — it REPLACED nothing here
+      return;
+    }
+    // Only an accepted report counts as sent; anything else forgets the
+    // last-sent payload so the next pass retries instead of dedup-suppressing
+    // a report the server never received.
+    localSessionsSent = res.ok ? payload : null;
+    localSessionsSentAt = res.ok ? Date.now() : 0;
+  } catch {
+    localSessionsSent = null;
+    localSessionsSentAt = 0;
+  }
+}
+
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
 // base between tasks (fresh conversation), resume in place while on a blocker.
 async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWork, getNext, getMcpUrl, isAlive, onChild, onTokenSuspect }) {
@@ -1754,6 +1818,10 @@ export async function runFleetDaemon() {
     // sessions are LIVE, and the guards above (chains, shipping) are populated
     // by the intake this same tick.
     retireWorkSessions(roster.activeWorkSessions);
+    // Terminal-session presence, throttled + dedup'd inside; never awaited —
+    // the daemon's own worktrees are carved out (a session the daemon spawned
+    // is already a tab, not something to offer adopting).
+    void maybeReportLocalSessions({ repoRoot, excludeDirs: [baseDir] });
     processJoinJobs(roster.joinJobs);
     processCleanupJobs(roster.cleanupJobs);
     const rosterIds = new Set(roster.agents.map((a) => a.agentId));

package/bin/lib/localSessions.mjs

@@ -0,0 +1,266 @@
+/**
+ * Terminal-session presence — which Claude Code sessions exist in THIS repo,
+ * read off Claude's own on-disk state. Nothing here is inference: the liveness
+ * registry (~/.claude/sessions/<pid>.json) says what is open right now, and the
+ * transcript store (~/.claude/projects/<munged-cwd>/<id>.jsonl) says what was.
+ * The daemon RELAYS both to the server so the Workbench can offer "adopt this
+ * terminal session as a tab" — activity, never capacity, and only ever facts
+ * the user could see by looking at their own machine.
+ *
+ * The one contract that matters to callers: NOTHING in this file throws. A
+ * presence scan runs inside the poll loop's best-effort tail, and a torn
+ * registry file or a vanished cwd is a session to skip, not an error to raise.
+ */
+
+import {
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  openSync,
+  readSync,
+  closeSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+const REPORT_CAP = 30;
+
+/** Path-prefix containment on already-realpath'd absolute paths. */
+const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
+
+/**
+ * Is this pid the SAME process the registry entry recorded?
+ *
+ * Registry entries go stale — Claude exits, the pid is recycled by something
+ * else, the file stays. `/proc/<pid>` existing only proves A process; the
+ * starttime (field 22 of /proc/<pid>/stat) proves it is THAT process. The comm
+ * field (parenthesised, may itself contain spaces and parens) makes naive
+ * whitespace-splitting wrong, so fields are counted from after the LAST ')':
+ * the first post-comm field is field 3, which puts starttime at index 19.
+ */
+function pidAlive(pid, procStart) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  let stat;
+  try {
+    stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+  } catch {
+    return false; // no /proc entry — the process is gone
+  }
+  if (procStart == null) return true; // nothing recorded to compare against
+  const close = stat.lastIndexOf(')');
+  if (close === -1) return false;
+  const fields = stat.slice(close + 1).trim().split(/\s+/);
+  return fields[19] === String(procStart);
+}
+
+/**
+ * Is a terminal Claude session with this id open on the machine RIGHT NOW?
+ *
+ * The adoption path asks this at the moment of adopting: forking a session
+ * while its terminal is still typing into it would put two Claudes on one
+ * conversation, which is the exact incoherence the Workbench's own locks
+ * exist to prevent.
+ */
+export function isTerminalSessionLive(sessionId) {
+  try {
+    const dir = join(homedir(), '.claude', 'sessions');
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith('.json')) continue;
+      let rec;
+      try {
+        rec = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+      } catch {
+        continue; // torn write / not JSON — not evidence of anything
+      }
+      if (rec?.sessionId !== sessionId) continue;
+      if (pidAlive(rec.pid, rec.procStart)) return true;
+    }
+  } catch {
+    /* registry unreadable — no proof of life is "not live" */
+  }
+  return false;
+}
+
+/**
+ * First transcript record that carries a cwd, from the file's head only.
+ *
+ * A transcript can be megabytes; the cwd/gitBranch identity rides on every
+ * record, so ~16KB from the front is enough to verify WHOSE session this is
+ * without paying to read the conversation. A file whose first cwd-bearing
+ * line does not parse (truncated at the window edge) is skipped, not retried
+ * deeper — this is presence, not forensics.
+ */
+function firstCwdRecord(file) {
+  let fd;
+  try {
+    fd = openSync(file, 'r');
+    const buf = Buffer.alloc(16384);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    for (const line of buf.subarray(0, n).toString('utf8').split('\n')) {
+      if (!line.includes('"cwd":"')) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec.cwd === 'string' && rec.cwd) return rec;
+      } catch {
+        /* an incomplete line at the window edge — try the next candidate */
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        /* best-effort */
+      }
+    }
+  }
+}
+
+/**
+ * Every Claude terminal session belonging to this repo: LIVE ones from the
+ * liveness registry, ENDED ones from the transcript store. Returns
+ * [{ id, cwd, live, lastActiveAt, branch? }], live first, then newest ended,
+ * capped at 30, deterministically ordered (so a stringified report only
+ * changes when the facts do).
+ *
+ * `excludeDirs` carves out the daemon's own worktrees: sessions the daemon
+ * itself spawned are tabs already, and offering to adopt one would be the
+ * product offering the user their own reflection.
+ */
+export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
+  const live = [];
+  const ended = [];
+  try {
+    let realRoot;
+    try {
+      realRoot = realpathSync(repoRoot);
+    } catch {
+      realRoot = String(repoRoot ?? '');
+    }
+    if (!realRoot) return [];
+    const excludes = [];
+    for (const d of excludeDirs) {
+      if (!d) continue;
+      try {
+        excludes.push(realpathSync(d));
+      } catch {
+        excludes.push(String(d)); // not on disk yet — keep the literal fence
+      }
+    }
+    const ours = (p) => inside(p, realRoot) && !excludes.some((e) => inside(p, e));
+
+    // ── LIVE: the registry, validated pid by pid ─────────────────────────
+    const nowIso = new Date().toISOString();
+    const liveIds = new Set();
+    let regNames = [];
+    try {
+      regNames = readdirSync(join(homedir(), '.claude', 'sessions'));
+    } catch {
+      /* no registry — no live sessions */
+    }
+    for (const name of regNames) {
+      if (!name.endsWith('.json')) continue; // .key files ride alongside
+      let rec;
+      try {
+        rec = JSON.parse(readFileSync(join(homedir(), '.claude', 'sessions', name), 'utf8'));
+      } catch {
+        continue;
+      }
+      if (!rec || typeof rec.sessionId !== 'string' || typeof rec.cwd !== 'string') continue;
+      if (liveIds.has(rec.sessionId)) continue;
+      if (!pidAlive(rec.pid, rec.procStart)) continue;
+      let cwd;
+      try {
+        cwd = realpathSync(rec.cwd);
+      } catch {
+        continue; // the directory is gone — nothing to point a tab at
+      }
+      if (!ours(cwd)) continue;
+      liveIds.add(rec.sessionId);
+      live.push({
+        id: rec.sessionId,
+        cwd,
+        live: true,
+        lastActiveAt: nowIso,
+        ...(typeof rec.gitBranch === 'string' && rec.gitBranch ? { branch: rec.gitBranch } : {}),
+      });
+    }
+    live.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+
+    // ── ENDED: the transcript store, verified file by file ───────────────
+    //
+    // The munged directory name is a PREFIX match on purpose: a session run in
+    // a SUBDIRECTORY of the repo munges to a longer name sharing the root's.
+    // But so does a sibling repo ('flowviant-two' shares 'flowviant' + '-'),
+    // which is why every candidate is verified against the cwd its own records
+    // embed rather than trusted on its directory name.
+    const munged = realRoot.replace(/[/.]/g, '-');
+    const projectsDir = join(homedir(), '.claude', 'projects');
+    let projDirs = [];
+    try {
+      projDirs = readdirSync(projectsDir);
+    } catch {
+      /* no transcript store — live sessions still report */
+    }
+    const cutoff = Date.now() - SEVEN_DAYS_MS;
+    const candidates = [];
+    for (const dirName of projDirs) {
+      if (dirName !== munged && !dirName.startsWith(`${munged}-`)) continue;
+      let entries = [];
+      try {
+        entries = readdirSync(join(projectsDir, dirName), { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const ent of entries) {
+        if (!ent.isFile() || !ent.name.endsWith('.jsonl')) continue; // top-level only
+        const id = ent.name.slice(0, -'.jsonl'.length);
+        if (!id || liveIds.has(id)) continue; // a live session outranks its own transcript
+        const file = join(projectsDir, dirName, ent.name);
+        let mtimeMs;
+        try {
+          mtimeMs = statSync(file).mtimeMs;
+        } catch {
+          continue;
+        }
+        if (mtimeMs < cutoff) continue; // week-old sessions are history, not presence
+        candidates.push({ id, file, mtimeMs });
+      }
+    }
+    // Newest first, then verify only as many as the cap still has room for —
+    // the verification read is the expensive step, so it is not spent on
+    // sessions the report would drop anyway.
+    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs || (a.id < b.id ? -1 : 1));
+    const room = Math.max(0, REPORT_CAP - Math.min(live.length, REPORT_CAP));
+    const endedIds = new Set();
+    for (const cand of candidates) {
+      if (ended.length >= room) break;
+      if (endedIds.has(cand.id)) continue; // one row per session, whatever dir names it
+      endedIds.add(cand.id);
+      const rec = firstCwdRecord(cand.file);
+      if (!rec) continue;
+      let cwd;
+      try {
+        cwd = realpathSync(rec.cwd);
+      } catch {
+        continue;
+      }
+      if (!ours(cwd)) continue;
+      ended.push({
+        id: cand.id,
+        cwd,
+        live: false,
+        lastActiveAt: new Date(cand.mtimeMs).toISOString(),
+        ...(typeof rec.gitBranch === 'string' && rec.gitBranch ? { branch: rec.gitBranch } : {}),
+      });
+    }
+  } catch {
+    /* presence must never throw into the poll loop — report what was gathered */
+  }
+  return [...live.slice(0, REPORT_CAP), ...ended];
+}

package/bin/lib/runtimes.mjs

@@ -310,9 +310,18 @@ export const RUNTIMES = {
      * strongest form of it available anywhere: `--append-system-prompt` sits
      * above the conversation rather than inside it.
      */
-    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [] }) {
+    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
       const a = [];
-      if (resume) a.push('--continue');
+      // ADOPTION — the first turn of a tab born from a terminal session.
+      // `--resume <id> --fork-session` finds the session globally (any cwd),
+      // carries its full context, and writes the FORK natively into THIS cwd's
+      // own store, leaving the original transcript untouched (measured on
+      // 2.1.234). From turn 2 on the plain `--continue` below resumes the fork
+      // where it now lives, so nothing downstream knows the tab was adopted.
+      // INSTEAD of --continue, never alongside it: they are the same decision
+      // ("what conversation is this?") answered two different ways.
+      if (adoptResumeId) a.push('--resume', adoptResumeId, '--fork-session');
+      else if (resume) a.push('--continue');
       a.push('-p', prompt, '--append-system-prompt', system);
       a.push(...mcp, ...resultSchemaArgs);
       a.push('--model', model || MODEL);
@@ -371,7 +380,12 @@ export const RUNTIMES = {
      * placed before it. Appending them after the positional is the kind of argv
      * that parses today and stops parsing on some future clap upgrade.
      */
-    args({ prompt, system, model, effort, resume, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [] }) {
+    args({ prompt, system, model, effort, resume, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
+      // Adoption resumes a CLAUDE terminal session — its transcript store, its
+      // fork semantics. Reaching here with an adopt id is a wiring mistake
+      // upstream, and it fails loudly on purpose: quietly dropping the flag
+      // would answer that session's held context with a different brain.
+      if (adoptResumeId) throw new Error('adoption is Claude-only — codex cannot resume a Claude terminal session');
       const a = ['exec'];
       if (resume) a.push('resume', '--last');
       a.push('--json');
@@ -610,7 +624,10 @@ export const RUNTIMES = {
      */
     profiles: ['build', 'wiki', 'consult'],
     mcp: null,
-    args({ prompt, system, model, effort, resume, profile = 'build', vaultDir, resultSchemaArgs = [] }) {
+    args({ prompt, system, model, effort, resume, profile = 'build', vaultDir, resultSchemaArgs = [], adoptResumeId }) {
+      // Same loud refusal as Codex: an adopt id names a Claude session, and no
+      // other runtime can resume one — see the claude builder for the contract.
+      if (adoptResumeId) throw new Error('adoption is Claude-only — agy cannot resume a Claude terminal session');
       const a = [];
       if (resume) a.push('--continue');
       // No system-prompt flag, same weakening as Codex: the contract rides in

package/bin/lib/work.mjs

@@ -15,16 +15,28 @@
  * two getters (the MCP URL and the lease TTL can change with any poll).
  */
 
-import { existsSync, rmSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  existsSync,
+  rmSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+  realpathSync,
+  statSync,
+  lstatSync,
+  mkdirSync,
+  cpSync,
+} from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { join } from 'node:path';
+import { join, dirname } from 'node:path';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, REFRESH_BEFORE_SECONDS } from './config.mjs';
-import { git, baseBranchName, isSafePathSegment } from './git.mjs';
+import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
 import { SYSTEM_WORK, WORK_TURN_KICKOFF } from './prompts.mjs';
 import { materializeInto, scrub as envScrub } from './env.mjs';
-import { detectRuntimes, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
+import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
+import { isTerminalSessionLive } from './localSessions.mjs';
 
 export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
@@ -178,14 +190,21 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * is the point. If the directory was retired but the branch survives, the
    * worktree re-attaches to the branch and the committed work is still there.
    */
-  const sessionWtFor = (sessionId) => {
+  const sessionWtFor = (sessionId, baseAt) => {
     if (!isSafePathSegment(sessionId)) return null;
     const wt = join(baseDir, 'sessions', sessionId);
     const fresh = !existsSync(wt);
     if (fresh) {
       const branch = `session/${sessionId}`;
+      // `baseAt` is the adoption override: a tab born from a terminal session
+      // branches from THAT checkout's HEAD, because the conversation being
+      // resumed was had against those commits — putting it on the project base
+      // would hand it a repo state it has never seen. Everything else is
+      // unchanged, the attach fallback included: a surviving branch already
+      // chose its base, and re-basing it here would move committed work.
+      const at = baseAt || baseRef;
       try {
-        git(['worktree', 'add', '-b', branch, wt, baseRef], repoRoot);
+        git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
       } catch {
         git(['worktree', 'prune'], repoRoot);
         try {
@@ -193,7 +212,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           git(['worktree', 'add', wt, branch], repoRoot);
         } catch {
           try {
-            git(['worktree', 'add', '-b', branch, wt, baseRef], repoRoot);
+            git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
           } catch {
             return null;
           }
@@ -233,6 +252,84 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     }
   };
 
+  /**
+   * Carry a terminal checkout's DIRTY state into a fresh adopt worktree. The
+   * source is strictly READ-ONLY — nothing here writes to it, because it is
+   * the human's own checkout and adoption promises to leave it exactly as the
+   * closed terminal did. Tracked changes travel as one binary patch staged
+   * through the worktree's PRIVATE git dir (invisible to status, dies with the
+   * tree); untracked files are copied one by one, skipping anything over 5MB.
+   *
+   * Returns '' or ONE bracketed line for the turn's prompt: a carry problem is
+   * the AGENT's to explain to the user, never a reason to fail the adoption —
+   * the conversation is the thing being adopted, and it resumes either way.
+   */
+  const carryDirtyState = (srcCwd, wt) => {
+    const problems = [];
+    try {
+      // A Buffer, not utf8: a `--binary` patch (and a hunk from a non-UTF-8
+      // text file) must round-trip byte-exact or the apply corrupts what it
+      // carries. 64MB of headroom — a dirtier tree than that fails the read
+      // here and is SAID, below, rather than half-applied.
+      const patch = execFileSync('git', ['diff', 'HEAD', '--binary'], {
+        cwd: srcCwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 64 * 1024 * 1024,
+      });
+      if (patch.length) {
+        const patchPath = sessionMetaPath(wt, 'flowviant-adopt.patch');
+        if (!patchPath) throw new Error('no private git dir to stage the patch in');
+        try {
+          writeFileSync(patchPath, patch);
+          git(['apply', '--whitespace=nowarn', patchPath], wt);
+        } finally {
+          try {
+            rmSync(patchPath, { force: true });
+          } catch {
+            /* best-effort — the private git dir dies with the worktree anyway */
+          }
+        }
+      }
+    } catch {
+      problems.push(
+        'their uncommitted TRACKED changes did not carry over (they are still in the terminal checkout, untouched)'
+      );
+    }
+    try {
+      const skipped = [];
+      for (const rel of splitNul(
+        gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], srcCwd)
+      )) {
+        try {
+          const from = join(srcCwd, rel);
+          // lstat, not stat: a symlink is carried as itself, and its own size
+          // is what the 5MB budget judges — never the file it points at.
+          if (lstatSync(from).size > 5 * 1024 * 1024) {
+            skipped.push(rel);
+            continue;
+          }
+          const to = join(wt, rel);
+          mkdirSync(dirname(to), { recursive: true });
+          cpSync(from, to);
+        } catch {
+          skipped.push(rel);
+        }
+      }
+      if (skipped.length) {
+        problems.push(
+          `${skipped.length} untracked file${skipped.length === 1 ? '' : 's'} did not carry (over 5MB or unreadable): ${skipped.slice(0, 5).join(', ')}${skipped.length > 5 ? ', …' : ''}`
+        );
+      }
+    } catch {
+      problems.push(
+        'untracked files could not be listed in the terminal checkout, so none were carried'
+      );
+    }
+    return problems.length
+      ? `[ADOPTION NOTE from the daemon — tell the user plainly at the start of your reply: ${problems.join('; ')}.]`
+      : '';
+  };
+
   /**
    * WHICH CLI drives this session — picked ONCE, on the first turn, and pinned
    * in the worktree's meta dir. The held context belongs to the CLI that made
@@ -241,8 +338,17 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * same reason). If the pinned CLI has left the machine, the turn settles
    * honestly instead of substituting. A retired-and-reattached directory has
    * no marker and no held context either, so re-picking there is correct.
-   * Returns { id } | { id: null } (nothing installed) | { missing: label }.
+   * Returns { id } | { id: null } (nothing installed) | { missing: label } |
+   * { unsupported: label } (pinned to a runtime no session can run on).
+   *
+   * SESSION-CAPABLE means rt.mcp is truthy, and the gate is not optional:
+   * a session turn hands its per-session token over a real MCP config, so
+   * `pickRuntimeFor('build')` is the WRONG question here — it also says yes
+   * to the MEDIATED build path (Antigravity, mcp: null), and a session pinned
+   * that way threw in mcpFor on every turn, failing the tab with an internal
+   * error instead of a sentence.
    */
+  const sessionCapable = (rid) => Boolean(RUNTIMES[rid]?.mcp) && canRun(RUNTIMES[rid], 'build');
   const sessionRuntime = (wt) => {
     const marker = sessionMetaPath(wt, 'flowviant-runtime');
     let pinned = null;
@@ -254,10 +360,19 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       }
     }
     if (pinned && RUNTIMES[pinned]) {
+      // A pin that names a non-session-capable runtime is settled honestly by
+      // the caller, not silently re-picked: re-picking would hand the held
+      // context to a different brain, which is the exact substitution the pin
+      // exists to prevent.
+      if (!sessionCapable(pinned)) return { unsupported: RUNTIMES[pinned].label || pinned };
       const installed = detectRuntimes().find((r) => r.id === pinned)?.installed;
       return installed ? { id: pinned } : { missing: RUNTIMES[pinned].label || pinned };
     }
-    const id = pickRuntimeFor('build');
+    // The fresh pick, gated the same way — Claude first when it qualifies, for
+    // the reason pickRuntimeFor gives: the prompts were tuned against it.
+    const rows = detectRuntimes();
+    const okFor = (rid) => sessionCapable(rid) && Boolean(rows.find((r) => r.id === rid)?.installed);
+    const id = okFor('claude') ? 'claude' : (Object.keys(RUNTIMES).find(okFor) ?? null);
     if (!id) return { id: null };
     if (marker) {
       try {
@@ -394,7 +509,110 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           note(
             `${c.cyan('tab')} ${c.dim(`— ${job.askedByName || 'the owner'} in "${job.sessionName || 'a session'}"`)}`
           );
-          const dir = sessionWtFor(job.sessionId);
+          // WHICH BRAIN the roster says this tab speaks (null/absent = Claude,
+          // which is what every tab ran on until now). The phase-2 hook: this
+          // daemon drives Claude tabs only, and a runtime it cannot honor is
+          // settled honestly — never answered by a different brain wearing the
+          // session's name.
+          if (job.runtime && job.runtime !== 'claude') {
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: `This machine's daemon serves Claude tabs only for now — runtime '${job.runtime}' isn't supported yet.`,
+            });
+            return;
+          }
+          // ── ADOPTION: a tab born from a TERMINAL session ────────────────
+          // The server sends `adopt {id, cwd}` only while the session has no
+          // sessionRef — no turn has ever spoken from a worktree here — and
+          // the first turn resumes the terminal conversation by forking it
+          // into the tab's own worktree. Everything the server asserts is
+          // re-validated MACHINE-side: the id shape, the source directory,
+          // and — decisive — that the terminal is actually closed, because
+          // forking a session someone is still typing into puts two Claudes
+          // on one conversation.
+          const adopting = Boolean(job.adopt) && !job.sessionRef;
+          let srcHead = null;
+          let adoptSrc = null; // the validated, realpath'd source checkout
+          if (adopting) {
+            if (
+              typeof job.adopt.id !== 'string' ||
+              !/^[0-9a-f][0-9a-f-]{6,62}$/i.test(job.adopt.id)
+            ) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer: 'that terminal session id is not one this machine can resume',
+              });
+              return;
+            }
+            let srcCwd = null;
+            try {
+              srcCwd = realpathSync(String(job.adopt.cwd ?? ''));
+              if (!statSync(srcCwd).isDirectory()) srcCwd = null;
+            } catch {
+              srcCwd = null;
+            }
+            if (!srcCwd) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer: "the terminal session's directory no longer exists on the machine",
+              });
+              return;
+            }
+            // Inside the repo, outside the daemon's own worktrees: an adopt
+            // source is a HUMAN's checkout, and one of our directories showing
+            // up here means a stale or confused offer, not a session to fork.
+            const under = (p, root) =>
+              p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
+            let realRoot = repoRoot;
+            let realBase = baseDir;
+            try {
+              realRoot = realpathSync(repoRoot);
+            } catch {
+              /* keep the literal path */
+            }
+            try {
+              realBase = realpathSync(baseDir);
+            } catch {
+              /* keep the literal path */
+            }
+            if (!under(srcCwd, realRoot)) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer: "the terminal session's directory is outside this project's repository",
+              });
+              return;
+            }
+            if (under(srcCwd, realBase)) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  "that directory is one of the daemon's own worktrees — its session is already a tab, not something to adopt",
+              });
+              return;
+            }
+            try {
+              srcHead = git(['rev-parse', 'HEAD'], srcCwd);
+            } catch {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  "the terminal session's directory is not a usable git checkout (no HEAD to branch from)",
+              });
+              return;
+            }
+            if (isTerminalSessionLive(job.adopt.id)) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  'That terminal session is still open on the machine — close it there first, then adopt.',
+              });
+              return;
+            }
+            adoptSrc = srcCwd;
+          }
+          // Based at the SOURCE's HEAD when adopting — the resumed
+          // conversation was had against those commits, not the project base.
+          const dir = sessionWtFor(job.sessionId, adopting ? srcHead : undefined);
           if (!dir) {
             await settleWorkTurn(job.id, {
               ok: false,
@@ -422,6 +640,17 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             });
             return;
           }
+          if (rt.unsupported) {
+            // A pin from before the session-capable gate existed can name a
+            // runtime no tab can run on (Antigravity has no MCP config, and
+            // the session's whole control plane rides one). An honest sentence
+            // beats the mcpFor throw this used to crash into every turn.
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: `this session is pinned to ${rt.unsupported}, which cannot drive a Workbench tab on this machine — open a new tab`,
+            });
+            return;
+          }
           if (!rt.id) {
             await settleWorkTurn(job.id, {
               ok: false,
@@ -430,6 +659,17 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             });
             return;
           }
+          if (adopting && rt.id !== 'claude') {
+            // The adopt id names a CLAUDE conversation; only claude can fork
+            // it (--resume --fork-session). The runtimes registry backstops
+            // this with a loud throw, but a sentence here beats a stack there.
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer:
+                'adopting a terminal session needs Claude Code on the machine — install it, then try again',
+            });
+            return;
+          }
           let mint = await mintWorkToken(job.sessionId);
           if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
           if (mint?.gone) {
@@ -454,6 +694,13 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // just opened. Anything else starts fresh IN the existing worktree —
           // never a reset; the dirty state is the session.
           const resume = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
+          // The dirty carry, on the adopt worktree's FIRST life only: a
+          // re-attempted adoption (the directory already exists) carried what
+          // it could the first time, and re-applying would double it. A carry
+          // problem never fails the adoption — it becomes one bracketed line
+          // in the prompt, so the AGENT tells the user what stayed behind.
+          let carryNote = '';
+          if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt);
           const mcp = mcpFor(rt.id, mint.token, getMcpUrl());
           // Attempts count RUNS: the infra refusals above consumed nothing and
           // settled on their own terms.
@@ -465,9 +712,14 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               prompt: WORK_TURN_KICKOFF({
                 sessionId: job.sessionId,
                 sessionName: job.sessionName,
-                message: job.body,
+                message: carryNote ? `${job.body}\n\n${carryNote}` : job.body,
                 askedByName: job.askedByName,
               }),
+              // The adopt turn resumes the TERMINAL conversation by forking it
+              // into this cwd (claude: --resume <id> --fork-session). After it
+              // speaks once, the fork lives natively here and turn 2+ is the
+              // ordinary --continue resume path, unchanged.
+              ...(adopting ? { adoptResumeId: job.adopt.id } : {}),
               system: SYSTEM_WORK,
               cwd: dir.wt,
               mcpArgs: mcp.args,
@@ -491,8 +743,13 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             // A resume that produced NOTHING usually means the held
             // conversation is gone (a first turn that crashed before writing
             // state, a wiped CLI dir). Retry once fresh in the SAME worktree —
-            // never reset — instead of bricking the tab forever.
-            if (resume && !(out || '').trim()) out = await runTurn({ ...turnArgs, resume: false });
+            // never reset — instead of bricking the tab forever. NEVER on an
+            // adopt turn (`resume` is structurally false there, and the guard
+            // says so out loud): a fresh conversation would silently discard
+            // the adoption and answer as a new session wearing its name — the
+            // empty adopt turn settles failed below instead.
+            if (!adopting && resume && !(out || '').trim())
+              out = await runTurn({ ...turnArgs, resume: false });
           } finally {
             for (const ch of spawned) workChildren.delete(ch);
             if (lockPath) {
@@ -509,6 +766,18 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // workers' no-sentinel case) — drop the cached token so the next
           // turn re-mints instead of failing the same way forever.
           if (!answer) workTokens.delete(job.sessionId);
+          if (adopting && !answer) {
+            // The fork came back with nothing — the terminal session's
+            // transcript is most likely gone (cleaned, expired, deleted). Say
+            // exactly that; no sessionRef is recorded, so the server keeps
+            // offering the adoption and a retry after the user checks is cheap.
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: "Couldn't resume the terminal session — it may have been removed.",
+            });
+            warn('adopt turn produced no output — settled as failed');
+            return;
+          }
           await settleWorkTurn(job.id, {
             ok: answer.length > 0,
             answer:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.44.1",
+  "version": "0.45.0",
   "description": "Run your own coding CLIs as headless build agents for Flowviant — Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {