flowviant 0.44.1 → 0.47.0

package/bin/lib/claude.mjs

@@ -233,7 +233,7 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText }) {
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
     if (!rt.args) {
@@ -276,6 +276,13 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       resume,
       streamJson,
       profile,
+      // Adopting a terminal session (work.mjs): Claude turns it into
+      // `--resume <id> --fork-session` (a FORK — the original is untouched);
+      // agy turns it into `--conversation <id>` (a MOVE — agy has no fork, the
+      // tab continues the terminal conversation itself). Codex THROWS on it,
+      // so a mis-wired adoption fails as a loud turn error rather than a
+      // silent fresh conversation wearing an adopted session's name.
+      adoptResumeId,
       // Only the wiki profile uses it, but it is passed unconditionally: a
       // runtime that can path-scope its writes needs to know WHERE the vault is,
       // and Claude — which cannot — simply ignores it.
@@ -291,6 +298,13 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       // positional, so a flag after it is a flag in the wrong place.
       // Wiki-vault turns are pure file work and pass neither — no MCP at all.
       mcp: mcpConfig ? ['--mcp-config', mcpConfig] : (mcpArgs ?? []),
+      // Resuming a SPECIFIC held conversation by its own id (work.mjs, codex
+      // sessions). Runtimes without a by-id resume ignore it and keep their
+      // `resume` behavior unchanged.
+      resumeThreadId,
+      // agy's by-id resume (work.mjs, antigravity sessions): the conversation
+      // id learned from the adopt hint or the cwd registry after a turn.
+      resumeConversationId,
     });
     // Whatever this machine is signed in with, we use. We do NOT pick.
     //
@@ -333,6 +347,10 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
         if (!rt.parse) return handleStreamLine(line, { cwd, emit, onActivity, appendText });
         const ev = rt.parse(line, cwd);
         if (!ev) return;
+        // The conversation id, when the runtime announces one (codex's
+        // thread.started). Purely additive: callers that pass no onThreadId —
+        // every dispatch path — see zero behavior change.
+        if (ev.threadId) onThreadId?.(ev.threadId);
         if (ev.text) appendText(ev.text);
         if (ev.activity) {
           emit(`${ev.activity.label}\n`);

package/bin/lib/fleet.mjs

@@ -84,6 +84,7 @@ import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 import { machineSnapshot } from './resources.mjs';
 import { detectRuntimes, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
 import { createWorkManager } from './work.mjs';
+import { scanLocalSessions } from './localSessions.mjs';
 
 async function fetchRoster(haveIds) {
   const url = new URL(FLEET_URL);
@@ -93,6 +94,13 @@ async function fetchRoster(haveIds) {
   // machine knows its cores, its RAM and whose Claude quota is being spent.
   // Older servers ignore the param, so sending it is always safe.
   url.searchParams.set('capacity', String(MAX_CONCURRENT));
+  // WHICH DAEMON this machine runs, so the server can gate version-dependent
+  // work — codex Workbench tabs are only created for machines whose daemon can
+  // actually serve them (dv >= 0.46.0). The same source the self-update check
+  // compares against the roster's daemon.latest (config.mjs VERSION, read off
+  // our own package.json). Older servers ignore unknown params, so sending it
+  // unconditionally is always safe.
+  url.searchParams.set('dv', VERSION);
   // WHICH CLIs this machine actually has, so the app can stop guessing.
   //
   // Until now every surface that listed Gemini or Codex said "not wired up yet"
@@ -222,6 +230,69 @@ function sampleDiffstat(cwd, baseRef, intentId, agentId) {
   };
 }
 
+/**
+ * Terminal-session presence: tell the server which Claude sessions exist in
+ * this repo (localSessions.mjs reads them off Claude's own on-disk state), so
+ * the Workbench can offer "adopt this terminal session as a tab". Best-effort
+ * in exactly the way the env/runtimes blocks are — a presence report that can
+ * fail a poll is worse than no presence at all — with three quiet economies:
+ * the scan runs at most once a minute (the reconcile loop ticks far faster), a
+ * report identical to the last DELIVERED one is not re-sent, and a 404 means
+ * an older server that has never heard of the endpoint, after which this
+ * process stops asking (a deploy that adds it also restarts nothing on this
+ * machine, so silence-until-restart costs one daemon restart, not a feature).
+ */
+const LOCAL_SESSIONS_URL = FLEET_URL.replace(/\/agents\/?$/, '/local-sessions');
+const LOCAL_SESSIONS_SCAN_MS = 60_000;
+// The web hides a report older than 10 minutes (presence must not linger as
+// fact after the machine dies), so an UNCHANGED report is re-sent inside that
+// window anyway — the re-send is the machine's heartbeat on this fact, and
+// suppressing it entirely would blank the strip while everything still holds.
+const LOCAL_SESSIONS_RESEND_MS = 5 * 60_000;
+let localSessionsUnsupported = false; // the server 404'd — quiet until restart
+let localSessionsScanAt = 0;
+let localSessionsSent = null; // last payload the server ACCEPTED, stringified
+let localSessionsSentAt = 0;
+async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
+  if (localSessionsUnsupported) return;
+  if (Date.now() - localSessionsScanAt < LOCAL_SESSIONS_SCAN_MS) return;
+  localSessionsScanAt = Date.now();
+  let payload;
+  try {
+    // scanLocalSessions orders deterministically, so this string only changes
+    // when the facts on disk do — the dedup below compares whole payloads.
+    payload = JSON.stringify({ sessions: scanLocalSessions({ repoRoot, excludeDirs }) });
+  } catch {
+    return; // presence must never throw into the poll loop
+  }
+  if (payload === localSessionsSent && Date.now() - localSessionsSentAt < LOCAL_SESSIONS_RESEND_MS)
+    return;
+  try {
+    const res = await fetch(LOCAL_SESSIONS_URL, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${FLEET_TOKEN}`,
+        'User-Agent': USER_AGENT,
+        'Content-Type': 'application/json',
+      },
+      signal: AbortSignal.timeout(15_000),
+      body: payload,
+    });
+    if (res.status === 404) {
+      localSessionsUnsupported = true; // older server — it REPLACED nothing here
+      return;
+    }
+    // Only an accepted report counts as sent; anything else forgets the
+    // last-sent payload so the next pass retries instead of dedup-suppressing
+    // a report the server never received.
+    localSessionsSent = res.ok ? payload : null;
+    localSessionsSentAt = res.ok ? Date.now() : 0;
+  } catch {
+    localSessionsSent = null;
+    localSessionsSentAt = 0;
+  }
+}
+
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
 // base between tasks (fresh conversation), resume in place while on a blocker.
 async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWork, getNext, getMcpUrl, isAlive, onChild, onTokenSuspect }) {
@@ -1754,6 +1825,10 @@ export async function runFleetDaemon() {
     // sessions are LIVE, and the guards above (chains, shipping) are populated
     // by the intake this same tick.
     retireWorkSessions(roster.activeWorkSessions);
+    // Terminal-session presence, throttled + dedup'd inside; never awaited —
+    // the daemon's own worktrees are carved out (a session the daemon spawned
+    // is already a tab, not something to offer adopting).
+    void maybeReportLocalSessions({ repoRoot, excludeDirs: [baseDir] });
     processJoinJobs(roster.joinJobs);
     processCleanupJobs(roster.cleanupJobs);
     const rosterIds = new Set(roster.agents.map((a) => a.agentId));

package/bin/lib/localSessions.mjs

@@ -0,0 +1,398 @@
+/**
+ * Terminal-session presence — which Claude Code sessions exist in THIS repo,
+ * read off Claude's own on-disk state. Nothing here is inference: the liveness
+ * registry (~/.claude/sessions/<pid>.json) says what is open right now, and the
+ * transcript store (~/.claude/projects/<munged-cwd>/<id>.jsonl) says what was.
+ * The daemon RELAYS both to the server so the Workbench can offer "adopt this
+ * terminal session as a tab" — activity, never capacity, and only ever facts
+ * the user could see by looking at their own machine.
+ *
+ * The one contract that matters to callers: NOTHING in this file throws. A
+ * presence scan runs inside the poll loop's best-effort tail, and a torn
+ * registry file or a vanished cwd is a session to skip, not an error to raise.
+ */
+
+import {
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  openSync,
+  readSync,
+  closeSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+const REPORT_CAP = 30;
+
+/** Path-prefix containment on already-realpath'd absolute paths. */
+const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
+
+/**
+ * Is this pid the SAME process the registry entry recorded?
+ *
+ * Registry entries go stale — Claude exits, the pid is recycled by something
+ * else, the file stays. `/proc/<pid>` existing only proves A process; the
+ * starttime (field 22 of /proc/<pid>/stat) proves it is THAT process. The comm
+ * field (parenthesised, may itself contain spaces and parens) makes naive
+ * whitespace-splitting wrong, so fields are counted from after the LAST ')':
+ * the first post-comm field is field 3, which puts starttime at index 19.
+ */
+function pidAlive(pid, procStart) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  let stat;
+  try {
+    stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+  } catch {
+    return false; // no /proc entry — the process is gone
+  }
+  if (procStart == null) return true; // nothing recorded to compare against
+  const close = stat.lastIndexOf(')');
+  if (close === -1) return false;
+  const fields = stat.slice(close + 1).trim().split(/\s+/);
+  return fields[19] === String(procStart);
+}
+
+/**
+ * Is a terminal Claude session with this id open on the machine RIGHT NOW?
+ *
+ * The adoption path asks this at the moment of adopting: forking a session
+ * while its terminal is still typing into it would put two Claudes on one
+ * conversation, which is the exact incoherence the Workbench's own locks
+ * exist to prevent.
+ */
+export function isTerminalSessionLive(sessionId) {
+  try {
+    const dir = join(homedir(), '.claude', 'sessions');
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith('.json')) continue;
+      let rec;
+      try {
+        rec = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+      } catch {
+        continue; // torn write / not JSON — not evidence of anything
+      }
+      if (rec?.sessionId !== sessionId) continue;
+      if (pidAlive(rec.pid, rec.procStart)) return true;
+    }
+  } catch {
+    /* registry unreadable — no proof of life is "not live" */
+  }
+  return false;
+}
+
+/**
+ * First transcript record that carries a cwd, from the file's head only.
+ *
+ * A transcript can be megabytes; the cwd/gitBranch identity rides on every
+ * record, so ~16KB from the front is enough to verify WHOSE session this is
+ * without paying to read the conversation. A file whose first cwd-bearing
+ * line does not parse (truncated at the window edge) is skipped, not retried
+ * deeper — this is presence, not forensics.
+ */
+function firstCwdRecord(file) {
+  let fd;
+  try {
+    fd = openSync(file, 'r');
+    const buf = Buffer.alloc(16384);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    for (const line of buf.subarray(0, n).toString('utf8').split('\n')) {
+      if (!line.includes('"cwd":"')) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec.cwd === 'string' && rec.cwd) return rec;
+      } catch {
+        /* an incomplete line at the window edge — try the next candidate */
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        /* best-effort */
+      }
+    }
+  }
+}
+
+/**
+ * Every Claude terminal session belonging to this repo: LIVE ones from the
+ * liveness registry, ENDED ones from the transcript store. Returns
+ * [{ id, cwd, live, lastActiveAt, branch? }], live first, then newest ended,
+ * capped at 30, deterministically ordered (so a stringified report only
+ * changes when the facts do).
+ *
+ * `excludeDirs` carves out the daemon's own worktrees: sessions the daemon
+ * itself spawned are tabs already, and offering to adopt one would be the
+ * product offering the user their own reflection.
+ */
+export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
+  const live = [];
+  const ended = [];
+  try {
+    let realRoot;
+    try {
+      realRoot = realpathSync(repoRoot);
+    } catch {
+      realRoot = String(repoRoot ?? '');
+    }
+    if (!realRoot) return [];
+    const excludes = [];
+    for (const d of excludeDirs) {
+      if (!d) continue;
+      try {
+        excludes.push(realpathSync(d));
+      } catch {
+        excludes.push(String(d)); // not on disk yet — keep the literal fence
+      }
+    }
+    const ours = (p) => inside(p, realRoot) && !excludes.some((e) => inside(p, e));
+
+    // ── LIVE: the registry, validated pid by pid ─────────────────────────
+    const nowIso = new Date().toISOString();
+    const liveIds = new Set();
+    let regNames = [];
+    try {
+      regNames = readdirSync(join(homedir(), '.claude', 'sessions'));
+    } catch {
+      /* no registry — no live sessions */
+    }
+    for (const name of regNames) {
+      if (!name.endsWith('.json')) continue; // .key files ride alongside
+      let rec;
+      try {
+        rec = JSON.parse(readFileSync(join(homedir(), '.claude', 'sessions', name), 'utf8'));
+      } catch {
+        continue;
+      }
+      if (!rec || typeof rec.sessionId !== 'string' || typeof rec.cwd !== 'string') continue;
+      if (liveIds.has(rec.sessionId)) continue;
+      if (!pidAlive(rec.pid, rec.procStart)) continue;
+      let cwd;
+      try {
+        cwd = realpathSync(rec.cwd);
+      } catch {
+        continue; // the directory is gone — nothing to point a tab at
+      }
+      if (!ours(cwd)) continue;
+      liveIds.add(rec.sessionId);
+      live.push({
+        id: rec.sessionId,
+        cwd,
+        live: true,
+        lastActiveAt: nowIso,
+        ...(typeof rec.gitBranch === 'string' && rec.gitBranch ? { branch: rec.gitBranch } : {}),
+      });
+    }
+    live.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+
+    // ── ENDED: the transcript store, verified file by file ───────────────
+    //
+    // The munged directory name is a PREFIX match on purpose: a session run in
+    // a SUBDIRECTORY of the repo munges to a longer name sharing the root's.
+    // But so does a sibling repo ('flowviant-two' shares 'flowviant' + '-'),
+    // which is why every candidate is verified against the cwd its own records
+    // embed rather than trusted on its directory name.
+    const munged = realRoot.replace(/[/.]/g, '-');
+    const projectsDir = join(homedir(), '.claude', 'projects');
+    let projDirs = [];
+    try {
+      projDirs = readdirSync(projectsDir);
+    } catch {
+      /* no transcript store — live sessions still report */
+    }
+    const cutoff = Date.now() - SEVEN_DAYS_MS;
+    const candidates = [];
+    for (const dirName of projDirs) {
+      if (dirName !== munged && !dirName.startsWith(`${munged}-`)) continue;
+      let entries = [];
+      try {
+        entries = readdirSync(join(projectsDir, dirName), { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const ent of entries) {
+        if (!ent.isFile() || !ent.name.endsWith('.jsonl')) continue; // top-level only
+        const id = ent.name.slice(0, -'.jsonl'.length);
+        if (!id || liveIds.has(id)) continue; // a live session outranks its own transcript
+        const file = join(projectsDir, dirName, ent.name);
+        let mtimeMs;
+        try {
+          mtimeMs = statSync(file).mtimeMs;
+        } catch {
+          continue;
+        }
+        if (mtimeMs < cutoff) continue; // week-old sessions are history, not presence
+        candidates.push({ id, file, mtimeMs });
+      }
+    }
+    // Newest first, then verify only as many as the cap still has room for —
+    // the verification read is the expensive step, so it is not spent on
+    // sessions the report would drop anyway.
+    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs || (a.id < b.id ? -1 : 1));
+    const room = Math.max(0, REPORT_CAP - Math.min(live.length, REPORT_CAP));
+    const endedIds = new Set();
+    for (const cand of candidates) {
+      if (ended.length >= room) break;
+      if (endedIds.has(cand.id)) continue; // one row per session, whatever dir names it
+      endedIds.add(cand.id);
+      const rec = firstCwdRecord(cand.file);
+      if (!rec) continue;
+      let cwd;
+      try {
+        cwd = realpathSync(rec.cwd);
+      } catch {
+        continue;
+      }
+      if (!ours(cwd)) continue;
+      ended.push({
+        id: cand.id,
+        cwd,
+        live: false,
+        lastActiveAt: new Date(cand.mtimeMs).toISOString(),
+        ...(typeof rec.gitBranch === 'string' && rec.gitBranch ? { branch: rec.gitBranch } : {}),
+      });
+    }
+  } catch {
+    /* presence must never throw into the poll loop — report what was gathered */
+  }
+  const claude = [...live.slice(0, REPORT_CAP), ...ended];
+  // agy rides in whatever room the cap leaves — Claude sessions first, they
+  // are the ones adoption serves best (fork, never move).
+  const agy = scanAgyConversations({ repoRoot, excludeDirs }).slice(
+    0,
+    Math.max(0, REPORT_CAP - claude.length)
+  );
+  return [...claude, ...agy];
+}
+
+// ── Antigravity (agy) ──────────────────────────────────────────────────────
+//
+// agy's store is nothing like Claude's: one SQLite db per conversation at
+// ~/.gemini/antigravity-cli/conversations/<uuid>.db (global, not cwd-keyed),
+// no per-pid liveness registry that survives contact (the presence/*.lock
+// files sit untouched by real runs — measured), and the only cwd mapping is
+// cache/last_conversations.json: {cwd → the LAST conversation run there}.
+// So the honest agy report is a SUBSET — the last conversation per directory
+// inside this repo — and that is exactly the one `agy --continue` would give
+// the person at that keyboard, i.e. the one worth offering to adopt.
+
+const AGY_DIR = () => join(homedir(), '.gemini', 'antigravity-cli');
+const AGY_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Newest write to the conversation's store — the wal carries recent turns,
+ *  so its mtime (not the db's) is the real "last active" (measured: a resume
+ *  touched db+wal, and never the presence lock). 0 = no such conversation. */
+function agyLastWriteMs(id) {
+  if (!AGY_UUID_RE.test(id)) return 0;
+  let newest = 0;
+  for (const suffix of ['.db', '.db-wal']) {
+    try {
+      const t = statSync(join(AGY_DIR(), 'conversations', `${id}${suffix}`)).mtimeMs;
+      if (t > newest) newest = t;
+    } catch {
+      /* absent half is fine — the db alone still answers */
+    }
+  }
+  return newest;
+}
+
+/** Any agy process on the machine right now? /proc comm scan — cheap at the
+ *  60s cadence, and the only liveness signal agy leaves (locks are inert). */
+function agyProcessAlive() {
+  try {
+    for (const name of readdirSync('/proc')) {
+      if (!/^\d+$/.test(name)) continue;
+      try {
+        if (readFileSync(`/proc/${name}/comm`, 'utf8').trim() === 'agy') return true;
+      } catch {
+        /* raced exit — keep scanning */
+      }
+    }
+  } catch {
+    /* no /proc — call nothing live rather than everything */
+  }
+  return false;
+}
+
+/**
+ * Is this agy conversation being driven RIGHT NOW? agy cannot answer
+ * per-conversation, so this is the conservative composite: an agy process
+ * exists AND this conversation's store was written in the last 10 minutes.
+ * Adoption is a MOVE for agy (no fork exists — measured, "trajectory not
+ * found" on a renamed copy), so refusing a maybe-live conversation for a few
+ * minutes costs a retry; adopting an actually-live one puts two drivers on
+ * one store.
+ */
+const AGY_LIVE_WINDOW_MS = 10 * 60 * 1000;
+export function isAgyConversationLive(id) {
+  try {
+    if (!agyProcessAlive()) return false;
+    const t = agyLastWriteMs(id);
+    return t > 0 && Date.now() - t < AGY_LIVE_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+
+/** The repo's agy conversations, via the cwd registry — see the section
+ *  comment for why this is deliberately a subset. */
+function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
+  const out = [];
+  try {
+    let realRoot;
+    try {
+      realRoot = realpathSync(repoRoot);
+    } catch {
+      return out;
+    }
+    const excludes = [];
+    for (const d of excludeDirs) {
+      if (!d) continue;
+      try {
+        excludes.push(realpathSync(d));
+      } catch {
+        excludes.push(String(d));
+      }
+    }
+    const ours = (p) => inside(p, realRoot) && !excludes.some((e) => inside(p, e));
+    const raw = readFileSync(join(AGY_DIR(), 'cache', 'last_conversations.json'), 'utf8');
+    const map = JSON.parse(raw);
+    if (!map || typeof map !== 'object') return out;
+    const cutoff = Date.now() - SEVEN_DAYS_MS;
+    const processUp = agyProcessAlive();
+    for (const [cwd, id] of Object.entries(map)) {
+      if (typeof id !== 'string' || !AGY_UUID_RE.test(id)) continue;
+      let real;
+      try {
+        real = realpathSync(cwd);
+      } catch {
+        continue; // the directory is gone — nothing to point a tab at
+      }
+      if (!ours(real)) continue;
+      const lastMs = agyLastWriteMs(id);
+      if (!lastMs || lastMs < cutoff) continue;
+      out.push({
+        id,
+        cwd: real,
+        live: processUp && Date.now() - lastMs < AGY_LIVE_WINDOW_MS,
+        lastActiveAt: new Date(lastMs).toISOString(),
+        runtime: 'antigravity',
+      });
+    }
+    out.sort(
+      (a, b) =>
+        (b.lastActiveAt < a.lastActiveAt ? -1 : b.lastActiveAt > a.lastActiveAt ? 1 : 0) ||
+        (a.id < b.id ? -1 : 1)
+    );
+  } catch {
+    /* no agy on this machine, or an unreadable registry — nothing to report */
+  }
+  return out;
+}

package/bin/lib/prompts.mjs

@@ -486,6 +486,41 @@ the way, say so — fixing it is allowed if it's small and obviously wanted.
 
 Write plain Markdown for a person watching a live session.`;
 
+/**
+ * The PLAIN tab — a work session on a runtime that cannot mount MCP
+ * (Antigravity: its server list is machine-wide, measured). No Flowviant
+ * tools means no streaming, no cards, no purpose line — and the product
+ * stays honest anyway: the final answer is delivered by the daemon's own
+ * report, an uncarded session's rail says "no card yet" (a readout, not a
+ * failure), and ship-time reconciliation turns every branch commit into the
+ * ledger's record. What this prompt must NOT do is pretend the tools exist,
+ * or apologize for their absence every turn.
+ */
+export const SYSTEM_WORK_PLAIN = `You are the human's own coding agent, working WITH them in their repository.
+This is a persistent session — a tab they keep open — and it should feel like
+working in a terminal: they talk, you work.
+
+MECHANICS OF THIS TAB:
+
+1. THIS WORKTREE IS THE SESSION. You are on this tab's own branch. Edit freely,
+   commit as coherent units complete — small, honest commits with real
+   messages. Uncommitted state survives between turns; this directory is yours.
+2. YOUR FINAL MESSAGE IS YOUR REPLY. It is delivered into the tab when the turn
+   ends — there is no live streaming from this runtime, so make the final
+   message the complete, self-contained report of what you did and found.
+3. YOU HAVE NO FLOWVIANT TOOLS in this session — no cards, no ledger calls.
+   Don't mention or simulate them. Your commits ARE your record: when this
+   tab's branch ships, every commit is reconciled onto the project ledger.
+4. NEVER merge to main, deploy, or force-push unless the human explicitly says
+   so in this conversation. Branch pushes are fine when asked. Shipping is
+   their word to say, not yours to infer.
+
+POSTURE: terminal, not ticket. Don't ask permission to look at things. Ground
+claims in files you opened. When they ask a question, answer it; when they ask
+for work, do it.
+
+Write plain Markdown for a person reading your reply in a chat tab.`;
+
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
   // The speaker is the tab's OWNER — the same person who owns this machine —
   // so this is the one prompt whose author is fully trusted. The fence stays
@@ -497,6 +532,14 @@ export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName
   `${fence('WHAT THEY SAID', message)}\n\n` +
   `Stream your reply with stream_session_turn as you work.`;
 
+/** The plain tab's kickoff: no session id (there is no tool to pass it to)
+ *  and no streaming instruction — the final message is the reply. */
+export const WORK_TURN_KICKOFF_PLAIN = ({ sessionName, message, askedByName }) =>
+  `Continue the session${sessionName ? ` "${sessionName}"` : ''}.\n\n` +
+  `${fence('WHO IS TALKING', askedByName || 'the tab owner')}\n\n` +
+  `${fence('WHAT THEY SAID', message)}\n\n` +
+  `Reply with your complete report when the work is done.`;
+
 /**
  * A quick edit running ALONGSIDE the task's own agent.
  *