flowviant 0.47.0 → 0.47.2

package/README.md

@@ -68,6 +68,31 @@ Flowviant only stores the tunnel URL; your browser talks to it directly.
 | `FLOWVIANT_TOKENS=a,b,c` | a static fleet, one worktree each |
 | `FLOWVIANT_SAFE=1` | restrict the toolset instead of running unattended |
 
+## Security posture
+
+Every project member with edit access can run turns on this machine —
+Workbench tabs and @-dispatches both execute a coding agent with the daemon's
+own OS permissions. Membership is the consent boundary, the same trust plane
+as the shared repository: invite people you would give a shell to.
+
+Two knobs bound the blast radius, and both are worth setting on a shared box:
+
+- **Run the daemon under a dedicated OS user** that owns only the repository
+  checkout and `~/.flowviant`. This is the single biggest hardening available
+  — a session can then only touch that account's files, not your keys, your
+  home directory, or the rest of the machine. A plain separate account works;
+  a systemd unit with `ProtectHome=read-only` and `ReadWritePaths=` works
+  better.
+- **`FLOWVIANT_SAFE=1`** narrows the toolset: Claude to an allowlist
+  (edit/read/search plus `git`/`gh`/`npm`/`bun` — no arbitrary shell), Codex
+  to a workspace-write sandbox. Antigravity has no per-invocation narrowing —
+  its permission engine is machine-wide — which is surfaced in the app rather
+  than papered over.
+
+The posture is reported on every poll and shown in the project's
+Settings → Machine section, so the team can see whether the box runs the
+guarded toolset or full permissions.
+
 ## License
 
 MIT — see [LICENSE](./LICENSE).

package/bin/lib/fleet.mjs

@@ -101,6 +101,12 @@ async function fetchRoster(haveIds) {
   // our own package.json). Older servers ignore unknown params, so sending it
   // unconditionally is always safe.
   url.searchParams.set('dv', VERSION);
+  // The permission posture this machine runs turns under — '1' when
+  // FLOWVIANT_SAFE narrows the toolset, '0' when everything is granted. A
+  // statement of configuration, not a request: the app SHOWS it in Settings
+  // so a team can see whether the shared box runs wide open, and enforces
+  // nothing (membership is the consent boundary). Older servers ignore it.
+  url.searchParams.set('safe', SAFE ? '1' : '0');
   // WHICH CLIs this machine actually has, so the app can stop guessing.
   //
   // Until now every surface that listed Gemini or Codex said "not wired up yet"

package/bin/lib/localSessions.mjs

@@ -24,8 +24,66 @@ import {
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
-const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
 const REPORT_CAP = 30;
+// ENDED sessions are the adoptable inventory, and the useful ones are FRESH:
+// "closed my laptop terminal, picking it up here". Claude Code prunes its own
+// history anyway, so a week-old row was a soon-to-be-dead offer — 48 hours,
+// newest per directory, few. (The first ship reported 7 days of everything
+// and the strip read as session history instead of presence.)
+const ENDED_WINDOW_MS = 48 * 60 * 60 * 1000;
+const ENDED_CAP = 5;
+
+/**
+ * The conversation's own title, off the transcript's `ai-title` records
+ * (the LAST one wins — titles get rewritten as a session evolves), falling
+ * back to the first real user message. Those records sit anywhere in the
+ * file (measured: line 81 to line 4457), so this reads the WHOLE transcript
+ * — behind an mtime cache, because the scan runs every minute and a title
+ * only changes when the file does: steady state is a stat, not a read.
+ */
+const titleCache = new Map(); // file → { mtimeMs, title }
+function transcriptTitle(file, mtimeMs) {
+  const hit = titleCache.get(file);
+  if (hit && hit.mtimeMs === mtimeMs) return hit.title;
+  let title = null;
+  try {
+    const stat = statSync(file);
+    // A transcript past this is not worth a read per minute of drift.
+    if (stat.size <= 64 * 1024 * 1024) {
+      let firstUser = null;
+      for (const line of readFileSync(file, 'utf8').split('\n')) {
+        if (line.includes('"type":"ai-title"')) {
+          try {
+            const t = JSON.parse(line)?.aiTitle;
+            if (typeof t === 'string' && t.trim()) title = t.trim(); // last wins
+          } catch {
+            /* torn line */
+          }
+        } else if (!firstUser && !title && line.includes('"type":"user"') && !line.includes('"isMeta":true')) {
+          try {
+            const content = JSON.parse(line)?.message?.content;
+            const text =
+              typeof content === 'string'
+                ? content
+                : Array.isArray(content)
+                  ? (content.find((b) => typeof b?.text === 'string')?.text ?? '')
+                  : '';
+            if (text.trim() && !text.startsWith('<')) firstUser = text.trim();
+          } catch {
+            /* torn line */
+          }
+        }
+      }
+      if (!title && firstUser) title = firstUser;
+      if (title) title = title.replace(/\s+/g, ' ').slice(0, 120);
+    }
+  } catch {
+    title = null;
+  }
+  if (titleCache.size > 400) titleCache.clear(); // a bound, not an LRU — refills in one scan
+  titleCache.set(file, { mtimeMs, title });
+  return title;
+}
 
 /** Path-prefix containment on already-realpath'd absolute paths. */
 const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
@@ -182,12 +240,29 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
       }
       if (!ours(cwd)) continue;
       liveIds.add(rec.sessionId);
+      // A live session's title, off its own transcript (the registry `name`
+      // is a machine-y fallback like "flowviant-35").
+      let liveTitle = null;
+      try {
+        const liveFile = join(
+          homedir(),
+          '.claude',
+          'projects',
+          cwd.replace(/[/.]/g, '-'),
+          `${rec.sessionId}.jsonl`
+        );
+        liveTitle = transcriptTitle(liveFile, statSync(liveFile).mtimeMs);
+      } catch {
+        /* no transcript yet */
+      }
+      if (!liveTitle && typeof rec.name === 'string' && rec.name.trim()) liveTitle = rec.name.trim();
       live.push({
         id: rec.sessionId,
         cwd,
         live: true,
         lastActiveAt: nowIso,
         ...(typeof rec.gitBranch === 'string' && rec.gitBranch ? { branch: rec.gitBranch } : {}),
+        ...(liveTitle ? { title: liveTitle } : {}),
       });
     }
     live.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
@@ -207,7 +282,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
     } catch {
       /* no transcript store — live sessions still report */
     }
-    const cutoff = Date.now() - SEVEN_DAYS_MS;
+    const cutoff = Date.now() - ENDED_WINDOW_MS;
     const candidates = [];
     for (const dirName of projDirs) {
       if (dirName !== munged && !dirName.startsWith(`${munged}-`)) continue;
@@ -228,7 +303,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
         } catch {
           continue;
         }
-        if (mtimeMs < cutoff) continue; // week-old sessions are history, not presence
+        if (mtimeMs < cutoff) continue; // an aged session is history, not presence
         candidates.push({ id, file, mtimeMs });
       }
     }
@@ -236,8 +311,14 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
     // the verification read is the expensive step, so it is not spent on
     // sessions the report would drop anyway.
     candidates.sort((a, b) => b.mtimeMs - a.mtimeMs || (a.id < b.id ? -1 : 1));
-    const room = Math.max(0, REPORT_CAP - Math.min(live.length, REPORT_CAP));
+    // ONE row per DIRECTORY, newest first, few: twenty sessions in the repo
+    // root are one offer — the newest is the one `--resume`'s picker would
+    // reach for and the only one worth importing 95% of the time. The rest
+    // are scrollback, and the product's own law says scrollback doesn't
+    // matter.
+    const room = Math.min(ENDED_CAP, Math.max(0, REPORT_CAP - Math.min(live.length, REPORT_CAP)));
     const endedIds = new Set();
+    const seenCwds = new Set(live.map((s) => s.cwd));
     for (const cand of candidates) {
       if (ended.length >= room) break;
       if (endedIds.has(cand.id)) continue; // one row per session, whatever dir names it
@@ -251,12 +332,16 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
         continue;
       }
       if (!ours(cwd)) continue;
+      if (seenCwds.has(cwd)) continue; // newest per directory; a live one owns its cwd
+      seenCwds.add(cwd);
+      const title = transcriptTitle(cand.file, cand.mtimeMs);
       ended.push({
         id: cand.id,
         cwd,
         live: false,
         lastActiveAt: new Date(cand.mtimeMs).toISOString(),
         ...(typeof rec.gitBranch === 'string' && rec.gitBranch ? { branch: rec.gitBranch } : {}),
+        ...(title ? { title } : {}),
       });
     }
   } catch {
@@ -365,7 +450,7 @@ function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
     const raw = readFileSync(join(AGY_DIR(), 'cache', 'last_conversations.json'), 'utf8');
     const map = JSON.parse(raw);
     if (!map || typeof map !== 'object') return out;
-    const cutoff = Date.now() - SEVEN_DAYS_MS;
+    const cutoff = Date.now() - ENDED_WINDOW_MS;
     const processUp = agyProcessAlive();
     for (const [cwd, id] of Object.entries(map)) {
       if (typeof id !== 'string' || !AGY_UUID_RE.test(id)) continue;

package/bin/lib/prompts.mjs

@@ -458,26 +458,40 @@ MECHANICS OF THIS TAB:
 4. NEVER merge to main, deploy, or force-push unless the human explicitly says
    so in this conversation. Branch pushes and PRs are fine when asked. Shipping
    is their word to say, not yours to infer.
+5. WHEN THEY HAVE TO CHOOSE, HAND THEM THE CHOICES. A real pick between known
+   options — not an open question — ends your reply with a fenced block the app
+   renders as buttons; their click composes their answer as the next message:
+
+   \`\`\`flowviant-ask
+   {"question": "Which auth flow?", "options": ["Magic link", "Password", "Both"], "multiSelect": false}
+   \`\`\`
+
+   ONE block per reply, and always the LAST thing in it. Two to eight options,
+   each label short enough to sit on a button. multiSelect true only for a
+   genuine check-several-of-these case. NEVER for an open question — ask those
+   in prose, like anyone would. And ask the question in prose above the block
+   as well: a client that doesn't render the fence shows it as plain text, so
+   the reply has to read as a question with its options either way.
 
 THE LEDGER. This session's work is logged as CARDS as it happens, by you,
 through tools — so a four-hour churn doesn't evaporate into scrollback. The
 rules:
 
-5. CLAIM WHAT YOU WORK. When they say "take the auth card" or "next", call
+6. CLAIM WHAT YOU WORK. When they say "take the auth card" or "next", call
    list_cards, then claim_card the one they mean. The card you hold is the
    tab's "Now" — it is how they and their team see what this session is doing.
-6. LOG DRIFT, don't ask permission for it. "Also fix that redirect" mid-flow:
+7. LOG DRIFT, don't ask permission for it. "Also fix that redirect" mid-flow:
    do the work, and file_card it — check list_cards FIRST; if a planned card
    already covers it, claim that one instead of filing a twin. One card per
    shippable unit. Never card-ify chatter, questions, or exploration.
-7. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
+8. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
    one-paragraph summary and the commit shas. Delivered is ASSERTED; done is
    OBSERVED (the merge, on their word). Never claim done, and never deliver
    work that isn't committed.
-8. RAISE WHAT YOU SPOT. A design flaw, a follow-up they named for later —
+9. RAISE WHAT YOU SPOT. A design flaw, a follow-up they named for later —
    raise_card, queued, unheld. You do not start raised work.
-9. BE PROPORTIONAL. A one-line typo fix inside the card you already hold is
-   that card's work, not a new card. When in doubt, fewer cards.
+10. BE PROPORTIONAL. A one-line typo fix inside the card you already hold is
+    that card's work, not a new card. When in doubt, fewer cards.
 
 POSTURE: terminal, not ticket. Don't ask permission to look at things. Don't
 narrate ceremony. Ground claims in files you opened. When they ask a question,
@@ -514,6 +528,21 @@ MECHANICS OF THIS TAB:
 4. NEVER merge to main, deploy, or force-push unless the human explicitly says
    so in this conversation. Branch pushes are fine when asked. Shipping is
    their word to say, not yours to infer.
+5. WHEN THEY HAVE TO CHOOSE, HAND THEM THE CHOICES. You have no tools here, but
+   this one costs none — it is text. A real pick between known options (not an
+   open question) ends your reply with a fenced block the app renders as
+   buttons; their click composes their answer as the next message:
+
+   \`\`\`flowviant-ask
+   {"question": "Which auth flow?", "options": ["Magic link", "Password", "Both"], "multiSelect": false}
+   \`\`\`
+
+   ONE block per reply, and always the LAST thing in it. Two to eight options,
+   each label short enough to sit on a button. multiSelect true only for a
+   genuine check-several-of-these case. NEVER for an open question — ask those
+   in prose, like anyone would. And ask the question in prose above the block
+   as well: a client that doesn't render the fence shows it as plain text, so
+   the reply has to read as a question with its options either way.
 
 POSTURE: terminal, not ticket. Don't ask permission to look at things. Ground
 claims in files you opened. When they ask a question, answer it; when they ask

package/bin/lib/work.mjs

@@ -45,6 +45,45 @@ import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
 import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
 import { homedir } from 'node:os';
 
+/**
+ * The shape a per-tab model name must have before it rides argv as
+ * `--model <name>`. Conservative for the same reason the codex thread id is
+ * (below): it comes off the wire and lands in a child process's arguments —
+ * alphanumerics plus dot/dash/underscore, at most 40 characters, and NEVER a
+ * leading dash, which is an argv that parses as a flag.
+ */
+const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
+
+/** The five efforts the CLIs actually accept. A literal set rather than a
+ *  pattern: there is no such thing as an effort we haven't heard of, and the
+ *  server's own union is exactly this list. */
+const WORK_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+
+/**
+ * WHICH BRAIN, AT WHICH EFFORT — the tab's own pick, off the roster.
+ *
+ * Absent is the resting state and it must stay genuinely absent: every tab ran
+ * with no `--model` and no `--effort` until now, so a job that names neither
+ * has to produce the byte-identical argv it produced yesterday — Claude falling
+ * back to the machine's MODEL pin, codex and agy to their own defaults. Hence
+ * an object with the key MISSING rather than one holding null: a null would
+ * reach the builders as a value and Claude's `model || MODEL` is the only one
+ * that would survive it.
+ *
+ * A value that fails its guard is DROPPED, not passed through and not an error.
+ * The honest outcome of "the server named a model this machine can't spell" is
+ * the machine's own default — a turn that runs — rather than a flag no CLI
+ * understands and a tab that fails every message.
+ */
+function brainFor(job) {
+  const out = {};
+  const model = typeof job?.model === 'string' ? job.model.trim() : '';
+  if (model && WORK_MODEL_RE.test(model)) out.model = model;
+  const effort = typeof job?.effort === 'string' ? job.effort.trim() : '';
+  if (effort && WORK_EFFORTS.has(effort)) out.effort = effort;
+  return out;
+}
+
 export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
   const WORK_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-turn-done');
@@ -869,9 +908,20 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // in the prompt, so the AGENT tells the user what stayed behind.
           let carryNote = '';
           if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt);
+          // The tab's transcript starts EMPTY on adoption (scrollback is
+          // disposable, the held context is the brain — never import an
+          // archive), so the first reply opens with a recap: the human sees
+          // the thread they are picking up without asking for it.
+          const adoptNote = adopting
+            ? '[ADOPTED SESSION — this conversation was brought in from a terminal. Begin your reply with a 2-3 sentence recap of where it left off and what state carried over, then answer the message.]'
+            : '';
           const mcp = plainTab
             ? { args: [], env: null, dir: null }
             : mcpFor(rt.id, mint.token, getMcpUrl());
+          // The tab's model/effort, if it named any. Spread into turnArgs so
+          // BOTH runTurn calls below carry it — the retry is the same turn on
+          // the same brain, not a quieter second opinion.
+          const brain = brainFor(job);
           // Attempts count RUNS: the infra refusals above consumed nothing and
           // settled on their own terms.
           workAttempts.set(job.id, tries + 1);
@@ -879,7 +929,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           let seenThreadId = null; // codex's conversation id, off thread.started
           const spawned = []; // this turn's children, for the teardown registry
           try {
-            const message = carryNote ? `${job.body}\n\n${carryNote}` : job.body;
+            const message = [job.body, adoptNote, carryNote].filter(Boolean).join('\n\n');
             const turnArgs = {
               // A plain tab has no tools to name and no session id to pass —
               // its kickoff asks for one complete report instead of a stream.
@@ -901,6 +951,8 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               // ordinary --continue resume path, unchanged.
               ...(adopting ? { adoptResumeId: job.adopt.id } : {}),
               system: plainTab ? SYSTEM_WORK_PLAIN : SYSTEM_WORK,
+              // Present only when the tab named one — see brainFor.
+              ...brain,
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "description": "Run your own coding CLIs as headless build agents for Flowviant — Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {