flowviant 0.47.1 → 0.47.2

package/README.md

@@ -68,6 +68,31 @@ Flowviant only stores the tunnel URL; your browser talks to it directly.
 | `FLOWVIANT_TOKENS=a,b,c` | a static fleet, one worktree each |
 | `FLOWVIANT_SAFE=1` | restrict the toolset instead of running unattended |
 
+## Security posture
+
+Every project member with edit access can run turns on this machine —
+Workbench tabs and @-dispatches both execute a coding agent with the daemon's
+own OS permissions. Membership is the consent boundary, the same trust plane
+as the shared repository: invite people you would give a shell to.
+
+Two knobs bound the blast radius, and both are worth setting on a shared box:
+
+- **Run the daemon under a dedicated OS user** that owns only the repository
+  checkout and `~/.flowviant`. This is the single biggest hardening available
+  — a session can then only touch that account's files, not your keys, your
+  home directory, or the rest of the machine. A plain separate account works;
+  a systemd unit with `ProtectHome=read-only` and `ReadWritePaths=` works
+  better.
+- **`FLOWVIANT_SAFE=1`** narrows the toolset: Claude to an allowlist
+  (edit/read/search plus `git`/`gh`/`npm`/`bun` — no arbitrary shell), Codex
+  to a workspace-write sandbox. Antigravity has no per-invocation narrowing —
+  its permission engine is machine-wide — which is surfaced in the app rather
+  than papered over.
+
+The posture is reported on every poll and shown in the project's
+Settings → Machine section, so the team can see whether the box runs the
+guarded toolset or full permissions.
+
 ## License
 
 MIT — see [LICENSE](./LICENSE).

package/bin/lib/fleet.mjs

@@ -101,6 +101,12 @@ async function fetchRoster(haveIds) {
   // our own package.json). Older servers ignore unknown params, so sending it
   // unconditionally is always safe.
   url.searchParams.set('dv', VERSION);
+  // The permission posture this machine runs turns under — '1' when
+  // FLOWVIANT_SAFE narrows the toolset, '0' when everything is granted. A
+  // statement of configuration, not a request: the app SHOWS it in Settings
+  // so a team can see whether the shared box runs wide open, and enforces
+  // nothing (membership is the consent boundary). Older servers ignore it.
+  url.searchParams.set('safe', SAFE ? '1' : '0');
   // WHICH CLIs this machine actually has, so the app can stop guessing.
   //
   // Until now every surface that listed Gemini or Codex said "not wired up yet"

package/bin/lib/prompts.mjs

@@ -458,26 +458,40 @@ MECHANICS OF THIS TAB:
 4. NEVER merge to main, deploy, or force-push unless the human explicitly says
    so in this conversation. Branch pushes and PRs are fine when asked. Shipping
    is their word to say, not yours to infer.
+5. WHEN THEY HAVE TO CHOOSE, HAND THEM THE CHOICES. A real pick between known
+   options — not an open question — ends your reply with a fenced block the app
+   renders as buttons; their click composes their answer as the next message:
+
+   \`\`\`flowviant-ask
+   {"question": "Which auth flow?", "options": ["Magic link", "Password", "Both"], "multiSelect": false}
+   \`\`\`
+
+   ONE block per reply, and always the LAST thing in it. Two to eight options,
+   each label short enough to sit on a button. multiSelect true only for a
+   genuine check-several-of-these case. NEVER for an open question — ask those
+   in prose, like anyone would. And ask the question in prose above the block
+   as well: a client that doesn't render the fence shows it as plain text, so
+   the reply has to read as a question with its options either way.
 
 THE LEDGER. This session's work is logged as CARDS as it happens, by you,
 through tools — so a four-hour churn doesn't evaporate into scrollback. The
 rules:
 
-5. CLAIM WHAT YOU WORK. When they say "take the auth card" or "next", call
+6. CLAIM WHAT YOU WORK. When they say "take the auth card" or "next", call
    list_cards, then claim_card the one they mean. The card you hold is the
    tab's "Now" — it is how they and their team see what this session is doing.
-6. LOG DRIFT, don't ask permission for it. "Also fix that redirect" mid-flow:
+7. LOG DRIFT, don't ask permission for it. "Also fix that redirect" mid-flow:
    do the work, and file_card it — check list_cards FIRST; if a planned card
    already covers it, claim that one instead of filing a twin. One card per
    shippable unit. Never card-ify chatter, questions, or exploration.
-7. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
+8. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
    one-paragraph summary and the commit shas. Delivered is ASSERTED; done is
    OBSERVED (the merge, on their word). Never claim done, and never deliver
    work that isn't committed.
-8. RAISE WHAT YOU SPOT. A design flaw, a follow-up they named for later —
+9. RAISE WHAT YOU SPOT. A design flaw, a follow-up they named for later —
    raise_card, queued, unheld. You do not start raised work.
-9. BE PROPORTIONAL. A one-line typo fix inside the card you already hold is
-   that card's work, not a new card. When in doubt, fewer cards.
+10. BE PROPORTIONAL. A one-line typo fix inside the card you already hold is
+    that card's work, not a new card. When in doubt, fewer cards.
 
 POSTURE: terminal, not ticket. Don't ask permission to look at things. Don't
 narrate ceremony. Ground claims in files you opened. When they ask a question,
@@ -514,6 +528,21 @@ MECHANICS OF THIS TAB:
 4. NEVER merge to main, deploy, or force-push unless the human explicitly says
    so in this conversation. Branch pushes are fine when asked. Shipping is
    their word to say, not yours to infer.
+5. WHEN THEY HAVE TO CHOOSE, HAND THEM THE CHOICES. You have no tools here, but
+   this one costs none — it is text. A real pick between known options (not an
+   open question) ends your reply with a fenced block the app renders as
+   buttons; their click composes their answer as the next message:
+
+   \`\`\`flowviant-ask
+   {"question": "Which auth flow?", "options": ["Magic link", "Password", "Both"], "multiSelect": false}
+   \`\`\`
+
+   ONE block per reply, and always the LAST thing in it. Two to eight options,
+   each label short enough to sit on a button. multiSelect true only for a
+   genuine check-several-of-these case. NEVER for an open question — ask those
+   in prose, like anyone would. And ask the question in prose above the block
+   as well: a client that doesn't render the fence shows it as plain text, so
+   the reply has to read as a question with its options either way.
 
 POSTURE: terminal, not ticket. Don't ask permission to look at things. Ground
 claims in files you opened. When they ask a question, answer it; when they ask

package/bin/lib/work.mjs

@@ -45,6 +45,45 @@ import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
 import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
 import { homedir } from 'node:os';
 
+/**
+ * The shape a per-tab model name must have before it rides argv as
+ * `--model <name>`. Conservative for the same reason the codex thread id is
+ * (below): it comes off the wire and lands in a child process's arguments —
+ * alphanumerics plus dot/dash/underscore, at most 40 characters, and NEVER a
+ * leading dash, which is an argv that parses as a flag.
+ */
+const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
+
+/** The five efforts the CLIs actually accept. A literal set rather than a
+ *  pattern: there is no such thing as an effort we haven't heard of, and the
+ *  server's own union is exactly this list. */
+const WORK_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+
+/**
+ * WHICH BRAIN, AT WHICH EFFORT — the tab's own pick, off the roster.
+ *
+ * Absent is the resting state and it must stay genuinely absent: every tab ran
+ * with no `--model` and no `--effort` until now, so a job that names neither
+ * has to produce the byte-identical argv it produced yesterday — Claude falling
+ * back to the machine's MODEL pin, codex and agy to their own defaults. Hence
+ * an object with the key MISSING rather than one holding null: a null would
+ * reach the builders as a value and Claude's `model || MODEL` is the only one
+ * that would survive it.
+ *
+ * A value that fails its guard is DROPPED, not passed through and not an error.
+ * The honest outcome of "the server named a model this machine can't spell" is
+ * the machine's own default — a turn that runs — rather than a flag no CLI
+ * understands and a tab that fails every message.
+ */
+function brainFor(job) {
+  const out = {};
+  const model = typeof job?.model === 'string' ? job.model.trim() : '';
+  if (model && WORK_MODEL_RE.test(model)) out.model = model;
+  const effort = typeof job?.effort === 'string' ? job.effort.trim() : '';
+  if (effort && WORK_EFFORTS.has(effort)) out.effort = effort;
+  return out;
+}
+
 export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
   const WORK_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-turn-done');
@@ -879,6 +918,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           const mcp = plainTab
             ? { args: [], env: null, dir: null }
             : mcpFor(rt.id, mint.token, getMcpUrl());
+          // The tab's model/effort, if it named any. Spread into turnArgs so
+          // BOTH runTurn calls below carry it — the retry is the same turn on
+          // the same brain, not a quieter second opinion.
+          const brain = brainFor(job);
           // Attempts count RUNS: the infra refusals above consumed nothing and
           // settled on their own terms.
           workAttempts.set(job.id, tries + 1);
@@ -908,6 +951,8 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               // ordinary --continue resume path, unchanged.
               ...(adopting ? { adoptResumeId: job.adopt.id } : {}),
               system: plainTab ? SYSTEM_WORK_PLAIN : SYSTEM_WORK,
+              // Present only when the tab named one — see brainFor.
+              ...brain,
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.47.1",
+  "version": "0.47.2",
   "description": "Run your own coding CLIs as headless build agents for Flowviant — Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {