flowviant 0.48.1 → 0.48.2

package/bin/lib/env.mjs

@@ -232,7 +232,7 @@ export async function loadCachedEnv(projectId) {
  * verification in materializeInto, which refuses to write a secret that git can
  * still see.
  */
-function excludeInWorktree(wt, relPaths) {
+export function excludeInWorktree(wt, relPaths) {
   try {
     let gitdir;
     try {

package/bin/lib/fleet.mjs

@@ -1215,6 +1215,7 @@ export async function runFleetDaemon() {
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,
+    workBusy,
   } = createWorkManager({
     repoRoot,
     baseDir,
@@ -1804,9 +1805,14 @@ export async function runFleetDaemon() {
     if (roster.daemon) {
       // "No worker mid-task" must include the wiki runner: updating mid-sweep
       // re-execs the daemon, orphans the wiki Claude, and the fresh process
-      // starts a second sweep racing it on the same vault.
+      // starts a second sweep racing it on the same vault. And it must include
+      // SESSION work (workBusy — turns, ships, undelivered settle reports):
+      // dispatch workers' children say nothing about the Workbench tabs, and a
+      // re-exec mid-turn SIGTERMs the tab's CLI and settles a partial answer.
       const safeToUpdate =
-        !wikiBusy && [...workers.values()].every((w) => w.state.child == null);
+        !wikiBusy &&
+        !workBusy() &&
+        [...workers.values()].every((w) => w.state.child == null);
       const updating = handleVersionSignal({
         latest: roster.daemon.latest,
         min: roster.daemon.min,

package/bin/lib/localSessions.mjs

@@ -13,6 +13,7 @@
  */
 
 import {
+  existsSync,
   readdirSync,
   readFileSync,
   realpathSync,
@@ -23,6 +24,7 @@ import {
 } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
 
 const REPORT_CAP = 30;
 // ENDED sessions are the adoptable inventory, and the useful ones are FRESH:
@@ -35,11 +37,14 @@ const ENDED_CAP = 5;
 
 /**
  * The conversation's own title, off the transcript's `ai-title` records
- * (the LAST one wins — titles get rewritten as a session evolves), falling
- * back to the first real user message. Those records sit anywhere in the
- * file (measured: line 81 to line 4457), so this reads the WHOLE transcript
- * — behind an mtime cache, because the scan runs every minute and a title
- * only changes when the file does: steady state is a stat, not a read.
+ * (the LAST one wins — titles get rewritten as a session evolves), and ONLY
+ * those records: this wire is presence METADATA, and the first user message
+ * — the fallback this used to relay — is transcript CONTENT wearing a
+ * title's clothes. An untitled row is honest presence; a quoted message is
+ * a leak. Those records sit anywhere in the file (measured: line 81 to line
+ * 4457), so this reads the WHOLE transcript — behind an mtime cache, because
+ * the scan runs every minute and a title only changes when the file does:
+ * steady state is a stat, not a read.
  */
 const titleCache = new Map(); // file → { mtimeMs, title }
 function transcriptTitle(file, mtimeMs) {
@@ -50,31 +55,15 @@ function transcriptTitle(file, mtimeMs) {
     const stat = statSync(file);
     // A transcript past this is not worth a read per minute of drift.
     if (stat.size <= 64 * 1024 * 1024) {
-      let firstUser = null;
       for (const line of readFileSync(file, 'utf8').split('\n')) {
-        if (line.includes('"type":"ai-title"')) {
-          try {
-            const t = JSON.parse(line)?.aiTitle;
-            if (typeof t === 'string' && t.trim()) title = t.trim(); // last wins
-          } catch {
-            /* torn line */
-          }
-        } else if (!firstUser && !title && line.includes('"type":"user"') && !line.includes('"isMeta":true')) {
-          try {
-            const content = JSON.parse(line)?.message?.content;
-            const text =
-              typeof content === 'string'
-                ? content
-                : Array.isArray(content)
-                  ? (content.find((b) => typeof b?.text === 'string')?.text ?? '')
-                  : '';
-            if (text.trim() && !text.startsWith('<')) firstUser = text.trim();
-          } catch {
-            /* torn line */
-          }
+        if (!line.includes('"type":"ai-title"')) continue;
+        try {
+          const t = JSON.parse(line)?.aiTitle;
+          if (typeof t === 'string' && t.trim()) title = t.trim(); // last wins
+        } catch {
+          /* torn line */
         }
       }
-      if (!title && firstUser) title = firstUser;
       if (title) title = title.replace(/\s+/g, ' ').slice(0, 120);
     }
   } catch {
@@ -104,7 +93,32 @@ function pidAlive(pid, procStart) {
   try {
     stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
   } catch {
-    return false; // no /proc entry — the process is gone
+    // No /proc ENTRY means the process is gone — but only where /proc exists
+    // at all. On macOS there is no /proc, so this read fails for EVERY pid,
+    // every session scans as dead, and live sessions become adoptable — the
+    // exact two-drivers-on-one-conversation outcome liveness exists to
+    // prevent. Probe by name instead: `ps -o comm=` on the pid, alive only if
+    // the surviving process still LOOKS like a coding-CLI process. A bare
+    // signal-0 probe was tried first and reads a RECYCLED pid as alive
+    // forever — a crashed session whose pid a launchd service inherited would
+    // report live for weeks, refuse adoption, and suppress its own ended row.
+    // The name check keeps the conservative direction (a transient race still
+    // errs live) without the permanent false-live.
+    if (!existsSync('/proc')) {
+      try {
+        const comm = execFileSync('ps', ['-o', 'comm=', '-p', String(pid)], {
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+          timeout: 5_000,
+        })
+          .trim()
+          .toLowerCase();
+        return /\b(claude|node|bun|codex|agy)\b|\/(claude|node|bun|codex|agy)$/.test(comm);
+      } catch {
+        return false; // ps errored or the pid is gone — the process is dead
+      }
+    }
+    return false; // /proc is real and has no entry — the process is gone
   }
   if (procStart == null) return true; // nothing recorded to compare against
   const close = stat.lastIndexOf(')');
@@ -389,8 +403,28 @@ function agyLastWriteMs(id) {
 }
 
 /** Any agy process on the machine right now? /proc comm scan — cheap at the
- *  60s cadence, and the only liveness signal agy leaves (locks are inert). */
+ *  60s cadence, and the only liveness signal agy leaves (locks are inert).
+ *  Tri-state on purpose: true (an agy process exists), false (scanned /proc
+ *  and found none), null (no /proc to scan — macOS — so the question is
+ *  UNANSWERABLE here, which is a different fact from "no", and the adoption
+ *  path below treats it differently: unknowable refuses, absent permits). */
 function agyProcessAlive() {
+  if (!existsSync('/proc')) {
+    // No /proc (macOS): ask pgrep the same question. A MEASURED "none" here
+    // matters — answering null instead made every agy conversation on such a
+    // machine read live forever, which both invented a state ("live" when the
+    // truth was "unmeasured") and permanently killed agy adoption there.
+    try {
+      execFileSync('pgrep', ['-x', 'agy'], {
+        stdio: ['ignore', 'ignore', 'ignore'],
+        timeout: 5_000,
+      });
+      return true; // exit 0 — at least one agy process
+    } catch (e) {
+      if (e?.status === 1) return false; // pgrep ran and found none
+      return null; // pgrep itself unavailable/errored — genuinely unknowable
+    }
+  }
   try {
     for (const name of readdirSync('/proc')) {
       if (!/^\d+$/.test(name)) continue;
@@ -401,7 +435,7 @@ function agyProcessAlive() {
       }
     }
   } catch {
-    /* no /proc — call nothing live rather than everything */
+    return null; // /proc exists but won't read — still unknowable
   }
   return false;
 }
@@ -418,7 +452,15 @@ function agyProcessAlive() {
 const AGY_LIVE_WINDOW_MS = 10 * 60 * 1000;
 export function isAgyConversationLive(id) {
   try {
-    if (!agyProcessAlive()) return false;
+    const up = agyProcessAlive();
+    // Unknowable is NOT "ended". Without /proc the process half of the
+    // composite cannot be measured, and calling that "no process" would make
+    // every agy conversation on such a machine adoptable — the move-adoption
+    // then puts a second driver on a store someone may still be writing.
+    // "Live" here means "refuse adoption", and refusing what we cannot verify
+    // is the same conservatism as the composite itself.
+    if (up === null) return true;
+    if (!up) return false;
     const t = agyLastWriteMs(id);
     return t > 0 && Date.now() - t < AGY_LIVE_WINDOW_MS;
   } catch {
@@ -466,7 +508,11 @@ function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
       out.push({
         id,
         cwd: real,
-        live: processUp && Date.now() - lastMs < AGY_LIVE_WINDOW_MS,
+        // Mirrors isAgyConversationLive exactly, unknowable (null) included:
+        // the report must never offer as adoptable a conversation the adopt
+        // path will then refuse — an offer wired to a refusal is the dead
+        // control this product keeps deleting.
+        live: processUp === null ? true : processUp && Date.now() - lastMs < AGY_LIVE_WINDOW_MS,
         lastActiveAt: new Date(lastMs).toISOString(),
         runtime: 'antigravity',
       });

package/bin/lib/prompts.mjs

@@ -493,6 +493,14 @@ rules:
 10. BE PROPORTIONAL. A one-line typo fix inside the card you already hold is
     that card's work, not a new card. When in doubt, fewer cards.
 
+THERE IS NO LATER. Your turn ends when you stop writing, and nothing of yours
+runs after that — so never promise to report back, keep watching, follow up, or
+tell them the result "as soon as it finishes". If something you started is
+still running, either wait for it inside this turn and report what happened, or
+end by saying plainly that it is unfinished, what is still running, and how they
+can check. A promise you cannot keep reads as a hang: they sit waiting for a
+message that will never come.
+
 POSTURE: terminal, not ticket. Don't ask permission to look at things. Don't
 narrate ceremony. Ground claims in files you opened. When they ask a question,
 answer it; when they ask for work, do it; when you spot something broken along
@@ -544,6 +552,14 @@ MECHANICS OF THIS TAB:
    as well: a client that doesn't render the fence shows it as plain text, so
    the reply has to read as a question with its options either way.
 
+THERE IS NO LATER. Your turn ends when you stop writing, and nothing of yours
+runs after that — so never promise to report back, keep watching, or tell them
+the result "as soon as it finishes". If something you started is still running,
+either wait for it inside this turn and report what happened, or end by saying
+plainly that it is unfinished, what is still running, and how they can check. A
+promise you cannot keep reads as a hang: they sit waiting for a message that
+will never come.
+
 POSTURE: terminal, not ticket. Don't ask permission to look at things. Ground
 claims in files you opened. When they ask a question, answer it; when they ask
 for work, do it.

package/bin/lib/update.mjs

@@ -87,6 +87,17 @@ export function runUpdateCommand() {
 
 // Nag at most once per target version, so a poll every ~10s doesn't spam.
 let naggedFor = null;
+/**
+ * When the last install ATTEMPT failed, so a failure can be retried instead of
+ * being final. It used to set `naggedFor` and stop: one unwritable global
+ * prefix, one npm blip, or one offline moment and the daemon stayed on its old
+ * version until the server announced a DIFFERENT one — which on a box nobody
+ * logs into means features silently missing for days (measured: a machine sat
+ * on 0.47.0 through two releases). A readout in the app now surfaces it too,
+ * but the machine should also just try again.
+ */
+let lastInstallFailAt = 0;
+const INSTALL_RETRY_MS = 15 * 60_000;
 
 /**
  * React to the server's {latest, min} signal from a roster poll.
@@ -110,6 +121,14 @@ export function handleVersionSignal({ latest, min, autoUpdate, safeToUpdate, tea
       }
       return false;
     }
+    // A failed install is retried on a cooldown, not abandoned: the common
+    // causes (an unwritable global prefix mid-fix, a registry blip, a network
+    // that came back) are all transient, and the poll runs every ~10s so
+    // without this a single failure is effectively permanent. Checked BEFORE
+    // the npm-view probe below, which is a SYNCHRONOUS network call — during
+    // backoff every ~10s poll would otherwise block the whole event loop on a
+    // question whose answer we already decided not to act on.
+    if (Date.now() - lastInstallFailAt < INSTALL_RETRY_MS) return false;
     // Loop guard: the server can announce a version before it's published. npm is
     // the source of truth — only install if npm ACTUALLY has something newer than
     // us, else `npm i -g @latest` reinstalls our own version and we'd re-exec
@@ -119,6 +138,9 @@ export function handleVersionSignal({ latest, min, autoUpdate, safeToUpdate, tea
       published = execFileSync('npm', ['view', 'flowviant', 'version'], {
         encoding: 'utf8',
         stdio: ['ignore', 'pipe', 'ignore'],
+        // Synchronous, so it holds the event loop hostage for however long it
+        // runs — a hung registry must not become a hung daemon.
+        timeout: 10_000,
       }).trim();
     } catch {
       /* offline / npm hiccup — treat as "can't confirm", skip this poll */
@@ -137,8 +159,10 @@ export function handleVersionSignal({ latest, min, autoUpdate, safeToUpdate, tea
       reexec(teardown);
       return true;
     } catch (e) {
-      warn(`self-update failed (${e?.message ?? e}) — update manually: npm i -g flowviant@latest`);
-      naggedFor = target; // don't retry-spam a failing install every poll
+      lastInstallFailAt = Date.now();
+      warn(
+        `self-update failed (${e?.message ?? e}) — retrying in 15m; to fix it now: npm i -g flowviant@latest`
+      );
       return false;
     }
   }

package/bin/lib/work.mjs

@@ -40,7 +40,7 @@ import {
   SYSTEM_WORK_PLAIN,
   WORK_TURN_KICKOFF_PLAIN,
 } from './prompts.mjs';
-import { materializeInto, scrub as envScrub } from './env.mjs';
+import { materializeInto, excludeInWorktree, scrub as envScrub } from './env.mjs';
 import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
 import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
@@ -91,6 +91,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   const SHIP_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/ship-done');
   const ACTIVITY_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-activity');
   const WORKTREES_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-worktrees');
+  const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
   const workAnswering = new Set(); // turn ids currently queued/running here
   const workAttempts = new Map(); // turn id -> completed runTurn attempts
   const MAX_WORK_TRIES = 3;
@@ -132,9 +133,23 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    */
   const pendingWorkReports = new Map(); // turnId -> work-turn-done body
   const pendingShipReports = new Map(); // sessionId -> ship-done body
-  /** POST a settle body. 'ok' | 'terminal' (the server will never accept this
-   *  body — 403 not this fleet's session, 404 unknown turn, 409 ship already
-   *  settled — so retrying is spam, not delivery) | 'retry'. */
+  /** POST a settle body. Four outcomes, and the split between the last two is
+   *  load-bearing:
+   *   - 'ok' — delivered.
+   *   - 'terminal' — the EXPLICIT per-endpoint statuses under which the server
+   *     will never re-offer the job (403 not this fleet's session, 404 unknown
+   *     turn, 409 ship already settled). Only these may drop the report AND
+   *     the attempts counter: they are the statuses where forgetting is safe
+   *     because the job is gone server-side too.
+   *   - 'reject' — any OTHER 4xx (a 400 from deploy skew, an edge/WAF rule):
+   *     the server refused this BODY, but the job row may still be pending and
+   *     riding every poll. The report must stay QUEUED — it is the skip-guard
+   *     that stops the turn being re-run with all its side effects — but
+   *     re-POSTing a body the server just refused every poll is spam, so
+   *     delivery backs off. Treating this as terminal once re-ran whole
+   *     non-idempotent CLI turns in a loop; treating it as plain retry
+   *     hammered a refused body forever.
+   *   - 'retry' — network errors, 408, 429 and 5xx: nothing was decided. */
   const postSettle = async (url, body, terminalStatuses) => {
     try {
       const res = await fetch(url, {
@@ -149,26 +164,41 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       });
       if (res.ok) return 'ok';
       if (terminalStatuses.includes(res.status)) return 'terminal';
+      if (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
+        return 'reject';
       return 'retry';
     } catch {
       return 'retry';
     }
   };
+  /** How long a REJECTED report sits out before re-offering its body — long
+   *  enough that a deploy-skew 400 costs a handful of POSTs a day, short
+   *  enough that a server fix picks the report up the same morning. */
+  const REJECT_RETRY_MS = 10 * 60 * 1000;
+  const reportBackoff = new Map(); // turnId|sessionId -> earliest next attempt
   const settleWorkTurn = async (turnId, payload) => {
     const body = { turnId, ...payload };
     const r = await postSettle(WORK_DONE_URL, body, [403, 404]);
-    if (r === 'retry') pendingWorkReports.set(turnId, body);
-    else {
+    if (r === 'retry' || r === 'reject') {
+      pendingWorkReports.set(turnId, body);
+      if (r === 'reject') reportBackoff.set(turnId, Date.now() + REJECT_RETRY_MS);
+    } else {
       pendingWorkReports.delete(turnId);
       workAttempts.delete(turnId);
+      reportBackoff.delete(turnId);
     }
     return r;
   };
   const settleShip = async (sessionId, payload) => {
     const body = { sessionId, ...payload };
     const r = await postSettle(SHIP_DONE_URL, body, [403, 409]);
-    if (r === 'retry') pendingShipReports.set(sessionId, body);
-    else pendingShipReports.delete(sessionId);
+    if (r === 'retry' || r === 'reject') {
+      pendingShipReports.set(sessionId, body);
+      if (r === 'reject') reportBackoff.set(sessionId, Date.now() + REJECT_RETRY_MS);
+    } else {
+      pendingShipReports.delete(sessionId);
+      reportBackoff.delete(sessionId);
+    }
     return r;
   };
   /**
@@ -187,7 +217,12 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    */
   const ACTIVITY_MIN_MS = 1_500;
   const ACTIVITY_KEEP = 4; // the last few lines — a tail, not a log
-  const makeNarrator = (sessionId) => {
+  /** `turnId` scopes the narration to the turn that produced it: a POST
+   *  already on the wire when the turn settles must not re-stamp a "working…"
+   *  line over the finished reply — the server drops narration for a turn
+   *  that is no longer pending. (A session-level pending count can't tell the
+   *  settled turn's stale line from the queued NEXT turn's fresh one.) */
+  const makeNarrator = (sessionId, turnId) => {
     const recent = [];
     let lastSent = 0;
     let dirty = false;
@@ -209,7 +244,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             'Content-Type': 'application/json',
           },
           signal: AbortSignal.timeout(10_000),
-          body: JSON.stringify({ sessionId, lines }),
+          body: JSON.stringify({ sessionId, turnId, lines }),
         });
       } catch {
         /* narration is decoration — a dropped line is not an incident */
@@ -228,7 +263,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     };
     return {
       line(label) {
-        const s = String(label ?? '')
+        // Scrub, like every string that leaves this machine: a narration line
+        // is the CLI's own stdout — a command echoing an env var, a read of a
+        // config file — and it rides the same uplink the final answer does.
+        const s = envScrub(String(label ?? ''))
           .replace(/\s+/g, ' ')
           .trim()
           .slice(0, 200);
@@ -328,6 +366,78 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     })();
   };
 
+  /**
+   * FILES THE HUMAN ATTACHED, brought to where a CLI can read them.
+   *
+   * A screenshot in a chat bubble is useless to an agent; a path is not. So the
+   * turn's attachments are downloaded into `.flowviant/uploads/` inside the
+   * session's own worktree and the prompt is handed the relative paths.
+   *
+   * `.flowviant/` rather than the repo proper, and gitignored-or-not it is
+   * never committed by us: these are the human's inputs to a conversation, not
+   * project files. The name is re-sanitized HERE even though the server already
+   * did it — this string becomes a path on someone's machine, and one place
+   * doing that check is one deploy away from being zero places.
+   */
+  const UPLOAD_DIR = '.flowviant/uploads';
+  const ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+  const safeUploadName = (raw) => {
+    const base = String(raw ?? '')
+      .split(/[\\/]/)
+      .pop()
+      .replace(/[^A-Za-z0-9._-]/g, '_')
+      .replace(/^[.-]+/, '')
+      .slice(0, 80);
+    return base || 'attachment';
+  };
+  /** @returns relative paths written, in the order the human attached them. */
+  const fetchAttachments = async (wt, attachments) => {
+    if (!Array.isArray(attachments) || attachments.length === 0) return [];
+    const dir = join(wt, UPLOAD_DIR);
+    try {
+      mkdirSync(dir, { recursive: true });
+    } catch {
+      return [];
+    }
+    // "Never committed by us" has to be true for GIT, not just for this code:
+    // an untracked `.flowviant/` makes the whole worktree dirty, which refuses
+    // every ship, exempts the tree from closed-tab retirement forever, and
+    // shows the human's own uploads in the rail as session changes. Same
+    // mechanism as the materialized env files — the exclude file git actually
+    // reads (env.mjs), which already skips lines it has written before, so
+    // calling it per fetch is idempotent.
+    excludeInWorktree(wt, ['.flowviant/']);
+    const written = [];
+    for (const a of attachments.slice(0, 8)) {
+      if (!a?.id || typeof a.id !== 'string' || !/^[0-9a-f-]{8,64}$/i.test(a.id)) continue;
+      if (Number(a.size) > ATTACHMENT_MAX_BYTES) continue;
+      try {
+        const res = await fetch(`${ATTACHMENT_URL}/${a.id}`, {
+          headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+          signal: AbortSignal.timeout(60_000),
+        });
+        if (!res.ok) continue;
+        const buf = Buffer.from(await res.arrayBuffer());
+        if (buf.byteLength === 0 || buf.byteLength > ATTACHMENT_MAX_BYTES) continue;
+        // Collisions are real (two screenshots both named Screenshot.png), and
+        // silently overwriting one with the other loses a file the human sent.
+        let name = safeUploadName(a.name);
+        if (existsSync(join(dir, name))) {
+          const dot = name.lastIndexOf('.');
+          const stem = dot > 0 ? name.slice(0, dot) : name;
+          const ext = dot > 0 ? name.slice(dot) : '';
+          name = `${stem}-${String(a.id).slice(0, 6)}${ext}`;
+        }
+        writeFileSync(join(dir, name), buf);
+        written.push(`${UPLOAD_DIR}/${name}`);
+      } catch {
+        /* one file failing must not fail the turn — the prompt lists what
+           actually arrived, so the agent never chases a path that isn't there */
+      }
+    }
+    return written;
+  };
+
   let flushingReports = false;
   const flushWorkReports = async () => {
     if (flushingReports) return;
@@ -335,15 +445,26 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     flushingReports = true;
     try {
       for (const [id, body] of [...pendingWorkReports]) {
+        // A rejected body sits out its backoff; the queued entry itself stays
+        // — it is the skip-guard against re-running a turn whose side effects
+        // already happened.
+        if ((reportBackoff.get(id) ?? 0) > Date.now()) continue;
         const r = await postSettle(WORK_DONE_URL, body, [403, 404]);
-        if (r !== 'retry') {
+        if (r === 'reject') reportBackoff.set(id, Date.now() + REJECT_RETRY_MS);
+        else if (r !== 'retry') {
           pendingWorkReports.delete(id);
           workAttempts.delete(id);
+          reportBackoff.delete(id);
         }
       }
       for (const [id, body] of [...pendingShipReports]) {
+        if ((reportBackoff.get(id) ?? 0) > Date.now()) continue;
         const r = await postSettle(SHIP_DONE_URL, body, [403, 409]);
-        if (r !== 'retry') pendingShipReports.delete(id);
+        if (r === 'reject') reportBackoff.set(id, Date.now() + REJECT_RETRY_MS);
+        else if (r !== 'retry') {
+          pendingShipReports.delete(id);
+          reportBackoff.delete(id);
+        }
       }
     } finally {
       flushingReports = false;
@@ -1088,9 +1209,20 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           let out;
           let seenThreadId = null; // codex's conversation id, off thread.started
           const spawned = []; // this turn's children, for the teardown registry
-          const narrator = makeNarrator(job.sessionId);
+          const narrator = makeNarrator(job.sessionId, job.id);
           try {
-            const message = [job.body, adoptNote, carryNote].filter(Boolean).join('\n\n');
+            // Files first, then the message that references them: the agent
+            // must be able to open what it is being told about. Only the ones
+            // that actually landed are named.
+            const files = await fetchAttachments(dir.wt, job.attachments);
+            const filesNote = files.length
+              ? `[FILES THE HUMAN ATTACHED TO THIS MESSAGE — already on disk in this worktree]\n${files
+                  .map((f) => `- ${f}`)
+                  .join('\n')}`
+              : '';
+            const message = [job.body, filesNote, adoptNote, carryNote]
+              .filter(Boolean)
+              .join('\n\n');
             const turnArgs = {
               // A plain tab has no tools to name and no session id to pass —
               // its kickoff asks for one complete report instead of a stream.
@@ -1599,6 +1731,25 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     }
   };
 
+  /**
+   * Is ANY session work in flight — the answer safeToUpdate needs. A self-
+   * update re-execs the process: a mid-turn CLI would be SIGTERM'd and its
+   * half-finished answer settled as the tab's reply, and a queued-but-
+   * undelivered settle report would die in memory — after which the skip-
+   * guard's protection is gone and the re-exec'd daemon re-runs a turn whose
+   * side effects (edits, commits, cards) already happened. `workChains` holds
+   * an entry for every queued-or-running turn and ship (entries self-delete
+   * when a chain drains); the other collections are belt over braces for the
+   * windows around it.
+   */
+  const workBusy = () =>
+    workChains.size > 0 ||
+    shipping.size > 0 ||
+    workChildren.size > 0 ||
+    workAnswering.size > 0 ||
+    pendingWorkReports.size > 0 ||
+    pendingShipReports.size > 0;
+
   return {
     flushWorkReports,
     processWorkTurns,
@@ -1606,5 +1757,6 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,
+    workBusy,
   };
 }

package/bin/lib/worktreeDiff.mjs

@@ -71,6 +71,10 @@ export function worktreeDiff(wt, baseRef) {
   let deletions = 0;
   const push = (path, added, deleted, binary = false) => {
     if (!path) return;
+    // Clamped to the server's zod cap (file path ≤ 300 — see the caps at the
+    // return, below): one over-cap string would 400 the whole report batch,
+    // and a readout must degrade to a shorter label, never to silence.
+    path = path.slice(0, 300);
     files.push(binary ? { path, added, deleted, binary } : { path, added, deleted });
     additions += added;
     deletions += deleted;
@@ -143,7 +147,14 @@ export function worktreeDiff(wt, baseRef) {
       for (const line of raw.split('\n')) {
         if (!line.trim()) continue;
         const [sha, subject, author] = line.split('\x1f');
-        if (sha) baseCommits.push({ sha, subject: subject ?? '', author: author ?? '' });
+        // Same clamp-to-the-server's-caps rule as the file paths: a subject or
+        // author name is whatever a person typed, and git puts no bound on it.
+        if (sha)
+          baseCommits.push({
+            sha,
+            subject: (subject ?? '').slice(0, 200),
+            author: (author ?? '').slice(0, 80),
+          });
       }
     }
   } catch {
@@ -161,12 +172,16 @@ export function worktreeDiff(wt, baseRef) {
   files.sort(
     (x, y) => y.added + y.deleted - (x.added + x.deleted) || (x.path < y.path ? -1 : 1)
   );
+  // Every string here is clamped to the server's own zod caps (branch ≤ 200,
+  // baseLabel ≤ 120, subject ≤ 200, author ≤ 80, file path ≤ 300): the report
+  // rides in a BATCH, so a single over-cap string — a generated branch name, a
+  // pathological commit subject — would 400 every session's readout at once.
   return {
-    branch,
+    branch: branch.slice(0, 200),
     path: wt,
     ahead,
     behind,
-    baseLabel: String(baseRef).replace(/^origin\//, ''),
+    baseLabel: String(baseRef).replace(/^origin\//, '').slice(0, 120),
     baseCommits,
     dirty,
     additions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.48.1",
+  "version": "0.48.2",
   "description": "Run your own coding CLIs as headless build agents for Flowviant — Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {