flowviant 0.48.5 → 0.50.0

package/bin/lib/fleet.mjs

@@ -550,6 +550,7 @@ export async function runFleetDaemon() {
     flushWorkReports,
     processWorkTurns,
     processShipJobs,
+    processDiffJobs,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,
@@ -1173,6 +1174,10 @@ export async function runFleetDaemon() {
     // sessions are LIVE, and the guards above (chains, shipping) are populated
     // by the intake this same tick.
     retireWorkSessions(roster.activeWorkSessions);
+    // Diffs somebody has open and is waiting on. Project-scoped rather than
+    // per-session: `git show` runs from the repo ROOT, which can see a closed
+    // tab's branch and a shipped commit on main alike.
+    processDiffJobs(roster.diffJobs);
     // …and what the SURVIVING ones hold: branch, ahead-of-base, diffstat.
     // Throttled inside, never awaited — a `git status` the human cannot run
     // themselves from a browser, relayed. After retirement so a directory that

package/bin/lib/prompts.mjs

@@ -254,14 +254,30 @@ THE LEDGER. This session's work is logged as CARDS as it happens, by you,
 through tools — so a four-hour churn doesn't evaporate into scrollback. The
 rules:
 
-6. CLAIM WHAT YOU WORK. When they say "take the auth card" or "next", call
-   list_cards, then claim_card the one they mean. The card you hold is the
-   tab's "Now" — it is how they and their team see what this session is doing.
-7. LOG DRIFT, don't ask permission for it. "Also fix that redirect" mid-flow:
+6. SAY WHAT YOU ARE DOING, on the card. When they say "take the auth card" or
+   "next", call list_cards, then log_work on the one they mean — that puts it on
+   their Working pile and their name on it. Call it AGAIN at real milestones: a
+   decision made, a hard part landed, a blocker found. One short line, past
+   tense, what a person scanning the card in a week needs. NOT every turn, and
+   NOT your reasoning — this tab's transcript is where prose goes; the card is
+   the record.
+   NOTHING REFUSES YOU. Several sessions may work one card and you may work
+   several cards; a teammate already on it is worth SAYING and is never a reason
+   to stop. drop_card when they change course.
+7. PUT THE CARD IN YOUR COMMITS. Every commit for a card ends its message with a
+   trailer on its own line:
+
+       Flowviant-Task: <the card id>
+
+   That is how the card's Changes list, and its history, learn which commits
+   built it — from the machine, not from your memory. One trailer per card the
+   commit serves. A commit that belongs to no card needs none; shipping
+   reconciles those anyway.
+8. LOG DRIFT, don't ask permission for it. "Also fix that redirect" mid-flow:
    do the work, and file_card it — check list_cards FIRST; if a planned card
-   already covers it, claim that one instead of filing a twin. One card per
-   shippable unit. Never card-ify chatter, questions, or exploration.
-8. PLANNING HAPPENS HERE. When they arrive with something big — "build the
+   already covers it, log_work against that one instead of filing a twin. One
+   card per shippable unit. Never card-ify chatter, questions, or exploration.
+9. PLANNING HAPPENS HERE. When they arrive with something big — "build the
    invite flow", "scaffold the admin area" — reading the code and breaking it
    into cards is YOUR job, in this tab. There is no planning surface anywhere
    else. Work it out with them in prose first; when the shape is settled, write
@@ -274,13 +290,13 @@ rules:
    empty and nothing breaks — the forecast quietly falls back to a flat default
    and the review has less to ask about. A card you have just designed is the
    only moment anyone knows those answers.
-9. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
+10. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
    one-paragraph summary and the commit shas. Delivered is ASSERTED; done is
    OBSERVED (the merge, on their word). Never claim done, and never deliver
    work that isn't committed.
-10. RAISE WHAT YOU SPOT. A design flaw, a follow-up they named for later —
+11. RAISE WHAT YOU SPOT. A design flaw, a follow-up they named for later —
     raise_card, queued, unheld. You do not start raised work.
-11. BE PROPORTIONAL. A one-line typo fix inside the card you already hold is
+12. BE PROPORTIONAL. A one-line typo fix inside the card you are already on is
     that card's work, not a new card. When in doubt, fewer cards. A plan is
     slices somebody could pick up one at a time, not a work-breakdown
     structure — if a card cannot be shipped on its own, it is not a card.
@@ -325,6 +341,9 @@ MECHANICS OF THIS TAB:
 3. YOU HAVE NO FLOWVIANT TOOLS in this session — no cards, no ledger calls.
    Don't mention or simulate them. Your commits ARE your record: when this
    tab's branch ships, every commit is reconciled onto the project ledger.
+   If the human names a card id, put it in the commit message as a trailer on
+   its own line — \`Flowviant-Task: <id>\` — and that commit will show up on the
+   card without any tool call. It is the one ledger gesture available here.
 4. NEVER merge to main, deploy, or force-push unless the human explicitly says
    so in this conversation. Branch pushes are fine when asked. Shipping is
    their word to say, not yours to infer.

package/bin/lib/work.mjs

@@ -91,6 +91,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   const SHIP_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/ship-done');
   const ACTIVITY_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-activity');
   const WORKTREES_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-worktrees');
+  const DIFF_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/diff-done');
   const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
   const workAnswering = new Set(); // turn ids currently queued/running here
   const workAttempts = new Map(); // turn id -> completed runTurn attempts
@@ -366,6 +367,104 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     })();
   };
 
+  /**
+   * COMMIT DIFFS, on request — the one PULL-shaped thing this daemon does.
+   *
+   * Everything else here is a push: the machine knows something and says it.
+   * A patch cannot work that way, because most are never opened and pushing
+   * every one would be storage and bandwidth for nothing. So the server leaves
+   * a job on the roster and this drains it.
+   *
+   * RUN FROM THE REPO ROOT, never a session worktree. A tab can be closed and
+   * its directory gone, but `session/<id>` outlives the tab and after a ship
+   * the commit is on main — the root checkout can see all of it, and a
+   * worktree can see only its own branch.
+   *
+   * Every failure is REPORTED rather than swallowed: "no such commit on this
+   * machine" is a real answer, and a viewer spinning forever is the worst thing
+   * this can do. The one thing never sent is a guess — an empty patch would
+   * tell a reader the commit changed nothing.
+   */
+  const MAX_PATCH_BYTES = 256 * 1024;
+  const servedDiffs = new Set();
+  const postDiff = async (body) => {
+    try {
+      await fetch(DIFF_DONE_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(30_000),
+        body: JSON.stringify(body),
+      });
+    } catch {
+      /* the row stays pending and expires; the next click re-requests */
+    }
+  };
+  const processDiffJobs = (jobs) => {
+    if (!Array.isArray(jobs) || jobs.length === 0) return;
+    for (const job of jobs.slice(0, 5)) {
+      const sha = String(job?.sha || '').toLowerCase();
+      // A sha becomes a `git` argument. The server validates too; one place
+      // doing this check is one deploy away from being zero places.
+      if (!/^[0-9a-f]{7,64}$/.test(sha)) continue;
+      // In-flight guard, not a cache: the server stops offering a sha the
+      // moment it settles, so this only stops the SAME poll's job being
+      // started twice while its `git show` is still running.
+      if (servedDiffs.has(sha)) continue;
+      servedDiffs.add(sha);
+      void (async () => {
+        try {
+          let patch = '';
+          const files = [];
+          try {
+            // `--format=` so the body is pure diff: the subject, author and
+            // date already reached the card on the worktree sweep, and
+            // repeating them inside the patch would put a second copy above
+            // every hunk.
+            patch = git(['show', '--patch', '--format=', sha], repoRoot);
+          } catch (e) {
+            await postDiff({ sha, error: String(e?.message || e).slice(0, 500) });
+            return;
+          }
+          try {
+            const raw = git(['show', '--numstat', '--format=', sha], repoRoot);
+            for (const line of raw.split('\n')) {
+              if (!line.trim()) continue;
+              const [a, d, ...rest] = line.split('\t');
+              const path = rest.join('\t');
+              if (!path) continue;
+              const binary = a === '-' || d === '-';
+              files.push({
+                path: path.slice(0, 300),
+                added: binary ? 0 : Number(a) || 0,
+                deleted: binary ? 0 : Number(d) || 0,
+                ...(binary ? { binary: true } : {}),
+              });
+            }
+          } catch {
+            /* a header without counts still beats no diff */
+          }
+          const truncated = Buffer.byteLength(patch, 'utf8') > MAX_PATCH_BYTES;
+          await postDiff({
+            sha,
+            // Cut on a LINE boundary: half a hunk header renders as garbage,
+            // and the viewer says the patch was truncated either way.
+            patch: truncated
+              ? patch.slice(0, MAX_PATCH_BYTES).replace(/\n[^\n]*$/, '\n')
+              : patch,
+            files: files.slice(0, 200),
+            truncated,
+          });
+        } finally {
+          servedDiffs.delete(sha);
+        }
+      })();
+    }
+  };
+
   /**
    * FILES THE HUMAN ATTACHED, brought to where a CLI can read them.
    *
@@ -1754,6 +1853,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     flushWorkReports,
     processWorkTurns,
     processShipJobs,
+    processDiffJobs,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,

package/bin/lib/worktreeDiff.mjs

@@ -13,6 +13,12 @@
  * uncommitted work in the same total. Untracked files count too: git calls them
  * nothing until they are added, and a human calls them new work.
  *
+ * It also carries THIS BRANCH'S OWN COMMITS and the cards they name — see
+ * `branchCommits` below. That rides here rather than on a route of its own
+ * because this sweep is already standing in the right directory on the right
+ * beat, and a second endpoint would be a second poll for a fact this one is
+ * next to.
+ *
  * Everything here is best-effort and read-only. A worktree mid-rebase, a
  * deleted directory, a file that vanished between listing and reading — each
  * degrades to a smaller answer, never to a thrown error. Nothing about a
@@ -30,6 +36,109 @@ const MAX_FILES = 20;
 const MAX_UNTRACKED_SCAN = 200;
 /** Past this we call a file binary rather than counting its lines. */
 const MAX_COUNT_BYTES = 512 * 1024;
+/** Commits reported per sweep. The server caps each CARD at 50; this is the
+ *  branch-wide bound, and a session branch past it is carrying an afternoon
+ *  nobody is going to read commit-by-commit. */
+const MAX_COMMITS = 50;
+
+/**
+ * WHICH CARDS A COMMIT NAMES.
+ *
+ * The convention is a git TRAILER — `Flowviant-Task: <id>` on its own line at
+ * the foot of the message, the same shape as `Co-authored-by:` and `Signed-off-
+ * by:`. Chosen over another MCP call for three reasons: it costs no write
+ * budget, it works on agy tabs which cannot mount MCP at all, and the commit IS
+ * the evidence rather than an assertion about it.
+ *
+ * Case-insensitive on the key and tolerant of several ids on one line, because
+ * a person or an agent writing this by hand will do both. Anything that is not
+ * a plausible id is dropped here rather than shipped: the server drops unknown
+ * ids too, but a readout should not spend a request on obvious noise.
+ */
+function taskIdsFromMessage(body) {
+  const ids = [];
+  for (const line of String(body || '').split('\n')) {
+    const m = line.match(/^\s*Flowviant-Task\s*:\s*(.+?)\s*$/i);
+    if (!m) continue;
+    for (const raw of m[1].split(/[\s,]+/)) {
+      const id = raw.replace(/^[#<]+|[>,.]+$/g, '');
+      if (id && id.length <= 64 && /^[A-Za-z0-9_-]+$/.test(id) && !ids.includes(id)) {
+        ids.push(id);
+      }
+    }
+  }
+  return ids;
+}
+
+/**
+ * The commits this branch has that base does not, with the cards they name.
+ *
+ * Only commits carrying a trailer are RETURNED: an untrailered commit belongs
+ * to no card, and ship-time reconciliation already turns those into a bundle so
+ * nothing shipped is invisible. Sending them anyway would be a payload the
+ * server drops on every sweep.
+ *
+ * `--no-merges`, because a merge commit describes a range rather than doing
+ * work, and its trailer (if it has one) would double-book the range's own
+ * commits.
+ */
+function branchCommits(wt, base) {
+  if (!base) return [];
+  const out = [];
+  try {
+    // %x1e between records, %x1f between fields — a subject and a body can
+    // contain anything a person can type, so the delimiters must be bytes they
+    // cannot.
+    const raw = git(
+      [
+        'log',
+        '--no-merges',
+        '-n',
+        String(MAX_COMMITS),
+        '--format=%H%x1f%s%x1f%an%x1f%aI%x1f%B%x1e',
+        `${base}..HEAD`,
+      ],
+      wt
+    );
+    for (const rec of raw.split('\x1e')) {
+      const line = rec.replace(/^\n+/, '');
+      if (!line.trim()) continue;
+      const [sha, subject, author, at, body] = line.split('\x1f');
+      if (!sha) continue;
+      const taskIds = taskIdsFromMessage(body);
+      if (taskIds.length === 0) continue;
+      let additions = 0;
+      let deletions = 0;
+      try {
+        const stat = git(['show', '--numstat', '--format=', sha], wt);
+        for (const l of stat.split('\n')) {
+          if (!l.trim()) continue;
+          const [a, d] = l.split('\t');
+          if (a === '-' || d === '-') continue; // binary
+          additions += Number(a) || 0;
+          deletions += Number(d) || 0;
+        }
+      } catch {
+        /* a commit we cannot stat still names its cards — send it anyway */
+      }
+      out.push({
+        // Clamped to the server's zod caps, same rule as everything else in
+        // this file: one over-cap string 400s the whole batch.
+        sha: sha.slice(0, 64),
+        subject: (subject ?? '').slice(0, 200),
+        author: (author ?? '').slice(0, 80),
+        at: (at ?? '').slice(0, 40),
+        additions,
+        deletions,
+        taskIds: taskIds.slice(0, 8),
+      });
+    }
+  } catch {
+    /* no base, unborn branch, or a repo mid-rebase — report no commits */
+  }
+  // Oldest first, so a card's list reads in the order the work happened.
+  return out.reverse();
+}
 
 /** Lines in a buffer, the way a diff counts them: a trailing newline does not
  *  add a line, and a NUL byte anywhere means we are not looking at text. */
@@ -48,7 +157,9 @@ function countLines(buf) {
  *   baseLabel:string, baseCommits:{sha:string, subject:string, author:string}[],
  *   dirty:boolean, additions:number, deletions:number, fileCount:number,
  *   truncated:number,
- *   files:{path:string, added:number, deleted:number, binary?:boolean}[]}}
+ *   files:{path:string, added:number, deleted:number, binary?:boolean}[],
+ *   commits:{sha:string, subject:string, author:string, at:string,
+ *     additions:number, deletions:number, taskIds:string[]}[]}}
  */
 export function worktreeDiff(wt, baseRef) {
   if (!wt || !existsSync(wt)) return null;
@@ -189,5 +300,6 @@ export function worktreeDiff(wt, baseRef) {
     fileCount: files.length,
     truncated: Math.max(0, files.length - MAX_FILES),
     files: files.slice(0, MAX_FILES),
+    commits: branchCommits(wt, base),
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.48.5",
+  "version": "0.50.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {