flowviant 0.51.2 → 0.53.0

package/bin/lib/authproxy.mjs

@@ -1,44 +1,124 @@
 /**
- * Opt-in basic-auth reverse proxy for previews (`.flowviant/preview.json`
- * "auth": true). The public tunnel is otherwise a capability URL — anyone with
- * it reaches the running app. This gates it: cloudflared → this proxy → dev
- * server, with a generated password the app surfaces to the reviewer.
+ * The password gate in front of a shared preview. cloudflared → this proxy →
+ * the dev server the DRIVER started in their own worktree.
  *
- * Minimal + dependency-free: forwards HTTP, and pipes WS upgrades (HMR) — the
+ * MANDATORY, not opt-in (2026-08-21). It was `.flowviant/preview.json`
+ * "auth": true, defaulting OFF, and its caller logged "tunneling WITHOUT a
+ * password" to a console nobody reads and opened the tunnel anyway. A tunnel
+ * publishes a worktree holding the project's materialized dev secrets; there is
+ * no honest default but closed. `startAuthProxy` returning null now means the
+ * share is ABORTED and the machine says why.
+ *
+ * Minimal and dependency-free: forwards HTTP, and pipes WS upgrades (HMR) — the
  * browser re-sends the cached Basic-auth header on same-origin upgrades, so HMR
- * still authenticates. If a proxy request fails the page just 502s; it never
- * touches the default (no-auth) preview path.
+ * still authenticates.
+ *
+ * Three things this file gets wrong easily, all of them fixed here and all of
+ * them worth keeping fixed:
+ *  - the credential must NOT reach the origin. `headers: req.headers` forwarded
+ *    `authorization` verbatim, handing the gate password to whatever code the
+ *    branch happens to be running. It is stripped now.
+ *  - the comparison is over a secret, so it is constant-time over a digest
+ *    rather than `===` over a string.
+ *  - `stop()` was a bare `server.close()`, which refuses NEW connections and
+ *    leaves live ones alone — so a held HMR websocket kept the page alive for
+ *    the one most-engaged viewer after teardown. Live sockets are tracked and
+ *    destroyed.
  */
 
 import { createServer, request } from 'node:http';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+
+/** Failed attempts before the proxy stops answering at all. A quick tunnel's
+ *  hostname is unguessable, so this is not the primary control — it is what
+ *  turns a discovered URL from an offline guessing target into a visible,
+ *  self-closing incident. */
+const MAX_FAILED = 25;
+
+const digest = (s) => createHash('sha256').update(String(s)).digest();
+
+/** Constant-time over sha256 digests, so length never leaks and a missing
+ *  header costs the same as a wrong one. */
+function sameSecret(a, b) {
+  try {
+    return timingSafeEqual(digest(a ?? ''), digest(b ?? ''));
+  } catch {
+    return false;
+  }
+}
 
-/** Start the proxy in front of a dev server on `targetPort`. Resolves
- *  { port, user, password, stop }. Binds loopback only (cloudflared connects
- *  locally); the password is what gates the public tunnel. */
-export function startAuthProxy({ targetPort, log }) {
+/**
+ * Start the gate in front of a dev server on `targetPort`. Resolves
+ * { port, user, password, stop } — or NULL, which the caller must treat as a
+ * hard failure. Binds loopback only; cloudflared connects locally, and the
+ * password is what gates the public hostname.
+ *
+ * `onAbuse` fires once, after MAX_FAILED rejected attempts, so the caller can
+ * tear the whole share down rather than leaving a URL under attack.
+ */
+export function startAuthProxy({ targetPort, log, onAbuse }) {
   const user = 'preview';
-  const password = randomBytes(9).toString('base64url'); // ~12 url-safe chars
+  // 24 bytes → 32 url-safe chars. It was 9 bytes, chosen when this was an
+  // opt-in convenience; it is the only thing between a public hostname and a
+  // worktree now.
+  const password = randomBytes(24).toString('base64url');
   const expected = 'Basic ' + Buffer.from(`${user}:${password}`).toString('base64');
-  const authed = (req) => req.headers['authorization'] === expected;
 
-  const forwardOpts = (req) => ({
-    host: '127.0.0.1',
-    port: targetPort,
-    method: req.method,
-    path: req.url,
-    headers: req.headers,
-  });
+  let failed = 0;
+  let abused = false;
+  const authed = (req) => {
+    if (abused) return false;
+    if (sameSecret(req.headers['authorization'], expected)) {
+      failed = 0;
+      return true;
+    }
+    // A bare GET with no header is the browser's first move on every load, and
+    // it is answered with a 401 challenge — it is not an attempt.
+    if (req.headers['authorization']) failed += 1;
+    if (failed >= MAX_FAILED && !abused) {
+      abused = true;
+      log?.(`preview gate: ${failed} failed attempts — closing the share.`);
+      try {
+        onAbuse?.();
+      } catch {
+        /* the caller's teardown is best-effort */
+      }
+    }
+    return false;
+  };
+
+  // The gate credential is OURS and stops here. Everything else is passed
+  // through untouched: the origin is the driver's own dev server and rewriting
+  // its request would be us editing their app's input.
+  const forwardOpts = (req) => {
+    const headers = { ...req.headers };
+    delete headers.authorization;
+    delete headers['proxy-authorization'];
+    return {
+      host: '127.0.0.1',
+      port: targetPort,
+      method: req.method,
+      path: req.url,
+      headers,
+    };
+  };
+
+  const challenge = (res) => {
+    res.writeHead(401, {
+      'WWW-Authenticate': 'Basic realm="Flowviant preview"',
+      'Content-Type': 'text/plain',
+      // A preview is a moving target by definition; nothing about it should sit
+      // in a cache the viewer cannot see.
+      'Cache-Control': 'no-store',
+    });
+    res.end('This preview is password-protected. Enter the password shown in Flowviant.');
+  };
+
+  // Every live socket, so stop() can actually end the ones already talking.
+  const sockets = new Set();
 
   const server = createServer((req, res) => {
-    if (!authed(req)) {
-      res.writeHead(401, {
-        'WWW-Authenticate': 'Basic realm="Flowviant preview"',
-        'Content-Type': 'text/plain',
-      });
-      res.end('This preview is password-protected. Enter the password shown in Flowviant.');
-      return;
-    }
+    if (!authed(req)) return challenge(res);
     const proxyReq = request(forwardOpts(req), (proxyRes) => {
       res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
       proxyRes.pipe(res);
@@ -50,8 +130,13 @@ export function startAuthProxy({ targetPort, log }) {
     req.pipe(proxyReq);
   });
 
+  server.on('connection', (socket) => {
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+  });
+
   // WS upgrade (HMR). The browser resends the Basic-auth header on same-origin
-  // upgrades, so we can gate it too, then pipe the two sockets together.
+  // upgrades, so we gate it too, then pipe the two sockets together.
   server.on('upgrade', (req, socket, head) => {
     if (!authed(req)) {
       socket.write('HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm="Flowviant preview"\r\n\r\n');
@@ -65,6 +150,8 @@ export function startAuthProxy({ targetPort, log }) {
       if (proxyHead && proxyHead.length) proxySocket.unshift(proxyHead);
       proxySocket.pipe(socket);
       socket.pipe(proxySocket);
+      sockets.add(proxySocket);
+      proxySocket.on('close', () => sockets.delete(proxySocket));
       proxySocket.on('error', () => socket.destroy());
       socket.on('error', () => proxySocket.destroy());
     });
@@ -74,10 +161,12 @@ export function startAuthProxy({ targetPort, log }) {
   });
 
   return new Promise((resolve) => {
-    server.on('error', () => resolve(null)); // couldn't bind → caller falls back to no proxy
+    // Could not bind → the caller ABORTS the share. There is no no-proxy path
+    // to fall back to any more.
+    server.on('error', () => resolve(null));
     server.listen(0, '127.0.0.1', () => {
       const port = server.address().port;
-      log?.(`auth proxy on :${port} — preview is password-gated`);
+      log?.(`preview gate on :${port}`);
       resolve({
         port,
         user,
@@ -88,6 +177,16 @@ export function startAuthProxy({ targetPort, log }) {
           } catch {
             /* already closed */
           }
+          // close() only stops NEW connections. An open HMR socket would keep
+          // serving the viewer who is still looking at it.
+          for (const s of sockets) {
+            try {
+              s.destroy();
+            } catch {
+              /* already gone */
+            }
+          }
+          sockets.clear();
         },
       });
     });

package/bin/lib/claude.mjs

@@ -197,7 +197,7 @@ const oneLine = (s, n = 160) => String(s).replace(/\s+/g, ' ').trim().slice(0, n
 // every intermediate text block still NARRATES, but only the final `result`
 // event contributes text — otherwise the same sentences arrive twice, once as
 // they stream and once in the result, and the tab posts the duplicate.
-function handleStreamLine(line, { cwd, emit, onActivity, appendText, answerFromResult }) {
+function handleStreamLine(line, { cwd, emit, onActivity, appendText, answerFromResult, onInit }) {
   let ev;
   try {
     ev = JSON.parse(line);
@@ -224,6 +224,19 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText, answerFromR
         push(humanizeToolUse(b.name, b.input || {}, cwd));
       }
     }
+  } else if (ev.type === 'system' && ev.subtype === 'init') {
+    // WHAT THIS MACHINE'S CLI CAN BE ASKED FOR BY NAME. The init event is the
+    // CLI's OWN answer — it has already resolved personal skills, this repo's
+    // skills, plugins and whatever the project settings enable or disable — so
+    // reading it costs nothing and cannot drift the way a `~/.claude/skills`
+    // scan of our own would. `skills` (rather than `slash_commands`) is the
+    // deliberate narrowing: the 50-odd commands beside it are the CLI's own
+    // interactive furniture (/clear, /model, /compact), and offering those in a
+    // relayed tab would be an offer wired to nothing.
+    //
+    // Only ever REPORTED, never enforced. Flowviant does not decide what your
+    // Claude can do; it relays what your Claude said it has.
+    if (Array.isArray(ev.skills)) onInit?.({ skills: ev.skills.map(String) });
   } else if (ev.type === 'result') {
     // The final assistant text (carries WIKI_DONE / REGROUND_DONE).
     if (typeof ev.result === 'string') appendText(ev.result + '\n');
@@ -247,7 +260,7 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText, answerFromR
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onInit, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
     if (!rt.args) {
@@ -359,7 +372,7 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       /** One line of the child's stdout, in whichever dialect it speaks. */
       const onLine = (line) => {
         if (!rt.parse)
-          return handleStreamLine(line, { cwd, emit, onActivity, appendText, answerFromResult });
+          return handleStreamLine(line, { cwd, emit, onActivity, appendText, answerFromResult, onInit });
         const ev = rt.parse(line, cwd);
         if (!ev) return;
         // The conversation id, when the runtime announces one (codex's

package/bin/lib/config.mjs

@@ -1,5 +1,6 @@
 /** Parsed configuration: env vars, CLI flags, and the chosen credentials. */
 
+import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -168,6 +169,21 @@ export const ALLOW_PATCHES =
 // them (Node's default UA is treated as a bot). Claude Code sends its own UA.
 export const USER_AGENT = `flowviant/${VERSION}`;
 
+/**
+ * WHICH DAEMON PROCESS this is — not which credential.
+ *
+ * Two daemons legitimately share one fleet token (that is exactly what
+ * `machineDaemonsDisagree` reports, and the instance lock added in 0.51.2
+ * cannot see a peer OLDER than itself). So the token cannot identify a lease
+ * holder, and anything that must be done exactly once needs this instead.
+ *
+ * Regenerated every start, deliberately: a daemon that restarted is a daemon
+ * that lost whatever it was holding, and a stale lease should not follow it
+ * back. Sent on the poll as `di`; its ABSENCE is what an older daemon looks
+ * like, and the server hands preview work to nobody who cannot name themselves.
+ */
+export const DAEMON_INSTANCE = randomBytes(12).toString('hex');
+
 // The ONE credential. `tokens` (FLOWVIANT_TOKEN / FLOWVIANT_TOKENS / --token /
 // --tokens) stood beside it and carried WORKER tokens into the pre-daemon loop;
 // that principal owns zero tools since dispatch was deleted, and the kind can no

package/bin/lib/fleet.mjs

@@ -23,6 +23,7 @@ import {
   USER_AGENT,
   MCP_URL,
   SAFE,
+  DAEMON_INSTANCE,
   POLL_SECONDS,
   MAX_CONCURRENT,
   IDLE_SECONDS,
@@ -73,11 +74,11 @@ import {
 } from './env.mjs';
 import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 import { machineSnapshot } from './resources.mjs';
-import { detectRuntimes, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
+import { detectRuntimes, knownSkills, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
 import { createWorkManager } from './work.mjs';
 import { scanLocalSessions } from './localSessions.mjs';
 
-async function fetchRoster(haveIds) {
+async function fetchRoster(haveIds, livePreviewSessionIds = []) {
   const url = new URL(FLEET_URL);
   if (haveIds.length) url.searchParams.set('have', haveIds.join(','));
   // What this machine will run at once. The server grows lanes to meet waiting
@@ -98,6 +99,15 @@ async function fetchRoster(haveIds) {
   // so a team can see whether the shared box runs wide open, and enforces
   // nothing (membership is the consent boundary). Older servers ignore it.
   url.searchParams.set('safe', SAFE ? '1' : '0');
+  // WHICH PROCESS, so the server can lease preview work to exactly one of two
+  // daemons on one credential. Older servers ignore unknown params.
+  url.searchParams.set('di', DAEMON_INSTANCE);
+  // Which shares this machine is still serving. It rides the poll rather than
+  // taking an endpoint of its own: one beat, no floor, and the stale window is
+  // the reconcile interval instead of minutes — which matters, because a share
+  // the server still calls live is a 530 on somebody's phone. Always set, even
+  // empty: '' means "serving none", absent would mean "an older daemon".
+  url.searchParams.set('pv', livePreviewSessionIds.join(','));
   // WHICH CLIs this machine actually has, so the app can stop guessing.
   //
   // Until now every surface that listed Gemini or Codex said "not wired up yet"
@@ -118,6 +128,21 @@ async function fetchRoster(haveIds) {
   } catch {
     /* detection is best-effort — a probe must never fail the poll */
   }
+  // WHAT THE CLI CAN BE ASKED FOR BY NAME, so the composer can autocomplete a
+  // `/` the way the terminal does. Learned from the init event of a turn we
+  // already ran (runtimes.mjs) — never probed, because spawning a CLI to fill a
+  // dropdown would spend the operator's quota on an affordance.
+  //
+  // NOT SENT until a turn has taught us: absent means "no turn has run here
+  // yet", and the app renders no menu rather than asserting this machine has no
+  // skills. An empty report, though, IS a fact and is sent as such — hence the
+  // null check rather than a truthiness check on the array.
+  try {
+    const skills = knownSkills();
+    if (skills !== null) url.searchParams.set('skills', skills.join(','));
+  } catch {
+    /* best-effort — the poll must never fail on a readout */
+  }
   // Env-sync identity + materialized version (the Settings "env vN" chip).
   try {
     for (const [k, v] of Object.entries(await envQueryParams())) {
@@ -359,6 +384,14 @@ export async function runFleetDaemon() {
   const nextByAgent = new Map();
   let leaseTtlSeconds = 24 * 60 * 60; // updated from each roster response
   let mcpUrl = MCP_URL;
+  // DEAD, and kept only because unpicking it is a rewire rather than a
+  // deletion: nothing calls `workers.set` anywhere in this tree. It held
+  // DISPATCH lanes, and the server has sent `agents: []` permanently since
+  // 2026-08-19, so every loop below iterates nothing. Two `stopPreview` calls
+  // hung off it until 2026-08-21 and read as live preview wiring; they were
+  // deleted, not rewired. When the Workbench preview lands, its teardown is
+  // keyed on sessionId and belongs beside retireWorkSessions in work.mjs —
+  // NOT here.
   const workers = new Map(); // agentId -> { state, promise, wt, label }
   let daemonAlive = true; // flipped false on shutdown so the stream stops reconnecting
   let stream = null; // push channel handle (set once the loop is set up)
@@ -398,15 +431,10 @@ export async function runFleetDaemon() {
       } catch {
         /* best-effort */
       }
-      // Stop the detached preview (dev server + cloudflared tunnel) — it's its
-      // own process group and survives our exit, otherwise leaking a port-bound
-      // server + a live tunnel serving a stale branch until reboot.
-      try {
-        w.state.stopPreview?.();
-      } catch {
-        /* best-effort */
-      }
     }
+    // Detached tunnels survive our exit by design, so leaving them would strand
+    // a public hostname until the box rebooted.
+    shutdownPreviews();
   };
   process.on('SIGINT', () => {
     console.log('');
@@ -578,6 +606,10 @@ export async function runFleetDaemon() {
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    processPreviewJobs,
+    livePreviewIds,
+    retirePreviews,
+    shutdownPreviews,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,
@@ -1138,7 +1170,7 @@ export async function runFleetDaemon() {
   for (;;) {
     let roster;
     try {
-      roster = await fetchRoster(buildHave());
+      roster = await fetchRoster(buildHave(), livePreviewIds());
     } catch (e) {
       if (e.auth) {
         fail(`${e.message} — credential revoked or invalid. Shutting down.`);
@@ -1200,11 +1232,20 @@ export async function runFleetDaemon() {
     // AFTER the work/ship intake: retirement is the server saying which
     // sessions are LIVE, and the guards above (chains, shipping) are populated
     // by the intake this same tick.
+    // BEFORE retirement, and the order is load-bearing: `git worktree remove`
+    // under a running dev server leaves it serving bytes from open file handles
+    // in a directory that no longer exists — a human is shown the wrong thing
+    // and nothing errors anywhere.
+    retirePreviews(roster.activeWorkSessions);
     retireWorkSessions(roster.activeWorkSessions);
     // Diffs somebody has open and is waiting on. Project-scoped rather than
     // per-session: `git show` runs from the repo ROOT, which can see a closed
     // tab's branch and a shipped commit on main alike.
     processDiffJobs(roster.diffJobs);
+    // Shares to open or tear down. CLAIMED before acted on — two daemons on one
+    // credential are both handed this array, and both opening a tunnel strands
+    // a public hostname nobody can settle.
+    processPreviewJobs(roster.previewJobs);
     // …and what the SURVIVING ones hold: branch, ahead-of-base, diffstat.
     // Throttled inside, never awaited — a `git status` the human cannot run
     // themselves from a browser, relayed. After retirement so a directory that
@@ -1308,11 +1349,6 @@ export async function runFleetDaemon() {
         } catch {
           /* best-effort */
         }
-        try {
-          w.state.stopPreview?.();
-        } catch {
-          /* best-effort */
-        }
         // Only poll mode's per-lane tree dies with the lane. A live lane owns no
         // checkout: the task it was building has its own, which must SURVIVE —
         // removing a lane requeues its task, and the next lane to pick that task