flowviant 0.51.2 → 0.53.0

package/bin/lib/prompts.mjs

@@ -397,24 +397,73 @@ for work, do it.
 
 Write plain Markdown for a person reading your reply in a chat tab.`;
 
+/**
+ * A LEADING SLASH COMMAND, which the CLI will only expand at position 0.
+ *
+ * Claude Code parses `/name …` as a command ONLY when it opens the prompt. Every
+ * turn here wraps the human's words in the scaffolding below, so a `/code-review`
+ * typed into a tab used to arrive on line 6 of a fenced block — inert text that
+ * looked like it should have worked. That is the product telling you no for
+ * bookkeeping reasons, which is the one thing it never does.
+ *
+ * SHAPE, NOT MEMBERSHIP. We do not check the name against the machine's skill
+ * list: that list is only learned after a turn has run (runtimes.mjs), so
+ * gating on it would make the first `/foo` of a machine's life behave
+ * differently from the second. Instead this matches what a command can LOOK
+ * like — one segment, no second slash — which leaves `/home/user/x.ts is
+ * broken` fenced as the prose it is. Measured on 2.1.238: an unknown command
+ * is treated as ordinary text, so a false positive costs nothing anyway.
+ */
+const LEADING_SLASH_COMMAND = /^\/[A-Za-z0-9][A-Za-z0-9_:-]*(?=\s|$)/;
+
+/**
+ * The kickoff, in the two orders it can be written.
+ *
+ * ORDINARY: scaffolding first, the human's words fenced inside it. The speaker
+ * is the tab's OWNER — the same person who owns this machine — so this is the
+ * one prompt whose author is fully trusted. The fence stays anyway: it costs
+ * nothing and keeps the shape identical everywhere, and repo content this turn
+ * READS is as untrusted as ever.
+ *
+ * SLASH: the human's words go FIRST, verbatim and unfenced, because that is the
+ * only position the CLI expands a command from — and the scaffolding follows,
+ * LABELLED as ours so the trailing lines cannot read as more of what the person
+ * typed. The fence is what is traded away, and only for the one author already
+ * trusted above; nothing else about the turn changes.
+ */
+const kickoff = ({ message, askedByName, head, tail }) => {
+  const scaffold =
+    `${head}\n\n` +
+    `${fence('WHO IS TALKING', askedByName || 'the tab owner')}\n\n`;
+  if (LEADING_SLASH_COMMAND.test(message.trim()))
+    return (
+      `${message.trim()}\n\n` +
+      `---\n` +
+      `[FLOWVIANT SESSION CONTEXT — written by Flowviant, not typed by the person above]\n` +
+      `${scaffold}${tail}`
+    );
+  return `${scaffold}${fence('WHAT THEY SAID', message)}\n\n${tail}`;
+};
+
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
-  // The speaker is the tab's OWNER — the same person who owns this machine —
-  // so this is the one prompt whose author is fully trusted. The fence stays
-  // anyway: it costs nothing and keeps the shape identical everywhere, and repo
-  // content this turn READS is as untrusted as ever.
-  `Continue the session${sessionName ? ` "${sessionName}"` : ''}.\n\n` +
-  `SESSION ID (pass this to stream_session_turn / update_session): ${sessionId}\n\n` +
-  `${fence('WHO IS TALKING', askedByName || 'the tab owner')}\n\n` +
-  `${fence('WHAT THEY SAID', message)}\n\n` +
-  `Stream your reply with stream_session_turn as you work.`;
+  kickoff({
+    message,
+    askedByName,
+    head:
+      `Continue the session${sessionName ? ` "${sessionName}"` : ''}.\n\n` +
+      `SESSION ID (pass this to stream_session_turn / update_session): ${sessionId}`,
+    tail: `Stream your reply with stream_session_turn as you work.`,
+  });
 
 /** The plain tab's kickoff: no session id (there is no tool to pass it to)
  *  and no streaming instruction — the final message is the reply. */
 export const WORK_TURN_KICKOFF_PLAIN = ({ sessionName, message, askedByName }) =>
-  `Continue the session${sessionName ? ` "${sessionName}"` : ''}.\n\n` +
-  `${fence('WHO IS TALKING', askedByName || 'the tab owner')}\n\n` +
-  `${fence('WHAT THEY SAID', message)}\n\n` +
-  `Reply with your complete report when the work is done.`;
+  kickoff({
+    message,
+    askedByName,
+    head: `Continue the session${sessionName ? ` "${sessionName}"` : ''}.`,
+    tail: `Reply with your complete report when the work is done.`,
+  });
 
 
 export const REGROUND_KICKOFF = ({ sha, title, files, vaultDir, predictedPages = [] }) =>

package/bin/lib/runtimes.mjs

@@ -903,3 +903,50 @@ export function detectRuntimes({ refresh = false } = {}) {
   });
   return detectedCache;
 }
+
+/**
+ * WHAT THE CLI SAID IT CAN BE ASKED FOR BY NAME — the machine's skills.
+ *
+ * Learned, never scanned. Claude Code's `system.init` event names its own
+ * resolved skill set on every stream-json turn, and the daemon already parses
+ * that stream (claude.mjs), so this costs nothing and is authoritative: it has
+ * plugins, this repo's `.claude/skills`, and whatever project settings enabled
+ * or disabled already folded in. A `~/.claude/skills` scan of our own would be
+ * a second implementation of the CLI's resolution rules, and would drift.
+ *
+ * THE PRICE OF LEARNING RATHER THAN PROBING is that a machine which has not run
+ * a turn yet knows nothing, and says nothing. That is the honest answer: the
+ * app renders no menu rather than an empty one, and a slash typed into a tab
+ * still reaches the CLI either way — the menu is an autocomplete, never a gate.
+ * We do NOT probe for it: a `claude -p` run purely to populate a dropdown would
+ * spend the operator's quota on a UI affordance.
+ *
+ * PER MACHINE, not per session. Every session worktree is a checkout of the one
+ * repo this daemon serves, so project skills are identical across tabs and
+ * personal skills are machine-wide. Last turn wins, which is what makes a skill
+ * added mid-run show up on the next poll.
+ */
+let skillsCache = null;
+
+/** Claude Code's own names: letters, digits, dash, underscore, and the colon a
+ *  plugin skill wears (`plugin:skill`). Anything else is not a name we could
+ *  put after a `/` anyway, so it is dropped rather than relayed as garbage. */
+const SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9_:-]{0,63}$/;
+
+/** Record what a turn's init event reported. Bounded and sorted so the poll's
+ *  query param has a stable length and a stable order — an unstable order would
+ *  make the server write a "change" on every single poll. */
+export function recordSkills(names) {
+  if (!Array.isArray(names)) return;
+  const clean = [...new Set(names.map((n) => String(n).trim()).filter((n) => SKILL_NAME.test(n)))]
+    .sort()
+    .slice(0, 100);
+  // An empty report is a FACT (a machine with no skills installed), so it is
+  // recorded as []. Never conflated with null, which stays "no turn has run".
+  skillsCache = clean;
+}
+
+/** What to send on the roster poll — null until a turn has taught us. */
+export function knownSkills() {
+  return skillsCache;
+}

package/bin/lib/work.mjs

@@ -30,8 +30,16 @@ import {
 } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { join, dirname } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, REFRESH_BEFORE_SECONDS } from './config.mjs';
+import {
+  FLEET_URL,
+  FLEET_TOKEN,
+  USER_AGENT,
+  REFRESH_BEFORE_SECONDS,
+  DAEMON_INSTANCE,
+} from './config.mjs';
 import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
+import { listenersIn } from './listeners.mjs';
+import { openTunnel } from './preview.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
 import {
@@ -41,7 +49,7 @@ import {
   WORK_TURN_KICKOFF_PLAIN,
 } from './prompts.mjs';
 import { materializeInto, excludeInWorktree, scrub as envScrub } from './env.mjs';
-import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
+import { detectRuntimes, canRun, recordSkills, RUNTIMES } from './runtimes.mjs';
 import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { homedir } from 'node:os';
@@ -92,6 +100,8 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   const ACTIVITY_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-activity');
   const WORKTREES_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-worktrees');
   const DIFF_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/diff-done');
+  const PREVIEW_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-claim');
+  const PREVIEW_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-done');
   const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
   const workAnswering = new Set(); // turn ids currently queued/running here
   const workAttempts = new Map(); // turn id -> completed runTurn attempts
@@ -327,8 +337,19 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   };
   const sessionWorktreeReport = (sessionId) => {
     if (!isSafePathSegment(sessionId)) return null;
-    const d = worktreeDiff(join(baseDir, 'sessions', sessionId), baseRef);
-    return d ? { sessionId, ...d } : null;
+    const wt = join(baseDir, 'sessions', sessionId);
+    const d = worktreeDiff(wt, baseRef);
+    if (!d) return null;
+    // WHAT IS LISTENING in this worktree, attributed by the CWD of the process
+    // holding the socket. It rides the sweep the daemon already makes rather
+    // than taking a beat of its own, exactly as the commit trailers do — and
+    // like them it needs no version floor, because it is a daemon→server report
+    // on an endpoint that already exists. An older server ignores the key.
+    //
+    // The browser NEVER names a directory and never names a port this did not
+    // report: ports are global to a box and a worktree is not, so this
+    // measurement is the security boundary for the whole preview feature.
+    return { sessionId, ...d, listening: listenersIn(wt) };
   };
   /** One session, now — called after its turn settles. */
   const reportSessionWorktree = async (sessionId) => {
@@ -403,6 +424,189 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       /* the row stays pending and expires; the next click re-requests */
     }
   };
+  // ── SESSION PREVIEWS ──────────────────────────────────────────────────────
+  //
+  // Share the dev server the DRIVER is already running in their tab, behind a
+  // generated password, on a quick tunnel. This daemon never starts an app: the
+  // deleted live-preview feature ran a repo-declared command through a shell,
+  // and that is the reason it is deleted. Here the human runs their own server,
+  // `listenersIn` notices it, and this only ever wraps a port that measurement
+  // already named for that session.
+  //
+  // CLAIM BEFORE ACTING. Two daemons legitimately share one fleet credential —
+  // the case `machineDaemonsDisagree` exists because it happens, and the 0.51.2
+  // instance lock is blind to an OLDER peer — so both are handed the same job
+  // array. Both opening a tunnel leaves a public hostname alive that nobody
+  // owns and nobody can tear down, because only the lease holder can settle the
+  // row. `processDiffJobs` gets away without this because running `git show`
+  // twice costs nothing.
+  const livePreviews = new Map(); // sessionId -> { port, url, stop }
+  const previewClaiming = new Set(); // sessionIds mid-claim on this tick
+
+  const postPreview = async (body) => {
+    try {
+      await fetch(PREVIEW_DONE_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(30_000),
+        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
+      });
+    } catch {
+      /* the row stops being confirmed and reads as ended — which is true */
+    }
+  };
+
+  const claimPreview = async (sessionId) => {
+    try {
+      const res = await fetch(PREVIEW_CLAIM_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        body: JSON.stringify({ sessionId, instance: DAEMON_INSTANCE }),
+      });
+      const j = await res.json().catch(() => null);
+      return j?.data?.claimed === true;
+    } catch {
+      return false; // could not claim → do nothing at all. The other daemon may have.
+    }
+  };
+
+  /** Tear one down here, and say so. `reason` is why, stored server-side rather
+   *  than inferred: "the origin stopped listening" and "the owner pressed Stop"
+   *  are different sentences to a teammate holding a phone. */
+  const stopPreview = async (sessionId, reason) => {
+    const live = livePreviews.get(sessionId);
+    livePreviews.delete(sessionId);
+    if (live) {
+      try {
+        live.stop();
+      } catch {
+        /* best-effort */
+      }
+    }
+    await postPreview({ sessionId, ended: true, endedReason: reason });
+  };
+
+  const processPreviewJobs = (jobs) => {
+    if (!Array.isArray(jobs) || jobs.length === 0) return;
+    for (const job of jobs.slice(0, 5)) {
+      const sessionId = String(job?.sessionId || '');
+      const port = Number(job?.port);
+      if (!isSafePathSegment(sessionId)) continue;
+
+      if (job?.action === 'stop') {
+        if (previewClaiming.has(sessionId)) continue;
+        previewClaiming.add(sessionId);
+        void stopPreview(sessionId, 'stopped').finally(() => previewClaiming.delete(sessionId));
+        continue;
+      }
+
+      if (!Number.isInteger(port) || port <= 0 || port > 65535) continue;
+      // Already serving exactly this. Re-opening would replace a working URL
+      // somebody may be looking at right now.
+      if (livePreviews.get(sessionId)?.port === port) continue;
+      if (previewClaiming.has(sessionId)) continue;
+      previewClaiming.add(sessionId);
+
+      void (async () => {
+        try {
+          if (!(await claimPreview(sessionId))) return; // somebody else has it
+          const wt = join(baseDir, 'sessions', sessionId);
+          // RE-VALIDATE the attribution here, not just the liveness. The server
+          // checked this port against a report up to a minute old; more
+          // importantly, checking `listenersIn` again is what keeps the answer
+          // to "whose port is this" on the machine that can actually see it.
+          const measured = listenersIn(wt).some((l) => l.port === port);
+          if (!measured) {
+            await postPreview({
+              sessionId,
+              error: `nothing is listening on port ${port} in this worktree.`,
+            });
+            return;
+          }
+          // Replace anything this session already had — one tab, one door.
+          const prev = livePreviews.get(sessionId);
+          if (prev) {
+            try {
+              prev.stop();
+            } catch {
+              /* best-effort */
+            }
+            livePreviews.delete(sessionId);
+          }
+          const t = await openTunnel({
+            port,
+            log: (m) => note(`preview ${sessionId.slice(0, 8)}: ${m}`),
+            // The origin died under a live tunnel. cloudflared happily outlives
+            // a dead dev server and the gate answers a dead origin with 502, so
+            // without this the app would print "live" over a 502.
+            onDead: () => {
+              livePreviews.delete(sessionId);
+              void postPreview({ sessionId, ended: true, endedReason: 'origin_gone' });
+            },
+          });
+          if (t.error) {
+            await postPreview({ sessionId, error: t.error });
+            return;
+          }
+          livePreviews.set(sessionId, { port, url: t.url, stop: t.stop });
+          await postPreview({ sessionId, url: t.url, user: t.user, password: t.password });
+        } finally {
+          previewClaiming.delete(sessionId);
+        }
+      })();
+    }
+  };
+
+  /** The sessionIds this machine is still serving — sent on the poll so the
+   *  server can tell a live share from one whose machine went away. Silence
+   *  must never read as "live". */
+  const livePreviewIds = () => [...livePreviews.keys()];
+
+  /**
+   * The tab closed (or the server stopped listing it). Ordered BEFORE
+   * `retireWorkSessions`, and that ordering is load-bearing: `git worktree
+   * remove` under a running dev server reintroduces the stale-server bug — on
+   * Linux the process keeps serving bytes from open file handles in a directory
+   * that no longer exists, which shows a human the wrong thing without erroring
+   * anywhere.
+   */
+  const retirePreviews = (activeIds) => {
+    // Same guard `retireWorkSessions` keeps: a roster response missing the
+    // field is an older server, not a close, and must not tear down every live
+    // share at once.
+    if (!Array.isArray(activeIds)) return;
+    const live = new Set(activeIds);
+    for (const sessionId of [...livePreviews.keys()]) {
+      if (live.has(sessionId)) continue;
+      if (previewClaiming.has(sessionId)) continue;
+      previewClaiming.add(sessionId);
+      void stopPreview(sessionId, 'tab_closed').finally(() => previewClaiming.delete(sessionId));
+    }
+  };
+
+  /** Daemon shutdown. Detached tunnels survive our exit by design, so leaving
+   *  them would strand a public hostname until the box rebooted — the exact
+   *  case `reapOrphanPreviews` exists to clean up after an UNgraceful death. */
+  const shutdownPreviews = () => {
+    for (const [, live] of livePreviews) {
+      try {
+        live.stop();
+      } catch {
+        /* best-effort */
+      }
+    }
+    livePreviews.clear();
+  };
+
   const processDiffJobs = (jobs) => {
     if (!Array.isArray(jobs) || jobs.length === 0) return;
     for (const job of jobs.slice(0, 5)) {
@@ -1353,6 +1557,12 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               streamJson: true,
               answerFromResult: true,
               onActivity: (a) => narrator.line(a?.label),
+              // What this CLI says it can be asked for by name. Harvested off
+              // the init event the stream already carries — no probe, no scan,
+              // no extra spawn — and reported on the next roster poll so the
+              // composer can autocomplete a `/`. See runtimes.mjs for why it is
+              // learned from a turn rather than looked up.
+              onInit: (i) => recordSkills(i.skills),
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,
@@ -1854,6 +2064,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    processPreviewJobs,
+    livePreviewIds,
+    retirePreviews,
+    shutdownPreviews,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.51.2",
+  "version": "0.53.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {