flowviant 0.52.0 → 0.54.0

package/bin/lib/fleet.mjs

@@ -23,6 +23,7 @@ import {
   USER_AGENT,
   MCP_URL,
   SAFE,
+  DAEMON_INSTANCE,
   POLL_SECONDS,
   MAX_CONCURRENT,
   IDLE_SECONDS,
@@ -30,7 +31,6 @@ import {
   REFRESH_BEFORE_SECONDS,
   LIVE,
   AUTO_UPDATE,
-  ALLOW_PATCHES,
 } from './config.mjs';
 import { handleVersionSignal } from './update.mjs';
 import {
@@ -77,7 +77,7 @@ import { detectRuntimes, knownSkills, pickRuntimeFor, RUNTIMES } from './runtime
 import { createWorkManager } from './work.mjs';
 import { scanLocalSessions } from './localSessions.mjs';
 
-async function fetchRoster(haveIds) {
+async function fetchRoster(haveIds, livePreviewSessionIds = [], heldSessionIds = []) {
   const url = new URL(FLEET_URL);
   if (haveIds.length) url.searchParams.set('have', haveIds.join(','));
   // What this machine will run at once. The server grows lanes to meet waiting
@@ -98,6 +98,20 @@ async function fetchRoster(haveIds) {
   // so a team can see whether the shared box runs wide open, and enforces
   // nothing (membership is the consent boundary). Older servers ignore it.
   url.searchParams.set('safe', SAFE ? '1' : '0');
+  // WHICH PROCESS, so the server can lease preview work to exactly one of two
+  // daemons on one credential. Older servers ignore unknown params.
+  url.searchParams.set('di', DAEMON_INSTANCE);
+  // Which shares this machine is still serving. It rides the poll rather than
+  // taking an endpoint of its own: one beat, no floor, and the stale window is
+  // the reconcile interval instead of minutes — which matters, because a share
+  // the server still calls live is a 530 on somebody's phone. Always set, even
+  // empty: '' means "serving none", absent would mean "an older daemon".
+  url.searchParams.set('pv', livePreviewSessionIds.join(','));
+  // The sessions this daemon holds a worktree for. Its LEASE on each renews
+  // here — one beat, no extra endpoint, and the server can tell "this daemon is
+  // still serving that tab" from "it went away" within a reconcile interval
+  // instead of minutes. Always set, even empty: '' means "holding none".
+  url.searchParams.set('ws', heldSessionIds.join(','));
   // WHICH CLIs this machine actually has, so the app can stop guessing.
   //
   // Until now every surface that listed Gemini or Codex said "not wired up yet"
@@ -261,20 +275,13 @@ async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
 
 export async function runFleetDaemon() {
   console.log('');
-  console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`fleet daemon · v${VERSION}`)}`);
+  console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`machine daemon · v${VERSION}`)}`);
   console.log(`  ${c.dim('──────────────────────────────────────────────')}`);
   const repoRoot = repoRootOrDie();
   const baseRef = detectBaseRef(repoRoot);
   info(SAFE ? 'mode   · safe (restricted toolset)' : 'mode   · unattended (skips permission prompts)');
   info(`repo   · ${repoRoot}`);
   info(`base   · ${baseRef}`);
-  // Stated out loud because it is the one setting that lets something else write
-  // into the checkout you are sitting in.
-  info(
-    ALLOW_PATCHES
-      ? 'patches· accepted — small changes land in your checkout for Keep/Revert (--no-patches to refuse)'
-      : 'patches· refused — everything arrives as a branch + PR'
-  );
   info(`server · ${FLEET_URL}`);
   console.log('');
 
@@ -285,18 +292,42 @@ export async function runFleetDaemon() {
   // the SAME project served twice, and the worst version of this: their session
   // worktrees are in different directories, so the per-turn lock cannot even see
   // across them. See instance.mjs for why that lock is not enough on its own.
-  const instance = acquireInstanceLock(FLEET_TOKEN, repoRoot);
+  // Same repo -> this run replaces whatever was serving it. Different repo ->
+  // refused, and nothing is signalled. See instance.mjs's header for the rule.
+  const instance = acquireInstanceLock(FLEET_TOKEN, repoRoot, {
+    takeover:
+      process.argv.includes('--takeover') || process.argv.includes('--takeover-downgrade'),
+    noTakeover:
+      process.argv.includes('--no-takeover') || process.env.FLOWVIANT_NO_TAKEOVER === '1',
+    allowDowngrade: process.argv.includes('--takeover-downgrade'),
+    log: (m) => info(m),
+  });
   if (!instance.ok) {
     const h = instance.holder;
     console.log('');
-    fail('a flowviant daemon is already running for this credential.');
+    // Two different refusals, because they are two different mistakes and the
+    // fix is not the same. Same CREDENTIAL: one project is being served twice.
+    // Same REPO under another credential: two daemons in one working tree,
+    // which the credential-keyed lock cannot see on its own.
+    if (instance.takeoverFailed) {
+      fail(`could not replace the running daemon: ${instance.takeoverFailed}`);
+    } else if (instance.sameRepo) {
+      fail('a flowviant daemon is already running in this repo.');
+    } else {
+      fail('a flowviant daemon is already running for this credential.');
+    }
     if (h?.pid) info(`holder · pid ${h.pid}${h.repoRoot ? ` in ${h.repoRoot}` : ''}`);
     // The two-checkouts case is the one nobody spots on their own: both tabs
     // look healthy, and the damage is doubled cards and doubled edits in a repo
     // you are not looking at. Name the other repo when it is a different one.
-    if (h?.repoRoot && h.repoRoot !== repoRoot)
+    if (!instance.sameRepo && h?.repoRoot && h.repoRoot !== repoRoot) {
       warn('that is a DIFFERENT checkout — one credential serves one project, so both would answer the same tabs.');
-    note('stop the other one first, or run this one with FLOWVIANT_ALLOW_MULTI=1 if you know what you are doing.');
+      // Not offered lightly: that daemon is serving other work, and this
+      // command was run somewhere else. Replacing it is a decision, not a
+      // restart, so it takes a word.
+      note('run with --takeover to stop it and serve this repo instead.');
+    }
+    note('or run this one with FLOWVIANT_ALLOW_MULTI=1 if you know what you are doing.');
     console.log('');
     process.exit(1);
   }
@@ -374,6 +405,14 @@ export async function runFleetDaemon() {
   const nextByAgent = new Map();
   let leaseTtlSeconds = 24 * 60 * 60; // updated from each roster response
   let mcpUrl = MCP_URL;
+  // DEAD, and kept only because unpicking it is a rewire rather than a
+  // deletion: nothing calls `workers.set` anywhere in this tree. It held
+  // DISPATCH lanes, and the server has sent `agents: []` permanently since
+  // 2026-08-19, so every loop below iterates nothing. Two `stopPreview` calls
+  // hung off it until 2026-08-21 and read as live preview wiring; they were
+  // deleted, not rewired. When the Workbench preview lands, its teardown is
+  // keyed on sessionId and belongs beside retireWorkSessions in work.mjs —
+  // NOT here.
   const workers = new Map(); // agentId -> { state, promise, wt, label }
   let daemonAlive = true; // flipped false on shutdown so the stream stops reconnecting
   let stream = null; // push channel handle (set once the loop is set up)
@@ -413,15 +452,10 @@ export async function runFleetDaemon() {
       } catch {
         /* best-effort */
       }
-      // Stop the detached preview (dev server + cloudflared tunnel) — it's its
-      // own process group and survives our exit, otherwise leaking a port-bound
-      // server + a live tunnel serving a stale branch until reboot.
-      try {
-        w.state.stopPreview?.();
-      } catch {
-        /* best-effort */
-      }
     }
+    // Detached tunnels survive our exit by design, so leaving them would strand
+    // a public hostname until the box rebooted.
+    shutdownPreviews();
   };
   process.on('SIGINT', () => {
     console.log('');
@@ -593,6 +627,11 @@ export async function runFleetDaemon() {
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    heldSessionIds,
+    processPreviewJobs,
+    livePreviewIds,
+    retirePreviews,
+    shutdownPreviews,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,
@@ -856,20 +895,42 @@ export async function runFleetDaemon() {
 
   // Changed files of a (merged) PR, for the re-ground prompt. Capped so a huge
   // PR can't blow up the prompt. prUrl was already validated before the merge.
-  // Returns null on a gh FAILURE (network/auth) — distinct from a PR that
-  // genuinely changed nothing — so the caller can retry instead of silently
-  // consuming the durable job with no re-ground run.
-  const changedFilesForPr = (prUrl) => {
-    try {
-      const out = execFileSync('gh', ['pr', 'view', prUrl, '--json', 'files'], {
-        cwd: repoRoot,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-      });
-      return (JSON.parse(out).files ?? []).map((f) => f.path).filter(Boolean).slice(0, 60);
-    } catch {
-      return null;
+  // WHICH FILES A SHIP CHANGED, read from the commits it landed.
+  //
+  // This asked `gh pr view <prUrl> --json files` until 2026-08-22, and `prUrl`
+  // has been null by construction since dispatch was deleted on 2026-08-19 —
+  // the server writes null and says so in a comment. Node threw on the null
+  // argument, the catch below read it as "gh failed", and the re-ground retried
+  // three times and gave up. Every post-ship re-ground for three months did
+  // that silently, while the spec said ship re-grounds the wiki.
+  //
+  // Returns null when it learned NOTHING (no shas, or none of them resolvable),
+  // which the caller still treats as retryable — distinct from a ship that
+  // genuinely changed no files.
+  const changedFilesForShas = (shas) => {
+    if (!Array.isArray(shas) || shas.length === 0) return null;
+    const files = new Set();
+    for (const sha of shas.slice(0, 50)) {
+      if (!/^[0-9a-f]{7,40}$/i.test(String(sha))) continue;
+      try {
+        const out = execFileSync(
+          'git',
+          ['show', '--name-only', '--pretty=format:', String(sha)],
+          { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }
+        );
+        for (const line of out.split('\n')) {
+          const f = line.trim();
+          if (f) files.add(f);
+          if (files.size >= 60) break;
+        }
+      } catch {
+        // One unreachable commit is not a failed re-ground — the ship merged
+        // to main and the rest of the shas still name real files. Only an
+        // EMPTY result is treated as "we learned nothing".
+      }
+      if (files.size >= 60) break;
     }
+    return files.size ? [...files] : null;
   };
   const regroundAttempts = new Map(); // intentId -> gh-failure count
 
@@ -1025,7 +1086,7 @@ export async function runFleetDaemon() {
               warn('wiki sweep ended without WIKI_DONE — partial pages synced; retry from the app.');
             await runSync(complete);
           } else {
-            const files = changedFilesForPr(task.prUrl);
+            const files = changedFilesForShas(task.shas);
             if (files === null) {
               // gh failed (network/auth) — retry via the durable job a couple
               // of times before consuming it, so a transient outage doesn't
@@ -1033,11 +1094,11 @@ export async function runFleetDaemon() {
               const n = (regroundAttempts.get(task.intentId) ?? 0) + 1;
               regroundAttempts.set(task.intentId, n);
               if (n < 3) {
-                warn(`wiki re-ground for "${task.title}": gh failed — will retry (${n}/3)`);
+                warn(`wiki re-ground for "${task.title}": no changed files resolved — will retry (${n}/3)`);
                 groundedIntents.delete(task.intentId); // let the roster re-offer it
                 continue;
               }
-              warn(`wiki re-ground for "${task.title}": gh failed ${n} times — giving up (heals on the next full sweep)`);
+              warn(`wiki re-ground for "${task.title}": could not resolve changed files ${n} times — giving up (heals on the next full sweep)`);
             } else if (files.length === 0) {
               note(`${c.cyan('wiki')} ${c.dim(`— "${task.title}": no changed files to re-ground`)}`);
             } else {
@@ -1153,7 +1214,7 @@ export async function runFleetDaemon() {
   for (;;) {
     let roster;
     try {
-      roster = await fetchRoster(buildHave());
+      roster = await fetchRoster(buildHave(), livePreviewIds(), heldSessionIds());
     } catch (e) {
       if (e.auth) {
         fail(`${e.message} — credential revoked or invalid. Shutting down.`);
@@ -1215,11 +1276,29 @@ export async function runFleetDaemon() {
     // AFTER the work/ship intake: retirement is the server saying which
     // sessions are LIVE, and the guards above (chains, shipping) are populated
     // by the intake this same tick.
-    retireWorkSessions(roster.activeWorkSessions);
+    // BEFORE retirement, and the order is load-bearing: `git worktree remove`
+    // under a running dev server leaves it serving bytes from open file handles
+    // in a directory that no longer exists — a human is shown the wrong thing
+    // and nothing errors anywhere.
+    retirePreviews(roster.activeWorkSessions);
+    // A session another daemon on this credential is serving is NOT a closed
+    // tab. Without this the daemon that lost the lease removes the worktree the
+    // winner is working in — absence would mean "somebody else won" instead of
+    // "the tab closed".
+    retireWorkSessions(
+      Array.isArray(roster.activeWorkSessions)
+        ? roster.activeWorkSessions
+        : roster.activeWorkSessions,
+      roster.sessionsHeldElsewhere
+    );
     // Diffs somebody has open and is waiting on. Project-scoped rather than
     // per-session: `git show` runs from the repo ROOT, which can see a closed
     // tab's branch and a shipped commit on main alike.
     processDiffJobs(roster.diffJobs);
+    // Shares to open or tear down. CLAIMED before acted on — two daemons on one
+    // credential are both handed this array, and both opening a tunnel strands
+    // a public hostname nobody can settle.
+    processPreviewJobs(roster.previewJobs);
     // …and what the SURVIVING ones hold: branch, ahead-of-base, diffstat.
     // Throttled inside, never awaited — a `git status` the human cannot run
     // themselves from a browser, relayed. After retirement so a directory that
@@ -1236,24 +1315,23 @@ export async function runFleetDaemon() {
     const sig = [...rosterIds].sort().join(',');
     if (sig !== rosterSig) {
       rosterSig = sig;
-      if (rosterIds.size === 0) {
-        // `agents` is permanently [] — the lanes it counted died with dispatch
-        // and the array survives only as wire compat. So this branch is the one
-        // that always runs, and it used to point at the Cockpit, a surface
-        // deleted 2026-08-04 that now redirects to the Board. Say what is
-        // actually true instead: the machine is up, and work starts in a tab.
-        info('Machine online. Open a tab in Flowviant → Workbench to start working.');
-      } else {
-        note(`Roster: ${c.bold(String(rosterIds.size))} agent${rosterIds.size === 1 ? '' : 's'}.`);
-      }
+      // `agents` is permanently [] — the lanes it counted died with dispatch
+      // and the array survives only as wire compat, so this runs once, on the
+      // first poll. It used to point at the Cockpit, a surface deleted
+      // 2026-08-04 that now redirects to the Board. Say what is actually true
+      // instead: the machine is up, and work starts in a tab.
+      info('Machine online. Open a tab in Flowviant → Workbench to start working.');
     }
-    // Heartbeat so a quiet/empty daemon visibly stays alive.
-    if (rosterIds.size === 0 && Date.now() - idleBeatAt > 60_000) {
+    // Heartbeat so a quiet daemon visibly stays alive. Gated on REAL work —
+    // `rosterIds` is built from `roster.agents`, which the server sends
+    // permanently empty, so gating on it printed "waiting" once a minute even
+    // while a tab's turn was running. `workBusy()` is the honest question: are
+    // there session turns, ships or unsettled reports in flight?
+    if (!workBusy() && Date.now() - idleBeatAt > 60_000) {
       idleBeatAt = Date.now();
-      info('idle — waiting for agents…');
+      info('machine online — nothing running right now.');
     }
 
-
     // Living-wiki work (runs under its own minted wiki token — no agent
     // needed). enqueueSweep queues a Regenerate; regroundJobs re-offers merged
     // deliveries whose re-ground never ran (e.g. we restarted between merge and
@@ -1269,13 +1347,18 @@ export async function runFleetDaemon() {
 
     // Env sync tick: register/bootstrap/wrap/rotate/sync as the roster block
     // dictates (self-guarded — one operation at a time, errors retry next
-    // poll). A fresh bundle rematerializes every AGENT worktree; the wiki
-    // worktree NEVER gets env (the cartographer doesn't need secrets).
+    // poll). A fresh bundle rematerializes every SESSION worktree this daemon
+    // holds — read off the sessions directory, the same fact retirement acts
+    // on; the wiki worktree NEVER gets env (the cartographer doesn't need
+    // secrets). This used to iterate the dispatch-era `workers` map, which
+    // nothing has ever `.set()`, so a rotation reached no worktree at all.
+    // Safe mid-turn by construction: materializeInto refuses to write anything
+    // git does not ignore, so it cannot dirty a tree and block a ship.
     void handleRosterEnv(roster.env, { projectId: roster.project?.id }).then(({ changed }) => {
       if (!changed) return;
-      for (const [, w] of workers) {
+      for (const id of heldSessionIds()) {
         try {
-          materializeInto(w.wt);
+          materializeInto(join(baseDir, 'sessions', id));
         } catch {
           /* best-effort */
         }
@@ -1323,11 +1406,6 @@ export async function runFleetDaemon() {
         } catch {
           /* best-effort */
         }
-        try {
-          w.state.stopPreview?.();
-        } catch {
-          /* best-effort */
-        }
         // Only poll mode's per-lane tree dies with the lane. A live lane owns no
         // checkout: the task it was building has its own, which must SURVIVE —
         // removing a lane requeues its task, and the next lane to pick that task

package/bin/lib/git.mjs

@@ -35,7 +35,7 @@ export function repoRootOrDie() {
   try {
     return git(['rev-parse', '--show-toplevel'], process.cwd());
   } catch {
-    console.error('error: fleet mode must run inside a git repo.');
+    console.error('error: the flowviant daemon must run inside a git repo.');
     process.exit(1);
   }
 }