flowviant 0.52.0 → 0.54.0

package/bin/lib/runtimes.mjs

@@ -687,9 +687,18 @@ export const RUNTIMES = {
         // turn reports failure having touched nothing. Caught only because an
         // end-to-end test had to add the flag by hand to work.
         //
-        // NOT `--sandbox` here, unlike wiki: a build has to `git push` and run
-        // `gh pr create`, so it needs the network by definition. The containment
-        // is the worktree, as it is for every runtime.
+        // NOT `--sandbox` here, unlike wiki: a build has to `git push`, so it
+        // needs the network by definition.
+        //
+        // AND NOTHING ELSE CONTAINS IT EITHER. This comment used to end "the
+        // containment is the worktree, as it is for every runtime", which was
+        // false and is the kind of false that stops people looking: `cwd` is a
+        // starting directory, not a jail. A build turn runs with the operator's
+        // full user permissions — it can write outside the worktree, to their
+        // home directory, to their other checkouts. Claude gets
+        // --dangerously-skip-permissions, codex gets --sandbox
+        // danger-full-access, and agy gets no sandbox flag at all. The only
+        // real boundary today is that the person driving the tab is trusted.
         //
         // FLOWVIANT_SAFE HAS NO EXPRESSION ON THIS RUNTIME. Claude narrows to an
         // allowlist and Codex to `workspace-write`; agy's only per-invocation

package/bin/lib/stream.mjs

@@ -1,11 +1,13 @@
 /**
- * Fleet daemon push channel — the best-practice endgame for dispatch latency.
+ * Machine daemon push channel — the best-practice endgame for pickup latency.
  *
- * Holds a hibernatable WebSocket open to the server. When a job lands (a wiki
- * regen, a dispatch, a merge request, an @mention), the server pushes a
- * `{type:'wake'}` frame and the daemon reconciles IMMEDIATELY — its normal
- * roster fetch — instead of waiting out the poll. That collapses pickup latency
- * from ≤RECONCILE_SECONDS to ~a round trip.
+ * Holds a hibernatable WebSocket open to the server. When a job lands — a
+ * session turn typed into a tab, a diff request, a preview, an env sync, a
+ * deploy, a wiki regen — the server pushes a `{type:'wake'}` frame and the
+ * daemon reconciles IMMEDIATELY — its normal roster fetch — instead of waiting
+ * out the poll. That collapses pickup latency from ≤RECONCILE_SECONDS to ~a
+ * round trip, which is what makes a message typed in the browser start on the
+ * machine at once.
  *
  * The socket carries NO authority: it's a dumb nudge, the roster HTTP fetch is
  * the source of truth (notify-then-reconcile, à la k8s watch). So a dropped or
@@ -74,9 +76,9 @@ export function connectStream({ onWake, isAlive }) {
       lastRxAt = Date.now();
       if (announcedDown) {
         announcedDown = false;
-        info(c.dim('push channel reconnected — instant dispatch back on'));
+        info(c.dim('push channel reconnected — turns start instantly again'));
       } else {
-        note(c.dim('push channel connected — instant dispatch on'));
+        note(c.dim('push channel connected — turns start instantly'));
       }
       clearPing();
       pingTimer = setInterval(() => {

package/bin/lib/update.mjs

@@ -114,10 +114,11 @@ export function handleVersionSignal({ latest, min, autoUpdate, safeToUpdate, tea
 
   if (wantInstall && !npx) {
     if (!safeToUpdate) {
-      // Outdated but an agent is mid-task — wait for idle. Nag once meanwhile.
+      // Outdated but a turn is running — wait until the machine is quiet. Nag
+      // once meanwhile.
       if (naggedFor !== target) {
         naggedFor = target;
-        note(`flowviant ${cur} → ${target} available — self-updating once agents go idle.`);
+        note(`flowviant ${cur} → ${target} available — self-updating once no turn is running.`);
       }
       return false;
     }

package/bin/lib/work.mjs

@@ -30,8 +30,16 @@ import {
 } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { join, dirname } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, REFRESH_BEFORE_SECONDS } from './config.mjs';
+import {
+  FLEET_URL,
+  FLEET_TOKEN,
+  USER_AGENT,
+  REFRESH_BEFORE_SECONDS,
+  DAEMON_INSTANCE,
+} from './config.mjs';
 import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
+import { listenersIn } from './listeners.mjs';
+import { openTunnel } from './preview.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
 import {
@@ -92,6 +100,8 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   const ACTIVITY_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-activity');
   const WORKTREES_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-worktrees');
   const DIFF_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/diff-done');
+  const PREVIEW_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-claim');
+  const PREVIEW_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-done');
   const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
   const workAnswering = new Set(); // turn ids currently queued/running here
   const workAttempts = new Map(); // turn id -> completed runTurn attempts
@@ -327,8 +337,19 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   };
   const sessionWorktreeReport = (sessionId) => {
     if (!isSafePathSegment(sessionId)) return null;
-    const d = worktreeDiff(join(baseDir, 'sessions', sessionId), baseRef);
-    return d ? { sessionId, ...d } : null;
+    const wt = join(baseDir, 'sessions', sessionId);
+    const d = worktreeDiff(wt, baseRef);
+    if (!d) return null;
+    // WHAT IS LISTENING in this worktree, attributed by the CWD of the process
+    // holding the socket. It rides the sweep the daemon already makes rather
+    // than taking a beat of its own, exactly as the commit trailers do — and
+    // like them it needs no version floor, because it is a daemon→server report
+    // on an endpoint that already exists. An older server ignores the key.
+    //
+    // The browser NEVER names a directory and never names a port this did not
+    // report: ports are global to a box and a worktree is not, so this
+    // measurement is the security boundary for the whole preview feature.
+    return { sessionId, ...d, listening: listenersIn(wt) };
   };
   /** One session, now — called after its turn settles. */
   const reportSessionWorktree = async (sessionId) => {
@@ -403,6 +424,189 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       /* the row stays pending and expires; the next click re-requests */
     }
   };
+  // ── SESSION PREVIEWS ──────────────────────────────────────────────────────
+  //
+  // Share the dev server the DRIVER is already running in their tab, behind a
+  // generated password, on a quick tunnel. This daemon never starts an app: the
+  // deleted live-preview feature ran a repo-declared command through a shell,
+  // and that is the reason it is deleted. Here the human runs their own server,
+  // `listenersIn` notices it, and this only ever wraps a port that measurement
+  // already named for that session.
+  //
+  // CLAIM BEFORE ACTING. Two daemons legitimately share one fleet credential —
+  // the case `machineDaemonsDisagree` exists because it happens, and the 0.51.2
+  // instance lock is blind to an OLDER peer — so both are handed the same job
+  // array. Both opening a tunnel leaves a public hostname alive that nobody
+  // owns and nobody can tear down, because only the lease holder can settle the
+  // row. `processDiffJobs` gets away without this because running `git show`
+  // twice costs nothing.
+  const livePreviews = new Map(); // sessionId -> { port, url, stop }
+  const previewClaiming = new Set(); // sessionIds mid-claim on this tick
+
+  const postPreview = async (body) => {
+    try {
+      await fetch(PREVIEW_DONE_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(30_000),
+        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
+      });
+    } catch {
+      /* the row stops being confirmed and reads as ended — which is true */
+    }
+  };
+
+  const claimPreview = async (sessionId) => {
+    try {
+      const res = await fetch(PREVIEW_CLAIM_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        body: JSON.stringify({ sessionId, instance: DAEMON_INSTANCE }),
+      });
+      const j = await res.json().catch(() => null);
+      return j?.data?.claimed === true;
+    } catch {
+      return false; // could not claim → do nothing at all. The other daemon may have.
+    }
+  };
+
+  /** Tear one down here, and say so. `reason` is why, stored server-side rather
+   *  than inferred: "the origin stopped listening" and "the owner pressed Stop"
+   *  are different sentences to a teammate holding a phone. */
+  const stopPreview = async (sessionId, reason) => {
+    const live = livePreviews.get(sessionId);
+    livePreviews.delete(sessionId);
+    if (live) {
+      try {
+        live.stop();
+      } catch {
+        /* best-effort */
+      }
+    }
+    await postPreview({ sessionId, ended: true, endedReason: reason });
+  };
+
+  const processPreviewJobs = (jobs) => {
+    if (!Array.isArray(jobs) || jobs.length === 0) return;
+    for (const job of jobs.slice(0, 5)) {
+      const sessionId = String(job?.sessionId || '');
+      const port = Number(job?.port);
+      if (!isSafePathSegment(sessionId)) continue;
+
+      if (job?.action === 'stop') {
+        if (previewClaiming.has(sessionId)) continue;
+        previewClaiming.add(sessionId);
+        void stopPreview(sessionId, 'stopped').finally(() => previewClaiming.delete(sessionId));
+        continue;
+      }
+
+      if (!Number.isInteger(port) || port <= 0 || port > 65535) continue;
+      // Already serving exactly this. Re-opening would replace a working URL
+      // somebody may be looking at right now.
+      if (livePreviews.get(sessionId)?.port === port) continue;
+      if (previewClaiming.has(sessionId)) continue;
+      previewClaiming.add(sessionId);
+
+      void (async () => {
+        try {
+          if (!(await claimPreview(sessionId))) return; // somebody else has it
+          const wt = join(baseDir, 'sessions', sessionId);
+          // RE-VALIDATE the attribution here, not just the liveness. The server
+          // checked this port against a report up to a minute old; more
+          // importantly, checking `listenersIn` again is what keeps the answer
+          // to "whose port is this" on the machine that can actually see it.
+          const measured = listenersIn(wt).some((l) => l.port === port);
+          if (!measured) {
+            await postPreview({
+              sessionId,
+              error: `nothing is listening on port ${port} in this worktree.`,
+            });
+            return;
+          }
+          // Replace anything this session already had — one tab, one door.
+          const prev = livePreviews.get(sessionId);
+          if (prev) {
+            try {
+              prev.stop();
+            } catch {
+              /* best-effort */
+            }
+            livePreviews.delete(sessionId);
+          }
+          const t = await openTunnel({
+            port,
+            log: (m) => note(`preview ${sessionId.slice(0, 8)}: ${m}`),
+            // The origin died under a live tunnel. cloudflared happily outlives
+            // a dead dev server and the gate answers a dead origin with 502, so
+            // without this the app would print "live" over a 502.
+            onDead: () => {
+              livePreviews.delete(sessionId);
+              void postPreview({ sessionId, ended: true, endedReason: 'origin_gone' });
+            },
+          });
+          if (t.error) {
+            await postPreview({ sessionId, error: t.error });
+            return;
+          }
+          livePreviews.set(sessionId, { port, url: t.url, stop: t.stop });
+          await postPreview({ sessionId, url: t.url, user: t.user, password: t.password });
+        } finally {
+          previewClaiming.delete(sessionId);
+        }
+      })();
+    }
+  };
+
+  /** The sessionIds this machine is still serving — sent on the poll so the
+   *  server can tell a live share from one whose machine went away. Silence
+   *  must never read as "live". */
+  const livePreviewIds = () => [...livePreviews.keys()];
+
+  /**
+   * The tab closed (or the server stopped listing it). Ordered BEFORE
+   * `retireWorkSessions`, and that ordering is load-bearing: `git worktree
+   * remove` under a running dev server reintroduces the stale-server bug — on
+   * Linux the process keeps serving bytes from open file handles in a directory
+   * that no longer exists, which shows a human the wrong thing without erroring
+   * anywhere.
+   */
+  const retirePreviews = (activeIds) => {
+    // Same guard `retireWorkSessions` keeps: a roster response missing the
+    // field is an older server, not a close, and must not tear down every live
+    // share at once.
+    if (!Array.isArray(activeIds)) return;
+    const live = new Set(activeIds);
+    for (const sessionId of [...livePreviews.keys()]) {
+      if (live.has(sessionId)) continue;
+      if (previewClaiming.has(sessionId)) continue;
+      previewClaiming.add(sessionId);
+      void stopPreview(sessionId, 'tab_closed').finally(() => previewClaiming.delete(sessionId));
+    }
+  };
+
+  /** Daemon shutdown. Detached tunnels survive our exit by design, so leaving
+   *  them would strand a public hostname until the box rebooted — the exact
+   *  case `reapOrphanPreviews` exists to clean up after an UNgraceful death. */
+  const shutdownPreviews = () => {
+    for (const [, live] of livePreviews) {
+      try {
+        live.stop();
+      } catch {
+        /* best-effort */
+      }
+    }
+    livePreviews.clear();
+  };
+
   const processDiffJobs = (jobs) => {
     if (!Array.isArray(jobs) || jobs.length === 0) return;
     for (const job of jobs.slice(0, 5)) {
@@ -595,9 +799,17 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           'Content-Type': 'application/json',
         },
         signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ sessionId }),
+        // The instance is what CLAIMS the session lease server-side. Two
+        // daemons share one fleet credential, so the token cannot say which of
+        // us is serving this tab — and the mint is the moment that matters:
+        // there is one work-token row per session and minting ROTATES it, so a
+        // second mint revokes the first daemon's live secret mid-turn.
+        body: JSON.stringify({ sessionId, instance: DAEMON_INSTANCE }),
       });
       if (res.status === 404) return { gone: true };
+      // 409 — another daemon on this credential holds the session. Not ours to
+      // serve and not a retry: stand down and let the holder answer.
+      if (res.status === 409) return { heldElsewhere: true };
       if (!res.ok) return null;
       const token = (await res.json().catch(() => null))?.data?.token ?? null;
       if (!token) return null;
@@ -964,8 +1176,25 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * machines. When the roster omits the field entirely (older server),
    * absence of signal is not a close — retire nothing.
    */
-  const retireWorkSessions = (activeIds) => {
+  /** Every session this daemon currently has a worktree for — what renews our
+   *  lease on the poll. Read off the directory rather than a map, so it is the
+   *  same fact retirement acts on. */
+  const heldSessionIds = () => {
+    const dir = join(baseDir, 'sessions');
+    try {
+      return readdirSync(dir).filter(isSafePathSegment).slice(0, 50);
+    } catch {
+      return [];
+    }
+  };
+
+  const retireWorkSessions = (activeIds, heldElsewhere) => {
     if (!Array.isArray(activeIds)) return;
+    // Sessions ANOTHER daemon on this credential is serving. They are absent
+    // from activeWorkSessions for us and present for them, and removing their
+    // worktree would pull the directory out from under a running turn. Absence
+    // means "the tab closed"; this is the one other thing it can mean.
+    const peers = new Set(Array.isArray(heldElsewhere) ? heldElsewhere : []);
     const dir = join(baseDir, 'sessions');
     if (!existsSync(dir)) return;
     let ids;
@@ -978,6 +1207,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     let removed = 0;
     for (const id of ids) {
       if (live.has(id)) continue;
+      if (peers.has(id)) continue; // another daemon's tab — not ours to retire
       if (workChains.has(id) || shipping.has(id)) continue; // still draining here
       const wt = join(dir, id);
       try {
@@ -1208,6 +1438,15 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           if (!plainTab) {
             mint = await mintWorkToken(job.sessionId);
             if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
+            // Another daemon on this credential holds the session. Return
+            // WITHOUT settling: the holder is answering this same turn, and
+            // settling it here — even as a failure — would race the real
+            // answer and could win. Dropping it means the turn stays pending
+            // and the holder's answer lands, which is the whole point.
+            if (mint?.heldElsewhere) {
+              workAnswering.delete(job.id);
+              return;
+            }
             if (mint?.gone) {
               await settleWorkTurn(job.id, {
                 ok: false,
@@ -1860,6 +2099,11 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    heldSessionIds,
+    processPreviewJobs,
+    livePreviewIds,
+    retirePreviews,
+    shutdownPreviews,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {