flowviant 0.53.0 → 0.54.1

package/bin/lib/login.mjs

@@ -56,7 +56,11 @@ export async function runLogin({ thenStart = false } = {}) {
   }
   const { deviceCode, userCode, intervalSeconds = 5, expiresInSeconds = 600 } = start;
   const pretty = `${userCode.slice(0, 4)}-${userCode.slice(4)}`;
-  console.log(`  1. Open ${c.cyan(APP_URL)} → your project → the ${c.bold('Agents')} panel → ${c.bold('Connect a machine')}.`);
+  // Where the control ACTUALLY is. It was "the Agents panel", a settings
+  // section deleted 2026-08-17; connecting a machine is offered on the surface
+  // you are on when it matters, and for a new operator that is the Workbench —
+  // the project's empty state says so before it can show you any sessions.
+  console.log(`  1. Open ${c.cyan(APP_URL)} → your project → the ${c.bold('Workbench')} → ${c.bold('Connect a machine')}.`);
   console.log(`  2. Enter this code:   ${c.bold(c.green(pretty))}\n`);
   info('waiting for you to approve…');
 

package/bin/lib/mcp-cli.mjs

@@ -2,17 +2,18 @@
  * `flowviant mcp` — connect YOUR Claude to Flowviant so you can file work from
  * the terminal ("stick that on the board", "file a task for this TODO").
  *
- * This mints a `cli` credential, which is a different principal from the worker
- * tokens the daemon rotates for builds. That separation is the point, not
- * bookkeeping: a worker reads untrusted repo, PR and issue text all day, so
- * giving THAT principal tools that write to your workspace would mean a hostile
- * string in a README could file work as you. The cli credential sees only the
- * management tools and can never claim or complete work; the worker can never
- * reach create_task.
+ * This mints a `cli` credential, which is a different principal from the
+ * per-session `work` tokens the daemon mints for Workbench tabs. That
+ * separation is the point, not bookkeeping: a session's agent reads untrusted
+ * repo and issue text all day, so giving THAT principal tools that write to
+ * your workspace would mean a hostile string in a README could file work as
+ * you. The cli credential sees only the management tools and can never work or
+ * ship a card; a session token can never reach create_task.
  *
  * There is deliberately no invite capability on it. Invites grant access to a
- * paid workspace and are guarded by a human browser session; you ask Flowvy in
- * the app for those, and approve the card.
+ * paid workspace and are guarded by a human browser session — they are sent
+ * from the workspace card's gear menu in the app, and never from a CLI
+ * credential sitting on a shared machine.
  */
 
 import { FLEET_TOKEN, USER_AGENT, MCP_URL, FLEET_URL } from './config.mjs';
@@ -77,7 +78,7 @@ export async function runMcpCommand(args = []) {
   console.log(`  ${cmd}`);
   console.log('');
   console.log('Then, in any Claude session: "file a task in Flowviant for …".');
-  console.log('Tasks land as drafts — nothing runs until you open one in the');
-  console.log('app and @mention an agent.');
+  console.log('Tasks land as drafts on the board — nothing runs until you open');
+  console.log('a session tab in the Workbench and type in it.');
   console.log('');
 }

package/bin/lib/preflight.mjs

@@ -91,20 +91,23 @@ export async function preflight({ needGit = true } = {}) {
     }
   }
 
-  // gh — needed to open PRs. Offer to fetch the isolated binary (yes-default:
-  // low-risk, no login carried by the install itself).
+  // gh — OPTIONAL. The daemon pushes and merges with plain `git`; nothing in
+  // the product opens a pull request any more, so gh is a convenience for the
+  // agent, not a requirement. Hence the offer no longer defaults to yes: an
+  // install nobody asked for, defaulted on, is how a preflight installs
+  // software on a machine whose operator only wanted a status line.
   if (gh && ghAuthed()) {
     ok('gh authenticated');
   } else if (gh) {
     warn('gh not signed in — run: gh auth login');
   } else {
-    warn('gh NOT found — needed to open PRs.');
-    if (await promptYesNo('Install GitHub CLI (gh) now?', true)) {
+    info('gh not found (optional).');
+    if (await promptYesNo('Install GitHub CLI (gh) now?', false)) {
       if (await installGh((m) => info(m))) gh = present('gh');
     }
     gh
       ? ok('gh installed to ~/.flowviant/bin — authenticate with: flowviant gh-auth')
-      : warn('install gh manually: https://cli.github.com, then run: gh auth login');
+      : info(c.dim('or install it later: https://cli.github.com, then: gh auth login'));
   }
 
   if (needGit) (git ? ok('git installed') : warn('git NOT found — install git'));

package/bin/lib/runtimes.mjs

@@ -687,9 +687,18 @@ export const RUNTIMES = {
         // turn reports failure having touched nothing. Caught only because an
         // end-to-end test had to add the flag by hand to work.
         //
-        // NOT `--sandbox` here, unlike wiki: a build has to `git push` and run
-        // `gh pr create`, so it needs the network by definition. The containment
-        // is the worktree, as it is for every runtime.
+        // NOT `--sandbox` here, unlike wiki: a build has to `git push`, so it
+        // needs the network by definition.
+        //
+        // AND NOTHING ELSE CONTAINS IT EITHER. This comment used to end "the
+        // containment is the worktree, as it is for every runtime", which was
+        // false and is the kind of false that stops people looking: `cwd` is a
+        // starting directory, not a jail. A build turn runs with the operator's
+        // full user permissions — it can write outside the worktree, to their
+        // home directory, to their other checkouts. Claude gets
+        // --dangerously-skip-permissions, codex gets --sandbox
+        // danger-full-access, and agy gets no sandbox flag at all. The only
+        // real boundary today is that the person driving the tab is trusted.
         //
         // FLOWVIANT_SAFE HAS NO EXPRESSION ON THIS RUNTIME. Claude narrows to an
         // allowlist and Codex to `workspace-write`; agy's only per-invocation

package/bin/lib/stream.mjs

@@ -1,11 +1,13 @@
 /**
- * Fleet daemon push channel — the best-practice endgame for dispatch latency.
+ * Machine daemon push channel — the best-practice endgame for pickup latency.
  *
- * Holds a hibernatable WebSocket open to the server. When a job lands (a wiki
- * regen, a dispatch, a merge request, an @mention), the server pushes a
- * `{type:'wake'}` frame and the daemon reconciles IMMEDIATELY — its normal
- * roster fetch — instead of waiting out the poll. That collapses pickup latency
- * from ≤RECONCILE_SECONDS to ~a round trip.
+ * Holds a hibernatable WebSocket open to the server. When a job lands — a
+ * session turn typed into a tab, a diff request, a preview, an env sync, a
+ * deploy, a wiki regen — the server pushes a `{type:'wake'}` frame and the
+ * daemon reconciles IMMEDIATELY — its normal roster fetch — instead of waiting
+ * out the poll. That collapses pickup latency from ≤RECONCILE_SECONDS to ~a
+ * round trip, which is what makes a message typed in the browser start on the
+ * machine at once.
  *
  * The socket carries NO authority: it's a dumb nudge, the roster HTTP fetch is
  * the source of truth (notify-then-reconcile, à la k8s watch). So a dropped or
@@ -74,9 +76,9 @@ export function connectStream({ onWake, isAlive }) {
       lastRxAt = Date.now();
       if (announcedDown) {
         announcedDown = false;
-        info(c.dim('push channel reconnected — instant dispatch back on'));
+        info(c.dim('push channel reconnected — turns start instantly again'));
       } else {
-        note(c.dim('push channel connected — instant dispatch on'));
+        note(c.dim('push channel connected — turns start instantly'));
       }
       clearPing();
       pingTimer = setInterval(() => {

package/bin/lib/update.mjs

@@ -114,10 +114,11 @@ export function handleVersionSignal({ latest, min, autoUpdate, safeToUpdate, tea
 
   if (wantInstall && !npx) {
     if (!safeToUpdate) {
-      // Outdated but an agent is mid-task — wait for idle. Nag once meanwhile.
+      // Outdated but a turn is running — wait until the machine is quiet. Nag
+      // once meanwhile.
       if (naggedFor !== target) {
         naggedFor = target;
-        note(`flowviant ${cur} → ${target} available — self-updating once agents go idle.`);
+        note(`flowviant ${cur} → ${target} available — self-updating once no turn is running.`);
       }
       return false;
     }

package/bin/lib/work.mjs

@@ -799,9 +799,17 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           'Content-Type': 'application/json',
         },
         signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ sessionId }),
+        // The instance is what CLAIMS the session lease server-side. Two
+        // daemons share one fleet credential, so the token cannot say which of
+        // us is serving this tab — and the mint is the moment that matters:
+        // there is one work-token row per session and minting ROTATES it, so a
+        // second mint revokes the first daemon's live secret mid-turn.
+        body: JSON.stringify({ sessionId, instance: DAEMON_INSTANCE }),
       });
       if (res.status === 404) return { gone: true };
+      // 409 — another daemon on this credential holds the session. Not ours to
+      // serve and not a retry: stand down and let the holder answer.
+      if (res.status === 409) return { heldElsewhere: true };
       if (!res.ok) return null;
       const token = (await res.json().catch(() => null))?.data?.token ?? null;
       if (!token) return null;
@@ -1168,8 +1176,25 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * machines. When the roster omits the field entirely (older server),
    * absence of signal is not a close — retire nothing.
    */
-  const retireWorkSessions = (activeIds) => {
+  /** Every session this daemon currently has a worktree for — what renews our
+   *  lease on the poll. Read off the directory rather than a map, so it is the
+   *  same fact retirement acts on. */
+  const heldSessionIds = () => {
+    const dir = join(baseDir, 'sessions');
+    try {
+      return readdirSync(dir).filter(isSafePathSegment).slice(0, 50);
+    } catch {
+      return [];
+    }
+  };
+
+  const retireWorkSessions = (activeIds, heldElsewhere) => {
     if (!Array.isArray(activeIds)) return;
+    // Sessions ANOTHER daemon on this credential is serving. They are absent
+    // from activeWorkSessions for us and present for them, and removing their
+    // worktree would pull the directory out from under a running turn. Absence
+    // means "the tab closed"; this is the one other thing it can mean.
+    const peers = new Set(Array.isArray(heldElsewhere) ? heldElsewhere : []);
     const dir = join(baseDir, 'sessions');
     if (!existsSync(dir)) return;
     let ids;
@@ -1182,6 +1207,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     let removed = 0;
     for (const id of ids) {
       if (live.has(id)) continue;
+      if (peers.has(id)) continue; // another daemon's tab — not ours to retire
       if (workChains.has(id) || shipping.has(id)) continue; // still draining here
       const wt = join(dir, id);
       try {
@@ -1412,6 +1438,15 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           if (!plainTab) {
             mint = await mintWorkToken(job.sessionId);
             if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
+            // Another daemon on this credential holds the session. Return
+            // WITHOUT settling: the holder is answering this same turn, and
+            // settling it here — even as a failure — would race the real
+            // answer and could win. Dropping it means the turn stays pending
+            // and the holder's answer lands, which is the whole point.
+            if (mint?.heldElsewhere) {
+              workAnswering.delete(job.id);
+              return;
+            }
             if (mint?.gone) {
               await settleWorkTurn(job.id, {
                 ok: false,
@@ -2064,6 +2099,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    heldSessionIds,
     processPreviewJobs,
     livePreviewIds,
     retirePreviews,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.53.0",
+  "version": "0.54.1",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {