flowviant 0.54.1 → 0.54.2

package/bin/lib/deploy.mjs

@@ -13,7 +13,7 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { join } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { deployCreds, appSecretsFor, scrub, myPubB64 } from './env.mjs';
 
@@ -167,7 +167,15 @@ export function processDeployJobs(jobs, ctx) {
     void (async () => {
       let beat = null;
       try {
-        const claimed = await post('deploy-claim', { jobId: job.id, pubkey: ctx.myPubB64() }).catch(() => null);
+        // `instance` names THIS PROCESS. The pubkey cannot: it is the env
+        // keypair read from one file per home directory, so two daemons on one
+        // box share it and a pubkey-only read-back let both "win" the claim
+        // and run the same deploy twice concurrently.
+        const claimed = await post('deploy-claim', {
+          jobId: job.id,
+          pubkey: ctx.myPubB64(),
+          instance: DAEMON_INSTANCE,
+        }).catch(() => null);
         if (!claimed?.claimed) return; // another daemon won the claim
         // Keep the claim fresh while we run — a long deploy must never be
         // re-queued out from under us (that would double-deploy). The async

package/bin/lib/fleet.mjs

@@ -782,7 +782,7 @@ export async function runFleetDaemon() {
             // Direct enqueue = immediacy; the server's durable regroundJobs list
             // (created by merge-done above, cleared by our reground-done report)
             // is the restart-safe backstop — dedup'd here by groundedIntents.
-            enqueueReground(job.id, job.prUrl, job.title, job.dirtiesPages);
+            enqueueReground(job.id, job.prUrl, job.title, job.dirtiesPages, job.shas);
           } else if (failedReason) {
             // Report into the thread (server narrates + re-arms the merge
             // button + notifies) — the job disappears from the roster.
@@ -926,7 +926,7 @@ export async function runFleetDaemon() {
     wikiQueue.push({ type: 'sweep' });
     void drainWiki();
   };
-  const enqueueReground = (intentId, prUrl, title, dirtiesPages) => {
+  const enqueueReground = (intentId, prUrl, title, dirtiesPages, shas) => {
     if (!intentId || groundedIntents.has(intentId)) return;
     groundedIntents.add(intentId);
     wikiQueue.push({
@@ -939,6 +939,13 @@ export async function runFleetDaemon() {
       // frontmatter file list has drifted, or that document a concept rather
       // than a directory.
       dirtiesPages: Array.isArray(dirtiesPages) ? dirtiesPages : [],
+      // THE COMMITS THAT SHIPPED — what changedFilesForShas resolves against.
+      // Dropping this here was the whole 0.54.0/0.54.1 defect: the server sent
+      // shas on every reground job, this function never stored them, and the
+      // drain's `task.shas` was undefined on every job — so the re-ground
+      // "revived" on 2026-08-22 retried three times against nothing and gave
+      // up, on a console nobody reads, on every single ship.
+      shas: Array.isArray(shas) ? shas : [],
     });
     void drainWiki();
   };
@@ -1185,6 +1192,13 @@ export async function runFleetDaemon() {
             // crash BEFORE this line leaves the job listed for a retry.
             regroundAttempts.delete(task.intentId);
             await reportMergeOutcome(REGROUND_DONE_URL, { taskId: task.intentId });
+            // The dedup was DAEMON-LIFETIME, which wedged a reopened card: its
+            // second ship writes a fresh durable job, this Set still holds the
+            // taskId, enqueueReground refuses it on every poll forever, and
+            // the never-consumed job churns the wiki-writer lease until a
+            // restart. The job is consumed now, so the guard has done its work;
+            // a FUTURE ship of the same card is new work, not a duplicate.
+            groundedIntents.delete(task.intentId);
           }
         } catch (e) {
           warn(`wiki ${task.type} failed: ${e.message}`);
@@ -1269,7 +1283,13 @@ export async function runFleetDaemon() {
       if (e.auth) {
         fail(`${e.message} — credential revoked or invalid. Shutting down.`);
         teardown();
-        process.exit(1);
+        // EXIT 0, for the same reason the commanded-stop path does: a revoked
+        // credential is a terminal, asked-for-by-someone state, and a relaunch
+        // can never fix it. Under `Restart=on-failure` a nonzero code has
+        // systemd relaunch the daemon immediately — a restart loop hammering
+        // dead-credential polls, fighting the Disconnect that revoked it, and
+        // ending in a unit that reads as a crash rather than a kill.
+        process.exit(0);
       }
       warn(`roster poll failed: ${e.message} — retrying in ${RECONCILE_SECONDS}s`);
       await sleep(RECONCILE_SECONDS);
@@ -1304,6 +1324,17 @@ export async function runFleetDaemon() {
           : 'stopped by Flowviant — no reason given.'
       );
       note('shutting down — stopping workers. Worktrees are kept: in-flight work resumes next run.');
+      // FLUSH the settle queue first, bounded: a queued-but-undelivered report
+      // is a COMPLETED turn whose side effects already happened, and dropping
+      // it re-runs the whole turn on the next start — quota spent twice and
+      // every card write doubled. This path is async (unlike the signal
+      // handlers, which cannot await), so the stop can afford five seconds of
+      // delivery before it obeys.
+      try {
+        await Promise.race([flushWorkReports(), sleep(5)]);
+      } catch {
+        /* undelivered reports re-run; delivering them was best-effort */
+      }
       // teardown() is NOT optional on this path. Detached preview tunnels
       // survive this process BY DESIGN, so exiting without it strands a public
       // hostname pointed into a worktree until somebody reboots the box — which
@@ -1421,7 +1452,7 @@ export async function runFleetDaemon() {
     for (const j of roster.regroundJobs ?? []) {
       const rid = j && (j.taskId ?? j.intentId); // new name first, old as fallback
       if (!j || typeof rid !== 'string') continue; // a null element would throw + wedge the loop
-      enqueueReground(rid, j.prUrl, j.title, j.dirtiesPages);
+      enqueueReground(rid, j.prUrl, j.title, j.dirtiesPages, j.shas);
     }
     void drainWiki();
 

package/bin/lib/instance.mjs

@@ -413,15 +413,16 @@ function stillTheHolder(holder) {
   // `process.argv[1] || ''` — and matching on '' would match every process
   // alive, so it takes the same road as a missing one.
   if (!want) return startedAroundLockWrite(holder);
+  let cmdline;
   try {
-    if (platform() === 'linux') {
-      return readFileSync(`/proc/${holder.pid}/cmdline`, 'utf8').replace(/\0/g, ' ').includes(want);
-    }
-    return execFileSync('ps', ['-o', 'command=', '-p', String(holder.pid)], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 3000,
-    }).includes(want);
+    cmdline =
+      platform() === 'linux'
+        ? readFileSync(`/proc/${holder.pid}/cmdline`, 'utf8').replace(/\0/g, ' ')
+        : execFileSync('ps', ['-o', 'command=', '-p', String(holder.pid)], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 3000,
+          });
   } catch {
     // NOT `false`. takeOverFrom already returned early if the pid were gone, so
     // reaching here means the process is alive and we could not READ it —
@@ -429,6 +430,45 @@ function stillTheHolder(holder) {
     // here is what made the refusal claim the pid belonged to somebody else.
     return null;
   }
+  if (!cmdline.includes(want)) return false;
+  // AN ENTRY MATCH ALONE IS NOT IDENTITY. Every daemon on the box shares one
+  // entry path under a global install, so "cmdline contains this cli.mjs"
+  // proves "is SOME flowviant daemon", not "is the daemon that wrote THIS
+  // lock" — and a crashed daemon's pid recycled to a SIBLING project's live
+  // daemon passed it, which let a same-repo takeover SIGTERM a different
+  // project's machine. Every 0.54.0+ lock also carries `startedAt`, the
+  // process's own witness to when it began, so when it is present the start
+  // time must agree too. `null` (could not measure — hidepid, no ps, a lock
+  // with no startedAt) falls back to the entry match alone, exactly the
+  // pre-check behaviour: refusing on ignorance here would re-brick takeover
+  // on the hosts that hide /proc.
+  const around = startedAroundLockWrite(holder);
+  return around === false ? false : true;
+}
+
+/**
+ * Unlink a lock file ONLY while it still names the pid the caller decided
+ * about (or nothing readable). Every rmSync of a lock outside the ppid-adopt
+ * path goes through this: between "I proved pid N is dead/stale" and the
+ * unlink, a concurrently starting daemon can clear the file itself and
+ * wx-create its own — and an unconditional rm then deletes a LIVE daemon's
+ * lock, leaving it running unguarded, which is the one condition this module
+ * exists to prevent. The read-then-rm gap that remains is microseconds against
+ * the seconds-wide window it closes.
+ *
+ * Returns false when the file now names a DIFFERENT pid — a handover the
+ * caller must treat as "not mine to clear" — true otherwise (removed, already
+ * gone, or best-effort failed into acquire's next pass).
+ */
+function rmLockIfStill(path, pid) {
+  const cur = readHolder(path);
+  if (cur && cur.pid !== pid) return false;
+  try {
+    rmSync(path, { force: true });
+  } catch {
+    /* best-effort; a stale file is cleared by the next acquire */
+  }
+  return true;
 }
 
 /** Blocking, because this runs before there is an event loop worth yielding to
@@ -530,11 +570,11 @@ function standDown(holder, path, log) {
     sleep(400);
   }
 
-  // A SIGKILLed daemon never ran its release(), so clear what it left.
-  try {
-    rmSync(path, { force: true });
-  } catch {
-    return { failed: 'could not clear the lock file' };
+  // A SIGKILLed daemon never ran its release(), so clear what it left — but
+  // only if the file still names the pid we stood down: in the gap since the
+  // last read a fresh daemon may have cleared it and taken the lock itself.
+  if (!rmLockIfStill(path, holder.pid)) {
+    return { failed: 'another daemon took the lock while it was being cleared — try again in a moment' };
   }
   return null;
 }
@@ -564,7 +604,13 @@ function takeOverFrom(holder, path, log, { allowDowngrade = false } = {}) {
     };
   }
   if (identified === false) {
-    return { failed: `pid ${holder.pid} is no longer the daemon that took this lock — refusing to signal it` };
+    // MEASURED: the lock's writer is gone and the pid now belongs to something
+    // else. That is a STALE LOCK, not an unremovable holder — refusing here
+    // used to brick every start after an OOM-kill or reboot recycled the pid
+    // to any live process, until a human deleted ~/.flowviant/daemon-*.lock by
+    // hand. Nothing is signalled (the process is a stranger); the caller
+    // clears the corpse the same way it clears a dead pid's.
+    return { stale: true };
   }
   if (!allowDowngrade && holder.version && cmpVersion(VERSION, holder.version) < 0) {
     return {
@@ -608,9 +654,19 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
     // quietly.
     if (noTakeover) return { ok: false, holder: neighbour, sameRepo: true };
     log?.(`another project's daemon is serving this repo (pid ${neighbour.pid}).`);
-    const bad = takeOverFrom(neighbour, neighbourLockPath(neighbour, path), log);
-    if (bad)
+    // The OPTIONS ride along — this call used to drop them, so a deliberate
+    // `flowviant --takeover-downgrade` against a newer neighbour printed
+    // "--takeover-downgrade if you mean it" at somebody who had already
+    // typed it.
+    const bad = takeOverFrom(neighbour, neighbourLockPath(neighbour, path), log, { allowDowngrade });
+    if (bad?.stale) {
+      // The neighbour's lock is a corpse wearing a recycled pid — clear it (if
+      // it still names that pid) and carry on to our own lock.
+      log?.(`pid ${neighbour.pid} is no longer a daemon — clearing its stale lock.`);
+      rmLockIfStill(neighbourLockPath(neighbour, path), neighbour.pid);
+    } else if (bad) {
       return { ok: false, holder: neighbour, sameRepo: true, takeoverFailed: bad.failed, unidentified: bad.unidentified };
+    }
   }
 
   // Two passes at most: one to clear a stale holder, one to take the lock. A
@@ -623,11 +679,20 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       if (e.code !== 'EEXIST') return { ok: true, release: () => {}, unguarded: true };
       const holder = readHolder(path);
       if (!holder || !alive(holder.pid)) {
-        // A crashed daemon's leftover. Clear it and take it on the next pass.
-        try {
-          rmSync(path, { force: true });
-        } catch {
-          return { ok: true, release: () => {}, unguarded: true };
+        // A crashed daemon's leftover. Clear it and take it on the next pass —
+        // ownership-verified, because a concurrent start may have cleared and
+        // re-created it in the gap since our read.
+        if (holder) rmLockIfStill(path, holder.pid);
+        else {
+          // Unreadable content: re-read before clearing, so a half-written
+          // record a peer is writing RIGHT NOW is not deleted mid-write.
+          const again = readHolder(path);
+          if (again && alive(again.pid)) continue; // it finished writing — a real holder now
+          try {
+            rmSync(path, { force: true });
+          } catch {
+            return { ok: true, release: () => {}, unguarded: true };
+          }
         }
         continue;
       }
@@ -653,10 +718,28 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       const wanted = force || (here && !noTakeover);
       if (wanted) {
         const bad = takeOverFrom(holder, path, log, { allowDowngrade });
+        if (bad?.stale) {
+          // Measured: the lock's writer is gone and its pid was recycled to a
+          // stranger. A corpse is cleared, never "refused" — refusing bricked
+          // every start after a reboot handed the pid to any live process.
+          log?.(`pid ${holder.pid} is no longer a daemon — clearing its stale lock.`);
+          rmLockIfStill(path, holder.pid);
+          continue;
+        }
         if (bad)
           return { ok: false, holder, takeoverFailed: bad.failed, sameRepo: here, unidentified: bad.unidentified };
         continue; // the file is gone — the next pass takes it
       }
+      // Before refusing on a different-repo holder, make sure it IS one: a
+      // stale lock whose pid was recycled to any live process would otherwise
+      // refuse this credential's start forever, naming a "daemon" that is a
+      // stranger. Only the MEASURED verdict clears; null (could not look)
+      // still refuses, because ignorance must not delete a lock.
+      if (stillTheHolder(holder) === false) {
+        log?.(`pid ${holder.pid} is no longer a daemon — clearing its stale lock.`);
+        rmLockIfStill(path, holder.pid);
+        continue;
+      }
       return { ok: false, holder, sameRepo: here };
     }
     try {

package/bin/lib/login.mjs

@@ -74,7 +74,11 @@ export async function runLogin({ thenStart = false } = {}) {
       continue; // transient — keep polling
     }
     if (poll.status === 'approved') {
-      store({ fleetToken: poll.fleetToken, projectId: poll.projectId, mcpUrl: poll.mcpUrl });
+      // `machineToken` is the wire's new name; `fleetToken` is the one every
+      // published daemon reads. The server dual-sends until DAEMON_MIN clears
+      // THIS release (0.54.2) — reading both here is what makes retiring the
+      // old key possible at all.
+      store({ fleetToken: poll.machineToken ?? poll.fleetToken, projectId: poll.projectId, mcpUrl: poll.mcpUrl });
       ok('connected — credential saved to ~/.flowviant/credentials.json');
       // The daemon starts right here unless the caller opted out; telling
       // someone to run a second command was the step that got missed, since by

package/bin/lib/preview.mjs

@@ -228,9 +228,25 @@ function mutateRegistry(fn) {
   }
 }
 
+/** Signal-0 liveness (EPERM = alive and not ours), for the OWNER check below. */
+function processAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === 'EPERM';
+  }
+}
+
 function recordPreviewPid(pid, sig) {
   if (!pid) return;
-  mutateRegistry((list) => [...list, { pid, sig }]);
+  // `owner` is the DAEMON that spawned it. The registry is shared by design —
+  // two daemons serving two projects both write here — so without an owner a
+  // starting daemon reaped its PEER's live tunnels: killed them, wiped their
+  // entries, and the peer kept heartbeating a URL that 530s (its probe watches
+  // the origin port, which was still alive).
+  mutateRegistry((list) => [...list, { pid, sig, owner: process.pid }]);
 }
 
 function forgetPreviewPid(pid) {
@@ -253,12 +269,21 @@ function stillOurs(pid, sig) {
 }
 
 /** Reap tunnel process groups left behind by a previously-crashed daemon.
- *  Call once at daemon startup, before any work begins. */
+ *  Call once at daemon startup, before any work begins.
+ *
+ *  ORPHANS ONLY: an entry whose owning daemon is STILL ALIVE belongs to a
+ *  peer serving another project (or to the process we are replacing, whose
+ *  own teardown handles it) — killing those and wiping their entries was a
+ *  peer daemon's startup silently breaking every live share on the box. Only
+ *  the entries this pass handled are removed; a peer's records survive. */
 export function reapOrphanPreviews(log) {
   const list = readRegistry();
   if (list.length === 0) return;
   let killed = 0;
-  for (const { pid, sig } of list) {
+  const handled = new Set();
+  for (const { pid, sig, owner } of list) {
+    if (Number.isInteger(owner) && owner !== process.pid && processAlive(owner)) continue;
+    handled.add(pid);
     if (!stillOurs(pid, sig)) continue;
     try {
       process.kill(-pid, 'SIGKILL'); // whole group
@@ -272,7 +297,7 @@ export function reapOrphanPreviews(log) {
       }
     }
   }
-  mutateRegistry(() => []);
+  if (handled.size) mutateRegistry((cur) => cur.filter((e) => !handled.has(e.pid)));
   if (killed) log?.(`reaped ${killed} orphaned preview tunnel${killed === 1 ? '' : 's'} from a previous run.`);
 }
 
@@ -295,8 +320,35 @@ const TAIL_BYTES = 2000;
  * cloudflared happily outlives a dead dev server and the gate answers a dead
  * origin with 502, so without this the product would report "live" over a 502 —
  * Flowviant asserting a state it never measured.
+ *
+ * `stillServing` (optional, async → boolean) is the ATTRIBUTION re-check the
+ * probe runs instead of a bare TCP connect. Ports are global to a box and a
+ * worktree is not: when the driver's dev server dies and anything else — a
+ * teammate's worktree, a database — binds the same number, a bare
+ * `isListening` keeps the probe green and the existing URL+password serve the
+ * NEW process, outside every consent gate. The caller passes the same
+ * `listenersIn(worktree)` check the open path uses, so "the origin is alive"
+ * keeps meaning "THIS session's origin".
+ *
+ * `onAbuse` fires when the gate closes itself after repeated failed password
+ * attempts — AFTER the share is torn down locally — so the caller can report
+ * the incident. Without it the abuse close was invisible: the row kept
+ * reading "live" until staleness, and endedReason 'abuse' was unreachable.
+ *
+ * `onTunnelGone` fires when cloudflared exits AFTER the URL was published
+ * (quick tunnels are best-effort and do get dropped). The probe cannot see
+ * this — it watches the origin — and a daemon that keeps heartbeating a dead
+ * hostname confirms "live" over a 530 for up to 8 hours.
  */
-export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
+export async function openTunnel({
+  port,
+  log,
+  onDead,
+  onAbuse,
+  onTunnelGone,
+  stillServing,
+  probeMs = 20_000,
+}) {
   // Re-validate at the machine. The server checked this port against the last
   // report; reports are up to a minute old and a dev server is a process a
   // human can stop at any moment.
@@ -337,7 +389,18 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
 
   // The gate comes up FIRST and the tunnel points at it, never at the origin —
   // so there is no window in which the public hostname is un-gated.
-  gate = await startAuthProxy({ targetPort: port, log, onAbuse: () => stop() });
+  gate = await startAuthProxy({
+    targetPort: port,
+    log,
+    onAbuse: () => {
+      stop();
+      try {
+        onAbuse?.();
+      } catch {
+        /* the caller's report is best-effort */
+      }
+    },
+  });
   if (!gate) {
     return { error: 'could not start the password gate for this preview, so nothing was published.' };
   }
@@ -348,7 +411,11 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
   args.push('--http-host-header', 'localhost');
 
   tunnel = spawn(cf.bin, args, { detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
-  recordPreviewPid(tunnel.pid, 'cloudflared');
+  // The signature names THIS tunnel's gate port, not the bare word
+  // 'cloudflared': the reap matches cmdline.includes(sig), and the generic
+  // word would let a recycled pid land on an operator's own unrelated
+  // cloudflared and group-SIGKILL it.
+  recordPreviewPid(tunnel.pid, `--url http://localhost:${gate.port}`);
 
   return new Promise((resolve) => {
     let settled = false;
@@ -378,11 +445,19 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
       const m = TUNNEL_RE.exec(s);
       if (!m) return;
 
-      // Watch the ORIGIN, not the tunnel. A dead dev server behind a live
-      // hostname is the failure a viewer cannot diagnose.
+      // Watch the ORIGIN — with the caller's ATTRIBUTION check when it gave
+      // one, never a bare port probe: a freed port rebound by another
+      // worktree answers a TCP connect exactly like the origin did, and the
+      // share would keep serving a process nobody consented to publish.
       probe = setInterval(async () => {
         if (stopped) return;
-        if (!(await isListening(port))) {
+        let serving;
+        try {
+          serving = stillServing ? await stillServing() : await isListening(port);
+        } catch {
+          serving = false; // an attribution check that errors is not a "yes"
+        }
+        if (!serving) {
           const dead = onDead;
           stop();
           try {
@@ -394,6 +469,20 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
       }, probeMs);
       if (probe.unref) probe.unref();
 
+      // The TUNNEL dying after publish (quick tunnels get dropped) is the one
+      // exit the probe cannot see. `stopped` guards our own kill: stop() sets
+      // it before signalling, so this only fires for a death nobody asked for.
+      tunnel.once('close', () => {
+        if (stopped) return;
+        const gone = onTunnelGone;
+        stop();
+        try {
+          gone?.();
+        } catch {
+          /* the caller's report is best-effort */
+        }
+      });
+
       finish({ url: m[0], user: gate.user, password: gate.password, stop });
     };
 

package/bin/lib/work.mjs

@@ -492,7 +492,15 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
         /* best-effort */
       }
     }
-    await postPreview({ sessionId, ended: true, endedReason: reason });
+    // Confirm only a teardown we actually PERFORMED. The stop job is a
+    // broadcast — every daemon on the credential gets it — and the one holding
+    // nothing used to answer instantly, flipping the row to 'ended' so the
+    // real holder was never told to stop and its tunnel outlived every
+    // surface. (The server drops mismatched confirms too; this is the copy on
+    // the component that can be published ahead of a deploy.) A stop for a
+    // tunnel whose daemon crashed resolves server-side: an unanswered 'ending'
+    // row reads as over once it goes stale.
+    if (live) await postPreview({ sessionId, ended: true, endedReason: reason });
   };
 
   const processPreviewJobs = (jobs) => {
@@ -552,6 +560,27 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               livePreviews.delete(sessionId);
               void postPreview({ sessionId, ended: true, endedReason: 'origin_gone' });
             },
+            // ATTRIBUTION rides the probe, not just the open: a freed default
+            // port (5173…) rebound by any other process on the box would keep
+            // a bare TCP probe green, and the share's URL+password would serve
+            // a worktree nobody consented to publish.
+            stillServing: async () => listenersIn(wt).some((l) => l.port === port),
+            // The gate closed itself after repeated failed passwords. Stored,
+            // so the incident is visible — and the entry is dropped so the
+            // owner can re-share the port without restarting the daemon.
+            onAbuse: () => {
+              livePreviews.delete(sessionId);
+              void postPreview({ sessionId, ended: true, endedReason: 'abuse' });
+            },
+            // cloudflared died AFTER publishing (quick tunnels get dropped).
+            // Without this the daemon kept heartbeating a hostname that 530s.
+            onTunnelGone: () => {
+              livePreviews.delete(sessionId);
+              void postPreview({
+                sessionId,
+                error: 'the tunnel dropped — share it again to reopen.',
+              });
+            },
           });
           if (t.error) {
             await postPreview({ sessionId, error: t.error });
@@ -1195,6 +1224,13 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     // worktree would pull the directory out from under a running turn. Absence
     // means "the tab closed"; this is the one other thing it can mean.
     const peers = new Set(Array.isArray(heldElsewhere) ? heldElsewhere : []);
+    // A peer-held session's CACHED work token is a claim-bypass: the mint is
+    // the one place the session lease 409s a non-holder, and a token younger
+    // than ~23h skips the mint entirely — so a daemon that lost a lease would
+    // run the next turn anyway, editing the worktree while every MCP call
+    // 401s (the peer's mint rotated the secret). Dropping the cache forces
+    // the next turn through the mint, where the 409 stands it down.
+    for (const id of peers) workTokens.delete(id);
     const dir = join(baseDir, 'sessions');
     if (!existsSync(dir)) return;
     let ids;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.54.1",
-  "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
+  "version": "0.54.2",
+  "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"