flowviant 0.54.1 → 0.55.0

package/bin/cli.mjs

@@ -32,6 +32,13 @@
  * odd side job the roster carries — a commit's patch, a preview share, a wiki
  * regen. When you say ship, the daemon merges that branch into base `--no-ff`.
  *
+ * MANY PROJECTS, ONE BOX (0.55.0): `flowviant login` in each repo stores one
+ * credential per project (~/.flowviant/credentials.json holds a map), and a
+ * bare `npx flowviant` serves the project BOUND to the repo it is started in.
+ * Ambiguity is a picker on a TTY and a worded refusal headless — never a
+ * guess. `flowviant projects` lists what is stored; `--project <name|id>`
+ * picks without a prompt.
+ *
  * Env:
  *   FLOWVIANT_FLEET     the machine credential (or use `flowviant login`).
  *   FLOWVIANT_API_URL   default https://api.flowviant.com/api/v2
@@ -49,7 +56,7 @@
  * git + worktreeDiff + patch; localSessions, listeners, preview + authproxy;
  * env + env-cli + vault, resources, deploy, shot.
  */
-import { FLEET_TOKEN } from './lib/config.mjs';
+import { FLEET_TOKEN, CREDENTIAL, adoptStoredCredential } from './lib/config.mjs';
 import { runFleetDaemon } from './lib/fleet.mjs';
 import { runLogin } from './lib/login.mjs';
 
@@ -172,6 +179,32 @@ if (process.argv[2] === 'stop') {
   process.exit(failed > 0 ? 1 : 0);
 }
 
+// `flowviant projects` — every project this box has a credential for, which
+// repo each is bound to, and which the legacy mirror points at. Needs no
+// network: it reads the store, which is the exact thing a confused person is
+// trying to see. The remedies are named because this listing IS the moment of
+// confusion ("why did it say skadooble?"), not documentation.
+if (process.argv[2] === 'projects') {
+  const { listStoredProjects, projectLabel } = await import('./lib/credentials.mjs');
+  const entries = listStoredProjects();
+  if (entries.length === 0) {
+    console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
+    process.exit(0);
+  }
+  for (const e of entries) {
+    console.log(
+      `  ${projectLabel(e)}  (${e.projectId.slice(0, 8)}…)` +
+        `${e.repoRoot ? `\n      repo · ${e.repoRoot}` : '\n      repo · not bound yet — first start or login in its repo binds it'}` +
+        `${e.active ? '\n      what a pre-0.55.0 flowviant on this box would serve (the legacy mirror)' : ''}`
+    );
+  }
+  console.log(
+    '\n  `npx flowviant` picks by the repo it is started in; `--project <name|id>` overrides;\n' +
+      '  `flowviant login` in a new repo connects another project.'
+  );
+  process.exit(0);
+}
+
 // `flowviant env <import|set|show>` — the CLI half of team env sync. Values
 // are sealed to the project pubkey ON THIS MACHINE (same write-only crypto as
 // the browser); `show` decrypts locally — it only works on an ENROLLED machine.
@@ -191,14 +224,117 @@ if (process.argv[2] === 'env') {
   process.exit(0);
 }
 
+// ── WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
+//
+// The store holds many projects since 0.55.0 and resolution is BY REPO
+// (credentials.mjs). What is left here is the human half: an ambiguous store
+// on a TTY becomes a PICKER, a single unbound credential gets ONE confirm that
+// binds it, and a headless start with no unambiguous answer refuses in words
+// that name every stored project and every way out. The one thing this block
+// must never do is serve a project the resolution did not name — "it said
+// skadooble in my calendar repo" is the confusion this exists to end.
+const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+
+/** Re-exec a plain `flowviant` after an inline login — the login command's own
+ *  pattern: config.mjs read the store at IMPORT time, before the credential
+ *  existed, so this process cannot serve; the child can. */
+async function reexecAfterLogin() {
+  await runLogin({ thenStart: false });
+  const { spawn } = await import('node:child_process');
+  const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
+  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
+}
+
+function listLines(entries, { projectLabel }) {
+  return entries
+    .map(
+      (e, i) =>
+        `  ${i + 1}. ${projectLabel(e)}` +
+        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet')
+    )
+    .join('\n');
+}
+
 if (!FLEET_TOKEN) {
-  console.error(
-    'error: no credential found. Easiest:\n' +
-      '  flowviant login      (approve in the app — recommended)\n' +
-      'Or set:\n' +
-      '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
-  );
-  process.exit(1);
+  if (CREDENTIAL.error) {
+    console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
+    process.exit(1);
+  }
+  if (CREDENTIAL.choices?.length && interactive) {
+    const creds = await import('./lib/credentials.mjs');
+    const { choices, repoRoot } = CREDENTIAL;
+    console.log(
+      CREDENTIAL.reason === 'outside-repo'
+        ? 'flowviant is not inside a git repo, and more than one project is connected here.'
+        : CREDENTIAL.reason === 'multiple-bound'
+          ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
+          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+    );
+    console.log(listLines(choices, creds));
+    console.log(`  ${choices.length + 1}. connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`);
+    const rl = (await import('node:readline/promises')).createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    const raw = (await rl.question(`Which project should this daemon serve? [1-${choices.length + 1}] `)).trim();
+    rl.close();
+    const n = Number.parseInt(raw, 10);
+    if (n === choices.length + 1) await reexecAfterLogin();
+    const picked = Number.isInteger(n) ? choices[n - 1] : undefined;
+    if (!picked) {
+      console.error('nothing chosen — nothing started.');
+      process.exit(1);
+    }
+    // An answered question is consent: adopt it, and BIND it to this repo so
+    // the next start needs no prompt. Repointing is legitimate and said aloud.
+    if (repoRoot && picked.repoRoot && picked.repoRoot !== repoRoot) {
+      console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
+    }
+    adoptStoredCredential(picked);
+    creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
+    console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
+  } else if (CREDENTIAL.choices?.length) {
+    const creds = await import('./lib/credentials.mjs');
+    console.error(
+      'error: more than one project is connected on this machine and this repo is not bound to any of them:\n' +
+        listLines(CREDENTIAL.choices, creds) +
+        '\nPick one with `--project <name|id>`, bind this repo by running `flowviant` here in a terminal once,\n' +
+        'or connect this repo to its own project with `flowviant login`.'
+    );
+    process.exit(1);
+  } else {
+    console.error(
+      'error: no credential found. Easiest:\n' +
+        '  flowviant login      (approve in the app — recommended)\n' +
+        'Or set:\n' +
+        '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
+    );
+    process.exit(1);
+  }
+} else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
+  // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
+  // yes binds and every later start is silent. This is the exact question
+  // whose absence had a calendar checkout serving skadooble.
+  const creds = await import('./lib/credentials.mjs');
+  const label = creds.projectLabel(CREDENTIAL.entry);
+  const rl = (await import('node:readline/promises')).createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  const raw = (
+    await rl.question(`This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `)
+  ).trim().toLowerCase();
+  rl.close();
+  if (raw === '' || raw === 'y' || raw === 'yes') {
+    creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
+  } else {
+    console.error(
+      `nothing started. Connect this repo to its own project with \`flowviant login\`, ` +
+        `or see what is stored with \`flowviant projects\`.`
+    );
+    process.exit(1);
+  }
 }
 
 await runFleetDaemon();

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir, cpus, totalmem } from 'node:os';
+import { cpus, totalmem } from 'node:os';
 
 // Read the daemon's version from its OWN package.json (always shipped in the npm
 // tarball) — never hardcode it. The hardcoded constant drifted: it sat at
@@ -30,14 +30,11 @@ export const MODEL = process.env.FLOWVIANT_MODEL || 'opus';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.
-function readStoredCredential() {
-  try {
-    return JSON.parse(readFileSync(join(homedir(), '.flowviant', 'credentials.json'), 'utf8'));
-  } catch {
-    return null;
-  }
-}
-const stored = readStoredCredential();
+// Since 0.55.0 the store holds MANY projects and resolution is BY REPO — see
+// credentials.mjs for the whole rule. `CREDENTIAL` carries the resolution so
+// cli.mjs can turn an ambiguity into a picker instead of a guess.
+import { resolveStoredCredential } from './credentials.mjs';
+export const CREDENTIAL = resolveStoredCredential();
 
 function argFlag(name) {
   const i = process.argv.indexOf(name);
@@ -167,5 +164,15 @@ export const DAEMON_INSTANCE = randomBytes(12).toString('hex');
 // --tokens) stood beside it and carried WORKER tokens into the pre-daemon loop;
 // that principal owns zero tools since dispatch was deleted, and the kind can no
 // longer be minted, so the plumbing went with the entrypoint (2026-08-19).
-export const FLEET_TOKEN =
-  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || stored?.fleetToken || '';
+// `let`, because ES named imports are LIVE bindings: when cli.mjs answers an
+// ambiguous store with a picker, adoptStoredCredential updates every importer
+// before the daemon touches the network. Everything before that point (the
+// resolution, the flags) is settled synchronously at import, as it always was.
+export let FLEET_TOKEN =
+  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || CREDENTIAL.entry?.fleetToken || '';
+
+/** cli.mjs's picker chose. Must run BEFORE runFleetDaemon — nothing here
+ *  re-authenticates a connection already made. */
+export function adoptStoredCredential(entry) {
+  if (entry?.fleetToken) FLEET_TOKEN = entry.fleetToken;
+}

package/bin/lib/credentials.mjs

@@ -0,0 +1,258 @@
+/**
+ * THE CREDENTIAL STORE — one file, MANY projects (v2, 2026-08-23).
+ *
+ * ~/.flowviant/credentials.json used to hold exactly one credential, and
+ * `flowviant login` overwrote it — so `npx flowviant` in ANY directory served
+ * whatever project was logged into last. A user standing in their calendar
+ * repo watched the banner say another project's name, and the only thing that
+ * saved them from serving the wrong repo was the instance lock's same-repo
+ * refusal. One VM is allowed to run one daemon per project (the lock is keyed
+ * per credential and the header of instance.mjs says so out loud); the store
+ * was the only thing pretending otherwise.
+ *
+ * THE FILE SHAPE, and why it is two shapes at once:
+ *
+ *   {
+ *     fleetToken, projectId, mcpUrl,          // the LEGACY MIRROR
+ *     projects: {                             // v2: every connected project
+ *       [projectId]: { fleetToken, mcpUrl, name, repoRoot, savedAt }
+ *     }
+ *   }
+ *
+ * The top-level trio is what every daemon before 0.55.0 reads, and the CLI is
+ * the one component a deploy cannot upgrade — so it stays, always mirroring
+ * the ACTIVE (most recently logged-in or explicitly picked) project. An old
+ * version keeps working with that project; a new one resolves by REPO.
+ *
+ * WHICH CREDENTIAL A START USES — resolution, in order:
+ *   --fleet / FLOWVIANT_FLEET     the operator said, verbatim (config.mjs).
+ *   --project <name|id>           an entry, named without a prompt.
+ *   the entry BOUND to this repo  repoRoot recorded at login/confirm, compared
+ *                                 by realpath — the no-ambiguity path.
+ *   one unbound entry             served, with a one-time TTY confirm that
+ *                                 binds it (headless keeps the old behaviour —
+ *                                 a systemd restart must not hang on a prompt).
+ *   anything else                 a CHOICE, never a guess: the CLI lists every
+ *                                 stored project and asks (cli.mjs), or — with
+ *                                 no TTY — refuses in words that name them all.
+ *
+ * The repoRoot binding is a SAFETY line, not bookkeeping: serving project X
+ * from a repo that is not X's checkout materializes X's session worktrees and
+ * decrypted env inside the wrong repository. Binding happens only at moments a
+ * HUMAN was present (login, an answered confirm, an explicit pick) — never
+ * silently on a headless start, where cementing the wrong repo would make the
+ * mistake permanent.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const CRED_DIR = join(homedir(), '.flowviant');
+const CRED_FILE = join(CRED_DIR, 'credentials.json');
+
+function readFile() {
+  try {
+    const v = JSON.parse(readFileSync(CRED_FILE, 'utf8'));
+    return v && typeof v === 'object' ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Atomic write (tmp + rename), 0600 — this file is credentials. */
+function writeFile(v) {
+  mkdirSync(CRED_DIR, { recursive: true });
+  const tmp = `${CRED_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(v, null, 2), { mode: 0o600 });
+  renameSync(tmp, CRED_FILE);
+}
+
+/** The repo root of `cwd`, realpath'd, or null when not inside a git repo. */
+export function detectRepoRoot(cwd = process.cwd()) {
+  try {
+    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5000,
+    }).trim();
+    return root ? realpathSync(root) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Same directory whatever it is spelled as — the instance.mjs rule. */
+function samePath(a, b) {
+  if (!a || !b) return false;
+  const norm = (v) => {
+    try {
+      return realpathSync(v);
+    } catch {
+      return String(v).replace(/\/+$/, '');
+    }
+  };
+  return norm(a) === norm(b);
+}
+
+/**
+ * Every stored project, NORMALIZED: the v2 map, plus the legacy trio surfaced
+ * as an entry when no map row carries its token (a pre-0.55.0 file is one
+ * project with no name and no binding — real, and listed as such). `active`
+ * marks the entry the legacy mirror points at.
+ */
+export function listStoredProjects() {
+  const f = readFile();
+  if (!f) return [];
+  const out = new Map();
+  for (const [projectId, e] of Object.entries(f.projects ?? {})) {
+    if (!e || typeof e.fleetToken !== 'string' || !e.fleetToken) continue;
+    out.set(projectId, {
+      projectId,
+      fleetToken: e.fleetToken,
+      mcpUrl: e.mcpUrl ?? null,
+      name: typeof e.name === 'string' && e.name ? e.name : null,
+      repoRoot: typeof e.repoRoot === 'string' && e.repoRoot ? e.repoRoot : null,
+      savedAt: e.savedAt ?? null,
+    });
+  }
+  if (typeof f.fleetToken === 'string' && f.fleetToken && typeof f.projectId === 'string' && f.projectId && !out.has(f.projectId)) {
+    out.set(f.projectId, {
+      projectId: f.projectId,
+      fleetToken: f.fleetToken,
+      mcpUrl: f.mcpUrl ?? null,
+      name: null,
+      repoRoot: null,
+      savedAt: null,
+    });
+  }
+  return [...out.values()].map((e) => ({ ...e, active: e.projectId === f.projectId }));
+}
+
+/** What a project is CALLED on a terminal: its name, or an id you can grep. */
+export function projectLabel(e) {
+  return e?.name ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
+}
+
+function mutate(fn) {
+  const f = readFile() ?? {};
+  if (!f.projects || typeof f.projects !== 'object') f.projects = {};
+  // Surface a legacy trio into the map before any edit, so nothing loses it.
+  if (typeof f.fleetToken === 'string' && f.fleetToken && typeof f.projectId === 'string' && f.projectId && !f.projects[f.projectId]) {
+    f.projects[f.projectId] = { fleetToken: f.fleetToken, mcpUrl: f.mcpUrl ?? null };
+  }
+  fn(f);
+  writeFile(f);
+  return f;
+}
+
+/** A fresh login: upsert the entry AND point the legacy mirror at it. */
+export function saveLogin({ fleetToken, projectId, mcpUrl, name, repoRoot }) {
+  mutate((f) => {
+    f.projects[projectId] = {
+      ...(f.projects[projectId] ?? {}),
+      fleetToken,
+      mcpUrl: mcpUrl ?? null,
+      ...(name ? { name } : {}),
+      ...(repoRoot ? { repoRoot } : {}),
+      savedAt: new Date().toISOString(),
+    };
+    f.fleetToken = fleetToken;
+    f.projectId = projectId;
+    f.mcpUrl = mcpUrl ?? null;
+  });
+}
+
+/** An explicit human pick: repoint the legacy mirror, and — when the pick was
+ *  made standing in a repo — bind the entry there. A pick IS the confirmation;
+ *  binding on anything less would cement a guess. */
+export function selectStoredProject(projectId, { bindRepoRoot } = {}) {
+  mutate((f) => {
+    const e = f.projects[projectId];
+    if (!e) return;
+    if (bindRepoRoot) e.repoRoot = bindRepoRoot;
+    f.fleetToken = e.fleetToken;
+    f.projectId = projectId;
+    f.mcpUrl = e.mcpUrl ?? null;
+  });
+}
+
+export function bindStoredRepo(projectId, repoRoot) {
+  if (!repoRoot) return;
+  mutate((f) => {
+    if (f.projects[projectId]) f.projects[projectId].repoRoot = repoRoot;
+  });
+}
+
+/** The roster names the project on every poll; remember it so the picker and
+ *  `flowviant projects` can say a NAME instead of an id. */
+export function setStoredProjectName(projectId, name) {
+  if (!projectId || typeof name !== 'string' || !name) return;
+  const entries = listStoredProjects();
+  const e = entries.find((x) => x.projectId === projectId);
+  if (!e || e.name === name) return;
+  mutate((f) => {
+    if (f.projects[projectId]) f.projects[projectId].name = name;
+  });
+}
+
+/** Match `--project <ref>` against the store: exact id, id prefix (≥6), or
+ *  case-insensitive name. Ambiguity is an error, never a coin flip. */
+export function matchStoredProject(ref) {
+  const entries = listStoredProjects();
+  const q = String(ref ?? '').trim();
+  if (!q) return { error: 'empty --project value' };
+  const byId = entries.filter(
+    (e) => e.projectId === q || (q.length >= 6 && e.projectId.startsWith(q))
+  );
+  const byName = entries.filter((e) => e.name && e.name.toLowerCase() === q.toLowerCase());
+  const hits = byId.length > 0 ? byId : byName;
+  if (hits.length === 1) return { entry: hits[0] };
+  if (hits.length > 1) return { error: `"${q}" matches ${hits.length} stored projects — use the full project id` };
+  return { error: `no stored project matches "${q}"` };
+}
+
+/**
+ * Resolve which stored credential this invocation should use. PURE over the
+ * store + argv + cwd; every refusal and prompt above it is built from what
+ * this returns. Shapes:
+ *   { entry, source: 'project-flag' | 'repo' | 'only', needsConfirm? }
+ *   { choices, reason: 'no-match' | 'multiple-bound' | 'outside-repo', repoRoot }
+ *   { none: true }
+ *   { error }
+ *
+ * Deliberately NO mirror fallback once more than one project is stored: the
+ * mirror is whichever login happened last, and serving it because it was
+ * recent is exactly the calendar-says-skadooble surprise this file exists to
+ * end. Two projects means the answer is a QUESTION (or --project, or the
+ * repo binding), never recency.
+ */
+export function resolveStoredCredential(argv = process.argv, cwd = process.cwd()) {
+  const i = argv.indexOf('--project');
+  const projectArg = i >= 0 ? argv[i + 1] : undefined;
+  if (projectArg !== undefined) {
+    const m = matchStoredProject(projectArg);
+    return m.entry ? { entry: m.entry, source: 'project-flag' } : { error: m.error };
+  }
+  const entries = listStoredProjects();
+  if (entries.length === 0) return { none: true };
+  const repoRoot = detectRepoRoot(cwd);
+
+  if (repoRoot) {
+    const bound = entries.filter((e) => samePath(e.repoRoot, repoRoot));
+    if (bound.length === 1) return { entry: bound[0], source: 'repo', repoRoot };
+    if (bound.length > 1) return { choices: bound, reason: 'multiple-bound', repoRoot };
+  }
+
+  // ONE stored project with no binding: the pre-0.55.0 world. Serve it — a
+  // headless restart must not hang — but flag it, so a TTY start asks ONCE and
+  // binds, which is what turns "it said skadooble in my calendar repo" into a
+  // question instead of a surprise.
+  if (entries.length === 1 && !entries[0].repoRoot) {
+    return { entry: entries[0], source: 'only', needsConfirm: Boolean(repoRoot), repoRoot };
+  }
+
+  return { choices: entries, reason: repoRoot ? 'no-match' : 'outside-repo', repoRoot };
+}

package/bin/lib/deploy.mjs

@@ -13,7 +13,7 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { join } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { deployCreds, appSecretsFor, scrub, myPubB64 } from './env.mjs';
 
@@ -167,7 +167,15 @@ export function processDeployJobs(jobs, ctx) {
     void (async () => {
       let beat = null;
       try {
-        const claimed = await post('deploy-claim', { jobId: job.id, pubkey: ctx.myPubB64() }).catch(() => null);
+        // `instance` names THIS PROCESS. The pubkey cannot: it is the env
+        // keypair read from one file per home directory, so two daemons on one
+        // box share it and a pubkey-only read-back let both "win" the claim
+        // and run the same deploy twice concurrently.
+        const claimed = await post('deploy-claim', {
+          jobId: job.id,
+          pubkey: ctx.myPubB64(),
+          instance: DAEMON_INSTANCE,
+        }).catch(() => null);
         if (!claimed?.claimed) return; // another daemon won the claim
         // Keep the claim fresh while we run — a long deploy must never be
         // re-queued out from under us (that would double-deploy). The async

package/bin/lib/env-cli.mjs

@@ -105,7 +105,11 @@ async function readSecretFromStdin(promptText) {
 }
 
 export async function runEnvCommand(args) {
-  if (!FLEET_TOKEN) die('no fleet credential — run `flowviant login` first.');
+  if (!FLEET_TOKEN)
+    die(
+      'no credential resolves here — run `flowviant login`, or run this inside the ' +
+        "project's own repo / pass `--project <name|id>` (`flowviant projects` lists them)."
+    );
   await sodium.ready;
   await ensureKeypair();
   const cmd = args[0];

package/bin/lib/fleet.mjs

@@ -31,7 +31,9 @@ import {
   REFRESH_BEFORE_SECONDS,
   LIVE,
   AUTO_UPDATE,
+  CREDENTIAL,
 } from './config.mjs';
+import { projectLabel, setStoredProjectName } from './credentials.mjs';
 import { handleVersionSignal } from './update.mjs';
 import {
   git,
@@ -322,6 +324,14 @@ export async function runFleetDaemon() {
   const repoRoot = repoRootOrDie();
   const baseRef = detectBaseRef(repoRoot);
   info(SAFE ? 'mode   · safe (restricted toolset)' : 'mode   · unattended (skips permission prompts)');
+  // WHICH PROJECT, before anything connects — the roster names it again a few
+  // seconds later with the server's word, but "which project is this daemon
+  // about to serve" must not require a network round trip to answer. Only when
+  // the credential came from the STORE: a --fleet/env token names no project
+  // until the roster does.
+  if (CREDENTIAL?.entry) {
+    info(`serves · ${projectLabel(CREDENTIAL.entry)} ${c.dim(`(${CREDENTIAL.entry.projectId.slice(0, 8)}…)`)}`);
+  }
   info(`repo   · ${repoRoot}`);
   info(`base   · ${baseRef}`);
   info(`server · ${FLEET_URL}`);
@@ -782,7 +792,7 @@ export async function runFleetDaemon() {
             // Direct enqueue = immediacy; the server's durable regroundJobs list
             // (created by merge-done above, cleared by our reground-done report)
             // is the restart-safe backstop — dedup'd here by groundedIntents.
-            enqueueReground(job.id, job.prUrl, job.title, job.dirtiesPages);
+            enqueueReground(job.id, job.prUrl, job.title, job.dirtiesPages, job.shas);
           } else if (failedReason) {
             // Report into the thread (server narrates + re-arms the merge
             // button + notifies) — the job disappears from the roster.
@@ -926,7 +936,7 @@ export async function runFleetDaemon() {
     wikiQueue.push({ type: 'sweep' });
     void drainWiki();
   };
-  const enqueueReground = (intentId, prUrl, title, dirtiesPages) => {
+  const enqueueReground = (intentId, prUrl, title, dirtiesPages, shas) => {
     if (!intentId || groundedIntents.has(intentId)) return;
     groundedIntents.add(intentId);
     wikiQueue.push({
@@ -939,6 +949,13 @@ export async function runFleetDaemon() {
       // frontmatter file list has drifted, or that document a concept rather
       // than a directory.
       dirtiesPages: Array.isArray(dirtiesPages) ? dirtiesPages : [],
+      // THE COMMITS THAT SHIPPED — what changedFilesForShas resolves against.
+      // Dropping this here was the whole 0.54.0/0.54.1 defect: the server sent
+      // shas on every reground job, this function never stored them, and the
+      // drain's `task.shas` was undefined on every job — so the re-ground
+      // "revived" on 2026-08-22 retried three times against nothing and gave
+      // up, on a console nobody reads, on every single ship.
+      shas: Array.isArray(shas) ? shas : [],
     });
     void drainWiki();
   };
@@ -1185,6 +1202,13 @@ export async function runFleetDaemon() {
             // crash BEFORE this line leaves the job listed for a retry.
             regroundAttempts.delete(task.intentId);
             await reportMergeOutcome(REGROUND_DONE_URL, { taskId: task.intentId });
+            // The dedup was DAEMON-LIFETIME, which wedged a reopened card: its
+            // second ship writes a fresh durable job, this Set still holds the
+            // taskId, enqueueReground refuses it on every poll forever, and
+            // the never-consumed job churns the wiki-writer lease until a
+            // restart. The job is consumed now, so the guard has done its work;
+            // a FUTURE ship of the same card is new work, not a duplicate.
+            groundedIntents.delete(task.intentId);
           }
         } catch (e) {
           warn(`wiki ${task.type} failed: ${e.message}`);
@@ -1269,7 +1293,13 @@ export async function runFleetDaemon() {
       if (e.auth) {
         fail(`${e.message} — credential revoked or invalid. Shutting down.`);
         teardown();
-        process.exit(1);
+        // EXIT 0, for the same reason the commanded-stop path does: a revoked
+        // credential is a terminal, asked-for-by-someone state, and a relaunch
+        // can never fix it. Under `Restart=on-failure` a nonzero code has
+        // systemd relaunch the daemon immediately — a restart loop hammering
+        // dead-credential polls, fighting the Disconnect that revoked it, and
+        // ending in a unit that reads as a crash rather than a kill.
+        process.exit(0);
       }
       warn(`roster poll failed: ${e.message} — retrying in ${RECONCILE_SECONDS}s`);
       await sleep(RECONCILE_SECONDS);
@@ -1285,6 +1315,11 @@ export async function runFleetDaemon() {
           `${c.cyan('project')} · ${c.bold(roster.project.name)} ${c.dim(`(${roster.project.id})`)}`
         );
         note(c.dim('  wiki + agents stream to THIS project — view its Code canvas in Flowviant.'));
+        // Remember the NAME beside the stored credential, so the picker and
+        // `flowviant projects` can say "skadooble" instead of an id — a
+        // credential saved before the server sent names backfills here. No-op
+        // for a --fleet/env token (nothing stored to annotate).
+        setStoredProjectName(roster.project.id, roster.project.name);
       }
     }
     if (roster.mcpUrl) mcpUrl = roster.mcpUrl;
@@ -1304,6 +1339,17 @@ export async function runFleetDaemon() {
           : 'stopped by Flowviant — no reason given.'
       );
       note('shutting down — stopping workers. Worktrees are kept: in-flight work resumes next run.');
+      // FLUSH the settle queue first, bounded: a queued-but-undelivered report
+      // is a COMPLETED turn whose side effects already happened, and dropping
+      // it re-runs the whole turn on the next start — quota spent twice and
+      // every card write doubled. This path is async (unlike the signal
+      // handlers, which cannot await), so the stop can afford five seconds of
+      // delivery before it obeys.
+      try {
+        await Promise.race([flushWorkReports(), sleep(5)]);
+      } catch {
+        /* undelivered reports re-run; delivering them was best-effort */
+      }
       // teardown() is NOT optional on this path. Detached preview tunnels
       // survive this process BY DESIGN, so exiting without it strands a public
       // hostname pointed into a worktree until somebody reboots the box — which
@@ -1421,7 +1467,7 @@ export async function runFleetDaemon() {
     for (const j of roster.regroundJobs ?? []) {
       const rid = j && (j.taskId ?? j.intentId); // new name first, old as fallback
       if (!j || typeof rid !== 'string') continue; // a null element would throw + wedge the loop
-      enqueueReground(rid, j.prUrl, j.title, j.dirtiesPages);
+      enqueueReground(rid, j.prUrl, j.title, j.dirtiesPages, j.shas);
     }
     void drainWiki();
 

package/bin/lib/instance.mjs

@@ -413,15 +413,16 @@ function stillTheHolder(holder) {
   // `process.argv[1] || ''` — and matching on '' would match every process
   // alive, so it takes the same road as a missing one.
   if (!want) return startedAroundLockWrite(holder);
+  let cmdline;
   try {
-    if (platform() === 'linux') {
-      return readFileSync(`/proc/${holder.pid}/cmdline`, 'utf8').replace(/\0/g, ' ').includes(want);
-    }
-    return execFileSync('ps', ['-o', 'command=', '-p', String(holder.pid)], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 3000,
-    }).includes(want);
+    cmdline =
+      platform() === 'linux'
+        ? readFileSync(`/proc/${holder.pid}/cmdline`, 'utf8').replace(/\0/g, ' ')
+        : execFileSync('ps', ['-o', 'command=', '-p', String(holder.pid)], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 3000,
+          });
   } catch {
     // NOT `false`. takeOverFrom already returned early if the pid were gone, so
     // reaching here means the process is alive and we could not READ it —
@@ -429,6 +430,45 @@ function stillTheHolder(holder) {
     // here is what made the refusal claim the pid belonged to somebody else.
     return null;
   }
+  if (!cmdline.includes(want)) return false;
+  // AN ENTRY MATCH ALONE IS NOT IDENTITY. Every daemon on the box shares one
+  // entry path under a global install, so "cmdline contains this cli.mjs"
+  // proves "is SOME flowviant daemon", not "is the daemon that wrote THIS
+  // lock" — and a crashed daemon's pid recycled to a SIBLING project's live
+  // daemon passed it, which let a same-repo takeover SIGTERM a different
+  // project's machine. Every 0.54.0+ lock also carries `startedAt`, the
+  // process's own witness to when it began, so when it is present the start
+  // time must agree too. `null` (could not measure — hidepid, no ps, a lock
+  // with no startedAt) falls back to the entry match alone, exactly the
+  // pre-check behaviour: refusing on ignorance here would re-brick takeover
+  // on the hosts that hide /proc.
+  const around = startedAroundLockWrite(holder);
+  return around === false ? false : true;
+}
+
+/**
+ * Unlink a lock file ONLY while it still names the pid the caller decided
+ * about (or nothing readable). Every rmSync of a lock outside the ppid-adopt
+ * path goes through this: between "I proved pid N is dead/stale" and the
+ * unlink, a concurrently starting daemon can clear the file itself and
+ * wx-create its own — and an unconditional rm then deletes a LIVE daemon's
+ * lock, leaving it running unguarded, which is the one condition this module
+ * exists to prevent. The read-then-rm gap that remains is microseconds against
+ * the seconds-wide window it closes.
+ *
+ * Returns false when the file now names a DIFFERENT pid — a handover the
+ * caller must treat as "not mine to clear" — true otherwise (removed, already
+ * gone, or best-effort failed into acquire's next pass).
+ */
+function rmLockIfStill(path, pid) {
+  const cur = readHolder(path);
+  if (cur && cur.pid !== pid) return false;
+  try {
+    rmSync(path, { force: true });
+  } catch {
+    /* best-effort; a stale file is cleared by the next acquire */
+  }
+  return true;
 }
 
 /** Blocking, because this runs before there is an event loop worth yielding to
@@ -530,11 +570,11 @@ function standDown(holder, path, log) {
     sleep(400);
   }
 
-  // A SIGKILLed daemon never ran its release(), so clear what it left.
-  try {
-    rmSync(path, { force: true });
-  } catch {
-    return { failed: 'could not clear the lock file' };
+  // A SIGKILLed daemon never ran its release(), so clear what it left — but
+  // only if the file still names the pid we stood down: in the gap since the
+  // last read a fresh daemon may have cleared it and taken the lock itself.
+  if (!rmLockIfStill(path, holder.pid)) {
+    return { failed: 'another daemon took the lock while it was being cleared — try again in a moment' };
   }
   return null;
 }
@@ -564,7 +604,13 @@ function takeOverFrom(holder, path, log, { allowDowngrade = false } = {}) {
     };
   }
   if (identified === false) {
-    return { failed: `pid ${holder.pid} is no longer the daemon that took this lock — refusing to signal it` };
+    // MEASURED: the lock's writer is gone and the pid now belongs to something
+    // else. That is a STALE LOCK, not an unremovable holder — refusing here
+    // used to brick every start after an OOM-kill or reboot recycled the pid
+    // to any live process, until a human deleted ~/.flowviant/daemon-*.lock by
+    // hand. Nothing is signalled (the process is a stranger); the caller
+    // clears the corpse the same way it clears a dead pid's.
+    return { stale: true };
   }
   if (!allowDowngrade && holder.version && cmpVersion(VERSION, holder.version) < 0) {
     return {
@@ -608,9 +654,19 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
     // quietly.
     if (noTakeover) return { ok: false, holder: neighbour, sameRepo: true };
     log?.(`another project's daemon is serving this repo (pid ${neighbour.pid}).`);
-    const bad = takeOverFrom(neighbour, neighbourLockPath(neighbour, path), log);
-    if (bad)
+    // The OPTIONS ride along — this call used to drop them, so a deliberate
+    // `flowviant --takeover-downgrade` against a newer neighbour printed
+    // "--takeover-downgrade if you mean it" at somebody who had already
+    // typed it.
+    const bad = takeOverFrom(neighbour, neighbourLockPath(neighbour, path), log, { allowDowngrade });
+    if (bad?.stale) {
+      // The neighbour's lock is a corpse wearing a recycled pid — clear it (if
+      // it still names that pid) and carry on to our own lock.
+      log?.(`pid ${neighbour.pid} is no longer a daemon — clearing its stale lock.`);
+      rmLockIfStill(neighbourLockPath(neighbour, path), neighbour.pid);
+    } else if (bad) {
       return { ok: false, holder: neighbour, sameRepo: true, takeoverFailed: bad.failed, unidentified: bad.unidentified };
+    }
   }
 
   // Two passes at most: one to clear a stale holder, one to take the lock. A
@@ -623,11 +679,20 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       if (e.code !== 'EEXIST') return { ok: true, release: () => {}, unguarded: true };
       const holder = readHolder(path);
       if (!holder || !alive(holder.pid)) {
-        // A crashed daemon's leftover. Clear it and take it on the next pass.
-        try {
-          rmSync(path, { force: true });
-        } catch {
-          return { ok: true, release: () => {}, unguarded: true };
+        // A crashed daemon's leftover. Clear it and take it on the next pass —
+        // ownership-verified, because a concurrent start may have cleared and
+        // re-created it in the gap since our read.
+        if (holder) rmLockIfStill(path, holder.pid);
+        else {
+          // Unreadable content: re-read before clearing, so a half-written
+          // record a peer is writing RIGHT NOW is not deleted mid-write.
+          const again = readHolder(path);
+          if (again && alive(again.pid)) continue; // it finished writing — a real holder now
+          try {
+            rmSync(path, { force: true });
+          } catch {
+            return { ok: true, release: () => {}, unguarded: true };
+          }
         }
         continue;
       }
@@ -653,10 +718,28 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       const wanted = force || (here && !noTakeover);
       if (wanted) {
         const bad = takeOverFrom(holder, path, log, { allowDowngrade });
+        if (bad?.stale) {
+          // Measured: the lock's writer is gone and its pid was recycled to a
+          // stranger. A corpse is cleared, never "refused" — refusing bricked
+          // every start after a reboot handed the pid to any live process.
+          log?.(`pid ${holder.pid} is no longer a daemon — clearing its stale lock.`);
+          rmLockIfStill(path, holder.pid);
+          continue;
+        }
         if (bad)
           return { ok: false, holder, takeoverFailed: bad.failed, sameRepo: here, unidentified: bad.unidentified };
         continue; // the file is gone — the next pass takes it
       }
+      // Before refusing on a different-repo holder, make sure it IS one: a
+      // stale lock whose pid was recycled to any live process would otherwise
+      // refuse this credential's start forever, naming a "daemon" that is a
+      // stranger. Only the MEASURED verdict clears; null (could not look)
+      // still refuses, because ignorance must not delete a lock.
+      if (stillTheHolder(holder) === false) {
+        log?.(`pid ${holder.pid} is no longer a daemon — clearing its stale lock.`);
+        rmLockIfStill(path, holder.pid);
+        continue;
+      }
       return { ok: false, holder, sameRepo: here };
     }
     try {

package/bin/lib/login.mjs

@@ -6,33 +6,15 @@
  * plain `flowviant` just runs — no token, no env var.
  */
 
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
+import { saveLogin, detectRepoRoot, projectLabel } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
-const CRED_DIR = join(homedir(), '.flowviant');
-const CRED_FILE = join(CRED_DIR, 'credentials.json');
 const DEVICE_START = FLEET_URL.replace(/\/agents\/?$/, '/device/start');
 const DEVICE_POLL = FLEET_URL.replace(/\/agents\/?$/, '/device/poll');
 const APP_URL = process.env.FLOWVIANT_APP_URL || 'https://app.flowviant.com';
 
-/** The locally-stored credential from a prior `login`, or null. Read by config. */
-export function readStoredCredential() {
-  try {
-    return JSON.parse(readFileSync(CRED_FILE, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function store(cred) {
-  mkdirSync(CRED_DIR, { recursive: true });
-  writeFileSync(CRED_FILE, JSON.stringify(cred, null, 2), { mode: 0o600 });
-}
-
 async function post(url, body) {
   const res = await fetch(url, {
     method: 'POST',
@@ -74,8 +56,28 @@ export async function runLogin({ thenStart = false } = {}) {
       continue; // transient — keep polling
     }
     if (poll.status === 'approved') {
-      store({ fleetToken: poll.fleetToken, projectId: poll.projectId, mcpUrl: poll.mcpUrl });
-      ok('connected — credential saved to ~/.flowviant/credentials.json');
+      // `machineToken` is the wire's new name; `fleetToken` is the one every
+      // published daemon reads. The server dual-sends until DAEMON_MIN clears
+      // the release that reads the new one (0.54.2+) — reading both here is
+      // what makes retiring the old key possible at all.
+      //
+      // BOUND to the repo the login was run in: a login is the one moment we
+      // know for certain which checkout this project means, and the binding is
+      // what lets a multi-project VM resolve `npx flowviant` by DIRECTORY
+      // instead of by whichever login happened last.
+      const repoRoot = detectRepoRoot();
+      const entry = {
+        fleetToken: poll.machineToken ?? poll.fleetToken,
+        projectId: poll.projectId,
+        mcpUrl: poll.mcpUrl,
+        name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
+        repoRoot,
+      };
+      saveLogin(entry);
+      ok(
+        `connected to ${c.bold(projectLabel(entry))}` +
+          `${repoRoot ? ` for ${c.dim(repoRoot)}` : ''} — saved to ~/.flowviant/credentials.json`
+      );
       // The daemon starts right here unless the caller opted out; telling
       // someone to run a second command was the step that got missed, since by
       // this point they are looking at the browser, not this terminal.

package/bin/lib/mcp-cli.mjs

@@ -23,8 +23,9 @@ const CLI_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/cli-token');
 export async function runMcpCommand(args = []) {
   if (!FLEET_TOKEN) {
     console.error(
-      'error: no credential. Run `flowviant login` first — this needs the\n' +
-        'fleet credential the daemon uses, so it knows which project to connect.'
+      'error: no credential resolves here. Run `flowviant login` first — or, with\n' +
+        'several projects connected on this box, run this inside the project\'s own\n' +
+        'repo or pass `--project <name|id>` (`flowviant projects` lists them).'
     );
     process.exit(1);
   }

package/bin/lib/preview.mjs

@@ -228,9 +228,25 @@ function mutateRegistry(fn) {
   }
 }
 
+/** Signal-0 liveness (EPERM = alive and not ours), for the OWNER check below. */
+function processAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === 'EPERM';
+  }
+}
+
 function recordPreviewPid(pid, sig) {
   if (!pid) return;
-  mutateRegistry((list) => [...list, { pid, sig }]);
+  // `owner` is the DAEMON that spawned it. The registry is shared by design —
+  // two daemons serving two projects both write here — so without an owner a
+  // starting daemon reaped its PEER's live tunnels: killed them, wiped their
+  // entries, and the peer kept heartbeating a URL that 530s (its probe watches
+  // the origin port, which was still alive).
+  mutateRegistry((list) => [...list, { pid, sig, owner: process.pid }]);
 }
 
 function forgetPreviewPid(pid) {
@@ -253,12 +269,21 @@ function stillOurs(pid, sig) {
 }
 
 /** Reap tunnel process groups left behind by a previously-crashed daemon.
- *  Call once at daemon startup, before any work begins. */
+ *  Call once at daemon startup, before any work begins.
+ *
+ *  ORPHANS ONLY: an entry whose owning daemon is STILL ALIVE belongs to a
+ *  peer serving another project (or to the process we are replacing, whose
+ *  own teardown handles it) — killing those and wiping their entries was a
+ *  peer daemon's startup silently breaking every live share on the box. Only
+ *  the entries this pass handled are removed; a peer's records survive. */
 export function reapOrphanPreviews(log) {
   const list = readRegistry();
   if (list.length === 0) return;
   let killed = 0;
-  for (const { pid, sig } of list) {
+  const handled = new Set();
+  for (const { pid, sig, owner } of list) {
+    if (Number.isInteger(owner) && owner !== process.pid && processAlive(owner)) continue;
+    handled.add(pid);
     if (!stillOurs(pid, sig)) continue;
     try {
       process.kill(-pid, 'SIGKILL'); // whole group
@@ -272,7 +297,7 @@ export function reapOrphanPreviews(log) {
       }
     }
   }
-  mutateRegistry(() => []);
+  if (handled.size) mutateRegistry((cur) => cur.filter((e) => !handled.has(e.pid)));
   if (killed) log?.(`reaped ${killed} orphaned preview tunnel${killed === 1 ? '' : 's'} from a previous run.`);
 }
 
@@ -295,8 +320,35 @@ const TAIL_BYTES = 2000;
  * cloudflared happily outlives a dead dev server and the gate answers a dead
  * origin with 502, so without this the product would report "live" over a 502 —
  * Flowviant asserting a state it never measured.
+ *
+ * `stillServing` (optional, async → boolean) is the ATTRIBUTION re-check the
+ * probe runs instead of a bare TCP connect. Ports are global to a box and a
+ * worktree is not: when the driver's dev server dies and anything else — a
+ * teammate's worktree, a database — binds the same number, a bare
+ * `isListening` keeps the probe green and the existing URL+password serve the
+ * NEW process, outside every consent gate. The caller passes the same
+ * `listenersIn(worktree)` check the open path uses, so "the origin is alive"
+ * keeps meaning "THIS session's origin".
+ *
+ * `onAbuse` fires when the gate closes itself after repeated failed password
+ * attempts — AFTER the share is torn down locally — so the caller can report
+ * the incident. Without it the abuse close was invisible: the row kept
+ * reading "live" until staleness, and endedReason 'abuse' was unreachable.
+ *
+ * `onTunnelGone` fires when cloudflared exits AFTER the URL was published
+ * (quick tunnels are best-effort and do get dropped). The probe cannot see
+ * this — it watches the origin — and a daemon that keeps heartbeating a dead
+ * hostname confirms "live" over a 530 for up to 8 hours.
  */
-export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
+export async function openTunnel({
+  port,
+  log,
+  onDead,
+  onAbuse,
+  onTunnelGone,
+  stillServing,
+  probeMs = 20_000,
+}) {
   // Re-validate at the machine. The server checked this port against the last
   // report; reports are up to a minute old and a dev server is a process a
   // human can stop at any moment.
@@ -337,7 +389,18 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
 
   // The gate comes up FIRST and the tunnel points at it, never at the origin —
   // so there is no window in which the public hostname is un-gated.
-  gate = await startAuthProxy({ targetPort: port, log, onAbuse: () => stop() });
+  gate = await startAuthProxy({
+    targetPort: port,
+    log,
+    onAbuse: () => {
+      stop();
+      try {
+        onAbuse?.();
+      } catch {
+        /* the caller's report is best-effort */
+      }
+    },
+  });
   if (!gate) {
     return { error: 'could not start the password gate for this preview, so nothing was published.' };
   }
@@ -348,7 +411,11 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
   args.push('--http-host-header', 'localhost');
 
   tunnel = spawn(cf.bin, args, { detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
-  recordPreviewPid(tunnel.pid, 'cloudflared');
+  // The signature names THIS tunnel's gate port, not the bare word
+  // 'cloudflared': the reap matches cmdline.includes(sig), and the generic
+  // word would let a recycled pid land on an operator's own unrelated
+  // cloudflared and group-SIGKILL it.
+  recordPreviewPid(tunnel.pid, `--url http://localhost:${gate.port}`);
 
   return new Promise((resolve) => {
     let settled = false;
@@ -378,11 +445,19 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
       const m = TUNNEL_RE.exec(s);
       if (!m) return;
 
-      // Watch the ORIGIN, not the tunnel. A dead dev server behind a live
-      // hostname is the failure a viewer cannot diagnose.
+      // Watch the ORIGIN — with the caller's ATTRIBUTION check when it gave
+      // one, never a bare port probe: a freed port rebound by another
+      // worktree answers a TCP connect exactly like the origin did, and the
+      // share would keep serving a process nobody consented to publish.
       probe = setInterval(async () => {
         if (stopped) return;
-        if (!(await isListening(port))) {
+        let serving;
+        try {
+          serving = stillServing ? await stillServing() : await isListening(port);
+        } catch {
+          serving = false; // an attribution check that errors is not a "yes"
+        }
+        if (!serving) {
           const dead = onDead;
           stop();
           try {
@@ -394,6 +469,20 @@ export async function openTunnel({ port, log, onDead, probeMs = 20_000 }) {
       }, probeMs);
       if (probe.unref) probe.unref();
 
+      // The TUNNEL dying after publish (quick tunnels get dropped) is the one
+      // exit the probe cannot see. `stopped` guards our own kill: stop() sets
+      // it before signalling, so this only fires for a death nobody asked for.
+      tunnel.once('close', () => {
+        if (stopped) return;
+        const gone = onTunnelGone;
+        stop();
+        try {
+          gone?.();
+        } catch {
+          /* the caller's report is best-effort */
+        }
+      });
+
       finish({ url: m[0], user: gate.user, password: gate.password, stop });
     };
 

package/bin/lib/work.mjs

@@ -492,7 +492,15 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
         /* best-effort */
       }
     }
-    await postPreview({ sessionId, ended: true, endedReason: reason });
+    // Confirm only a teardown we actually PERFORMED. The stop job is a
+    // broadcast — every daemon on the credential gets it — and the one holding
+    // nothing used to answer instantly, flipping the row to 'ended' so the
+    // real holder was never told to stop and its tunnel outlived every
+    // surface. (The server drops mismatched confirms too; this is the copy on
+    // the component that can be published ahead of a deploy.) A stop for a
+    // tunnel whose daemon crashed resolves server-side: an unanswered 'ending'
+    // row reads as over once it goes stale.
+    if (live) await postPreview({ sessionId, ended: true, endedReason: reason });
   };
 
   const processPreviewJobs = (jobs) => {
@@ -552,6 +560,27 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               livePreviews.delete(sessionId);
               void postPreview({ sessionId, ended: true, endedReason: 'origin_gone' });
             },
+            // ATTRIBUTION rides the probe, not just the open: a freed default
+            // port (5173…) rebound by any other process on the box would keep
+            // a bare TCP probe green, and the share's URL+password would serve
+            // a worktree nobody consented to publish.
+            stillServing: async () => listenersIn(wt).some((l) => l.port === port),
+            // The gate closed itself after repeated failed passwords. Stored,
+            // so the incident is visible — and the entry is dropped so the
+            // owner can re-share the port without restarting the daemon.
+            onAbuse: () => {
+              livePreviews.delete(sessionId);
+              void postPreview({ sessionId, ended: true, endedReason: 'abuse' });
+            },
+            // cloudflared died AFTER publishing (quick tunnels get dropped).
+            // Without this the daemon kept heartbeating a hostname that 530s.
+            onTunnelGone: () => {
+              livePreviews.delete(sessionId);
+              void postPreview({
+                sessionId,
+                error: 'the tunnel dropped — share it again to reopen.',
+              });
+            },
           });
           if (t.error) {
             await postPreview({ sessionId, error: t.error });
@@ -1195,6 +1224,13 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     // worktree would pull the directory out from under a running turn. Absence
     // means "the tab closed"; this is the one other thing it can mean.
     const peers = new Set(Array.isArray(heldElsewhere) ? heldElsewhere : []);
+    // A peer-held session's CACHED work token is a claim-bypass: the mint is
+    // the one place the session lease 409s a non-holder, and a token younger
+    // than ~23h skips the mint entirely — so a daemon that lost a lease would
+    // run the next turn anyway, editing the worktree while every MCP call
+    // 401s (the peer's mint rotated the secret). Dropping the cache forces
+    // the next turn through the mint, where the 409 stands it down.
+    for (const id of peers) workTokens.delete(id);
     const dir = join(baseDir, 'sessions');
     if (!existsSync(dir)) return;
     let ids;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.54.1",
-  "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
+  "version": "0.55.0",
+  "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"