flowviant 0.54.2 → 0.55.1

package/bin/cli.mjs

@@ -32,6 +32,13 @@
  * odd side job the roster carries — a commit's patch, a preview share, a wiki
  * regen. When you say ship, the daemon merges that branch into base `--no-ff`.
  *
+ * MANY PROJECTS, ONE BOX (0.55.0): `flowviant login` in each repo stores one
+ * credential per project (~/.flowviant/credentials.json holds a map), and a
+ * bare `npx flowviant` serves the project BOUND to the repo it is started in.
+ * Ambiguity is a picker on a TTY and a worded refusal headless — never a
+ * guess. `flowviant projects` lists what is stored; `--project <name|id>`
+ * picks without a prompt.
+ *
  * Env:
  *   FLOWVIANT_FLEET     the machine credential (or use `flowviant login`).
  *   FLOWVIANT_API_URL   default https://api.flowviant.com/api/v2
@@ -49,7 +56,7 @@
  * git + worktreeDiff + patch; localSessions, listeners, preview + authproxy;
  * env + env-cli + vault, resources, deploy, shot.
  */
-import { FLEET_TOKEN } from './lib/config.mjs';
+import { FLEET_TOKEN, CREDENTIAL, adoptStoredCredential } from './lib/config.mjs';
 import { runFleetDaemon } from './lib/fleet.mjs';
 import { runLogin } from './lib/login.mjs';
 
@@ -172,6 +179,32 @@ if (process.argv[2] === 'stop') {
   process.exit(failed > 0 ? 1 : 0);
 }
 
+// `flowviant projects` — every project this box has a credential for, which
+// repo each is bound to, and which the legacy mirror points at. Needs no
+// network: it reads the store, which is the exact thing a confused person is
+// trying to see. The remedies are named because this listing IS the moment of
+// confusion ("why did it say skadooble?"), not documentation.
+if (process.argv[2] === 'projects') {
+  const { listStoredProjects, projectLabel } = await import('./lib/credentials.mjs');
+  const entries = listStoredProjects();
+  if (entries.length === 0) {
+    console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
+    process.exit(0);
+  }
+  for (const e of entries) {
+    console.log(
+      `  ${projectLabel(e)}  (${e.projectId.slice(0, 8)}…)` +
+        `${e.repoRoot ? `\n      repo · ${e.repoRoot}` : '\n      repo · not bound yet — first start or login in its repo binds it'}` +
+        `${e.active ? '\n      what a pre-0.55.0 flowviant on this box would serve (the legacy mirror)' : ''}`
+    );
+  }
+  console.log(
+    '\n  `npx flowviant` picks by the repo it is started in; `--project <name|id>` overrides;\n' +
+      '  `flowviant login` in a new repo connects another project.'
+  );
+  process.exit(0);
+}
+
 // `flowviant env <import|set|show>` — the CLI half of team env sync. Values
 // are sealed to the project pubkey ON THIS MACHINE (same write-only crypto as
 // the browser); `show` decrypts locally — it only works on an ENROLLED machine.
@@ -191,14 +224,122 @@ if (process.argv[2] === 'env') {
   process.exit(0);
 }
 
+// ── WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
+//
+// The store holds many projects since 0.55.0 and resolution is BY REPO
+// (credentials.mjs). What is left here is the human half: an ambiguous store
+// on a TTY becomes a PICKER, a single unbound credential gets ONE confirm that
+// binds it, and a headless start with no unambiguous answer refuses in words
+// that name every stored project and every way out. The one thing this block
+// must never do is serve a project the resolution did not name — "it said
+// skadooble in my calendar repo" is the confusion this exists to end.
+// A RESTART IS NOT A PERSON. `reexec` (update.mjs) inherits stdio, so an
+// auto-updated daemon's child sees two TTYs; without this it would stop on the
+// binding confirm below and the machine would stay dark until somebody typed a
+// key. Same reasoning as the headless case, and the same answer.
+const interactive =
+  Boolean(process.stdin.isTTY && process.stdout.isTTY) && process.env.FLOWVIANT_REEXEC !== '1';
+const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+
+/** Re-exec a plain `flowviant` after an inline login — the login command's own
+ *  pattern: config.mjs read the store at IMPORT time, before the credential
+ *  existed, so this process cannot serve; the child can. */
+async function reexecAfterLogin() {
+  await runLogin({ thenStart: false });
+  const { spawn } = await import('node:child_process');
+  const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
+  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
+}
+
+function listLines(entries, { projectLabel }) {
+  return entries
+    .map(
+      (e, i) =>
+        `  ${i + 1}. ${projectLabel(e)}` +
+        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet')
+    )
+    .join('\n');
+}
+
 if (!FLEET_TOKEN) {
-  console.error(
-    'error: no credential found. Easiest:\n' +
-      '  flowviant login      (approve in the app — recommended)\n' +
-      'Or set:\n' +
-      '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
-  );
-  process.exit(1);
+  if (CREDENTIAL.error) {
+    console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
+    process.exit(1);
+  }
+  if (CREDENTIAL.choices?.length && interactive) {
+    const creds = await import('./lib/credentials.mjs');
+    const { choices, repoRoot } = CREDENTIAL;
+    console.log(
+      CREDENTIAL.reason === 'outside-repo'
+        ? 'flowviant is not inside a git repo, and more than one project is connected here.'
+        : CREDENTIAL.reason === 'multiple-bound'
+          ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
+          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+    );
+    console.log(listLines(choices, creds));
+    console.log(`  ${choices.length + 1}. connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`);
+    const rl = (await import('node:readline/promises')).createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    const raw = (await rl.question(`Which project should this daemon serve? [1-${choices.length + 1}] `)).trim();
+    rl.close();
+    const n = Number.parseInt(raw, 10);
+    if (n === choices.length + 1) await reexecAfterLogin();
+    const picked = Number.isInteger(n) ? choices[n - 1] : undefined;
+    if (!picked) {
+      console.error('nothing chosen — nothing started.');
+      process.exit(1);
+    }
+    // An answered question is consent: adopt it, and BIND it to this repo so
+    // the next start needs no prompt. Repointing is legitimate and said aloud.
+    if (repoRoot && picked.repoRoot && picked.repoRoot !== repoRoot) {
+      console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
+    }
+    adoptStoredCredential(picked);
+    creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
+    console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
+  } else if (CREDENTIAL.choices?.length) {
+    const creds = await import('./lib/credentials.mjs');
+    console.error(
+      'error: more than one project is connected on this machine and this repo is not bound to any of them:\n' +
+        listLines(CREDENTIAL.choices, creds) +
+        '\nPick one with `--project <name|id>`, bind this repo by running `flowviant` here in a terminal once,\n' +
+        'or connect this repo to its own project with `flowviant login`.'
+    );
+    process.exit(1);
+  } else {
+    console.error(
+      'error: no credential found. Easiest:\n' +
+        '  flowviant login      (approve in the app — recommended)\n' +
+        'Or set:\n' +
+        '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
+    );
+    process.exit(1);
+  }
+} else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
+  // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
+  // yes binds and every later start is silent. This is the exact question
+  // whose absence had a calendar checkout serving skadooble.
+  const creds = await import('./lib/credentials.mjs');
+  const label = creds.projectLabel(CREDENTIAL.entry);
+  const rl = (await import('node:readline/promises')).createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  const raw = (
+    await rl.question(`This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `)
+  ).trim().toLowerCase();
+  rl.close();
+  if (raw === '' || raw === 'y' || raw === 'yes') {
+    creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
+  } else {
+    console.error(
+      `nothing started. Connect this repo to its own project with \`flowviant login\`, ` +
+        `or see what is stored with \`flowviant projects\`.`
+    );
+    process.exit(1);
+  }
 }
 
 await runFleetDaemon();

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir, cpus, totalmem } from 'node:os';
+import { cpus, totalmem } from 'node:os';
 
 // Read the daemon's version from its OWN package.json (always shipped in the npm
 // tarball) — never hardcode it. The hardcoded constant drifted: it sat at
@@ -30,14 +30,11 @@ export const MODEL = process.env.FLOWVIANT_MODEL || 'opus';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.
-function readStoredCredential() {
-  try {
-    return JSON.parse(readFileSync(join(homedir(), '.flowviant', 'credentials.json'), 'utf8'));
-  } catch {
-    return null;
-  }
-}
-const stored = readStoredCredential();
+// Since 0.55.0 the store holds MANY projects and resolution is BY REPO — see
+// credentials.mjs for the whole rule. `CREDENTIAL` carries the resolution so
+// cli.mjs can turn an ambiguity into a picker instead of a guess.
+import { resolveStoredCredential } from './credentials.mjs';
+export const CREDENTIAL = resolveStoredCredential();
 
 function argFlag(name) {
   const i = process.argv.indexOf(name);
@@ -167,5 +164,15 @@ export const DAEMON_INSTANCE = randomBytes(12).toString('hex');
 // --tokens) stood beside it and carried WORKER tokens into the pre-daemon loop;
 // that principal owns zero tools since dispatch was deleted, and the kind can no
 // longer be minted, so the plumbing went with the entrypoint (2026-08-19).
-export const FLEET_TOKEN =
-  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || stored?.fleetToken || '';
+// `let`, because ES named imports are LIVE bindings: when cli.mjs answers an
+// ambiguous store with a picker, adoptStoredCredential updates every importer
+// before the daemon touches the network. Everything before that point (the
+// resolution, the flags) is settled synchronously at import, as it always was.
+export let FLEET_TOKEN =
+  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || CREDENTIAL.entry?.fleetToken || '';
+
+/** cli.mjs's picker chose. Must run BEFORE runFleetDaemon — nothing here
+ *  re-authenticates a connection already made. */
+export function adoptStoredCredential(entry) {
+  if (entry?.fleetToken) FLEET_TOKEN = entry.fleetToken;
+}

package/bin/lib/credentials.mjs

@@ -0,0 +1,258 @@
+/**
+ * THE CREDENTIAL STORE — one file, MANY projects (v2, 2026-08-23).
+ *
+ * ~/.flowviant/credentials.json used to hold exactly one credential, and
+ * `flowviant login` overwrote it — so `npx flowviant` in ANY directory served
+ * whatever project was logged into last. A user standing in their calendar
+ * repo watched the banner say another project's name, and the only thing that
+ * saved them from serving the wrong repo was the instance lock's same-repo
+ * refusal. One VM is allowed to run one daemon per project (the lock is keyed
+ * per credential and the header of instance.mjs says so out loud); the store
+ * was the only thing pretending otherwise.
+ *
+ * THE FILE SHAPE, and why it is two shapes at once:
+ *
+ *   {
+ *     fleetToken, projectId, mcpUrl,          // the LEGACY MIRROR
+ *     projects: {                             // v2: every connected project
+ *       [projectId]: { fleetToken, mcpUrl, name, repoRoot, savedAt }
+ *     }
+ *   }
+ *
+ * The top-level trio is what every daemon before 0.55.0 reads, and the CLI is
+ * the one component a deploy cannot upgrade — so it stays, always mirroring
+ * the ACTIVE (most recently logged-in or explicitly picked) project. An old
+ * version keeps working with that project; a new one resolves by REPO.
+ *
+ * WHICH CREDENTIAL A START USES — resolution, in order:
+ *   --fleet / FLOWVIANT_FLEET     the operator said, verbatim (config.mjs).
+ *   --project <name|id>           an entry, named without a prompt.
+ *   the entry BOUND to this repo  repoRoot recorded at login/confirm, compared
+ *                                 by realpath — the no-ambiguity path.
+ *   one unbound entry             served, with a one-time TTY confirm that
+ *                                 binds it (headless keeps the old behaviour —
+ *                                 a systemd restart must not hang on a prompt).
+ *   anything else                 a CHOICE, never a guess: the CLI lists every
+ *                                 stored project and asks (cli.mjs), or — with
+ *                                 no TTY — refuses in words that name them all.
+ *
+ * The repoRoot binding is a SAFETY line, not bookkeeping: serving project X
+ * from a repo that is not X's checkout materializes X's session worktrees and
+ * decrypted env inside the wrong repository. Binding happens only at moments a
+ * HUMAN was present (login, an answered confirm, an explicit pick) — never
+ * silently on a headless start, where cementing the wrong repo would make the
+ * mistake permanent.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const CRED_DIR = join(homedir(), '.flowviant');
+const CRED_FILE = join(CRED_DIR, 'credentials.json');
+
+function readFile() {
+  try {
+    const v = JSON.parse(readFileSync(CRED_FILE, 'utf8'));
+    return v && typeof v === 'object' ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Atomic write (tmp + rename), 0600 — this file is credentials. */
+function writeFile(v) {
+  mkdirSync(CRED_DIR, { recursive: true });
+  const tmp = `${CRED_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(v, null, 2), { mode: 0o600 });
+  renameSync(tmp, CRED_FILE);
+}
+
+/** The repo root of `cwd`, realpath'd, or null when not inside a git repo. */
+export function detectRepoRoot(cwd = process.cwd()) {
+  try {
+    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5000,
+    }).trim();
+    return root ? realpathSync(root) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Same directory whatever it is spelled as — the instance.mjs rule. */
+function samePath(a, b) {
+  if (!a || !b) return false;
+  const norm = (v) => {
+    try {
+      return realpathSync(v);
+    } catch {
+      return String(v).replace(/\/+$/, '');
+    }
+  };
+  return norm(a) === norm(b);
+}
+
+/**
+ * Every stored project, NORMALIZED: the v2 map, plus the legacy trio surfaced
+ * as an entry when no map row carries its token (a pre-0.55.0 file is one
+ * project with no name and no binding — real, and listed as such). `active`
+ * marks the entry the legacy mirror points at.
+ */
+export function listStoredProjects() {
+  const f = readFile();
+  if (!f) return [];
+  const out = new Map();
+  for (const [projectId, e] of Object.entries(f.projects ?? {})) {
+    if (!e || typeof e.fleetToken !== 'string' || !e.fleetToken) continue;
+    out.set(projectId, {
+      projectId,
+      fleetToken: e.fleetToken,
+      mcpUrl: e.mcpUrl ?? null,
+      name: typeof e.name === 'string' && e.name ? e.name : null,
+      repoRoot: typeof e.repoRoot === 'string' && e.repoRoot ? e.repoRoot : null,
+      savedAt: e.savedAt ?? null,
+    });
+  }
+  if (typeof f.fleetToken === 'string' && f.fleetToken && typeof f.projectId === 'string' && f.projectId && !out.has(f.projectId)) {
+    out.set(f.projectId, {
+      projectId: f.projectId,
+      fleetToken: f.fleetToken,
+      mcpUrl: f.mcpUrl ?? null,
+      name: null,
+      repoRoot: null,
+      savedAt: null,
+    });
+  }
+  return [...out.values()].map((e) => ({ ...e, active: e.projectId === f.projectId }));
+}
+
+/** What a project is CALLED on a terminal: its name, or an id you can grep. */
+export function projectLabel(e) {
+  return e?.name ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
+}
+
+function mutate(fn) {
+  const f = readFile() ?? {};
+  if (!f.projects || typeof f.projects !== 'object') f.projects = {};
+  // Surface a legacy trio into the map before any edit, so nothing loses it.
+  if (typeof f.fleetToken === 'string' && f.fleetToken && typeof f.projectId === 'string' && f.projectId && !f.projects[f.projectId]) {
+    f.projects[f.projectId] = { fleetToken: f.fleetToken, mcpUrl: f.mcpUrl ?? null };
+  }
+  fn(f);
+  writeFile(f);
+  return f;
+}
+
+/** A fresh login: upsert the entry AND point the legacy mirror at it. */
+export function saveLogin({ fleetToken, projectId, mcpUrl, name, repoRoot }) {
+  mutate((f) => {
+    f.projects[projectId] = {
+      ...(f.projects[projectId] ?? {}),
+      fleetToken,
+      mcpUrl: mcpUrl ?? null,
+      ...(name ? { name } : {}),
+      ...(repoRoot ? { repoRoot } : {}),
+      savedAt: new Date().toISOString(),
+    };
+    f.fleetToken = fleetToken;
+    f.projectId = projectId;
+    f.mcpUrl = mcpUrl ?? null;
+  });
+}
+
+/** An explicit human pick: repoint the legacy mirror, and — when the pick was
+ *  made standing in a repo — bind the entry there. A pick IS the confirmation;
+ *  binding on anything less would cement a guess. */
+export function selectStoredProject(projectId, { bindRepoRoot } = {}) {
+  mutate((f) => {
+    const e = f.projects[projectId];
+    if (!e) return;
+    if (bindRepoRoot) e.repoRoot = bindRepoRoot;
+    f.fleetToken = e.fleetToken;
+    f.projectId = projectId;
+    f.mcpUrl = e.mcpUrl ?? null;
+  });
+}
+
+export function bindStoredRepo(projectId, repoRoot) {
+  if (!repoRoot) return;
+  mutate((f) => {
+    if (f.projects[projectId]) f.projects[projectId].repoRoot = repoRoot;
+  });
+}
+
+/** The roster names the project on every poll; remember it so the picker and
+ *  `flowviant projects` can say a NAME instead of an id. */
+export function setStoredProjectName(projectId, name) {
+  if (!projectId || typeof name !== 'string' || !name) return;
+  const entries = listStoredProjects();
+  const e = entries.find((x) => x.projectId === projectId);
+  if (!e || e.name === name) return;
+  mutate((f) => {
+    if (f.projects[projectId]) f.projects[projectId].name = name;
+  });
+}
+
+/** Match `--project <ref>` against the store: exact id, id prefix (≥6), or
+ *  case-insensitive name. Ambiguity is an error, never a coin flip. */
+export function matchStoredProject(ref) {
+  const entries = listStoredProjects();
+  const q = String(ref ?? '').trim();
+  if (!q) return { error: 'empty --project value' };
+  const byId = entries.filter(
+    (e) => e.projectId === q || (q.length >= 6 && e.projectId.startsWith(q))
+  );
+  const byName = entries.filter((e) => e.name && e.name.toLowerCase() === q.toLowerCase());
+  const hits = byId.length > 0 ? byId : byName;
+  if (hits.length === 1) return { entry: hits[0] };
+  if (hits.length > 1) return { error: `"${q}" matches ${hits.length} stored projects — use the full project id` };
+  return { error: `no stored project matches "${q}"` };
+}
+
+/**
+ * Resolve which stored credential this invocation should use. PURE over the
+ * store + argv + cwd; every refusal and prompt above it is built from what
+ * this returns. Shapes:
+ *   { entry, source: 'project-flag' | 'repo' | 'only', needsConfirm? }
+ *   { choices, reason: 'no-match' | 'multiple-bound' | 'outside-repo', repoRoot }
+ *   { none: true }
+ *   { error }
+ *
+ * Deliberately NO mirror fallback once more than one project is stored: the
+ * mirror is whichever login happened last, and serving it because it was
+ * recent is exactly the calendar-says-skadooble surprise this file exists to
+ * end. Two projects means the answer is a QUESTION (or --project, or the
+ * repo binding), never recency.
+ */
+export function resolveStoredCredential(argv = process.argv, cwd = process.cwd()) {
+  const i = argv.indexOf('--project');
+  const projectArg = i >= 0 ? argv[i + 1] : undefined;
+  if (projectArg !== undefined) {
+    const m = matchStoredProject(projectArg);
+    return m.entry ? { entry: m.entry, source: 'project-flag' } : { error: m.error };
+  }
+  const entries = listStoredProjects();
+  if (entries.length === 0) return { none: true };
+  const repoRoot = detectRepoRoot(cwd);
+
+  if (repoRoot) {
+    const bound = entries.filter((e) => samePath(e.repoRoot, repoRoot));
+    if (bound.length === 1) return { entry: bound[0], source: 'repo', repoRoot };
+    if (bound.length > 1) return { choices: bound, reason: 'multiple-bound', repoRoot };
+  }
+
+  // ONE stored project with no binding: the pre-0.55.0 world. Serve it — a
+  // headless restart must not hang — but flag it, so a TTY start asks ONCE and
+  // binds, which is what turns "it said skadooble in my calendar repo" into a
+  // question instead of a surprise.
+  if (entries.length === 1 && !entries[0].repoRoot) {
+    return { entry: entries[0], source: 'only', needsConfirm: Boolean(repoRoot), repoRoot };
+  }
+
+  return { choices: entries, reason: repoRoot ? 'no-match' : 'outside-repo', repoRoot };
+}

package/bin/lib/env-cli.mjs

@@ -105,7 +105,11 @@ async function readSecretFromStdin(promptText) {
 }
 
 export async function runEnvCommand(args) {
-  if (!FLEET_TOKEN) die('no fleet credential — run `flowviant login` first.');
+  if (!FLEET_TOKEN)
+    die(
+      'no credential resolves here — run `flowviant login`, or run this inside the ' +
+        "project's own repo / pass `--project <name|id>` (`flowviant projects` lists them)."
+    );
   await sodium.ready;
   await ensureKeypair();
   const cmd = args[0];

package/bin/lib/env.mjs

@@ -34,6 +34,8 @@ import {
   mkdirSync,
   existsSync,
   appendFileSync,
+  chmodSync,
+  lstatSync,
   rmSync,
 } from 'node:fs';
 import { execFileSync } from 'node:child_process';
@@ -123,11 +125,52 @@ export function myPubB64() {
   return keypair ? sodium.to_base64(keypair.publicKey, B64()) : null;
 }
 
-/** Query params the roster poll carries: identity + materialized version. */
+/** Query params the roster poll carries: identity, materialized version, and
+ *  the target files we REFUSED to write.
+ *
+ *  `envv` alone was a half-truth and the surface built on it said the wrong
+ *  thing out loud: it is set the moment the bundle DECRYPTS, independent of
+ *  whether a single byte reached a worktree, so a project whose `.env` is
+ *  tracked in git got the green "on the current env" chip while every session
+ *  ran on whatever stale placeholder git had checked out. The daemon knew —
+ *  it warned, to a console nobody reads. `envskip` is that warning routed
+ *  somewhere a human is actually looking.
+ *
+ *  A daemon→server REPORT, so it needs no version floor: an older daemon
+ *  simply sends no `envskip` key, which reads as "nothing to report" — and
+ *  that is honest, because an older daemon genuinely is not measuring it.
+ *  Bounded hard: a query string is not a log. */
 export async function envQueryParams() {
   await ensureKeypair();
   const params = { envpub: myPubB64() };
   if (bundleVersion >= 0) params.envv = String(bundleVersion);
+  // THE EMPTY STRING IS A REPORT, and it is the only thing that can ever CLEAR
+  // the surface's warning. Gating this on truthiness (which is what it did
+  // first) meant a person who followed the on-screen remedy exactly — gitignore
+  // the file, restart — sent no `envskip` at all, the server left the column
+  // alone by design, and the amber line stayed up forever telling them to fix
+  // something already fixed. Absence must keep meaning IGNORANCE, so the gate
+  // is "has a pass actually run", never "is there something to say".
+  // (fleet.mjs's query loop had to stop filtering on truthiness too — one
+  // check here is useless while a second one downstream drops the same value.)
+  if (everMaterialized) {
+    const files = [...new Set([...skippedByWorktree.values()].flat())].sort();
+    // Each path is percent-encoded BEFORE the join, because `isSafeEnvTargetFile`
+    // permits a comma in a filename and the server splits on one — unencoded,
+    // `a,b.env` would arrive as two files that do not exist. Truncation is by
+    // WHOLE ELEMENTS against a byte budget; a mid-path cut names a file nobody
+    // has, which is worse than naming fewer.
+    const parts = [];
+    let budget = 400;
+    for (const f of files) {
+      if (parts.length >= 10) break;
+      const enc = encodeURIComponent(f);
+      if (enc.length + 1 > budget) break;
+      parts.push(enc);
+      budget -= enc.length + 1;
+    }
+    params.envskip = parts.join(',');
+  }
   return params;
 }
 
@@ -310,6 +353,37 @@ function isIgnoredInGit(wt, relPath) {
 
 // Per-worktree: the target files we last materialized THIS SESSION.
 const lastFilesByWorktree = new Map();
+
+/** Target files refused for a GIT reason, PER WORKTREE — reported to the
+ *  server on the next poll. Per-worktree because the refusal is: both
+ *  predicates (`isTrackedInGit`, `isIgnoredInGit`) run with `cwd: wt`, so
+ *  ".env is refused" is a fact about ONE tree. A process-global set mixed two
+ *  trees' answers together and, worse, could only ever grow.
+ *
+ *  Names only — a path is not a secret, and the whole point is that a human
+ *  can act on it ("gitignore apps/api/.dev.vars"). Only the two GIT causes go
+ *  in here: they have a remedy the reader can carry out, and the surface names
+ *  that remedy. A transient write failure is a warn, not a standing claim. */
+const skippedByWorktree = new Map();
+
+/** Worktrees whose most recent pass wrote everything it was asked to.
+ *  `hasMaterialized` is built on THIS rather than on "a pass ran", so a pass
+ *  that refused something RETRIES on the next turn — which is what lets
+ *  `echo .env >> .gitignore` actually take effect without waiting for an
+ *  unrelated bundle change. A pass with nothing to write counts as clean. */
+const cleanWorktrees = new Set();
+
+/** True once any materialization pass has completed. Distinguishes "we refused
+ *  nothing" from "we have not looked", which is the whole contract of the
+ *  `envskip` report — see envQueryParams. */
+let everMaterialized = false;
+
+/** Has this process completed a CLEAN materialization pass for this worktree?
+ *  The creation-only rule (work.mjs) needs a second condition or a directory
+ *  that existed before the bundle did is never revisited. */
+export function hasMaterialized(wt) {
+  return cleanWorktrees.has(wt);
+}
 // Project-global union of every target file we've ever materialized — PERSISTED
 // in the cache and seeded on load, so a file whose key was deleted while the
 // daemon was down still gets its stale plaintext copy cleaned on the next
@@ -366,6 +440,15 @@ export function appSecretsFor(env) {
  *  app secrets go to the provider at deploy, deploy creds are injected only. */
 export function materializeInto(wt) {
   if (!wt || !existsSync(wt)) return;
+  // NEVER SYNCED IS NOT "NO SECRETS", and conflating them cost a whole session.
+  // `values` is empty both before the first bundle lands and for a project that
+  // genuinely has none; `bundleVersion < 0` is the one that means IGNORANCE.
+  // Writing nothing here and RECORDING it as materialized let a worktree
+  // created on the first poll after a restart — before handleRosterEnv had
+  // warmed the cache — sit secret-less for its entire life, because nothing
+  // re-materializes a directory that is neither fresh nor covered by a bundle
+  // CHANGE. Returning without recording is what makes the next turn retry.
+  if (bundleVersion < 0) return;
   const byFile = new Map();
   for (const v of values) {
     if (v.scope !== 'app' || v.env !== 'dev') continue; // only local dev secrets hit a worktree file
@@ -382,9 +465,16 @@ export function materializeInto(wt) {
   excludeInWorktree(wt, [...byFile.keys()]);
 
   const written = [];
+  /** Refused for a GIT reason this pass — reported, and remediable. */
+  const refusedForGit = [];
+  /** Anything that did not get written, git reasons and write failures alike.
+   *  Blocks the clean mark so the next turn tries again. */
+  let anyProblem = false;
   for (const [file, list] of byFile) {
     if (isTrackedInGit(wt, file)) {
       warn(`env: "${file}" is tracked in git — refusing to write secrets there (gitignore it). Its keys are NOT materialized.`);
+      refusedForGit.push(file);
+      anyProblem = true;
       continue;
     }
     // The load-bearing check. A materialized secret sits in a worktree whose
@@ -392,10 +482,27 @@ export function materializeInto(wt) {
     // "git cannot see this file" is a precondition for writing it, not a nicety.
     if (!isIgnoredInGit(wt, file)) {
       warn(`env: "${file}" is not gitignored — refusing to write secrets there. Add it to .gitignore. Its keys are NOT materialized.`);
+      refusedForGit.push(file);
+      anyProblem = true;
       continue;
     }
     try {
       const abs = join(wt, file);
+      // A SYMLINK AT THE TARGET IS NOT A TARGET. `writeFileSync` follows one,
+      // so a link committed into the repo (or dropped by an agent) at the
+      // materialization path would write the project's decrypted secrets
+      // wherever it points — outside the worktree, and outside everything the
+      // check-ignore gate can reason about. `lstat`, not `stat`, and refuse.
+      // Cheap, and the whole exposure is one call away otherwise.
+      try {
+        if (lstatSync(abs).isSymbolicLink()) {
+          warn(`env: "${file}" is a symlink — refusing to write secrets through it.`);
+          anyProblem = true;
+          continue;
+        }
+      } catch {
+        /* does not exist yet — the ordinary case */
+      }
       mkdirSync(dirname(abs), { recursive: true });
       const body = renderEnvFile(list);
       // Skip an identical rewrite — otherwise every bundle bump touches the
@@ -407,9 +514,22 @@ export function materializeInto(wt) {
         /* new file */
       }
       if (prior !== body) writeFileSync(abs, body, { mode: 0o600 });
+      // `mode` on writeFileSync applies at CREATION only — an overwrite of a
+      // file that already existed keeps whatever mode it had, so a 0644 stub
+      // committed by a teammate (or left by an older daemon) would hold
+      // plaintext secrets world-readable on a shared box. chmod every time.
+      try {
+        chmodSync(abs, 0o600);
+      } catch {
+        /* best-effort: a filesystem without modes is not a reason to refuse */
+      }
       written.push(file);
     } catch (e) {
+      // NOT reported as a refusal: the surface's line names a git cause and a
+      // git remedy, and a full disk is neither. It still blocks the clean mark,
+      // so the next turn retries.
       warn(`env: could not write ${file} into worktree: ${e.message}`);
+      anyProblem = true;
     }
   }
 
@@ -423,6 +543,18 @@ export function materializeInto(wt) {
   }
   for (const f of written) knownTargetFiles.add(f);
   lastFilesByWorktree.set(wt, written);
+
+  // THE PASS'S VERDICT, recorded whole and REPLACING the previous one — this is
+  // what lets a refusal clear. `refusedForGit` is recomputed from scratch every
+  // pass, so a file that gets gitignored simply is not in the next one, and the
+  // union reported on the poll shrinks. `anyProblem` (which also covers a write
+  // failure) is what decides whether this worktree gets retried on the next
+  // turn; a clean pass is remembered so we stop touching a live directory.
+  if (refusedForGit.length > 0) skippedByWorktree.set(wt, refusedForGit);
+  else skippedByWorktree.delete(wt);
+  if (anyProblem) cleanWorktrees.delete(wt);
+  else cleanWorktrees.add(wt);
+  everMaterialized = true;
 }
 
 /**

package/bin/lib/fleet.mjs

@@ -31,7 +31,9 @@ import {
   REFRESH_BEFORE_SECONDS,
   LIVE,
   AUTO_UPDATE,
+  CREDENTIAL,
 } from './config.mjs';
+import { projectLabel, setStoredProjectName } from './credentials.mjs';
 import { handleVersionSignal } from './update.mjs';
 import {
   git,
@@ -67,6 +69,7 @@ import { ensureVault, syncVault } from './vault.mjs';
 import {
   envQueryParams,
   handleRosterEnv,
+  loadCachedEnv,
   materializeInto,
   myPubB64,
   scrub as envScrub,
@@ -148,9 +151,17 @@ async function fetchRoster(haveIds, livePreviewSessionIds = [], heldSessionIds =
     /* best-effort — the poll must never fail on a readout */
   }
   // Env-sync identity + materialized version (the Settings "env vN" chip).
+  //
+  // `!= null`, NOT truthiness. `envskip` uses the EMPTY STRING as a real
+  // report — "measured, refused nothing" — and it is the only value that can
+  // clear the surface's warning. A `if (v)` here silently dropped it, so
+  // fixing the filter in envQueryParams alone would have changed nothing.
+  // This is the same trap the skills relay eight lines up documents and
+  // sidesteps by calling `url.searchParams.set` directly; the general fix is
+  // better than a second special case.
   try {
     for (const [k, v] of Object.entries(await envQueryParams())) {
-      if (v) url.searchParams.set(k, v);
+      if (v != null) url.searchParams.set(k, v);
     }
   } catch {
     /* env identity is best-effort — the poll must never fail on it */
@@ -322,6 +333,14 @@ export async function runFleetDaemon() {
   const repoRoot = repoRootOrDie();
   const baseRef = detectBaseRef(repoRoot);
   info(SAFE ? 'mode   · safe (restricted toolset)' : 'mode   · unattended (skips permission prompts)');
+  // WHICH PROJECT, before anything connects — the roster names it again a few
+  // seconds later with the server's word, but "which project is this daemon
+  // about to serve" must not require a network round trip to answer. Only when
+  // the credential came from the STORE: a --fleet/env token names no project
+  // until the roster does.
+  if (CREDENTIAL?.entry) {
+    info(`serves · ${projectLabel(CREDENTIAL.entry)} ${c.dim(`(${CREDENTIAL.entry.projectId.slice(0, 8)}…)`)}`);
+  }
   info(`repo   · ${repoRoot}`);
   info(`base   · ${baseRef}`);
   info(`server · ${FLEET_URL}`);
@@ -385,6 +404,39 @@ export async function runFleetDaemon() {
     warn('could not take the single-instance lock (unwritable ~/.flowviant) — running unguarded');
 
   await preflight({ needGit: true });
+
+  // WARM THE ENV CACHE BEFORE THE FIRST POLL, not on the first roster tick.
+  // `handleRosterEnv` loads it, and `handleRosterEnv` runs AFTER
+  // `processWorkTurns` in the reconcile below — so on the first poll after a
+  // restart a brand-new session worktree was materialized against an EMPTY
+  // bundle, and then never revisited (creation-only, and `needSync` is false
+  // when the cache holds the version the server is already on). The turn ran
+  // with no secrets and nothing said so.
+  //
+  // This is only possible since 0.55.0: the credential store knows which
+  // project this checkout is, so the cache — which is keyed by projectId — can
+  // be found before the server has named anything. A `--fleet`/env token names
+  // no project until the roster does, so it keeps the old lazy path.
+  // Best-effort throughout: a cache miss is the ordinary first-run state.
+  //
+  // GATED ON THE STORE ACTUALLY BEING THE SOURCE. `--fleet` / `FLOWVIANT_FLEET`
+  // OVERRIDE the stored credential (config.mjs), but `CREDENTIAL` is resolved
+  // from the store regardless — so reading its projectId here would decrypt and
+  // materialize project A's cached secrets while this daemon is serving project
+  // B's token. That is the wrong project's plaintext in a worktree, which is
+  // the exact failure the repo binding exists to prevent, arriving by a
+  // different door. An external token names no project until the roster does,
+  // so it keeps the lazy path and loses nothing but one poll.
+  const externalToken =
+    process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+  if (!externalToken && CREDENTIAL?.entry?.projectId) {
+    try {
+      await loadCachedEnv(CREDENTIAL.entry.projectId);
+    } catch {
+      /* no cache, no keypair yet, unreadable home — the roster tick retries */
+    }
+  }
+
   // Kill any preview dev-server/tunnel groups a previously-crashed daemon left
   // running (detached children survive an ungraceful exit) before we start fresh.
   reapOrphanPreviews((m) => info(m));
@@ -1305,6 +1357,11 @@ export async function runFleetDaemon() {
           `${c.cyan('project')} · ${c.bold(roster.project.name)} ${c.dim(`(${roster.project.id})`)}`
         );
         note(c.dim('  wiki + agents stream to THIS project — view its Code canvas in Flowviant.'));
+        // Remember the NAME beside the stored credential, so the picker and
+        // `flowviant projects` can say "skadooble" instead of an id — a
+        // credential saved before the server sent names backfills here. No-op
+        // for a --fleet/env token (nothing stored to annotate).
+        setStoredProjectName(roster.project.id, roster.project.name);
       }
     }
     if (roster.mcpUrl) mcpUrl = roster.mcpUrl;

package/bin/lib/login.mjs

@@ -6,33 +6,15 @@
  * plain `flowviant` just runs — no token, no env var.
  */
 
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
+import { saveLogin, detectRepoRoot, projectLabel } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
-const CRED_DIR = join(homedir(), '.flowviant');
-const CRED_FILE = join(CRED_DIR, 'credentials.json');
 const DEVICE_START = FLEET_URL.replace(/\/agents\/?$/, '/device/start');
 const DEVICE_POLL = FLEET_URL.replace(/\/agents\/?$/, '/device/poll');
 const APP_URL = process.env.FLOWVIANT_APP_URL || 'https://app.flowviant.com';
 
-/** The locally-stored credential from a prior `login`, or null. Read by config. */
-export function readStoredCredential() {
-  try {
-    return JSON.parse(readFileSync(CRED_FILE, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function store(cred) {
-  mkdirSync(CRED_DIR, { recursive: true });
-  writeFileSync(CRED_FILE, JSON.stringify(cred, null, 2), { mode: 0o600 });
-}
-
 async function post(url, body) {
   const res = await fetch(url, {
     method: 'POST',
@@ -76,10 +58,26 @@ export async function runLogin({ thenStart = false } = {}) {
     if (poll.status === 'approved') {
       // `machineToken` is the wire's new name; `fleetToken` is the one every
       // published daemon reads. The server dual-sends until DAEMON_MIN clears
-      // THIS release (0.54.2) — reading both here is what makes retiring the
-      // old key possible at all.
-      store({ fleetToken: poll.machineToken ?? poll.fleetToken, projectId: poll.projectId, mcpUrl: poll.mcpUrl });
-      ok('connected — credential saved to ~/.flowviant/credentials.json');
+      // the release that reads the new one (0.54.2+) — reading both here is
+      // what makes retiring the old key possible at all.
+      //
+      // BOUND to the repo the login was run in: a login is the one moment we
+      // know for certain which checkout this project means, and the binding is
+      // what lets a multi-project VM resolve `npx flowviant` by DIRECTORY
+      // instead of by whichever login happened last.
+      const repoRoot = detectRepoRoot();
+      const entry = {
+        fleetToken: poll.machineToken ?? poll.fleetToken,
+        projectId: poll.projectId,
+        mcpUrl: poll.mcpUrl,
+        name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
+        repoRoot,
+      };
+      saveLogin(entry);
+      ok(
+        `connected to ${c.bold(projectLabel(entry))}` +
+          `${repoRoot ? ` for ${c.dim(repoRoot)}` : ''} — saved to ~/.flowviant/credentials.json`
+      );
       // The daemon starts right here unless the caller opted out; telling
       // someone to run a second command was the step that got missed, since by
       // this point they are looking at the browser, not this terminal.

package/bin/lib/mcp-cli.mjs

@@ -23,8 +23,9 @@ const CLI_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/cli-token');
 export async function runMcpCommand(args = []) {
   if (!FLEET_TOKEN) {
     console.error(
-      'error: no credential. Run `flowviant login` first — this needs the\n' +
-        'fleet credential the daemon uses, so it knows which project to connect.'
+      'error: no credential resolves here. Run `flowviant login` first — or, with\n' +
+        'several projects connected on this box, run this inside the project\'s own\n' +
+        'repo or pass `--project <name|id>` (`flowviant projects` lists them).'
     );
     process.exit(1);
   }

package/bin/lib/runtimes.mjs

@@ -79,7 +79,16 @@ export function humanizeClaudeTool(name, input = {}, cwd = '') {
     case 'LS':
       return { kind: 'list', label: `ls ${shortPath(input.path ?? '.', cwd)}` };
     case 'Bash':
-      return { kind: 'bash', label: `$ ${oneLine(input.command, 60)}` };
+      // `command` rides beside the display label, VERBATIM (capped): the label
+      // is a 60-char readout for a console and the rail, and truncation is
+      // fine there — but the admin's command audit exists to answer "what
+      // actually ran on our box", and an ellipsis is exactly where the part
+      // that matters would hide.
+      return {
+        kind: 'bash',
+        command: String(input.command ?? '').slice(0, 2000),
+        label: `$ ${oneLine(input.command, 60)}`,
+      };
     default:
       return null; // other tools: silent
   }
@@ -103,7 +112,11 @@ function humanizeCodexItem(item = {}, cwd = '') {
     case 'reasoning':
       return { kind: 'think', label: oneLine(item.text) || 'thinking…' };
     case 'command_execution':
-      return { kind: 'bash', label: `$ ${oneLine(item.command, 60)}` };
+      return {
+        kind: 'bash',
+        command: String(item.command ?? '').slice(0, 2000),
+        label: `$ ${oneLine(item.command, 60)}`,
+      };
     case 'file_change': {
       // `changes` is a list of touched paths; the daemon counts distinct files,
       // so emit one activity per path rather than one for the batch.
@@ -207,7 +220,11 @@ function humanizeAgyTool(name, p = {}, cwd = '') {
     case 'list_dir':
       return { kind: 'list', label: `ls ${shortPath(path, cwd)}` };
     case 'run_command':
-      return { kind: 'bash', label: `$ ${oneLine(p.CommandLine, 60)}` };
+      return {
+        kind: 'bash',
+        command: String(p.CommandLine ?? '').slice(0, 2000),
+        label: `$ ${oneLine(p.CommandLine, 60)}`,
+      };
     case 'call_mcp_tool':
       return { kind: 'tool', label: `mcp.${p.ToolName ?? ''}` };
     default:

package/bin/lib/update.mjs

@@ -59,7 +59,17 @@ function reexec(teardown) {
   }
   const child = spawn(process.execPath, process.argv.slice(1), {
     stdio: 'inherit',
-    env: process.env,
+    // MARK THE CHILD AS A RESTART, not as a person typing `flowviant`.
+    // stdio is inherited, so the child sees two TTYs and believes a human is
+    // watching — and 0.55.0 asks a one-time binding question on exactly that
+    // signal. An auto-update that lands while nobody is looking would then sit
+    // on `Serve this repo as X? [Y/n]` with the machine dark until someone
+    // walks past. The rule credentials.mjs already states for systemd applies
+    // verbatim here: a RESTART must not hang on a prompt. Skipping the confirm
+    // is not a widening — the daemon serves exactly the credential it was
+    // already serving one second ago, and the question gets asked the next
+    // time a human starts it by hand.
+    env: { ...process.env, FLOWVIANT_REEXEC: '1' },
   });
   child.on('exit', (code) => process.exit(code ?? 0));
 }

package/bin/lib/work.mjs

@@ -48,7 +48,7 @@ import {
   SYSTEM_WORK_PLAIN,
   WORK_TURN_KICKOFF_PLAIN,
 } from './prompts.mjs';
-import { materializeInto, excludeInWorktree, scrub as envScrub } from './env.mjs';
+import { materializeInto, hasMaterialized, excludeInWorktree, scrub as envScrub } from './env.mjs';
 import { detectRuntimes, canRun, recordSkills, RUNTIMES } from './runtimes.mjs';
 import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
@@ -102,6 +102,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   const DIFF_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/diff-done');
   const PREVIEW_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-claim');
   const PREVIEW_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-done');
+  const SESSION_COMMANDS_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-commands');
   const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
   const workAnswering = new Set(); // turn ids currently queued/running here
   const workAttempts = new Map(); // turn id -> completed runTurn attempts
@@ -899,6 +900,25 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       } catch {
         /* best-effort */
       }
+    } else if (!hasMaterialized(wt)) {
+      // CREATION-ONLY NEEDED A SECOND CONDITION. The rule above is right about
+      // a LIVE directory — its env belongs to the session and re-writing it
+      // mid-flight is not ours to do — but "created" and "ever given a bundle"
+      // are different events, and the gap between them is a whole daemon
+      // restart: `handleRosterEnv` (which warms the encrypted cache) runs
+      // AFTER `processWorkTurns` on the same poll, so a worktree made on the
+      // first turn after a restart was materialized against an EMPTY bundle
+      // and, being neither fresh nor covered by a bundle CHANGE, never
+      // revisited. `materializeInto` now declines to record a pass it made in
+      // ignorance (bundleVersion < 0), so this branch is what retries it —
+      // once, on the next turn, and never again after it succeeds. Idempotent
+      // by construction: identical bodies are not rewritten, so nothing
+      // hot-restarts a dev server the driver is watching.
+      try {
+        materializeInto(wt);
+      } catch {
+        /* best-effort */
+      }
     }
     return { wt, fresh };
   };
@@ -1584,6 +1604,45 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           let seenThreadId = null; // codex's conversation id, off thread.started
           const spawned = []; // this turn's children, for the teardown registry
           const narrator = makeNarrator(job.sessionId, job.id);
+
+          // THE COMMAND AUDIT — every `$ …` the CLI's stream reports, batched
+          // to the server verbatim so an admin can read what actually ran on
+          // this box. Same events the narrator renders and forgets; this is
+          // the durable copy, and it carries ONLY commands — no prose, no
+          // thinking, no file reads (the session stays private; what executed
+          // on the shared machine is the machine's own fact to relay).
+          // Flushed mid-turn every 25 so a long turn is not one giant loss on
+          // a kill, and again at settle. Best-effort: a failed post drops the
+          // batch rather than blocking the turn — the surface says it is the
+          // machine's report, not a syscall trace.
+          const auditBatch = [];
+          const flushAudit = () => {
+            if (auditBatch.length === 0) return;
+            const commands = auditBatch.splice(0, auditBatch.length);
+            void fetch(SESSION_COMMANDS_URL, {
+              method: 'POST',
+              headers: {
+                Authorization: `Bearer ${FLEET_TOKEN}`,
+                'User-Agent': USER_AGENT,
+                'Content-Type': 'application/json',
+              },
+              signal: AbortSignal.timeout(30_000),
+              body: JSON.stringify({
+                sessionId: job.sessionId,
+                turnId: job.id,
+                runtime: rt.id,
+                cwd: dir.wt,
+                commands,
+              }),
+            }).catch(() => {
+              /* best-effort — the audit records what reached it */
+            });
+          };
+          const auditCommand = (a) => {
+            if (a?.kind !== 'bash' || !a.command) return;
+            auditBatch.push({ command: a.command, at: new Date().toISOString() });
+            if (auditBatch.length >= 25) flushAudit();
+          };
           try {
             // Files first, then the message that references them: the agent
             // must be able to open what it is being told about. Only the ones
@@ -1627,7 +1686,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               // posted once. Every line goes to the narrator above, throttled.
               streamJson: true,
               answerFromResult: true,
-              onActivity: (a) => narrator.line(a?.label),
+              onActivity: (a) => {
+                narrator.line(a?.label);
+                auditCommand(a);
+              },
               // What this CLI says it can be asked for by name. Harvested off
               // the init event the stream already carries — no probe, no scan,
               // no extra spawn — and reported on the next roster poll so the
@@ -1683,6 +1745,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             // is cleared server-side at settle — clearing it here would race
             // the settle and blank the tab a beat before the reply lands.
             narrator.stop();
+            flushAudit();
             for (const ch of spawned) workChildren.delete(ch);
             if (lockPath) {
               try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.54.2",
-  "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
+  "version": "0.55.1",
+  "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"