flowviant 0.55.0 → 0.55.1

package/bin/cli.mjs

@@ -233,7 +233,12 @@ if (process.argv[2] === 'env') {
 // that name every stored project and every way out. The one thing this block
 // must never do is serve a project the resolution did not name — "it said
 // skadooble in my calendar repo" is the confusion this exists to end.
-const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+// A RESTART IS NOT A PERSON. `reexec` (update.mjs) inherits stdio, so an
+// auto-updated daemon's child sees two TTYs; without this it would stop on the
+// binding confirm below and the machine would stay dark until somebody typed a
+// key. Same reasoning as the headless case, and the same answer.
+const interactive =
+  Boolean(process.stdin.isTTY && process.stdout.isTTY) && process.env.FLOWVIANT_REEXEC !== '1';
 const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own

package/bin/lib/env.mjs

@@ -34,6 +34,8 @@ import {
   mkdirSync,
   existsSync,
   appendFileSync,
+  chmodSync,
+  lstatSync,
   rmSync,
 } from 'node:fs';
 import { execFileSync } from 'node:child_process';
@@ -123,11 +125,52 @@ export function myPubB64() {
   return keypair ? sodium.to_base64(keypair.publicKey, B64()) : null;
 }
 
-/** Query params the roster poll carries: identity + materialized version. */
+/** Query params the roster poll carries: identity, materialized version, and
+ *  the target files we REFUSED to write.
+ *
+ *  `envv` alone was a half-truth and the surface built on it said the wrong
+ *  thing out loud: it is set the moment the bundle DECRYPTS, independent of
+ *  whether a single byte reached a worktree, so a project whose `.env` is
+ *  tracked in git got the green "on the current env" chip while every session
+ *  ran on whatever stale placeholder git had checked out. The daemon knew —
+ *  it warned, to a console nobody reads. `envskip` is that warning routed
+ *  somewhere a human is actually looking.
+ *
+ *  A daemon→server REPORT, so it needs no version floor: an older daemon
+ *  simply sends no `envskip` key, which reads as "nothing to report" — and
+ *  that is honest, because an older daemon genuinely is not measuring it.
+ *  Bounded hard: a query string is not a log. */
 export async function envQueryParams() {
   await ensureKeypair();
   const params = { envpub: myPubB64() };
   if (bundleVersion >= 0) params.envv = String(bundleVersion);
+  // THE EMPTY STRING IS A REPORT, and it is the only thing that can ever CLEAR
+  // the surface's warning. Gating this on truthiness (which is what it did
+  // first) meant a person who followed the on-screen remedy exactly — gitignore
+  // the file, restart — sent no `envskip` at all, the server left the column
+  // alone by design, and the amber line stayed up forever telling them to fix
+  // something already fixed. Absence must keep meaning IGNORANCE, so the gate
+  // is "has a pass actually run", never "is there something to say".
+  // (fleet.mjs's query loop had to stop filtering on truthiness too — one
+  // check here is useless while a second one downstream drops the same value.)
+  if (everMaterialized) {
+    const files = [...new Set([...skippedByWorktree.values()].flat())].sort();
+    // Each path is percent-encoded BEFORE the join, because `isSafeEnvTargetFile`
+    // permits a comma in a filename and the server splits on one — unencoded,
+    // `a,b.env` would arrive as two files that do not exist. Truncation is by
+    // WHOLE ELEMENTS against a byte budget; a mid-path cut names a file nobody
+    // has, which is worse than naming fewer.
+    const parts = [];
+    let budget = 400;
+    for (const f of files) {
+      if (parts.length >= 10) break;
+      const enc = encodeURIComponent(f);
+      if (enc.length + 1 > budget) break;
+      parts.push(enc);
+      budget -= enc.length + 1;
+    }
+    params.envskip = parts.join(',');
+  }
   return params;
 }
 
@@ -310,6 +353,37 @@ function isIgnoredInGit(wt, relPath) {
 
 // Per-worktree: the target files we last materialized THIS SESSION.
 const lastFilesByWorktree = new Map();
+
+/** Target files refused for a GIT reason, PER WORKTREE — reported to the
+ *  server on the next poll. Per-worktree because the refusal is: both
+ *  predicates (`isTrackedInGit`, `isIgnoredInGit`) run with `cwd: wt`, so
+ *  ".env is refused" is a fact about ONE tree. A process-global set mixed two
+ *  trees' answers together and, worse, could only ever grow.
+ *
+ *  Names only — a path is not a secret, and the whole point is that a human
+ *  can act on it ("gitignore apps/api/.dev.vars"). Only the two GIT causes go
+ *  in here: they have a remedy the reader can carry out, and the surface names
+ *  that remedy. A transient write failure is a warn, not a standing claim. */
+const skippedByWorktree = new Map();
+
+/** Worktrees whose most recent pass wrote everything it was asked to.
+ *  `hasMaterialized` is built on THIS rather than on "a pass ran", so a pass
+ *  that refused something RETRIES on the next turn — which is what lets
+ *  `echo .env >> .gitignore` actually take effect without waiting for an
+ *  unrelated bundle change. A pass with nothing to write counts as clean. */
+const cleanWorktrees = new Set();
+
+/** True once any materialization pass has completed. Distinguishes "we refused
+ *  nothing" from "we have not looked", which is the whole contract of the
+ *  `envskip` report — see envQueryParams. */
+let everMaterialized = false;
+
+/** Has this process completed a CLEAN materialization pass for this worktree?
+ *  The creation-only rule (work.mjs) needs a second condition or a directory
+ *  that existed before the bundle did is never revisited. */
+export function hasMaterialized(wt) {
+  return cleanWorktrees.has(wt);
+}
 // Project-global union of every target file we've ever materialized — PERSISTED
 // in the cache and seeded on load, so a file whose key was deleted while the
 // daemon was down still gets its stale plaintext copy cleaned on the next
@@ -366,6 +440,15 @@ export function appSecretsFor(env) {
  *  app secrets go to the provider at deploy, deploy creds are injected only. */
 export function materializeInto(wt) {
   if (!wt || !existsSync(wt)) return;
+  // NEVER SYNCED IS NOT "NO SECRETS", and conflating them cost a whole session.
+  // `values` is empty both before the first bundle lands and for a project that
+  // genuinely has none; `bundleVersion < 0` is the one that means IGNORANCE.
+  // Writing nothing here and RECORDING it as materialized let a worktree
+  // created on the first poll after a restart — before handleRosterEnv had
+  // warmed the cache — sit secret-less for its entire life, because nothing
+  // re-materializes a directory that is neither fresh nor covered by a bundle
+  // CHANGE. Returning without recording is what makes the next turn retry.
+  if (bundleVersion < 0) return;
   const byFile = new Map();
   for (const v of values) {
     if (v.scope !== 'app' || v.env !== 'dev') continue; // only local dev secrets hit a worktree file
@@ -382,9 +465,16 @@ export function materializeInto(wt) {
   excludeInWorktree(wt, [...byFile.keys()]);
 
   const written = [];
+  /** Refused for a GIT reason this pass — reported, and remediable. */
+  const refusedForGit = [];
+  /** Anything that did not get written, git reasons and write failures alike.
+   *  Blocks the clean mark so the next turn tries again. */
+  let anyProblem = false;
   for (const [file, list] of byFile) {
     if (isTrackedInGit(wt, file)) {
       warn(`env: "${file}" is tracked in git — refusing to write secrets there (gitignore it). Its keys are NOT materialized.`);
+      refusedForGit.push(file);
+      anyProblem = true;
       continue;
     }
     // The load-bearing check. A materialized secret sits in a worktree whose
@@ -392,10 +482,27 @@ export function materializeInto(wt) {
     // "git cannot see this file" is a precondition for writing it, not a nicety.
     if (!isIgnoredInGit(wt, file)) {
       warn(`env: "${file}" is not gitignored — refusing to write secrets there. Add it to .gitignore. Its keys are NOT materialized.`);
+      refusedForGit.push(file);
+      anyProblem = true;
       continue;
     }
     try {
       const abs = join(wt, file);
+      // A SYMLINK AT THE TARGET IS NOT A TARGET. `writeFileSync` follows one,
+      // so a link committed into the repo (or dropped by an agent) at the
+      // materialization path would write the project's decrypted secrets
+      // wherever it points — outside the worktree, and outside everything the
+      // check-ignore gate can reason about. `lstat`, not `stat`, and refuse.
+      // Cheap, and the whole exposure is one call away otherwise.
+      try {
+        if (lstatSync(abs).isSymbolicLink()) {
+          warn(`env: "${file}" is a symlink — refusing to write secrets through it.`);
+          anyProblem = true;
+          continue;
+        }
+      } catch {
+        /* does not exist yet — the ordinary case */
+      }
       mkdirSync(dirname(abs), { recursive: true });
       const body = renderEnvFile(list);
       // Skip an identical rewrite — otherwise every bundle bump touches the
@@ -407,9 +514,22 @@ export function materializeInto(wt) {
         /* new file */
       }
       if (prior !== body) writeFileSync(abs, body, { mode: 0o600 });
+      // `mode` on writeFileSync applies at CREATION only — an overwrite of a
+      // file that already existed keeps whatever mode it had, so a 0644 stub
+      // committed by a teammate (or left by an older daemon) would hold
+      // plaintext secrets world-readable on a shared box. chmod every time.
+      try {
+        chmodSync(abs, 0o600);
+      } catch {
+        /* best-effort: a filesystem without modes is not a reason to refuse */
+      }
       written.push(file);
     } catch (e) {
+      // NOT reported as a refusal: the surface's line names a git cause and a
+      // git remedy, and a full disk is neither. It still blocks the clean mark,
+      // so the next turn retries.
       warn(`env: could not write ${file} into worktree: ${e.message}`);
+      anyProblem = true;
     }
   }
 
@@ -423,6 +543,18 @@ export function materializeInto(wt) {
   }
   for (const f of written) knownTargetFiles.add(f);
   lastFilesByWorktree.set(wt, written);
+
+  // THE PASS'S VERDICT, recorded whole and REPLACING the previous one — this is
+  // what lets a refusal clear. `refusedForGit` is recomputed from scratch every
+  // pass, so a file that gets gitignored simply is not in the next one, and the
+  // union reported on the poll shrinks. `anyProblem` (which also covers a write
+  // failure) is what decides whether this worktree gets retried on the next
+  // turn; a clean pass is remembered so we stop touching a live directory.
+  if (refusedForGit.length > 0) skippedByWorktree.set(wt, refusedForGit);
+  else skippedByWorktree.delete(wt);
+  if (anyProblem) cleanWorktrees.delete(wt);
+  else cleanWorktrees.add(wt);
+  everMaterialized = true;
 }
 
 /**

package/bin/lib/fleet.mjs

@@ -69,6 +69,7 @@ import { ensureVault, syncVault } from './vault.mjs';
 import {
   envQueryParams,
   handleRosterEnv,
+  loadCachedEnv,
   materializeInto,
   myPubB64,
   scrub as envScrub,
@@ -150,9 +151,17 @@ async function fetchRoster(haveIds, livePreviewSessionIds = [], heldSessionIds =
     /* best-effort — the poll must never fail on a readout */
   }
   // Env-sync identity + materialized version (the Settings "env vN" chip).
+  //
+  // `!= null`, NOT truthiness. `envskip` uses the EMPTY STRING as a real
+  // report — "measured, refused nothing" — and it is the only value that can
+  // clear the surface's warning. A `if (v)` here silently dropped it, so
+  // fixing the filter in envQueryParams alone would have changed nothing.
+  // This is the same trap the skills relay eight lines up documents and
+  // sidesteps by calling `url.searchParams.set` directly; the general fix is
+  // better than a second special case.
   try {
     for (const [k, v] of Object.entries(await envQueryParams())) {
-      if (v) url.searchParams.set(k, v);
+      if (v != null) url.searchParams.set(k, v);
     }
   } catch {
     /* env identity is best-effort — the poll must never fail on it */
@@ -395,6 +404,39 @@ export async function runFleetDaemon() {
     warn('could not take the single-instance lock (unwritable ~/.flowviant) — running unguarded');
 
   await preflight({ needGit: true });
+
+  // WARM THE ENV CACHE BEFORE THE FIRST POLL, not on the first roster tick.
+  // `handleRosterEnv` loads it, and `handleRosterEnv` runs AFTER
+  // `processWorkTurns` in the reconcile below — so on the first poll after a
+  // restart a brand-new session worktree was materialized against an EMPTY
+  // bundle, and then never revisited (creation-only, and `needSync` is false
+  // when the cache holds the version the server is already on). The turn ran
+  // with no secrets and nothing said so.
+  //
+  // This is only possible since 0.55.0: the credential store knows which
+  // project this checkout is, so the cache — which is keyed by projectId — can
+  // be found before the server has named anything. A `--fleet`/env token names
+  // no project until the roster does, so it keeps the old lazy path.
+  // Best-effort throughout: a cache miss is the ordinary first-run state.
+  //
+  // GATED ON THE STORE ACTUALLY BEING THE SOURCE. `--fleet` / `FLOWVIANT_FLEET`
+  // OVERRIDE the stored credential (config.mjs), but `CREDENTIAL` is resolved
+  // from the store regardless — so reading its projectId here would decrypt and
+  // materialize project A's cached secrets while this daemon is serving project
+  // B's token. That is the wrong project's plaintext in a worktree, which is
+  // the exact failure the repo binding exists to prevent, arriving by a
+  // different door. An external token names no project until the roster does,
+  // so it keeps the lazy path and loses nothing but one poll.
+  const externalToken =
+    process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+  if (!externalToken && CREDENTIAL?.entry?.projectId) {
+    try {
+      await loadCachedEnv(CREDENTIAL.entry.projectId);
+    } catch {
+      /* no cache, no keypair yet, unreadable home — the roster tick retries */
+    }
+  }
+
   // Kill any preview dev-server/tunnel groups a previously-crashed daemon left
   // running (detached children survive an ungraceful exit) before we start fresh.
   reapOrphanPreviews((m) => info(m));

package/bin/lib/runtimes.mjs

@@ -79,7 +79,16 @@ export function humanizeClaudeTool(name, input = {}, cwd = '') {
     case 'LS':
       return { kind: 'list', label: `ls ${shortPath(input.path ?? '.', cwd)}` };
     case 'Bash':
-      return { kind: 'bash', label: `$ ${oneLine(input.command, 60)}` };
+      // `command` rides beside the display label, VERBATIM (capped): the label
+      // is a 60-char readout for a console and the rail, and truncation is
+      // fine there — but the admin's command audit exists to answer "what
+      // actually ran on our box", and an ellipsis is exactly where the part
+      // that matters would hide.
+      return {
+        kind: 'bash',
+        command: String(input.command ?? '').slice(0, 2000),
+        label: `$ ${oneLine(input.command, 60)}`,
+      };
     default:
       return null; // other tools: silent
   }
@@ -103,7 +112,11 @@ function humanizeCodexItem(item = {}, cwd = '') {
     case 'reasoning':
       return { kind: 'think', label: oneLine(item.text) || 'thinking…' };
     case 'command_execution':
-      return { kind: 'bash', label: `$ ${oneLine(item.command, 60)}` };
+      return {
+        kind: 'bash',
+        command: String(item.command ?? '').slice(0, 2000),
+        label: `$ ${oneLine(item.command, 60)}`,
+      };
     case 'file_change': {
       // `changes` is a list of touched paths; the daemon counts distinct files,
       // so emit one activity per path rather than one for the batch.
@@ -207,7 +220,11 @@ function humanizeAgyTool(name, p = {}, cwd = '') {
     case 'list_dir':
       return { kind: 'list', label: `ls ${shortPath(path, cwd)}` };
     case 'run_command':
-      return { kind: 'bash', label: `$ ${oneLine(p.CommandLine, 60)}` };
+      return {
+        kind: 'bash',
+        command: String(p.CommandLine ?? '').slice(0, 2000),
+        label: `$ ${oneLine(p.CommandLine, 60)}`,
+      };
     case 'call_mcp_tool':
       return { kind: 'tool', label: `mcp.${p.ToolName ?? ''}` };
     default:

package/bin/lib/update.mjs

@@ -59,7 +59,17 @@ function reexec(teardown) {
   }
   const child = spawn(process.execPath, process.argv.slice(1), {
     stdio: 'inherit',
-    env: process.env,
+    // MARK THE CHILD AS A RESTART, not as a person typing `flowviant`.
+    // stdio is inherited, so the child sees two TTYs and believes a human is
+    // watching — and 0.55.0 asks a one-time binding question on exactly that
+    // signal. An auto-update that lands while nobody is looking would then sit
+    // on `Serve this repo as X? [Y/n]` with the machine dark until someone
+    // walks past. The rule credentials.mjs already states for systemd applies
+    // verbatim here: a RESTART must not hang on a prompt. Skipping the confirm
+    // is not a widening — the daemon serves exactly the credential it was
+    // already serving one second ago, and the question gets asked the next
+    // time a human starts it by hand.
+    env: { ...process.env, FLOWVIANT_REEXEC: '1' },
   });
   child.on('exit', (code) => process.exit(code ?? 0));
 }

package/bin/lib/work.mjs

@@ -48,7 +48,7 @@ import {
   SYSTEM_WORK_PLAIN,
   WORK_TURN_KICKOFF_PLAIN,
 } from './prompts.mjs';
-import { materializeInto, excludeInWorktree, scrub as envScrub } from './env.mjs';
+import { materializeInto, hasMaterialized, excludeInWorktree, scrub as envScrub } from './env.mjs';
 import { detectRuntimes, canRun, recordSkills, RUNTIMES } from './runtimes.mjs';
 import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
@@ -102,6 +102,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
   const DIFF_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/diff-done');
   const PREVIEW_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-claim');
   const PREVIEW_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-done');
+  const SESSION_COMMANDS_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-commands');
   const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
   const workAnswering = new Set(); // turn ids currently queued/running here
   const workAttempts = new Map(); // turn id -> completed runTurn attempts
@@ -899,6 +900,25 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       } catch {
         /* best-effort */
       }
+    } else if (!hasMaterialized(wt)) {
+      // CREATION-ONLY NEEDED A SECOND CONDITION. The rule above is right about
+      // a LIVE directory — its env belongs to the session and re-writing it
+      // mid-flight is not ours to do — but "created" and "ever given a bundle"
+      // are different events, and the gap between them is a whole daemon
+      // restart: `handleRosterEnv` (which warms the encrypted cache) runs
+      // AFTER `processWorkTurns` on the same poll, so a worktree made on the
+      // first turn after a restart was materialized against an EMPTY bundle
+      // and, being neither fresh nor covered by a bundle CHANGE, never
+      // revisited. `materializeInto` now declines to record a pass it made in
+      // ignorance (bundleVersion < 0), so this branch is what retries it —
+      // once, on the next turn, and never again after it succeeds. Idempotent
+      // by construction: identical bodies are not rewritten, so nothing
+      // hot-restarts a dev server the driver is watching.
+      try {
+        materializeInto(wt);
+      } catch {
+        /* best-effort */
+      }
     }
     return { wt, fresh };
   };
@@ -1584,6 +1604,45 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           let seenThreadId = null; // codex's conversation id, off thread.started
           const spawned = []; // this turn's children, for the teardown registry
           const narrator = makeNarrator(job.sessionId, job.id);
+
+          // THE COMMAND AUDIT — every `$ …` the CLI's stream reports, batched
+          // to the server verbatim so an admin can read what actually ran on
+          // this box. Same events the narrator renders and forgets; this is
+          // the durable copy, and it carries ONLY commands — no prose, no
+          // thinking, no file reads (the session stays private; what executed
+          // on the shared machine is the machine's own fact to relay).
+          // Flushed mid-turn every 25 so a long turn is not one giant loss on
+          // a kill, and again at settle. Best-effort: a failed post drops the
+          // batch rather than blocking the turn — the surface says it is the
+          // machine's report, not a syscall trace.
+          const auditBatch = [];
+          const flushAudit = () => {
+            if (auditBatch.length === 0) return;
+            const commands = auditBatch.splice(0, auditBatch.length);
+            void fetch(SESSION_COMMANDS_URL, {
+              method: 'POST',
+              headers: {
+                Authorization: `Bearer ${FLEET_TOKEN}`,
+                'User-Agent': USER_AGENT,
+                'Content-Type': 'application/json',
+              },
+              signal: AbortSignal.timeout(30_000),
+              body: JSON.stringify({
+                sessionId: job.sessionId,
+                turnId: job.id,
+                runtime: rt.id,
+                cwd: dir.wt,
+                commands,
+              }),
+            }).catch(() => {
+              /* best-effort — the audit records what reached it */
+            });
+          };
+          const auditCommand = (a) => {
+            if (a?.kind !== 'bash' || !a.command) return;
+            auditBatch.push({ command: a.command, at: new Date().toISOString() });
+            if (auditBatch.length >= 25) flushAudit();
+          };
           try {
             // Files first, then the message that references them: the agent
             // must be able to open what it is being told about. Only the ones
@@ -1627,7 +1686,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               // posted once. Every line goes to the narrator above, throttled.
               streamJson: true,
               answerFromResult: true,
-              onActivity: (a) => narrator.line(a?.label),
+              onActivity: (a) => {
+                narrator.line(a?.label);
+                auditCommand(a);
+              },
               // What this CLI says it can be asked for by name. Harvested off
               // the init event the stream already carries — no probe, no scan,
               // no extra spawn — and reported on the next roster poll so the
@@ -1683,6 +1745,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             // is cleared server-side at settle — clearing it here would race
             // the settle and blank the tab a beat before the reply lands.
             narrator.stop();
+            flushAudit();
             for (const ch of spawned) workChildren.delete(ch);
             if (lockPath) {
               try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.55.0",
-  "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
+  "version": "0.55.1",
+  "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"