flowviant 0.55.1 → 0.55.3

package/bin/cli.mjs

@@ -237,8 +237,22 @@ if (process.argv[2] === 'env') {
 // auto-updated daemon's child sees two TTYs; without this it would stop on the
 // binding confirm below and the machine would stay dark until somebody typed a
 // key. Same reasoning as the headless case, and the same answer.
-const interactive =
-  Boolean(process.stdin.isTTY && process.stdout.isTTY) && process.env.FLOWVIANT_REEXEC !== '1';
+// `canPrompt()`, not a bare isTTY pair: a BACKGROUNDED job (`flowviant &`) has
+// two TTYs and cannot be asked anything — the first read raises SIGTTIN and the
+// kernel STOPS the process, which is why 0.55.2's timeout did not save it (a
+// stopped process runs no timers). See tty.mjs.
+const { canPrompt, askWithTimeout } = await import('./lib/tty.mjs');
+const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
+
+/** How long the one-time binding confirm waits before serving unbound. A person
+ *  who just typed `flowviant` answers in seconds; anything longer is a restart
+ *  nobody is watching, and the machine must not sit dark for it. */
+const CONFIRM_TIMEOUT_MS = 20_000;
+
+/** The picker's own budget. Longer than the confirm: this one asks you to READ
+ *  a list before answering, and its fallback costs you a start rather than
+ *  costing you a binding. */
+const PICK_TIMEOUT_MS = 60_000;
 const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own
@@ -278,12 +292,22 @@ if (!FLEET_TOKEN) {
     );
     console.log(listLines(choices, creds));
     console.log(`  ${choices.length + 1}. connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`);
-    const rl = (await import('node:readline/promises')).createInterface({
-      input: process.stdin,
-      output: process.stdout,
-    });
-    const raw = (await rl.question(`Which project should this daemon serve? [1-${choices.length + 1}] `)).trim();
-    rl.close();
+    // Bounded like the confirm below, and for the same reason — but silence
+    // means something DIFFERENT here and the difference is load-bearing. There
+    // is a real ambiguity to resolve; serving a guess is the skadooble bug.
+    // So no answer REFUSES, which is exactly what this branch already does
+    // headless, and the message says how to answer without being present.
+    const raw = await askWithTimeout(
+      `Which project should this daemon serve? [1-${choices.length + 1}] `,
+      PICK_TIMEOUT_MS
+    );
+    if (raw === null) {
+      console.error(
+        `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
+          `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
+      );
+      process.exit(1);
+    }
     const n = Number.parseInt(raw, 10);
     if (n === choices.length + 1) await reexecAfterLogin();
     const picked = Number.isInteger(n) ? choices[n - 1] : undefined;
@@ -321,17 +345,37 @@ if (!FLEET_TOKEN) {
   // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
   // yes binds and every later start is silent. This is the exact question
   // whose absence had a calendar checkout serving skadooble.
+  //
+  // AND IT TIMES OUT, because a prompt on a start path is a way for a machine
+  // to go dark. `FLOWVIANT_REEXEC` above covers the restart THIS version
+  // performs, but it cannot cover the one that matters most: the hop that
+  // installs a fixed daemon is spawned by the OLD one, which never sets it.
+  // 0.55.0 → 0.55.1 was exactly that — an auto-update landing unattended would
+  // stop here with the machine serving nothing. A guard that only works once
+  // everyone already has it is not a guard.
+  //
+  // ON TIMEOUT WE SERVE, AND WE DO NOT BIND. Those are two decisions:
+  //  · SERVE, because it is what every version before 0.55.0 did with this
+  //    exact store, so the silent path is the status quo rather than a new
+  //    risk — and a daemon that answers is strictly better than one that does
+  //    not, which is the whole reason this product has exactly one refusal.
+  //  · DO NOT BIND, because binding is the thing the question was FOR. Nobody
+  //    answered, so nothing is cemented; the next human start asks again. That
+  //    keeps the skadooble case fixed for the person who is actually looking,
+  //    which is the only person it could ever have been fixed for.
   const creds = await import('./lib/credentials.mjs');
   const label = creds.projectLabel(CREDENTIAL.entry);
-  const rl = (await import('node:readline/promises')).createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-  const raw = (
-    await rl.question(`This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `)
-  ).trim().toLowerCase();
-  rl.close();
-  if (raw === '' || raw === 'y' || raw === 'yes') {
+  const answered = await askWithTimeout(
+    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `,
+    CONFIRM_TIMEOUT_MS
+  );
+  const raw = answered === null ? null : answered.toLowerCase(); // null = nobody answered
+  if (raw === null) {
+    console.log(
+      `\n  no answer in ${Math.round(CONFIRM_TIMEOUT_MS / 1000)}s — serving ${label} for this run ` +
+        `without tying it to this repo. Run \`flowviant\` here and answer to make it stick.`
+    );
+  } else if (raw === '' || raw === 'y' || raw === 'yes') {
     creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
   } else {
     console.error(

package/bin/lib/install.mjs

@@ -27,17 +27,23 @@ export function addLocalBinToPath() {
   }
 }
 
-/** TTY-guarded y/N. Non-interactive (no TTY) never auto-installs → returns false
- *  so a headless/cron run just prints the manual instructions instead. */
+/** TTY-guarded y/N. Non-interactive never auto-installs → returns false so a
+ *  headless/cron run just prints the manual instructions instead.
+ *
+ *  `canPrompt()` rather than `stdin.isTTY`, and BOUNDED: preflight runs before
+ *  the daemon serves anything, so a question here that cannot be answered is a
+ *  machine that never starts. A backgrounded job has a TTY and cannot be asked
+ *  — the read raises SIGTTIN and the kernel stops the process. Silence is `no`,
+ *  which is already what this returns when nobody is there. */
 export async function promptYesNo(question, defaultYes) {
-  if (!process.stdin.isTTY) return false;
-  const { createInterface } = await import('node:readline');
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise((res) =>
-    rl.question(`${question} ${defaultYes ? '[Y/n]' : '[y/N]'} `, res),
+  const { canPrompt, askWithTimeout } = await import('./tty.mjs');
+  if (!canPrompt()) return false;
+  const answer = await askWithTimeout(
+    `${question} ${defaultYes ? '[Y/n]' : '[y/N]'} `,
+    30_000
   );
-  rl.close();
-  const a = answer.trim().toLowerCase();
+  if (answer === null) return false;
+  const a = answer.toLowerCase();
   if (!a) return defaultYes;
   return a === 'y' || a === 'yes';
 }

package/bin/lib/tty.mjs

@@ -0,0 +1,111 @@
+/**
+ * NO PROMPT ON THE START PATH MAY STOP THE DAEMON.
+ *
+ * This exists because 0.55.2 added a 20-second timeout to the repo-binding
+ * confirm and it did not work in the one case that mattered most. `flowviant &`
+ * from an interactive shell puts the process in a background process group; the
+ * first TTY read raises SIGTTIN (and a TTY write SIGTTOU), whose DEFAULT
+ * disposition is to STOP the process. A stopped process runs no timers, so the
+ * AbortController never fires — the guard was on the wrong side of the thing it
+ * was guarding against. The shell prints `[1]+ Stopped` and nothing else: no
+ * banner, no error, no poll, forever, and `bg` does not rescue it.
+ *
+ * Two independent defences, because either one alone has a hole:
+ *
+ *  1. `canPrompt()` — do not ask at all unless we are the terminal's FOREGROUND
+ *     process group. `stdin.isTTY` is true for a backgrounded job, so it cannot
+ *     answer this on its own; the foreground group is what actually decides
+ *     whether a read will succeed or be signalled.
+ *
+ *  2. `askWithTimeout()` — while asking, install no-op SIGTTIN/SIGTTOU handlers.
+ *     A handler (even an empty one) replaces the default STOP, so a misjudged
+ *     foreground check degrades to a read that fails or hangs — and a hang is
+ *     something the timer can now actually interrupt, because the process is
+ *     still running.
+ *
+ * The detection is best-effort by design and FAILS TOWARDS ASKING: an unknown
+ * platform returns true, because refusing to prompt a human who IS there is a
+ * worse failure than a prompt that times out on its own.
+ */
+
+import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+
+/**
+ * Is this process in the controlling terminal's foreground process group?
+ *
+ * Linux: BOTH numbers come out of one `/proc/self/stat` read — field 5 is our
+ * own `pgrp` and field 8 is `tpgid`, the foreground group of our controlling
+ * terminal. Parsed from AFTER the last ')' because field 2 is the executable
+ * name and may itself contain spaces and parentheses.
+ *
+ * NOT `process.getpgrp()`: it DOES NOT EXIST in Node (verified on 24.16 — it
+ * throws `TypeError: process.getpgrp is not a function`). The first cut of this
+ * file called it, the throw was swallowed by the fail-open catch below, and the
+ * function therefore returned `true` unconditionally — a detector that always
+ * says "yes, a human is here" is not a detector, and only the signal handlers
+ * in `askWithTimeout` were doing any work. Caught by probing this function in
+ * isolation on a real pty; nothing else would have shown it, because the
+ * fallback it degraded to still behaves acceptably.
+ *
+ * Elsewhere: ask `ps` for both. Unknown: assume foreground (see the header).
+ */
+export function inForeground() {
+  try {
+    if (process.platform === 'linux') {
+      const stat = readFileSync('/proc/self/stat', 'utf8');
+      const after = stat.slice(stat.lastIndexOf(')') + 1).trim().split(/\s+/);
+      const pgrp = Number(after[2]); // state ppid PGRP session tty_nr tpgid
+      const tpgid = Number(after[5]);
+      if (!Number.isFinite(tpgid) || !Number.isFinite(pgrp)) return true;
+      if (tpgid <= 0) return true; // no controlling terminal — nothing to be behind
+      return tpgid === pgrp;
+    }
+    const out = execFileSync('ps', ['-o', 'tpgid=,pgid=', '-p', String(process.pid)], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+    }).trim().split(/\s+/);
+    const tpgid = Number(out[0]);
+    const pgrp = Number(out[1]);
+    if (!Number.isFinite(tpgid) || !Number.isFinite(pgrp) || tpgid <= 0) return true;
+    return tpgid === pgrp;
+  } catch {
+    return true;
+  }
+}
+
+/** A human is at this terminal AND can actually be reached by a question. */
+export function canPrompt() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY) && inForeground();
+}
+
+/**
+ * Ask, and come back no matter what. Resolves the trimmed answer, or `null`
+ * when nobody answered within `timeoutMs` — the caller decides what silence
+ * means, because it is not the same answer everywhere (the binding confirm
+ * serves unbound; the project picker refuses, exactly as it does headless).
+ */
+export async function askWithTimeout(query, timeoutMs) {
+  const noop = () => {};
+  // Replacing the DEFAULT disposition is the whole point — an empty handler is
+  // enough, and it is what keeps the timer below able to run at all.
+  process.on('SIGTTIN', noop);
+  process.on('SIGTTOU', noop);
+  const rl = (await import('node:readline/promises')).createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  try {
+    return (await rl.question(query, { signal: ac.signal })).trim();
+  } catch {
+    return null; // aborted, or the read failed because we are not in front
+  } finally {
+    clearTimeout(timer);
+    rl.close();
+    process.off('SIGTTIN', noop);
+    process.off('SIGTTOU', noop);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.55.1",
+  "version": "0.55.3",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {