flowviant 0.63.1 → 0.65.0

package/bin/lib/claude.mjs

@@ -359,6 +359,25 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
     const child = spawn(rt.bin, args, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
+      /**
+       * ITS OWN PROCESS GROUP, so what the agent starts stays attributable.
+       *
+       * Everything the CLI spawns inherits this pgid and KEEPS it through
+       * `nohup` and `setsid` — which is exactly when attribution by descendancy
+       * fails, because reparenting to init breaks the ppid chain the moment a
+       * process becomes long-running. `processes.mjs` reads the group; the
+       * Workbench renders it.
+       *
+       * TEARDOWN IS DELIBERATELY UNCHANGED: `shutdownWork` still SIGTERMs this
+       * CHILD and never the group. Signalling the group would kill the dev
+       * server the driver started every time the daemon restarts — including
+       * on an ordinary auto-update, unattended — which is the outcome the
+       * deleted dev-run supervisor spent a whole registry avoiding. Flowviant
+       * does not manage those processes; it reports them.
+       *
+       * Not `unref`'d: the daemon must still wait on this turn.
+       */
+      detached: true,
       // Only ADDS to the environment (the worker token, for runtimes that read
       // it from there). Never replaces it: the CLI's own credentials live in
       // this environment, and handing it a curated one signs it out.

package/bin/lib/fleet.mjs

@@ -91,8 +91,7 @@ import { repoState } from './repoState.mjs';
 async function fetchRoster(
   haveIds,
   livePreviewSessionIds = [],
-  heldSessionIds = [],
-  liveDevRunSessionIds = []
+  heldSessionIds = []
 ) {
   const url = new URL(FLEET_URL);
   if (haveIds.length) url.searchParams.set('have', haveIds.join(','));
@@ -123,11 +122,6 @@ async function fetchRoster(
   // the server still calls live is a 530 on somebody's phone. Always set, even
   // empty: '' means "serving none", absent would mean "an older daemon".
   url.searchParams.set('pv', livePreviewSessionIds.join(','));
-  // The dev runs this machine is still carrying. Same rule as `pv`: always set,
-  // even empty — '' means "running none", absent would mean "an older daemon",
-  // and a run the server still calls running with nothing behind it is a chip
-  // that says Serving over a dead port.
-  url.searchParams.set('dr', liveDevRunSessionIds.join(','));
   // The sessions this daemon holds a worktree for. Its LEASE on each renews
   // here — one beat, no extra endpoint, and the server can tell "this daemon is
   // still serving that tab" from "it went away" within a reconcile interval
@@ -514,11 +508,6 @@ export async function runFleetDaemon() {
   // Kill any preview dev-server/tunnel groups a previously-crashed daemon left
   // running (detached children survive an ungraceful exit) before we start fresh.
   reapOrphanPreviews((m) => info(m));
-  // Dev servers are ADOPTED rather than reaped when their session is still
-  // live: a self-update or a same-repo takeover leaves them running on purpose,
-  // and the successor must supervise them or the row says running while nothing
-  // owns the process. The activeWorkSessions list is not known yet at startup,
-  // so the first reconcile does the adopting — see `adoptDevRuns`.
 
   // Persistent worktree home (0.9.0) — survives daemon restarts AND reboots,
   // so Ctrl+C mid-task never loses local work. Keyed per repo path.
@@ -642,20 +631,6 @@ export async function runFleetDaemon() {
     // commanded stop.
     //
     // A SAME-REPO TAKEOVER IS DELIBERATELY NOT DISTINGUISHED, and that is a
-    // stated limitation rather than an oversight. The takeover asks the holder
-    // to stand down with SIGTERM, which is byte-for-byte what `systemctl stop`
-    // sends, so this handler cannot tell "another daemon is about to serve this
-    // repo in one second" from "this box is going down". Killing is the safe
-    // reading: the wrong guess in the other direction leaves dev servers
-    // running with nothing supervising them until a reboot. The cost is that
-    // re-running `flowviant` in your own repo restarts the app you were
-    // watching, and the successor's `adoptDevRuns` finds nothing.
-    //
-    // The SELF-UPDATE re-exec — the common unattended case — does NOT reach
-    // teardown, so its runs survive and are adopted, which is the half of
-    // "consistently running" this delivers today. Distinguishing a takeover
-    // would need the successor to mark the lock before it signals.
-    shutdownDevRuns(true);
   };
   process.on('SIGINT', () => {
     console.log('');
@@ -833,11 +808,6 @@ export async function runFleetDaemon() {
     livePreviewIds,
     retirePreviews,
     shutdownPreviews,
-    processDevRunJobs,
-    liveDevRunIds,
-    retireDevRuns,
-    shutdownDevRuns,
-    adoptDevRuns,
     retireWorkSessions,
     reportWorktrees,
     shutdownWork,
@@ -1443,7 +1413,7 @@ export async function runFleetDaemon() {
   for (;;) {
     let roster;
     try {
-      roster = await fetchRoster(buildHave(), livePreviewIds(), heldSessionIds(), liveDevRunIds());
+      roster = await fetchRoster(buildHave(), livePreviewIds(), heldSessionIds());
     } catch (e) {
       if (e.auth) {
         fail(`${e.message} — credential revoked or invalid. Shutting down.`);
@@ -1572,12 +1542,6 @@ export async function runFleetDaemon() {
     // `git worktree remove` would happily pull the directory out from under a
     // running node process, which then serves bytes from open file handles in
     // a directory that no longer exists, with no error anywhere.
-    // ADOPT BEFORE RETIRING. A run left alive by a self-update or a takeover
-    // must be re-attached before the retire pass can decide it is unowned;
-    // doing it the other way round would kill exactly the processes this
-    // feature exists to keep.
-    adoptDevRuns(roster.activeWorkSessions);
-    retireDevRuns(roster.activeWorkSessions);
     // A session another daemon on this credential is serving is NOT a closed
     // tab. Without this the daemon that lost the lease removes the worktree the
     // winner is working in — absence would mean "somebody else won" instead of
@@ -1596,7 +1560,6 @@ export async function runFleetDaemon() {
     // credential are both handed this array, and both opening a tunnel strands
     // a public hostname nobody can settle.
     processPreviewJobs(roster.previewJobs);
-    processDevRunJobs(roster.devRunJobs);
     // …and what the SURVIVING ones hold: branch, ahead-of-base, diffstat.
     // Throttled inside, never awaited — a `git status` the human cannot run
     // themselves from a browser, relayed. After retirement so a directory that

package/bin/lib/placeLock.mjs

@@ -0,0 +1,106 @@
+/**
+ * THE PLACE LOCK — several turns may run in one directory; Flowviant's own git
+ * may not run beside any of them.
+ *
+ * Its own module because it is the only concurrency PRIMITIVE in the daemon and
+ * the only one whose failure mode is invisible: a lock that grants too much
+ * shows up as corrupted work weeks later, and one that grants too little shows
+ * up as "ship did nothing". Inside `createWorkManager` it could not be tested
+ * at all.
+ */
+export function createPlaceLock() {
+/**
+ * THE PLACE LOCK — turns run CONCURRENTLY; Flowviant's own git does not.
+ *
+ * This was `chainFor`, a strict serial queue per place: every turn waited for
+ * the one before it, so two tabs in one directory took turns and — because
+ * every tab's place defaulted to the checkout — no two tabs in the product
+ * ever ran at the same time. The driver's instruction ended it: "i feel like
+ * we shouldnt need to manage parallelism on flowviant, the ai clis should
+ * intrinsictly factor that in."
+ *
+ * It is a READERS-WRITER lock now, and the split is exactly where the
+ * argument lands. A TURN is a READER: several may run in one place at once,
+ * because coordinating two agents editing a tree is their job and they are
+ * better at it than a queue is — measured, three agents on disjoint files
+ * lost nothing across 120 concurrent writes. A SHIP is a WRITER: it folds and
+ * merges with git, in that same directory, and the CLIs cannot coordinate
+ * with it because they do not know it exists. That is the one piece of
+ * concurrency Flowviant still owns, so it is the one piece it still manages.
+ *
+ * WRITER PREFERENCE, deliberately: once a ship is waiting, later turns queue
+ * behind it. Without that a busy place could starve a ship indefinitely, and
+ * "ship it" would appear to do nothing for as long as anybody kept typing.
+ *
+ * THE SHIP SIDE ALSO FIXES A LATENT BUG. Ship used to take `chainFor` on the
+ * SESSION id while turns took it on the PLACE, under a comment claiming a
+ * ship "must not run git in this worktree while a turn's CLI is live in it".
+ * Those are different keys the moment a place is set — which was every tab —
+ * so the two never shared a chain and the guarantee was not held. Both sides
+ * key on the place now.
+ *
+ * The cross-process pid lock (`flowviant-turn.lock`) is UNCHANGED and stays
+ * per-place: it is a crash backstop for an orphaned CLI a dead daemon left
+ * behind, not the parallelism policy. It is more conservative than this lock
+ * — two sessions sharing one place still serialize across processes — which
+ * costs nothing in practice, since a place holds one session unless somebody
+ * deliberately points a second one at it.
+ */
+const placeLocks = new Map(); // placeId -> { readers, writing, waiters: [] }
+
+const pumpPlace = (id) => {
+  const st = placeLocks.get(id);
+  if (!st) return;
+  while (st.waiters.length) {
+    const next = st.waiters[0];
+    if (next.write) {
+      // A writer runs only in a quiet place, and blocks everything behind it.
+      if (st.readers === 0 && !st.writing) {
+        st.waiters.shift();
+        st.writing = true;
+        next.go();
+      }
+      break;
+    }
+    if (st.writing) break;
+    st.waiters.shift();
+    st.readers += 1;
+    next.go();
+  }
+  // Drop the entry when the place goes quiet, so the map cannot grow for the
+  // process lifetime.
+  if (!st.writing && st.readers === 0 && st.waiters.length === 0) placeLocks.delete(id);
+};
+
+/**
+ * Run `fn` holding the place's lock. `write: true` is exclusive.
+ *
+ * `.finally` rather than a try/catch that swallows: one rejected turn must
+ * release the lock but must NOT be turned into a success — the settle
+ * contract above is what guarantees a turn is answered, and hiding a throw
+ * here would let a turn fail silently while holding nothing.
+ */
+const inPlace = async (placeId, write, fn) => {
+  let st = placeLocks.get(placeId);
+  if (!st) {
+    st = { readers: 0, writing: false, waiters: [] };
+    placeLocks.set(placeId, st);
+  }
+  await new Promise((go) => {
+    st.waiters.push({ write, go });
+    pumpPlace(placeId);
+  });
+  try {
+    return await fn();
+  } finally {
+    const cur = placeLocks.get(placeId);
+    if (cur) {
+      if (write) cur.writing = false;
+      else cur.readers = Math.max(0, cur.readers - 1);
+      pumpPlace(placeId);
+    }
+  }
+};
+
+  return { placeLocks, inPlace };
+}

package/bin/lib/processes.mjs

@@ -0,0 +1,202 @@
+/**
+ * WHAT YOUR CLAUDE IS ACTUALLY RUNNING — the processes it started, still alive.
+ *
+ * The Workbench could say what a tab had CHANGED (the diffstat) and what was
+ * LISTENING in it (`listeners.mjs`), and nothing about what it was RUNNING. A
+ * backgrounded watcher — `rbxtsc -w`, `tsc --watch`, `cargo watch` — holds no
+ * socket and touches no file for minutes at a time, so it was invisible from a
+ * browser in a way it never is in a terminal, where you can just look.
+ *
+ * ATTRIBUTED BY PROCESS GROUP, not by working directory, and that choice is the
+ * whole design. Two candidates were weighed:
+ *
+ *   · BY CWD, the rule `listeners.mjs` uses. It answers "what is running in
+ *     this directory", which is the wrong question here — under a shared place
+ *     it sweeps in a teammate's processes and their command lines, and this
+ *     product's standing rule is that a teammate's activity is never surfaced.
+ *   · BY DESCENDANCY, walking ppid. It answers the right question and then
+ *     loses exactly the processes worth showing: `nohup` and `setsid` reparent
+ *     to init, so the long-running watcher drops off the chain the moment it
+ *     becomes long-running.
+ *
+ * A process GROUP survives reparenting. The daemon spawns each turn's CLI
+ * `detached`, which makes it a group leader, and every process the agent starts
+ * inherits that pgid however it is backgrounded. So the group IS "started by
+ * the AI instructed through Flowviant", precisely, and it keeps being that
+ * after the turn ends and the CLI exits — which is when it matters.
+ *
+ * THE GROUP LEADER IS NEVER REPORTED, and this is not tidiness. The CLI is
+ * spawned as `-p <prompt> --append-system-prompt <system>`, so its own argv
+ * holds the driver's entire message and the whole operating contract. Reporting
+ * it would push several kilobytes of prompt through the wire and into a browser
+ * on every sweep. The leader is also not something the agent STARTED — it is
+ * the agent. `pid === pgid` identifies it for free.
+ *
+ * Command lines are SCRUBBED with the project's own secret values before they
+ * leave, the same treatment the activity line and the command audit get, and
+ * capped. Scrubbing catches materialized env secrets; it cannot catch a token
+ * somebody types inline, and nothing here pretends otherwise.
+ *
+ * Linux (including WSL2) reads /proc. macOS shells out to `ps`. Windows reports
+ * NOTHING and says so by returning null — the same three-state rule the rest of
+ * this product keeps, where "looked and found none" is `[]` and "cannot look"
+ * is not the same answer.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync } from 'node:fs';
+import { platform } from 'node:os';
+
+/** A box with more processes than this is not one we walk per sweep. */
+const MAX_PIDS = 4000;
+/** Rows reported per session. A watcher, a dev server and its child is three;
+ *  twenty is somebody's compose stack and the extra rows say nothing. */
+export const MAX_PROCS = 12;
+/** Longest command line relayed. Long enough for `node x.js --flag value`,
+ *  short enough that a pathological argv cannot become the report. */
+const MAX_CMD = 200;
+
+export function processesSupported() {
+  return platform() === 'linux' || platform() === 'darwin';
+}
+
+/**
+ * `pid (comm) state ppid pgrp …` — comm is arbitrary text and CAN contain a
+ * `)`, so the fields are read after the LAST one rather than by splitting the
+ * whole line. A process named `foo) bar` is not hypothetical; it is what
+ * anything that sets its own title can produce.
+ */
+function pgrpOf(pid) {
+  let stat;
+  try {
+    stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+  } catch {
+    return null; // gone between readdir and read — ordinary
+  }
+  const close = stat.lastIndexOf(')');
+  if (close < 0) return null;
+  const rest = stat.slice(close + 1).trim().split(/\s+/);
+  const pgrp = Number(rest[2]);
+  return Number.isInteger(pgrp) && pgrp > 0 ? pgrp : null;
+}
+
+function cmdlineOf(pid) {
+  try {
+    const raw = readFileSync(`/proc/${pid}/cmdline`, 'utf8');
+    const parts = raw.split('\0').filter(Boolean);
+    if (!parts.length) return null; // a kernel thread — no argv at all
+    return parts.join(' ');
+  } catch {
+    return null;
+  }
+}
+
+function scanLinux(pgids) {
+  let pids;
+  try {
+    pids = readdirSync('/proc').filter((d) => /^\d+$/.test(d));
+  } catch {
+    return [];
+  }
+  if (pids.length > MAX_PIDS) pids = pids.slice(0, MAX_PIDS);
+
+  const out = [];
+  for (const raw of pids) {
+    const pid = Number(raw);
+    const pgrp = pgrpOf(raw);
+    if (pgrp === null || !pgids.has(pgrp)) continue;
+    // The CLI itself — its argv is the prompt. See the header.
+    if (pid === pgrp) continue;
+    const cmd = cmdlineOf(raw);
+    if (!cmd) continue;
+    out.push({ pid, pgid: pgrp, cmd });
+  }
+  return out;
+}
+
+function scanDarwin(pgids) {
+  let text;
+  try {
+    text = execFileSync('ps', ['-axo', 'pid=,pgid=,command='], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5000,
+      maxBuffer: 4 * 1024 * 1024,
+    });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const line of text.split('\n')) {
+    const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    const pgid = Number(m[2]);
+    if (!pgids.has(pgid) || pid === pgid) continue;
+    const cmd = m[3].trim();
+    if (cmd) out.push({ pid, pgid, cmd });
+  }
+  return out;
+}
+
+/**
+ * Live processes in any of `pgids`.
+ *
+ * Returns null where the platform cannot answer — never `[]`, which means
+ * "looked, found none" and is a different fact a surface renders differently.
+ */
+export function processesInGroups(pgids, { scrub } = {}) {
+  if (!processesSupported()) return null;
+  const want = pgids instanceof Set ? pgids : new Set(pgids ?? []);
+  if (want.size === 0) return [];
+  const rows = platform() === 'darwin' ? scanDarwin(want) : scanLinux(want);
+  // Oldest first: a pid is monotonic, so the long-running watcher you started
+  // an hour ago sorts above the `sh -c` spawned two seconds ago. Cutting from
+  // the END keeps the durable processes and drops the churn.
+  rows.sort((a, b) => a.pid - b.pid);
+  return rows.slice(0, MAX_PROCS).map((r) => ({
+    pid: r.pid,
+    cmd: String(scrub ? scrub(r.cmd) : r.cmd).slice(0, MAX_CMD),
+  }));
+}
+
+/**
+ * Which of `pgids` still has anything alive in it.
+ *
+ * The caller remembers a pgid per session so a backgrounded process outlives
+ * the turn that started it. That set must be pruned or it grows for the life of
+ * the daemon — and a recycled pgid would eventually attribute a stranger's
+ * process to a tab.
+ */
+export function liveGroups(pgids) {
+  if (!processesSupported()) return new Set(pgids ?? []);
+  const want = pgids instanceof Set ? pgids : new Set(pgids ?? []);
+  if (want.size === 0) return new Set();
+  const alive = new Set();
+  if (platform() === 'darwin') {
+    for (const r of scanDarwin(want)) alive.add(r.pgid);
+    // A group whose only member is its leader is still alive; scanDarwin drops
+    // leaders, so ask the kernel directly for the rest.
+    for (const g of want) {
+      if (alive.has(g)) continue;
+      try {
+        process.kill(g, 0);
+        alive.add(g);
+      } catch {
+        /* gone */
+      }
+    }
+    return alive;
+  }
+  let pids;
+  try {
+    pids = readdirSync('/proc').filter((d) => /^\d+$/.test(d));
+  } catch {
+    return want; // cannot tell — keep what we had rather than forget a live tab
+  }
+  for (const raw of pids) {
+    const pgrp = pgrpOf(raw);
+    if (pgrp !== null && want.has(pgrp)) alive.add(pgrp);
+  }
+  return alive;
+}