flowviant 0.66.0 → 0.67.0

package/bin/lib/fleet.mjs

@@ -319,7 +319,7 @@ async function maybeReportRepoState({ repoRoot, baseRef }) {
   repoStateScanAt = Date.now();
   let payload;
   try {
-    const state = repoState(repoRoot, baseRef);
+    const state = repoState(repoRoot, getBaseRef());
     if (!state) return; // not readable — say nothing rather than say "none"
     payload = JSON.stringify(state);
   } catch {
@@ -399,7 +399,19 @@ export async function runFleetDaemon() {
   console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`machine daemon · v${VERSION}`)}`);
   console.log(`  ${c.dim('──────────────────────────────────────────────')}`);
   const repoRoot = repoRootOrDie();
-  const baseRef = detectBaseRef(repoRoot);
+  /**
+   * WHERE SHIP LANDS. Detected at startup, then OVERRIDDEN by the roster when a
+   * human has chosen one (`projects.baseBranch`).
+   *
+   * A `let` and a getter rather than a const, because the answer can change
+   * while the daemon runs — and because the detected value itself is fragile:
+   * with no `origin/HEAD` set, `detectBaseRef` falls back to
+   * `origin/<whatever was checked out at startup>`, which froze for the life of
+   * the process. A stored value is the fix; this is the wiring that lets it
+   * reach the code that merges.
+   */
+  let baseRef = detectBaseRef(repoRoot);
+  const getBaseRef = () => baseRef;
   info(SAFE ? 'mode   · safe (restricted toolset)' : 'mode   · unattended (skips permission prompts)');
   // WHICH PROJECT, before anything connects — the roster names it again a few
   // seconds later with the server's word, but "which project is this daemon
@@ -815,7 +827,7 @@ export async function runFleetDaemon() {
   } = createWorkManager({
     repoRoot,
     baseDir,
-    baseRef,
+    getBaseRef,
     getMcpUrl: () => mcpUrl,
     getLeaseTtl: () => leaseTtlSeconds,
   });
@@ -1542,6 +1554,20 @@ export async function runFleetDaemon() {
     // `git worktree remove` would happily pull the directory out from under a
     // running node process, which then serves bytes from open file handles in
     // a directory that no longer exists, with no error anywhere.
+    /**
+     * WHERE SHIP LANDS, if a human has chosen. Absence means "you decide" —
+     * the state every daemon was in before this existed, and what an
+     * unconfigured project still means — so it must NOT clear a detection.
+     * Announced on change, because a silent switch of merge target is the one
+     * thing worse than not offering the choice at all.
+     */
+    if (typeof roster.baseBranch === 'string' && roster.baseBranch.trim()) {
+      const want = `origin/${baseBranchName(roster.baseBranch.trim())}`;
+      if (want !== baseRef) {
+        note(`base   · ${want} ${c.dim('(set for this project)')}`);
+        baseRef = want;
+      }
+    }
     // A session another daemon on this credential is serving is NOT a closed
     // tab. Without this the daemon that lost the lease removes the worktree the
     // winner is working in — absence would mean "somebody else won" instead of
@@ -1662,7 +1688,7 @@ export async function runFleetDaemon() {
     // machines). Config report is cheap + dedup'd; jobs are single-flight.
     if (roster.env?.deployAuthorized) {
       void reportDeployConfig(repoRoot);
-      processDeployJobs(roster.deployJobs, { repoRoot, baseRef, myPubB64 });
+      processDeployJobs(roster.deployJobs, { repoRoot, baseRef: getBaseRef(), myPubB64 });
     }
 
     // Stop workers whose agent left the roster (removed in the app).

package/bin/lib/git.mjs

@@ -98,6 +98,32 @@ export function detectBaseRef(repoRoot) {
   } catch {
     /* origin/HEAD not set */
   }
+  /**
+   * NO `origin/HEAD`. Prefer a CONVENTION over an accident.
+   *
+   * This used to fall straight through to `origin/<whatever is checked out
+   * right now>` — which, since the result is computed once at daemon start and
+   * held for the life of the process, meant starting the daemon while you
+   * happened to be on `staging` silently made staging the merge target for
+   * every ship until you restarted. Nothing said so.
+   *
+   * A remote branch actually called `main` or `master` is a far better guess
+   * than the branch you were standing on, and unlike that one it does not
+   * depend on when the process booted. The old behaviour survives as the last
+   * resort, because a repo with neither is a repo where we genuinely have
+   * nothing better.
+   *
+   * The real fix is that a human can now SET it (`projects.baseBranch`), which
+   * overrides all of this. This just stops the unset case being arbitrary.
+   */
+  for (const conventional of ['origin/main', 'origin/master']) {
+    try {
+      git(['rev-parse', '--verify', '--quiet', `refs/remotes/${conventional}`], repoRoot);
+      return conventional;
+    } catch {
+      /* not this one */
+    }
+  }
   try {
     return `origin/${git(['rev-parse', '--abbrev-ref', 'HEAD'], repoRoot)}`;
   } catch {

package/bin/lib/repoState.mjs

@@ -165,6 +165,7 @@ export function repoState(repoRoot, baseRef) {
   const listening = listenersIn(repoRoot);
   const wt = worktrees ?? [];
   const br = branches ?? [];
+  const sessionRows = br.filter((b) => b.session);
   return {
     base: baseRef,
     worktrees: wt.slice(0, MAX_WORKTREES),
@@ -173,7 +174,25 @@ export function repoState(repoRoot, baseRef) {
     // part somebody is actually working in.
     branches: br.slice(0, MAX_BRANCHES),
     branchesTotal: br.length,
-    sessionBranches: br.filter((b) => b.session).length,
+    sessionBranches: sessionRows.length,
+    /**
+     * …AND HOW MANY OF THEM STILL HOLD WORK.
+     *
+     * "40 branches" is meaningful to nobody. "3 branches holding work you
+     * haven't shipped" is meaningful to everybody, and it is the only half of
+     * the count anyone can act on. `ahead` is commits this branch has that base
+     * does not — already measured above by `ahead-behind`, so this costs no
+     * extra git call.
+     *
+     * OMITTED, never guessed, when the measurement is missing: an older git
+     * takes the fallback format in `readBranches` and reports no `ahead` at
+     * all, and a count of zero unshipped branches would then be a claim nobody
+     * measured. Absent means "could not tell"; the surface renders the flat
+     * count instead.
+     */
+    ...(sessionRows.every((b) => typeof b.ahead === 'number')
+      ? { sessionBranchesUnshipped: sessionRows.filter((b) => b.ahead > 0).length }
+      : {}),
     listening,
     // "Nothing is listening" and "this machine cannot look" (Windows, a failed
     // scan) are the same empty array without this — and the second must never

package/bin/lib/shipSweep.mjs

@@ -0,0 +1,59 @@
+import { baseBranchName } from './git.mjs';
+
+/**
+ * RETIRE A BRANCH FLOWVIANT MADE AND FLOWVIANT MERGED.
+ *
+ * NOT PRUNING SOMEBODY'S REPO — removing our own bookkeeping. `session/<id>`
+ * is an artifact this daemon created, named and merged; the driver's work is
+ * the commits, and after a `--no-ff` ship those are on base. The standing law
+ * that the Repository block reports and never prunes is untouched: it was
+ * written for refs of UNKNOWN provenance — a branch the agent cut mid-turn, a
+ * worktree a crash left behind — and this is the one category that is
+ * provably ours.
+ *
+ * WHY IT MATTERS MORE THAN TIDINESS: a reporting surface only works if what
+ * it reports is rare. Every merged session branch used to accumulate forever,
+ * so "is claude polluting the branches" could not be answered from a list
+ * dominated by our own litter. Stop littering and what remains is worth
+ * reading.
+ *
+ * `git branch -d` IS THE GUARD, deliberately, rather than a stack of checks
+ * of our own. It refuses an UNMERGED branch and it refuses one CHECKED OUT in
+ * any worktree — which are two of the three conditions, enforced by the tool
+ * that owns the truth instead of by our reading of it. Never `-D`: if git
+ * objects, git is right and we stop. The third condition is ours and is the
+ * name: only `session/<id>` exactly, so a branch the agent cut is never in
+ * scope no matter what it was merged into.
+ *
+ * ORDERING IS LOAD-BEARING. This must not run while a ship report is still
+ * undelivered. Ship's idempotency path recovers from a lost report by asking
+ * `branchExists && ancestorOfBase(branch)`; with the branch gone a re-offered
+ * job answers "nothing to ship — this session has no branch on this machine"
+ * for work that shipped, and the server's reconciliation backstop silently
+ * never books the commits no card claimed.
+ *
+ * Local only. Ship pushes base and has never pushed `session/*`, so there is
+ * nothing to clean on a remote.
+ */
+export function sweepMergedBranch(sessionId, { git, repoRoot, baseRef, note, isReportPending }) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(String(sessionId ?? ''))) return false;
+  // The report has not landed. See ORDERING above.
+  if (isReportPending?.(sessionId)) return false;
+  const name = `session/${sessionId}`;
+  try {
+    git(['rev-parse', '--verify', '--quiet', `refs/heads/${name}`], repoRoot);
+  } catch {
+    return false; // already gone, or never existed
+  }
+  try {
+    git(['branch', '-d', name], repoRoot);
+  } catch {
+    // Unmerged, or checked out somewhere. Both are correct reasons to keep it,
+    // and both are git's answer rather than ours.
+    return false;
+  }
+  // NARRATED, like every other sweep: a deletion with no trace in the log
+  // cannot be diagnosed from either end.
+  note?.(`retired ${name} — already merged into ${baseBranchName(baseRef)}`);
+  return true;
+}

package/bin/lib/work.mjs

@@ -42,6 +42,7 @@ import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.
 import { listenersIn, listenersSupported } from './listeners.mjs';
 import { processesInGroups, liveGroups, processesSupported } from './processes.mjs';
 import { createPlaceLock } from './placeLock.mjs';
+import { sweepMergedBranch } from './shipSweep.mjs';
 import { openTunnel } from './preview.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
@@ -100,7 +101,18 @@ function brainFor(job) {
   return out;
 }
 
-export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
+export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, getLeaseTtl }) {
+  /**
+   * WHERE SHIP LANDS, read fresh every time rather than captured at startup.
+   *
+   * A getter, like `getMcpUrl` and `getLeaseTtl` beside it, because the answer
+   * can now change while the daemon runs: a human sets `projects.baseBranch`
+   * and the next roster poll carries it. Captured by value this would be
+   * whatever `origin/HEAD` said the moment the process booted — which is also
+   * the shape of the bug it replaces, where an unset `origin/HEAD` froze
+   * `origin/<branch you happened to be on>` for the life of the daemon.
+   */
+  const baseRef = () => getBaseRef();
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
   const WORK_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-turn-done');
   const SHIP_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/ship-done');
@@ -227,6 +239,9 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     } else {
       pendingShipReports.delete(sessionId);
       reportBackoff.delete(sessionId);
+      // The report has landed, so the idempotency path no longer needs the
+      // branch to exist. See `sweepMergedSessionBranch`.
+      sweepMergedSessionBranch(sessionId);
     }
     return r;
   };
@@ -423,7 +438,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     const place = placeOf(sessionId);
     if (place !== REPO_PLACE && !isSafePathSegment(place)) return null;
     const wt = placeDir(sessionId);
-    const d = worktreeDiff(wt, baseRef);
+    const d = worktreeDiff(wt, baseRef());
     if (!d) return null;
     // WHAT IS LISTENING in this worktree, attributed by the CWD of the process
     // holding the socket. It rides the sweep the daemon already makes rather
@@ -972,6 +987,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
         else if (r !== 'retry') {
           pendingShipReports.delete(id);
           reportBackoff.delete(id);
+          // Delivered late is still delivered — same sweep as the immediate
+          // path, and it must be here too or a report that needed a retry
+          // would leave its branch behind forever.
+          sweepMergedSessionBranch(id);
         }
       }
     } finally {
@@ -1071,7 +1090,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       // would hand it a repo state it has never seen. Everything else is
       // unchanged, the attach fallback included: a surviving branch already
       // chose its base, and re-basing it here would move committed work.
-      const at = baseAt || baseRef;
+      const at = baseAt || baseRef();
       try {
         git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
       } catch {
@@ -1442,6 +1461,18 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    *  session's own id IS its default place. */
   const sessionWtFor = (sessionId, baseAt) => placeWtFor(sessionId, baseAt);
 
+  /** See `shipSweep.mjs`. Bound to this manager's repo, base and report queue. */
+  const sweepMergedSessionBranch = (sessionId) =>
+    sweepMergedBranch(sessionId, {
+      git,
+      repoRoot,
+      baseRef: baseRef(),
+      note,
+      // The report queue is consulted at CALL time, never captured — a sweep
+      // scheduled while a report was outstanding must still see it land.
+      isReportPending: (id) => pendingShipReports.has(id),
+    });
+
   const retireWorkSessions = (activeIds, heldElsewhere) => {
     if (!Array.isArray(activeIds)) return;
     // Sessions ANOTHER daemon on this credential is serving. They are absent
@@ -1479,9 +1510,15 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
         // it, closed tab or not. (The non-force remove would refuse anyway;
         // the explicit check keeps the intent legible.)
         if (git(['status', '--porcelain'], wt) !== '') continue;
-        git(['worktree', 'remove', wt], repoRoot); // non-force; the branch survives
+        git(['worktree', 'remove', wt], repoRoot); // non-force
         workTokens.delete(id);
         removed++;
+        // NOW the branch can be judged. While this worktree existed the branch
+        // was checked out in it, so `git branch -d` refused on every earlier
+        // attempt — a tab that shipped and then closed would otherwise leave
+        // its merged branch behind forever, which is the common case.
+        // Unshipped work still refuses here: `-d` is what decides.
+        sweepMergedSessionBranch(id);
       } catch {
         /* not cleanly removable — leave it */
       }
@@ -2191,7 +2228,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           }
           const ancestorOfBase = (ref) => {
             try {
-              git(['merge-base', '--is-ancestor', ref, baseRef], repoRoot);
+              git(['merge-base', '--is-ancestor', ref, baseRef()], repoRoot);
               return true;
             } catch {
               return false;
@@ -2240,7 +2277,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               } catch {
                 /* not there — fine */
               }
-              git(['worktree', 'add', '--detach', tmp, baseRef], repoRoot);
+              git(['worktree', 'add', '--detach', tmp, baseRef()], repoRoot);
               gitMerge(
                 [
                   'merge',
@@ -2251,7 +2288,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
                 ],
                 tmp
               );
-              git(['push', 'origin', `HEAD:${baseBranchName(baseRef)}`], tmp);
+              git(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmp);
             } finally {
               try {
                 git(['worktree', 'remove', '--force', tmp], repoRoot);
@@ -2272,7 +2309,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             const tip = git(['rev-parse', branch], repoRoot);
             let commits = [];
             try {
-              const m = git(['log', baseRef, '--merges', '--format=%H %P', '-n', '500'], repoRoot)
+              const m = git(['log', baseRef(), '--merges', '--format=%H %P', '-n', '500'], repoRoot)
                 .split('\n')
                 .map((l) => l.trim().split(' '))
                 .find((p) => p.length >= 3 && p[2] === tip);
@@ -2283,7 +2320,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             await done({
               ok: true,
               commits,
-              note: `${baseBranchName(baseRef)} already contains this session's branch — nothing new to merge`,
+              note: `${baseBranchName(baseRef())} already contains this session's branch — nothing new to merge`,
             });
             ok(`${c.cyan('ship')} ${c.dim('— already on main; nothing new to merge')}`);
             return;
@@ -2301,7 +2338,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               return;
             }
             const tip = git(['rev-parse', branch], repoRoot);
-            const commits = logCommits(`${baseRef}..${tip}`);
+            const commits = logCommits(`${baseRef()}..${tip}`);
             if (commits.length === 0) {
               await done({
                 ok: false,
@@ -2369,7 +2406,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // Fold main into the branch FIRST: conflicts land here, in the
           // session's own worktree, where the next turn can resolve them.
           try {
-            gitMerge(['merge', '--no-edit', baseRef], dir.wt);
+            gitMerge(['merge', '--no-edit', baseRef()], dir.wt);
           } catch (e) {
             const detail = `${e?.stdout ?? ''}\n${e?.stderr ?? ''}\n${e?.message ?? ''}`;
             // NEVER leave the session mid-merge: a MERGE_HEAD left behind puts
@@ -2400,7 +2437,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // one X for both, so the ledger can never carry receipts for commits
           // that did not land.
           const tip = git(['rev-parse', branch], repoRoot);
-          const commits = logCommits(`${baseRef}..${tip}`);
+          const commits = logCommits(`${baseRef()}..${tip}`);
           if (commits.length === 0) {
             // Post-fold this is nearly unreachable (a zero-commit branch is an
             // ancestor of base, settled above) — but if the branch's commits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {