flowviant 0.66.0 → 0.68.0

package/bin/lib/fleet.mjs

@@ -319,7 +319,7 @@ async function maybeReportRepoState({ repoRoot, baseRef }) {
   repoStateScanAt = Date.now();
   let payload;
   try {
-    const state = repoState(repoRoot, baseRef);
+    const state = repoState(repoRoot, getBaseRef());
     if (!state) return; // not readable — say nothing rather than say "none"
     payload = JSON.stringify(state);
   } catch {
@@ -399,7 +399,19 @@ export async function runFleetDaemon() {
   console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`machine daemon · v${VERSION}`)}`);
   console.log(`  ${c.dim('──────────────────────────────────────────────')}`);
   const repoRoot = repoRootOrDie();
-  const baseRef = detectBaseRef(repoRoot);
+  /**
+   * WHERE SHIP LANDS. Detected at startup, then OVERRIDDEN by the roster when a
+   * human has chosen one (`projects.baseBranch`).
+   *
+   * A `let` and a getter rather than a const, because the answer can change
+   * while the daemon runs — and because the detected value itself is fragile:
+   * with no `origin/HEAD` set, `detectBaseRef` falls back to
+   * `origin/<whatever was checked out at startup>`, which froze for the life of
+   * the process. A stored value is the fix; this is the wiring that lets it
+   * reach the code that merges.
+   */
+  let baseRef = detectBaseRef(repoRoot);
+  const getBaseRef = () => baseRef;
   info(SAFE ? 'mode   · safe (restricted toolset)' : 'mode   · unattended (skips permission prompts)');
   // WHICH PROJECT, before anything connects — the roster names it again a few
   // seconds later with the server's word, but "which project is this daemon
@@ -815,7 +827,7 @@ export async function runFleetDaemon() {
   } = createWorkManager({
     repoRoot,
     baseDir,
-    baseRef,
+    getBaseRef,
     getMcpUrl: () => mcpUrl,
     getLeaseTtl: () => leaseTtlSeconds,
   });
@@ -1542,6 +1554,20 @@ export async function runFleetDaemon() {
     // `git worktree remove` would happily pull the directory out from under a
     // running node process, which then serves bytes from open file handles in
     // a directory that no longer exists, with no error anywhere.
+    /**
+     * WHERE SHIP LANDS, if a human has chosen. Absence means "you decide" —
+     * the state every daemon was in before this existed, and what an
+     * unconfigured project still means — so it must NOT clear a detection.
+     * Announced on change, because a silent switch of merge target is the one
+     * thing worse than not offering the choice at all.
+     */
+    if (typeof roster.baseBranch === 'string' && roster.baseBranch.trim()) {
+      const want = `origin/${baseBranchName(roster.baseBranch.trim())}`;
+      if (want !== baseRef) {
+        note(`base   · ${want} ${c.dim('(set for this project)')}`);
+        baseRef = want;
+      }
+    }
     // A session another daemon on this credential is serving is NOT a closed
     // tab. Without this the daemon that lost the lease removes the worktree the
     // winner is working in — absence would mean "somebody else won" instead of
@@ -1662,7 +1688,7 @@ export async function runFleetDaemon() {
     // machines). Config report is cheap + dedup'd; jobs are single-flight.
     if (roster.env?.deployAuthorized) {
       void reportDeployConfig(repoRoot);
-      processDeployJobs(roster.deployJobs, { repoRoot, baseRef, myPubB64 });
+      processDeployJobs(roster.deployJobs, { repoRoot, baseRef: getBaseRef(), myPubB64 });
     }
 
     // Stop workers whose agent left the roster (removed in the app).

package/bin/lib/git.mjs

@@ -98,6 +98,32 @@ export function detectBaseRef(repoRoot) {
   } catch {
     /* origin/HEAD not set */
   }
+  /**
+   * NO `origin/HEAD`. Prefer a CONVENTION over an accident.
+   *
+   * This used to fall straight through to `origin/<whatever is checked out
+   * right now>` — which, since the result is computed once at daemon start and
+   * held for the life of the process, meant starting the daemon while you
+   * happened to be on `staging` silently made staging the merge target for
+   * every ship until you restarted. Nothing said so.
+   *
+   * A remote branch actually called `main` or `master` is a far better guess
+   * than the branch you were standing on, and unlike that one it does not
+   * depend on when the process booted. The old behaviour survives as the last
+   * resort, because a repo with neither is a repo where we genuinely have
+   * nothing better.
+   *
+   * The real fix is that a human can now SET it (`projects.baseBranch`), which
+   * overrides all of this. This just stops the unset case being arbitrary.
+   */
+  for (const conventional of ['origin/main', 'origin/master']) {
+    try {
+      git(['rev-parse', '--verify', '--quiet', `refs/remotes/${conventional}`], repoRoot);
+      return conventional;
+    } catch {
+      /* not this one */
+    }
+  }
   try {
     return `origin/${git(['rev-parse', '--abbrev-ref', 'HEAD'], repoRoot)}`;
   } catch {

package/bin/lib/repoState.mjs

@@ -165,6 +165,7 @@ export function repoState(repoRoot, baseRef) {
   const listening = listenersIn(repoRoot);
   const wt = worktrees ?? [];
   const br = branches ?? [];
+  const sessionRows = br.filter((b) => b.session);
   return {
     base: baseRef,
     worktrees: wt.slice(0, MAX_WORKTREES),
@@ -173,7 +174,25 @@ export function repoState(repoRoot, baseRef) {
     // part somebody is actually working in.
     branches: br.slice(0, MAX_BRANCHES),
     branchesTotal: br.length,
-    sessionBranches: br.filter((b) => b.session).length,
+    sessionBranches: sessionRows.length,
+    /**
+     * …AND HOW MANY OF THEM STILL HOLD WORK.
+     *
+     * "40 branches" is meaningful to nobody. "3 branches holding work you
+     * haven't shipped" is meaningful to everybody, and it is the only half of
+     * the count anyone can act on. `ahead` is commits this branch has that base
+     * does not — already measured above by `ahead-behind`, so this costs no
+     * extra git call.
+     *
+     * OMITTED, never guessed, when the measurement is missing: an older git
+     * takes the fallback format in `readBranches` and reports no `ahead` at
+     * all, and a count of zero unshipped branches would then be a claim nobody
+     * measured. Absent means "could not tell"; the surface renders the flat
+     * count instead.
+     */
+    ...(sessionRows.every((b) => typeof b.ahead === 'number')
+      ? { sessionBranchesUnshipped: sessionRows.filter((b) => b.ahead > 0).length }
+      : {}),
     listening,
     // "Nothing is listening" and "this machine cannot look" (Windows, a failed
     // scan) are the same empty array without this — and the second must never

package/bin/lib/shipMerge.mjs

@@ -0,0 +1,132 @@
+import { baseBranchName } from './git.mjs';
+
+/**
+ * CARRY A SHIPPED TIP OUT ONTO BASE AND PUSH IT.
+ *
+ * Through a THROWAWAY DETACHED WORKTREE, which is the whole shape of this: the
+ * merge commit has to be made somewhere, and making it in anybody's checkout
+ * moves a directory somebody is working in. A detached worktree at base is
+ * nobody's, so the merge lands, the push goes, and the directory dies in the
+ * `finally` — on success, on conflict, on throw. It must die, or the next ship
+ * of this session trips over its corpse.
+ *
+ * `--no-ff`, NEVER squash: every delivered card carries commit shas as its
+ * receipts, and squashing would point all of them at commits that no longer
+ * exist on base.
+ *
+ * Two behaviours beyond that, and both arrived with per-person worktrees.
+ */
+export function mergeOutward({
+  tip,
+  count,
+  branch,
+  label,
+  git,
+  gitMerge,
+  repoRoot,
+  tmpDir,
+  baseRef,
+  workingTree,
+  warn,
+}) {
+  const dropTmp = () => {
+    try {
+      git(['worktree', 'remove', '--force', tmpDir], repoRoot);
+    } catch {
+      /* not there — fine */
+    }
+  };
+  const attempt = () => {
+    dropTmp();
+    git(['worktree', 'add', '--detach', tmpDir, baseRef()], repoRoot);
+    gitMerge(
+      ['merge', '--no-ff', tip, '-m', `ship(${label}): ${count} commit${count === 1 ? '' : 's'}`],
+      tmpDir
+    );
+    git(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmpDir);
+  };
+  try {
+    try {
+      attempt();
+    } catch (e) {
+      /**
+       * TWO PEOPLE SHIPPED AT ONCE — retry exactly once.
+       *
+       * Ship takes a write lock on a PLACE, and since every person works in a
+       * directory of their own, two teammates shipping hold two DIFFERENT
+       * locks and nothing serializes them. Both fetch, both merge onto the same
+       * base in their own throwaway, and whoever pushes second is rejected
+       * non-fast-forward. The window is fetch-to-push, and it did not exist
+       * while everyone shared one directory — it arrived with the split.
+       *
+       * WITHOUT THIS the loser is told their ship FAILED, in raw git, over a
+       * race that resolves itself by looking again. That breaks the promise
+       * this path exists to keep: nobody may be left believing their work is
+       * or is not on base when the opposite is true.
+       *
+       * ONCE, not a loop. A second rejection is no longer a race — it is a repo
+       * something else is writing to continuously, and the honest answer there
+       * is the error. The retry re-fetches and rebuilds the throwaway from the
+       * NEW base, so it merges against what the winner just landed rather than
+       * re-pushing a stale merge. The TIP is untouched, so the receipts still
+       * name exactly the same commits.
+       */
+      if (!isRaceRejection(e)) throw e;
+      warn?.('ship: base moved under us — refetching and merging again');
+      try {
+        git(['fetch', 'origin', '--quiet'], repoRoot);
+      } catch {
+        /* offline — the retry fails honestly on the same push */
+      }
+      attempt();
+    }
+    /**
+     * AND BRING THE SHIP PLACE'S OWN BRANCH UP, when that branch IS base.
+     *
+     * Which is every tab belonging to the machine's OPERATOR: their place is
+     * the project folder, and it sits on main. Without this, main is left one
+     * commit behind `origin/main` the instant it ships, because the `--no-ff`
+     * merge exists only on the remote — and `worktreeDiff` computes `behind` as
+     * `HEAD..origin/main` without filtering merges, so the rail immediately
+     * reported "1 new on main since you branched" and listed the operator's OWN
+     * ship commit back to them. That inverts the entire point of that block,
+     * which is to show the one thing a session cannot see from inside itself.
+     *
+     * Safe by construction and never a surprise: ship already required a clean
+     * tree, the fold already moved this same directory under the same exclusive
+     * lock, and `--ff-only` can neither conflict nor write a commit.
+     *
+     * NOBODY ELSE'S CHECKOUT MOVES. A teammate's branch is not base, so this
+     * does nothing for them — and their branch being genuinely behind base is a
+     * fact the rail should keep telling them.
+     */
+    if (workingTree && branch && branch === baseBranchName(baseRef())) {
+      try {
+        git(['fetch', 'origin', '--quiet'], repoRoot);
+        git(['merge', '--ff-only', baseRef()], workingTree);
+      } catch {
+        /* a readout, not the ship — the merge already landed, and the next
+           fold picks this up either way */
+      }
+    }
+  } finally {
+    try {
+      dropTmp();
+      git(['worktree', 'prune'], repoRoot);
+    } catch {
+      /* best effort */
+    }
+  }
+}
+
+/**
+ * Is this push failure a LOST RACE rather than a broken repo?
+ *
+ * Matched on git's own words. Deliberately narrow: anything unrecognised is
+ * rethrown, because retrying an unknown failure is how a real problem gets
+ * reported twice and understood never.
+ */
+export function isRaceRejection(e) {
+  const d = `${e?.stdout ?? ''}\n${e?.stderr ?? ''}\n${e?.message ?? ''}`;
+  return /non-fast-forward|\[rejected\]|fetch first|stale info/i.test(d);
+}

package/bin/lib/shipSweep.mjs

@@ -0,0 +1,59 @@
+import { baseBranchName } from './git.mjs';
+
+/**
+ * RETIRE A BRANCH FLOWVIANT MADE AND FLOWVIANT MERGED.
+ *
+ * NOT PRUNING SOMEBODY'S REPO — removing our own bookkeeping. `session/<id>`
+ * is an artifact this daemon created, named and merged; the driver's work is
+ * the commits, and after a `--no-ff` ship those are on base. The standing law
+ * that the Repository block reports and never prunes is untouched: it was
+ * written for refs of UNKNOWN provenance — a branch the agent cut mid-turn, a
+ * worktree a crash left behind — and this is the one category that is
+ * provably ours.
+ *
+ * WHY IT MATTERS MORE THAN TIDINESS: a reporting surface only works if what
+ * it reports is rare. Every merged session branch used to accumulate forever,
+ * so "is claude polluting the branches" could not be answered from a list
+ * dominated by our own litter. Stop littering and what remains is worth
+ * reading.
+ *
+ * `git branch -d` IS THE GUARD, deliberately, rather than a stack of checks
+ * of our own. It refuses an UNMERGED branch and it refuses one CHECKED OUT in
+ * any worktree — which are two of the three conditions, enforced by the tool
+ * that owns the truth instead of by our reading of it. Never `-D`: if git
+ * objects, git is right and we stop. The third condition is ours and is the
+ * name: only `session/<id>` exactly, so a branch the agent cut is never in
+ * scope no matter what it was merged into.
+ *
+ * ORDERING IS LOAD-BEARING. This must not run while a ship report is still
+ * undelivered. Ship's idempotency path recovers from a lost report by asking
+ * `branchExists && ancestorOfBase(branch)`; with the branch gone a re-offered
+ * job answers "nothing to ship — this session has no branch on this machine"
+ * for work that shipped, and the server's reconciliation backstop silently
+ * never books the commits no card claimed.
+ *
+ * Local only. Ship pushes base and has never pushed `session/*`, so there is
+ * nothing to clean on a remote.
+ */
+export function sweepMergedBranch(sessionId, { git, repoRoot, baseRef, note, isReportPending }) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(String(sessionId ?? ''))) return false;
+  // The report has not landed. See ORDERING above.
+  if (isReportPending?.(sessionId)) return false;
+  const name = `session/${sessionId}`;
+  try {
+    git(['rev-parse', '--verify', '--quiet', `refs/heads/${name}`], repoRoot);
+  } catch {
+    return false; // already gone, or never existed
+  }
+  try {
+    git(['branch', '-d', name], repoRoot);
+  } catch {
+    // Unmerged, or checked out somewhere. Both are correct reasons to keep it,
+    // and both are git's answer rather than ours.
+    return false;
+  }
+  // NARRATED, like every other sweep: a deletion with no trace in the log
+  // cannot be diagnosed from either end.
+  note?.(`retired ${name} — already merged into ${baseBranchName(baseRef)}`);
+  return true;
+}

package/bin/lib/work.mjs

@@ -42,6 +42,8 @@ import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.
 import { listenersIn, listenersSupported } from './listeners.mjs';
 import { processesInGroups, liveGroups, processesSupported } from './processes.mjs';
 import { createPlaceLock } from './placeLock.mjs';
+import { sweepMergedBranch } from './shipSweep.mjs';
+import { mergeOutward as shipMergeOutward } from './shipMerge.mjs';
 import { openTunnel } from './preview.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
@@ -100,7 +102,18 @@ function brainFor(job) {
   return out;
 }
 
-export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
+export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, getLeaseTtl }) {
+  /**
+   * WHERE SHIP LANDS, read fresh every time rather than captured at startup.
+   *
+   * A getter, like `getMcpUrl` and `getLeaseTtl` beside it, because the answer
+   * can now change while the daemon runs: a human sets `projects.baseBranch`
+   * and the next roster poll carries it. Captured by value this would be
+   * whatever `origin/HEAD` said the moment the process booted — which is also
+   * the shape of the bug it replaces, where an unset `origin/HEAD` froze
+   * `origin/<branch you happened to be on>` for the life of the daemon.
+   */
+  const baseRef = () => getBaseRef();
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
   const WORK_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-turn-done');
   const SHIP_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/ship-done');
@@ -227,6 +240,9 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     } else {
       pendingShipReports.delete(sessionId);
       reportBackoff.delete(sessionId);
+      // The report has landed, so the idempotency path no longer needs the
+      // branch to exist. See `sweepMergedSessionBranch`.
+      sweepMergedSessionBranch(sessionId);
     }
     return r;
   };
@@ -423,7 +439,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     const place = placeOf(sessionId);
     if (place !== REPO_PLACE && !isSafePathSegment(place)) return null;
     const wt = placeDir(sessionId);
-    const d = worktreeDiff(wt, baseRef);
+    const d = worktreeDiff(wt, baseRef());
     if (!d) return null;
     // WHAT IS LISTENING in this worktree, attributed by the CWD of the process
     // holding the socket. It rides the sweep the daemon already makes rather
@@ -972,6 +988,10 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
         else if (r !== 'retry') {
           pendingShipReports.delete(id);
           reportBackoff.delete(id);
+          // Delivered late is still delivered — same sweep as the immediate
+          // path, and it must be here too or a report that needed a retry
+          // would leave its branch behind forever.
+          sweepMergedSessionBranch(id);
         }
       }
     } finally {
@@ -1071,7 +1091,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       // would hand it a repo state it has never seen. Everything else is
       // unchanged, the attach fallback included: a surviving branch already
       // chose its base, and re-basing it here would move committed work.
-      const at = baseAt || baseRef;
+      const at = baseAt || baseRef();
       try {
         git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
       } catch {
@@ -1442,6 +1462,18 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    *  session's own id IS its default place. */
   const sessionWtFor = (sessionId, baseAt) => placeWtFor(sessionId, baseAt);
 
+  /** See `shipSweep.mjs`. Bound to this manager's repo, base and report queue. */
+  const sweepMergedSessionBranch = (sessionId) =>
+    sweepMergedBranch(sessionId, {
+      git,
+      repoRoot,
+      baseRef: baseRef(),
+      note,
+      // The report queue is consulted at CALL time, never captured — a sweep
+      // scheduled while a report was outstanding must still see it land.
+      isReportPending: (id) => pendingShipReports.has(id),
+    });
+
   const retireWorkSessions = (activeIds, heldElsewhere) => {
     if (!Array.isArray(activeIds)) return;
     // Sessions ANOTHER daemon on this credential is serving. They are absent
@@ -1479,9 +1511,15 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
         // it, closed tab or not. (The non-force remove would refuse anyway;
         // the explicit check keeps the intent legible.)
         if (git(['status', '--porcelain'], wt) !== '') continue;
-        git(['worktree', 'remove', wt], repoRoot); // non-force; the branch survives
+        git(['worktree', 'remove', wt], repoRoot); // non-force
         workTokens.delete(id);
         removed++;
+        // NOW the branch can be judged. While this worktree existed the branch
+        // was checked out in it, so `git branch -d` refused on every earlier
+        // attempt — a tab that shipped and then closed would otherwise leave
+        // its merged branch behind forever, which is the common case.
+        // Unshipped work still refuses here: `-d` is what decides.
+        sweepMergedSessionBranch(id);
       } catch {
         /* not cleanly removable — leave it */
       }
@@ -2191,7 +2229,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           }
           const ancestorOfBase = (ref) => {
             try {
-              git(['merge-base', '--is-ancestor', ref, baseRef], repoRoot);
+              git(['merge-base', '--is-ancestor', ref, baseRef()], repoRoot);
               return true;
             } catch {
               return false;
@@ -2232,35 +2270,23 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // Merge outward through a throwaway worktree so no checkout moves.
           // The throwaway dies on EVERY exit — success, conflict or throw —
           // or the next ship of this session trips over its corpse.
-          const mergeOutward = (tip, count) => {
-            const tmp = join(baseDir, 'ship', job.sessionId);
-            try {
-              try {
-                git(['worktree', 'remove', '--force', tmp], repoRoot);
-              } catch {
-                /* not there — fine */
-              }
-              git(['worktree', 'add', '--detach', tmp, baseRef], repoRoot);
-              gitMerge(
-                [
-                  'merge',
-                  '--no-ff',
-                  tip,
-                  '-m',
-                  `ship(${job.sessionName || job.sessionId.slice(0, 8)}): ${count} commit${count === 1 ? '' : 's'}`,
-                ],
-                tmp
-              );
-              git(['push', 'origin', `HEAD:${baseBranchName(baseRef)}`], tmp);
-            } finally {
-              try {
-                git(['worktree', 'remove', '--force', tmp], repoRoot);
-                git(['worktree', 'prune'], repoRoot);
-              } catch {
-                /* best effort */
-              }
-            }
-          };
+          // Carry the tip out onto base and push it. See `shipMerge.mjs` for
+          // the throwaway-worktree shape, the one retry when two people ship at
+          // once, and why the operator's own branch is fast-forwarded after.
+          const mergeOutward = (tip, count) =>
+            shipMergeOutward({
+              tip,
+              count,
+              branch,
+              label: job.sessionName || job.sessionId.slice(0, 8),
+              git,
+              gitMerge,
+              repoRoot,
+              tmpDir: join(baseDir, 'ship', job.sessionId),
+              baseRef,
+              workingTree: placeWtFor(shipPlace)?.wt ?? null,
+              warn,
+            });
           // Idempotency: base already contains the branch tip. A re-offered
           // job after a lost report lands here — never a re-merge, and never
           // "nothing to ship" AS A FAILURE for work that in fact shipped. The
@@ -2272,7 +2298,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             const tip = git(['rev-parse', branch], repoRoot);
             let commits = [];
             try {
-              const m = git(['log', baseRef, '--merges', '--format=%H %P', '-n', '500'], repoRoot)
+              const m = git(['log', baseRef(), '--merges', '--format=%H %P', '-n', '500'], repoRoot)
                 .split('\n')
                 .map((l) => l.trim().split(' '))
                 .find((p) => p.length >= 3 && p[2] === tip);
@@ -2283,7 +2309,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             await done({
               ok: true,
               commits,
-              note: `${baseBranchName(baseRef)} already contains this session's branch — nothing new to merge`,
+              note: `${baseBranchName(baseRef())} already contains this session's branch — nothing new to merge`,
             });
             ok(`${c.cyan('ship')} ${c.dim('— already on main; nothing new to merge')}`);
             return;
@@ -2301,7 +2327,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               return;
             }
             const tip = git(['rev-parse', branch], repoRoot);
-            const commits = logCommits(`${baseRef}..${tip}`);
+            const commits = logCommits(`${baseRef()}..${tip}`);
             if (commits.length === 0) {
               await done({
                 ok: false,
@@ -2369,7 +2395,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // Fold main into the branch FIRST: conflicts land here, in the
           // session's own worktree, where the next turn can resolve them.
           try {
-            gitMerge(['merge', '--no-edit', baseRef], dir.wt);
+            gitMerge(['merge', '--no-edit', baseRef()], dir.wt);
           } catch (e) {
             const detail = `${e?.stdout ?? ''}\n${e?.stderr ?? ''}\n${e?.message ?? ''}`;
             // NEVER leave the session mid-merge: a MERGE_HEAD left behind puts
@@ -2400,7 +2426,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // one X for both, so the ledger can never carry receipts for commits
           // that did not land.
           const tip = git(['rev-parse', branch], repoRoot);
-          const commits = logCommits(`${baseRef}..${tip}`);
+          const commits = logCommits(`${baseRef()}..${tip}`);
           if (commits.length === 0) {
             // Post-fold this is nearly unreachable (a zero-commit branch is an
             // ancestor of base, settled above) — but if the branch's commits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.66.0",
+  "version": "0.68.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {