flowviant 0.67.0 → 0.69.0

package/bin/lib/runtimes.mjs

@@ -337,17 +337,31 @@ export const RUNTIMES = {
      * strongest form of it available anywhere: `--append-system-prompt` sits
      * above the conversation rather than inside it.
      */
-    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
+    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId }) {
       const a = [];
-      // ADOPTION — the first turn of a tab born from a terminal session.
-      // `--resume <id> --fork-session` finds the session globally (any cwd),
-      // carries its full context, and writes the FORK natively into THIS cwd's
-      // own store, leaving the original transcript untouched (measured on
-      // 2.1.234). From turn 2 on the plain `--continue` below resumes the fork
-      // where it now lives, so nothing downstream knows the tab was adopted.
-      // INSTEAD of --continue, never alongside it: they are the same decision
-      // ("what conversation is this?") answered two different ways.
+      // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
+      // are mutually exclusive, never combined.
+      //
+      // ADOPTION: `--resume <id> --fork-session` finds the session globally
+      // (any cwd), carries its full context, and writes the FORK natively into
+      // THIS cwd's own store, leaving the original transcript untouched
+      // (measured on 2.1.234).
+      //
+      // BY ID: the conversation THIS TAB spoke under last time, learned from
+      // the CLI's own `system.init` event and pinned per session. It exists
+      // because `--continue` is CWD-KEYED, and a directory stopped being one
+      // tab the day tabs moved into their driver's project folder — two tabs
+      // sharing a directory both said `--continue` and both resumed whichever
+      // conversation spoke most recently there, so tab B inherited tab A's
+      // entire context and every turn after that ping-ponged between them.
+      // Exactly the failure codex's own note warns about for `resume --last`,
+      // arriving for Claude by a different route. An id is unambiguous wherever
+      // the tab is standing.
+      //
+      // `--continue` is the LAST resort, and only where nothing better is
+      // known.
       if (adoptResumeId) a.push('--resume', adoptResumeId, '--fork-session');
+      else if (resumeThreadId) a.push('--resume', resumeThreadId);
       else if (resume) a.push('--continue');
       a.push('-p', prompt, '--append-system-prompt', system);
       a.push(...mcp, ...resultSchemaArgs);

package/bin/lib/shipMerge.mjs

@@ -0,0 +1,132 @@
+import { baseBranchName } from './git.mjs';
+
+/**
+ * CARRY A SHIPPED TIP OUT ONTO BASE AND PUSH IT.
+ *
+ * Through a THROWAWAY DETACHED WORKTREE, which is the whole shape of this: the
+ * merge commit has to be made somewhere, and making it in anybody's checkout
+ * moves a directory somebody is working in. A detached worktree at base is
+ * nobody's, so the merge lands, the push goes, and the directory dies in the
+ * `finally` — on success, on conflict, on throw. It must die, or the next ship
+ * of this session trips over its corpse.
+ *
+ * `--no-ff`, NEVER squash: every delivered card carries commit shas as its
+ * receipts, and squashing would point all of them at commits that no longer
+ * exist on base.
+ *
+ * Two behaviours beyond that, and both arrived with per-person worktrees.
+ */
+export function mergeOutward({
+  tip,
+  count,
+  branch,
+  label,
+  git,
+  gitMerge,
+  repoRoot,
+  tmpDir,
+  baseRef,
+  workingTree,
+  warn,
+}) {
+  const dropTmp = () => {
+    try {
+      git(['worktree', 'remove', '--force', tmpDir], repoRoot);
+    } catch {
+      /* not there — fine */
+    }
+  };
+  const attempt = () => {
+    dropTmp();
+    git(['worktree', 'add', '--detach', tmpDir, baseRef()], repoRoot);
+    gitMerge(
+      ['merge', '--no-ff', tip, '-m', `ship(${label}): ${count} commit${count === 1 ? '' : 's'}`],
+      tmpDir
+    );
+    git(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmpDir);
+  };
+  try {
+    try {
+      attempt();
+    } catch (e) {
+      /**
+       * TWO PEOPLE SHIPPED AT ONCE — retry exactly once.
+       *
+       * Ship takes a write lock on a PLACE, and since every person works in a
+       * directory of their own, two teammates shipping hold two DIFFERENT
+       * locks and nothing serializes them. Both fetch, both merge onto the same
+       * base in their own throwaway, and whoever pushes second is rejected
+       * non-fast-forward. The window is fetch-to-push, and it did not exist
+       * while everyone shared one directory — it arrived with the split.
+       *
+       * WITHOUT THIS the loser is told their ship FAILED, in raw git, over a
+       * race that resolves itself by looking again. That breaks the promise
+       * this path exists to keep: nobody may be left believing their work is
+       * or is not on base when the opposite is true.
+       *
+       * ONCE, not a loop. A second rejection is no longer a race — it is a repo
+       * something else is writing to continuously, and the honest answer there
+       * is the error. The retry re-fetches and rebuilds the throwaway from the
+       * NEW base, so it merges against what the winner just landed rather than
+       * re-pushing a stale merge. The TIP is untouched, so the receipts still
+       * name exactly the same commits.
+       */
+      if (!isRaceRejection(e)) throw e;
+      warn?.('ship: base moved under us — refetching and merging again');
+      try {
+        git(['fetch', 'origin', '--quiet'], repoRoot);
+      } catch {
+        /* offline — the retry fails honestly on the same push */
+      }
+      attempt();
+    }
+    /**
+     * AND BRING THE SHIP PLACE'S OWN BRANCH UP, when that branch IS base.
+     *
+     * Which is every tab belonging to the machine's OPERATOR: their place is
+     * the project folder, and it sits on main. Without this, main is left one
+     * commit behind `origin/main` the instant it ships, because the `--no-ff`
+     * merge exists only on the remote — and `worktreeDiff` computes `behind` as
+     * `HEAD..origin/main` without filtering merges, so the rail immediately
+     * reported "1 new on main since you branched" and listed the operator's OWN
+     * ship commit back to them. That inverts the entire point of that block,
+     * which is to show the one thing a session cannot see from inside itself.
+     *
+     * Safe by construction and never a surprise: ship already required a clean
+     * tree, the fold already moved this same directory under the same exclusive
+     * lock, and `--ff-only` can neither conflict nor write a commit.
+     *
+     * NOBODY ELSE'S CHECKOUT MOVES. A teammate's branch is not base, so this
+     * does nothing for them — and their branch being genuinely behind base is a
+     * fact the rail should keep telling them.
+     */
+    if (workingTree && branch && branch === baseBranchName(baseRef())) {
+      try {
+        git(['fetch', 'origin', '--quiet'], repoRoot);
+        git(['merge', '--ff-only', baseRef()], workingTree);
+      } catch {
+        /* a readout, not the ship — the merge already landed, and the next
+           fold picks this up either way */
+      }
+    }
+  } finally {
+    try {
+      dropTmp();
+      git(['worktree', 'prune'], repoRoot);
+    } catch {
+      /* best effort */
+    }
+  }
+}
+
+/**
+ * Is this push failure a LOST RACE rather than a broken repo?
+ *
+ * Matched on git's own words. Deliberately narrow: anything unrecognised is
+ * rethrown, because retrying an unknown failure is how a real problem gets
+ * reported twice and understood never.
+ */
+export function isRaceRejection(e) {
+  const d = `${e?.stdout ?? ''}\n${e?.stderr ?? ''}\n${e?.message ?? ''}`;
+  return /non-fast-forward|\[rejected\]|fetch first|stale info/i.test(d);
+}

package/bin/lib/work.mjs

@@ -43,6 +43,7 @@ import { listenersIn, listenersSupported } from './listeners.mjs';
 import { processesInGroups, liveGroups, processesSupported } from './processes.mjs';
 import { createPlaceLock } from './placeLock.mjs';
 import { sweepMergedBranch } from './shipSweep.mjs';
+import { mergeOutward as shipMergeOutward } from './shipMerge.mjs';
 import { openTunnel } from './preview.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
@@ -413,6 +414,8 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
   };
 
   let lastWorktreeSweep = 0;
+  /** Sessions this process has already tried to measure. See `reportWorktrees`. */
+  const worktreeSeen = new Set();
   let lastWorktreeFetch = 0;
   let sweepingWorktrees = false;
   const postWorktrees = async (reports) => {
@@ -477,10 +480,34 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     if (r) await postWorktrees([r]);
   };
   /** Every live session, throttled — called from the reconcile loop. */
+  /**
+   * A SESSION NOBODY HAS MEASURED YET JUMPS THE SWEEP (2026-08-26).
+   *
+   * The throttle is GLOBAL, not per-session, so a tab opened one second after a
+   * sweep waited the remaining fifty-nine for its first measurement — and until
+   * it lands there is no branch, no directory and no listeners anywhere in the
+   * product, because every one of those readouts is gated on a measurement and
+   * renders nothing rather than inventing a state. Asked directly: "how come it
+   * takes a while for a new session to show branch and worktree and listeners
+   * after i create a new tab."
+   *
+   * ATTEMPTED, never MEASURED, is what is remembered. A session whose directory
+   * cannot be read yet — a pre-places daemon that has not cut one, a worktree
+   * mid-creation — would otherwise be "unmeasured" on every poll and force a
+   * full sweep each time. Recording the attempt bounds it at exactly one extra
+   * sweep per session, ever, after which the normal cadence carries it.
+   */
   const reportWorktrees = (activeIds) => {
     if (!Array.isArray(activeIds) || activeIds.length === 0) return;
     if (sweepingWorktrees) return;
-    if (Date.now() - lastWorktreeSweep < WORKTREE_SWEEP_MS) return;
+    const firstSight = activeIds.some((id) => !worktreeSeen.has(id));
+    if (!firstSight && Date.now() - lastWorktreeSweep < WORKTREE_SWEEP_MS) return;
+    // Bounded to LIVE sessions: a long-running daemon must not accumulate a
+    // uuid per tab anyone has ever opened. Pruning also means a reopened tab is
+    // measured immediately again, which is the same answer for the same reason.
+    const live = new Set(activeIds);
+    for (const id of worktreeSeen) if (!live.has(id)) worktreeSeen.delete(id);
+    for (const id of activeIds) worktreeSeen.add(id);
     sweepingWorktrees = true;
     lastWorktreeSweep = Date.now();
     void (async () => {
@@ -1151,9 +1178,23 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    * working tree itself would show up as an untracked path and block every
    * ship of an otherwise-clean session.
    */
-  const sessionMetaPath = (wt, name) => {
+  /**
+   * A file beside the worktree's git dir, holding something about ONE TAB.
+   *
+   * `scope` is the session id and is NOT optional for anything per-tab. These
+   * markers were named bare — `flowviant-codex-thread`, `flowviant-agy-
+   * conversation` — which was unambiguous while one directory meant one tab.
+   * The day tabs moved into their driver's project folder, every tab there
+   * started reading and writing ONE marker: tab B would resume tab A's codex
+   * thread, and the last turn to finish would overwrite the id for both.
+   *
+   * The turn LOCK is deliberately still un-scoped — it guards the directory
+   * against a second CLI, which is a property of the place and not of a tab.
+   */
+  const sessionMetaPath = (wt, name, scope) => {
     try {
-      return join(git(['rev-parse', '--absolute-git-dir'], wt), name);
+      const safe = scope && /^[A-Za-z0-9_-]{1,64}$/.test(String(scope)) ? `-${scope}` : '';
+      return join(git(['rev-parse', '--absolute-git-dir'], wt), `${name}${safe}`);
     } catch {
       return null;
     }
@@ -1171,7 +1212,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    * the AGENT's to explain to the user, never a reason to fail the adoption —
    * the conversation is the thing being adopted, and it resumes either way.
    */
-  const carryDirtyState = (srcCwd, wt) => {
+  const carryDirtyState = (srcCwd, wt, sessionId) => {
     const problems = [];
     try {
       // A Buffer, not utf8: a `--binary` patch (and a hunk from a non-UTF-8
@@ -1184,7 +1225,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
         maxBuffer: 64 * 1024 * 1024,
       });
       if (patch.length) {
-        const patchPath = sessionMetaPath(wt, 'flowviant-adopt.patch');
+        const patchPath = sessionMetaPath(wt, 'flowviant-adopt.patch', sessionId);
         if (!patchPath) throw new Error('no private git dir to stage the patch in');
         try {
           writeFileSync(patchPath, patch);
@@ -1269,8 +1310,10 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    */
   const sessionCapable = (rid) =>
     (Boolean(RUNTIMES[rid]?.mcp) || rid === 'antigravity') && canRun(RUNTIMES[rid], 'build');
-  const sessionRuntime = (wt, jobRuntime) => {
-    const marker = sessionMetaPath(wt, 'flowviant-runtime');
+  const sessionRuntime = (wt, jobRuntime, sessionId) => {
+    // SCOPED: two tabs standing in one directory may run different CLIs, and an
+    // unscoped pin would hand the second one the first one's runtime.
+    const marker = sessionMetaPath(wt, 'flowviant-runtime', sessionId);
     let pinned = null;
     if (marker && existsSync(marker)) {
       try {
@@ -1689,7 +1732,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // which is what every tab ran on until now) — honored by
           // sessionRuntime: on a first turn a named runtime IS the pick, and a
           // named runtime that disagrees with the pin settles below.
-          const rt = sessionRuntime(dir.wt, job.runtime || null);
+          const rt = sessionRuntime(dir.wt, job.runtime || null, job.sessionId);
           if (rt.mismatch) {
             // Something upstream changed this tab's identity mid-life. A held
             // context must never be answered by a different brain — say so.
@@ -1782,9 +1825,43 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // persisted below, beside the runtime pin; absent, the turn runs
           // FRESH in the same worktree — the dirty state is most of the held
           // context, and a machine-global guess is someone else's conversation.
+          /**
+           * CLAUDE RESUMES BY THE CONVERSATION ID THIS TAB SPOKE UNDER.
+           *
+           * `--continue` is CWD-KEYED. That was unambiguous while one directory
+           * meant one tab, and it stopped being true the day tabs moved into
+           * their driver's project folder: every tab there said `--continue`
+           * and every one of them resumed whichever conversation had spoken
+           * most recently in that directory. Tab B inherited tab A's entire
+           * context, and each turn afterwards ping-ponged between them — the
+           * exact failure the codex note two blocks down warns about for
+           * `resume --last`, arriving for Claude by a different route.
+           *
+           * The id comes from the CLI's own `system.init` event, which the
+           * stream parser already surfaces, and is pinned per session so it is
+           * unambiguous wherever the tab is standing.
+           *
+           * NO ID, NO `--continue`: a tab whose place is shared starts FRESH
+           * rather than guessing, because in a shared directory the guess is
+           * someone else's conversation. `--continue` survives only where the
+           * directory belongs to this tab alone, which is the one case it was
+           * ever right for.
+           */
+          let claudeResumeId = null;
+          if (rt.id === 'claude') {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-claude-session', job.sessionId);
+            if (convMarker && existsSync(convMarker)) {
+              try {
+                const v = readFileSync(convMarker, 'utf8').trim();
+                if (/^[A-Za-z0-9_-]{8,64}$/.test(v)) claudeResumeId = v;
+              } catch {
+                /* unreadable marker — run fresh */
+              }
+            }
+          }
           let codexResumeId = null;
           if (rt.id === 'codex') {
-            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread', job.sessionId);
             if (threadMarker && existsSync(threadMarker)) {
               try {
                 const v = readFileSync(threadMarker, 'utf8').trim();
@@ -1802,7 +1879,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // dispatch sharing the machine could overwrite that between turns.
           let agyConvId = null;
           if (rt.id === 'antigravity' && !adopting) {
-            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation', job.sessionId);
             if (convMarker && existsSync(convMarker)) {
               try {
                 const v = readFileSync(convMarker, 'utf8').trim();
@@ -1825,19 +1902,23 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // it (cwd-keyed; measured safe), so a lost marker degrades to the
           // weaker resume instead of silently starting over.
           const spokeHere = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
+          // A place this tab does NOT have to itself: `--continue` there is a
+          // guess at somebody else's conversation, so it is withheld and only
+          // a pinned id may resume.
+          const placeIsMine = !placeOf(job.sessionId) || placeOf(job.sessionId) === job.sessionId;
           const resume =
             rt.id === 'codex'
               ? Boolean(codexResumeId)
               : rt.id === 'antigravity'
-                ? Boolean(agyConvId) || spokeHere
-                : spokeHere;
+                ? Boolean(agyConvId) || (placeIsMine && spokeHere)
+                : Boolean(claudeResumeId) || (placeIsMine && spokeHere);
           // The dirty carry, on the adopt worktree's FIRST life only: a
           // re-attempted adoption (the directory already exists) carried what
           // it could the first time, and re-applying would double it. A carry
           // problem never fails the adoption — it becomes one bracketed line
           // in the prompt, so the AGENT tells the user what stayed behind.
           let carryNote = '';
-          if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt);
+          if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt, job.sessionId);
           // The tab's transcript starts EMPTY on adoption (scrollback is
           // disposable, the held context is the brain — never import an
           // archive), so the first reply opens with a recap: the human sees
@@ -1857,6 +1938,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           workAttempts.set(job.id, tries + 1);
           let out;
           let seenThreadId = null; // codex's conversation id, off thread.started
+          let seenClaudeSession = null; // claude's own conversation id, off system.init
           const spawned = []; // this turn's children, for the teardown registry
           const narrator = makeNarrator(job.sessionId, job.id);
 
@@ -1950,7 +2032,16 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
               // no extra spawn — and reported on the next roster poll so the
               // composer can autocomplete a `/`. See runtimes.mjs for why it is
               // learned from a turn rather than looked up.
-              onInit: (i) => recordSkills(i.skills),
+              onInit: (i) => {
+                recordSkills(i.skills);
+                // The conversation this turn is actually speaking under. Held
+                // and persisted after the turn ends, so the NEXT one resumes
+                // this exact thread rather than whatever the directory saw
+                // last. Last write wins on purpose: a resume that fell back to
+                // fresh reports the fresh id, healing the marker.
+                if (typeof i.sessionId === 'string' && i.sessionId.trim())
+                  seenClaudeSession = i.sessionId.trim();
+              },
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,
@@ -1985,7 +2076,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
             out = await runTurn({
               ...turnArgs,
               resume,
-              resumeThreadId: codexResumeId || undefined,
+              resumeThreadId: codexResumeId || claudeResumeId || undefined,
               resumeConversationId: agyConvId || undefined,
             });
             // A resume that produced NOTHING usually means the held
@@ -2022,8 +2113,26 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // before it ever touches disk — it later rides in argv as
           // `resume <id>` — and best-effort, like the runtime pin: an
           // unwritable marker just means the tab runs fresh next turn.
+          // The conversation THIS TAB just spoke under, pinned so the next
+          // turn resumes it by id rather than asking the directory. Written
+          // after the turn for the same reason codex's is: an id learned
+          // mid-turn is only true once the turn that learned it finished.
+          if (
+            rt.id === 'claude' &&
+            seenClaudeSession &&
+            /^[A-Za-z0-9_-]{8,64}$/.test(seenClaudeSession)
+          ) {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-claude-session', job.sessionId);
+            if (convMarker) {
+              try {
+                writeFileSync(convMarker, seenClaudeSession);
+              } catch {
+                /* best-effort — the next turn re-learns it */
+              }
+            }
+          }
           if (rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
-            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread', job.sessionId);
             if (threadMarker) {
               try {
                 writeFileSync(threadMarker, seenThreadId);
@@ -2055,7 +2164,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // cwd registry. From here on the marker is the tab's identity and
           // the registry is never trusted again.
           if (rt.id === 'antigravity' && answer.length > 0) {
-            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation', job.sessionId);
             if (convMarker && !existsSync(convMarker)) {
               const learned = adopting ? job.adopt.id : agyRegistryLookup(dir.wt);
               if (learned && AGY_CONV_RE.test(learned)) {
@@ -2269,35 +2378,23 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // Merge outward through a throwaway worktree so no checkout moves.
           // The throwaway dies on EVERY exit — success, conflict or throw —
           // or the next ship of this session trips over its corpse.
-          const mergeOutward = (tip, count) => {
-            const tmp = join(baseDir, 'ship', job.sessionId);
-            try {
-              try {
-                git(['worktree', 'remove', '--force', tmp], repoRoot);
-              } catch {
-                /* not there — fine */
-              }
-              git(['worktree', 'add', '--detach', tmp, baseRef()], repoRoot);
-              gitMerge(
-                [
-                  'merge',
-                  '--no-ff',
-                  tip,
-                  '-m',
-                  `ship(${job.sessionName || job.sessionId.slice(0, 8)}): ${count} commit${count === 1 ? '' : 's'}`,
-                ],
-                tmp
-              );
-              git(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmp);
-            } finally {
-              try {
-                git(['worktree', 'remove', '--force', tmp], repoRoot);
-                git(['worktree', 'prune'], repoRoot);
-              } catch {
-                /* best effort */
-              }
-            }
-          };
+          // Carry the tip out onto base and push it. See `shipMerge.mjs` for
+          // the throwaway-worktree shape, the one retry when two people ship at
+          // once, and why the operator's own branch is fast-forwarded after.
+          const mergeOutward = (tip, count) =>
+            shipMergeOutward({
+              tip,
+              count,
+              branch,
+              label: job.sessionName || job.sessionId.slice(0, 8),
+              git,
+              gitMerge,
+              repoRoot,
+              tmpDir: join(baseDir, 'ship', job.sessionId),
+              baseRef,
+              workingTree: placeWtFor(shipPlace)?.wt ?? null,
+              warn,
+            });
           // Idempotency: base already contains the branch tip. A re-offered
           // job after a lost report lands here — never a re-merge, and never
           // "nothing to ship" AS A FAILURE for work that in fact shipped. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.67.0",
+  "version": "0.69.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {