flowviant 0.68.0 → 0.70.0

package/bin/lib/localSessions.mjs

@@ -74,6 +74,47 @@ function transcriptTitle(file, mtimeMs) {
   return title;
 }
 
+/**
+ * THE TITLE CLAUDE GAVE ITS OWN CONVERSATION, for one session we already know
+ * the id of.
+ *
+ * `scanLocalSessions` finds transcripts the hard way — walk every project
+ * directory, read each file's own `cwd` — because it is answering "what is in
+ * this repo" and knows no ids. This asks the same store a narrower question:
+ * the tab pinned the id the CLI reported at `system.init`, and the directory is
+ * the place the turn was spawned in, so the file is one munge away (Claude Code
+ * names the directory after the cwd with `/` and `.` replaced by `-`).
+ *
+ * The realpath fallback is not defensive padding: a place under a symlinked
+ * home munges to a DIFFERENT directory name depending on which form the CLI was
+ * handed, and the daemon does not control which that was.
+ *
+ * Returns null for anything it cannot read. A missing title is honest silence —
+ * the tab keeps whatever name it has.
+ */
+export function titleForSession(cwd, sessionId) {
+  if (!cwd || typeof sessionId !== 'string' || !/^[A-Za-z0-9_-]{8,64}$/.test(sessionId)) {
+    return null;
+  }
+  const projects = join(homedir(), '.claude', 'projects');
+  const dirs = [String(cwd)];
+  try {
+    const real = realpathSync(String(cwd));
+    if (real !== String(cwd)) dirs.push(real);
+  } catch {
+    /* the place is gone — nothing to read */
+  }
+  for (const dir of dirs) {
+    const file = join(projects, dir.replace(/[/.]/g, '-'), `${sessionId}.jsonl`);
+    try {
+      return transcriptTitle(file, statSync(file).mtimeMs);
+    } catch {
+      /* not this munge — try the other */
+    }
+  }
+  return null;
+}
+
 /** Path-prefix containment on already-realpath'd absolute paths. */
 const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
 

package/bin/lib/runtimes.mjs

@@ -337,17 +337,31 @@ export const RUNTIMES = {
      * strongest form of it available anywhere: `--append-system-prompt` sits
      * above the conversation rather than inside it.
      */
-    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
+    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId }) {
       const a = [];
-      // ADOPTION — the first turn of a tab born from a terminal session.
-      // `--resume <id> --fork-session` finds the session globally (any cwd),
-      // carries its full context, and writes the FORK natively into THIS cwd's
-      // own store, leaving the original transcript untouched (measured on
-      // 2.1.234). From turn 2 on the plain `--continue` below resumes the fork
-      // where it now lives, so nothing downstream knows the tab was adopted.
-      // INSTEAD of --continue, never alongside it: they are the same decision
-      // ("what conversation is this?") answered two different ways.
+      // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
+      // are mutually exclusive, never combined.
+      //
+      // ADOPTION: `--resume <id> --fork-session` finds the session globally
+      // (any cwd), carries its full context, and writes the FORK natively into
+      // THIS cwd's own store, leaving the original transcript untouched
+      // (measured on 2.1.234).
+      //
+      // BY ID: the conversation THIS TAB spoke under last time, learned from
+      // the CLI's own `system.init` event and pinned per session. It exists
+      // because `--continue` is CWD-KEYED, and a directory stopped being one
+      // tab the day tabs moved into their driver's project folder — two tabs
+      // sharing a directory both said `--continue` and both resumed whichever
+      // conversation spoke most recently there, so tab B inherited tab A's
+      // entire context and every turn after that ping-ponged between them.
+      // Exactly the failure codex's own note warns about for `resume --last`,
+      // arriving for Claude by a different route. An id is unambiguous wherever
+      // the tab is standing.
+      //
+      // `--continue` is the LAST resort, and only where nothing better is
+      // known.
       if (adoptResumeId) a.push('--resume', adoptResumeId, '--fork-session');
+      else if (resumeThreadId) a.push('--resume', resumeThreadId);
       else if (resume) a.push('--continue');
       a.push('-p', prompt, '--append-system-prompt', system);
       a.push(...mcp, ...resultSchemaArgs);

package/bin/lib/work.mjs

@@ -59,7 +59,11 @@ import { detectRuntimes, canRun, recordSkills, RUNTIMES } from './runtimes.mjs';
 /** The place id meaning "the checkout", not a worktree. Must match the
  *  server's REPO_PLACE — it is a wire value, not a local convention. */
 const REPO_PLACE = 'repo';
-import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
+import {
+  isTerminalSessionLive,
+  isAgyConversationLive,
+  titleForSession,
+} from './localSessions.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { homedir } from 'node:os';
 
@@ -398,10 +402,21 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
   const learnPlaces = (map) => {
     if (!map || typeof map !== 'object') return;
     for (const [sid, place] of Object.entries(map)) {
-      if (typeof place === 'string' && place) sessionPlaces.set(sid, place);
-      // null / '' / anything else: the server is telling us this tab is in its
-      // OWN worktree. Falling back to the default requires forgetting, not
-      // ignoring.
+      // VALIDATE AT THE TRUST BOUNDARY. `placeDir` joins this value straight
+      // into `sessions/<place>` and it is the directory a turn is SPAWNED in
+      // and a preview port is measured against — the security boundary for the
+      // whole preview feature. The server resolves place to an enum (never a
+      // path), but a server bug or compromise sending `../../etc` would
+      // otherwise point a session's measured directory anywhere on the box and
+      // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
+      // already reject an unsafe segment; doing it here covers every consumer
+      // (the preview-claim `placeDir` did not re-check). REPO_PLACE resolves to
+      // repoRoot, so it is allowed through despite not being a path segment.
+      if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
+        sessionPlaces.set(sid, place);
+      // null / '' / an unsafe value: the server is telling us this tab is in its
+      // OWN worktree (or is malformed). Falling back to the default requires
+      // forgetting, not ignoring.
       else sessionPlaces.delete(sid);
     }
   };
@@ -414,6 +429,8 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
   };
 
   let lastWorktreeSweep = 0;
+  /** Sessions this process has already tried to measure. See `reportWorktrees`. */
+  const worktreeSeen = new Set();
   let lastWorktreeFetch = 0;
   let sweepingWorktrees = false;
   const postWorktrees = async (reports) => {
@@ -463,6 +480,29 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     // `processesSupported` keeps "cannot look" (Windows) apart from "looked and
     // found none", which renders differently.
     const processes = sessionProcesses(sessionId);
+    // THE NAME CLAUDE ALREADY GAVE THIS CONVERSATION, relayed.
+    //
+    // Claude Code titles its own sessions; a Flowviant tab was born "session 3"
+    // and stayed that way unless somebody renamed it by hand, so a strip of
+    // eight tabs said nothing about any of them. The title is not ours to
+    // invent — reading it is the same relay this whole file does, and asking
+    // a model for one would be a second brain, which the product forbids.
+    //
+    // Only CLAUDE tabs have one here: the id is the one the CLI reported at
+    // `system.init` and pinned per tab, so a codex or agy tab simply has no
+    // marker and reports no title. No runtime check is needed for that — the
+    // absent marker IS the check.
+    //
+    // No version floor: a daemon→server report on an endpoint that already
+    // exists, so an older daemon sends no key and the server leaves the name
+    // exactly as it found it.
+    let title = null;
+    try {
+      const marker = sessionMetaPath(wt, 'flowviant-claude-session', sessionId);
+      if (marker) title = titleForSession(wt, readFileSync(marker, 'utf8').trim());
+    } catch {
+      /* no marker yet — this tab has not spoken, or is not Claude */
+    }
     return {
       sessionId,
       ...d,
@@ -470,6 +510,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
       listeningSupported: listenersSupported(),
       ...(processes === null ? {} : { processes }),
       processesSupported: processesSupported(),
+      ...(title ? { title } : {}),
     };
   };
   /** One session, now — called after its turn settles. */
@@ -478,10 +519,34 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     if (r) await postWorktrees([r]);
   };
   /** Every live session, throttled — called from the reconcile loop. */
+  /**
+   * A SESSION NOBODY HAS MEASURED YET JUMPS THE SWEEP (2026-08-26).
+   *
+   * The throttle is GLOBAL, not per-session, so a tab opened one second after a
+   * sweep waited the remaining fifty-nine for its first measurement — and until
+   * it lands there is no branch, no directory and no listeners anywhere in the
+   * product, because every one of those readouts is gated on a measurement and
+   * renders nothing rather than inventing a state. Asked directly: "how come it
+   * takes a while for a new session to show branch and worktree and listeners
+   * after i create a new tab."
+   *
+   * ATTEMPTED, never MEASURED, is what is remembered. A session whose directory
+   * cannot be read yet — a pre-places daemon that has not cut one, a worktree
+   * mid-creation — would otherwise be "unmeasured" on every poll and force a
+   * full sweep each time. Recording the attempt bounds it at exactly one extra
+   * sweep per session, ever, after which the normal cadence carries it.
+   */
   const reportWorktrees = (activeIds) => {
     if (!Array.isArray(activeIds) || activeIds.length === 0) return;
     if (sweepingWorktrees) return;
-    if (Date.now() - lastWorktreeSweep < WORKTREE_SWEEP_MS) return;
+    const firstSight = activeIds.some((id) => !worktreeSeen.has(id));
+    if (!firstSight && Date.now() - lastWorktreeSweep < WORKTREE_SWEEP_MS) return;
+    // Bounded to LIVE sessions: a long-running daemon must not accumulate a
+    // uuid per tab anyone has ever opened. Pruning also means a reopened tab is
+    // measured immediately again, which is the same answer for the same reason.
+    const live = new Set(activeIds);
+    for (const id of worktreeSeen) if (!live.has(id)) worktreeSeen.delete(id);
+    for (const id of activeIds) worktreeSeen.add(id);
     sweepingWorktrees = true;
     lastWorktreeSweep = Date.now();
     void (async () => {
@@ -1152,9 +1217,23 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    * working tree itself would show up as an untracked path and block every
    * ship of an otherwise-clean session.
    */
-  const sessionMetaPath = (wt, name) => {
+  /**
+   * A file beside the worktree's git dir, holding something about ONE TAB.
+   *
+   * `scope` is the session id and is NOT optional for anything per-tab. These
+   * markers were named bare — `flowviant-codex-thread`, `flowviant-agy-
+   * conversation` — which was unambiguous while one directory meant one tab.
+   * The day tabs moved into their driver's project folder, every tab there
+   * started reading and writing ONE marker: tab B would resume tab A's codex
+   * thread, and the last turn to finish would overwrite the id for both.
+   *
+   * The turn LOCK is deliberately still un-scoped — it guards the directory
+   * against a second CLI, which is a property of the place and not of a tab.
+   */
+  const sessionMetaPath = (wt, name, scope) => {
     try {
-      return join(git(['rev-parse', '--absolute-git-dir'], wt), name);
+      const safe = scope && /^[A-Za-z0-9_-]{1,64}$/.test(String(scope)) ? `-${scope}` : '';
+      return join(git(['rev-parse', '--absolute-git-dir'], wt), `${name}${safe}`);
     } catch {
       return null;
     }
@@ -1172,7 +1251,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    * the AGENT's to explain to the user, never a reason to fail the adoption —
    * the conversation is the thing being adopted, and it resumes either way.
    */
-  const carryDirtyState = (srcCwd, wt) => {
+  const carryDirtyState = (srcCwd, wt, sessionId) => {
     const problems = [];
     try {
       // A Buffer, not utf8: a `--binary` patch (and a hunk from a non-UTF-8
@@ -1185,7 +1264,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
         maxBuffer: 64 * 1024 * 1024,
       });
       if (patch.length) {
-        const patchPath = sessionMetaPath(wt, 'flowviant-adopt.patch');
+        const patchPath = sessionMetaPath(wt, 'flowviant-adopt.patch', sessionId);
         if (!patchPath) throw new Error('no private git dir to stage the patch in');
         try {
           writeFileSync(patchPath, patch);
@@ -1270,8 +1349,10 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    */
   const sessionCapable = (rid) =>
     (Boolean(RUNTIMES[rid]?.mcp) || rid === 'antigravity') && canRun(RUNTIMES[rid], 'build');
-  const sessionRuntime = (wt, jobRuntime) => {
-    const marker = sessionMetaPath(wt, 'flowviant-runtime');
+  const sessionRuntime = (wt, jobRuntime, sessionId) => {
+    // SCOPED: two tabs standing in one directory may run different CLIs, and an
+    // unscoped pin would hand the second one the first one's runtime.
+    const marker = sessionMetaPath(wt, 'flowviant-runtime', sessionId);
     let pinned = null;
     if (marker && existsSync(marker)) {
       try {
@@ -1690,7 +1771,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // which is what every tab ran on until now) — honored by
           // sessionRuntime: on a first turn a named runtime IS the pick, and a
           // named runtime that disagrees with the pin settles below.
-          const rt = sessionRuntime(dir.wt, job.runtime || null);
+          const rt = sessionRuntime(dir.wt, job.runtime || null, job.sessionId);
           if (rt.mismatch) {
             // Something upstream changed this tab's identity mid-life. A held
             // context must never be answered by a different brain — say so.
@@ -1783,9 +1864,43 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // persisted below, beside the runtime pin; absent, the turn runs
           // FRESH in the same worktree — the dirty state is most of the held
           // context, and a machine-global guess is someone else's conversation.
+          /**
+           * CLAUDE RESUMES BY THE CONVERSATION ID THIS TAB SPOKE UNDER.
+           *
+           * `--continue` is CWD-KEYED. That was unambiguous while one directory
+           * meant one tab, and it stopped being true the day tabs moved into
+           * their driver's project folder: every tab there said `--continue`
+           * and every one of them resumed whichever conversation had spoken
+           * most recently in that directory. Tab B inherited tab A's entire
+           * context, and each turn afterwards ping-ponged between them — the
+           * exact failure the codex note two blocks down warns about for
+           * `resume --last`, arriving for Claude by a different route.
+           *
+           * The id comes from the CLI's own `system.init` event, which the
+           * stream parser already surfaces, and is pinned per session so it is
+           * unambiguous wherever the tab is standing.
+           *
+           * NO ID, NO `--continue`: a tab whose place is shared starts FRESH
+           * rather than guessing, because in a shared directory the guess is
+           * someone else's conversation. `--continue` survives only where the
+           * directory belongs to this tab alone, which is the one case it was
+           * ever right for.
+           */
+          let claudeResumeId = null;
+          if (rt.id === 'claude') {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-claude-session', job.sessionId);
+            if (convMarker && existsSync(convMarker)) {
+              try {
+                const v = readFileSync(convMarker, 'utf8').trim();
+                if (/^[A-Za-z0-9_-]{8,64}$/.test(v)) claudeResumeId = v;
+              } catch {
+                /* unreadable marker — run fresh */
+              }
+            }
+          }
           let codexResumeId = null;
           if (rt.id === 'codex') {
-            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread', job.sessionId);
             if (threadMarker && existsSync(threadMarker)) {
               try {
                 const v = readFileSync(threadMarker, 'utf8').trim();
@@ -1803,7 +1918,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // dispatch sharing the machine could overwrite that between turns.
           let agyConvId = null;
           if (rt.id === 'antigravity' && !adopting) {
-            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation', job.sessionId);
             if (convMarker && existsSync(convMarker)) {
               try {
                 const v = readFileSync(convMarker, 'utf8').trim();
@@ -1826,19 +1941,23 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // it (cwd-keyed; measured safe), so a lost marker degrades to the
           // weaker resume instead of silently starting over.
           const spokeHere = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
+          // A place this tab does NOT have to itself: `--continue` there is a
+          // guess at somebody else's conversation, so it is withheld and only
+          // a pinned id may resume.
+          const placeIsMine = !placeOf(job.sessionId) || placeOf(job.sessionId) === job.sessionId;
           const resume =
             rt.id === 'codex'
               ? Boolean(codexResumeId)
               : rt.id === 'antigravity'
-                ? Boolean(agyConvId) || spokeHere
-                : spokeHere;
+                ? Boolean(agyConvId) || (placeIsMine && spokeHere)
+                : Boolean(claudeResumeId) || (placeIsMine && spokeHere);
           // The dirty carry, on the adopt worktree's FIRST life only: a
           // re-attempted adoption (the directory already exists) carried what
           // it could the first time, and re-applying would double it. A carry
           // problem never fails the adoption — it becomes one bracketed line
           // in the prompt, so the AGENT tells the user what stayed behind.
           let carryNote = '';
-          if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt);
+          if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt, job.sessionId);
           // The tab's transcript starts EMPTY on adoption (scrollback is
           // disposable, the held context is the brain — never import an
           // archive), so the first reply opens with a recap: the human sees
@@ -1858,6 +1977,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           workAttempts.set(job.id, tries + 1);
           let out;
           let seenThreadId = null; // codex's conversation id, off thread.started
+          let seenClaudeSession = null; // claude's own conversation id, off system.init
           const spawned = []; // this turn's children, for the teardown registry
           const narrator = makeNarrator(job.sessionId, job.id);
 
@@ -1896,7 +2016,14 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           };
           const auditCommand = (a) => {
             if (a?.kind !== 'bash' || !a.command) return;
-            auditBatch.push({ command: a.command, at: new Date().toISOString() });
+            // Scrubbed like every other string that leaves this box (the
+            // narrator label, the settle answer, commit subjects, ship/merge
+            // lines, the per-tab process report). A command line is exactly
+            // where a secret leaks — `curl -H "authorization: <token>"`,
+            // `PGPASSWORD=… psql` — and the audit is stored 30 days and rendered
+            // in the admin view, so the one uplink that omitted scrub was the
+            // one most likely to carry a plaintext secret.
+            auditBatch.push({ command: envScrub(a.command), at: new Date().toISOString() });
             if (auditBatch.length >= 25) flushAudit();
           };
           try {
@@ -1951,7 +2078,16 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
               // no extra spawn — and reported on the next roster poll so the
               // composer can autocomplete a `/`. See runtimes.mjs for why it is
               // learned from a turn rather than looked up.
-              onInit: (i) => recordSkills(i.skills),
+              onInit: (i) => {
+                recordSkills(i.skills);
+                // The conversation this turn is actually speaking under. Held
+                // and persisted after the turn ends, so the NEXT one resumes
+                // this exact thread rather than whatever the directory saw
+                // last. Last write wins on purpose: a resume that fell back to
+                // fresh reports the fresh id, healing the marker.
+                if (typeof i.sessionId === 'string' && i.sessionId.trim())
+                  seenClaudeSession = i.sessionId.trim();
+              },
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,
@@ -1986,7 +2122,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
             out = await runTurn({
               ...turnArgs,
               resume,
-              resumeThreadId: codexResumeId || undefined,
+              resumeThreadId: codexResumeId || claudeResumeId || undefined,
               resumeConversationId: agyConvId || undefined,
             });
             // A resume that produced NOTHING usually means the held
@@ -2023,8 +2159,26 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // before it ever touches disk — it later rides in argv as
           // `resume <id>` — and best-effort, like the runtime pin: an
           // unwritable marker just means the tab runs fresh next turn.
+          // The conversation THIS TAB just spoke under, pinned so the next
+          // turn resumes it by id rather than asking the directory. Written
+          // after the turn for the same reason codex's is: an id learned
+          // mid-turn is only true once the turn that learned it finished.
+          if (
+            rt.id === 'claude' &&
+            seenClaudeSession &&
+            /^[A-Za-z0-9_-]{8,64}$/.test(seenClaudeSession)
+          ) {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-claude-session', job.sessionId);
+            if (convMarker) {
+              try {
+                writeFileSync(convMarker, seenClaudeSession);
+              } catch {
+                /* best-effort — the next turn re-learns it */
+              }
+            }
+          }
           if (rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
-            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread', job.sessionId);
             if (threadMarker) {
               try {
                 writeFileSync(threadMarker, seenThreadId);
@@ -2056,7 +2210,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // cwd registry. From here on the marker is the tab's identity and
           // the registry is never trusted again.
           if (rt.id === 'antigravity' && answer.length > 0) {
-            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation', job.sessionId);
             if (convMarker && !existsSync(convMarker)) {
               const learned = adopting ? job.adopt.id : agyRegistryLookup(dir.wt);
               if (learned && AGY_CONV_RE.test(learned)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.68.0",
+  "version": "0.70.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {