flowviant 0.69.0 → 0.70.0

package/bin/lib/localSessions.mjs

@@ -74,6 +74,47 @@ function transcriptTitle(file, mtimeMs) {
   return title;
 }
 
+/**
+ * THE TITLE CLAUDE GAVE ITS OWN CONVERSATION, for one session we already know
+ * the id of.
+ *
+ * `scanLocalSessions` finds transcripts the hard way — walk every project
+ * directory, read each file's own `cwd` — because it is answering "what is in
+ * this repo" and knows no ids. This asks the same store a narrower question:
+ * the tab pinned the id the CLI reported at `system.init`, and the directory is
+ * the place the turn was spawned in, so the file is one munge away (Claude Code
+ * names the directory after the cwd with `/` and `.` replaced by `-`).
+ *
+ * The realpath fallback is not defensive padding: a place under a symlinked
+ * home munges to a DIFFERENT directory name depending on which form the CLI was
+ * handed, and the daemon does not control which that was.
+ *
+ * Returns null for anything it cannot read. A missing title is honest silence —
+ * the tab keeps whatever name it has.
+ */
+export function titleForSession(cwd, sessionId) {
+  if (!cwd || typeof sessionId !== 'string' || !/^[A-Za-z0-9_-]{8,64}$/.test(sessionId)) {
+    return null;
+  }
+  const projects = join(homedir(), '.claude', 'projects');
+  const dirs = [String(cwd)];
+  try {
+    const real = realpathSync(String(cwd));
+    if (real !== String(cwd)) dirs.push(real);
+  } catch {
+    /* the place is gone — nothing to read */
+  }
+  for (const dir of dirs) {
+    const file = join(projects, dir.replace(/[/.]/g, '-'), `${sessionId}.jsonl`);
+    try {
+      return transcriptTitle(file, statSync(file).mtimeMs);
+    } catch {
+      /* not this munge — try the other */
+    }
+  }
+  return null;
+}
+
 /** Path-prefix containment on already-realpath'd absolute paths. */
 const inside = (p, root) => p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
 

package/bin/lib/work.mjs

@@ -59,7 +59,11 @@ import { detectRuntimes, canRun, recordSkills, RUNTIMES } from './runtimes.mjs';
 /** The place id meaning "the checkout", not a worktree. Must match the
  *  server's REPO_PLACE — it is a wire value, not a local convention. */
 const REPO_PLACE = 'repo';
-import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
+import {
+  isTerminalSessionLive,
+  isAgyConversationLive,
+  titleForSession,
+} from './localSessions.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { homedir } from 'node:os';
 
@@ -398,10 +402,21 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
   const learnPlaces = (map) => {
     if (!map || typeof map !== 'object') return;
     for (const [sid, place] of Object.entries(map)) {
-      if (typeof place === 'string' && place) sessionPlaces.set(sid, place);
-      // null / '' / anything else: the server is telling us this tab is in its
-      // OWN worktree. Falling back to the default requires forgetting, not
-      // ignoring.
+      // VALIDATE AT THE TRUST BOUNDARY. `placeDir` joins this value straight
+      // into `sessions/<place>` and it is the directory a turn is SPAWNED in
+      // and a preview port is measured against — the security boundary for the
+      // whole preview feature. The server resolves place to an enum (never a
+      // path), but a server bug or compromise sending `../../etc` would
+      // otherwise point a session's measured directory anywhere on the box and
+      // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
+      // already reject an unsafe segment; doing it here covers every consumer
+      // (the preview-claim `placeDir` did not re-check). REPO_PLACE resolves to
+      // repoRoot, so it is allowed through despite not being a path segment.
+      if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
+        sessionPlaces.set(sid, place);
+      // null / '' / an unsafe value: the server is telling us this tab is in its
+      // OWN worktree (or is malformed). Falling back to the default requires
+      // forgetting, not ignoring.
       else sessionPlaces.delete(sid);
     }
   };
@@ -465,6 +480,29 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     // `processesSupported` keeps "cannot look" (Windows) apart from "looked and
     // found none", which renders differently.
     const processes = sessionProcesses(sessionId);
+    // THE NAME CLAUDE ALREADY GAVE THIS CONVERSATION, relayed.
+    //
+    // Claude Code titles its own sessions; a Flowviant tab was born "session 3"
+    // and stayed that way unless somebody renamed it by hand, so a strip of
+    // eight tabs said nothing about any of them. The title is not ours to
+    // invent — reading it is the same relay this whole file does, and asking
+    // a model for one would be a second brain, which the product forbids.
+    //
+    // Only CLAUDE tabs have one here: the id is the one the CLI reported at
+    // `system.init` and pinned per tab, so a codex or agy tab simply has no
+    // marker and reports no title. No runtime check is needed for that — the
+    // absent marker IS the check.
+    //
+    // No version floor: a daemon→server report on an endpoint that already
+    // exists, so an older daemon sends no key and the server leaves the name
+    // exactly as it found it.
+    let title = null;
+    try {
+      const marker = sessionMetaPath(wt, 'flowviant-claude-session', sessionId);
+      if (marker) title = titleForSession(wt, readFileSync(marker, 'utf8').trim());
+    } catch {
+      /* no marker yet — this tab has not spoken, or is not Claude */
+    }
     return {
       sessionId,
       ...d,
@@ -472,6 +510,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
       listeningSupported: listenersSupported(),
       ...(processes === null ? {} : { processes }),
       processesSupported: processesSupported(),
+      ...(title ? { title } : {}),
     };
   };
   /** One session, now — called after its turn settles. */
@@ -1977,7 +2016,14 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           };
           const auditCommand = (a) => {
             if (a?.kind !== 'bash' || !a.command) return;
-            auditBatch.push({ command: a.command, at: new Date().toISOString() });
+            // Scrubbed like every other string that leaves this box (the
+            // narrator label, the settle answer, commit subjects, ship/merge
+            // lines, the per-tab process report). A command line is exactly
+            // where a secret leaks — `curl -H "authorization: <token>"`,
+            // `PGPASSWORD=… psql` — and the audit is stored 30 days and rendered
+            // in the admin view, so the one uplink that omitted scrub was the
+            // one most likely to carry a plaintext secret.
+            auditBatch.push({ command: envScrub(a.command), at: new Date().toISOString() });
             if (auditBatch.length >= 25) flushAudit();
           };
           try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {