flowviant 0.70.0 → 0.71.1

package/bin/lib/fleet.mjs

@@ -815,6 +815,7 @@ export async function runFleetDaemon() {
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    processKillJobs,
     heldSessionIds,
     processPreviewJobs,
     livePreviewIds,
@@ -1586,6 +1587,11 @@ export async function runFleetDaemon() {
     // credential are both handed this array, and both opening a tunnel strands
     // a public hostname nobody can settle.
     processPreviewJobs(roster.previewJobs);
+    // One measured process a human asked to stop. Claimed before acted on for
+    // the same reason a share is, and re-verified against the kernel inside —
+    // the pid on this job is a request, never an authority, because pids are
+    // recycled and the row the browser clicked is up to a sweep old.
+    processKillJobs(roster.killJobs);
     // …and what the SURVIVING ones hold: branch, ahead-of-base, diffstat.
     // Throttled inside, never awaited — a `git status` the human cannot run
     // themselves from a browser, relayed. After retirement so a directory that

package/bin/lib/listeners.mjs

@@ -24,21 +24,59 @@
  * reports NOTHING and says so through the empty array — the same answer
  * `stillOurs` gives, and the same rule the rest of the product keeps: an
  * unmeasured thing renders nothing rather than rendering "none".
+ *
+ * CHOSEN vs KERNEL-ASSIGNED, and why this is a measurement rather than a guess.
+ * `wrangler dev` opens NINE listening sockets; exactly one of them is the URL a
+ * person opens. The other eight were opened on port 0 and given whatever the
+ * kernel had free, and nobody will ever type one into a browser. The box itself
+ * says where that range is (`/proc/sys/net/ipv4/ip_local_port_range`, or
+ * `sysctl net.inet.ip.portrange.*`), so "was this port CHOSEN" is a fact we can
+ * read rather than a heuristic about anybody's stack — the same character as
+ * `bind`, and it needs no allowlist, no framework detection and no probe.
+ *
+ * IT IS THE ONE DISCRIMINATOR A PROBE COULD NOT PROVIDE. Connecting to each
+ * port and keeping the ones that answer HTTP is the obvious alternative and it
+ * is WRONG, not merely rude: under `wrangler dev` the app's internal entry
+ * socket returns byte-for-byte what the dev URL returns, because the dev URL
+ * proxies straight to it. A probe promotes the wrong port. The free fact beats
+ * the expensive one on accuracy.
+ *
+ * WHAT THE ROW MAY CARRY, and the line that must not be crossed. `pid` and
+ * `rss` are numbers about a process; the LABEL is still only the basenames of
+ * argv[0] and argv[1], and argv[1] is skipped outright when it starts with `-`.
+ * That is why no row here is ever passed through `envScrub`: it cannot carry a
+ * secret, by construction rather than by filtering. Widening the label to "the
+ * first argument that is not a flag" would break exactly that — it reads a
+ * flag's VALUE, so `node --require hunter2 app.js` would relay `hunter2`. Do
+ * not widen it. Add fields that are numbers; never add argv.
  */
 
 import { execFileSync } from 'node:child_process';
 import { createConnection } from 'node:net';
 import { readFileSync, readdirSync, readlinkSync, realpathSync } from 'node:fs';
 import { platform } from 'node:os';
+import { rssBytes } from './processes.mjs';
 import { sep } from 'node:path';
 
 /** A box with more processes than this is not one we walk per sweep. The scan
  *  is one readlink per pid and runs every reconcile; this is the runaway
  *  bound, not a capacity statement. */
 const MAX_PIDS = 4000;
-/** Rows reported per session. A dev server, its HMR socket and an API is three;
- *  twenty is somebody's docker-compose and the extra rows say nothing. */
-const MAX_ROWS = 8;
+/**
+ * Rows reported per session.
+ *
+ * It was 8, and `wrangler dev` alone opens NINE — so the cap was silently
+ * eating a row on an ordinary stack while the wire carried no flag saying it
+ * had. Both halves of that are fixed: the number is 12, and `measureListeners`
+ * reports the TOTAL so a surface can say it is not showing everything.
+ *
+ * The cap is also no longer allowed to eat the row that matters. Sorting was by
+ * port ascending, which is arbitrary with respect to importance — a dev server
+ * on :8080 beside eight kernel-assigned sockets in the 30000s survives by luck,
+ * and one on :9000 would not. CHOSEN ports sort first now, so the cut falls on
+ * the ephemeral tail, which is the half nobody opens.
+ */
+const MAX_ROWS = 12;
 /** Longest process label we relay. */
 const MAX_LABEL = 40;
 
@@ -120,6 +158,68 @@ export function labelFromArgv(argv) {
   return label.slice(0, MAX_LABEL) || null;
 }
 
+/**
+ * THE KERNEL'S OWN EPHEMERAL PORT RANGE, or null where we cannot read it.
+ *
+ * A socket opened on port 0 is given a port out of this range; a port outside
+ * it was named by a person or their config. That is the whole of the CHOSEN
+ * test, and the reason it is honest: the range is READ FROM THIS BOX, never
+ * assumed. Linux's default is 32768-60999 and macOS's is 49152-65535, and both
+ * are tunable — hardcoding either would turn a measurement into a guess that is
+ * wrong on exactly the machines somebody bothered to tune.
+ *
+ * THREE STATES, as everywhere else here: `undefined` before we look, `null` for
+ * "this box would not say" (which must leave `chosen` OFF every row rather than
+ * defaulting it), and a pair once measured. Cached for the life of the process
+ * because the range does not move under a running kernel.
+ */
+let EPHEMERAL;
+function ephemeralRange() {
+  if (EPHEMERAL !== undefined) return EPHEMERAL;
+  EPHEMERAL = null;
+  try {
+    if (platform() === 'linux') {
+      const [lo, hi] = readFileSync('/proc/sys/net/ipv4/ip_local_port_range', 'utf8')
+        .trim()
+        .split(/\s+/)
+        .map(Number);
+      if (Number.isInteger(lo) && Number.isInteger(hi) && lo > 0 && hi >= lo) EPHEMERAL = [lo, hi];
+    } else if (platform() === 'darwin') {
+      const one = (k) =>
+        Number(
+          execFileSync('sysctl', ['-n', k], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 3000,
+          }).trim()
+        );
+      const lo = one('net.inet.ip.portrange.first');
+      const hi = one('net.inet.ip.portrange.last');
+      if (Number.isInteger(lo) && Number.isInteger(hi) && lo > 0 && hi >= lo) EPHEMERAL = [lo, hi];
+    }
+  } catch {
+    /* unreadable — stays null, and `chosen` is then absent rather than guessed */
+  }
+  return EPHEMERAL;
+}
+
+/**
+ * True/false once the range is known, `undefined` when it is not — so the
+ * caller can omit the key entirely rather than assert a default.
+ *
+ * Split from the cached reader so the RULE is testable without a kernel: the
+ * three-state answer is the part worth pinning, and it is the part a later
+ * refactor is most likely to flatten into a boolean.
+ */
+export function isChosenPort(port, range) {
+  if (!range) return undefined;
+  return port < range[0] || port > range[1];
+}
+
+function chosenPort(port) {
+  return isChosenPort(port, ephemeralRange());
+}
+
 function labelFor(pid) {
   try {
     const raw = readFileSync(`/proc/${pid}/cmdline`, 'utf8');
@@ -180,7 +280,20 @@ function scanLinux(worktree) {
       const hit = inodes.get(m[1]);
       if (!hit) continue;
       if (found.has(hit.port)) continue;
-      found.set(hit.port, { port: hit.port, bind: hit.bind, label: labelFor(pid) });
+      const chosen = chosenPort(hit.port);
+      const rss = rssBytes(pid);
+      found.set(hit.port, {
+        port: hit.port,
+        bind: hit.bind,
+        label: labelFor(pid),
+        // The pid was always in hand here — it is what resolves the cwd — and
+        // was thrown away the moment the row was built. Keeping it is what lets
+        // a surface group nine sockets under the ONE program that opened them,
+        // and it is the only thing a kill could ever be aimed at.
+        pid: Number(pid),
+        ...(rss != null ? { rss } : {}),
+        ...(chosen === undefined ? {} : { chosen }),
+      });
     }
   }
   return [...found.values()];
@@ -205,6 +318,22 @@ function scanDarwin(worktree) {
   // Pass 1: every listening socket, as pid → ports.
   const byPid = new Map();
   let pid = null;
+  // RSS for every pid on the box, in one call. `lsof` cannot report memory and
+  // a per-pid `ps` would be one fork per row; this is one fork per sweep.
+  const rssByPid = new Map();
+  try {
+    for (const line of execFileSync('ps', ['-axo', 'pid=,rss='], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5000,
+      maxBuffer: 4 * 1024 * 1024,
+    }).split('\n')) {
+      const m = /^\s*(\d+)\s+(\d+)\s*$/.exec(line);
+      if (m) rssByPid.set(m[1], Number(m[2]) * 1024); // ps reports KB
+    }
+  } catch {
+    /* no memory on this box — rows simply carry no rss */
+  }
   for (const line of lsof(['-nP', '-iTCP', '-sTCP:LISTEN', '-F', 'pn']).split('\n')) {
     if (line.startsWith('p')) pid = line.slice(1);
     else if (line.startsWith('n') && pid) {
@@ -235,7 +364,20 @@ function scanDarwin(worktree) {
       const cwd = line.slice(1);
       if (cwd !== root && !cwd.startsWith(prefix)) continue;
       for (const row of byPid.get(cur) || []) {
-        if (!out.has(row.port)) out.set(row.port, { ...row, label: null });
+        if (out.has(row.port)) continue;
+        const chosen = chosenPort(row.port);
+        out.set(row.port, {
+          ...row,
+          // Still null on darwin: `lsof -F pn` is asked for name and pid, never
+          // a command, and adding `-F c` would relay a command name we have no
+          // scrub for. The CHOSEN test needs no label, which is the other
+          // reason it is the right discriminator — it is the only one that
+          // works identically on a Mac.
+          label: null,
+          pid: Number(cur),
+          ...(rssByPid.has(cur) ? { rss: rssByPid.get(cur) } : {}),
+          ...(chosen === undefined ? {} : { chosen }),
+        });
       }
     }
   }
@@ -245,19 +387,54 @@ function scanDarwin(worktree) {
 // ── public ─────────────────────────────────────────────────────────────────
 
 /**
- * Every TCP port in LISTEN held by a process whose cwd is inside `worktree`.
- * Smallest port first, capped. An empty array on an unsupported platform means
- * "we did not look" — callers must not turn it into "nothing is running".
+ * ORDER, and why it is not the port number any more.
+ *
+ * CHOSEN ports first, each group by port ascending. Two reasons, and the second
+ * is the load-bearing one:
+ *
+ *  · A person scanning this list is looking for the URL they are about to open,
+ *    and that is always a port somebody named. The seven sockets `wrangler dev`
+ *    was handed by the kernel are not candidates and should not be read past.
+ *  · The list is CAPPED. Ordering by port number let the cap fall wherever the
+ *    numbers happened to land, so a dev server on a high port could be the row
+ *    that got dropped. Sorting by chosen-ness puts the cut on the tail nobody
+ *    opens.
+ *
+ * Where the range could not be read `chosen` is absent on every row, `Number()`
+ * of undefined is NaN, and the comparison is false both ways — so the order
+ * degrades to the old port sort rather than to something arbitrary.
+ */
+export function byChosenThenPort(a, b) {
+  const ac = a.chosen === true ? 0 : 1;
+  const bc = b.chosen === true ? 0 : 1;
+  return ac !== bc ? ac - bc : a.port - b.port;
+}
+
+/**
+ * Every TCP port in LISTEN held by a process whose cwd is inside `worktree`,
+ * with the TOTAL the cap was applied to.
+ *
+ * The total is the whole point of the pair. A list silently cut at twelve
+ * answers "what is running in here" with a number that is not true, and the
+ * Repository block already settled that trade for branches and worktrees: the
+ * capped list rides beside the count it was cut from. An empty array on an
+ * unsupported platform means "we did not look" — callers must not turn it into
+ * "nothing is running".
  */
-export function listenersIn(worktree) {
-  if (!worktree) return [];
+export function measureListeners(worktree) {
+  if (!worktree) return { rows: [], total: 0 };
   let rows;
   try {
     rows = platform() === 'linux' ? scanLinux(worktree) : platform() === 'darwin' ? scanDarwin(worktree) : [];
   } catch {
-    return [];
+    return { rows: [], total: 0 };
   }
-  return rows.sort((a, b) => a.port - b.port).slice(0, MAX_ROWS);
+  return { rows: rows.sort(byChosenThenPort).slice(0, MAX_ROWS), total: rows.length };
+}
+
+/** The capped rows alone, for callers with nowhere to put a total. */
+export function listenersIn(worktree) {
+  return measureListeners(worktree).rows;
 }
 
 /** Does this platform measure listeners at all? The web must render no preview

package/bin/lib/processes.mjs

@@ -80,6 +80,28 @@ function pgrpOf(pid) {
   return Number.isInteger(pgrp) && pgrp > 0 ? pgrp : null;
 }
 
+/**
+ * Resident set size in BYTES for one pid, or null.
+ *
+ * Read from `VmRSS` in /proc/<pid>/status rather than from `statm`, whose
+ * second field is resident PAGES and would need a page size we would have to
+ * assume. 4096 is not universal — arm64 boxes run 16K pages — and a memory
+ * readout that is silently four times wrong on somebody's machine is worse than
+ * no readout at all. `status` states its own unit.
+ *
+ * Lives here rather than in `listeners.mjs` because it is a fact about a
+ * PROCESS; both scanners import it, so there is one implementation of the unit
+ * question and not two that can drift.
+ */
+export function rssBytes(pid) {
+  try {
+    const m = /^VmRSS:\s+(\d+)\s+kB$/m.exec(readFileSync(`/proc/${pid}/status`, 'utf8'));
+    return m ? Number(m[1]) * 1024 : null;
+  } catch {
+    return null; // gone between the scan and the read — ordinary
+  }
+}
+
 function cmdlineOf(pid) {
   try {
     const raw = readFileSync(`/proc/${pid}/cmdline`, 'utf8');
@@ -109,7 +131,8 @@ function scanLinux(pgids) {
     if (pid === pgrp) continue;
     const cmd = cmdlineOf(raw);
     if (!cmd) continue;
-    out.push({ pid, pgid: pgrp, cmd });
+    const rss = rssBytes(raw);
+    out.push({ pid, pgid: pgrp, cmd, ...(rss != null ? { rss } : {}) });
   }
   return out;
 }
@@ -117,7 +140,7 @@ function scanLinux(pgids) {
 function scanDarwin(pgids) {
   let text;
   try {
-    text = execFileSync('ps', ['-axo', 'pid=,pgid=,command='], {
+    text = execFileSync('ps', ['-axo', 'pid=,pgid=,rss=,command='], {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: 5000,
@@ -128,13 +151,13 @@ function scanDarwin(pgids) {
   }
   const out = [];
   for (const line of text.split('\n')) {
-    const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+    const m = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/.exec(line);
     if (!m) continue;
     const pid = Number(m[1]);
     const pgid = Number(m[2]);
     if (!pgids.has(pgid) || pid === pgid) continue;
-    const cmd = m[3].trim();
-    if (cmd) out.push({ pid, pgid, cmd });
+    const cmd = m[4].trim();
+    if (cmd) out.push({ pid, pgid, cmd, rss: Number(m[3]) * 1024 }); // ps reports KB
   }
   return out;
 }
@@ -146,18 +169,36 @@ function scanDarwin(pgids) {
  * "looked, found none" and is a different fact a surface renders differently.
  */
 export function processesInGroups(pgids, { scrub } = {}) {
+  const m = measureProcesses(pgids, { scrub });
+  return m === null ? null : m.rows;
+}
+
+/**
+ * …and the TOTAL the cap was applied to.
+ *
+ * The rows alone are a lie about scale the moment a group has more than twelve
+ * members: a dashboard summing them states an incomplete figure as a complete
+ * one. Same rule the listener list and the Repository block's worktree counts
+ * keep — the capped list rides beside the count it was cut from, or it answers
+ * "how much is in here" with a number that is not true.
+ */
+export function measureProcesses(pgids, { scrub } = {}) {
   if (!processesSupported()) return null;
   const want = pgids instanceof Set ? pgids : new Set(pgids ?? []);
-  if (want.size === 0) return [];
+  if (want.size === 0) return { rows: [], total: 0 };
   const rows = platform() === 'darwin' ? scanDarwin(want) : scanLinux(want);
   // Oldest first: a pid is monotonic, so the long-running watcher you started
   // an hour ago sorts above the `sh -c` spawned two seconds ago. Cutting from
   // the END keeps the durable processes and drops the churn.
   rows.sort((a, b) => a.pid - b.pid);
-  return rows.slice(0, MAX_PROCS).map((r) => ({
+  const capped = rows.slice(0, MAX_PROCS).map((r) => ({
     pid: r.pid,
     cmd: String(scrub ? scrub(r.cmd) : r.cmd).slice(0, MAX_CMD),
+    // Absent rather than zero where it could not be read: a watcher using no
+    // memory is not a thing, so a 0 here would only ever mean "we failed".
+    ...(r.rss != null ? { rss: r.rss } : {}),
   }));
+  return { rows: capped, total: rows.length };
 }
 
 /**

package/bin/lib/repoState.mjs

@@ -32,7 +32,7 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { listenersIn, listenersSupported } from './listeners.mjs';
+import { measureListeners, listenersSupported } from './listeners.mjs';
 
 /** Same cap the session diffstat uses: enough to see the shape, small enough
  *  that one machine cannot flood a row. */
@@ -162,7 +162,13 @@ export function repoState(repoRoot, baseRef) {
    * Reported, not offered: this is a readout of what is up. Sharing one is a
    * separate act with its own gates (see previewJobs).
    */
-  const listening = listenersIn(repoRoot);
+  // The TOTAL beside the capped rows, for the reason every other capped list
+  // here carries one: a list silently cut at twelve answers "what is running in
+  // the checkout" with a number that is not true, and `wrangler dev` alone
+  // opens nine.
+  const lis = measureListeners(repoRoot);
+  const listening = lis.rows;
+  const listeningTotal = lis.total;
   const wt = worktrees ?? [];
   const br = branches ?? [];
   const sessionRows = br.filter((b) => b.session);
@@ -194,6 +200,7 @@ export function repoState(repoRoot, baseRef) {
       ? { sessionBranchesUnshipped: sessionRows.filter((b) => b.ahead > 0).length }
       : {}),
     listening,
+    listeningTotal,
     // "Nothing is listening" and "this machine cannot look" (Windows, a failed
     // scan) are the same empty array without this — and the second must never
     // render as the first. Same field, same reason, as the session report.

package/bin/lib/work.mjs

@@ -39,8 +39,9 @@ import {
   MODEL,
 } from './config.mjs';
 import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
-import { listenersIn, listenersSupported } from './listeners.mjs';
-import { processesInGroups, liveGroups, processesSupported } from './processes.mjs';
+import { listenersIn, measureListeners, listenersSupported } from './listeners.mjs';
+import { measureProcesses, liveGroups, processesSupported } from './processes.mjs';
+import { mutateRegistry, processAlive, readRegistry } from './procRegistry.mjs';
 import { createPlaceLock } from './placeLock.mjs';
 import { sweepMergedBranch } from './shipSweep.mjs';
 import { mergeOutward as shipMergeOutward } from './shipMerge.mjs';
@@ -125,6 +126,8 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
   const WORKTREES_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-worktrees');
   const DIFF_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/diff-done');
   const PREVIEW_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-claim');
+  const KILL_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/kill-done');
+  const KILL_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/kill-claim');
   const PREVIEW_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-done');
   const SESSION_COMMANDS_URL = FLEET_URL.replace(/\/agents\/?$/, '/session-commands');
   const ATTACHMENT_URL = FLEET_URL.replace(/\/agents\/?$/, '/attachment');
@@ -149,11 +152,65 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    */
   const sessionGroups = new Map(); // sessionId -> Set<pgid>
 
+  /**
+   * …AND IT SURVIVES A RESTART, which it did not until 2026-08-27.
+   *
+   * This map used to live only in this closure. The processes it tracks
+   * OUTLIVE the daemon on purpose — `shutdownWork` SIGTERMs the CLI child and
+   * never the group, precisely so an unattended auto-update does not kill the
+   * driver's dev server — so every daemon restart left a live watcher running
+   * with nothing left that knew whose it was. The tab reported `[]`, the web
+   * read that as "looked, found none", and the Running section went dark until
+   * some later turn happened to open a new group.
+   *
+   * That is not a small bug: AUTO_UPDATE is on by default, so it fired on every
+   * release, on every machine. And it broke the three-state rule this file
+   * states in its own header — the honest answer after a restart was "we have
+   * forgotten", and `[]` is not that. Persisting is what makes `[]` true again,
+   * which is why the fix is a disk write and not a fourth state.
+   *
+   * `procRegistry` is the right home and was sitting unused: it was built for
+   * exactly this ("the daemon spawns things that outlive it… the successor has
+   * to find them"), was orphaned when the dev-run system was deleted, and
+   * already does the atomic write, the stale-lock recovery, the entry cap and
+   * the dead-pid TTL. Its prune is deliberately LOOSE here — it keeps an entry
+   * whose leader is gone, because the leader is the CLI and it exits at the end
+   * of every turn while the watcher it started keeps running. `liveGroups` is
+   * the real prune, on every read, against the kernel.
+   */
+  const GROUPS_DIR = join(homedir(), '.flowviant');
+  const GROUPS_FILE = join(GROUPS_DIR, 'session-groups.json');
+  const GROUPS_LOCK = join(GROUPS_DIR, 'session-groups.lock');
+
+  const persistGroups = () => {
+    const flat = [];
+    for (const [sid, set] of sessionGroups)
+      for (const pgid of set) flat.push({ sessionId: sid, pid: pgid, startedAt: Date.now() });
+    try {
+      mutateRegistry(GROUPS_DIR, GROUPS_FILE, GROUPS_LOCK, () => flat);
+    } catch {
+      /* best-effort: losing the file costs a restart's visibility, never a turn */
+    }
+  };
+
+  try {
+    for (const e of readRegistry(GROUPS_FILE)) {
+      if (!e?.sessionId || !Number.isInteger(e?.pid)) continue;
+      const set = sessionGroups.get(e.sessionId) ?? new Set();
+      set.add(e.pid);
+      sessionGroups.set(e.sessionId, set);
+    }
+  } catch {
+    /* no registry yet — the ordinary first run */
+  }
+
   const noteSessionGroup = (sessionId, pgid) => {
     if (!sessionId || !pgid) return;
     const set = sessionGroups.get(sessionId) ?? new Set();
+    if (set.has(pgid)) return;
     set.add(pgid);
     sessionGroups.set(sessionId, set);
+    persistGroups();
   };
 
   /** This tab's live processes, or null where the machine cannot look. */
@@ -162,9 +219,24 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     const known = sessionGroups.get(sessionId);
     if (!known || known.size === 0) return [];
     const alive = liveGroups(known);
+    // Only touch the disk when the set actually MOVED. This runs on every
+    // sweep, for every live tab, forever; an unconditional write would be a
+    // file rewrite a minute for the life of the daemon to restate what is
+    // already there — the same reasoning the auto-name relay uses for its
+    // unchanged-title check.
+    const changed = alive.size !== known.size;
     if (alive.size === 0) sessionGroups.delete(sessionId);
     else sessionGroups.set(sessionId, alive);
-    return processesInGroups(alive, { scrub: envScrub });
+    if (changed) persistGroups();
+    return measureProcesses(alive, { scrub: envScrub });
+  };
+
+  /** Every process group this machine is tracking, across every tab — what a
+   *  kill request is checked against before anything is signalled. */
+  const allKnownGroups = () => {
+    const all = new Set();
+    for (const set of sessionGroups.values()) for (const g of set) all.add(g);
+    return all;
   };
 
 
@@ -479,7 +551,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     // report on an endpoint that already exists, so NO version floor, and
     // `processesSupported` keeps "cannot look" (Windows) apart from "looked and
     // found none", which renders differently.
-    const processes = sessionProcesses(sessionId);
+    const proc = sessionProcesses(sessionId);
     // THE NAME CLAUDE ALREADY GAVE THIS CONVERSATION, relayed.
     //
     // Claude Code titles its own sessions; a Flowviant tab was born "session 3"
@@ -503,12 +575,18 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     } catch {
       /* no marker yet — this tab has not spoken, or is not Claude */
     }
+    // The TOTAL rides beside the capped rows, because a list silently cut at
+    // twelve answers "what is running in here" with a number that is not true.
+    // `wrangler dev` alone opens nine, so the old cap of eight was already
+    // dropping a row on an ordinary stack with nothing on the wire to say so.
+    const lis = measureListeners(wt);
     return {
       sessionId,
       ...d,
-      listening: listenersIn(wt),
+      listening: lis.rows,
+      listeningTotal: lis.total,
       listeningSupported: listenersSupported(),
-      ...(processes === null ? {} : { processes }),
+      ...(proc === null ? {} : { processes: proc.rows, processesTotal: proc.total }),
       processesSupported: processesSupported(),
       ...(title ? { title } : {}),
     };
@@ -893,6 +971,211 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     livePreviews.clear();
   };
 
+  // ── stopping one measured process ────────────────────────────────────────
+  //
+  // The driver points at a row the MACHINE reported and says stop. Flowviant
+  // never picks the target, never sweeps, never signals anything on its own
+  // initiative, and never signals a GROUP — teardown deliberately SIGTERMs the
+  // CLI child and not its group precisely so an unattended auto-update cannot
+  // take the driver's dev server with it, and a control that signalled groups
+  // would hand that outcome back one click at a time.
+  //
+  // WHY THIS EXISTS AT ALL, since "ask your Claude to kill it" looks like it
+  // already covers it. It does not, and it fails hardest in the case that
+  // motivates it: every tab one person owns shares ONE place, the cross-process
+  // turn lock is per-place and deliberately un-scoped, so while any other tab
+  // of yours is mid-turn a new turn does not spawn — it warns and waits. If the
+  // runaway process you want stopped is being held by a turn that is hung, the
+  // turn that would kill it never runs. (Two more: FLOWVIANT_SAFE=1 — which the
+  // README recommends on a shared box — has no kill, pkill, lsof or ss in its
+  // allowlist; and under the README's own top hardening tip, a daemon on its
+  // own OS user, the operator's dev server is EPERM to the agent.)
+  //
+  // A PID IS NOT AN IDENTITY, and this is the whole safety argument. Pids are
+  // recycled, the row the browser is looking at is up to a sweep old, and the
+  // instance lock already learned this the expensive way — its own comment says
+  // "a looser version of this check SIGTERMed one". So the pid the server sends
+  // is a REQUEST, never an authority: this re-derives attribution from the
+  // kernel immediately before signalling, and refuses unless the pid is STILL
+  // in one of this tab's process groups or STILL holding a socket in this
+  // tab's place. A recycled pid belonging to something else fails that, which
+  // is the property a start-time witness would have bought at the cost of
+  // another wire field.
+  //
+  // CLAIMED, not read, for the reason `processPreviewJobs` states: two daemons
+  // legitimately share one credential and both are handed the same array.
+  // Signalling twice is survivable; signalling twice with a recycle in between
+  // is the failure this whole comment is about.
+  const killing = new Set(); // job ids in flight on this tick
+
+  const postKill = async (body) => {
+    try {
+      await fetch(KILL_DONE_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(30_000),
+        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
+      });
+    } catch {
+      /* unsettled, and the server expires it — the asker is told, never spun */
+    }
+  };
+
+  const claimKill = async (id) => {
+    try {
+      const res = await fetch(KILL_CLAIM_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
+      });
+      const j = await res.json().catch(() => null);
+      return j?.data?.claimed === true;
+    } catch {
+      return false; // the peer may hold it; doing nothing is the safe answer
+    }
+  };
+
+  /**
+   * Is this pid, RIGHT NOW, one of the things we told the browser about for
+   * this session? Two lanes, matching the two lists a row can come from.
+   *
+   * Deliberately re-measured rather than read from anything cached: a cache is
+   * exactly as old as the report the browser is acting on, and staleness is the
+   * hazard.
+   */
+  const killTargetOk = (sessionId, pid) => {
+    const groups = sessionGroups.get(sessionId);
+    if (groups && groups.size) {
+      const alive = liveGroups(groups);
+      const rows = measureProcesses(alive)?.rows ?? [];
+      if (rows.some((r) => r.pid === pid)) return true;
+    }
+    const wt = placeDir(sessionId);
+    if (wt) {
+      try {
+        if (measureListeners(wt).rows.some((r) => r.pid === pid)) return true;
+      } catch {
+        /* unmeasurable → not verified → refused, which is the safe direction */
+      }
+    }
+    return false;
+  };
+
+  /**
+   * How long to watch for the process to actually go before answering.
+   *
+   * SIGTERM is a REQUEST, not an event: a dev server traps it and tears down
+   * its children, which takes a beat. Answering the instant the signal returns
+   * would report "signalled" over a process that is about to die, and the
+   * surface would then offer Force stop on something already on its way out.
+   *
+   * Four seconds is long enough for the ordinary teardown and short enough that
+   * a person is still looking at the row. Past it the honest answer is that the
+   * signal landed and the thing is still there — which is a real state, and the
+   * one where escalating actually means something.
+   */
+  const KILL_GRACE_MS = 4000;
+
+  const waitForExit = async (pid) => {
+    const until = Date.now() + KILL_GRACE_MS;
+    while (Date.now() < until) {
+      if (!processAlive(pid)) return true;
+      await new Promise((r) => setTimeout(r, 200));
+    }
+    return !processAlive(pid);
+  };
+
+  const runKill = async (job) => {
+    const id = String(job.id);
+    const sessionId = String(job.sessionId || '');
+    const pid = Number(job.pid);
+    const signal = job.signal === 'KILL' ? 'SIGKILL' : 'SIGTERM';
+
+    if (!processesSupported()) {
+      await postKill({ id, outcome: 'unsupported' });
+      return;
+    }
+    if (!killTargetOk(sessionId, pid)) {
+      // Not a lie and not a failure: the process is genuinely no longer one of
+      // this tab's, which is the common case when somebody clicks a row that
+      // has since exited. The asker gets that sentence rather than a spinner —
+      // and the RE-MEASURE below is what takes the stale row off their screen,
+      // since a row you can click for something already gone is the readout
+      // being behind, not the person being wrong.
+      await postKill({ id, outcome: 'not_found' });
+      await remeasureAfterKill(sessionId);
+      return;
+    }
+    if (!(await claimKill(id))) return;
+    try {
+      process.kill(pid, signal);
+      // WHAT HAPPENED, not what we did. "We sent a signal" is a fact about us;
+      // "it stopped" is a fact about the machine, and the machine is standing
+      // right here able to check. Reporting the weaker word would also make the
+      // Force stop offer wrong for the whole window, since escalating only
+      // means something while the process is genuinely still there.
+      const gone = await waitForExit(pid);
+      await postKill({ id, outcome: gone ? 'stopped' : 'signalled', signal });
+    } catch (e) {
+      // EPERM is the daemon-on-its-own-user posture doing exactly what it is
+      // for. Report it as its own word: "we may not" and "it was gone" are
+      // different sentences and the surface says which.
+      await postKill({ id, outcome: e?.code === 'ESRCH' ? 'not_found' : 'error', detail: String(e?.code || e) });
+    }
+    await remeasureAfterKill(sessionId);
+  };
+
+  /**
+   * THE LIST THE PERSON IS LOOKING AT WAS MEASURED BEFORE ANY OF THIS.
+   *
+   * Without this the row survives the thing it describes: the panel renders the
+   * last sweep's `listening`, the sweep is on a SIXTY-SECOND beat, and the
+   * reported outcome sits next to a port row still claiming to be live. The
+   * first person to use it said exactly that — "i clicked stop on the listening
+   * but its still running… then it finally disappears".
+   *
+   * The rule it was missing is one this file already keeps everywhere else: an
+   * action that changes what the machine would measure must cause a new
+   * measurement. A turn settling does it; a kill did not. `reportSessionWorktree`
+   * is the un-throttled per-session path built for precisely this and it was
+   * being called from exactly one place.
+   *
+   * Never awaited by the caller's answer path: the outcome is posted first, so
+   * a slow re-measure can delay the list but never the sentence.
+   */
+  const remeasureAfterKill = async (sessionId) => {
+    try {
+      await reportSessionWorktree(sessionId);
+    } catch {
+      /* the 60s sweep still carries it — this only makes it prompt */
+    }
+  };
+
+  const processKillJobs = (jobs) => {
+    if (!Array.isArray(jobs) || jobs.length === 0) return;
+    for (const job of jobs.slice(0, 5)) {
+      const id = String(job?.id || '');
+      const pid = Number(job?.pid);
+      // Bounded at the boundary the same way sessionId and port already are.
+      // pid 1 is init and is never something a tab started; a signal there
+      // would ask the kernel to shut the box down.
+      if (!id || killing.has(id)) continue;
+      if (!Number.isInteger(pid) || pid <= 1 || pid > 4_294_967_295) continue;
+      if (!isSafePathSegment(String(job?.sessionId || ''))) continue;
+      killing.add(id);
+      void runKill(job).finally(() => killing.delete(id));
+    }
+  };
+
   const processDiffJobs = (jobs) => {
     if (!Array.isArray(jobs) || jobs.length === 0) return;
     for (const job of jobs.slice(0, 5)) {
@@ -2641,6 +2924,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
     processWorkTurns,
     processShipJobs,
     processDiffJobs,
+    processKillJobs,
     heldSessionIds,
     processPreviewJobs,
     livePreviewIds,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.70.0",
+  "version": "0.71.1",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {