flowviant 0.71.1 → 0.72.0

package/README.md

@@ -51,7 +51,7 @@ Nothing starts work except you opening a tab and typing in it.
 
 ## Sharing a preview
 
-You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed) behind a **mandatory password gate**. Flowviant stores only the tunnel URL; your browser talks to it directly.
+You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed) behind a **mandatory password gate**. Flowviant stores only the tunnel URL; your browser talks to it directly. Since 0.72.0 the gate also lets the Workbench embed the share in a frame: it rewrites the response's frame policy to permit exactly the app's origin, and a framed sign-in gets a partitioned cookie so it works where third-party cookies are blocked.
 
 The daemon never executes anything the repository declares. An earlier version read a `.flowviant/preview.json` from the branch and spawned the command it named — that start path was removed in 0.53.0 and is not coming back; see the header of `bin/lib/preview.mjs` for exactly what it did, so nobody rebuilds it.
 

package/bin/lib/authproxy.mjs

@@ -32,10 +32,45 @@
  *  - NEVER 302 A WEBSOCKET UPGRADE. Browsers do not follow 3xx on an upgrade,
  *    they fail the connection — HMR would break in a way that looks like a dead
  *    dev server. A cookie-less upgrade stays a 401.
- *  - `SameSite=Lax` is chosen, so this gate CANNOT be embedded in a
- *    cross-site iframe. The Workbench must not try; making it work would mean
- *    `SameSite=None`, which is a different security posture and a conscious
- *    re-argument, not a quiet flag change.
+ *  - THE FRAME IS THE APP'S AND ONLY THE APP'S (0.72.0, and this reverses the
+ *    old "cannot be embedded, the Workbench must not try" rule deliberately —
+ *    the Workbench now DOES frame the share, so both halves are re-argued
+ *    here). Two changes, one per blocker:
+ *    (a) THE COOKIE. `SameSite=Lax` is kept for a top-level visit — it is the
+ *        CSRF boundary and works in every browser ever shipped. A FRAMED
+ *        navigation (`Sec-Fetch-Dest: iframe`) instead gets `SameSite=None;
+ *        Partitioned` (CHIPS): partitioning keys the cookie to the top-level
+ *        site that framed it, so evil.com framing this hostname gets its OWN
+ *        empty jar, never the viewer's grant — which is why None here is not
+ *        the CSRF hole it would be unpartitioned. Branching on Sec-Fetch-Dest
+ *        rather than always sending both attributes matters: Safari 18.5–26.1
+ *        DROPPED any Set-Cookie carrying `Partitioned` outright, so stamping it
+ *        unconditionally would have broken the working top-level path on those
+ *        builds. A browser too old to send Sec-Fetch-Dest gets Lax and the
+ *        frame fails exactly as it always did — Open remains the escape.
+ *        AND THE PARTITIONING CLAIM HAS A BACKSTOP, because one browser class
+ *        breaks it: Chromium 76–113 (and same-vintage webviews/forks) sends
+ *        Sec-Fetch-Dest — so it takes this branch — while ignoring the
+ *        `Partitioned` attribute it has never heard of, storing a PLAIN
+ *        unpartitioned SameSite=None cookie: the exact CSRF hole the sentence
+ *        above says partitioning prevents. So `crossSiteAbuse` refuses a
+ *        GRANT-authenticated request that Fetch Metadata marks cross-site
+ *        unless it is a top-level GET/HEAD navigation (the Open link, the
+ *        frame's own src). Every browser in the vulnerable class sends
+ *        Sec-Fetch-Site (it shipped alongside Dest), a browser sending
+ *        neither never got a None cookie in the first place, and the password
+ *        path is exempt — Basic auth is never attached cross-site by a
+ *        browser, so curl and Playwright feel nothing.
+ *    (b) THE FRAME POLICY. In grant mode the forwarded response's frame policy
+ *        is REWRITTEN to `frame-ancestors 'self' <app origin>` (origin taken
+ *        from `authorizeUrl`, the one app fact this gate already holds). That
+ *        permits exactly ONE cross-origin framer — the app the viewer is
+ *        already authenticated to — instead of switching clickjacking
+ *        protection off for everyone; enforced `frame-ancestors` outranks
+ *        `X-Frame-Options` in every current engine, and the stripped XFO is
+ *        the belt-and-braces for the rest. Password-only mode rewrites
+ *        NOTHING: there is no app origin to allow and no cookie that could
+ *        authenticate a frame, so the origin's own policy stands verbatim.
  *
  * Three things this file gets wrong easily, all of them fixed here and all of
  * them worth keeping fixed:
@@ -155,6 +190,95 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
 
   const authed = (req) => credential(req) === 'ok';
 
+  /**
+   * The CSRF backstop for the partitioned cookie (header rule 4a): a browser
+   * old enough to ignore `Partitioned` while honouring `SameSite=None` will
+   * attach the grant to cross-site requests, so a request that FETCH METADATA
+   * says is cross-site is refused unless it is a plain navigation GET/HEAD —
+   * the two shapes this product legitimately serves cross-site (the Open
+   * link, the Workbench frame's own src; a rendered attacker frame is then
+   * stopped by the frame-ancestors rewrite). Applies ONLY to grant-cookie
+   * auth: a password in an Authorization header is never attached cross-site
+   * by a browser, and clients that send no Sec-Fetch headers never held a
+   * None cookie, so absence stays permitted.
+   */
+  const crossSiteAbuse = (req) => {
+    if (String(req.headers['sec-fetch-site'] || '').toLowerCase() !== 'cross-site') return false;
+    const mode = String(req.headers['sec-fetch-mode'] || '').toLowerCase();
+    // Cross-site fetch/XHR/img/script with the cookie — nothing legitimate
+    // looks like this: the framed app's own subresources are same-origin.
+    if (mode && mode !== 'navigate') return true;
+    // A cross-site POST navigation is the classic auto-submitted CSRF form.
+    return !(req.method === 'GET' || req.method === 'HEAD');
+  };
+
+  /** True when THIS request authenticated with the password rather than the
+   *  cookie — the credential class CSRF cannot ride. */
+  const viaPassword = (req) => sameSecret(req.headers['authorization'], expected);
+
+  /** The one app fact this gate holds: the origin allowed to frame us. Derived
+   *  from `authorizeUrl` (server-built from PUBLIC_APP_URL) rather than a new
+   *  wire field, so an older server changes nothing and no floor is needed. */
+  let appOrigin = null;
+  try {
+    if (grants) appOrigin = new URL(authorizeUrl).origin;
+  } catch {
+    appOrigin = null;
+  }
+
+  /**
+   * Replace the origin's frame policy with ours: `frame-ancestors 'self'
+   * <app origin>`. Rules that must survive any edit:
+   *  - REWRITE the directive inside an existing enforced CSP, never append a
+   *    second policy beside it — multiple CSP headers intersect, so an origin
+   *    `frame-ancestors 'none'` would still win over anything we added.
+   *  - APPEND a policy holding only our directive when the origin stated no
+   *    frame-ancestors at all — a public tunnel hostname deserves a frame
+   *    policy even when localhost never needed one.
+   *  - LEAVE Report-Only alone: browsers ignore frame-ancestors there, and
+   *    rewriting a report channel would be editing the driver's telemetry.
+   *  - DELETE X-Frame-Options: an enforced frame-ancestors makes every current
+   *    engine ignore it anyway; deleting is for the stragglers.
+   */
+  const framePolicy = () => `frame-ancestors 'self' ${appOrigin}`;
+  const rewriteFramePolicy = (headers) => {
+    if (!grants || !appOrigin) return headers;
+    const out = { ...headers };
+    delete out['x-frame-options'];
+    let sawDirective = false;
+    // Node joins duplicate response headers with ', ', so one string can hold
+    // SEVERAL policies (comma-separated), each holding several directives
+    // (semicolon-separated). Split on BOTH levels or replacing a directive
+    // eats the tail of a neighbouring policy — CSP source lists never contain
+    // a comma, so the outer split is safe.
+    const rewriteOne = (v) =>
+      String(v)
+        .split(',')
+        .map((policy) =>
+          policy
+            .split(';')
+            .map((part) => {
+              if (/^\s*frame-ancestors(\s|$)/i.test(part)) {
+                sawDirective = true;
+                return ` ${framePolicy()}`;
+              }
+              return part;
+            })
+            .join(';')
+        )
+        .join(',');
+    const csp = out['content-security-policy'];
+    if (csp !== undefined) {
+      out['content-security-policy'] = Array.isArray(csp) ? csp.map(rewriteOne) : rewriteOne(csp);
+    }
+    if (!sawDirective) {
+      const existing = out['content-security-policy'];
+      if (existing === undefined) out['content-security-policy'] = framePolicy();
+      else out['content-security-policy'] = Array.isArray(existing) ? [...existing, framePolicy()] : [existing, framePolicy()];
+    }
+    return out;
+  };
+
   // The gate credential is OURS and stops here. Everything else is passed
   // through untouched: the origin is the driver's own dev server and rewriting
   // its request would be us editing their app's input.
@@ -234,12 +358,18 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     if (!r.ok) return challenge(res);
     const to = safeRelative(u.searchParams.get('to'));
     const maxAge = Math.max(0, r.payload.exp - Math.floor(Date.now() / 1000));
+    // FRAMED means Partitioned (header rule 4a). Sec-Fetch-Dest survives the
+    // whole redirect chain (it describes the navigation, not the hop), so the
+    // callback sees `iframe` exactly when the Workbench is the one asking.
+    const dest = String(req.headers['sec-fetch-dest'] || '').toLowerCase();
+    const framed = dest === 'iframe' || dest === 'frame' || dest === 'embed' || dest === 'object';
+    const site = framed ? 'SameSite=None; Partitioned' : 'SameSite=Lax';
     // The immediate 302 to a clean path is MANDATORY, not cosmetic: it takes
     // `?g=` out of the address bar, out of the Referer every subresource would
     // carry, and out of browser history. It cannot take it out of cloudflared's
     // access log — which is why the grant is short-lived and share-bound.
     res.writeHead(302, {
-      'Set-Cookie': `${GRANT_COOKIE}=${r.raw}; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=${maxAge}`,
+      'Set-Cookie': `${GRANT_COOKIE}=${r.raw}; Path=/; Secure; HttpOnly; ${site}; Max-Age=${maxAge}`,
       Location: to,
       ...noStore,
     });
@@ -262,8 +392,18 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
       if (grants && verdict !== 'badpass' && isBrowserNav(req)) return bounce(req, res, verdict);
       return challenge(res);
     }
+    // 4. The grant is a cookie, and a cookie can be ridden (header rule 4a's
+    // backstop). Never a bounce — the caller HAS a credential; the request
+    // SHAPE is what is refused.
+    if (grants && crossSiteAbuse(req) && !viaPassword(req)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain', ...noStore });
+      res.end('cross-site request refused');
+      return;
+    }
     const proxyReq = request(forwardOpts(req), (proxyRes) => {
-      res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
+      // The one RESPONSE rewrite this gate performs (header rule 4b): the
+      // frame policy. Everything else is the driver's own app talking.
+      res.writeHead(proxyRes.statusCode || 502, rewriteFramePolicy(proxyRes.headers));
       proxyRes.pipe(res);
     });
     proxyReq.on('error', () => {
@@ -296,6 +436,14 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
       socket.destroy();
       return;
     }
+    // The same cross-site backstop as the request path: a cookie-ridden
+    // cross-site handshake (Sec-Fetch-Mode: websocket) is refused; the framed
+    // app's own HMR socket is same-origin and never trips it.
+    if (grants && crossSiteAbuse(req) && !viaPassword(req)) {
+      socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+      socket.destroy();
+      return;
+    }
     const proxyReq = request(forwardOpts(req));
     proxyReq.on('upgrade', (proxyRes, proxySocket, proxyHead) => {
       const headerLines = Object.entries(proxyRes.headers).map(([k, v]) => `${k}: ${v}`);

package/bin/lib/fleet.mjs

@@ -831,6 +831,24 @@ export async function runFleetDaemon() {
     getBaseRef,
     getMcpUrl: () => mcpUrl,
     getLeaseTtl: () => leaseTtlSeconds,
+    /**
+     * "THE REPO JUST CHANGED — look again."
+     *
+     * `maybeReportRepoState` is on its own 60s wall clock and nothing ever
+     * reset it, so every Flowviant action that alters the branch/worktree
+     * picture — a ship deleting the merged branch, retirement removing a
+     * directory and pruning, a tab being cut — left the rail's Repository block
+     * listing things that no longer exist for up to a minute. It is the same
+     * rule the diffstat just learned: an action that changes what the machine
+     * would measure must cause a new measurement.
+     *
+     * A callback rather than an export because work.mjs is imported BY this
+     * file, so it cannot import back. Clearing the timestamp is enough — the
+     * next reconcile does the scan, on the beat it already runs.
+     */
+    onRepoChanged: () => {
+      repoStateScanAt = 0;
+    },
   });
   workShutdown = shutdownWork; // teardown can now reach the live session CLIs
 

package/bin/lib/listeners.mjs

@@ -58,6 +58,26 @@ import { platform } from 'node:os';
 import { rssBytes } from './processes.mjs';
 import { sep } from 'node:path';
 
+/**
+ * INFRASTRUCTURE CHILDREN ARE NOT LISTENERS. cloudflared opens its own local
+ * metrics socket, and its cwd is inherited from the daemon — inside the
+ * checkout — so a live share put a `cloudflared` row in the repo place's list:
+ * Flowviant's own plumbing offered back to the operator as a thing to share or
+ * stop. Same rule as the `process.pid` exclusion below: a process that IS
+ * Flowviant is not a process Flowviant reports. `preview.mjs` registers each
+ * tunnel child here as it spawns it (that import direction already exists;
+ * the reverse would be a cycle). In-process is enough: a PEER daemon's tunnel
+ * lives in a different checkout, so cwd attribution already excludes it, and
+ * a crashed daemon's orphan is reaped at the next startup.
+ */
+const infraPids = new Set();
+export const noteInfraPid = (pid) => {
+  if (Number.isInteger(pid) && pid > 0) infraPids.add(pid);
+};
+export const forgetInfraPid = (pid) => {
+  infraPids.delete(pid);
+};
+
 /** A box with more processes than this is not one we walk per sweep. The scan
  *  is one readlink per pid and runs every reconcile; this is the runaway
  *  bound, not a capacity statement. */
@@ -261,6 +281,15 @@ function scanLinux(worktree) {
       continue; // not ours, or gone
     }
     if (!inside(cwd)) continue;
+    // NEVER THE DAEMON ITSELF. `startAuthProxy` binds a loopback port IN THIS
+    // PROCESS to gate a preview, and the daemon's own cwd is inside the
+    // checkout — so the gate was attributed to the repo place and surfaced as
+    // a listener the operator could click Stop on. Stopping it would take down
+    // the door in front of a live share, and it is not a thing anybody
+    // started: it is us. Same rule `processes.mjs` keeps by never reporting the
+    // group leader, for the same reason — a process that IS Flowviant is not a
+    // process Flowviant reports.
+    if (Number(pid) === process.pid || infraPids.has(Number(pid))) continue;
 
     let fds;
     try {
@@ -334,8 +363,12 @@ function scanDarwin(worktree) {
   } catch {
     /* no memory on this box — rows simply carry no rss */
   }
+  const self = String(process.pid);
   for (const line of lsof(['-nP', '-iTCP', '-sTCP:LISTEN', '-F', 'pn']).split('\n')) {
-    if (line.startsWith('p')) pid = line.slice(1);
+    // The daemon's own preview gate is not something the driver started — see
+    // the linux branch for the whole argument. Nor its cloudflared children.
+    if (line.startsWith('p'))
+      pid = line.slice(1) === self || infraPids.has(Number(line.slice(1))) ? null : line.slice(1);
     else if (line.startsWith('n') && pid) {
       const m = /:(\d+)$/.exec(line.slice(1));
       if (!m) continue;

package/bin/lib/preview.mjs

@@ -46,7 +46,7 @@ import {
 import { join } from 'node:path';
 import { homedir, platform, arch } from 'node:os';
 import { startAuthProxy } from './authproxy.mjs';
-import { isListening } from './listeners.mjs';
+import { forgetInfraPid, isListening, noteInfraPid } from './listeners.mjs';
 
 // ── cloudflared: pinned, verified, or not fetched at all ───────────────────
 
@@ -389,6 +389,7 @@ export async function openTunnel({
         }
       }
       forgetPreviewPid(tunnel.pid);
+      forgetInfraPid(tunnel.pid);
     }
   };
 
@@ -428,6 +429,9 @@ export async function openTunnel({
   // word would let a recycled pid land on an operator's own unrelated
   // cloudflared and group-SIGKILL it.
   recordPreviewPid(tunnel.pid, `--url http://localhost:${gate.port}`);
+  // Keep our own plumbing out of the listeners measurement (see listeners.mjs:
+  // cloudflared's metrics socket lives in the checkout's cwd).
+  noteInfraPid(tunnel.pid);
 
   return new Promise((resolve) => {
     let settled = false;

package/bin/lib/work.mjs

@@ -107,7 +107,15 @@ function brainFor(job) {
   return out;
 }
 
-export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, getLeaseTtl }) {
+export function createWorkManager({
+  repoRoot,
+  baseDir,
+  getBaseRef,
+  getMcpUrl,
+  getLeaseTtl,
+  /** "The repo picture changed — look again." See the caller in fleet.mjs. */
+  onRepoChanged = () => {},
+}) {
   /**
    * WHERE SHIP LANDS, read fresh every time rather than captured at startup.
    *
@@ -319,6 +327,19 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
       // The report has landed, so the idempotency path no longer needs the
       // branch to exist. See `sweepMergedSessionBranch`.
       sweepMergedSessionBranch(sessionId);
+      // AND THE DIFFSTAT IS NOW WRONG BY DEFINITION. A ship folds base in,
+      // merges the tip out and deletes the branch, so a fresh measurement reads
+      // `ahead: 0` with an empty diffstat — and without this the rail keeps
+      // rendering the ENTIRE pre-ship diff while the transcript two hundred
+      // pixels away says "Shipped to main". The ship button re-arms over a
+      // branch that is already merged. Same rule the kill path just learned:
+      // an action that changes what the machine would measure must cause a new
+      // measurement, and the 60s sweep is not that.
+      void reportPlaceWorktrees(sessionId).catch(() => {});
+      // …and the REPO picture changed too: the session branch is gone and base
+      // moved. Without this the Repository block keeps counting a branch the
+      // ship just deleted.
+      onRepoChanged();
     }
     return r;
   };
@@ -591,11 +612,43 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
       ...(title ? { title } : {}),
     };
   };
-  /** One session, now — called after its turn settles. */
+  /** One session, now. */
   const reportSessionWorktree = async (sessionId) => {
     const r = sessionWorktreeReport(sessionId);
     if (r) await postWorktrees([r]);
   };
+
+  /**
+   * …AND EVERY OTHER TAB STANDING IN THE SAME DIRECTORY.
+   *
+   * One tab is not one directory any more. Since tabs moved into the driver's
+   * own folder, every tab a person owns resolves to the SAME place — so a turn
+   * in tab A changed the directory tab B is also describing, and only tab A was
+   * re-measured. Tab B went on rendering its pre-turn `+A −D` for up to a
+   * minute, which makes the tab strip visibly disagree with itself about one
+   * directory. That is the "why are two tabs showing one dev server" confusion
+   * the places readout exists to END, arriving through the diffstat instead.
+   *
+   * It fires on EVERY turn, every ship and every stop, which is what made this
+   * the most-hit instance of the rule and the least visible: nothing is wrong
+   * on the tab you are looking at.
+   *
+   * Bounded by the live set the roster last handed us, and the reports go in
+   * ONE post — the endpoint is already batched, and a tab per request would
+   * turn a five-tab place into five round trips on every settle.
+   */
+  const reportPlaceWorktrees = async (sessionId) => {
+    const place = placeOf(sessionId);
+    const ids = [sessionId];
+    // `worktreeSeen` is the roster's own live set, pruned to `activeWorkSessions`
+    // on every sweep — so this can never report a tab that has closed, and it
+    // needs no second source of truth about which tabs exist.
+    for (const id of worktreeSeen) {
+      if (id !== sessionId && placeOf(id) === place) ids.push(id);
+    }
+    const reports = ids.map(sessionWorktreeReport).filter(Boolean);
+    if (reports.length) await postWorktrees(reports);
+  };
   /** Every live session, throttled — called from the reconcile loop. */
   /**
    * A SESSION NOBODY HAS MEASURED YET JUMPS THE SWEEP (2026-08-26).
@@ -1154,7 +1207,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    */
   const remeasureAfterKill = async (sessionId) => {
     try {
-      await reportSessionWorktree(sessionId);
+      await reportPlaceWorktrees(sessionId);
     } catch {
       /* the 60s sweep still carries it — this only makes it prompt */
     }
@@ -1444,6 +1497,9 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
         git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
       } catch {
         git(['worktree', 'prune'], repoRoot);
+        // A directory and a branch just stopped existing. The Repository block
+        // would otherwise keep listing both until its own 60s scan came round.
+        onRepoChanged();
         try {
           // The branch may already exist (a retired directory's work) — attach.
           git(['worktree', 'add', wt, branch], repoRoot);
@@ -2535,7 +2591,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // written half a file, and the tab should show that honestly). NOT
           // awaited: this runs inside the session's chain, and a slow POST
           // would delay the next turn of that tab behind a readout.
-          void reportSessionWorktree(job.sessionId).catch(() => {});
+          void reportPlaceWorktrees(job.sessionId).catch(() => {});
         }
       });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.71.1",
+  "version": "0.72.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {