flowviant 0.71.1 → 0.73.0

package/README.md

@@ -51,7 +51,7 @@ Nothing starts work except you opening a tab and typing in it.
 
 ## Sharing a preview
 
-You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed) behind a **mandatory password gate**. Flowviant stores only the tunnel URL; your browser talks to it directly.
+You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed) behind a **mandatory password gate**. Flowviant stores only the tunnel URL; your browser talks to it directly. Since 0.72.0 the gate also lets the Workbench embed the share in a frame: it rewrites the response's frame policy to permit exactly the app's origin, and a framed sign-in gets a partitioned cookie so it works where third-party cookies are blocked.
 
 The daemon never executes anything the repository declares. An earlier version read a `.flowviant/preview.json` from the branch and spawned the command it named — that start path was removed in 0.53.0 and is not coming back; see the header of `bin/lib/preview.mjs` for exactly what it did, so nobody rebuilds it.
 

package/bin/cli.mjs

@@ -244,7 +244,7 @@ if (process.argv[2] === 'env') {
 // two TTYs and cannot be asked anything — the first read raises SIGTTIN and the
 // kernel STOPS the process, which is why 0.55.2's timeout did not save it (a
 // stopped process runs no timers). See tty.mjs.
-const { canPrompt, askWithTimeout } = await import('./lib/tty.mjs');
+const { canPrompt, askWithTimeout, selectMenu, menuSupported } = await import('./lib/tty.mjs');
 const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
 
 /** How long the one-time binding confirm waits before serving unbound. A person
@@ -285,6 +285,8 @@ if (!FLEET_TOKEN) {
   }
   if (CREDENTIAL.choices?.length && interactive) {
     const creds = await import('./lib/credentials.mjs');
+    const { originSlug } = await import('./lib/git.mjs');
+    const { basename } = await import('node:path');
     const { choices, repoRoot } = CREDENTIAL;
     console.log(
       CREDENTIAL.reason === 'outside-repo'
@@ -293,27 +295,78 @@ if (!FLEET_TOKEN) {
           ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
           : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
     );
-    console.log(listLines(choices, creds));
-    console.log(`  ${choices.length + 1}. connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`);
+
+    const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`;
+    // WHICH ONE LOOKS RIGHT — a pre-selection, never an auto-serve. The resolver
+    // refuses to serve a project the repo PATH did not name (the skadooble law);
+    // this only decides which row the cursor starts on, using the repo's folder
+    // name and its github repo-name against the stored project names. A unique
+    // match becomes ONE keypress; a wrong guess costs nothing, because the human
+    // still confirms. `multiple-bound` gets no hint — every choice already names
+    // this repo, so nothing distinguishes them.
+    const slug = repoRoot ? originSlug(repoRoot) : null;
+    const likely =
+      CREDENTIAL.reason === 'multiple-bound'
+        ? -1
+        : creds.likelyChoiceIndex(choices, {
+            repoBasename: repoRoot ? basename(repoRoot) : null,
+            repoSlugName: slug ? slug.split('/')[1] : null,
+          });
+
     // Bounded like the confirm below, and for the same reason — but silence
     // means something DIFFERENT here and the difference is load-bearing. There
     // is a real ambiguity to resolve; serving a guess is the skadooble bug.
     // So no answer REFUSES, which is exactly what this branch already does
     // headless, and the message says how to answer without being present.
-    const raw = await askWithTimeout(
-      `Which project should this daemon serve? [1-${choices.length + 1}] `,
-      PICK_TIMEOUT_MS
-    );
-    if (raw === null) {
-      console.error(
-        `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
-          `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
+    let chosen = null; // 0-based into [...choices, login]
+    if (menuSupported()) {
+      const rowLabel = (e) =>
+        creds.projectLabel(e) + (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet');
+      const options = [...choices.map(rowLabel), loginLabel];
+      // Say WHY the cursor starts where it does — "intuitive" made visible.
+      if (likely >= 0) options[likely] += '   ← looks like this repo';
+      const res = await selectMenu({
+        options,
+        defaultIndex: likely >= 0 ? likely : 0,
+        timeoutMs: PICK_TIMEOUT_MS,
+      });
+      if (res.timedOut) {
+        console.error(
+          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
+            `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
+        );
+        process.exit(1);
+      }
+      if (res.cancelled) {
+        console.error('nothing chosen — nothing started.');
+        process.exit(1);
+      }
+      if (!res.unsupported) chosen = res.index;
+    }
+    if (chosen === null) {
+      // Numeric fallback — a pipe, or a terminal without raw mode. Empty Enter
+      // takes the likely default when there is one, so it is one keystroke here
+      // too.
+      console.log(listLines(choices, creds));
+      console.log(`  ${choices.length + 1}. ${loginLabel}`);
+      const hint = likely >= 0 ? ` (enter for ${creds.projectLabel(choices[likely])})` : '';
+      const raw = await askWithTimeout(
+        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `,
+        PICK_TIMEOUT_MS
       );
-      process.exit(1);
+      if (raw === null) {
+        console.error(
+          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
+            `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
+        );
+        process.exit(1);
+      }
+      const n = raw === '' && likely >= 0 ? likely + 1 : Number.parseInt(raw, 10);
+      chosen = Number.isInteger(n) ? n - 1 : -1;
     }
-    const n = Number.parseInt(raw, 10);
-    if (n === choices.length + 1) await reexecAfterLogin();
-    const picked = Number.isInteger(n) ? choices[n - 1] : undefined;
+
+    if (chosen === choices.length) await reexecAfterLogin();
+    const picked = chosen >= 0 ? choices[chosen] : undefined;
     if (!picked) {
       console.error('nothing chosen — nothing started.');
       process.exit(1);

package/bin/lib/authproxy.mjs

@@ -32,10 +32,45 @@
  *  - NEVER 302 A WEBSOCKET UPGRADE. Browsers do not follow 3xx on an upgrade,
  *    they fail the connection — HMR would break in a way that looks like a dead
  *    dev server. A cookie-less upgrade stays a 401.
- *  - `SameSite=Lax` is chosen, so this gate CANNOT be embedded in a
- *    cross-site iframe. The Workbench must not try; making it work would mean
- *    `SameSite=None`, which is a different security posture and a conscious
- *    re-argument, not a quiet flag change.
+ *  - THE FRAME IS THE APP'S AND ONLY THE APP'S (0.72.0, and this reverses the
+ *    old "cannot be embedded, the Workbench must not try" rule deliberately —
+ *    the Workbench now DOES frame the share, so both halves are re-argued
+ *    here). Two changes, one per blocker:
+ *    (a) THE COOKIE. `SameSite=Lax` is kept for a top-level visit — it is the
+ *        CSRF boundary and works in every browser ever shipped. A FRAMED
+ *        navigation (`Sec-Fetch-Dest: iframe`) instead gets `SameSite=None;
+ *        Partitioned` (CHIPS): partitioning keys the cookie to the top-level
+ *        site that framed it, so evil.com framing this hostname gets its OWN
+ *        empty jar, never the viewer's grant — which is why None here is not
+ *        the CSRF hole it would be unpartitioned. Branching on Sec-Fetch-Dest
+ *        rather than always sending both attributes matters: Safari 18.5–26.1
+ *        DROPPED any Set-Cookie carrying `Partitioned` outright, so stamping it
+ *        unconditionally would have broken the working top-level path on those
+ *        builds. A browser too old to send Sec-Fetch-Dest gets Lax and the
+ *        frame fails exactly as it always did — Open remains the escape.
+ *        AND THE PARTITIONING CLAIM HAS A BACKSTOP, because one browser class
+ *        breaks it: Chromium 76–113 (and same-vintage webviews/forks) sends
+ *        Sec-Fetch-Dest — so it takes this branch — while ignoring the
+ *        `Partitioned` attribute it has never heard of, storing a PLAIN
+ *        unpartitioned SameSite=None cookie: the exact CSRF hole the sentence
+ *        above says partitioning prevents. So `crossSiteAbuse` refuses a
+ *        GRANT-authenticated request that Fetch Metadata marks cross-site
+ *        unless it is a top-level GET/HEAD navigation (the Open link, the
+ *        frame's own src). Every browser in the vulnerable class sends
+ *        Sec-Fetch-Site (it shipped alongside Dest), a browser sending
+ *        neither never got a None cookie in the first place, and the password
+ *        path is exempt — Basic auth is never attached cross-site by a
+ *        browser, so curl and Playwright feel nothing.
+ *    (b) THE FRAME POLICY. In grant mode the forwarded response's frame policy
+ *        is REWRITTEN to `frame-ancestors 'self' <app origin>` (origin taken
+ *        from `authorizeUrl`, the one app fact this gate already holds). That
+ *        permits exactly ONE cross-origin framer — the app the viewer is
+ *        already authenticated to — instead of switching clickjacking
+ *        protection off for everyone; enforced `frame-ancestors` outranks
+ *        `X-Frame-Options` in every current engine, and the stripped XFO is
+ *        the belt-and-braces for the rest. Password-only mode rewrites
+ *        NOTHING: there is no app origin to allow and no cookie that could
+ *        authenticate a frame, so the origin's own policy stands verbatim.
  *
  * Three things this file gets wrong easily, all of them fixed here and all of
  * them worth keeping fixed:
@@ -155,6 +190,95 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
 
   const authed = (req) => credential(req) === 'ok';
 
+  /**
+   * The CSRF backstop for the partitioned cookie (header rule 4a): a browser
+   * old enough to ignore `Partitioned` while honouring `SameSite=None` will
+   * attach the grant to cross-site requests, so a request that FETCH METADATA
+   * says is cross-site is refused unless it is a plain navigation GET/HEAD —
+   * the two shapes this product legitimately serves cross-site (the Open
+   * link, the Workbench frame's own src; a rendered attacker frame is then
+   * stopped by the frame-ancestors rewrite). Applies ONLY to grant-cookie
+   * auth: a password in an Authorization header is never attached cross-site
+   * by a browser, and clients that send no Sec-Fetch headers never held a
+   * None cookie, so absence stays permitted.
+   */
+  const crossSiteAbuse = (req) => {
+    if (String(req.headers['sec-fetch-site'] || '').toLowerCase() !== 'cross-site') return false;
+    const mode = String(req.headers['sec-fetch-mode'] || '').toLowerCase();
+    // Cross-site fetch/XHR/img/script with the cookie — nothing legitimate
+    // looks like this: the framed app's own subresources are same-origin.
+    if (mode && mode !== 'navigate') return true;
+    // A cross-site POST navigation is the classic auto-submitted CSRF form.
+    return !(req.method === 'GET' || req.method === 'HEAD');
+  };
+
+  /** True when THIS request authenticated with the password rather than the
+   *  cookie — the credential class CSRF cannot ride. */
+  const viaPassword = (req) => sameSecret(req.headers['authorization'], expected);
+
+  /** The one app fact this gate holds: the origin allowed to frame us. Derived
+   *  from `authorizeUrl` (server-built from PUBLIC_APP_URL) rather than a new
+   *  wire field, so an older server changes nothing and no floor is needed. */
+  let appOrigin = null;
+  try {
+    if (grants) appOrigin = new URL(authorizeUrl).origin;
+  } catch {
+    appOrigin = null;
+  }
+
+  /**
+   * Replace the origin's frame policy with ours: `frame-ancestors 'self'
+   * <app origin>`. Rules that must survive any edit:
+   *  - REWRITE the directive inside an existing enforced CSP, never append a
+   *    second policy beside it — multiple CSP headers intersect, so an origin
+   *    `frame-ancestors 'none'` would still win over anything we added.
+   *  - APPEND a policy holding only our directive when the origin stated no
+   *    frame-ancestors at all — a public tunnel hostname deserves a frame
+   *    policy even when localhost never needed one.
+   *  - LEAVE Report-Only alone: browsers ignore frame-ancestors there, and
+   *    rewriting a report channel would be editing the driver's telemetry.
+   *  - DELETE X-Frame-Options: an enforced frame-ancestors makes every current
+   *    engine ignore it anyway; deleting is for the stragglers.
+   */
+  const framePolicy = () => `frame-ancestors 'self' ${appOrigin}`;
+  const rewriteFramePolicy = (headers) => {
+    if (!grants || !appOrigin) return headers;
+    const out = { ...headers };
+    delete out['x-frame-options'];
+    let sawDirective = false;
+    // Node joins duplicate response headers with ', ', so one string can hold
+    // SEVERAL policies (comma-separated), each holding several directives
+    // (semicolon-separated). Split on BOTH levels or replacing a directive
+    // eats the tail of a neighbouring policy — CSP source lists never contain
+    // a comma, so the outer split is safe.
+    const rewriteOne = (v) =>
+      String(v)
+        .split(',')
+        .map((policy) =>
+          policy
+            .split(';')
+            .map((part) => {
+              if (/^\s*frame-ancestors(\s|$)/i.test(part)) {
+                sawDirective = true;
+                return ` ${framePolicy()}`;
+              }
+              return part;
+            })
+            .join(';')
+        )
+        .join(',');
+    const csp = out['content-security-policy'];
+    if (csp !== undefined) {
+      out['content-security-policy'] = Array.isArray(csp) ? csp.map(rewriteOne) : rewriteOne(csp);
+    }
+    if (!sawDirective) {
+      const existing = out['content-security-policy'];
+      if (existing === undefined) out['content-security-policy'] = framePolicy();
+      else out['content-security-policy'] = Array.isArray(existing) ? [...existing, framePolicy()] : [existing, framePolicy()];
+    }
+    return out;
+  };
+
   // The gate credential is OURS and stops here. Everything else is passed
   // through untouched: the origin is the driver's own dev server and rewriting
   // its request would be us editing their app's input.
@@ -234,12 +358,18 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     if (!r.ok) return challenge(res);
     const to = safeRelative(u.searchParams.get('to'));
     const maxAge = Math.max(0, r.payload.exp - Math.floor(Date.now() / 1000));
+    // FRAMED means Partitioned (header rule 4a). Sec-Fetch-Dest survives the
+    // whole redirect chain (it describes the navigation, not the hop), so the
+    // callback sees `iframe` exactly when the Workbench is the one asking.
+    const dest = String(req.headers['sec-fetch-dest'] || '').toLowerCase();
+    const framed = dest === 'iframe' || dest === 'frame' || dest === 'embed' || dest === 'object';
+    const site = framed ? 'SameSite=None; Partitioned' : 'SameSite=Lax';
     // The immediate 302 to a clean path is MANDATORY, not cosmetic: it takes
     // `?g=` out of the address bar, out of the Referer every subresource would
     // carry, and out of browser history. It cannot take it out of cloudflared's
     // access log — which is why the grant is short-lived and share-bound.
     res.writeHead(302, {
-      'Set-Cookie': `${GRANT_COOKIE}=${r.raw}; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=${maxAge}`,
+      'Set-Cookie': `${GRANT_COOKIE}=${r.raw}; Path=/; Secure; HttpOnly; ${site}; Max-Age=${maxAge}`,
       Location: to,
       ...noStore,
     });
@@ -262,8 +392,18 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
       if (grants && verdict !== 'badpass' && isBrowserNav(req)) return bounce(req, res, verdict);
       return challenge(res);
     }
+    // 4. The grant is a cookie, and a cookie can be ridden (header rule 4a's
+    // backstop). Never a bounce — the caller HAS a credential; the request
+    // SHAPE is what is refused.
+    if (grants && crossSiteAbuse(req) && !viaPassword(req)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain', ...noStore });
+      res.end('cross-site request refused');
+      return;
+    }
     const proxyReq = request(forwardOpts(req), (proxyRes) => {
-      res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
+      // The one RESPONSE rewrite this gate performs (header rule 4b): the
+      // frame policy. Everything else is the driver's own app talking.
+      res.writeHead(proxyRes.statusCode || 502, rewriteFramePolicy(proxyRes.headers));
       proxyRes.pipe(res);
     });
     proxyReq.on('error', () => {
@@ -296,6 +436,14 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
       socket.destroy();
       return;
     }
+    // The same cross-site backstop as the request path: a cookie-ridden
+    // cross-site handshake (Sec-Fetch-Mode: websocket) is refused; the framed
+    // app's own HMR socket is same-origin and never trips it.
+    if (grants && crossSiteAbuse(req) && !viaPassword(req)) {
+      socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+      socket.destroy();
+      return;
+    }
     const proxyReq = request(forwardOpts(req));
     proxyReq.on('upgrade', (proxyRes, proxySocket, proxyHead) => {
       const headerLines = Object.entries(proxyRes.headers).map(([k, v]) => `${k}: ${v}`);

package/bin/lib/credentials.mjs

@@ -136,6 +136,40 @@ export function projectLabel(e) {
   return e?.name ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
 }
 
+/** Collapse a name or slug for loose comparison: "My Project", "my-project"
+ *  and "myproject" all become "myproject". */
+function normalizeName(s) {
+  return String(s ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, '');
+}
+
+/**
+ * WHICH stored project most likely goes with this repo — a HINT for the
+ * picker's default, and DELIBERATELY not a licence to serve it. `resolveStored
+ * Credential` matches by repo PATH and refuses to guess past that, because
+ * serving a project the path did not name is the "it said skadooble in my
+ * calendar repo" surprise this whole file exists to prevent. A name that
+ * matches the repo's folder or its github repo-name is softer evidence — good
+ * enough to put the cursor on that row so the answer is one keypress, never
+ * good enough to skip the human. Two names can collide (a project "api" and a
+ * repo "api"), which is exactly why this only pre-selects.
+ *
+ * Returns the index of a UNIQUE match, or -1 when nothing matches or more than
+ * one does — an ambiguous hint is not a hint, and a default that is as likely
+ * wrong as right is worse than starting at the top.
+ */
+export function likelyChoiceIndex(choices, { repoBasename, repoSlugName } = {}) {
+  const wants = new Set([normalizeName(repoBasename), normalizeName(repoSlugName)].filter(Boolean));
+  if (wants.size === 0) return -1;
+  const hits = [];
+  choices.forEach((e, i) => {
+    const n = normalizeName(e?.name);
+    if (n && wants.has(n)) hits.push(i);
+  });
+  return hits.length === 1 ? hits[0] : -1;
+}
+
 function mutate(fn) {
   const f = readFile() ?? {};
   if (!f.projects || typeof f.projects !== 'object') f.projects = {};

package/bin/lib/fleet.mjs

@@ -831,6 +831,24 @@ export async function runFleetDaemon() {
     getBaseRef,
     getMcpUrl: () => mcpUrl,
     getLeaseTtl: () => leaseTtlSeconds,
+    /**
+     * "THE REPO JUST CHANGED — look again."
+     *
+     * `maybeReportRepoState` is on its own 60s wall clock and nothing ever
+     * reset it, so every Flowviant action that alters the branch/worktree
+     * picture — a ship deleting the merged branch, retirement removing a
+     * directory and pruning, a tab being cut — left the rail's Repository block
+     * listing things that no longer exist for up to a minute. It is the same
+     * rule the diffstat just learned: an action that changes what the machine
+     * would measure must cause a new measurement.
+     *
+     * A callback rather than an export because work.mjs is imported BY this
+     * file, so it cannot import back. Clearing the timestamp is enough — the
+     * next reconcile does the scan, on the beat it already runs.
+     */
+    onRepoChanged: () => {
+      repoStateScanAt = 0;
+    },
   });
   workShutdown = shutdownWork; // teardown can now reach the live session CLIs
 

package/bin/lib/listeners.mjs

@@ -58,6 +58,26 @@ import { platform } from 'node:os';
 import { rssBytes } from './processes.mjs';
 import { sep } from 'node:path';
 
+/**
+ * INFRASTRUCTURE CHILDREN ARE NOT LISTENERS. cloudflared opens its own local
+ * metrics socket, and its cwd is inherited from the daemon — inside the
+ * checkout — so a live share put a `cloudflared` row in the repo place's list:
+ * Flowviant's own plumbing offered back to the operator as a thing to share or
+ * stop. Same rule as the `process.pid` exclusion below: a process that IS
+ * Flowviant is not a process Flowviant reports. `preview.mjs` registers each
+ * tunnel child here as it spawns it (that import direction already exists;
+ * the reverse would be a cycle). In-process is enough: a PEER daemon's tunnel
+ * lives in a different checkout, so cwd attribution already excludes it, and
+ * a crashed daemon's orphan is reaped at the next startup.
+ */
+const infraPids = new Set();
+export const noteInfraPid = (pid) => {
+  if (Number.isInteger(pid) && pid > 0) infraPids.add(pid);
+};
+export const forgetInfraPid = (pid) => {
+  infraPids.delete(pid);
+};
+
 /** A box with more processes than this is not one we walk per sweep. The scan
  *  is one readlink per pid and runs every reconcile; this is the runaway
  *  bound, not a capacity statement. */
@@ -261,6 +281,15 @@ function scanLinux(worktree) {
       continue; // not ours, or gone
     }
     if (!inside(cwd)) continue;
+    // NEVER THE DAEMON ITSELF. `startAuthProxy` binds a loopback port IN THIS
+    // PROCESS to gate a preview, and the daemon's own cwd is inside the
+    // checkout — so the gate was attributed to the repo place and surfaced as
+    // a listener the operator could click Stop on. Stopping it would take down
+    // the door in front of a live share, and it is not a thing anybody
+    // started: it is us. Same rule `processes.mjs` keeps by never reporting the
+    // group leader, for the same reason — a process that IS Flowviant is not a
+    // process Flowviant reports.
+    if (Number(pid) === process.pid || infraPids.has(Number(pid))) continue;
 
     let fds;
     try {
@@ -334,8 +363,12 @@ function scanDarwin(worktree) {
   } catch {
     /* no memory on this box — rows simply carry no rss */
   }
+  const self = String(process.pid);
   for (const line of lsof(['-nP', '-iTCP', '-sTCP:LISTEN', '-F', 'pn']).split('\n')) {
-    if (line.startsWith('p')) pid = line.slice(1);
+    // The daemon's own preview gate is not something the driver started — see
+    // the linux branch for the whole argument. Nor its cloudflared children.
+    if (line.startsWith('p'))
+      pid = line.slice(1) === self || infraPids.has(Number(line.slice(1))) ? null : line.slice(1);
     else if (line.startsWith('n') && pid) {
       const m = /:(\d+)$/.exec(line.slice(1));
       if (!m) continue;

package/bin/lib/preview.mjs

@@ -46,7 +46,7 @@ import {
 import { join } from 'node:path';
 import { homedir, platform, arch } from 'node:os';
 import { startAuthProxy } from './authproxy.mjs';
-import { isListening } from './listeners.mjs';
+import { forgetInfraPid, isListening, noteInfraPid } from './listeners.mjs';
 
 // ── cloudflared: pinned, verified, or not fetched at all ───────────────────
 
@@ -389,6 +389,7 @@ export async function openTunnel({
         }
       }
       forgetPreviewPid(tunnel.pid);
+      forgetInfraPid(tunnel.pid);
     }
   };
 
@@ -428,6 +429,9 @@ export async function openTunnel({
   // word would let a recycled pid land on an operator's own unrelated
   // cloudflared and group-SIGKILL it.
   recordPreviewPid(tunnel.pid, `--url http://localhost:${gate.port}`);
+  // Keep our own plumbing out of the listeners measurement (see listeners.mjs:
+  // cloudflared's metrics socket lives in the checkout's cwd).
+  noteInfraPid(tunnel.pid);
 
   return new Promise((resolve) => {
     let settled = false;

package/bin/lib/tty.mjs

@@ -109,3 +109,126 @@ export async function askWithTimeout(query, timeoutMs) {
     process.off('SIGTTOU', noop);
   }
 }
+
+/**
+ * Can we draw an arrow-navigable menu? Raw mode is what turns ↑/↓ into
+ * keystrokes we receive one at a time; without `setRawMode` (a pipe, a
+ * terminal that refuses raw input) there is nothing to drive, and the caller
+ * falls back to the numeric prompt rather than drawing a menu nobody can move.
+ * `canPrompt()` still gates whether we ask AT ALL — this only decides HOW.
+ */
+export function menuSupported() {
+  return Boolean(
+    process.stdin.isTTY && process.stdout.isTTY && typeof process.stdin.setRawMode === 'function'
+  );
+}
+
+/**
+ * The menu's key handling, PURE so it can be tested without a terminal. Given a
+ * keypress and the current cursor, returns exactly one intent:
+ *   { index }   move the highlight (arrows wrap; k/j vim-style; g/G ends)
+ *   { choose }  take a row (Enter takes the highlight; 1–9 jump-and-take)
+ *   { cancel }  Esc, q, or Ctrl-C — nothing chosen
+ *   null        a key we ignore
+ * A number past the end is ignored, not clamped: pressing 9 in a 3-row list
+ * must not silently select row 3.
+ */
+export function menuKey(key, { index, count }) {
+  if (key === '\x03' || key === '\x1b' || key === 'q' || key === 'Q') return { cancel: true };
+  if (key === '\r' || key === '\n') return { choose: index };
+  if (key === '\x1b[A' || key === 'k') return { index: (index - 1 + count) % count };
+  if (key === '\x1b[B' || key === 'j') return { index: (index + 1) % count };
+  if (key === '\x1b[H' || key === 'g') return { index: 0 };
+  if (key === '\x1b[F' || key === 'G') return { index: count - 1 };
+  if (/^[1-9]$/.test(key)) {
+    const n = Number(key) - 1;
+    return n < count ? { choose: n } : null;
+  }
+  return null;
+}
+
+const MENU_FOOTER = '↑/↓ move · enter select · 1–9 jump · esc cancel';
+
+/**
+ * An arrow-navigable picker for the start path. Resolves one of:
+ *   { index }        the row taken
+ *   { cancelled }    Esc/q/Ctrl-C
+ *   { timedOut }     nobody drove it within timeoutMs
+ *   { unsupported }  no raw mode — the caller uses the numeric prompt instead
+ *
+ * Held to this file's one law — no start-path prompt may hang the daemon — the
+ * same way `askWithTimeout` is: it keeps the timeout, installs the
+ * SIGTTIN/SIGTTOU no-ops that keep that timer alive, restores the terminal in
+ * every exit, and refuses (returns `unsupported`) rather than half-drawing when
+ * raw mode is not really there. The caller still gates on `canPrompt()` before
+ * ever reaching here.
+ */
+export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
+  if (!menuSupported()) return { unsupported: true };
+  const stdin = process.stdin;
+  const out = process.stdout;
+  const count = options.length;
+  if (count === 0) return { unsupported: true };
+  let index = Math.min(Math.max(defaultIndex | 0, 0), count - 1);
+
+  const width = Math.max(24, (out.columns || 80) - 2);
+  const clip = (s) => (s.length > width ? s.slice(0, width - 1) + '…' : s);
+  const frame = () =>
+    options
+      .map((o, i) => (i === index ? `\x1b[7m> ${clip(o)}\x1b[0m` : `  ${clip(o)}`))
+      .join('\n') +
+    '\n' +
+    `\x1b[2m  ${MENU_FOOTER}\x1b[0m`;
+  const lineCount = count + 1; // rows + footer
+
+  let rendered = false;
+  const draw = () => {
+    if (rendered) out.write(`\x1b[${lineCount}A`); // back to the top of our block
+    out.write('\r\x1b[0J'); // clear from here to the end of the screen
+    out.write(frame() + '\n');
+    rendered = true;
+  };
+
+  const noop = () => {};
+  return await new Promise((resolve) => {
+    let done = false;
+    const finish = (result) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      stdin.removeListener('data', onData);
+      try {
+        stdin.setRawMode(false);
+      } catch {
+        /* already restored / gone */
+      }
+      stdin.pause();
+      process.off('SIGTTIN', noop);
+      process.off('SIGTTOU', noop);
+      out.write('\x1b[?25h'); // show the cursor again
+      resolve(result);
+    };
+    const onData = (buf) => {
+      const action = menuKey(buf.toString('utf8'), { index, count });
+      if (!action) return;
+      if (action.cancel) return finish({ cancelled: true });
+      if (action.choose !== undefined) return finish({ index: action.choose });
+      if (action.index !== undefined) {
+        index = action.index;
+        draw();
+      }
+    };
+    process.on('SIGTTIN', noop);
+    process.on('SIGTTOU', noop);
+    const timer = setTimeout(() => finish({ timedOut: true }), timeoutMs);
+    try {
+      stdin.setRawMode(true);
+    } catch {
+      return finish({ unsupported: true });
+    }
+    stdin.resume();
+    out.write('\x1b[?25l'); // hide the cursor while we own the block
+    draw();
+    stdin.on('data', onData);
+  });
+}

package/bin/lib/work.mjs

@@ -107,7 +107,15 @@ function brainFor(job) {
   return out;
 }
 
-export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, getLeaseTtl }) {
+export function createWorkManager({
+  repoRoot,
+  baseDir,
+  getBaseRef,
+  getMcpUrl,
+  getLeaseTtl,
+  /** "The repo picture changed — look again." See the caller in fleet.mjs. */
+  onRepoChanged = () => {},
+}) {
   /**
    * WHERE SHIP LANDS, read fresh every time rather than captured at startup.
    *
@@ -319,6 +327,19 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
       // The report has landed, so the idempotency path no longer needs the
       // branch to exist. See `sweepMergedSessionBranch`.
       sweepMergedSessionBranch(sessionId);
+      // AND THE DIFFSTAT IS NOW WRONG BY DEFINITION. A ship folds base in,
+      // merges the tip out and deletes the branch, so a fresh measurement reads
+      // `ahead: 0` with an empty diffstat — and without this the rail keeps
+      // rendering the ENTIRE pre-ship diff while the transcript two hundred
+      // pixels away says "Shipped to main". The ship button re-arms over a
+      // branch that is already merged. Same rule the kill path just learned:
+      // an action that changes what the machine would measure must cause a new
+      // measurement, and the 60s sweep is not that.
+      void reportPlaceWorktrees(sessionId).catch(() => {});
+      // …and the REPO picture changed too: the session branch is gone and base
+      // moved. Without this the Repository block keeps counting a branch the
+      // ship just deleted.
+      onRepoChanged();
     }
     return r;
   };
@@ -591,11 +612,43 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
       ...(title ? { title } : {}),
     };
   };
-  /** One session, now — called after its turn settles. */
+  /** One session, now. */
   const reportSessionWorktree = async (sessionId) => {
     const r = sessionWorktreeReport(sessionId);
     if (r) await postWorktrees([r]);
   };
+
+  /**
+   * …AND EVERY OTHER TAB STANDING IN THE SAME DIRECTORY.
+   *
+   * One tab is not one directory any more. Since tabs moved into the driver's
+   * own folder, every tab a person owns resolves to the SAME place — so a turn
+   * in tab A changed the directory tab B is also describing, and only tab A was
+   * re-measured. Tab B went on rendering its pre-turn `+A −D` for up to a
+   * minute, which makes the tab strip visibly disagree with itself about one
+   * directory. That is the "why are two tabs showing one dev server" confusion
+   * the places readout exists to END, arriving through the diffstat instead.
+   *
+   * It fires on EVERY turn, every ship and every stop, which is what made this
+   * the most-hit instance of the rule and the least visible: nothing is wrong
+   * on the tab you are looking at.
+   *
+   * Bounded by the live set the roster last handed us, and the reports go in
+   * ONE post — the endpoint is already batched, and a tab per request would
+   * turn a five-tab place into five round trips on every settle.
+   */
+  const reportPlaceWorktrees = async (sessionId) => {
+    const place = placeOf(sessionId);
+    const ids = [sessionId];
+    // `worktreeSeen` is the roster's own live set, pruned to `activeWorkSessions`
+    // on every sweep — so this can never report a tab that has closed, and it
+    // needs no second source of truth about which tabs exist.
+    for (const id of worktreeSeen) {
+      if (id !== sessionId && placeOf(id) === place) ids.push(id);
+    }
+    const reports = ids.map(sessionWorktreeReport).filter(Boolean);
+    if (reports.length) await postWorktrees(reports);
+  };
   /** Every live session, throttled — called from the reconcile loop. */
   /**
    * A SESSION NOBODY HAS MEASURED YET JUMPS THE SWEEP (2026-08-26).
@@ -1154,7 +1207,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
    */
   const remeasureAfterKill = async (sessionId) => {
     try {
-      await reportSessionWorktree(sessionId);
+      await reportPlaceWorktrees(sessionId);
     } catch {
       /* the 60s sweep still carries it — this only makes it prompt */
     }
@@ -1444,6 +1497,9 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
         git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
       } catch {
         git(['worktree', 'prune'], repoRoot);
+        // A directory and a branch just stopped existing. The Repository block
+        // would otherwise keep listing both until its own 60s scan came round.
+        onRepoChanged();
         try {
           // The branch may already exist (a retired directory's work) — attach.
           git(['worktree', 'add', wt, branch], repoRoot);
@@ -2535,7 +2591,7 @@ export function createWorkManager({ repoRoot, baseDir, getBaseRef, getMcpUrl, ge
           // written half a file, and the tab should show that honestly). NOT
           // awaited: this runs inside the session's chain, and a slow POST
           // would delay the next turn of that tab behind a readout.
-          void reportSessionWorktree(job.sessionId).catch(() => {});
+          void reportPlaceWorktrees(job.sessionId).catch(() => {});
         }
       });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.71.1",
+  "version": "0.73.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {