flowviant 0.77.2 → 0.77.5

package/bin/lib/preview.mjs

@@ -254,18 +254,53 @@ function forgetPreviewPid(pid) {
   mutateRegistry((list) => list.filter((e) => e.pid !== pid));
 }
 
-// Only kill a pid we can VERIFY is still one of ours — its /proc cmdline must
-// still contain the signature we stored. A reused pid belonging to something
-// unrelated won't match, so we never kill a stranger. Linux-only (that's where
-// /proc + process groups work); elsewhere we just clear the registry.
+/**
+ * Only kill a pid we can VERIFY is still one of ours — its command line must
+ * still contain the signature we stored. A reused pid belonging to something
+ * unrelated won't match, so we never kill a stranger.
+ *
+ * MACOS READS IT THROUGH `ps`, because "Linux-only, elsewhere just clear the
+ * registry" was the worst of both. A macOS daemon killed ungracefully leaves
+ * cloudflared running — it is spawned detached — so the public hostname keeps
+ * resolving to this machine while the gate dies with the daemon. The reaper
+ * then verified nothing, killed nothing, and DELETED the entry, so no later run
+ * could ever find that process. The tunnel served 502 until anything else on
+ * the box bound the gate's old port, which `startAuthProxy` obtained with
+ * `listen(0)` and is therefore squarely inside the kernel's ephemeral reuse
+ * pool — at which point a live public hostname forwarded straight to an
+ * unrelated local service with no gate, no password and no grant check. Exactly
+ * what this file's header says the reap exists to prevent.
+ *
+ * Three states, not two: `true` (ours), `false` (verified NOT ours, or gone),
+ * and `null` (we could not look — the caller keeps the record rather than
+ * dropping it).
+ */
 function stillOurs(pid, sig) {
-  if (platform() !== 'linux') return false;
-  try {
-    const cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
-    return typeof sig === 'string' && sig.length > 0 && cmd.includes(sig);
-  } catch {
-    return false; // process gone / unreadable
+  if (typeof sig !== 'string' || sig.length === 0) return false;
+  if (platform() === 'linux') {
+    try {
+      const cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
+      return cmd.includes(sig);
+    } catch {
+      return false; // process gone / unreadable
+    }
   }
+  if (platform() === 'darwin') {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8',
+        timeout: 5_000,
+      });
+      return cmd.includes(sig);
+    } catch {
+      // `ps` exits non-zero when the pid is gone — which is a real answer.
+      return false;
+    }
+  }
+  // Windows: no way to check from here. UNKNOWN, never "not ours" — see the
+  // caller, which keeps the record so a later run on a platform that can look
+  // is still able to.
+  return null;
 }
 
 /** Reap tunnel process groups left behind by a previously-crashed daemon.
@@ -283,8 +318,19 @@ export function reapOrphanPreviews(log) {
   const handled = new Set();
   for (const { pid, sig, owner } of list) {
     if (Number.isInteger(owner) && owner !== process.pid && processAlive(owner)) continue;
+    const ours = stillOurs(pid, sig);
+    /**
+     * THE RECORD OUTLIVES A REAP THAT COULD NOT LOOK. `handled.add` ran BEFORE
+     * this check, so an entry was dropped whether or not anything was killed —
+     * and on any platform `stillOurs` could not read, that deleted the only
+     * trace of a tunnel still serving the public internet. Kept on `null`
+     * (unknown); removed on `true` (we killed it) and on `false` (the process
+     * is gone, or the pid now belongs to somebody else and the entry is stale
+     * either way).
+     */
+    if (ours === null) continue;
     handled.add(pid);
-    if (!stillOurs(pid, sig)) continue;
+    if (!ours) continue;
     try {
       process.kill(-pid, 'SIGKILL'); // whole group
       killed++;

package/bin/lib/work.mjs

@@ -567,6 +567,21 @@ export function createWorkManager({
   const worktreeSeen = new Set();
   let lastWorktreeFetch = 0;
   let sweepingWorktrees = false;
+  /**
+   * WHERE THE NEXT SWEEP STARTS.
+   *
+   * A safety valve with a rotation, and the rotation is the load-bearing half.
+   * The sweep used to take `activeIds.slice(0, 20)` — a silent truncation of a
+   * list the server builds tabs-first and agent places LAST, so on a project
+   * with twenty live tabs no agent was EVER measured: no branch diff, no head
+   * sha, and none of their trailered commits ever reached a card. Permanently,
+   * because the same twenty won every pass.
+   *
+   * Chunking removes the cut for any realistic project (see below). The cursor
+   * is what makes the residual cap fair rather than arbitrary: past it, the
+   * places that missed one sweep are the ones that lead the next.
+   */
+  let worktreeCursor = 0;
   const postWorktrees = async (reports) => {
     if (!reports.length) return;
     try {
@@ -800,12 +815,46 @@ export function createWorkManager({
           // landed. Best-effort like everything in this sweep.
           void landed.observe().catch(() => {});
         }
+        /**
+         * MEASURED IN CHUNKS, not truncated to one.
+         *
+         * The server's endpoint takes twenty entries per request, and this read
+         * that bound as "measure twenty places" — so everything past the
+         * twentieth was silently never measured, and the server builds that
+         * list with agent places at the END. A project with twenty live tabs
+         * therefore measured no agent at all: their review pane showed no
+         * branch diff, `checkIsStale` had no head to compare against, and their
+         * commits never reached the cards they name.
+         *
+         * The cap on a REQUEST is not a cap on the WORK. Several requests of
+         * twenty cost several round trips and each is validated per entry
+         * exactly as before, so no contract changes and no floor is needed.
+         *
+         * `SWEEP_MAX_PLACES` is a bound on the MACHINE — each place costs a
+         * `git diff`, a listener scan and a process scan — and the cursor
+         * rotates so a project past it still measures everything, just across
+         * successive sweeps instead of one.
+         */
+        const SWEEP_MAX_PLACES = 60;
+        const CHUNK = 20;
+        const total = activeIds.length;
+        const start = total > SWEEP_MAX_PLACES ? worktreeCursor % total : 0;
+        const take = Math.min(total, SWEEP_MAX_PLACES);
+        // Rotated slice, so the tail of a long list leads the next sweep rather
+        // than never being reached.
+        const order = Array.from({ length: take }, (_, i) => activeIds[(start + i) % total]);
+        worktreeCursor = total > SWEEP_MAX_PLACES ? (start + take) % total : 0;
         const reports = [];
-        for (const id of activeIds.slice(0, 20)) {
+        for (const id of order) {
           const r = sessionWorktreeReport(id);
           if (r) reports.push(r);
         }
-        await postWorktrees(reports);
+        // One POST per chunk. Awaited in sequence rather than fired together:
+        // this runs on the machine's own poll beat and a burst of parallel
+        // writes to the same rows buys nothing.
+        for (let i = 0; i < reports.length; i += CHUNK) {
+          await postWorktrees(reports.slice(i, i + CHUNK));
+        }
       } finally {
         sweepingWorktrees = false;
       }
@@ -3734,10 +3783,30 @@ export function createWorkManager({
      * — which the stale path does on purpose before a merge. A receipt naming
      * somebody else's commit is worse than a missing one.
      */
-    const out = git(
-      ['log', '--format=%H', '--no-merges', `${from}..HEAD`, '--not', baseRef()],
-      wt
-    );
+    /**
+     * IT CANNOT THROW, and that guard is the whole point of it being here.
+     *
+     * `git()` throws on a non-zero exit, and `baseRef()` is built from the
+     * project's Base branch setting — free text an owner types, never verified
+     * against the remote. Point it at a branch with no tracking ref (`develop`
+     * on a repo whose remote branch is `dev`) and this exits "fatal: ambiguous
+     * argument". The throw escaped `runAgentTurn` AFTER the CLI had already run
+     * the card, so `postAgentTurn` was never reached, the server never settled
+     * the turn, and the next poll handed back the identical turn — the same
+     * card re-run every poll for six hours, on the operator's shared account,
+     * piling commits onto the review branch, silently.
+     *
+     * An unreadable range means we cannot MEASURE the receipts, which is a
+     * smaller failure than not settling: the turn still reports, and ship-time
+     * reconciliation books whatever no card claimed. Missing beats fabricated
+     * and both beat a stall.
+     */
+    let out;
+    try {
+      out = git(['log', '--format=%H', '--no-merges', `${from}..HEAD`, '--not', baseRef()], wt);
+    } catch {
+      return [];
+    }
     return typeof out === 'string'
       ? out.split('\n').map((x) => x.trim()).filter(Boolean).slice(0, 50)
       : [];
@@ -4060,6 +4129,18 @@ export function createWorkManager({
           detached: true,
           stdio: ['ignore', 'pipe', 'pipe'],
         });
+        /**
+         * …AND IT IS TRACKED, so a stop or a takeover takes it with them.
+         *
+         * A check is a full test or build run in the agent's worktree, and it
+         * was the one long-lived child the daemon spawned without telling its
+         * own teardown about it. `shutdownWork` signalled the CLI children and
+         * left this one — so restarting the daemon, or a same-repo takeover,
+         * orphaned a running test suite inside a worktree the sweep may then
+         * try to remove. The ten-minute timer would eventually kill it, but by
+         * then it belongs to no daemon and nothing on any surface names it.
+         */
+        workChildren.set(child, null);
       } catch (e) {
         // TEXT BEFORE FINISH: `finish` captures `text` by value into the
         // resolved object, so assigning afterwards threw the spawn error away
@@ -4068,9 +4149,32 @@ export function createWorkManager({
         finish('failed');
         return;
       }
-      // The TAIL, not the head: a failing check says why at the end.
+      /**
+       * The TAIL, not the head: a failing check says why at the end. And
+       * SCRUBBED BEFORE IT IS CUT, which is the order that matters.
+       *
+       * It used to slice first: `text = (text + buf).slice(-CAP)`, with a
+       * single `envScrub` at the very end. `envScrub` replaces EXACT full
+       * values, so any credential straddling either boundary — the rolling
+       * window's, or a chunk's — was already cut in half by the time it was
+       * looked at, matched nothing, and the surviving tail was written to
+       * `agent.checkOutput` and shown to every member of the project. A failing
+       * integration test that dumps its environment is an ordinary way to reach
+       * that, and the partial is enough where the prefix of the key is a
+       * publicly known constant.
+       *
+       * Scrubbing on every chunk fixes both straddles at once: the accumulated
+       * text always holds the previous kept tail plus the whole new chunk, so a
+       * value split across chunks is whole here, and a value near the window
+       * edge is redacted before anything is discarded. Bounded work — the
+       * string is never longer than the cap plus one chunk.
+       *
+       * The one case it cannot cover is a secret LONGER than the cap itself,
+       * which can never sit in the window whole. The final scrub below stays as
+       * the second pass over what actually ships.
+       */
       const keep = (buf) => {
-        text = (text + buf.toString()).slice(-CHECK_OUTPUT_CAP);
+        text = envScrub(text + buf.toString()).slice(-CHECK_OUTPUT_CAP);
       };
       child.stdout?.on('data', keep);
       child.stderr?.on('data', keep);
@@ -4094,11 +4198,13 @@ export function createWorkManager({
       }, CHECK_TIMEOUT_MS);
       child.on('error', (e) => {
         clearTimeout(timer);
+        workChildren.delete(child);
         text += String(e?.message || e);
         finish('failed');
       });
       child.on('close', (code) => {
         clearTimeout(timer);
+        workChildren.delete(child);
         finish(code === 0 ? 'passed' : 'failed');
       });
     });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.77.2",
-  "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
+  "version": "0.77.5",
+  "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"