flowviant 0.77.3 → 0.78.0

package/bin/lib/claude.mjs

@@ -259,7 +259,17 @@ function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText
       // permission, an aborted run). Under `answerFromResult` this is the only
       // stdout that would have said so, and a caller whose `out` is the answer
       // must not report "no output" for a turn that explained itself.
-      const msg = ev.error?.message ?? ev.error ?? ev.subtype;
+      // `errors[]` FIRST, because it is where the real sentence is. Claude
+      // Code reports a dead `--resume` id as
+      // `{subtype:'error_during_execution', errors:['No conversation found
+      // with session ID: …']}` — reading only `error`/`subtype` dropped that
+      // and appended the literal string `error_during_execution`, which told
+      // the driver nothing and hid the one phrase the caller needs to
+      // recognise a lost conversation.
+      const listed = Array.isArray(ev.errors)
+        ? ev.errors.filter((e) => typeof e === 'string' && e.trim()).join('; ')
+        : '';
+      const msg = listed || ev.error?.message || ev.error || ev.subtype;
       appendText(`${typeof msg === 'string' ? msg : JSON.stringify(msg)}\n`);
     }
   }

package/bin/lib/deploy.mjs

@@ -10,13 +10,14 @@
  * wrangler output routinely echoes secrets.
  */
 
-import { readFileSync, existsSync } from 'node:fs';
+
 import { spawn } from 'node:child_process';
 import { join } from 'node:path';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { deployCreds, appSecretsFor, scrub, myPubB64 } from './env.mjs';
 import { childEnv } from './childEnv.mjs';
+import { git } from './git.mjs';
 
 const deployUrl = (tail) => FLEET_URL.replace(/\/agents\/?$/, `/${tail}`);
 
@@ -38,27 +39,64 @@ async function post(tail, body) {
   return json?.data;
 }
 
-/** Read + parse .flowviant/deploy.json from the repo root. Returns [] if none. */
-export function readDeployConfig(repoRoot) {
-  const path = join(repoRoot, '.flowviant', 'deploy.json');
-  if (!existsSync(path)) return [];
+/**
+ * Read + parse `.flowviant/deploy.json` AS IT IS ON THE BASE BRANCH. Returns []
+ * if the branch has none.
+ *
+ * IT USED TO READ THE WORKING TREE, which made the feature's one stated bound
+ * false. `deploy_target`'s own description says "only ids already declared in
+ * `.flowviant/deploy.json` on MAIN can be named (the daemon reads and runs from
+ * the repo ROOT, never a session worktree, so an agent cannot author the command
+ * it triggers without shipping it first)" — and the repo root's WORKING TREE is
+ * exactly where the machine operator's tabs stand (their place is the checkout).
+ * So an agent that had read an injected instruction could write an uncommitted
+ * `.flowviant/deploy.json` naming any shell command, call `deploy_target`, and
+ * have the daemon run it from the repo root with `CLOUDFLARE_API_TOKEN` and
+ * every other deploy-scope credential in its environment. Nothing about that
+ * needed a commit, a review, or an owner.
+ *
+ * Reading the COMMITTED tree is what makes the sentence true: authoring the
+ * command now requires landing it on base, which is a reviewed act. The file is
+ * read through git rather than the filesystem, so an uncommitted edit is simply
+ * not there.
+ *
+ * A base ref that does not resolve yields NO TARGETS, and says so once. That is
+ * the withholding direction and it is the right one here — a deploy is
+ * irreversible and running the wrong file is worse than running nothing.
+ */
+export function readDeployConfig(repoRoot, baseRef) {
+  let raw;
+  if (baseRef) {
+    try {
+      raw = git(['show', `${baseRef}:.flowviant/deploy.json`], repoRoot);
+    } catch {
+      // No such file on base, or a base ref that does not resolve. Both mean
+      // "this branch declares no targets", which is a real answer.
+      return [];
+    }
+  } else {
+    // No base ref in hand (a caller that has not been updated). Refuse rather
+    // than silently falling back to the working tree — that fallback IS the bug.
+    warn('deploy: no base branch resolved, so no deploy targets were read.');
+    return [];
+  }
   try {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    const parsed = JSON.parse(raw);
     const targets = Array.isArray(parsed?.targets) ? parsed.targets : [];
     // Keep only fields the server + runner need; the daemon holds the commands.
     return targets
       .filter((t) => t && typeof t.id === 'string' && typeof t.command === 'string')
       .slice(0, 20);
   } catch (e) {
-    warn(`deploy: .flowviant/deploy.json is not valid JSON — ${e.message}`);
+    warn(`deploy: .flowviant/deploy.json on the base branch is not valid JSON — ${e.message}`);
     return [];
   }
 }
 
 /** Report the parsed config to the server (only when it changed). */
 let lastConfigJson = null;
-export async function reportDeployConfig(repoRoot) {
-  const targets = readDeployConfig(repoRoot);
+export async function reportDeployConfig(repoRoot, baseRef) {
+  const targets = readDeployConfig(repoRoot, baseRef);
   const json = JSON.stringify(targets);
   if (json === lastConfigJson) return;
   // Scrub command strings before the server sees them — a command line can embed
@@ -154,6 +192,23 @@ async function verifyHealth(url, status) {
 }
 
 const claiming = new Set(); // in-flight guard (single-flight per daemon process)
+/**
+ * JOBS THIS PROCESS HAS ALREADY RUN, whatever the server thinks.
+ *
+ * A deploy is IRREVERSIBLE and the report is not: a transient 5xx, a DNS blip
+ * or the 30s timeout meant the outcome never landed, the heartbeat stopped,
+ * and three minutes later the server requeued the job and this same daemon ran
+ * `wrangler rollback` — or a full prod deploy with every pushSecret re-pushed —
+ * a SECOND time, leaving production two versions behind the intended one with
+ * nothing recording that it happened twice.
+ *
+ * So the process remembers. Not a substitute for the report (see the retry
+ * below, which is the real fix); a floor under it, for the case where the
+ * report never lands at all. It does not survive a restart — nothing local
+ * could be trusted to — which is why the retry has to keep the heartbeat alive
+ * while it runs.
+ */
+const ran = new Set();
 
 /**
  * Process queued deploy jobs from the roster. `ctx` = { repoRoot, baseRef,
@@ -168,6 +223,7 @@ export function processDeployJobs(jobs, ctx) {
     // reconcile loop, since this runs unguarded from the fleet tick.
     if (!job || typeof job.id !== 'string') continue;
     if (claiming.has(job.id)) continue;
+    if (ran.has(job.id)) continue; // already executed here — never twice
     claiming.add(job.id);
     void (async () => {
       let beat = null;
@@ -185,10 +241,35 @@ export function processDeployJobs(jobs, ctx) {
         // Keep the claim fresh while we run — a long deploy must never be
         // re-queued out from under us (that would double-deploy). The async
         // run() below keeps the event loop free so this fires.
+        /**
+         * …AND IT CAN DIE, which is what makes the `stillBeating` predicate
+         * below mean anything.
+         *
+         * `report` is handed `() => beat != null` so it stops retrying once the
+         * claim is certainly stale — but `beat` only ever held a timer handle
+         * and was never nulled, so that predicate could not return false and
+         * `report` retried into a job another daemon may already own.
+         *
+         * The server re-queues a deploy whose heartbeat is older than three
+         * minutes, and this fires every sixty seconds — so three consecutive
+         * failures is exactly the point past which the claim cannot be assumed.
+         * A single blip does not count: only an unbroken run does.
+         */
+        let missed = 0;
         beat = setInterval(() => {
-          void post('deploy-heartbeat', { jobId: job.id, pubkey: ctx.myPubB64() }).catch(() => {});
+          void post('deploy-heartbeat', { jobId: job.id, pubkey: ctx.myPubB64() })
+            .then(() => {
+              missed = 0;
+            })
+            .catch(() => {
+              missed += 1;
+              if (missed >= 3 && beat) {
+                clearInterval(beat);
+                beat = null;
+              }
+            });
         }, 60_000);
-        const targets = readDeployConfig(ctx.repoRoot);
+        const targets = readDeployConfig(ctx.repoRoot, ctx.baseRef);
         const target = targets.find((t) => t.id === job.targetId);
         if (!target) {
           await report(job, ctx, { ok: false, message: `target "${job.targetId}" not in .flowviant/deploy.json` });
@@ -196,13 +277,19 @@ export function processDeployJobs(jobs, ctx) {
         }
         note(`${c.cyan('deploy')} ${c.dim(`— ${job.kind} ${job.targetId} → ${job.env}…`)}`);
         const outcome = await runDeploy(job, target, ctx);
-        await report(job, ctx, outcome);
+        // From here the work is DONE. Whatever the report does, this job must
+        // never run again in this process.
+        ran.add(job.id);
+        await report(job, ctx, outcome, () => beat != null);
         if (outcome.ok) ok(`${c.cyan('deploy')} ${c.dim(`— ${job.targetId} → ${job.env} done${outcome.healthOk === false ? ' (health failed)' : ''}`)}`);
         else warn(`deploy: ${job.targetId} → ${job.env} failed — ${outcome.message}`);
       } catch (e) {
         warn(`deploy job ${job.id} errored: ${e.message}`);
         await report(job, ctx, { ok: false, message: e.message }).catch(() => {});
       } finally {
+        // Stopped only AFTER the report has landed or given up — the requeue is
+        // gated on heartbeat staleness, so beating through the retries is what
+        // stops the server handing this job out again mid-retry.
         if (beat) clearInterval(beat);
         claiming.delete(job.id);
       }
@@ -278,13 +365,49 @@ async function runDeploy(job, target, ctx) {
   };
 }
 
-function report(job, ctx, outcome) {
-  return post('deploy-report', {
+/**
+ * THE OUTCOME IS RETRIED, because losing it re-runs the deploy.
+ *
+ * One `post` with a `.catch(warn)` was the whole of this: a transient 5xx, a
+ * DNS blip or the 30s timeout dropped the outcome, the `finally` stopped the
+ * heartbeat, and the server — which requeues a running job after three minutes
+ * without one — handed the SAME job back to the SAME daemon, which ran it
+ * again. For a rollback that is production two versions behind the intended
+ * one; for a prod deploy it is every pushSecret pushed twice. Nothing recorded
+ * that it had happened at all.
+ *
+ * The heartbeat keeps running throughout (the caller's `finally` is what stops
+ * it), so the requeue window stays shut for as long as we are still trying.
+ * Bounded: six attempts over roughly a minute, then a warning and the local
+ * `ran` guard as the floor.
+ */
+async function report(job, ctx, outcome, stillBeating = () => true) {
+  const body = {
     jobId: job.id,
     pubkey: ctx.myPubB64(),
     ok: !!outcome.ok,
     deploymentId: outcome.deploymentId ?? null,
     healthOk: outcome.healthOk ?? null,
     message: scrub(outcome.message || ''),
-  }).catch((e) => warn(`deploy: could not report outcome — ${e.message}`));
+  };
+  for (let attempt = 0; attempt < 6; attempt++) {
+    try {
+      await post('deploy-report', body);
+      return;
+    } catch (e) {
+      // The last attempt says so; the ones before it are noise on a path that
+      // usually recovers.
+      if (attempt === 5) {
+        warn(`deploy: could not report outcome after 6 tries — ${e.message}`);
+        return;
+      }
+      // If the heartbeat is already gone the requeue window is open and
+      // retrying buys nothing — the job may have been handed to somebody else.
+      if (!stillBeating()) {
+        warn(`deploy: could not report outcome — ${e.message}`);
+        return;
+      }
+      await new Promise((r) => setTimeout(r, 2000 * (attempt + 1)));
+    }
+  }
 }

package/bin/lib/fleet.mjs

@@ -85,7 +85,7 @@ import {
   RUNTIMES,
 } from './runtimes.mjs';
 import { createWorkManager } from './work.mjs';
-import { scanLocalSessions } from './localSessions.mjs';
+import { scanLocalSessions, ourConversationIds } from './localSessions.mjs';
 import { repoState } from './repoState.mjs';
 
 async function fetchRoster(
@@ -253,7 +253,7 @@ let localSessionsUnsupported = false; // the server 404'd — quiet until restar
 let localSessionsScanAt = 0;
 let localSessionsSent = null; // last payload the server ACCEPTED, stringified
 let localSessionsSentAt = 0;
-async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
+async function maybeReportLocalSessions({ repoRoot, excludeDirs, excludeIds }) {
   if (localSessionsUnsupported) return;
   if (Date.now() - localSessionsScanAt < LOCAL_SESSIONS_SCAN_MS) return;
   localSessionsScanAt = Date.now();
@@ -261,7 +261,9 @@ async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
   try {
     // scanLocalSessions orders deterministically, so this string only changes
     // when the facts on disk do — the dedup below compares whole payloads.
-    payload = JSON.stringify({ sessions: scanLocalSessions({ repoRoot, excludeDirs }) });
+    payload = JSON.stringify({
+      sessions: scanLocalSessions({ repoRoot, excludeDirs, excludeIds }),
+    });
   } catch {
     return; // presence must never throw into the poll loop
   }
@@ -892,6 +894,7 @@ export async function runFleetDaemon() {
               execFileSync('gh', ['pr', 'edit', job.prUrl, '--base', baseBranchName(baseRef)], {
                 cwd: repoRoot,
                 stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 30_000,
               });
             } catch (e) {
               // Already targeting base is the common no-op; anything else is
@@ -912,6 +915,7 @@ export async function runFleetDaemon() {
             execFileSync('gh', ['pr', 'merge', job.prUrl, '--squash', '--delete-branch'], {
               cwd: repoRoot,
               stdio: ['ignore', 'pipe', 'pipe'],
+              timeout: 120_000,
             });
             merged = true;
           } catch (e) {
@@ -989,7 +993,7 @@ export async function runFleetDaemon() {
                   'Task restarted in Flowviant — this attempt was discarded.',
                   '--delete-branch',
                 ],
-                { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'] }
+                { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
               );
             } catch (e) {
               // Already closed/merged/missing = fine; anything else we still
@@ -1031,10 +1035,22 @@ export async function runFleetDaemon() {
   const REGROUND_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/reground-done');
   const WIKI_VAULT_URL = FLEET_URL.replace(/\/agents\/?$/, '/wiki-vault');
   const WIKI_PROGRESS_URL = FLEET_URL.replace(/\/agents\/?$/, '/wiki-progress');
+  const WIKI_ABANDONED_URL = FLEET_URL.replace(/\/agents\/?$/, '/wiki-abandoned');
   const wikiQueue = [];
   let wikiBusy = false;
   let wikiChild = null; // the wiki turn's Claude process — tracked so teardown can kill it
   let lastSweepAt = null; // dedup: run each Regenerate request once
+  // …UNLESS IT FAILED. A sweep that ends without WIKI_DONE never finalizes, so
+  // the server's `regen_requested_at` stays set and the roster keeps offering
+  // the same `requestedAt` — which this dedup then swallowed forever. The
+  // console said "retry from the app", to a console nobody reads. Bounded the
+  // same way the re-ground path is: a full sweep is an expensive model turn, so
+  // a repo that fails one every time must not be able to loop-burn quota.
+  let sweepAttempts = 0;
+  // Which request the counter belongs to, so a NEW Regenerate click starts with
+  // a full budget rather than inheriting an exhausted one.
+  let sweepAttemptsFor = null;
+  const MAX_SWEEP_ATTEMPTS = 3;
   const groundedIntents = new Set(); // dedup: re-ground each delivery once
   // The vault is keyed by the server project this fleet credential serves
   // (learned from the roster); until the first poll names it, fall back to a
@@ -1077,8 +1093,38 @@ export async function runFleetDaemon() {
     }
   };
 
+  /**
+   * Tell the server this daemon has stopped retrying the pending sweep.
+   *
+   * The retry budget is a `let` in this process; `regen_requested_at` is a
+   * durable column with a 24-hour TTL. Without this the two disagreed — the
+   * daemon had permanently given up while every surface went on calling the
+   * sweep queued, for the rest of the day. Best-effort: an older server 404s
+   * once and the TTL is still the backstop it always was.
+   */
+  const postWikiAbandoned = async () => {
+    try {
+      await fetch(WIKI_ABANDONED_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        body: '{}',
+      });
+    } catch {
+      /* best-effort — the request's own TTL still expires it */
+    }
+  };
+
   const enqueueSweep = (job) => {
     if (!job || job.requestedAt === lastSweepAt) return;
+    if (job.requestedAt !== sweepAttemptsFor) {
+      sweepAttemptsFor = job.requestedAt;
+      sweepAttempts = 0;
+    }
     lastSweepAt = job.requestedAt;
     // A full sweep is expensive — never stack two. One queued sweep already
     // covers any newer Regenerate click (it reads the repo fresh when it runs).
@@ -1224,6 +1270,18 @@ export async function runFleetDaemon() {
         // thinking block or slow tool (which emit nothing until they finish) —
         // otherwise the cover would flap back to the empty state mid-sweep.
         let heartbeat = null;
+        /**
+         * Did THIS sweep finish? Read by the `finally` below, which owns the
+         * retry decision for every way out of this block.
+         *
+         * It used to be decided inline on the one branch where the turn
+         * returned without its sentinel — so the two OTHER ways a sweep fails,
+         * `pickRuntimeFor` finding no CLI and the catch around the whole turn,
+         * left the request pinned and never retried at all. Those are the
+         * failures most worth retrying: a missing runtime is fixed by
+         * installing one, and a thrown turn is exactly the transient case.
+         */
+        let sweepCompleted = false;
         try {
           // Immediate frame so the cover shows the daemon feed right away (the
           // "reading your code" phase), not a static message, while Claude warms up.
@@ -1283,6 +1341,7 @@ export async function runFleetDaemon() {
           }
           const wikiLabel = RUNTIMES[wikiRt].label;
           if (task.type === 'sweep') {
+            sweepAttempts++;
             note(`${c.cyan('wiki')} ${c.dim(`— regenerating: your ${wikiLabel} is reading the repo…`)}`);
             const out = await runTurn({
               prompt: WIKI_KICKOFF(sha, vaultDir),
@@ -1307,9 +1366,12 @@ export async function runFleetDaemon() {
               },
             });
             const complete = sawSentinel(out, 'WIKI_DONE');
-            if (complete) ok(`${c.cyan('wiki')} ${c.dim('— vault regenerated from your code.')}`);
-            else
-              warn('wiki sweep ended without WIKI_DONE — partial pages synced; retry from the app.');
+            if (complete) {
+              sweepCompleted = true;
+              ok(`${c.cyan('wiki')} ${c.dim('— vault regenerated from your code.')}`);
+            } else {
+              warn('wiki sweep ended without WIKI_DONE — partial pages synced');
+            }
             await runSync(complete);
           } else {
             const files = changedFilesForShas(task.shas);
@@ -1376,6 +1438,34 @@ export async function runFleetDaemon() {
         } finally {
           wikiChild = null;
           if (heartbeat) clearInterval(heartbeat);
+          /**
+           * THE RETRY DECISION, IN ONE PLACE, FOR EVERY WAY OUT OF THIS BLOCK.
+           *
+           * Deciding it inline on the no-sentinel branch covered one of the
+           * three ways a sweep fails and silently declined the other two. Here
+           * it covers the thrown turn and the no-runtime return as well, which
+           * are the two most worth retrying.
+           *
+           * A successful sweep resets the budget. A failed one with budget left
+           * clears `lastSweepAt` so the roster's next offer of the SAME request
+           * is accepted — partial pages are synced without pruning either way,
+           * so a retry resumes rather than starting over. A failed one with the
+           * budget spent tells the SERVER, because the counter is process-local
+           * and the request it bounds is durable for 24 hours.
+           */
+          if (task.type === 'sweep') {
+            if (sweepCompleted) {
+              sweepAttempts = 0;
+            } else if (sweepAttempts < MAX_SWEEP_ATTEMPTS) {
+              lastSweepAt = null;
+              warn(`wiki sweep failed — retrying (${sweepAttempts}/${MAX_SWEEP_ATTEMPTS})`);
+            } else {
+              warn(
+                `wiki sweep failed ${sweepAttempts} times — giving up on this request; press Regenerate to try again.`
+              );
+              await postWikiAbandoned();
+            }
+          }
           // Terminal frame so the app cover clears promptly (don't wait for the
           // freshness window to lapse). force-sent past the throttle.
           await postWikiProgress(frame({ done: true }), true);
@@ -1643,7 +1733,15 @@ export async function runFleetDaemon() {
     // Terminal-session presence, throttled + dedup'd inside; never awaited —
     // the daemon's own worktrees are carved out (a session the daemon spawned
     // is already a tab, not something to offer adopting).
-    void maybeReportLocalSessions({ repoRoot, excludeDirs: [baseDir] });
+    void maybeReportLocalSessions({
+      repoRoot,
+      excludeDirs: [baseDir],
+      // …and our OWN tabs' conversations. Only the CHECKOUT needs this: every
+      // other place is under `baseDir` and already fenced by directory, while
+      // the operator's tabs share the checkout with real terminal sessions and
+      // cannot be. See `ourConversationIds`.
+      excludeIds: ourConversationIds(repoRoot),
+    });
     // …and the repo itself: every worktree and every branch, ours and not.
     // Never awaited, throttled inside, and silent on an older server.
     void maybeReportRepoState({ repoRoot, baseRef });
@@ -1736,7 +1834,10 @@ export async function runFleetDaemon() {
     // runs queued deploy jobs (the server only sends deployJobs to authorized
     // machines). Config report is cheap + dedup'd; jobs are single-flight.
     if (roster.env?.deployAuthorized) {
-      void reportDeployConfig(repoRoot);
+      // The BASE branch's copy, not the working tree's — see readDeployConfig.
+      // Reporting the working tree would advertise targets the runner will not
+      // find, which is the same lie in the other direction.
+      void reportDeployConfig(repoRoot, getBaseRef());
       processDeployJobs(roster.deployJobs, { repoRoot, baseRef: getBaseRef(), myPubB64 });
     }
 

package/bin/lib/localSessions.mjs

@@ -234,6 +234,72 @@ function firstCwdRecord(file) {
   }
 }
 
+/**
+ * THE MARKER NAMES THE DAEMON PINS A TAB'S CONVERSATION UNDER.
+ *
+ * One owner, because two things read them and a drift here is silent: `work.mjs`
+ * WRITES them (`sessionMetaPath(wt, <name>, sessionId)`) and this file READS
+ * them to know which conversations are its own.
+ */
+export const SESSION_MARKERS = [
+  'flowviant-claude-session',
+  'flowviant-codex-thread',
+  'flowviant-agy-conversation',
+];
+
+/**
+ * EVERY CONVERSATION THIS DAEMON STARTED, so the adopt strip never offers you
+ * your own reflection.
+ *
+ * The machine OPERATOR's tabs work in the checkout itself (their place is
+ * `'repo'`), so their CLI transcripts land in `~/.claude/projects/<munge(repoRoot)>/`
+ * — the very directory this scan reads. The `excludeDirs` fence cannot help:
+ * repoRoot is the scan ROOT, not something under it. So the daemon's own tabs
+ * were reported as adoptable "terminal sessions", and two things followed:
+ * the `+` menu offered to adopt a tab you already have open (accepting FORKS
+ * that conversation and copies the checkout's uncommitted and untracked files
+ * into a new worktree), and — because the ended walk keeps only the newest row
+ * per directory, and a live tab's transcript is always the freshest thing in
+ * the checkout — a REAL terminal session started in the repo root could never
+ * be offered at all.
+ *
+ * Excluded by conversation ID rather than by directory, because the directory
+ * is shared with exactly the sessions we want to keep offering.
+ */
+export function ourConversationIds(repoRoot, gitDirs = []) {
+  const ids = new Set();
+  const dirs = new Set(gitDirs.filter(Boolean));
+  try {
+    dirs.add(
+      execFileSync('git', ['rev-parse', '--absolute-git-dir'], {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        timeout: 5_000,
+      }).trim()
+    );
+  } catch {
+    /* not a repo, or git unavailable — the fence is simply empty */
+  }
+  for (const dir of dirs) {
+    let names = [];
+    try {
+      names = readdirSync(dir);
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!SESSION_MARKERS.some((m) => n === m || n.startsWith(`${m}-`))) continue;
+      try {
+        const v = readFileSync(join(dir, n), 'utf8').trim();
+        if (v) ids.add(v);
+      } catch {
+        /* unreadable marker: nothing to fence */
+      }
+    }
+  }
+  return ids;
+}
+
 /**
  * Every Claude terminal session belonging to this repo: LIVE ones from the
  * liveness registry, ENDED ones from the transcript store. Returns
@@ -245,7 +311,11 @@ function firstCwdRecord(file) {
  * itself spawned are tabs already, and offering to adopt one would be the
  * product offering the user their own reflection.
  */
-export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
+export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
+  /** Conversations this daemon started — never offered for adoption. See
+   *  `ourConversationIds`: the operator's tabs share the checkout with real
+   *  terminal sessions, so the fence has to be by id, not by directory. */
+  const mine = excludeIds instanceof Set ? excludeIds : new Set(excludeIds ?? []);
   const live = [];
   const ended = [];
   try {
@@ -311,6 +381,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
         /* no transcript yet */
       }
       if (!liveTitle && typeof rec.name === 'string' && rec.name.trim()) liveTitle = rec.name.trim();
+      if (mine.has(rec.sessionId)) continue; // our own tab, not a terminal session
       live.push({
         id: rec.sessionId,
         cwd,
@@ -387,6 +458,13 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
         continue;
       }
       if (!ours(cwd)) continue;
+      /**
+       * OUR OWN TAB IS NOT A CANDIDATE, and it is skipped BEFORE `seenCwds`
+       * claims the directory — otherwise the daemon's transcript (always the
+       * freshest thing in the checkout) took the one slot that directory gets
+       * and a genuine terminal session there could never be offered at all.
+       */
+      if (mine.has(cand.id)) continue;
       if (seenCwds.has(cwd)) continue; // newest per directory; a live one owns its cwd
       seenCwds.add(cwd);
       const title = transcriptTitle(cand.file, cand.mtimeMs);
@@ -405,7 +483,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
   const claude = [...live.slice(0, REPORT_CAP), ...ended];
   // agy rides in whatever room the cap leaves — Claude sessions first, they
   // are the ones adoption serves best (fork, never move).
-  const agy = scanAgyConversations({ repoRoot, excludeDirs }).slice(
+  const agy = scanAgyConversations({ repoRoot, excludeDirs, excludeIds: mine }).slice(
     0,
     Math.max(0, REPORT_CAP - claude.length)
   );
@@ -511,7 +589,8 @@ export function isAgyConversationLive(id) {
 
 /** The repo's agy conversations, via the cwd registry — see the section
  *  comment for why this is deliberately a subset. */
-function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
+function scanAgyConversations({ repoRoot, excludeDirs = [], excludeIds }) {
+  const mine = excludeIds instanceof Set ? excludeIds : new Set(excludeIds ?? []);
   const out = [];
   try {
     let realRoot;
@@ -537,6 +616,9 @@ function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
     const processUp = agyProcessAlive();
     for (const [cwd, id] of Object.entries(map)) {
       if (typeof id !== 'string' || !AGY_UUID_RE.test(id)) continue;
+      // The operator's own agy TAB, whose conversation is registered against
+      // the checkout exactly as a terminal one would be.
+      if (mine.has(id)) continue;
       let real;
       try {
         real = realpathSync(cwd);

package/bin/lib/preflight.mjs

@@ -20,7 +20,7 @@ function present(cmd) {
 
 function ghAuthed() {
   try {
-    execFileSync('gh', ['auth', 'status'], { stdio: 'ignore' });
+    execFileSync('gh', ['auth', 'status'], { stdio: 'ignore', timeout: 20_000 });
     return true;
   } catch {
     return false;

package/bin/lib/preview.mjs

@@ -254,18 +254,53 @@ function forgetPreviewPid(pid) {
   mutateRegistry((list) => list.filter((e) => e.pid !== pid));
 }
 
-// Only kill a pid we can VERIFY is still one of ours — its /proc cmdline must
-// still contain the signature we stored. A reused pid belonging to something
-// unrelated won't match, so we never kill a stranger. Linux-only (that's where
-// /proc + process groups work); elsewhere we just clear the registry.
+/**
+ * Only kill a pid we can VERIFY is still one of ours — its command line must
+ * still contain the signature we stored. A reused pid belonging to something
+ * unrelated won't match, so we never kill a stranger.
+ *
+ * MACOS READS IT THROUGH `ps`, because "Linux-only, elsewhere just clear the
+ * registry" was the worst of both. A macOS daemon killed ungracefully leaves
+ * cloudflared running — it is spawned detached — so the public hostname keeps
+ * resolving to this machine while the gate dies with the daemon. The reaper
+ * then verified nothing, killed nothing, and DELETED the entry, so no later run
+ * could ever find that process. The tunnel served 502 until anything else on
+ * the box bound the gate's old port, which `startAuthProxy` obtained with
+ * `listen(0)` and is therefore squarely inside the kernel's ephemeral reuse
+ * pool — at which point a live public hostname forwarded straight to an
+ * unrelated local service with no gate, no password and no grant check. Exactly
+ * what this file's header says the reap exists to prevent.
+ *
+ * Three states, not two: `true` (ours), `false` (verified NOT ours, or gone),
+ * and `null` (we could not look — the caller keeps the record rather than
+ * dropping it).
+ */
 function stillOurs(pid, sig) {
-  if (platform() !== 'linux') return false;
-  try {
-    const cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
-    return typeof sig === 'string' && sig.length > 0 && cmd.includes(sig);
-  } catch {
-    return false; // process gone / unreadable
+  if (typeof sig !== 'string' || sig.length === 0) return false;
+  if (platform() === 'linux') {
+    try {
+      const cmd = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
+      return cmd.includes(sig);
+    } catch {
+      return false; // process gone / unreadable
+    }
   }
+  if (platform() === 'darwin') {
+    try {
+      const cmd = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+        encoding: 'utf8',
+        timeout: 5_000,
+      });
+      return cmd.includes(sig);
+    } catch {
+      // `ps` exits non-zero when the pid is gone — which is a real answer.
+      return false;
+    }
+  }
+  // Windows: no way to check from here. UNKNOWN, never "not ours" — see the
+  // caller, which keeps the record so a later run on a platform that can look
+  // is still able to.
+  return null;
 }
 
 /** Reap tunnel process groups left behind by a previously-crashed daemon.
@@ -283,8 +318,19 @@ export function reapOrphanPreviews(log) {
   const handled = new Set();
   for (const { pid, sig, owner } of list) {
     if (Number.isInteger(owner) && owner !== process.pid && processAlive(owner)) continue;
+    const ours = stillOurs(pid, sig);
+    /**
+     * THE RECORD OUTLIVES A REAP THAT COULD NOT LOOK. `handled.add` ran BEFORE
+     * this check, so an entry was dropped whether or not anything was killed —
+     * and on any platform `stillOurs` could not read, that deleted the only
+     * trace of a tunnel still serving the public internet. Kept on `null`
+     * (unknown); removed on `true` (we killed it) and on `false` (the process
+     * is gone, or the pid now belongs to somebody else and the entry is stale
+     * either way).
+     */
+    if (ours === null) continue;
     handled.add(pid);
-    if (!stillOurs(pid, sig)) continue;
+    if (!ours) continue;
     try {
       process.kill(-pid, 'SIGKILL'); // whole group
       killed++;

package/bin/lib/prompts.mjs

@@ -482,11 +482,29 @@ export const WORK_TURN_KICKOFF_PLAIN = ({ sessionName, message, askedByName }) =
   });
 
 
+/**
+ * THE FEATURE NAME AND THE FILE LIST ARE FENCED, and they were the only two
+ * unfenced strings left in this file.
+ *
+ * A card title is member-authored, and worse: ticket triage falls back to the
+ * REPORTER's ticket title verbatim, so a stranger can put words in it. That
+ * string rides the ship report into `code_map_reground_jobs`, comes back on the
+ * roster, and landed here as a bare `Feature: <text>` line — no delimiter, no
+ * instruction not to obey it. This turn runs UNATTENDED under `WIKI_PERM`,
+ * which grants Write, Edit, `Bash(mkdir:*)` and `Bash(rm:*)`, and whose own
+ * comment concedes that Write/Edit cannot be path-scoped here — the worktree
+ * reset is the backstop, and it only cleans the wiki worktree. Anything written
+ * outside it survives.
+ *
+ * Every other kickoff in this file already fences its untrusted input; this one
+ * was simply missed. The file list is fenced for the same reason at lower
+ * stakes — a path is attacker-influenceable too, and there is no cost to it.
+ */
 export const REGROUND_KICKOFF = ({ sha, title, files, vaultDir, predictedPages = [] }) =>
   `A feature just merged. Re-ground the knowledge vault (${vaultDir}) for it.\n\n` +
-  `Feature: ${title}\n` +
+  `Feature:\n${fence('FEATURE NAME', title)}\n` +
   `Grounded commit: ${sha}\n` +
-  `Changed files:\n${files.map((f) => `- ${f}`).join('\n')}\n\n` +
+  `Changed files:\n${fence('CHANGED FILES', files.map((f) => `- ${f}`).join('\n'))}\n\n` +
   // The plan's own prediction, made when this work was drafted. Overlapping
   // changed files against each page's frontmatter finds most of what moved, but
   // misses a page whose file list has drifted or that documents a CONCEPT rather

package/bin/lib/work.mjs

@@ -82,6 +82,37 @@ import {
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { homedir } from 'node:os';
 
+/**
+ * A RESUME THAT FOUND NO CONVERSATION, in the CLI's own words.
+ *
+ * "Produced nothing" was the only signal the retry backstop had, and it is not
+ * the signal these failures give: Claude Code answers a dead `--resume` id with
+ * a result event carrying `errors: ['No conversation found with session ID: …']`
+ * AND writes the same line to stderr, so `out` is non-empty, the backstop never
+ * fired, and the turn SETTLED SUCCESSFULLY with the error as its answer. Every
+ * later message in that tab replied the same way — the marker file still held
+ * the dead id, nothing rewrote it (that only happens when an init event is
+ * seen, and there is none), and no surface offered a way to clear it. A tab
+ * bricked forever by its own CLI pruning its history, which it does on its own
+ * schedule.
+ *
+ * Matched on the CLI's phrasing rather than a code, because neither runtime
+ * gives one. Deliberately narrow: it must not swallow a rate limit or a
+ * permission refusal, both of which are real answers that should stand.
+ */
+const RESUME_LOST = [
+  /no conversation found/i,
+  /no session found/i,
+  /session .{0,80}not found/i,
+  /conversation .{0,80}not found/i,
+  /thread .{0,80}not found/i,
+  /trajectory not found/i,
+];
+const resumeConversationLost = (text) => {
+  const t = String(text || '');
+  return t.length > 0 && RESUME_LOST.some((re) => re.test(t));
+};
+
 /**
  * The shape a per-tab model name must have before it rides argv as
  * `--model <name>`. Conservative for the same reason the codex thread id is
@@ -1309,6 +1340,23 @@ export function createWorkManager({
     const pid = Number(job.pid);
     const signal = job.signal === 'KILL' ? 'SIGKILL' : 'SIGTERM';
 
+    /**
+     * CLAIM FIRST, EVEN FOR THE ANSWERS THAT SIGNAL NOTHING.
+     *
+     * `unsupported` and `not_found` cost nothing to produce, which is exactly
+     * why they must be leased: two daemons on one credential are handed the
+     * same job, and the one holding NOTHING reaches these branches without
+     * measuring anything or making a round trip — so it would answer first,
+     * settle the row, and the machine that could actually have signalled would
+     * find the job already closed and never touch the process. The person reads
+     * "the pid is no longer one of this tab's", which is a real sentence, over a
+     * watcher that is still running.
+     *
+     * The server enforces holder-only settles again (it briefly accepted these
+     * two unclaimed, which is the bug above), so an unclaimed post here would
+     * simply be dropped. One extra round trip on a path nobody is waiting on.
+     */
+    if (!(await claimKill(id))) return;
     if (!processesSupported()) {
       await postKill({ id, outcome: 'unsupported' });
       return;
@@ -1324,7 +1372,6 @@ export function createWorkManager({
       await remeasureAfterKill(sessionId);
       return;
     }
-    if (!(await claimKill(id))) return;
     try {
       process.kill(pid, signal);
       // WHAT HAPPENED, not what we did. "We sent a signal" is a fact about us;
@@ -1439,7 +1486,18 @@ export function createWorkManager({
     // outcome because "the machine cannot do this at all" and "GitHub said
     // no" read differently to the person who asked.
     try {
-      execFileSync('gh', ['auth', 'status'], { stdio: ['ignore', 'pipe', 'pipe'] });
+      // TIMED OUT, like every other `gh` call. `execFileSync` blocks the whole
+      // event loop, so a hung `gh` — an expired token whose refresh hits a
+      // black hole, a credential helper waiting on a keyring prompt that has
+      // no terminal — stops the roster poll, every in-flight settle, the
+      // worktree sweep and the deploy heartbeat (whose 3-minute staleness
+      // window then re-queues a deploy this daemon is still running). The
+      // AGENT merge path was given exactly these timeouts in 0.77.1; this
+      // copy, forty lines of the same logic, was missed.
+      execFileSync('gh', ['auth', 'status'], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 20_000,
+      });
     } catch (e) {
       const missing = e?.code === 'ENOENT';
       await settlePr({
@@ -1499,6 +1557,7 @@ export function createWorkManager({
           execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state'], {
             cwd: repoRoot,
             stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 30_000,
           }).toString()
         );
         return j?.state === 'OPEN' && typeof j?.url === 'string' ? j.url.trim() : null;
@@ -1524,7 +1583,7 @@ export function createWorkManager({
             // call, nothing invented. baseBranchName, not baseRef: gh 422s on
             // a remote-tracking name like origin/main.
             ['pr', 'create', '--head', branch, '--base', baseName, '--fill'],
-            { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'] }
+            { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
           )
             .toString()
             .trim();
@@ -1559,6 +1618,7 @@ export function createWorkManager({
       execFileSync('gh', ['pr', 'merge', branch, '--merge'], {
         cwd: repoRoot,
         stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 120_000,
       });
     } catch (e) {
       const line = ghFirstLine(e);
@@ -2247,15 +2307,41 @@ export function createWorkManager({
    * the pid lives and clears the lock once it is dead.
    */
   const workChildren = new Map(); // child process -> lockPath | null
+  /**
+   * Children whose whole PROCESS GROUP must go, not just the child.
+   *
+   * The standing rule is the opposite — teardown SIGTERMs the CLI child and
+   * never its group, precisely so an unattended auto-update does not kill the
+   * driver's dev server, which a turn started INTO the CLI's group. That rule
+   * is about the CLI's group and stays.
+   *
+   * A project CHECK is a different group entirely: the daemon spawns it itself,
+   * `detached` with `shell: true`, so its group holds the check command and
+   * nothing else — no dev server of anybody's. And `shell: true` is exactly
+   * what makes signalling only the child useless: a compound command like
+   * `npm run lint && npm test` leaves `/bin/sh` as the child, so SIGTERM killed
+   * the shell and the test runner underneath it carried on holding the
+   * worktree — and that place's WRITER lock — through every stop, takeover and
+   * auto-update. The check's own ten-minute timer already kills `-child.pid`
+   * for this reason; teardown simply did not.
+   */
+  const groupKillChildren = new Set();
   const shutdownWork = () => {
     for (const [ch] of workChildren) {
       try {
-        ch.kill('SIGTERM');
+        if (groupKillChildren.has(ch) && ch.pid) process.kill(-ch.pid, 'SIGTERM');
+        else ch.kill('SIGTERM');
       } catch {
-        /* best-effort */
+        // A group that has already gone, or a pid that is no longer a leader.
+        try {
+          ch.kill('SIGTERM');
+        } catch {
+          /* best-effort */
+        }
       }
     }
     workChildren.clear();
+    groupKillChildren.clear();
   };
 
   /**
@@ -2816,6 +2902,7 @@ export function createWorkManager({
             toolLog.ev.length > 0 ? toolLog : undefined
           );
 
+
           // THE COMMAND AUDIT — every `$ …` the CLI's stream reports, batched
           // to the server verbatim so an admin can read what actually ran on
           // this box. Same events the narrator renders and forgets; this is
@@ -2973,8 +3060,28 @@ export function createWorkManager({
             // loud): a fresh conversation would silently discard the adoption
             // and answer as a new session wearing its name — the empty adopt
             // turn settles failed below instead.
-            if (!adopting && resume && !(out || '').trim())
+            /**
+             * …OR PRODUCED ONLY THE CLI SAYING THE CONVERSATION IS GONE.
+             *
+             * "Produced nothing" was the whole test, and it is not the shape
+             * these failures take: Claude Code answers a dead `--resume` id
+             * with a result event carrying `errors: ['No conversation found
+             * with session ID: …']` and writes the same line to stderr, so
+             * `out` is non-empty. The backstop never fired, the turn settled
+             * SUCCESSFULLY with that error as its answer, and — because the
+             * marker is only rewritten when an init event is seen, and there
+             * was none — the dead id stayed pinned. Every later message in
+             * that tab replied identically, with nothing on any surface able
+             * to clear it. A tab bricked forever by its own CLI pruning its
+             * history, which it does on its own schedule.
+             */
+            if (
+              !adopting &&
+              resume &&
+              (!(out || '').trim() || resumeConversationLost(out))
+            ) {
               out = await runTurn({ ...turnArgs, resume: false });
+            }
           } finally {
             // The CLI has stopped printing, so stop relaying. The LINE itself
             // is cleared server-side at settle — clearing it here would race
@@ -3783,10 +3890,30 @@ export function createWorkManager({
      * — which the stale path does on purpose before a merge. A receipt naming
      * somebody else's commit is worse than a missing one.
      */
-    const out = git(
-      ['log', '--format=%H', '--no-merges', `${from}..HEAD`, '--not', baseRef()],
-      wt
-    );
+    /**
+     * IT CANNOT THROW, and that guard is the whole point of it being here.
+     *
+     * `git()` throws on a non-zero exit, and `baseRef()` is built from the
+     * project's Base branch setting — free text an owner types, never verified
+     * against the remote. Point it at a branch with no tracking ref (`develop`
+     * on a repo whose remote branch is `dev`) and this exits "fatal: ambiguous
+     * argument". The throw escaped `runAgentTurn` AFTER the CLI had already run
+     * the card, so `postAgentTurn` was never reached, the server never settled
+     * the turn, and the next poll handed back the identical turn — the same
+     * card re-run every poll for six hours, on the operator's shared account,
+     * piling commits onto the review branch, silently.
+     *
+     * An unreadable range means we cannot MEASURE the receipts, which is a
+     * smaller failure than not settling: the turn still reports, and ship-time
+     * reconciliation books whatever no card claimed. Missing beats fabricated
+     * and both beat a stall.
+     */
+    let out;
+    try {
+      out = git(['log', '--format=%H', '--no-merges', `${from}..HEAD`, '--not', baseRef()], wt);
+    } catch {
+      return [];
+    }
     return typeof out === 'string'
       ? out.split('\n').map((x) => x.trim()).filter(Boolean).slice(0, 50)
       : [];
@@ -4109,6 +4236,25 @@ export function createWorkManager({
           detached: true,
           stdio: ['ignore', 'pipe', 'pipe'],
         });
+        /**
+         * …AND IT IS TRACKED, so a stop or a takeover takes it with them.
+         *
+         * A check is a full test or build run in the agent's worktree, and it
+         * was the one long-lived child the daemon spawned without telling its
+         * own teardown about it. `shutdownWork` signalled the CLI children and
+         * left this one — so restarting the daemon, or a same-repo takeover,
+         * orphaned a running test suite inside a worktree the sweep may then
+         * try to remove. The ten-minute timer would eventually kill it, but by
+         * then it belongs to no daemon and nothing on any surface names it.
+         *
+         * Registered for a GROUP kill: with `shell: true` the child is
+         * `/bin/sh`, and signalling it leaves the runner it started behind —
+         * which is the process actually holding the worktree. See
+         * `groupKillChildren` for why this one is exempt from the
+         * never-signal-the-group rule.
+         */
+        workChildren.set(child, null);
+        groupKillChildren.add(child);
       } catch (e) {
         // TEXT BEFORE FINISH: `finish` captures `text` by value into the
         // resolved object, so assigning afterwards threw the spawn error away
@@ -4117,9 +4263,32 @@ export function createWorkManager({
         finish('failed');
         return;
       }
-      // The TAIL, not the head: a failing check says why at the end.
+      /**
+       * The TAIL, not the head: a failing check says why at the end. And
+       * SCRUBBED BEFORE IT IS CUT, which is the order that matters.
+       *
+       * It used to slice first: `text = (text + buf).slice(-CAP)`, with a
+       * single `envScrub` at the very end. `envScrub` replaces EXACT full
+       * values, so any credential straddling either boundary — the rolling
+       * window's, or a chunk's — was already cut in half by the time it was
+       * looked at, matched nothing, and the surviving tail was written to
+       * `agent.checkOutput` and shown to every member of the project. A failing
+       * integration test that dumps its environment is an ordinary way to reach
+       * that, and the partial is enough where the prefix of the key is a
+       * publicly known constant.
+       *
+       * Scrubbing on every chunk fixes both straddles at once: the accumulated
+       * text always holds the previous kept tail plus the whole new chunk, so a
+       * value split across chunks is whole here, and a value near the window
+       * edge is redacted before anything is discarded. Bounded work — the
+       * string is never longer than the cap plus one chunk.
+       *
+       * The one case it cannot cover is a secret LONGER than the cap itself,
+       * which can never sit in the window whole. The final scrub below stays as
+       * the second pass over what actually ships.
+       */
       const keep = (buf) => {
-        text = (text + buf.toString()).slice(-CHECK_OUTPUT_CAP);
+        text = envScrub(text + buf.toString()).slice(-CHECK_OUTPUT_CAP);
       };
       child.stdout?.on('data', keep);
       child.stderr?.on('data', keep);
@@ -4143,11 +4312,13 @@ export function createWorkManager({
       }, CHECK_TIMEOUT_MS);
       child.on('error', (e) => {
         clearTimeout(timer);
+        workChildren.delete(child);
         text += String(e?.message || e);
         finish('failed');
       });
       child.on('close', (code) => {
         clearTimeout(timer);
+        workChildren.delete(child);
         finish(code === 0 ? 'passed' : 'failed');
       });
     });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.77.3",
-  "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
+  "version": "0.78.0",
+  "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"