flowviant 0.77.5 → 0.78.1

package/bin/lib/authproxy.mjs

@@ -92,12 +92,28 @@ import { createServer, request } from 'node:http';
 import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
 import { GRANT_COOKIE, cookieValues, safePathname, safeRelative, stripCookie, verifyGrant } from './grant.mjs';
 
-/** Failed attempts before the proxy stops answering at all. A quick tunnel's
- *  hostname is unguessable, so this is not the primary control — it is what
- *  turns a discovered URL from an offline guessing target into a visible,
- *  self-closing incident. */
+/** Wrong-password attempts from ONE source before that source's Basic
+ *  attempts are refused outright. A quick tunnel's hostname is unguessable,
+ *  so this is not the primary control — but it is KNOWN to every past
+ *  member, tester and password recipient, whose access cannot be recalled.
+ *  The threshold is per source because one global counter made 25 wrong
+ *  guesses from any URL holder a kill switch on everyone else's share. */
 const MAX_FAILED = 25;
 
+/** Counted failures across ALL sources before the whole share tears down.
+ *  The per-source block above answers a single abuser; this answers a
+ *  DISTRIBUTED guessing run (addresses rotating to stay under MAX_FAILED
+ *  each) — the original self-closing-incident property, kept at a threshold
+ *  ordinary use cannot reach: a blocked source stops counting, so getting
+ *  here takes eight independent sources each burning their full allowance. */
+const MAX_FAILED_TOTAL = 200;
+
+/** Bound on the per-source map — a rotating attacker must not grow daemon
+ *  memory without limit. Eviction is oldest-first and CAN un-block an evicted
+ *  source, but cycling 500 fresh sources costs at least 500 counted failures,
+ *  and the global backstop closes the share long before that. */
+const MAX_SOURCES = 500;
+
 const digest = (s) => createHash('sha256').update(String(s)).digest();
 
 /** Constant-time over sha256 digests, so length never leaks and a missing
@@ -116,8 +132,10 @@ function sameSecret(a, b) {
  * hard failure. Binds loopback only; cloudflared connects locally, and the
  * password is what gates the public hostname.
  *
- * `onAbuse` fires once, after MAX_FAILED rejected attempts, so the caller can
- * tear the whole share down rather than leaving a URL under attack.
+ * `onAbuse` fires once, after MAX_FAILED_TOTAL rejected attempts across all
+ * sources, so the caller can tear the whole share down rather than leaving a
+ * URL under attack. A single source is blocked on its own, at MAX_FAILED,
+ * without ending anybody else's share.
  */
 export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId, authorizeUrl }) {
   // ALL THREE OR NONE. Two of the three is a gate that cannot bounce anybody:
@@ -134,44 +152,82 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
   const password = randomBytes(24).toString('base64url');
   const expected = 'Basic ' + Buffer.from(`${user}:${password}`).toString('base64');
 
-  let failed = 0;
+  let failedTotal = 0;
   let abused = false;
+  /** source → wrong-password count, insertion-ordered so eviction below is
+   *  oldest-first. A source at MAX_FAILED is BLOCKED: its Basic attempts are
+   *  refused BEFORE the comparison and stop counting toward the total. */
+  const failedBySource = new Map();
   /** The payload of the last validly-signed but EXPIRED grant seen, so a
    *  tester can be re-bounced with the token inside it. */
   let lastExpired = null;
 
+  /** cloudflared forwards the real client address in Cf-Connecting-Ip; a
+   *  direct local connection (the machine's own curl, the tests) has only the
+   *  socket. The header is attacker-writable in principle, but lying in it
+   *  only SPREADS one attacker across per-source counters — which is exactly
+   *  the shape MAX_FAILED_TOTAL exists to answer. */
+  const sourceOf = (req) =>
+    String(req.headers['cf-connecting-ip'] || req.socket?.remoteAddress || 'unknown');
+
+  const sourceBlocked = (req) => (failedBySource.get(sourceOf(req)) ?? 0) >= MAX_FAILED;
+
+  const noteFailure = (req) => {
+    const src = sourceOf(req);
+    const count = (failedBySource.get(src) ?? 0) + 1;
+    // Delete-then-set so Map insertion order tracks recency, making the
+    // eviction below an LRU rather than "whoever failed first".
+    failedBySource.delete(src);
+    failedBySource.set(src, count);
+    if (failedBySource.size > MAX_SOURCES) {
+      failedBySource.delete(failedBySource.keys().next().value);
+    }
+    if (count === MAX_FAILED) {
+      log?.(`preview gate: ${count} failed attempts from ${src} — refusing that source.`);
+    }
+    // MONOTONE, never reset by a success: a distributed run has no successes
+    // to hide behind, and a legitimate share cannot reach the backstop —
+    // every source stops counting at MAX_FAILED, so 200 needs eight distinct
+    // sources each exhausting their own allowance.
+    failedTotal += 1;
+    if (failedTotal >= MAX_FAILED_TOTAL && !abused) {
+      abused = true;
+      log?.(`preview gate: ${failedTotal} failed attempts across sources — closing the share.`);
+      try {
+        onAbuse?.();
+      } catch {
+        /* the caller's teardown is best-effort */
+      }
+    }
+  };
+
   /**
    * A PURE CREDENTIAL PREDICATE — no method, no Accept, no path. That is what
    * lets the websocket upgrade handler reuse it verbatim, and it is why routing
    * decisions live in the request handler instead.
    *
-   * Tristate-plus: 'ok' | 'none' | 'expired' | 'forged' | 'badpass'.
+   * Tristate-plus: 'ok' | 'none' | 'expired' | 'forged' | 'badpass' | 'blocked'.
    */
   const credential = (req) => {
     if (abused) return 'badpass';
-    if (sameSecret(req.headers['authorization'], expected)) {
-      failed = 0;
-      return 'ok';
-    }
     // ONLY A WRONG PASSWORD COUNTS AS AN ATTEMPT, and this is a reason rather
     // than a preference. A forged HMAC is not brute-forceable, so counting it
     // buys nothing — while counting it would hand any stranger who finds the
-    // hostname a 25-request KILL SWITCH on the owner's share, because onAbuse
-    // tears the whole thing down. An expired-but-validly-signed grant must
-    // never count either, or a viewer who left a tab open overnight closes the
-    // share on their own reload. MAX_FAILED keeps its exact meaning, which is
-    // also why the 'abuse' ended-reason sentence stays true.
+    // hostname a kill switch on the owner's share, because onAbuse tears the
+    // whole thing down. An expired-but-validly-signed grant must never count
+    // either, or a viewer who left a tab open overnight closes the share on
+    // their own reload.
     if (req.headers['authorization']) {
-      failed += 1;
-      if (failed >= MAX_FAILED && !abused) {
-        abused = true;
-        log?.(`preview gate: ${failed} failed attempts — closing the share.`);
-        try {
-          onAbuse?.();
-        } catch {
-          /* the caller's teardown is best-effort */
-        }
+      // A blocked source is refused BEFORE the comparison — a block that
+      // still grades guesses would let the brute force run to a correct hit.
+      if (sourceBlocked(req)) return 'blocked';
+      if (sameSecret(req.headers['authorization'], expected)) {
+        // Per-source only: a shared NAT recovers when one person behind it
+        // gets the password right; failedTotal stays monotone (see above).
+        failedBySource.delete(sourceOf(req));
+        return 'ok';
       }
+      noteFailure(req);
       return 'badpass';
     }
 
@@ -188,8 +244,6 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     return String(req.headers.cookie ?? '').includes(GRANT_COOKIE) ? 'forged' : 'none';
   };
 
-  const authed = (req) => credential(req) === 'ok';
-
   /**
    * The CSRF backstop for the partitioned cookie (header rule 4a): a browser
    * old enough to ignore `Partitioned` while honouring `SameSite=None` will
@@ -388,6 +442,14 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     }
     // 3. One predicate.
     const verdict = credential(req);
+    // A blocked source gets 429, not the challenge — a WWW-Authenticate here
+    // would invite the retry the block exists to end. Only that source's
+    // Basic attempts are refused; every other viewer's share is untouched.
+    if (verdict === 'blocked') {
+      res.writeHead(429, { 'Content-Type': 'text/plain', ...noStore });
+      res.end('too many failed attempts from this address');
+      return;
+    }
     if (verdict !== 'ok') {
       if (grants && verdict !== 'badpass' && isBrowserNav(req)) return bounce(req, res, verdict);
       return challenge(res);
@@ -435,10 +497,17 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     }
     // NEVER 302 HERE — browsers fail an upgrade rather than following a 3xx, so
     // a bounce would read as a dead dev server. The cookie IS sent on a
-    // same-origin handshake, so `authed` works unchanged; a cookie-less upgrade
-    // stays a 401 and the page's HMR client reconnects once the human has
-    // re-authenticated in the main document.
-    if (!authed(req)) {
+    // same-origin handshake, so the predicate works unchanged; a cookie-less
+    // upgrade stays a 401 and the page's HMR client reconnects once the human
+    // has re-authenticated in the main document. A blocked source's Basic
+    // handshake gets the same 429 the request path sends, and no challenge.
+    const upgradeVerdict = credential(req);
+    if (upgradeVerdict === 'blocked') {
+      socket.write('HTTP/1.1 429 Too Many Requests\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+    if (upgradeVerdict !== 'ok') {
       socket.write('HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm="Flowviant preview"\r\n\r\n');
       socket.destroy();
       return;

package/bin/lib/claude.mjs

@@ -12,10 +12,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { SAFE, MODEL } from './config.mjs';
+import { SAFE } from './config.mjs';
 import { runtimeById, humanizeClaudeTool } from './runtimes.mjs';
 
 // Every prompt/kickoff constant lives in prompts.mjs and is re-exported here:
@@ -141,20 +138,6 @@ export const blockedId = (out) => {
   return m ? m[1] : null;
 };
 
-export function mcpConfigFor(token, mcpUrl) {
-  const dir = mkdtempSync(join(tmpdir(), 'flowviant-'));
-  const p = join(dir, 'mcp.json');
-  writeFileSync(
-    p,
-    JSON.stringify({
-      mcpServers: {
-        flowviant: { type: 'http', url: mcpUrl, headers: { Authorization: `Bearer ${token}` } },
-      },
-    })
-  );
-  return { dir, path: p };
-}
-
 /**
  * Hand a runtime the flowviant MCP server, however that runtime wants it.
  *
@@ -259,7 +242,17 @@ function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText
       // permission, an aborted run). Under `answerFromResult` this is the only
       // stdout that would have said so, and a caller whose `out` is the answer
       // must not report "no output" for a turn that explained itself.
-      const msg = ev.error?.message ?? ev.error ?? ev.subtype;
+      // `errors[]` FIRST, because it is where the real sentence is. Claude
+      // Code reports a dead `--resume` id as
+      // `{subtype:'error_during_execution', errors:['No conversation found
+      // with session ID: …']}` — reading only `error`/`subtype` dropped that
+      // and appended the literal string `error_during_execution`, which told
+      // the driver nothing and hid the one phrase the caller needs to
+      // recognise a lost conversation.
+      const listed = Array.isArray(ev.errors)
+        ? ev.errors.filter((e) => typeof e === 'string' && e.trim()).join('; ')
+        : '';
+      const msg = listed || ev.error?.message || ev.error || ev.subtype;
       appendText(`${typeof msg === 'string' ? msg : JSON.stringify(msg)}\n`);
     }
   }

package/bin/lib/deploy.mjs

@@ -10,13 +10,14 @@
  * wrangler output routinely echoes secrets.
  */
 
-import { readFileSync, existsSync } from 'node:fs';
+
 import { spawn } from 'node:child_process';
 import { join } from 'node:path';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { deployCreds, appSecretsFor, scrub, myPubB64 } from './env.mjs';
 import { childEnv } from './childEnv.mjs';
+import { git } from './git.mjs';
 
 const deployUrl = (tail) => FLEET_URL.replace(/\/agents\/?$/, `/${tail}`);
 
@@ -38,27 +39,64 @@ async function post(tail, body) {
   return json?.data;
 }
 
-/** Read + parse .flowviant/deploy.json from the repo root. Returns [] if none. */
-export function readDeployConfig(repoRoot) {
-  const path = join(repoRoot, '.flowviant', 'deploy.json');
-  if (!existsSync(path)) return [];
+/**
+ * Read + parse `.flowviant/deploy.json` AS IT IS ON THE BASE BRANCH. Returns []
+ * if the branch has none.
+ *
+ * IT USED TO READ THE WORKING TREE, which made the feature's one stated bound
+ * false. `deploy_target`'s own description says "only ids already declared in
+ * `.flowviant/deploy.json` on MAIN can be named (the daemon reads and runs from
+ * the repo ROOT, never a session worktree, so an agent cannot author the command
+ * it triggers without shipping it first)" — and the repo root's WORKING TREE is
+ * exactly where the machine operator's tabs stand (their place is the checkout).
+ * So an agent that had read an injected instruction could write an uncommitted
+ * `.flowviant/deploy.json` naming any shell command, call `deploy_target`, and
+ * have the daemon run it from the repo root with `CLOUDFLARE_API_TOKEN` and
+ * every other deploy-scope credential in its environment. Nothing about that
+ * needed a commit, a review, or an owner.
+ *
+ * Reading the COMMITTED tree is what makes the sentence true: authoring the
+ * command now requires landing it on base, which is a reviewed act. The file is
+ * read through git rather than the filesystem, so an uncommitted edit is simply
+ * not there.
+ *
+ * A base ref that does not resolve yields NO TARGETS, and says so once. That is
+ * the withholding direction and it is the right one here — a deploy is
+ * irreversible and running the wrong file is worse than running nothing.
+ */
+export function readDeployConfig(repoRoot, baseRef) {
+  let raw;
+  if (baseRef) {
+    try {
+      raw = git(['show', `${baseRef}:.flowviant/deploy.json`], repoRoot);
+    } catch {
+      // No such file on base, or a base ref that does not resolve. Both mean
+      // "this branch declares no targets", which is a real answer.
+      return [];
+    }
+  } else {
+    // No base ref in hand (a caller that has not been updated). Refuse rather
+    // than silently falling back to the working tree — that fallback IS the bug.
+    warn('deploy: no base branch resolved, so no deploy targets were read.');
+    return [];
+  }
   try {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    const parsed = JSON.parse(raw);
     const targets = Array.isArray(parsed?.targets) ? parsed.targets : [];
     // Keep only fields the server + runner need; the daemon holds the commands.
     return targets
       .filter((t) => t && typeof t.id === 'string' && typeof t.command === 'string')
       .slice(0, 20);
   } catch (e) {
-    warn(`deploy: .flowviant/deploy.json is not valid JSON — ${e.message}`);
+    warn(`deploy: .flowviant/deploy.json on the base branch is not valid JSON — ${e.message}`);
     return [];
   }
 }
 
 /** Report the parsed config to the server (only when it changed). */
 let lastConfigJson = null;
-export async function reportDeployConfig(repoRoot) {
-  const targets = readDeployConfig(repoRoot);
+export async function reportDeployConfig(repoRoot, baseRef) {
+  const targets = readDeployConfig(repoRoot, baseRef);
   const json = JSON.stringify(targets);
   if (json === lastConfigJson) return;
   // Scrub command strings before the server sees them — a command line can embed
@@ -154,6 +192,23 @@ async function verifyHealth(url, status) {
 }
 
 const claiming = new Set(); // in-flight guard (single-flight per daemon process)
+/**
+ * JOBS THIS PROCESS HAS ALREADY RUN, whatever the server thinks.
+ *
+ * A deploy is IRREVERSIBLE and the report is not: a transient 5xx, a DNS blip
+ * or the 30s timeout meant the outcome never landed, the heartbeat stopped,
+ * and three minutes later the server requeued the job and this same daemon ran
+ * `wrangler rollback` — or a full prod deploy with every pushSecret re-pushed —
+ * a SECOND time, leaving production two versions behind the intended one with
+ * nothing recording that it happened twice.
+ *
+ * So the process remembers. Not a substitute for the report (see the retry
+ * below, which is the real fix); a floor under it, for the case where the
+ * report never lands at all. It does not survive a restart — nothing local
+ * could be trusted to — which is why the retry has to keep the heartbeat alive
+ * while it runs.
+ */
+const ran = new Set();
 
 /**
  * Process queued deploy jobs from the roster. `ctx` = { repoRoot, baseRef,
@@ -168,6 +223,7 @@ export function processDeployJobs(jobs, ctx) {
     // reconcile loop, since this runs unguarded from the fleet tick.
     if (!job || typeof job.id !== 'string') continue;
     if (claiming.has(job.id)) continue;
+    if (ran.has(job.id)) continue; // already executed here — never twice
     claiming.add(job.id);
     void (async () => {
       let beat = null;
@@ -185,10 +241,41 @@ export function processDeployJobs(jobs, ctx) {
         // Keep the claim fresh while we run — a long deploy must never be
         // re-queued out from under us (that would double-deploy). The async
         // run() below keeps the event loop free so this fires.
+        /**
+         * …AND IT CAN DIE, which is what makes the `stillBeating` predicate
+         * below mean anything.
+         *
+         * `report` is handed `() => beat != null` so it stops retrying once the
+         * claim is certainly stale — but `beat` only ever held a timer handle
+         * and was never nulled, so that predicate could not return false and
+         * `report` retried into a job another daemon may already own.
+         *
+         * The server re-queues a deploy whose heartbeat is older than three
+         * minutes, and this fires every sixty seconds — so three consecutive
+         * failures is exactly the point past which the claim cannot be assumed.
+         * A single blip does not count: only an unbroken run does.
+         */
+        let missed = 0;
         beat = setInterval(() => {
-          void post('deploy-heartbeat', { jobId: job.id, pubkey: ctx.myPubB64() }).catch(() => {});
+          void post('deploy-heartbeat', {
+            jobId: job.id,
+            pubkey: ctx.myPubB64(),
+            // Instance rides the heartbeat too, or a same-box sibling's beat
+            // could keep a dead claimer's job "running" past the stale sweep.
+            instance: DAEMON_INSTANCE,
+          })
+            .then(() => {
+              missed = 0;
+            })
+            .catch(() => {
+              missed += 1;
+              if (missed >= 3 && beat) {
+                clearInterval(beat);
+                beat = null;
+              }
+            });
         }, 60_000);
-        const targets = readDeployConfig(ctx.repoRoot);
+        const targets = readDeployConfig(ctx.repoRoot, ctx.baseRef);
         const target = targets.find((t) => t.id === job.targetId);
         if (!target) {
           await report(job, ctx, { ok: false, message: `target "${job.targetId}" not in .flowviant/deploy.json` });
@@ -196,13 +283,19 @@ export function processDeployJobs(jobs, ctx) {
         }
         note(`${c.cyan('deploy')} ${c.dim(`— ${job.kind} ${job.targetId} → ${job.env}…`)}`);
         const outcome = await runDeploy(job, target, ctx);
-        await report(job, ctx, outcome);
+        // From here the work is DONE. Whatever the report does, this job must
+        // never run again in this process.
+        ran.add(job.id);
+        await report(job, ctx, outcome, () => beat != null);
         if (outcome.ok) ok(`${c.cyan('deploy')} ${c.dim(`— ${job.targetId} → ${job.env} done${outcome.healthOk === false ? ' (health failed)' : ''}`)}`);
         else warn(`deploy: ${job.targetId} → ${job.env} failed — ${outcome.message}`);
       } catch (e) {
         warn(`deploy job ${job.id} errored: ${e.message}`);
         await report(job, ctx, { ok: false, message: e.message }).catch(() => {});
       } finally {
+        // Stopped only AFTER the report has landed or given up — the requeue is
+        // gated on heartbeat staleness, so beating through the retries is what
+        // stops the server handing this job out again mid-retry.
         if (beat) clearInterval(beat);
         claiming.delete(job.id);
       }
@@ -278,13 +371,55 @@ async function runDeploy(job, target, ctx) {
   };
 }
 
-function report(job, ctx, outcome) {
-  return post('deploy-report', {
+/**
+ * THE OUTCOME IS RETRIED, because losing it re-runs the deploy.
+ *
+ * One `post` with a `.catch(warn)` was the whole of this: a transient 5xx, a
+ * DNS blip or the 30s timeout dropped the outcome, the `finally` stopped the
+ * heartbeat, and the server — which requeues a running job after three minutes
+ * without one — handed the SAME job back to the SAME daemon, which ran it
+ * again. For a rollback that is production two versions behind the intended
+ * one; for a prod deploy it is every pushSecret pushed twice. Nothing recorded
+ * that it had happened at all.
+ *
+ * The heartbeat keeps running throughout (the caller's `finally` is what stops
+ * it), so the requeue window stays shut for as long as we are still trying.
+ * Bounded: six attempts over roughly a minute, then a warning and the local
+ * `ran` guard as the floor.
+ */
+async function report(job, ctx, outcome, stillBeating = () => true) {
+  const body = {
     jobId: job.id,
     pubkey: ctx.myPubB64(),
+    // The same term the claim carries, for the same reason: the pubkey is one
+    // keypair per home directory, so two daemons on one box share it, and a
+    // stale holder's late report would otherwise settle the RECLAIMER's
+    // running job. The server matches it when present; an older server
+    // ignores the extra key.
+    instance: DAEMON_INSTANCE,
     ok: !!outcome.ok,
     deploymentId: outcome.deploymentId ?? null,
     healthOk: outcome.healthOk ?? null,
     message: scrub(outcome.message || ''),
-  }).catch((e) => warn(`deploy: could not report outcome — ${e.message}`));
+  };
+  for (let attempt = 0; attempt < 6; attempt++) {
+    try {
+      await post('deploy-report', body);
+      return;
+    } catch (e) {
+      // The last attempt says so; the ones before it are noise on a path that
+      // usually recovers.
+      if (attempt === 5) {
+        warn(`deploy: could not report outcome after 6 tries — ${e.message}`);
+        return;
+      }
+      // If the heartbeat is already gone the requeue window is open and
+      // retrying buys nothing — the job may have been handed to somebody else.
+      if (!stillBeating()) {
+        warn(`deploy: could not report outcome — ${e.message}`);
+        return;
+      }
+      await new Promise((r) => setTimeout(r, 2000 * (attempt + 1)));
+    }
+  }
 }

package/bin/lib/env.mjs

@@ -249,7 +249,9 @@ export async function loadCachedEnv(projectId) {
   if (!cached) return false;
   values = cached.values ?? [];
   bundleVersion = cached.bundleVersion ?? -1;
-  knownTargetFiles = new Set(cached.knownFiles ?? values.map((v) => v.targetFile));
+  // Filtered even though we wrote the cache: this set feeds removeStaleEnvFile,
+  // and a cache file predates whatever rules the running daemon enforces.
+  knownTargetFiles = new Set((cached.knownFiles ?? values.map((v) => v.targetFile)).filter(isSafeTarget));
   cachedProjectId = projectId;
   return values.length > 0;
 }
@@ -264,8 +266,8 @@ export async function loadCachedEnv(projectId) {
  * only and never touches the user's repo". Git does not read that file: it
  * resolves `info/exclude` against $GIT_COMMON_DIR — the main `.git` — so in
  * every linked worktree the daemon creates, the exclusion did nothing at all.
- * The plaintext secret files stayed visible to `git add -A`, which is what
- * `checkpointWip` runs before force-pushing a WIP commit to the remote.
+ * The plaintext secret files stayed visible to `git add -A` — the first thing
+ * an agent runs before committing and pushing the branch it is working on.
  *
  * `--git-common-dir` is asked of git rather than derived, because that is the
  * one answer that cannot drift from what git itself will consult. The file is
@@ -307,13 +309,25 @@ export function excludeInWorktree(wt, relPaths) {
   }
 }
 
+/** MUST match the server's isSafeEnvTargetFile (env.schema.ts) — the server
+ *  validates at intake, but this file also refills paths from the on-disk
+ *  cache and hands them to rmSync, so the daemon holds its own line rather
+ *  than trusting either source. `.git` is refused at ANY depth and
+ *  case-insensitively (git treats `.GIT` the same on case-insensitive
+ *  filesystems): a target of `.git/hooks/pre-commit` would turn a
+ *  materialized value into code git runs on the operator's next commit —
+ *  check-ignore alone must not be the only thing standing there. The control
+ *  range subsumes the old bare `\0` check and keeps a newline out of a PATH,
+ *  where nothing downstream expects one. */
 const isSafeTarget = (p) =>
-  p &&
+  typeof p === 'string' &&
+  p.length > 0 &&
   p.length <= 200 &&
   !p.includes('\\') &&
-  !p.includes('\0') &&
+  // eslint-disable-next-line no-control-regex
+  !/[\x00-\x1f\x7f]/.test(p) &&
   !p.startsWith('/') &&
-  p.split('/').every((s) => s.length > 0 && s !== '.' && s !== '..');
+  p.split('/').every((s) => s.length > 0 && s !== '.' && s !== '..' && s.toLowerCase() !== '.git');
 
 /** Is this path TRACKED in the repo? info/exclude only hides UNTRACKED files —
  *  materializing secrets into a tracked file would make them stageable and
@@ -406,8 +420,16 @@ function renderEnvFile(list) {
 }
 
 /** Delete a materialized file from a worktree, but ONLY if it's ours (carries
- *  our header) and not git-tracked — never touch a file we didn't write. */
+ *  our header) and not git-tracked — never touch a file we didn't write.
+ *
+ *  `rel` gets the SAME gate the write path has: it arrives via
+ *  knownTargetFiles, which is refilled from the server bundle and from the
+ *  on-disk cache, and this function joins it to a worktree and calls rmSync.
+ *  The isTrackedInGit check cannot stand in for validation — `ls-files` on a
+ *  path outside the worktree THROWS, the catch reads as "not tracked", and
+ *  the deletion proceeds. A delete primitive validates its own input. */
 function removeStaleEnvFile(wt, rel) {
+  if (!isSafeTarget(rel)) return;
   if (isTrackedInGit(wt, rel)) return;
   const abs = join(wt, rel);
   try {
@@ -460,8 +482,8 @@ export function materializeInto(wt) {
 
   // Exclude BEFORE writing, not after. The old order wrote plaintext first and
   // tried to hide it afterwards, so every failure mode — and the exclude file
-  // being the wrong one, which it was — left a readable secret in a tree that
-  // `checkpointWip` force-pushes.
+  // being the wrong one, which it was — left a readable secret sitting where
+  // the next `git add -A` in that tree would stage it for a push.
   excludeInWorktree(wt, [...byFile.keys()]);
 
   const written = [];
@@ -477,9 +499,9 @@ export function materializeInto(wt) {
       anyProblem = true;
       continue;
     }
-    // The load-bearing check. A materialized secret sits in a worktree whose
-    // whole tree gets `git add -A`'d and force-pushed by the WIP checkpoint, so
-    // "git cannot see this file" is a precondition for writing it, not a nicety.
+    // The load-bearing check. A materialized secret sits in a worktree where an
+    // agent runs `git add -A` and pushes as a matter of course, so "git cannot
+    // see this file" is a precondition for writing it, not a nicety.
     if (!isIgnoredInGit(wt, file)) {
       warn(`env: "${file}" is not gitignored — refusing to write secrets there. Add it to .gitignore. Its keys are NOT materialized.`);
       refusedForGit.push(file);
@@ -557,17 +579,6 @@ export function materializeInto(wt) {
   everMaterialized = true;
 }
 
-/**
- * The secret files this daemon has materialized into `wt`.
- *
- * Exists so anything that stages the whole tree can subtract them by pathspec.
- * Belt to the check-ignore braces: `git add -A` obeys .gitignore, so a properly
- * ignored file is already safe — but "already safe" was the assumption that put
- * plaintext on a remote branch, and a second, independent mechanism is cheap.
- */
-export function materializedFiles(wt) {
-  return [...(lastFilesByWorktree.get(wt) ?? [])];
-}
 
 // ── Uplink scrubbing ───────────────────────────────────────────────────────
 
@@ -704,7 +715,9 @@ export async function handleRosterEnv(env, { projectId } = {}) {
       bundleVersion = bundle.bundleVersion;
       // Fold the current target files into the persisted known set so stale
       // cleanup survives a restart (a key deleted while down still gets swept).
-      for (const v of values) knownTargetFiles.add(v.targetFile);
+      // Filtered at the fill, not just at the delete: this set is persisted,
+      // so an unsafe path admitted here would outlive the bundle that sent it.
+      for (const v of values) if (isSafeTarget(v.targetFile)) knownTargetFiles.add(v.targetFile);
       if (cachedProjectId) writeCache(cachedProjectId, { values, bundleVersion, knownFiles: [...knownTargetFiles] });
       ok(`${c.cyan('env')} ${c.dim(`— synced ${values.length} secret${values.length === 1 ? '' : 's'} (env v${bundleVersion})`)}`);
       return { changed: true };