flowviant 0.77.5 → 0.78.1

package/bin/lib/landed.mjs

@@ -23,18 +23,19 @@
  * report nothing — ignorance is never turned into a state.
  */
 
+import { execFileSync } from 'node:child_process';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
 import { git, baseBranchName } from './git.mjs';
-import { taskIdsFromMessage } from './worktreeDiff.mjs';
+import { stripDelims, taskIdsFromMessage } from './worktreeDiff.mjs';
 import { warn } from './ui.mjs';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
 
 const LANDED_URL = FLEET_URL.replace(/\/agents\/?$/, '/base-landed');
 /** The server accepts 50 per report. A bigger range walks OLDEST-FIRST in
- *  batches: the persisted tip advances to the last commit actually reported,
+ *  batches: the persisted tip advances to the last commit actually walked,
  *  so the remainder is picked up on the next beat rather than skipped forever
  *  — a trailered card in commit 51 of a big catch-up still closes. */
 const MAX_COMMITS = 50;
@@ -74,27 +75,64 @@ export function createLandedObserver({ repoRoot, baseRef }) {
     }
   };
 
-  /** New non-merge commits in from..to, OLDEST FIRST. `--no-merges` for the
-   *  same reason branchCommits keeps it: a merge commit describes a range
-   *  rather than doing work, and its constituents are walked as themselves. */
+  /** git with the buffer the WALK needs. git.mjs's call takes execFileSync's
+   *  default 1MiB cap, and a catch-up range's `%B` bodies blew through it —
+   *  the throw landed in the reseed catch below, which skipped the whole range
+   *  and silently lost every trailer in it. 8MB is repoState's number for the
+   *  same reason; rev-list output at 41 bytes a commit clears ~200k commits
+   *  before it matters. */
+  const gitWide = (args) =>
+    execFileSync('git', args, {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      maxBuffer: 8 * 1024 * 1024,
+    }).trim();
+
+  /** New non-merge commits in from..to, OLDEST FIRST — the next batch of at
+   *  most MAX_COMMITS, plus the tip the state should advance to when the range
+   *  held more. `--no-merges` for the same reason branchCommits keeps it: a
+   *  merge commit describes a range rather than doing work, and its
+   *  constituents are walked as themselves.
+   *
+   *  THE SHA LIST COMES FROM REV-LIST, NEVER FROM THE FORMATTED LOG. Git
+   *  preserves the 0x1e/0x1f delimiter bytes inside a commit BODY (verified
+   *  empirically), so a crafted message can fabricate whole records — an
+   *  arbitrary sha plus Flowviant-Task ids that /fleet/base-landed would close
+   *  cards on. rev-list prints nothing an author controls, so its output is
+   *  the set of commits that exist: a parsed record whose sha is not in the
+   *  batch is a forgery and is dropped, a repeated sha is the same forgery
+   *  wearing a real commit's name, and the delimiter bytes are stripped from
+   *  every surviving field.
+   *
+   *  BOUNDING THE BODY FETCH TO THE BATCH is what makes the header's batching
+   *  contract true at any range size: `%B` over the whole range grows without
+   *  bound, so the formatted log runs over exactly the shas being reported
+   *  this beat (`--no-walk=unsorted` shows precisely the commits named, in
+   *  argv order — measured). */
   const walk = (from, to) => {
-    const raw = git(
-      ['log', '--reverse', '--no-merges', '--format=%H%x1f%s%x1f%B%x1e', `${from}..${to}`],
-      repoRoot
-    );
+    const shas = gitWide(['rev-list', '--reverse', '--no-merges', `${from}..${to}`])
+      .split('\n')
+      .filter((s) => SHA_RE.test(s));
+    const batch = shas.slice(0, MAX_COMMITS);
+    const tipAfter = shas.length > MAX_COMMITS ? batch[batch.length - 1] : null;
+    if (batch.length === 0) return { commits: [], tipAfter };
+    const real = new Set(batch);
+    const raw = gitWide(['log', '--no-walk=unsorted', '--format=%H%x1f%s%x1f%B%x1e', ...batch]);
     const out = [];
     for (const rec of raw.split('\x1e')) {
       const line = rec.replace(/^\n+/, '');
       if (!line.trim()) continue;
-      const [sha, subject, body] = line.split('\x1f');
-      if (!SHA_RE.test(sha || '')) continue;
+      const [sha, subject, ...bodyParts] = line.split('\x1f');
+      if (!real.has(sha)) continue;
+      real.delete(sha);
       out.push({
         sha,
-        subject: String(subject || '').slice(0, 200),
-        taskIds: taskIdsFromMessage(body).slice(0, 8),
+        subject: stripDelims(subject).slice(0, 200),
+        taskIds: taskIdsFromMessage(stripDelims(bodyParts.join('\n'))).slice(0, 8),
       });
     }
-    return out;
+    return { commits: out, tipAfter };
   };
 
   /** Look at the base tip; if it moved, report the range. Call after anything
@@ -112,21 +150,30 @@ export function createLandedObserver({ repoRoot, baseRef }) {
       return;
     }
     if (st.tip === tip) return;
-    let all;
+    let walked;
     try {
-      all = walk(st.tip, ref);
+      walked = walk(st.tip, ref);
     } catch {
-      // The old tip is no longer answerable (force-push, gc) — reseed and
-      // report nothing rather than guess at a range.
-      writeState({ ref, tip });
+      // Two failures land here and only one may reseed. Probe the range
+      // directly: if rev-list cannot COUNT it, the old tip is genuinely gone
+      // (force-push, gc) and observation reseeds at the new one — ignorance is
+      // never turned into a state. Anything else (a transient spawn failure,
+      // an over-buffer) keeps the stored tip so the next beat retries the same
+      // range; reseeding on those was what skipped a whole catch-up range and
+      // permanently lost every trailer in it.
+      try {
+        git(['rev-list', '--count', `${st.tip}..${ref}`], repoRoot);
+      } catch {
+        writeState({ ref, tip });
+      }
       return;
     }
     // Oldest-first BATCH: a range past the server's cap advances the tip only
-    // to the last commit reported, so the remainder rides the next beat —
+    // to the last commit walked, so the remainder rides the next beat —
     // nothing is skipped forever. (A range of nothing but merge commits still
     // reports, tip-only: the tip moving is the fact deploy-on-merge rides.)
-    const commits = all.slice(0, MAX_COMMITS);
-    const reportedTip = all.length > MAX_COMMITS ? commits[commits.length - 1].sha : tip;
+    const commits = walked.commits;
+    const reportedTip = walked.tipAfter ?? tip;
     inFlight = true;
     try {
       const res = await fetch(LANDED_URL, {

package/bin/lib/localSessions.mjs

@@ -234,6 +234,72 @@ function firstCwdRecord(file) {
   }
 }
 
+/**
+ * THE MARKER NAMES THE DAEMON PINS A TAB'S CONVERSATION UNDER.
+ *
+ * One owner, because two things read them and a drift here is silent: `work.mjs`
+ * WRITES them (`sessionMetaPath(wt, <name>, sessionId)`) and this file READS
+ * them to know which conversations are its own.
+ */
+export const SESSION_MARKERS = [
+  'flowviant-claude-session',
+  'flowviant-codex-thread',
+  'flowviant-agy-conversation',
+];
+
+/**
+ * EVERY CONVERSATION THIS DAEMON STARTED, so the adopt strip never offers you
+ * your own reflection.
+ *
+ * The machine OPERATOR's tabs work in the checkout itself (their place is
+ * `'repo'`), so their CLI transcripts land in `~/.claude/projects/<munge(repoRoot)>/`
+ * — the very directory this scan reads. The `excludeDirs` fence cannot help:
+ * repoRoot is the scan ROOT, not something under it. So the daemon's own tabs
+ * were reported as adoptable "terminal sessions", and two things followed:
+ * the `+` menu offered to adopt a tab you already have open (accepting FORKS
+ * that conversation and copies the checkout's uncommitted and untracked files
+ * into a new worktree), and — because the ended walk keeps only the newest row
+ * per directory, and a live tab's transcript is always the freshest thing in
+ * the checkout — a REAL terminal session started in the repo root could never
+ * be offered at all.
+ *
+ * Excluded by conversation ID rather than by directory, because the directory
+ * is shared with exactly the sessions we want to keep offering.
+ */
+export function ourConversationIds(repoRoot, gitDirs = []) {
+  const ids = new Set();
+  const dirs = new Set(gitDirs.filter(Boolean));
+  try {
+    dirs.add(
+      execFileSync('git', ['rev-parse', '--absolute-git-dir'], {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        timeout: 5_000,
+      }).trim()
+    );
+  } catch {
+    /* not a repo, or git unavailable — the fence is simply empty */
+  }
+  for (const dir of dirs) {
+    let names = [];
+    try {
+      names = readdirSync(dir);
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!SESSION_MARKERS.some((m) => n === m || n.startsWith(`${m}-`))) continue;
+      try {
+        const v = readFileSync(join(dir, n), 'utf8').trim();
+        if (v) ids.add(v);
+      } catch {
+        /* unreadable marker: nothing to fence */
+      }
+    }
+  }
+  return ids;
+}
+
 /**
  * Every Claude terminal session belonging to this repo: LIVE ones from the
  * liveness registry, ENDED ones from the transcript store. Returns
@@ -245,7 +311,11 @@ function firstCwdRecord(file) {
  * itself spawned are tabs already, and offering to adopt one would be the
  * product offering the user their own reflection.
  */
-export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
+export function scanLocalSessions({ repoRoot, excludeDirs = [], excludeIds }) {
+  /** Conversations this daemon started — never offered for adoption. See
+   *  `ourConversationIds`: the operator's tabs share the checkout with real
+   *  terminal sessions, so the fence has to be by id, not by directory. */
+  const mine = excludeIds instanceof Set ? excludeIds : new Set(excludeIds ?? []);
   const live = [];
   const ended = [];
   try {
@@ -311,6 +381,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
         /* no transcript yet */
       }
       if (!liveTitle && typeof rec.name === 'string' && rec.name.trim()) liveTitle = rec.name.trim();
+      if (mine.has(rec.sessionId)) continue; // our own tab, not a terminal session
       live.push({
         id: rec.sessionId,
         cwd,
@@ -387,6 +458,13 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
         continue;
       }
       if (!ours(cwd)) continue;
+      /**
+       * OUR OWN TAB IS NOT A CANDIDATE, and it is skipped BEFORE `seenCwds`
+       * claims the directory — otherwise the daemon's transcript (always the
+       * freshest thing in the checkout) took the one slot that directory gets
+       * and a genuine terminal session there could never be offered at all.
+       */
+      if (mine.has(cand.id)) continue;
       if (seenCwds.has(cwd)) continue; // newest per directory; a live one owns its cwd
       seenCwds.add(cwd);
       const title = transcriptTitle(cand.file, cand.mtimeMs);
@@ -405,7 +483,7 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
   const claude = [...live.slice(0, REPORT_CAP), ...ended];
   // agy rides in whatever room the cap leaves — Claude sessions first, they
   // are the ones adoption serves best (fork, never move).
-  const agy = scanAgyConversations({ repoRoot, excludeDirs }).slice(
+  const agy = scanAgyConversations({ repoRoot, excludeDirs, excludeIds: mine }).slice(
     0,
     Math.max(0, REPORT_CAP - claude.length)
   );
@@ -511,7 +589,8 @@ export function isAgyConversationLive(id) {
 
 /** The repo's agy conversations, via the cwd registry — see the section
  *  comment for why this is deliberately a subset. */
-function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
+function scanAgyConversations({ repoRoot, excludeDirs = [], excludeIds }) {
+  const mine = excludeIds instanceof Set ? excludeIds : new Set(excludeIds ?? []);
   const out = [];
   try {
     let realRoot;
@@ -537,6 +616,9 @@ function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
     const processUp = agyProcessAlive();
     for (const [cwd, id] of Object.entries(map)) {
       if (typeof id !== 'string' || !AGY_UUID_RE.test(id)) continue;
+      // The operator's own agy TAB, whose conversation is registered against
+      // the checkout exactly as a terminal one would be.
+      if (mine.has(id)) continue;
       let real;
       try {
         real = realpathSync(cwd);

package/bin/lib/preflight.mjs

@@ -20,7 +20,7 @@ function present(cmd) {
 
 function ghAuthed() {
   try {
-    execFileSync('gh', ['auth', 'status'], { stdio: 'ignore' });
+    execFileSync('gh', ['auth', 'status'], { stdio: 'ignore', timeout: 20_000 });
     return true;
   } catch {
     return false;

package/bin/lib/preview.mjs

@@ -367,14 +367,17 @@ const TAIL_BYTES = 2000;
  * origin with 502, so without this the product would report "live" over a 502 —
  * Flowviant asserting a state it never measured.
  *
- * `stillServing` (optional, async → boolean) is the ATTRIBUTION re-check the
- * probe runs instead of a bare TCP connect. Ports are global to a box and a
- * worktree is not: when the driver's dev server dies and anything else — a
- * teammate's worktree, a database — binds the same number, a bare
- * `isListening` keeps the probe green and the existing URL+password serve the
- * NEW process, outside every consent gate. The caller passes the same
- * `listenersIn(worktree)` check the open path uses, so "the origin is alive"
- * keeps meaning "THIS session's origin".
+ * `stillServing` (optional, async → boolean) is the ATTRIBUTION check — the
+ * same `listenersIn(worktree)` predicate the caller ran at the boundary —
+ * and it guards EVERY gate in here, not just the probe: the open-time
+ * re-validation, one more look immediately before cloudflared spawns, and the
+ * recurring probe. Ports are global to a box and a worktree is not: when the
+ * driver's dev server dies and anything else — a teammate's worktree, a
+ * database — binds the same number, a bare `isListening` answers yes and the
+ * URL+password serve the NEW process, outside every consent gate. Three gates
+ * on one predicate, so "the origin is alive" always means "THIS session's
+ * origin"; a bare TCP connect stands in only when no predicate was given (an
+ * older caller).
  *
  * `onAbuse` fires when the gate closes itself after repeated failed password
  * attempts — AFTER the share is torn down locally — so the caller can report
@@ -400,10 +403,21 @@ export async function openTunnel({
   shareId,
   authorizeUrl,
 }) {
+  // ONE predicate for every liveness question this function asks. Attribution
+  // when the caller gave it, a bare TCP connect only when it did not; an
+  // attribution check that errors is not a "yes".
+  const serving = async () => {
+    try {
+      return stillServing ? await stillServing() : await isListening(port);
+    } catch {
+      return false;
+    }
+  };
+
   // Re-validate at the machine. The server checked this port against the last
   // report; reports are up to a minute old and a dev server is a process a
   // human can stop at any moment.
-  if (!(await isListening(port))) {
+  if (!(await serving())) {
     return { error: `nothing is listening on port ${port} in this worktree any more.` };
   }
 
@@ -464,6 +478,17 @@ export async function openTunnel({
     return { error: 'could not start the password gate for this preview, so nothing was published.' };
   }
 
+  // The last look BEFORE anything becomes public. Between the check above and
+  // here sit a possible cloudflared download and the gate's own bind — long
+  // enough for the dev server to die and an unrelated process to take the
+  // port, which a check that ran only at the top would never see again until
+  // the probe's first beat, up to probeMs later. Same predicate, so the moment
+  // the hostname exists it can only be pointing at THIS session's origin.
+  if (!(await serving())) {
+    stop();
+    return { error: `nothing is listening on port ${port} in this worktree any more.` };
+  }
+
   const args = ['tunnel', '--url', `http://localhost:${gate.port}`];
   // Send the origin the Host it expects. Vite and Next reject a Host they do
   // not recognise, so without this the tunnel resolves and then 403s.
@@ -513,13 +538,7 @@ export async function openTunnel({
       // share would keep serving a process nobody consented to publish.
       probe = setInterval(async () => {
         if (stopped) return;
-        let serving;
-        try {
-          serving = stillServing ? await stillServing() : await isListening(port);
-        } catch {
-          serving = false; // an attribution check that errors is not a "yes"
-        }
-        if (!serving) {
+        if (!(await serving())) {
           const dead = onDead;
           stop();
           try {

package/bin/lib/prompts.mjs

@@ -298,21 +298,16 @@ rules:
    it down: file_card the slice you are starting, raise_card the rest so the
    queue holds the plan instead of your context.
    FILL IN THE SHAPE when you do — \`points\`, \`acceptanceCriteria\` ("done
-   when", one line each), \`codeAnchors\` (the modules the card owns), and
-   \`priority\`. This is not bookkeeping: the forecast is computed from points and
-   anchors, and the ship review quiz is generated from the criteria. Leave them
-   empty and nothing breaks — the forecast quietly falls back to a flat default
-   and the review has less to ask about. A card you have just designed is the
-   only moment anyone knows those answers.
-   NAME THE FEATURE. When one ask becomes several cards, give them all the same
-   \`featureName\` — a short name a human would recognise ("Password reset",
-   "Billing export"). That is what lets the Board show them as one piece of work
-   instead of five loose rows. Reuse a name already on the board rather than
-   coining a synonym for it.
+   when", one line each), and \`codeAnchors\` (the modules the card owns). This
+   is not bookkeeping: points are how an agent's workload is budgeted when
+   cards are deployed, the ship review quiz is generated from the criteria,
+   and the anchors are what the planner reads. Leave them empty and nothing
+   breaks — the review just has less to ask about. A card you have just
+   designed is the only moment anyone knows those answers.
 10. YOU CAN CORRECT A CARD YOU ALREADY FILED. update_cards patches the SHAPE of
-   cards that exist — \`points\`, \`priority\`, \`featureName\` — up to 25 in one
-   call. This is the tool for "help me plan the backlog": list_cards, decide,
-   then send every change in ONE call. It cannot move a card, close one, assign
+   cards that exist — \`points\` and \`waitsOn\` — up to 25 in one call. This is
+   the tool for "help me plan the backlog": list_cards, decide, then send
+   every change in ONE call. It cannot move a card, close one, assign
    anyone or touch a receipt — organising a backlog is not working on it, so do
    not log_work or deliver anything you have not actually built. A card that is already delivered is refused, because its
    spec is what somebody's review is about. And when list_cards says
@@ -321,9 +316,11 @@ rules:
    SAY WHAT WAITS ON WHAT. \`waitsOn\` takes the task ids a card cannot start
    until, and it is what turns a feature from a heap into a sequence: the
    migration before the endpoint, the endpoint before the UI, the polish last.
-   The Board orders and bands cards from it — READY vs WAITING — so a person who
-   was not in this conversation can still see where to start. Declare it while
-   you are decomposing, because that is the one moment anyone knows.
+   When cards are deployed to agents, the split respects it — an agent holding
+   a card's prerequisite merges before the dependent one starts — and the task
+   page shows it, so a person who was not in this conversation can still see
+   where to start. Declare it while you are decomposing, because that is the
+   one moment anyone knows.
 11. DELIVER WITH RECEIPTS. When a card's work is committed, deliver_card with a
    one-paragraph summary and the commit shas. Delivered is ASSERTED; done is
    OBSERVED (the merge, on their word). Never claim done, and never deliver
@@ -482,20 +479,40 @@ export const WORK_TURN_KICKOFF_PLAIN = ({ sessionName, message, askedByName }) =
   });
 
 
+/**
+ * EVERY SERVER-CARRIED STRING HERE IS FENCED — the feature name, the file
+ * list, and the predicted-page list.
+ *
+ * A card title is member-authored, and worse: ticket triage falls back to the
+ * REPORTER's ticket title verbatim, so a stranger can put words in it. That
+ * string rides the ship report into `code_map_reground_jobs`, comes back on the
+ * roster, and landed here as a bare `Feature: <text>` line — no delimiter, no
+ * instruction not to obey it. This turn runs UNATTENDED under `WIKI_PERM`,
+ * which grants Write, Edit, `Bash(mkdir:*)` and `Bash(rm:*)`, and whose own
+ * comment concedes that Write/Edit cannot be path-scoped here — the worktree
+ * reset is the backstop, and it only cleans the wiki worktree. Anything written
+ * outside it survives.
+ *
+ * The predicted pages come off the roster exactly as the title does — a
+ * planner wrote them from card text, and card text is member-authored — so an
+ * unfenced `- <page>` line was the same injection lane with a different field
+ * name. The file list is fenced for the same reason at lower stakes: a path is
+ * attacker-influenceable too, and there is no cost to it.
+ */
 export const REGROUND_KICKOFF = ({ sha, title, files, vaultDir, predictedPages = [] }) =>
   `A feature just merged. Re-ground the knowledge vault (${vaultDir}) for it.\n\n` +
-  `Feature: ${title}\n` +
+  `Feature:\n${fence('FEATURE NAME', title)}\n` +
   `Grounded commit: ${sha}\n` +
-  `Changed files:\n${files.map((f) => `- ${f}`).join('\n')}\n\n` +
+  `Changed files:\n${fence('CHANGED FILES', files.map((f) => `- ${f}`).join('\n'))}\n\n` +
   // The plan's own prediction, made when this work was drafted. Overlapping
   // changed files against each page's frontmatter finds most of what moved, but
   // misses a page whose file list has drifted or that documents a CONCEPT rather
   // than a directory. This is a hint to CHECK, never a list to trust.
   (predictedPages.length
-    ? `When this work was planned, these vault pages were expected to go stale.\n` +
-      `Treat it as a lead, not a fact — verify each against the code before\n` +
-      `editing, and ignore any that turned out to be unaffected:\n` +
-      `${predictedPages.map((p) => `- ${p}`).join('\n')}\n\n`
+    ? `When this work was planned, the vault pages listed below were expected\n` +
+      `to go stale. Treat the list as a lead, not a fact — verify each against\n` +
+      `the code before editing, and ignore any that turned out to be unaffected:\n` +
+      `${fence('PREDICTED PAGES', predictedPages.map((p) => `- ${p}`).join('\n'))}\n\n`
     : '') +
   `Follow your instructions: update the touched vault pages (and any docs/\n` +
   `chapter that covers them), append the feature-history entry to log.md,\n` +

package/bin/lib/shipSweep.mjs

@@ -19,11 +19,15 @@ import { baseBranchName } from './git.mjs';
  *
  * `git branch -d` IS THE GUARD, deliberately, rather than a stack of checks
  * of our own. It refuses an UNMERGED branch and it refuses one CHECKED OUT in
- * any worktree — which are two of the three conditions, enforced by the tool
- * that owns the truth instead of by our reading of it. Never `-D`: if git
- * objects, git is right and we stop. The third condition is ours and is the
- * name: only `session/<id>` exactly, so a branch the agent cut is never in
- * scope no matter what it was merged into.
+ * any worktree — enforced by the tool that owns the truth instead of by our
+ * reading of it. Never `-D`: if git objects, git is right and we stop. Two
+ * conditions are ours on top of it. The NAME: only `session/<id>` exactly, so
+ * a branch the agent cut is never in scope no matter what it was merged into.
+ * And ANCESTRY OF BASE: `-d` with no upstream judges "merged" against HEAD,
+ * so an operator parked on an experimental branch that merged the session
+ * work would get the delete while the narration below claimed "merged into
+ * <base>" for commits base has never seen — the claim is checked against the
+ * thing it names before git is asked at all.
  *
  * ORDERING IS LOAD-BEARING. This must not run while a ship report is still
  * undelivered. Ship's idempotency path recovers from a lost report by asking
@@ -45,6 +49,13 @@ export function sweepMergedBranch(sessionId, { git, repoRoot, baseRef, note, isR
   } catch {
     return false; // already gone, or never existed
   }
+  try {
+    git(['merge-base', '--is-ancestor', `refs/heads/${name}`, baseRef], repoRoot);
+  } catch {
+    // Not on base — merged into something, perhaps, but not into the thing the
+    // narration names, and not ours to retire on HEAD's say-so.
+    return false;
+  }
   try {
     git(['branch', '-d', name], repoRoot);
   } catch {