flowviant 0.78.0 → 0.78.1

package/bin/lib/shipSweep.mjs

@@ -19,11 +19,15 @@ import { baseBranchName } from './git.mjs';
  *
  * `git branch -d` IS THE GUARD, deliberately, rather than a stack of checks
  * of our own. It refuses an UNMERGED branch and it refuses one CHECKED OUT in
- * any worktree — which are two of the three conditions, enforced by the tool
- * that owns the truth instead of by our reading of it. Never `-D`: if git
- * objects, git is right and we stop. The third condition is ours and is the
- * name: only `session/<id>` exactly, so a branch the agent cut is never in
- * scope no matter what it was merged into.
+ * any worktree — enforced by the tool that owns the truth instead of by our
+ * reading of it. Never `-D`: if git objects, git is right and we stop. Two
+ * conditions are ours on top of it. The NAME: only `session/<id>` exactly, so
+ * a branch the agent cut is never in scope no matter what it was merged into.
+ * And ANCESTRY OF BASE: `-d` with no upstream judges "merged" against HEAD,
+ * so an operator parked on an experimental branch that merged the session
+ * work would get the delete while the narration below claimed "merged into
+ * <base>" for commits base has never seen — the claim is checked against the
+ * thing it names before git is asked at all.
  *
  * ORDERING IS LOAD-BEARING. This must not run while a ship report is still
  * undelivered. Ship's idempotency path recovers from a lost report by asking
@@ -45,6 +49,13 @@ export function sweepMergedBranch(sessionId, { git, repoRoot, baseRef, note, isR
   } catch {
     return false; // already gone, or never existed
   }
+  try {
+    git(['merge-base', '--is-ancestor', `refs/heads/${name}`, baseRef], repoRoot);
+  } catch {
+    // Not on base — merged into something, perhaps, but not into the thing the
+    // narration names, and not ours to retire on HEAD's say-so.
+    return false;
+  }
   try {
     git(['branch', '-d', name], repoRoot);
   } catch {

package/bin/lib/work.mjs

@@ -574,8 +574,11 @@ export function createWorkManager({
       // path), but a server bug or compromise sending `../../etc` would
       // otherwise point a session's measured directory anywhere on the box and
       // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
-      // already reject an unsafe segment; doing it here covers every consumer
-      // (the preview-claim `placeDir` did not re-check). REPO_PLACE resolves to
+      // already reject an unsafe segment; checking at the intake covers the
+      // consumers that do not (the preview-claim `placeDir` did not re-check).
+      // NOT the only writer: `processWorkTurns` stores a turn job's place too,
+      // and keeps the same check — validating one intake and not the other is
+      // one deploy away from validating neither. REPO_PLACE resolves to
       // repoRoot, so it is allowed through despite not being a path segment.
       if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
         sessionPlaces.set(sid, place);
@@ -2480,9 +2483,26 @@ export function createWorkManager({
       // run it again while the report is merely undelivered.
       if (pendingWorkReports.has(job.id)) continue;
       workAnswering.add(job.id);
-      // Serialized by PLACE: two tabs sharing a worktree take turns in it
-      // rather than editing the same files at the same time.
       const place = job.place || job.sessionId;
+      /**
+       * VALIDATED AT THE TRUST BOUNDARY, exactly as `learnPlaces` validates
+       * the roster's map — this is the OTHER writer of `sessionPlaces`, in the
+       * same reconcile tick, BEFORE the preview jobs and the sweep read it. An
+       * unchecked value stored here reaches every `placeDir` consumer: the
+       * turn is spawned in it, `burstListeners` measures it, and a share would
+       * publicly tunnel a directory OUTSIDE the checkout — the exact traversal
+       * the preview feature's port attribution exists to prevent. Settled out
+       * loud rather than skipped, because a silently dropped turn strands the
+       * tab for the server's whole expiry window.
+       */
+      if (place !== REPO_PLACE && !isSafePathSegment(place)) {
+        void settleWorkTurn(job.id, {
+          ok: false,
+          answer:
+            'the server named a working directory this machine refuses to use — close and reopen the tab, then send the message again',
+        }).finally(() => workAnswering.delete(job.id));
+        continue;
+      }
       // Remembered for every other beat — the sweep, ship, the preview
       // re-check — so they all ask the same directory this turn runs in.
       sessionPlaces.set(job.sessionId, place);
@@ -3346,7 +3366,7 @@ export function createWorkManager({
           };
           // The machine may have no git identity, and a merge COMMIT needs
           // one. Prefer the user's own config; fall back to the daemon's (the
-          // same fallback checkpointWip uses) so a bare machine doesn't fail
+          // same fallback ship's merge keeps) so a bare machine doesn't fail
           // the fold with "Please tell me who you are".
           let idEnv = null;
           try {
@@ -3658,7 +3678,28 @@ export function createWorkManager({
       ['diff', '--name-only', `${baseRef()}...HEAD`],
       ['ls-files', '--others', '--exclude-standard'],
     ]) {
-      const r = git(args, wt);
+      /**
+       * `git()` THROWS; it does not return a non-string.
+       *
+       * The guard below was `if (typeof r !== 'string') continue`, which is a
+       * value `execFileSync` can never produce — so every one of these calls
+       * was effectively unguarded. And this runs over the LIVE AGENTS a plan
+       * job carries, which include agents still in `planning`: they have no
+       * worktree yet, so `git diff` in a directory that does not exist exits
+       * non-zero and throws straight out of `runAgentPlan` — after the press
+       * has been claimed and before the try/finally below. The press then sat
+       * `planning` until its expiry, having spent nothing and explained
+       * nothing, on what would be an ordinary second Deploy.
+       *
+       * An agent whose files cannot be read contributes none. That is the
+       * honest answer and it is what the planner should be told.
+       */
+      let r;
+      try {
+        r = git(args, wt);
+      } catch {
+        continue;
+      }
       if (typeof r !== 'string') continue;
       for (const line of r.split('\n')) {
         const f = line.trim();
@@ -3706,7 +3747,15 @@ export function createWorkManager({
       id: String(a?.id ?? ''),
       name: String(a?.name ?? ''),
       status: String(a?.status ?? ''),
-      changedFiles: agentChangedFiles(a?.placeId),
+      // Belt: `agentChangedFiles` is defensive internally, but it resolves a
+      // place first and this whole block sits outside the try below.
+      changedFiles: (() => {
+        try {
+          return agentChangedFiles(a?.placeId);
+        } catch {
+          return [];
+        }
+      })(),
     }));
 
     let out = '';
@@ -3787,8 +3836,13 @@ export function createWorkManager({
   // UNLEASED, unlike a plan or a kill. The server hands out at most one turn
   // per agent per poll and its settle is conditional on the row still being
   // pending, so a second daemon cannot advance the queue twice. What it could
-  // do is run a CLI twice in one worktree, which is what this in-flight set and
-  // the place lock prevent — the same discipline `processWorkTurns` keeps.
+  // do is run a CLI twice in one worktree. The in-flight set below cannot
+  // prevent that alone: it is keyed by TURN id, so it never sees the
+  // DIFFERENT turn the server's TTL-skip hands out while an expired turn's
+  // CLI is still running — and a reader lock would run the two side by side.
+  // So an agent turn takes its place's lock as a WRITER: an agent is ONE
+  // process by definition, and its `a-<id>` place is its own — no tab ever
+  // stands there, so the tabs' turns-run-concurrently law is untouched.
   const agentTurns = new Set(); // turn ids in flight on this tick
   /**
    * The CLI a live agent turn is running in, by PLACE.
@@ -3805,14 +3859,29 @@ export function createWorkManager({
    *  emptied, so run the project's own check in the worktree we are already
    *  standing in. A job lane for that would need a claim, a floor and a settle
    *  to say something this reply already can. */
-  /** Turn ids whose work is DONE but whose report has not landed. The same
-   *  skip-guard `pendingWorkReports` is for a tab, and for the same reason: a
-   *  settle that fails to POST must not re-run the turn — that is a second CLI,
-   *  a second set of commits, and the operator's quota spent again. */
-  const agentReported = new Set();
+  /**
+   * Turns whose work is DONE but whose settle has not landed, keyed to the
+   * finished BODY. The delivery half of what `pendingWorkReports` is for a
+   * tab: a settle that fails to POST must not re-run the turn — that is a
+   * second CLI, a second set of commits, and the operator's quota spent again
+   * — but a guard that only SKIPPED left the other half undone. One failed
+   * POST parked the agent for the server's whole six-hour expiry, holding a
+   * cap slot the entire time, and then expired into "nobody ran it" — a false
+   * sentence about a turn this machine finished. The server's settle is
+   * idempotent (conditional on the row still being pending), so a re-offer of
+   * a held turn re-POSTs the stored body instead: safe, and it lands the
+   * moment the network heals rather than six hours later.
+   *
+   * BOUNDED by the roster itself: a held body's clock is refreshed while the
+   * server keeps offering its turn, and once offering stops — settled by the
+   * re-POST, or expired server-side — the grace below is all that keeps it.
+   */
+  const agentReported = new Map(); // turnId -> { body, at }
+  const AGENT_REPORT_GRACE_MS = 30 * 60_000;
 
   const postAgentTurn = async (body) => {
-    agentReported.add(String(body.turnId));
+    const turnId = String(body.turnId);
+    agentReported.set(turnId, { body, at: Date.now() });
     try {
       const res = await fetch(AGENT_TURN_DONE_URL, {
         method: 'POST',
@@ -3825,14 +3894,19 @@ export function createWorkManager({
         body: JSON.stringify(body),
       });
       const j = await res.json().catch(() => null);
-      // Landed. Forgetting it keeps the guard from growing without bound; a
-      // re-offer of a settled turn is refused server-side anyway.
-      if (res.ok) agentReported.delete(String(body.turnId));
+      // Landed, or REFUSED: a 4xx is the server saying this settle will never
+      // be accepted (expired, already settled, unknown turn), and re-POSTing a
+      // refusal forever is the wedge wearing a retry's clothes. 408/429 stay
+      // retryable, the same split `postSettle` makes for a tab.
+      if (
+        res.ok ||
+        (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
+      )
+        agentReported.delete(turnId);
       return j?.data ?? null;
     } catch {
-      // Unsettled, and the id STAYS in the guard: the server expires the turn
-      // and the agent lands in Stuck saying nobody ran it, which is far better
-      // than running it again for six hours.
+      // Unsettled — a network error, so the body STAYS held and the next
+      // re-offer retries the POST rather than the CLI.
       return null;
     }
   };
@@ -3953,7 +4027,10 @@ export function createWorkManager({
       return;
     }
 
-    await inPlace(place, false, async () => {
+    // A WRITER on the agent's own place — see the lane header. Only `a-<id>`
+    // places: those are agents' by construction, and anything else here would
+    // be a tab's directory, where a turn is a reader by the product's own law.
+    await inPlace(place, place.startsWith('a-'), async () => {
       const dir = placeWtFor(place);
       if (!dir) {
         // No worktree and none could be cut. `nothing` rather than an invented
@@ -4148,13 +4225,46 @@ export function createWorkManager({
   };
 
   const processAgentTurnJobs = (jobs) => {
-    if (!Array.isArray(jobs) || jobs.length === 0) return;
-    for (const job of jobs.slice(0, 4)) {
+    const list = Array.isArray(jobs) ? jobs : [];
+    if (agentReported.size) {
+      // The roster is the held bodies' clock: an offered turn is still pending
+      // server-side and worth retrying; one the roster stopped naming was
+      // settled or expired, and holding its body past a generous grace would
+      // grow this map for the life of the process. The server's own expiry is
+      // the true bound — the grace only covers its POST racing a final offer.
+      const offered = new Set(list.map((j) => String(j?.id || '')));
+      const now = Date.now();
+      for (const [id, held] of agentReported) {
+        if (offered.has(id)) held.at = now;
+        else if (now - held.at > AGENT_REPORT_GRACE_MS) agentReported.delete(id);
+      }
+    }
+    for (const job of list.slice(0, 4)) {
       const id = String(job?.id || '');
       if (!id || agentTurns.has(id)) continue;
-      // Already RAN here; only the report is outstanding. Re-running it would
-      // spend the operator's quota again and write a second set of commits.
-      if (agentReported.has(id)) continue;
+      const held = agentReported.get(id);
+      if (held) {
+        // Already RAN here; only the settle is outstanding. Re-POST the held
+        // body — never the CLI, which would spend the operator's quota again
+        // and write a second set of commits. The reply can still carry the one
+        // instruction a settle can (`review: true`, the queue just emptied),
+        // so the project's check runs from here too, under the same writer
+        // lock the turn itself would have held.
+        agentTurns.add(id);
+        void (async () => {
+          const reply = await postAgentTurn(held.body);
+          const place = String(job.placeId || '');
+          const wt = typeof held.body.worktree === 'string' ? held.body.worktree : null;
+          if (reply?.review === true && isSafePathSegment(place) && wt && existsSync(wt)) {
+            await inPlace(place, place.startsWith('a-'), () =>
+              runCheck(String(job.agentId || ''), wt)
+            );
+          }
+        })()
+          .catch(() => {})
+          .finally(() => agentTurns.delete(id));
+        continue;
+      }
       if (!job.agentId || !job.placeId) continue;
       agentTurns.add(id);
       void runAgentTurn(job).finally(() => agentTurns.delete(id));
@@ -4382,8 +4492,8 @@ export function createWorkManager({
   /**
    * A merge COMMIT needs a git identity and the machine may have none. Prefer
    * the operator's own config; fall back to the daemon's, the same fallback
-   * `checkpointWip` and ship both use, so a bare machine does not fail the fold
-   * with "Please tell me who you are".
+   * ship's merge keeps, so a bare machine does not fail the fold with
+   * "Please tell me who you are".
    */
   const gitMerge = (args, cwd) => {
     let idEnv = null;
@@ -4409,18 +4519,37 @@ export function createWorkManager({
     const agentId = String(job.agentId);
     const place = String(job.placeId || '');
     if (!isSafePathSegment(place)) {
+      // Before the claim, and before `report` exists — this one is not covered
+      // by the belt below because there is nothing yet to be un-reported.
       await postAgentMerge({ agentId, ok: false, detail: 'the agent has no worktree here' });
       return;
     }
     if (!(await claimAgentMerge(agentId))) return;
 
+    /**
+     * NO EXIT PATH MAY LEAVE A CLAIMED MERGE UNREPORTED — the same belt the
+     * ship path carries, and this function did not.
+     *
+     * Every branch below reports, but an UNEXPECTED throw reports nothing:
+     * several `git()` calls in here are bare, and `git()` is `execFileSync`,
+     * which throws on any non-zero exit. The agent then sits in `merging`,
+     * which refuses Stop and refuses an answer, until an expiry fires — with
+     * nothing anywhere saying what went wrong.
+     */
+    let reported = false;
+    const report = async (body) => {
+      reported = true;
+      await postAgentMerge(body);
+    };
+
     // A WRITER on the place, exactly as a ship is. It folds base in and pushes
     // with git in that directory, and no CLI can coordinate with something it
     // does not know exists.
-    await inPlace(place, true, async () => {
+    try {
+      await inPlace(place, true, async () => {
       const wt = join(baseDir, 'sessions', place);
       if (!existsSync(wt)) {
-        await postAgentMerge({ agentId, ok: false, detail: 'the worktree is gone' });
+        await report({ agentId, ok: false, detail: 'the worktree is gone' });
         return;
       }
       try {
@@ -4437,7 +4566,7 @@ export function createWorkManager({
         try {
           gitMerge(['merge', '--no-edit', baseRef()], wt);
         } catch (e) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail: envScrub(String(e?.message || e)).slice(0, 2000),
@@ -4460,7 +4589,7 @@ export function createWorkManager({
       if (!branch) {
         // A detached HEAD names no branch, so there is nothing to merge and
         // nothing to record. An ambiguity in git, not a rule of ours.
-        await postAgentMerge({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
+        await report({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
         return;
       }
       const tip = (git(['rev-parse', 'HEAD'], wt) || '').trim();
@@ -4470,7 +4599,7 @@ export function createWorkManager({
         // Already on base — an idempotent re-offer, or an agent that changed
         // nothing. Reported as a SUCCESS: the branch's work is on base, which
         // is what the caller is asking about.
-        await postAgentMerge({ agentId, ok: true, sha: tip || undefined });
+        await report({ agentId, ok: true, sha: tip || undefined });
         return;
       }
       /**
@@ -4504,7 +4633,7 @@ export function createWorkManager({
             timeout: 20_000,
           });
         } catch (e) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail:
@@ -4516,7 +4645,7 @@ export function createWorkManager({
         }
         const prBase = baseBranchName(baseRef());
         if (branch === prBase) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail: `this agent is on the base branch (${prBase}) — there is nothing to open a pull request from`,
@@ -4531,19 +4660,34 @@ export function createWorkManager({
           // token in its userinfo — so this one line is the only place on the
           // agent merge path that can leak a credential into a stored,
           // team-visible `mergeError`.
-          await postAgentMerge({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
+          await report({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
           return;
         }
         let prUrl = null;
         try {
           const j = JSON.parse(
-            execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state'], {
+            execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state,baseRefName'], {
               cwd: repoRoot,
               stdio: ['ignore', 'pipe', 'pipe'],
               timeout: 30_000,
             }).toString()
           );
-          if (j?.state === 'OPEN' && typeof j?.url === 'string') prUrl = j.url.trim();
+          if (j?.state === 'OPEN' && typeof j?.url === 'string') {
+            // Adoptable only when it points at the project's own base. A PR
+            // somebody opened by hand against another branch would otherwise
+            // be merged INTO that branch, and the ok settle would claim work
+            // reached base that landed somewhere else entirely. Refused only
+            // on a MEASURED mismatch — an absent field adopts as before.
+            if (typeof j?.baseRefName === 'string' && j.baseRefName !== prBase) {
+              await report({
+                agentId,
+                ok: false,
+                detail: `the open pull request for ${branch} targets ${j.baseRefName}, not ${prBase} — retarget or close it, then approve again`,
+              });
+              return;
+            }
+            prUrl = j.url.trim();
+          }
         } catch {
           /* no PR for this branch at all — created below */
         }
@@ -4559,7 +4703,7 @@ export function createWorkManager({
               .trim();
             prUrl = out.split('\n').filter(Boolean).pop() ?? null;
           } catch (e) {
-            await postAgentMerge({ agentId, ok: false, detail: ghFirstLine(e) });
+            await report({ agentId, ok: false, detail: ghFirstLine(e) });
             return;
           }
         }
@@ -4574,7 +4718,7 @@ export function createWorkManager({
           // Already merged is a SUCCESS: a re-offered job, or somebody merged
           // it in the browser. The observer closes the cards either way.
           if (!/already merged/i.test(line)) {
-            await postAgentMerge({
+            await report({
               agentId,
               ok: false,
               detail:
@@ -4583,11 +4727,46 @@ export function createWorkManager({
             return;
           }
         }
-        // THE TIP, not a merge commit: the merge commit was made on GitHub and
-        // this machine has not fetched it. It identifies the state we asked to
-        // be merged, which is what the receipt is for — the cards themselves
-        // close when the landed observer sees the commits arrive on base.
-        await postAgentMerge({ agentId, ok: true, sha: tip });
+        // VERIFY before reporting ok: modern gh exits 0 on an already-MERGED
+        // PR, and on a repo with a merge queue or auto-merge it exits 0 after
+        // ENQUEUEING — in both, "merged" is a claim about the future. The tip
+        // being an ancestor of base is the fact `ok` asserts, and the server
+        // closes every delivered card on this sha the moment it hears it — so
+        // measure it, with one short retry for the fetch racing GitHub's
+        // merge commit. The same guard the session PR path carries.
+        const tipOnBase = () => {
+          try {
+            git(['merge-base', '--is-ancestor', tip, baseRef()], repoRoot);
+            return true;
+          } catch {
+            return false;
+          }
+        };
+        let landedOnBase = false;
+        for (let attempt = 0; attempt < 2 && !landedOnBase; attempt++) {
+          if (attempt > 0) await new Promise((r) => setTimeout(r, 2000));
+          try {
+            git(['fetch', 'origin', '--quiet'], repoRoot);
+          } catch {
+            /* offline — the check below answers from what we have */
+          }
+          landedOnBase = tipOnBase();
+        }
+        if (!landedOnBase) {
+          await report({
+            agentId,
+            ok: false,
+            detail:
+              "GitHub accepted the merge, but this branch's tip is not on the base branch — a merge queue may still be running it, or the PR that merged was an older one. Approve again once it lands." +
+              (prUrl && PR_URL_RE.test(prUrl) ? ` The pull request is at ${prUrl}.` : ''),
+          });
+          return;
+        }
+        // THE TIP, not the merge commit GitHub made: the tip identifies the
+        // state we asked to be merged, which is what the receipt is for — the
+        // cards themselves close when the landed observer sees the commits
+        // arrive on base.
+        await report({ agentId, ok: true, sha: tip });
         onRepoChanged();
         landed.observe();
         return;
@@ -4607,17 +4786,29 @@ export function createWorkManager({
           warn,
         });
       } catch (e) {
-        await postAgentMerge({
+        await report({
           agentId,
           ok: false,
           detail: envScrub(String(e?.message || e)).slice(0, 2000),
         });
         return;
       }
-      await postAgentMerge({ agentId, ok: true, sha: tip });
+      await report({ agentId, ok: true, sha: tip });
       onRepoChanged();
       landed.observe();
-    });
+      });
+    } finally {
+      if (!reported) {
+        // Belt over braces. A merge this daemon claimed and cannot account for
+        // is a FAILURE, said out loud, so the agent goes back to Review with a
+        // reason instead of waiting out an expiry that blames nobody.
+        await postAgentMerge({
+          agentId,
+          ok: false,
+          detail: 'the merge did not complete — check the daemon log',
+        }).catch(() => {});
+      }
+    }
   };
 
   const processAgentMergeJobs = (jobs) => {
@@ -4687,6 +4878,10 @@ export function createWorkManager({
     // into a card nobody can explain.
     agentTurns.size > 0 ||
     agentMerges.size > 0 ||
+    // A finished agent turn whose settle has not landed lives only in this
+    // process; a restart here is the six-hour park the held body exists to
+    // prevent. Same reason the tab's report queues are below.
+    agentReported.size > 0 ||
     shipping.size > 0 ||
     workChildren.size > 0 ||
     workAnswering.size > 0 ||

package/bin/lib/worktreeDiff.mjs

@@ -27,7 +27,7 @@
 
 import { existsSync, statSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { git } from './git.mjs';
+import { git, gitRaw, splitNul } from './git.mjs';
 
 /** Rows reported. The rail shows a handful; the totals below cover the rest. */
 const MAX_FILES = 20;
@@ -70,6 +70,14 @@ export function taskIdsFromMessage(body) {
   return ids;
 }
 
+/**
+ * The %x1e/%x1f record delimiters, removed from any field that survives
+ * parsing. Splitting alone is not enough: git PRESERVES both bytes in a commit
+ * body, so a surviving field can still carry a fragment of a forged record,
+ * and a stripped field can never re-assemble one downstream.
+ */
+export const stripDelims = (s) => String(s ?? '').replace(/[\x1e\x1f]/g, '');
+
 /**
  * The commits this branch has that base does not, with the cards they name.
  *
@@ -81,14 +89,27 @@ export function taskIdsFromMessage(body) {
  * `--no-merges`, because a merge commit describes a range rather than doing
  * work, and its trailer (if it has one) would double-book the range's own
  * commits.
+ *
+ * THE SHA LIST COMES FROM REV-LIST, NEVER FROM THE FORMATTED LOG. The %x1e and
+ * %x1f delimiters are formatting, not a fence: git preserves both bytes inside
+ * a commit BODY (verified empirically), so a crafted message can fabricate
+ * whole records — a self-named sha carrying task ids, exactly the receipt this
+ * product refuses to let an agent write about itself. rev-list prints nothing
+ * an author controls, so its output is the set of commits that exist: a parsed
+ * record whose sha is not in that set is a forgery and is dropped, a repeated
+ * sha is the same forgery wearing a real commit's name, and the delimiter
+ * bytes are stripped from every surviving field.
  */
 function branchCommits(wt, base) {
   if (!base) return [];
   const out = [];
   try {
-    // %x1e between records, %x1f between fields — a subject and a body can
-    // contain anything a person can type, so the delimiters must be bytes they
-    // cannot.
+    const real = new Set(
+      git(['rev-list', '--no-merges', '-n', String(MAX_COMMITS), `${base}..HEAD`], wt)
+        .split('\n')
+        .filter(Boolean)
+    );
+    if (real.size === 0) return [];
     const raw = git(
       [
         'log',
@@ -103,9 +124,10 @@ function branchCommits(wt, base) {
     for (const rec of raw.split('\x1e')) {
       const line = rec.replace(/^\n+/, '');
       if (!line.trim()) continue;
-      const [sha, subject, author, at, body] = line.split('\x1f');
-      if (!sha) continue;
-      const taskIds = taskIdsFromMessage(body);
+      const [sha, subject, author, at, ...bodyParts] = line.split('\x1f');
+      if (!real.has(sha)) continue;
+      real.delete(sha);
+      const taskIds = taskIdsFromMessage(stripDelims(bodyParts.join('\n')));
       if (taskIds.length === 0) continue;
       let additions = 0;
       let deletions = 0;
@@ -125,9 +147,9 @@ function branchCommits(wt, base) {
         // Clamped to the server's zod caps, same rule as everything else in
         // this file: one over-cap string 400s the whole batch.
         sha: sha.slice(0, 64),
-        subject: (subject ?? '').slice(0, 200),
-        author: (author ?? '').slice(0, 80),
-        at: (at ?? '').slice(0, 40),
+        subject: stripDelims(subject).slice(0, 200),
+        author: stripDelims(author).slice(0, 80),
+        at: stripDelims(at).slice(0, 40),
         additions,
         deletions,
         taskIds: taskIds.slice(0, 8),
@@ -202,13 +224,25 @@ export function worktreeDiff(wt, baseRef) {
   };
 
   // Tracked: working tree vs base. `git diff <base>` (no --cached, no second
-  // ref) is exactly "everything this session did", committed or not.
+  // ref) is exactly "everything this session did", committed or not. `-z`, for
+  // the reason gitRaw exists: git's LINE-based output C-quotes any path that
+  // is not plain ASCII, so an accented filename arrives as "n\303\251w.txt" —
+  // a string that is not the path and reads as escaped garbage in the rail.
   try {
-    const raw = git(['diff', '--numstat', base || 'HEAD'], wt);
-    for (const line of raw.split('\n')) {
-      if (!line.trim()) continue;
-      const [a, d, ...rest] = line.split('\t');
-      const path = rest.join('\t');
+    // `--numstat -z` frames a normal change as one field, "added\tdeleted\tpath",
+    // but a RENAME as three: "added\tdeleted\t" (empty path), then the old path,
+    // then the new one. An empty path is therefore the rename marker and the
+    // next two fields belong to it — read line-wise, a rename would report a
+    // file literally named "old => new".
+    const fields = splitNul(gitRaw(['diff', '--numstat', '-z', base || 'HEAD', '--'], wt));
+    for (let i = 0; i < fields.length; i++) {
+      const [a, d, ...rest] = fields[i].split('\t');
+      let path = rest.join('\t');
+      if (!path) {
+        path = fields[i + 2] ?? fields[i + 1]; // the post-rename name is what exists now
+        i += 2;
+        if (!path) continue;
+      }
       const binary = a === '-' || d === '-';
       push(path, binary ? 0 : Number(a) || 0, binary ? 0 : Number(d) || 0, binary);
     }
@@ -217,11 +251,12 @@ export function worktreeDiff(wt, baseRef) {
   }
 
   // Untracked, minus everything gitignored — new files are the most visible
-  // work a session does and they would otherwise show as nothing at all.
+  // work a session does and they would otherwise show as nothing at all. `-z`
+  // here is not cosmetic: a C-quoted untracked name fails the statSync below,
+  // and the catch swallowed the row — a session's brand-new `café.txt` simply
+  // vanished from the rail.
   try {
-    const others = git(['ls-files', '--others', '--exclude-standard'], wt)
-      .split('\n')
-      .filter(Boolean);
+    const others = splitNul(gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], wt));
     for (const path of others.slice(0, MAX_UNTRACKED_SCAN)) {
       try {
         const full = join(wt, path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.78.0",
+  "version": "0.78.1",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {