flowviant 0.8.1 → 0.9.1

package/bin/cli.mjs

@@ -44,6 +44,33 @@ if (process.argv[2] === 'login') {
   process.exit(0);
 }
 
+// `flowviant clean` — reclaim the persistent worktrees (~/.flowviant/worktrees).
+// They're kept across runs so in-flight work survives Ctrl+C; this is the drain.
+// Repos self-heal: the daemon runs `git worktree prune` if a stale registration
+// blocks re-adding a path.
+if (process.argv[2] === 'clean') {
+  const { rmSync, existsSync } = await import('node:fs');
+  const { join } = await import('node:path');
+  const { homedir } = await import('node:os');
+  const { execFileSync } = await import('node:child_process');
+  const dir = join(homedir(), '.flowviant', 'worktrees');
+  if (!existsSync(dir)) {
+    console.log('nothing to clean — no worktrees at ~/.flowviant/worktrees.');
+    process.exit(0);
+  }
+  let size = '';
+  try {
+    const kb = Number(execFileSync('du', ['-sk', dir], { encoding: 'utf8' }).split('\t')[0]);
+    size = ` (${(kb / 1024).toFixed(0)} MB reclaimed)`;
+  } catch {
+    /* du unavailable — skip the size */
+  }
+  console.log('note: stop any running flowviant daemon first — in-flight local work is discarded.');
+  rmSync(dir, { recursive: true, force: true });
+  console.log(`cleaned ~/.flowviant/worktrees${size}.`);
+  process.exit(0);
+}
+
 if (!FLEET_TOKEN && tokens.length === 0) {
   console.error(
     'error: no credential found. Easiest:\n' +

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-export const VERSION = '0.8.1';
+export const VERSION = '0.9.1';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.

package/bin/lib/fleet.mjs

@@ -5,10 +5,11 @@
  * MCP token, and only spawns Claude when the server says an agent has work.
  */
 
-import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { mkdirSync, existsSync, rmSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join, basename } from 'node:path';
 import {
   VERSION,
   FLEET_URL,
@@ -22,6 +23,16 @@ import {
   REFRESH_BEFORE_SECONDS,
   LIVE,
 } from './config.mjs';
+import {
+  git,
+  resetWorktree,
+  repoRootOrDie,
+  detectBaseRef,
+  originSlug,
+  isValidPrUrl,
+  isValidBranch,
+  isSafePathSegment,
+} from './git.mjs';
 import { c, LABEL_COLORS, info, note, ok, warn, fail } from './ui.mjs';
 import {
   sleep,
@@ -33,7 +44,6 @@ import {
   SINGLE_KICKOFF,
   SINGLE_RESUME,
 } from './claude.mjs';
-import { git, repoRootOrDie, detectBaseRef, resetWorktree } from './git.mjs';
 import { runLiveWorker } from './live.mjs';
 import { preflight } from './preflight.mjs';
 
@@ -44,6 +54,7 @@ async function fetchRoster(haveIds) {
   // Cloudflare Bot Fight Mode (403). A descriptive product UA passes.
   const res = await fetch(url, {
     headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+    signal: AbortSignal.timeout(30_000), // a black-holed poll must not stall the loop
   });
   if (res.status === 401 || res.status === 403) {
     // Fleet credential revoked/expired — retrying can't recover; signal exit.
@@ -53,7 +64,20 @@ async function fetchRoster(haveIds) {
   }
   if (!res.ok) throw new Error(`fleet poll failed (${res.status})`);
   const body = await res.json();
-  return body.data; // { mcpUrl, leaseTtlSeconds, agents: [{agentId,name,token,reviewGate,hasWork}] }
+  // Validate the shape here so a malformed 200 (deploy hiccup, error envelope)
+  // throws a NORMAL retryable error inside the loop's try/catch, instead of a
+  // `roster.agents.map` TypeError escaping to top-level and killing the daemon.
+  const data = body?.data;
+  if (!data || !Array.isArray(data.agents)) {
+    throw new Error('fleet poll returned an unexpected shape');
+  }
+  // Drop roster agents with an unsafe id BEFORE they're used as a path segment.
+  data.agents = data.agents.filter((a) => {
+    if (isSafePathSegment(a?.agentId)) return true;
+    warn(`ignoring roster agent with an invalid id: ${JSON.stringify(a?.agentId)}`);
+    return false;
+  });
+  return data; // { mcpUrl, leaseTtlSeconds, agents: [{agentId,name,token,reviewGate,hasWork}] }
 }
 
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
@@ -151,7 +175,21 @@ export async function runFleetDaemon() {
   console.log('');
   preflight({ needGit: true });
 
-  const baseDir = mkdtempSync(join(tmpdir(), 'flowviant-fleet-'));
+  // Persistent worktree home (0.9.0) — survives daemon restarts AND reboots,
+  // so Ctrl+C mid-task never loses local work. Keyed per repo path; each
+  // agent's worktree carries a task marker so a resumed claim keeps its files.
+  const repoKey = `${basename(repoRoot)}-${createHash('sha256').update(repoRoot).digest('hex').slice(0, 8)}`;
+  const baseDir = join(homedir(), '.flowviant', 'worktrees', repoKey);
+  mkdirSync(baseDir, { recursive: true });
+  try {
+    const kb = Number(execFileSync('du', ['-sk', baseDir], { encoding: 'utf8' }).split('\t')[0]);
+    if (kb > 1024)
+      info(
+        `disk   · worktrees ${(kb / 1024 / 1024).toFixed(1)} GB at ~/.flowviant/worktrees — \`flowviant clean\` reclaims`
+      );
+  } catch {
+    /* du unavailable (Windows) — skip the disk line */
+  }
   const tokenByAgent = new Map(); // agentId -> latest worker token
   const mintedAt = new Map(); // agentId -> ms when we last got a fresh token
   const hasWorkByAgent = new Map(); // agentId -> server says it has claimable work
@@ -159,6 +197,10 @@ export async function runFleetDaemon() {
   let mcpUrl = MCP_URL;
   const workers = new Map(); // agentId -> { state, promise, wt, label }
 
+  // Shutdown KEEPS the worktrees: in-flight local work survives Ctrl+C and
+  // resumes in place on the next run (the task marker matches). Worktrees are
+  // only removed when an agent is deleted from the roster, or by
+  // `flowviant clean`.
   const teardown = () => {
     for (const [, w] of workers) {
       w.state.alive = false;
@@ -167,21 +209,19 @@ export async function runFleetDaemon() {
       } catch {
         /* best-effort */
       }
+      // Stop the detached preview (dev server + cloudflared tunnel) — it's its
+      // own process group and survives our exit, otherwise leaking a port-bound
+      // server + a live tunnel serving a stale branch until reboot.
       try {
-        git(['worktree', 'remove', '--force', w.wt], repoRoot);
+        w.state.stopPreview?.();
       } catch {
         /* best-effort */
       }
     }
-    try {
-      rmSync(baseDir, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
   };
   process.on('SIGINT', () => {
     console.log('');
-    note('shutting down — stopping workers and freeing worktrees…');
+    note('shutting down — stopping workers. Worktrees are kept: in-flight work resumes next run.');
     teardown();
     process.exit(130);
   });
@@ -201,6 +241,7 @@ export async function runFleetDaemon() {
           'User-Agent': USER_AGENT,
           'Content-Type': 'application/json',
         },
+        signal: AbortSignal.timeout(30_000),
         body: JSON.stringify(body),
       });
     } catch {
@@ -216,6 +257,18 @@ export async function runFleetDaemon() {
           note(`${c.cyan('merge')} ${c.dim(`— ${job.title}`)}`);
           let merged = false;
           let failedReason = null; // permanent — tell the thread, clear the flag
+          // Refuse a PR URL that isn't an https github.com PR in THIS repo — a
+          // bad/hostile server must not merge a PR in another repo the user's
+          // gh can write to (and a leading '-' would be a gh flag).
+          if (!isValidPrUrl(job.prUrl, originSlug(repoRoot))) {
+            mergeAttempts.delete(job.id);
+            await reportMergeOutcome(MERGE_FAILED_URL, {
+              intentId: job.id,
+              message: 'refused: PR URL is not a pull request in this repository',
+            });
+            warn(`merge REFUSED for "${job.title}": untrusted PR URL ${String(job.prUrl)}`);
+            return;
+          }
           try {
             execFileSync('gh', ['pr', 'merge', job.prUrl, '--squash', '--delete-branch'], {
               cwd: repoRoot,
@@ -225,8 +278,13 @@ export async function runFleetDaemon() {
           } catch (e) {
             const err = e.stderr?.toString?.() || e.message || '';
             const line = err.split('\n')[0] || 'gh pr merge failed';
-            if (/already merged|not open|closed/i.test(err)) merged = true;
-            else if (/conflict|not mergeable|CONFLICTING/i.test(err)) {
+            // Only "already merged" is a real success; a CLOSED-without-merge PR
+            // also matches "not open"/"closed" but nothing landed on main —
+            // report it as a failure so the thread learns the truth.
+            if (/already merged/i.test(err)) merged = true;
+            else if (/not open|closed/i.test(err)) {
+              failedReason = 'the PR was closed without merging';
+            } else if (/conflict|not mergeable|CONFLICTING/i.test(err)) {
               // Permanent until a human/agent acts — don't spin on it.
               failedReason = `merge conflict with ${baseRef} — the branch needs a rebase`;
             } else {
@@ -270,7 +328,10 @@ export async function runFleetDaemon() {
       (async () => {
         try {
           note(`${c.cyan('cleanup')} ${c.dim(`— ${job.title} (restarted)`)}`);
-          if (job.prUrl) {
+          // Same guards as merge: only close a PR in THIS repo, only delete a
+          // well-formed non-base branch. A bad server must not close a stranger's
+          // PR or delete `main` (`--delete` with `main`) via a cleanup job.
+          if (job.prUrl && isValidPrUrl(job.prUrl, originSlug(repoRoot))) {
             try {
               execFileSync(
                 'gh',
@@ -290,15 +351,18 @@ export async function runFleetDaemon() {
               const err = e.stderr?.toString?.() || e.message || '';
               warn(`cleanup for "${job.title}": ${err.split('\n')[0] || 'gh pr close failed'}`);
             }
-          } else if (job.branch) {
+          } else if (job.branch && isValidBranch(job.branch, repoRoot, baseRef)) {
             try {
-              execFileSync('git', ['push', 'origin', '--delete', job.branch], {
+              // Explicit refspec form so a leading '-' can't be a git flag.
+              execFileSync('git', ['push', 'origin', `:refs/heads/${job.branch}`], {
                 cwd: repoRoot,
                 stdio: ['ignore', 'pipe', 'pipe'],
               });
             } catch {
               /* branch already gone — fine */
             }
+          } else if (job.prUrl || job.branch) {
+            warn(`cleanup REFUSED for "${job.title}": untrusted PR/branch value`);
           }
           await reportMergeOutcome(CLEANUP_DONE_URL, { intentId: job.id });
           ok(`${c.cyan('cleaned')} ${c.dim(`— ${job.title}`)}`);
@@ -377,7 +441,16 @@ export async function runFleetDaemon() {
       if (!workers.has(a.agentId)) {
         const wt = join(baseDir, `agent-${a.agentId}`);
         try {
-          if (!existsSync(wt)) git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+          if (!existsSync(wt)) {
+            try {
+              git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+            } catch {
+              // A stale registration (e.g. after `flowviant clean` rm'd the
+              // dir) blocks re-adding the same path — prune and retry once.
+              git(['worktree', 'prune'], repoRoot);
+              git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+            }
+          }
         } catch (e) {
           fail(`could not create worktree for "${a.name}": ${e.message}`);
           continue;
@@ -399,6 +472,11 @@ export async function runFleetDaemon() {
           onChild: (ch) => {
             state.child = ch;
           },
+          // Hold the preview's stop fn so teardown/removal can kill the detached
+          // dev-server + tunnel (they survive our exit otherwise).
+          onPreview: (stop) => {
+            state.stopPreview = stop;
+          },
           // A turn that couldn't reach the MCP server: forget the cached token so
           // the next reconcile poll re-mints a fresh one (self-heals a token that
           // was rotated/expired out from under a running session).
@@ -423,6 +501,11 @@ export async function runFleetDaemon() {
         } catch {
           /* best-effort */
         }
+        try {
+          w.state.stopPreview?.();
+        } catch {
+          /* best-effort */
+        }
         try {
           git(['worktree', 'remove', '--force', w.wt], repoRoot);
         } catch {
@@ -431,6 +514,7 @@ export async function runFleetDaemon() {
         workers.delete(id);
         tokenByAgent.delete(id);
         hasWorkByAgent.delete(id);
+        mintedAt.delete(id); // was leaked on removal (finding 14)
       }
     }
 

package/bin/lib/git.mjs

@@ -15,6 +15,50 @@ export function repoRootOrDie() {
   }
 }
 
+// ── Server-value validation ────────────────────────────────────────────────
+// prUrl / branch / agentId arrive from the fleet server. execFileSync blocks
+// SHELL injection but NOT git/gh option injection (a leading '-' becomes a
+// flag) or cross-repo/cross-path abuse. These guards make a malicious or buggy
+// server unable to touch a repo/branch/path outside the expected scope.
+
+/** The `owner/repo` the daemon is running inside, from origin's URL. Null if
+ *  origin isn't a github remote. */
+export function originSlug(repoRoot) {
+  try {
+    const url = git(['remote', 'get-url', 'origin'], repoRoot);
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/i);
+    return m ? `${m[1]}/${m[2]}` : null;
+  } catch {
+    return null;
+  }
+}
+
+/** A PR URL is accepted only if it's an https github.com PR in THIS repo. */
+export function isValidPrUrl(prUrl, slug) {
+  if (typeof prUrl !== 'string' || !slug) return false;
+  const m = prUrl.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/\d+$/);
+  return !!m && m[1].toLowerCase() === slug.toLowerCase();
+}
+
+/** A branch name is accepted only if git considers it a well-formed ref, it's
+ *  not the base branch, and it doesn't start with '-' (option injection). */
+export function isValidBranch(branch, repoRoot, baseRef) {
+  if (typeof branch !== 'string' || !branch || branch.startsWith('-')) return false;
+  if (baseRef && (branch === baseRef || `origin/${branch}` === baseRef)) return false;
+  try {
+    git(['check-ref-format', '--branch', branch], repoRoot);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** A roster agent id used as a filesystem path segment — strict allowlist so
+ *  it can't traverse (`..`, `/`) out of the worktrees dir. */
+export function isSafePathSegment(id) {
+  return typeof id === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(id);
+}
+
 export function detectBaseRef(repoRoot) {
   try {
     return git(['rev-parse', '--abbrev-ref', 'origin/HEAD'], repoRoot); // e.g. origin/main

package/bin/lib/live.mjs

@@ -16,6 +16,8 @@
  * live fleet + repo to shake out. Old (poll/sentinel) mode is untouched.
  */
 
+import { readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import {
   MCP_URL,
@@ -29,7 +31,7 @@ import {
 } from './config.mjs';
 import { c, info, ok, warn } from './ui.mjs';
 import { sleep } from './claude.mjs';
-import { git, resetWorktree } from './git.mjs';
+import { git, resetWorktree, isValidBranch } from './git.mjs';
 import { loadPreviewConfig, startPreview } from './preview.mjs';
 
 // Register a branch preview's tunnel URL with Flowviant (fleet-authed). The
@@ -44,6 +46,7 @@ async function registerLiveTarget(intentId, kind, url) {
         'User-Agent': USER_AGENT,
         'Content-Type': 'application/json',
       },
+      signal: AbortSignal.timeout(30_000),
       body: JSON.stringify({ intentId, kind, url }),
     });
   } catch {
@@ -88,12 +91,14 @@ your branch is started for you automatically — you do NOT need to open a tunne
 or register a live target. NEVER merge — a human confirms done in the thread
 (the merge card) and the merge runs separately.`;
 
-function seedPrompt(runId, brief, transcript) {
+function seedPrompt(runId, brief, transcript, resumedInPlace) {
   return [
     `Your run id is ${runId}. Use it for every flowviant MCP tool call.`,
-    brief?.branch
-      ? `This is a REVISION — your prior branch "${brief.branch}" is checked out; address the review feedback and push to the SAME branch (the PR updates in place).`
-      : `Start from the clean base checkout and open a fresh draft PR when done.`,
+    resumedInPlace
+      ? `You are RESUMING after a daemon restart: your worktree still contains your own uncommitted work from before the interruption. Run \`git status\` and \`git diff\` first, take stock, and CONTINUE from there — do not start over.`
+      : brief?.branch
+        ? `This is a REVISION — your prior branch "${brief.branch}" is checked out; address the review feedback and push to the SAME branch (the PR updates in place).`
+        : `Start from the clean base checkout and open a fresh draft PR when done.`,
     ``,
     `Task brief:`,
     JSON.stringify(brief ?? {}, null, 2),
@@ -120,6 +125,7 @@ async function mcpCall(mcpUrl, token, name, args) {
       // without this every live MCP call fails against api.flowviant.com.
       'User-Agent': USER_AGENT,
     },
+    signal: AbortSignal.timeout(30_000),
     body: JSON.stringify({
       jsonrpc: '2.0',
       id: ++rpcId,
@@ -180,6 +186,36 @@ function makeInput(seedText) {
   };
 }
 
+// Task marker — WHICH intent this worktree was building, stored in the
+// worktree's own git dir (never the working tree, so the agent can't commit
+// it and `git clean` can't delete it). It's what lets a claim after a daemon
+// restart recognize its own half-built worktree and resume IN PLACE instead
+// of resetting away hours of uncommitted work.
+function markerPath(cwd) {
+  return join(git(['rev-parse', '--absolute-git-dir'], cwd), 'flowviant-task');
+}
+function readTaskMarker(cwd) {
+  try {
+    return readFileSync(markerPath(cwd), 'utf8').trim() || null;
+  } catch {
+    return null;
+  }
+}
+function writeTaskMarker(cwd, intentId) {
+  try {
+    writeFileSync(markerPath(cwd), `${intentId}\n`);
+  } catch {
+    /* best-effort — worst case the next restart resets to base */
+  }
+}
+function clearTaskMarker(cwd) {
+  try {
+    rmSync(markerPath(cwd), { force: true });
+  } catch {
+    /* best-effort */
+  }
+}
+
 // A stop word from any teammate halts the agent (interrupt at the next boundary,
 // then hold for direction) — the "stop, you're going the wrong way" valve.
 const STOP_RE = /(^|\W)stop(\W|$)/i;
@@ -225,25 +261,48 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
   const { runId, intentId } = claim;
   const brief = claim.brief ?? {};
   const title = brief.title ?? 'a task';
-  // Re-claiming the SAME intent this worker was just working (parked on a blocker,
-  // now resuming) — its worktree holds hours of uncommitted work. Do NOT reset.
+  // Re-claiming the SAME intent this worker was just working — either this
+  // daemon's own memory (parked on a blocker, now resuming) or the persistent
+  // task marker (the daemon restarted mid-task). Its worktree holds hours of
+  // uncommitted work. Do NOT reset.
   const resuming = !!resumeIntentId && intentId === resumeIntentId;
+  const resumedInPlace = !resuming && readTaskMarker(cwd) === intentId;
 
   // Revision resumes its PR branch; a genuinely fresh task gets a clean base
-  // checkout; a resume keeps its dirty worktree untouched.
-  if (brief.branch) {
+  // checkout; a resume (in-memory or marker) keeps its dirty worktree untouched.
+  // The branch is server-supplied — validate it's a well-formed non-base ref
+  // (not a leading-'-' git option) before checkout; on a bad value fall back to
+  // a clean base rather than executing it.
+  if (brief.branch && isValidBranch(brief.branch, cwd, baseRef)) {
     try {
       git(['fetch', 'origin', '--quiet'], cwd);
       git(['checkout', brief.branch], cwd);
     } catch {
-      if (!resuming) resetWorktree(cwd, baseRef);
+      if (!resuming && !resumedInPlace) resetWorktree(cwd, baseRef);
     }
-  } else if (!resuming) {
+  } else if (!resuming && !resumedInPlace) {
     resetWorktree(cwd, baseRef);
   }
+  writeTaskMarker(cwd, intentId);
+
+  if (resumedInPlace) {
+    // Thread honesty: the team must see this is a genuine continuation with
+    // files intact — deterministic, not left to the model's self-narration.
+    await mcpCall(mcpUrl, token, 'stream_turn', {
+      runId,
+      turnId: `resume:${runId}`,
+      text: '⟲ Resumed after a daemon restart — local work survived; continuing in place.',
+    }).catch(() => {});
+  }
 
   const env = { ...process.env };
-  delete env.ANTHROPIC_API_KEY; // force the user's Claude Code subscription
+  // Force the user's Claude Code subscription — strip EVERY var that could
+  // divert to API billing or a proxy (poll mode strips these too; live mode
+  // was only clearing API_KEY, so an exported AUTH_TOKEN/BASE_URL silently
+  // billed the API on the default path).
+  delete env.ANTHROPIC_API_KEY;
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  delete env.ANTHROPIC_BASE_URL;
 
   // Prior channel transcript — present when resuming a parked/re-claimed task;
   // seed it so a fresh session picks up where the conversation left off. afterId
@@ -255,7 +314,7 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
     .join('\n');
   let afterId = priorMsgs.length ? priorMsgs[priorMsgs.length - 1].id : null;
 
-  const input = makeInput(seedPrompt(runId, brief, transcript));
+  const input = makeInput(seedPrompt(runId, brief, transcript, resumedInPlace));
   const session = query({
     prompt: input.stream(),
     options: {
@@ -360,7 +419,14 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
         await flush();
         turnId = null;
 
-        if (completed) return { outcome: 'done', title, intentId };
+        // Task finished — clear the marker so this worktree is NOT treated as a
+        // resume of this intent later (esp. if the task is restarted from
+        // scratch, which discards it: a stale marker would resume the discarded
+        // attempt's dirty files).
+        if (completed) {
+          clearTaskMarker(cwd);
+          return { outcome: 'done', title, intentId };
+        }
 
         if (sawBlocker) {
           const res = await waitForResolution(mcpUrl, token, blockerId, isAlive);
@@ -384,6 +450,11 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
         // Torn down out from under us (restart / reassign in Flowviant): the
         // server killed this run — abandon the session, don't keep building.
         if (poll && poll.ok === false && poll.reason === 'run_not_active') {
+          // Discarded (restart/reassign): clear the marker AND reset the
+          // worktree so the next fresh claim starts from clean base, never
+          // resuming the abandoned attempt.
+          clearTaskMarker(cwd);
+          resetWorktree(cwd, baseRef);
           return { outcome: 'torn_down', title, intentId };
         }
         const fresh = (poll?.messages ?? []).filter((x) => x.role === 'user');
@@ -452,6 +523,7 @@ export async function runLiveWorker({
   isAlive,
   onTokenSuspect,
   onChild,
+  onPreview,
 }) {
   // The intent this worker is holding across iterations. When a task parks on a
   // blocker its worktree keeps uncommitted work; on the resume claim we must NOT
@@ -478,6 +550,10 @@ export async function runLiveWorker({
       }
       preview = null;
     }
+    // Detached preview children (dev server + tunnel) survive process exit, so
+    // the daemon's SIGINT teardown needs a handle to stop them — clear it here
+    // once they're down.
+    onPreview?.(null);
   };
   const startReviewPreview = async (intentId) => {
     stopPreview();
@@ -503,6 +579,7 @@ export async function runLiveWorker({
       log: (m) => info(`${label} ${c.dim(m)}`),
     });
     if (preview) {
+      onPreview?.(stopPreview); // hand the daemon a stop handle for shutdown
       await registerLiveTarget(intentId, kind, preview.url);
       ok(`${label} ${c.dim('live preview ready — open the node to drive it in your review')}`);
     }

package/bin/lib/login.mjs

@@ -37,6 +37,7 @@ async function post(url, body) {
   const res = await fetch(url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', 'User-Agent': USER_AGENT },
+    signal: AbortSignal.timeout(30_000),
     body: JSON.stringify(body),
   });
   if (!res.ok) throw new Error(`HTTP ${res.status}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {