flowviant 0.9.0 → 0.9.1

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-export const VERSION = '0.9.0';
+export const VERSION = '0.9.1';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.

package/bin/lib/fleet.mjs

@@ -5,7 +5,7 @@
  * MCP token, and only spawns Claude when the server says an agent has work.
  */
 
-import { mkdirSync, existsSync } from 'node:fs';
+import { mkdirSync, existsSync, rmSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
@@ -23,6 +23,16 @@ import {
   REFRESH_BEFORE_SECONDS,
   LIVE,
 } from './config.mjs';
+import {
+  git,
+  resetWorktree,
+  repoRootOrDie,
+  detectBaseRef,
+  originSlug,
+  isValidPrUrl,
+  isValidBranch,
+  isSafePathSegment,
+} from './git.mjs';
 import { c, LABEL_COLORS, info, note, ok, warn, fail } from './ui.mjs';
 import {
   sleep,
@@ -34,7 +44,6 @@ import {
   SINGLE_KICKOFF,
   SINGLE_RESUME,
 } from './claude.mjs';
-import { git, repoRootOrDie, detectBaseRef, resetWorktree } from './git.mjs';
 import { runLiveWorker } from './live.mjs';
 import { preflight } from './preflight.mjs';
 
@@ -45,6 +54,7 @@ async function fetchRoster(haveIds) {
   // Cloudflare Bot Fight Mode (403). A descriptive product UA passes.
   const res = await fetch(url, {
     headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+    signal: AbortSignal.timeout(30_000), // a black-holed poll must not stall the loop
   });
   if (res.status === 401 || res.status === 403) {
     // Fleet credential revoked/expired — retrying can't recover; signal exit.
@@ -54,7 +64,20 @@ async function fetchRoster(haveIds) {
   }
   if (!res.ok) throw new Error(`fleet poll failed (${res.status})`);
   const body = await res.json();
-  return body.data; // { mcpUrl, leaseTtlSeconds, agents: [{agentId,name,token,reviewGate,hasWork}] }
+  // Validate the shape here so a malformed 200 (deploy hiccup, error envelope)
+  // throws a NORMAL retryable error inside the loop's try/catch, instead of a
+  // `roster.agents.map` TypeError escaping to top-level and killing the daemon.
+  const data = body?.data;
+  if (!data || !Array.isArray(data.agents)) {
+    throw new Error('fleet poll returned an unexpected shape');
+  }
+  // Drop roster agents with an unsafe id BEFORE they're used as a path segment.
+  data.agents = data.agents.filter((a) => {
+    if (isSafePathSegment(a?.agentId)) return true;
+    warn(`ignoring roster agent with an invalid id: ${JSON.stringify(a?.agentId)}`);
+    return false;
+  });
+  return data; // { mcpUrl, leaseTtlSeconds, agents: [{agentId,name,token,reviewGate,hasWork}] }
 }
 
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
@@ -186,6 +209,14 @@ export async function runFleetDaemon() {
       } catch {
         /* best-effort */
       }
+      // Stop the detached preview (dev server + cloudflared tunnel) — it's its
+      // own process group and survives our exit, otherwise leaking a port-bound
+      // server + a live tunnel serving a stale branch until reboot.
+      try {
+        w.state.stopPreview?.();
+      } catch {
+        /* best-effort */
+      }
     }
   };
   process.on('SIGINT', () => {
@@ -210,6 +241,7 @@ export async function runFleetDaemon() {
           'User-Agent': USER_AGENT,
           'Content-Type': 'application/json',
         },
+        signal: AbortSignal.timeout(30_000),
         body: JSON.stringify(body),
       });
     } catch {
@@ -225,6 +257,18 @@ export async function runFleetDaemon() {
           note(`${c.cyan('merge')} ${c.dim(`— ${job.title}`)}`);
           let merged = false;
           let failedReason = null; // permanent — tell the thread, clear the flag
+          // Refuse a PR URL that isn't an https github.com PR in THIS repo — a
+          // bad/hostile server must not merge a PR in another repo the user's
+          // gh can write to (and a leading '-' would be a gh flag).
+          if (!isValidPrUrl(job.prUrl, originSlug(repoRoot))) {
+            mergeAttempts.delete(job.id);
+            await reportMergeOutcome(MERGE_FAILED_URL, {
+              intentId: job.id,
+              message: 'refused: PR URL is not a pull request in this repository',
+            });
+            warn(`merge REFUSED for "${job.title}": untrusted PR URL ${String(job.prUrl)}`);
+            return;
+          }
           try {
             execFileSync('gh', ['pr', 'merge', job.prUrl, '--squash', '--delete-branch'], {
               cwd: repoRoot,
@@ -234,8 +278,13 @@ export async function runFleetDaemon() {
           } catch (e) {
             const err = e.stderr?.toString?.() || e.message || '';
             const line = err.split('\n')[0] || 'gh pr merge failed';
-            if (/already merged|not open|closed/i.test(err)) merged = true;
-            else if (/conflict|not mergeable|CONFLICTING/i.test(err)) {
+            // Only "already merged" is a real success; a CLOSED-without-merge PR
+            // also matches "not open"/"closed" but nothing landed on main —
+            // report it as a failure so the thread learns the truth.
+            if (/already merged/i.test(err)) merged = true;
+            else if (/not open|closed/i.test(err)) {
+              failedReason = 'the PR was closed without merging';
+            } else if (/conflict|not mergeable|CONFLICTING/i.test(err)) {
               // Permanent until a human/agent acts — don't spin on it.
               failedReason = `merge conflict with ${baseRef} — the branch needs a rebase`;
             } else {
@@ -279,7 +328,10 @@ export async function runFleetDaemon() {
       (async () => {
         try {
           note(`${c.cyan('cleanup')} ${c.dim(`— ${job.title} (restarted)`)}`);
-          if (job.prUrl) {
+          // Same guards as merge: only close a PR in THIS repo, only delete a
+          // well-formed non-base branch. A bad server must not close a stranger's
+          // PR or delete `main` (`--delete` with `main`) via a cleanup job.
+          if (job.prUrl && isValidPrUrl(job.prUrl, originSlug(repoRoot))) {
             try {
               execFileSync(
                 'gh',
@@ -299,15 +351,18 @@ export async function runFleetDaemon() {
               const err = e.stderr?.toString?.() || e.message || '';
               warn(`cleanup for "${job.title}": ${err.split('\n')[0] || 'gh pr close failed'}`);
             }
-          } else if (job.branch) {
+          } else if (job.branch && isValidBranch(job.branch, repoRoot, baseRef)) {
             try {
-              execFileSync('git', ['push', 'origin', '--delete', job.branch], {
+              // Explicit refspec form so a leading '-' can't be a git flag.
+              execFileSync('git', ['push', 'origin', `:refs/heads/${job.branch}`], {
                 cwd: repoRoot,
                 stdio: ['ignore', 'pipe', 'pipe'],
               });
             } catch {
               /* branch already gone — fine */
             }
+          } else if (job.prUrl || job.branch) {
+            warn(`cleanup REFUSED for "${job.title}": untrusted PR/branch value`);
           }
           await reportMergeOutcome(CLEANUP_DONE_URL, { intentId: job.id });
           ok(`${c.cyan('cleaned')} ${c.dim(`— ${job.title}`)}`);
@@ -417,6 +472,11 @@ export async function runFleetDaemon() {
           onChild: (ch) => {
             state.child = ch;
           },
+          // Hold the preview's stop fn so teardown/removal can kill the detached
+          // dev-server + tunnel (they survive our exit otherwise).
+          onPreview: (stop) => {
+            state.stopPreview = stop;
+          },
           // A turn that couldn't reach the MCP server: forget the cached token so
           // the next reconcile poll re-mints a fresh one (self-heals a token that
           // was rotated/expired out from under a running session).
@@ -441,6 +501,11 @@ export async function runFleetDaemon() {
         } catch {
           /* best-effort */
         }
+        try {
+          w.state.stopPreview?.();
+        } catch {
+          /* best-effort */
+        }
         try {
           git(['worktree', 'remove', '--force', w.wt], repoRoot);
         } catch {
@@ -449,6 +514,7 @@ export async function runFleetDaemon() {
         workers.delete(id);
         tokenByAgent.delete(id);
         hasWorkByAgent.delete(id);
+        mintedAt.delete(id); // was leaked on removal (finding 14)
       }
     }
 

package/bin/lib/git.mjs

@@ -15,6 +15,50 @@ export function repoRootOrDie() {
   }
 }
 
+// ── Server-value validation ────────────────────────────────────────────────
+// prUrl / branch / agentId arrive from the fleet server. execFileSync blocks
+// SHELL injection but NOT git/gh option injection (a leading '-' becomes a
+// flag) or cross-repo/cross-path abuse. These guards make a malicious or buggy
+// server unable to touch a repo/branch/path outside the expected scope.
+
+/** The `owner/repo` the daemon is running inside, from origin's URL. Null if
+ *  origin isn't a github remote. */
+export function originSlug(repoRoot) {
+  try {
+    const url = git(['remote', 'get-url', 'origin'], repoRoot);
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/i);
+    return m ? `${m[1]}/${m[2]}` : null;
+  } catch {
+    return null;
+  }
+}
+
+/** A PR URL is accepted only if it's an https github.com PR in THIS repo. */
+export function isValidPrUrl(prUrl, slug) {
+  if (typeof prUrl !== 'string' || !slug) return false;
+  const m = prUrl.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/\d+$/);
+  return !!m && m[1].toLowerCase() === slug.toLowerCase();
+}
+
+/** A branch name is accepted only if git considers it a well-formed ref, it's
+ *  not the base branch, and it doesn't start with '-' (option injection). */
+export function isValidBranch(branch, repoRoot, baseRef) {
+  if (typeof branch !== 'string' || !branch || branch.startsWith('-')) return false;
+  if (baseRef && (branch === baseRef || `origin/${branch}` === baseRef)) return false;
+  try {
+    git(['check-ref-format', '--branch', branch], repoRoot);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** A roster agent id used as a filesystem path segment — strict allowlist so
+ *  it can't traverse (`..`, `/`) out of the worktrees dir. */
+export function isSafePathSegment(id) {
+  return typeof id === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(id);
+}
+
 export function detectBaseRef(repoRoot) {
   try {
     return git(['rev-parse', '--abbrev-ref', 'origin/HEAD'], repoRoot); // e.g. origin/main

package/bin/lib/live.mjs

@@ -16,7 +16,7 @@
  * live fleet + repo to shake out. Old (poll/sentinel) mode is untouched.
  */
 
-import { readFileSync, writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import {
@@ -31,7 +31,7 @@ import {
 } from './config.mjs';
 import { c, info, ok, warn } from './ui.mjs';
 import { sleep } from './claude.mjs';
-import { git, resetWorktree } from './git.mjs';
+import { git, resetWorktree, isValidBranch } from './git.mjs';
 import { loadPreviewConfig, startPreview } from './preview.mjs';
 
 // Register a branch preview's tunnel URL with Flowviant (fleet-authed). The
@@ -46,6 +46,7 @@ async function registerLiveTarget(intentId, kind, url) {
         'User-Agent': USER_AGENT,
         'Content-Type': 'application/json',
       },
+      signal: AbortSignal.timeout(30_000),
       body: JSON.stringify({ intentId, kind, url }),
     });
   } catch {
@@ -124,6 +125,7 @@ async function mcpCall(mcpUrl, token, name, args) {
       // without this every live MCP call fails against api.flowviant.com.
       'User-Agent': USER_AGENT,
     },
+    signal: AbortSignal.timeout(30_000),
     body: JSON.stringify({
       jsonrpc: '2.0',
       id: ++rpcId,
@@ -206,6 +208,13 @@ function writeTaskMarker(cwd, intentId) {
     /* best-effort — worst case the next restart resets to base */
   }
 }
+function clearTaskMarker(cwd) {
+  try {
+    rmSync(markerPath(cwd), { force: true });
+  } catch {
+    /* best-effort */
+  }
+}
 
 // A stop word from any teammate halts the agent (interrupt at the next boundary,
 // then hold for direction) — the "stop, you're going the wrong way" valve.
@@ -261,7 +270,10 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
 
   // Revision resumes its PR branch; a genuinely fresh task gets a clean base
   // checkout; a resume (in-memory or marker) keeps its dirty worktree untouched.
-  if (brief.branch) {
+  // The branch is server-supplied — validate it's a well-formed non-base ref
+  // (not a leading-'-' git option) before checkout; on a bad value fall back to
+  // a clean base rather than executing it.
+  if (brief.branch && isValidBranch(brief.branch, cwd, baseRef)) {
     try {
       git(['fetch', 'origin', '--quiet'], cwd);
       git(['checkout', brief.branch], cwd);
@@ -284,7 +296,13 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
   }
 
   const env = { ...process.env };
-  delete env.ANTHROPIC_API_KEY; // force the user's Claude Code subscription
+  // Force the user's Claude Code subscription — strip EVERY var that could
+  // divert to API billing or a proxy (poll mode strips these too; live mode
+  // was only clearing API_KEY, so an exported AUTH_TOKEN/BASE_URL silently
+  // billed the API on the default path).
+  delete env.ANTHROPIC_API_KEY;
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  delete env.ANTHROPIC_BASE_URL;
 
   // Prior channel transcript — present when resuming a parked/re-claimed task;
   // seed it so a fresh session picks up where the conversation left off. afterId
@@ -401,7 +419,14 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
         await flush();
         turnId = null;
 
-        if (completed) return { outcome: 'done', title, intentId };
+        // Task finished — clear the marker so this worktree is NOT treated as a
+        // resume of this intent later (esp. if the task is restarted from
+        // scratch, which discards it: a stale marker would resume the discarded
+        // attempt's dirty files).
+        if (completed) {
+          clearTaskMarker(cwd);
+          return { outcome: 'done', title, intentId };
+        }
 
         if (sawBlocker) {
           const res = await waitForResolution(mcpUrl, token, blockerId, isAlive);
@@ -425,6 +450,11 @@ export async function runLiveTask({ mcpUrl, token, cwd, baseRef, isAlive, resume
         // Torn down out from under us (restart / reassign in Flowviant): the
         // server killed this run — abandon the session, don't keep building.
         if (poll && poll.ok === false && poll.reason === 'run_not_active') {
+          // Discarded (restart/reassign): clear the marker AND reset the
+          // worktree so the next fresh claim starts from clean base, never
+          // resuming the abandoned attempt.
+          clearTaskMarker(cwd);
+          resetWorktree(cwd, baseRef);
           return { outcome: 'torn_down', title, intentId };
         }
         const fresh = (poll?.messages ?? []).filter((x) => x.role === 'user');
@@ -493,6 +523,7 @@ export async function runLiveWorker({
   isAlive,
   onTokenSuspect,
   onChild,
+  onPreview,
 }) {
   // The intent this worker is holding across iterations. When a task parks on a
   // blocker its worktree keeps uncommitted work; on the resume claim we must NOT
@@ -519,6 +550,10 @@ export async function runLiveWorker({
       }
       preview = null;
     }
+    // Detached preview children (dev server + tunnel) survive process exit, so
+    // the daemon's SIGINT teardown needs a handle to stop them — clear it here
+    // once they're down.
+    onPreview?.(null);
   };
   const startReviewPreview = async (intentId) => {
     stopPreview();
@@ -544,6 +579,7 @@ export async function runLiveWorker({
       log: (m) => info(`${label} ${c.dim(m)}`),
     });
     if (preview) {
+      onPreview?.(stopPreview); // hand the daemon a stop handle for shutdown
       await registerLiveTarget(intentId, kind, preview.url);
       ok(`${label} ${c.dim('live preview ready — open the node to drive it in your review')}`);
     }

package/bin/lib/login.mjs

@@ -37,6 +37,7 @@ async function post(url, body) {
   const res = await fetch(url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', 'User-Agent': USER_AGENT },
+    signal: AbortSignal.timeout(30_000),
     body: JSON.stringify(body),
   });
   if (!res.ok) throw new Error(`HTTP ${res.status}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {