flowviant 0.90.0 → 0.91.1

package/bin/cli.mjs

@@ -40,7 +40,10 @@
  * bare `npx flowviant` serves the project BOUND to the repo it is started in.
  * Ambiguity is a picker on a TTY and a worded refusal headless — never a
  * guess. `flowviant projects` lists what is stored; `--project <name|id>`
- * picks without a prompt.
+ * picks without a prompt. `flowviant machines` (0.91.0) asks the server which
+ * BOXES have polled each of those credentials — the view-only answer to "am I
+ * running duplicate or redundant daemons?", which the store alone cannot give
+ * because a daemon on another computer is invisible from here.
  *
  * Env:
  *   FLOWVIANT_FLEET     the machine credential (or use `flowviant login`).
@@ -195,8 +198,18 @@ if (process.argv[2] === 'projects') {
     process.exit(0);
   }
   for (const e of entries) {
+    // THE DATE RIDES THE ID, always — this listing exists for the moment
+    // somebody is asking "why did it say skadooble?", and "which of these two
+    // did I set up last month" is the same question one step on. Absent when
+    // nothing recorded one (a credential stored before the field existed);
+    // nothing is invented.
+    const savedOn = e.savedAt ? new Date(e.savedAt) : null;
+    const connected =
+      savedOn && !Number.isNaN(savedOn.getTime())
+        ? `, connected ${savedOn.toLocaleDateString('en-US', { month: 'short', day: 'numeric' })}`
+        : '';
     console.log(
-      `  ${projectLabel(e)}  (${e.projectId.slice(0, 8)}…)` +
+      `  ${projectLabel(e)}  (${e.projectId.slice(0, 8)}…${connected})` +
         `${e.repoRoot ? `\n      repo · ${e.repoRoot}` : '\n      repo · not bound yet — first start or login in its repo binds it'}` +
         `${e.active ? '\n      what a pre-0.55.0 flowviant on this box would serve (the legacy mirror)' : ''}`
     );
@@ -208,6 +221,96 @@ if (process.argv[2] === 'projects') {
   process.exit(0);
 }
 
+// ── `flowviant machines` — every project connected on THIS box, and every box
+//    that has polled each of them.
+//
+// A THIRD COMMAND, and the owner's ruling it amends is his own: the terminal
+// surface is `npx flowviant` and `npx flowviant login`, full stop — which is
+// what deleted the old terminal flag for moving a machine — and he asked for
+// this one directly ("the CLI gets a command to list connections"). So it is
+// amended in the narrowest form that ruling allows: VIEW-ONLY. It starts
+// nothing, stops nothing, moves nothing, takes no lock and reaches no daemon.
+// The only state it can change is this box's credential file, and only behind
+// an explicit `--forget`.
+//
+// The question is the owner's, verbatim: "is there a way to view ALL the
+// connected flowviants? because im not sure if i have any duplicate or
+// redundant daemons running". It needs the NETWORK, unlike `projects` next
+// door, because the boxes are the server's answer — this box cannot see a
+// daemon running on somebody else's computer, and guessing would be worse than
+// asking.
+//
+// ONE CALL PER STORED CREDENTIAL, because the CLI has NO PERSON IDENTITY: every
+// request it can make is `Bearer <machine token>`, so "all my machines" has to
+// be assembled from the credentials this box holds. That is also the limit the
+// footer states out loud — the app's Home is where the whole account's answer
+// lives.
+//
+// EXIT 0 whatever it finds, including nothing: the listing is the answer the
+// asker came for, and a non-zero code over "you have no projects connected"
+// would make this command unusable in anything that checks one.
+if (process.argv[2] === 'machines') {
+  const creds = await import('./lib/credentials.mjs');
+  const forgetAt = process.argv.indexOf('--forget');
+  if (forgetAt >= 0) {
+    // THE ONE WRITE. Named explicitly, matched by full id or a ≥6 prefix, and
+    // AMBIGUITY REFUSES rather than guessing — this deletes a credential, and
+    // two projects that look alike is the case that produced the command.
+    const res = creds.forgetStoredProject(process.argv[forgetAt + 1]);
+    if (res.error) {
+      console.error(`error: ${res.error}`);
+      process.exit(1);
+    }
+    console.log(
+      `forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box.\n` +
+        '  Nothing was stopped or deleted anywhere else — `flowviant login` connects it again.'
+    );
+    process.exit(0);
+  }
+
+  const entries = creds.listStoredProjects();
+  if (entries.length === 0) {
+    console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
+    process.exit(0);
+  }
+  const { boxesUrlFrom, fetchBoxesFor, renderMachines, MACHINES_FOOTER } = await import(
+    './lib/machines.mjs'
+  );
+  const { FLEET_URL } = await import('./lib/config.mjs');
+  // OUR OWN BOX ID, so the listing can mark "← this box".
+  //
+  // READ, NEVER CREATED. This called `ensureKeypair()` until 2026-09-19, which
+  // MINTS a keypair when there is no file — a 0600 write establishing this
+  // machine's durable identity, performed by a command whose entire job is to
+  // print a list. A view-only command is what let a third terminal command
+  // exist at all, and enrolling a box as a side effect of looking at one is not
+  // that. `readStoredPubB64` reads or answers null.
+  //
+  // NULL COSTS ONLY THE MARK, and that is the honest outcome: a box that has
+  // never run a daemon has never polled, so it is not in this listing to be
+  // marked in the first place.
+  let me;
+  try {
+    const env = await import('./lib/env.mjs');
+    me = env.readStoredPubB64() ?? undefined;
+  } catch {
+    /* unreadable keypair — nothing is marked, and nothing is claimed */
+  }
+  const url = boxesUrlFrom(FLEET_URL);
+  const results = {};
+  // SEQUENTIAL, not a fan-out: this is a handful of credentials on somebody's
+  // laptop, and a parallel burst against the API buys nothing a person waiting
+  // two seconds can perceive.
+  for (const e of entries) {
+    results[e.projectId] = await fetchBoxesFor(e, { url, envpub: me });
+  }
+  console.log('');
+  for (const line of renderMachines(entries, results)) console.log(line);
+  console.log('');
+  for (const line of MACHINES_FOOTER) console.log(line);
+  process.exit(0);
+}
+
 // `flowviant env <import|set|show>` — the CLI half of team env sync. Values
 // are sealed to the project pubkey ON THIS MACHINE (same write-only crypto as
 // the browser); `show` decrypts locally — it only works on an ENROLLED machine.
@@ -247,15 +350,14 @@ if (process.argv[2] === 'env') {
 const { canPrompt, askWithTimeout, selectMenu, menuSupported } = await import('./lib/tty.mjs');
 const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
 
-/** How long the one-time binding confirm waits before serving unbound. A person
- *  who just typed `flowviant` answers in seconds; anything longer is a restart
- *  nobody is watching, and the machine must not sit dark for it. */
-const CONFIRM_TIMEOUT_MS = 20_000;
-
-/** The picker's own budget. Longer than the confirm: this one asks you to READ
- *  a list before answering, and its fallback costs you a start rather than
- *  costing you a binding. */
-const PICK_TIMEOUT_MS = 60_000;
+/** NO ANSWER TIME LIMIT on the start path (2026-09-20, the owner: "why is
+ *  there an answer time limit, remove that"). The confirm below carried 20s
+ *  and the picker 60s, each arguing that a restart nobody is watching must
+ *  not sit dark on a prompt — but `interactive` already excludes exactly that
+ *  case (no foreground terminal, or a self-update re-exec, and nothing is
+ *  asked). What was left was a person reading a list being told "no answer
+ *  in 60s — nothing started". A prompt a person can see waits for the
+ *  person; tty.mjs's header carries the argument. */
 const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own
@@ -268,11 +370,16 @@ async function reexecAfterLogin() {
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
 }
 
-function listLines(entries, { projectLabel }) {
+// TWO ROWS THAT READ ALIKE ARE NOT A CHOICE. `projectRowLabel` adds the id and
+// the connected date to the COLLIDING rows only — production held two projects
+// both called "BRIF AI", both bound to the same checkout, so this picker
+// offered two identical lines and the only way to answer was to guess. See
+// credentials.mjs for why the suffix is not on every row.
+function listLines(entries, { projectRowLabel }) {
   return entries
     .map(
       (e, i) =>
-        `  ${i + 1}. ${projectLabel(e)}` +
+        `  ${i + 1}. ${projectRowLabel(e, entries)}` +
         (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet')
     )
     .join('\n');
@@ -321,22 +428,15 @@ if (!FLEET_TOKEN) {
     let chosen = null; // 0-based into [...choices, login]
     if (menuSupported()) {
       const rowLabel = (e) =>
-        creds.projectLabel(e) + (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet');
+        creds.projectRowLabel(e, choices) +
+        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet');
       const options = [...choices.map(rowLabel), loginLabel];
       // Say WHY the cursor starts where it does — "intuitive" made visible.
       if (likely >= 0) options[likely] += '   ← looks like this repo';
       const res = await selectMenu({
         options,
         defaultIndex: likely >= 0 ? likely : 0,
-        timeoutMs: PICK_TIMEOUT_MS,
       });
-      if (res.timedOut) {
-        console.error(
-          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
-            `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
-        );
-        process.exit(1);
-      }
       if (res.cancelled) {
         console.error('nothing chosen — nothing started.');
         process.exit(1);
@@ -351,12 +451,13 @@ if (!FLEET_TOKEN) {
       console.log(`  ${choices.length + 1}. ${loginLabel}`);
       const hint = likely >= 0 ? ` (enter for ${creds.projectLabel(choices[likely])})` : '';
       const raw = await askWithTimeout(
-        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `,
-        PICK_TIMEOUT_MS
+        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `
       );
       if (raw === null) {
+        // The read itself failed — stdin closed, or the terminal went away
+        // mid-question. Not a timeout: there is none.
         console.error(
-          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
+          `\ncould not read an answer — nothing started. ` +
             `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
         );
         process.exit(1);
@@ -410,7 +511,10 @@ if (!FLEET_TOKEN) {
   // stop here with the machine serving nothing. A guard that only works once
   // everyone already has it is not a guard.
   //
-  // ON TIMEOUT WE SERVE, AND WE DO NOT BIND. Those are two decisions:
+  // IF THE READ FAILS WE SERVE, AND WE DO NOT BIND. (This used to say "on
+  // timeout"; there is no timeout since 2026-09-20 — a person at the prompt
+  // is waited for. `null` now means stdin closed under the question.) Those
+  // are two decisions:
   //  · SERVE, because it is what every version before 0.55.0 did with this
   //    exact store, so the silent path is the status quo rather than a new
   //    risk — and a daemon that answers is strictly better than one that does
@@ -422,13 +526,12 @@ if (!FLEET_TOKEN) {
   const creds = await import('./lib/credentials.mjs');
   const label = creds.projectLabel(CREDENTIAL.entry);
   const answered = await askWithTimeout(
-    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `,
-    CONFIRM_TIMEOUT_MS
+    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `
   );
-  const raw = answered === null ? null : answered.toLowerCase(); // null = nobody answered
+  const raw = answered === null ? null : answered.toLowerCase(); // null = the read failed
   if (raw === null) {
     console.log(
-      `\n  no answer in ${Math.round(CONFIRM_TIMEOUT_MS / 1000)}s — serving ${label} for this run ` +
+      `\n  could not read an answer — serving ${label} for this run ` +
         `without tying it to this repo. Run \`flowviant\` here and answer to make it stick.`
     );
   } else if (raw === '' || raw === 'y' || raw === 'yes') {

package/bin/lib/config.mjs

@@ -264,6 +264,24 @@ export const MACHINE_HOST = (() => {
   }
 })();
 
+/**
+ * WHEN THIS PROCESS STARTED (0.91.0), measured ONCE at import.
+ *
+ * It rides the poll as `st` beside `pid`, and together they are what somebody
+ * who has lost track of their daemons actually needs: the owner, verbatim, "im
+ * not sure if i have any duplicate or redundant daemons running". A pid alone
+ * cannot tell one long-lived daemon from a process that has restarted nine
+ * times since you last looked; a start time can.
+ *
+ * Derived from `process.uptime()` rather than stamped at import for its own
+ * sake, so it stays true across a lazy import and reads as the process's own
+ * age rather than this module's. Computed once, deliberately: a value that
+ * drifts by a millisecond every poll would rewrite the column for ever.
+ */
+export const PROCESS_STARTED_AT = new Date(
+  Date.now() - Math.max(0, process.uptime() * 1000)
+).toISOString();
+
 // The ONE credential. `tokens` (FLOWVIANT_TOKEN / FLOWVIANT_TOKENS / --token /
 // --tokens) stood beside it and carried WORKER tokens into the pre-daemon loop;
 // that principal owns zero tools since dispatch was deleted, and the kind can no

package/bin/lib/credentials.mjs

@@ -136,6 +136,42 @@ export function projectLabel(e) {
   return e?.name ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
 }
 
+/**
+ * THE SAME LABEL, DISAMBIGUATED — for a list where two rows can read alike
+ * (2026-09-19).
+ *
+ * Two projects genuinely named the same thing is not a hypothetical: production
+ * held two called "BRIF AI", both bound to the same checkout on one box, so
+ * `npx flowviant` there offered two IDENTICAL picker rows and the only way to
+ * choose between them was to guess. A picker whose options cannot be told apart
+ * is not a picker.
+ *
+ * THE SUFFIX IS ONLY ON THE COLLIDING ROWS. An id on every row would be noise
+ * on the ordinary case — one project per repo, nothing ambiguous — and noise is
+ * what makes the one row that matters unfindable. The DATE rides beside the id
+ * because it is the fact a person can actually match against their own memory
+ * ("I set that one up last month"), where two random-looking hex prefixes are
+ * two things to compare character by character.
+ *
+ * `flowviant machines` deliberately does the OPPOSITE and prints the id on
+ * every row: there you are reconciling a whole box's worth of credentials, and
+ * a suffix you have to notice before you know it matters has already made you
+ * do the work the listing exists to do for you.
+ */
+export function projectRowLabel(e, entries) {
+  const label = projectLabel(e);
+  const collides =
+    Array.isArray(entries) &&
+    entries.filter((x) => x !== e && projectLabel(x) === label).length > 0;
+  if (!collides) return label;
+  const d = e?.savedAt ? new Date(e.savedAt) : null;
+  const when =
+    d && !Number.isNaN(d.getTime())
+      ? `, connected ${d.toLocaleDateString('en-US', { month: 'short', day: 'numeric' })}`
+      : '';
+  return `${label} (id ${String(e?.projectId ?? '').slice(0, 8)}…${when})`;
+}
+
 /** Collapse a name or slug for loose comparison: "My Project", "my-project"
  *  and "myproject" all become "myproject". */
 function normalizeName(s) {
@@ -213,6 +249,48 @@ export function selectStoredProject(projectId, { bindRepoRoot } = {}) {
   });
 }
 
+/**
+ * FORGET A STORED CREDENTIAL — `flowviant machines --forget <id>` (2026-09-19).
+ *
+ * The one write this otherwise view-only command can make, and it edits THIS
+ * BOX'S credential file and nothing else: no server is called, no daemon is
+ * stopped, no project is deleted. It exists because a credential whose project
+ * was disconnected or deleted in the app 401s forever from here, and until now
+ * the only way to clear one was to hand-edit JSON under `~/.flowviant`.
+ *
+ * IT CLEARS THE LEGACY MIRROR TOO when the mirror names the entry being
+ * removed. Leaving it would resurrect the row on the next read —
+ * `listStoredProjects` surfaces the top-level trio as an entry whenever no map
+ * row carries its token — so the forget would silently not have happened, which
+ * is the worst outcome available here.
+ *
+ * MATCHES BY FULL ID OR A PREFIX OF AT LEAST SIX, the same rule
+ * `matchStoredProject` keeps, and AMBIGUITY IS A REFUSAL rather than a coin
+ * flip: this deletes a credential, and the case that produced the whole command
+ * is two projects that look alike.
+ */
+export function forgetStoredProject(ref) {
+  const q = String(ref ?? '').trim();
+  if (!q) return { error: 'empty --forget value' };
+  const hits = listStoredProjects().filter(
+    (e) => e.projectId === q || (q.length >= 6 && e.projectId.startsWith(q))
+  );
+  if (hits.length === 0) return { error: `no stored project matches "${q}"` };
+  if (hits.length > 1) {
+    return { error: `"${q}" matches ${hits.length} stored projects — use the full project id` };
+  }
+  const gone = hits[0];
+  mutate((f) => {
+    delete f.projects[gone.projectId];
+    if (f.projectId === gone.projectId) {
+      delete f.projectId;
+      delete f.fleetToken;
+      delete f.mcpUrl;
+    }
+  });
+  return { entry: gone };
+}
+
 export function bindStoredRepo(projectId, repoRoot) {
   if (!repoRoot) return;
   mutate((f) => {

package/bin/lib/env.mjs

@@ -146,6 +146,31 @@ export function myPubB64() {
   return keypair ? sodium.to_base64(keypair.publicKey, B64()) : null;
 }
 
+/**
+ * THIS BOX'S PUBLIC KEY, READ AND NEVER WRITTEN (2026-09-19, the review).
+ *
+ * `flowviant machines` is a VIEW-ONLY command — that narrowness is the whole
+ * reason a third terminal command was allowed to exist at all — and it was
+ * calling `ensureKeypair`, which on a box with no keypair CREATES ONE: a
+ * filesystem write, 0600, minting this machine's durable identity, from a
+ * command whose entire job is to print a list. Listing must not enrol.
+ *
+ * It reads the stored file and nothing else. No sodium, no parse of the private
+ * half, no creation. NULL for every failure — absent, unreadable, malformed —
+ * and null simply means no row gets the "← this box" mark, which is honest: a
+ * box that has never run a daemon has never polled, so it is not in the listing
+ * to be marked. Claiming a row is you on a guess would be worse than the mark
+ * being absent.
+ */
+export function readStoredPubB64() {
+  try {
+    const stored = JSON.parse(readFileSync(KEYPAIR_PATH, 'utf8'));
+    return typeof stored?.pub === 'string' && stored.pub ? stored.pub : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Query params the roster poll carries: identity, materialized version, and
  *  the target files we REFUSED to write.
  *

package/bin/lib/fleet.mjs

@@ -25,6 +25,7 @@ import {
   SAFE,
   DAEMON_INSTANCE,
   MACHINE_HOST,
+  PROCESS_STARTED_AT,
   POLL_SECONDS,
   MAX_CONCURRENT,
   IDLE_SECONDS,
@@ -93,6 +94,64 @@ import { claudeAuthContext } from './claudeAuth.mjs';
 /** Said once per process — see the catch around `envQueryParams` below. */
 let warnedEnvIdentity = false;
 
+/**
+ * HAS THIS PROCESS ALREADY ASKED FOR THE MACHINE? (0.91.0)
+ *
+ * The owner's ruling on two boxes running one project: "it should kill the
+ * first one and take over". So a daemon asks on the FIRST poll of its life and
+ * never again, and this pair is the whole of that "never again".
+ *
+ * ONE ASK PER PROCESS IS THE SAFETY, NOT A POLITENESS. A param that kept asking
+ * would be two boxes trading a machine back and forth every ten seconds. Asked
+ * once, the story ends at the first exchange, because the box that loses
+ * SETTLES ITS TURNS AND EXITS rather than restarting — and a process that has
+ * exited sends no more first polls.
+ *
+ * THAT LAST SENTENCE IS TRUE OF THE PROCESS AND NOT OF THE UNIT, which is why
+ * the server stopped relying on it (2026-09-19). Under `Restart=always`, pm2 or
+ * docker, exit 0 is a relaunch and the relaunch's first poll is a genuine one.
+ * `takeMachineHolderNow` refuses a take by the box it just displaced for the
+ * length of the displaced window, so the ping-pong is bounded on the side that
+ * can see both boxes. This module still keeps its half of the bargain.
+ *
+ * SPENT ON A DELIVERED POLL, NOT ON AN ATTEMPTED ONE, which is why this is two
+ * functions instead of one consuming read. A daemon that starts while the wire
+ * is down retries every ten seconds; spending the ask on the failed attempt
+ * would mean the box you walked over to and started never takes the machine,
+ * and nothing anywhere would say why.
+ *
+ * IT IS NOT THE DELETED FLAG COMING BACK. There is still nothing to type: the
+ * terminal surface is `npx flowviant` and `npx flowviant login`, and what
+ * claims here is starting the daemon, which is already one of those two.
+ *
+ * Exported so both properties can be proved without a server, a credential or a
+ * second box — they are the contract, and nothing else in the file states them.
+ */
+/**
+ * AND A RESTART IS NOT A PERSON (2026-09-19, the review).
+ *
+ * `update.mjs` re-execs the daemon with `FLOWVIANT_REEXEC='1'` after an
+ * UNATTENDED auto-update, which is on by default. Born `false`, the new process
+ * would then spend a fresh ask and TAKE THE PROJECT'S MACHINE — so a standby
+ * sitting quietly on somebody's second computer would seize the machine off the
+ * live holder in the middle of the night, settling its running turns as moved,
+ * because npm published a patch. Nobody was at either keyboard, and nothing on
+ * any surface would say why.
+ *
+ * The ask belongs to the GESTURE, not to the process: what claims a machine is
+ * a person typing `npx flowviant`, and a re-exec is the same start continuing.
+ * So a re-executed daemon is born with the ask already spent and behaves
+ * exactly as it did before the update — it keeps the machine if it had it (arm
+ * (a) stamps it), and stands by if it did not.
+ */
+let machineAskSpent = process.env.FLOWVIANT_REEXEC === '1';
+export function machineAskPending() {
+  return !machineAskSpent;
+}
+export function spendMachineAsk() {
+  machineAskSpent = true;
+}
+
 async function fetchRoster(
   haveIds,
   livePreviewSessionIds = [],
@@ -101,7 +160,12 @@ async function fetchRoster(
    *  every unattended lane asks — see the `pr` param below for why it is the
    *  admission and not the pressure reading alone. Undefined where the caller
    *  has no admission to offer, which reads exactly like an older daemon. */
-  churnHold = undefined
+  churnHold = undefined,
+  /** The checkout this daemon serves, for the `cp` report below. Passed in
+   *  rather than re-derived: `repoRootOrDie` is resolved once at startup and
+   *  running git on every poll to re-learn a constant would be a syscall for
+   *  a readout. */
+  repoRoot = null
 ) {
   const url = new URL(FLEET_URL);
   if (haveIds.length) url.searchParams.set('have', haveIds.join(','));
@@ -132,9 +196,51 @@ async function fetchRoster(
   // Absent when the host has no readable name — an older daemon looks the same,
   // and both mean "nobody said", which is what the nameless fallback renders.
   if (MACHINE_HOST) url.searchParams.set('mh', MACHINE_HOST);
-  // NOTHING HERE ASKS FOR THE MACHINE. A poll reports what this box IS; moving
-  // the project's machine onto it is a gesture a person makes in the app, and
-  // the daemon learns the outcome on its next poll like every other holder fact.
+  /**
+   * WHICH CHECKOUT, WHICH PROCESS, AND SINCE WHEN (0.91.0) — the three facts
+   * that turn "a box polled" into a row somebody can act on.
+   *
+   * The owner could not answer a plain question about his own machines: "im not
+   * sure if i have any duplicate or redundant daemons running". The hostname
+   * alone cannot answer it either, because ONE box legitimately runs several
+   * daemons — "i can have 1 daemon in one directory, 1 in another as a
+   * differentiator of projects" — so `cp` is what makes two rows on one box
+   * legible, and `pid` + `st` are what let somebody standing at that box find
+   * the process and tell a long-lived daemon from one that has restarted nine
+   * times since they last looked.
+   *
+   * DAEMON→SERVER REPORTS, so no floor: an older daemon sends none of these and
+   * the server stores null, which reads as "it did not say" rather than as a
+   * box with no checkout. Bounded here as well as at the boundary — a query
+   * string is not a log, and this one is rendered into a terminal.
+   */
+  if (repoRoot) url.searchParams.set('cp', String(repoRoot).slice(0, 256));
+  url.searchParams.set('pid', String(process.pid));
+  url.searchParams.set('st', PROCESS_STARTED_AT);
+  /**
+   * THE FIRST POLL OF THIS PROCESS ASKS FOR THE MACHINE (`claim`, 0.91.0).
+   *
+   * The owner, on two boxes running one project: "it should kill the first one
+   * and take over." Starting the daemon on the computer in front of you IS the
+   * gesture — there is no flag, no env var and no third command, so the ruling
+   * that deleted the old machine-moving flag ("i dont intend to run or do
+   * anything in the terminal besides npx flowviant or npx flowviant login")
+   * stands untouched.
+   *
+   * SENT ONCE PER PROCESS, and that is the safety rather than a politeness: see
+   * `askForMachineOnce`. The server takes holdership there and then, the box it
+   * displaces learns through the existing named-and-windowed `displaced` signal
+   * and exits 0, and nothing restarts to ask again.
+   *
+   * AN OLDER SERVER IGNORES IT and the old standby behaviour stands, which is
+   * why this needs no floor of its own — the server applies one (it will not
+   * take a machine from a box too old to be told it lost it).
+   */
+  if (machineAskPending()) url.searchParams.set('claim', '1');
+  // A poll reports what this box IS. Moving the project's machine onto it, when
+  // this process has already spent its one ask above, is a gesture a person
+  // makes in the app — and the daemon learns that outcome on its next poll like
+  // every other holder fact.
   // Which shares this machine is still serving. It rides the poll rather than
   // taking an endpoint of its own: one beat, no floor, and the stale window is
   // the reconcile interval instead of minutes — which matters, because a share
@@ -305,6 +411,12 @@ async function fetchRoster(
     throw e;
   }
   if (!res.ok) throw new Error(`fleet poll failed (${res.status})`);
+  // THE ASK IS SPENT HERE AND NOWHERE ELSE — on a poll the server actually
+  // answered. Spending it where the param is SET would lose the claim of a
+  // daemon that started while the wire was down: it would retry, silently
+  // without `claim`, and the box somebody walked over to and started would
+  // never take the machine.
+  spendMachineAsk();
   const body = await res.json();
   // Validate the shape here so a malformed 200 (deploy hiccup, error envelope)
   // throws a NORMAL retryable error inside the loop's try/catch, instead of a
@@ -600,6 +712,34 @@ export function createHolderWatch({ say = () => {} } = {}) {
         return 'absent';
       }
       if (holder.mine === true) {
+        /**
+         * WE TOOK IT, AND THE SERVER SAID SO (0.91.0).
+         *
+         * Sent on the one poll that moved holdership and never again, so this
+         * is news by construction — no key to remember, no window to judge.
+         * RELAYED AND NEVER DERIVED: the box we displaced is named because the
+         * server named it, and an unnamed one gets the nameless fallback the
+         * rest of this file uses rather than a guess. The turns clause DROPS
+         * WHOLE when the count is absent — "0 turns were running" is a
+         * measurement nobody took, printed at the one moment somebody is
+         * deciding whether they have just interrupted their own work.
+         */
+        const took = holder.took;
+        if (took && typeof took === 'object' && !Array.isArray(took)) {
+          standbyKey = null;
+          const from =
+            typeof took.from === 'string' && took.from.trim()
+              ? took.from.trim().slice(0, 64)
+              : 'another machine';
+          const turns = Number.isInteger(took.turns) && took.turns > 0 ? took.turns : null;
+          say(
+            `took this project's machine from ${from}` +
+              (turns
+                ? ` — ${turns} turn${turns === 1 ? '' : 's'} ${turns === 1 ? 'was' : 'were'} running there and ${turns === 1 ? 'was' : 'were'} settled as moved.`
+                : '.')
+          );
+          return 'mine';
+        }
         if (standbyKey !== null) {
           standbyKey = null;
           say('this machine now serves the project.');
@@ -631,10 +771,28 @@ export function createHolderWatch({ say = () => {} } = {}) {
         // rather than a zero — because "heard 0s ago" is a measurement nobody
         // took, printed at the one moment the person is deciding whether to
         // wait.
+        //
+        // THE PROMISE IS GONE (0.91.0), and its absence is the honest half.
+        // This sentence used to end "It moves here automatically once that
+        // machine has been quiet 10 minutes", which was true while starting a
+        // daemon did nothing but wait. Since 0.91.0 a process START asks for
+        // the machine on its first poll — the owner's ruling, "it should kill
+        // the first one and take over" — so reaching this branch at all means
+        // the ask was REFUSED or never spent. Four ways: an older server that
+        // does not honour it; a daemon this server will not hand a machine to;
+        // an UNATTENDED RE-EXEC, which is born with the ask spent because a
+        // restart is not a person; and — the one worth naming — a box this
+        // credential DISPLACED inside the last ten minutes, which the server
+        // refuses so that two supervised daemons cannot trade a machine back
+        // and forth forever (see `takeMachineHolderNow`). In that last case the
+        // right next move is a decision, not a wait, which is exactly what this
+        // sentence already points at. Restating the staleness clock instead
+        // would promise a handover on the one path where it is least likely to
+        // be what happens. So the line relays the fact and points at the door,
+        // which is the same door it always pointed at.
         say(
           `This project's machine is ${name ?? 'another machine'}${ago ? ` (heard ${ago} ago)` : ''}. ` +
-            'It moves here automatically once that machine has been quiet 10 minutes ' +
-            "— or move it now from the app's project settings."
+            "This one is standing by — move it here from the app's project settings."
         );
       }
       return 'standby';
@@ -1926,7 +2084,8 @@ export async function runFleetDaemon() {
         buildHave(),
         livePreviewIds(),
         heldSessionIds(),
-        admit('churn')
+        admit('churn'),
+        repoRoot
       );
     } catch (e) {
       if (e.auth) {
@@ -1960,6 +2119,35 @@ export async function runFleetDaemon() {
         // for a --fleet/env token (nothing stored to annotate).
         setStoredProjectName(roster.project.id, roster.project.name);
       }
+      /**
+       * WHAT ELSE IS SERVING THIS PROJECT — said ONCE, right after the first
+       * poll lands, and never again (0.91.0).
+       *
+       * The owner could not answer a plain question about his own setup: "im
+       * not sure if i have any duplicate or redundant daemons running". This is
+       * the half of the answer that belongs in the terminal you just typed
+       * into, because that is where you are standing when the question occurs
+       * to you — the app's Home is where the whole account's answer lives.
+       *
+       * A RELAY, and it withholds nothing on failure: an older server has no
+       * boxes route and 404s, which prints NOTHING rather than a complaint
+       * about a feature nobody asked for. Fire-and-forget and never awaited on
+       * the poll path — a listing must never delay a roster tick.
+       */
+      void (async () => {
+        try {
+          const { boxesUrlFrom, fetchBoxesFor, otherBoxesLine } = await import('./machines.mjs');
+          const res = await fetchBoxesFor(
+            { fleetToken: FLEET_TOKEN },
+            { url: boxesUrlFrom(FLEET_URL), envpub: myPubB64() ?? undefined }
+          );
+          if (!res.boxes) return;
+          const line = otherBoxesLine(res.boxes, res.me);
+          if (line) note(line);
+        } catch {
+          /* a readout — it must never disturb the daemon that produced it */
+        }
+      })();
     }
     if (roster.mcpUrl) mcpUrl = roster.mcpUrl;
     /**

package/bin/lib/machines.mjs

@@ -0,0 +1,270 @@
+/**
+ * `npx flowviant machines` — every project connected on THIS box, and every box
+ * that has polled each of them (0.91.0).
+ *
+ * ── WHY A THIRD COMMAND EXISTS AT ALL ──
+ *
+ * The terminal surface is `npx flowviant` and `npx flowviant login`, full stop.
+ * That is the owner's own ruling and it is what deleted the terminal flag that
+ * used to move a project's machine. This amends it BY HIS OWN REQUEST — "the CLI gets a command to list connections" —
+ * and it is amended in the narrowest way the ruling can survive: this command
+ * is VIEW-ONLY. It starts nothing, stops nothing, moves nothing and takes no
+ * lock; the one thing it can change is the local credential file, and only
+ * behind an explicit `--forget`. Every decision is still made in the app.
+ *
+ * The question it answers is the owner's, verbatim: "is there a way to view ALL
+ * the connected flowviants? because im not sure if i have any duplicate or
+ * redundant daemons running". Measured the day it was asked: four live daemons
+ * across two boxes, two credentials last heard three days ago, and two projects
+ * both named "BRIF AI" bound to the same checkout — which is why `npx
+ * flowviant` there offered two identical picker rows. THE PROJECT ID IS
+ * THEREFORE ALWAYS PRINTED: it is the only thing that tells those two apart,
+ * and the whole listing is worth less without it.
+ *
+ * ── IT IS A RELAY ──
+ *
+ * The role words (`serving`, `standing by`, `idle`) are the SERVER'S, computed
+ * in one place so this command, project settings and the account's Home block
+ * cannot disagree about what a box is doing. Nothing here re-derives a state, and
+ * a project the server could not answer for says so rather than rendering as
+ * empty.
+ *
+ * ── RENDERING IS PURE, FETCHING IS NOT ──
+ *
+ * `renderMachines` takes the entries and the results and returns lines, so
+ * every case that matters — rejected, unreachable, an older server, no boxes,
+ * behind, this box — is provable without a network, a credential or a daemon.
+ * The wiring above it is the thin part on purpose.
+ *
+ * It deliberately imports NOTHING from fleet.mjs: that module pulls the whole
+ * daemon (the CLIs, the worktree machinery, the preview tunnels) and this
+ * command runs before the auth gate, like `stop` and `projects`. The small
+ * duration formatter below is a second copy of a ten-line function, knowingly,
+ * and it says different words anyway — "heard 12s ago" against "last heard 3d
+ * ago", where the word LAST is the staleness mark.
+ */
+
+import { USER_AGENT } from './config.mjs';
+
+/** The boxes read, derived from the roster URL the way the diffstat post is —
+ *  one place configures the API base and everything else is a suffix swap. */
+export function boxesUrlFrom(fleetUrl) {
+  return String(fleetUrl).replace(/\/agents\/?$/, '/boxes');
+}
+
+/** The one answer `agoFrom` gives that is a PHRASE rather than a duration, so
+ *  it is the one answer that must not take an " ago" after it. Named because
+ *  two callers have to agree about it and a bare string literal is how they
+ *  stopped agreeing. */
+const JUST_NOW = 'just now';
+
+/**
+ * A coarse age. Never "0s": a box heard a moment ago reads as "just now",
+ * because a daemon that polled four hundred milliseconds ago has not been
+ * silent for no time at all — the same rule `agoLabel` keeps in fleet.mjs and
+ * `elapsed` keeps in the web.
+ *
+ * NULL for anything unmeasurable, so the caller DROPS the clause rather than
+ * printing a duration nobody took.
+ */
+export function agoFrom(iso, now = Date.now()) {
+  const t = Date.parse(iso ?? '');
+  if (Number.isNaN(t)) return null;
+  const ms = Math.max(0, now - t);
+  const s = Math.round(ms / 1000);
+  if (s < 5) return JUST_NOW;
+  if (s < 90) return `${s}s`;
+  const m = Math.round(s / 60);
+  if (m < 90) return `${m}m`;
+  const h = Math.round(m / 60);
+  if (h < 36) return `${h}h`;
+  return `${Math.round(h / 24)}d`;
+}
+
+/**
+ * WHEN THIS BOX WAS LAST HEARD FROM, as a whole phrase — and the phrase is one
+ * function because the two callers got it WRONG THE SAME WAY (2026-09-19, the
+ * review).
+ *
+ * `agoFrom` answers with a DURATION for everything except the newest case,
+ * where it answers with the words "just now" — and both callers appended
+ * " ago", so the most common row in the listing, a daemon that polled four
+ * hundred milliseconds ago, read "heard just now ago". On the serving box. On
+ * the first line anybody looks at.
+ *
+ * Stated once here rather than fixed twice: a duration takes the suffix, a
+ * phrase does not, and "LAST heard" is the staleness mark the whole listing
+ * turns on. An unmeasurable stamp says "never heard" rather than printing a
+ * duration nobody took.
+ */
+export function heardPhrase(box, now = Date.now()) {
+  const ago = agoFrom(box?.lastHeardAt, now);
+  if (!ago) return 'never heard';
+  const lead = box?.fresh ? 'heard' : 'last heard';
+  return ago === JUST_NOW ? `${lead} ${ago}` : `${lead} ${ago} ago`;
+}
+
+/** `savedAt` as a date somebody can match against their own memory of setting
+ *  it up. Absent stays absent — a credential stored before the field existed
+ *  has no date, and inventing one would be the listing asserting a day. */
+export function connectedOn(iso) {
+  const t = Date.parse(iso ?? '');
+  if (Number.isNaN(t)) return null;
+  return new Date(t).toLocaleDateString('en-US', { month: 'short', day: 'numeric' });
+}
+
+/** The server's own role word, spelled for a terminal. Unknown values pass
+ *  through untouched: this is a relay, and a role this build has never heard of
+ *  is still the server's answer. */
+function roleWord(role) {
+  return role === 'standing-by' ? 'standing by' : String(role ?? 'idle');
+}
+
+/** One box, as a line under its project. The MARK is the only derived thing on
+ *  it — a filled dot for a box the server still calls fresh, hollow for one it
+ *  does not — and the words beside it are all the server's or the box's own. */
+export function renderBox(box, { me = null, latest = null } = {}, now = Date.now()) {
+  const mark = box.fresh ? '●' : '○';
+  const name = box.boxName || 'an unnamed machine';
+  // "LAST heard" is the staleness mark, and the row is never hidden for it —
+  // the owner's answer to "what about a box that stopped" was exactly this.
+  const heard = heardPhrase(box, now);
+  const cells = [
+    `${mark} ${name}`,
+    roleWord(box.role),
+    box.checkoutPath || '(checkout not reported)',
+    box.daemonVersion ? `v${box.daemonVersion}` : 'version not reported',
+    heard,
+  ];
+  let line = `    ${cells.join('   ')}`;
+  if (me && box.boxId === me) line += '   ← this box';
+  // Said only when the server said it, and it names the version that is
+  // actually published rather than a feature floor — a floor may sit above
+  // LATEST on purpose, and an instruction to install something npm does not
+  // serve is worse than silence.
+  if (box.behind && latest) line += `   · behind, ${latest} is latest`;
+  return line;
+}
+
+/**
+ * THE WHOLE LISTING, as lines. Pure over (entries, results, now).
+ *
+ * `results` is keyed by projectId and each value is one of:
+ *   { boxes, latest, me }   the server answered
+ *   { rejected: true }      401/403 — the credential is dead here
+ *   { unsupported: true }   404 — an older server with no boxes route
+ *   { error: '<words>' }    anything else, relayed rather than summarised
+ * A project with no entry in `results` is treated as unreachable, because that
+ * is the only thing an absent answer can honestly mean.
+ */
+export function renderMachines(entries, results, { now = Date.now() } = {}) {
+  const lines = [];
+  // WHICH LABELS COLLIDE. Two projects genuinely called the same thing is the
+  // case that produced this command, so the id carries it — and it is printed
+  // on EVERY row rather than only the colliding ones, because a reader who has
+  // to notice a suffix to know whether it matters has already been asked to do
+  // the work this listing is for.
+  for (const e of entries) {
+    const label = e.name || `project ${e.projectId.slice(0, 8)}…`;
+    const connected = connectedOn(e.savedAt);
+    const id = `(id ${e.projectId.slice(0, 8)}…${connected ? `, connected ${connected}` : ''})`;
+    lines.push(
+      `  ${label}  ·  ${e.repoRoot || 'not bound to a repo yet'}   ${id}`
+    );
+    const r = results?.[e.projectId];
+    if (!r || r.error) {
+      // The failure is RELAYED, not summarised, and the loop carries on: one
+      // unreachable project must not cost you the listing for the others.
+      lines.push(`    could not ask the server — ${r?.error ?? 'no answer'}`);
+      continue;
+    }
+    if (r.rejected) {
+      lines.push(
+        '    credential rejected — this project was disconnected or deleted. ' +
+          `\`flowviant machines --forget ${e.projectId.slice(0, 8)}\` removes it here.`
+      );
+      continue;
+    }
+    if (r.unsupported) {
+      lines.push('    server does not report machines yet');
+      continue;
+    }
+    const boxes = Array.isArray(r.boxes) ? r.boxes : [];
+    if (boxes.length === 0) {
+      // NOT "no machines". Nothing has polled this credential, which is a
+      // different fact from a project whose machines have all gone quiet — and
+      // a quiet one still has rows, wearing its last-heard.
+      lines.push('    (no machine has polled this project)');
+      continue;
+    }
+    for (const b of boxes) lines.push(renderBox(b, { me: r.me, latest: r.latest }, now));
+  }
+  return lines;
+}
+
+/**
+ * THE FOOTER. Two sentences, both of which exist because this listing is the
+ * moment somebody is confused — the same reason `flowviant projects` names its
+ * remedies inline rather than in a manual.
+ *
+ * The first says where the verbs are, because there are none here. The second
+ * states this command's own SCOPE, which is the one thing a reader cannot see
+ * from the output: it lists what is connected on THIS box, and a daemon running
+ * on a computer that has never met this one is invisible to it. The app's Home
+ * is where "all of them" lives, and pretending otherwise would be this listing
+ * quietly answering a narrower question than the one asked.
+ */
+export const MACHINES_FOOTER = [
+  '  stop a machine from the app: project settings → Machine → Disconnect;',
+  '  a new `npx flowviant` on another box takes the project over.',
+  '  this lists the projects connected on THIS box; the app’s Home lists every machine on your account.',
+];
+
+/**
+ * Ask one credential for its boxes. Never throws: every outcome is a shape the
+ * renderer knows, because one dead project must not end the listing.
+ *
+ * A 404 is an older SERVER rather than a missing project — the route is new —
+ * and it is kept apart from a 401, which is a credential this box should
+ * probably forget. Two different next moves; collapsing them is how somebody
+ * deletes a working credential.
+ */
+export async function fetchBoxesFor(entry, { url, envpub, fetchImpl = fetch } = {}) {
+  const target = new URL(url);
+  if (envpub) target.searchParams.set('envpub', envpub);
+  try {
+    const res = await fetchImpl(target, {
+      headers: { Authorization: `Bearer ${entry.fleetToken}`, 'User-Agent': USER_AGENT },
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (res.status === 401 || res.status === 403) return { rejected: true };
+    if (res.status === 404) return { unsupported: true };
+    if (!res.ok) return { error: `HTTP ${res.status}` };
+    const body = await res.json();
+    const data = body?.data;
+    if (!data || !Array.isArray(data.boxes)) return { error: 'unexpected answer shape' };
+    return { boxes: data.boxes, latest: data.latest ?? null, me: data.me ?? null };
+  } catch (e) {
+    return { error: String(e?.message ?? e) };
+  }
+}
+
+/**
+ * THE OTHER BOXES ON THIS PROJECT, as ONE line for the daemon's startup — or
+ * null when there are none, which is the common case and must print nothing.
+ *
+ * Said ONCE per process, after the first successful poll, and never per poll:
+ * the fact only changes when somebody starts a daemon somewhere else, and a
+ * true sentence restated every ten seconds is a scrolling console nobody reads.
+ * THE CALLING BOX IS EXCLUDED — it is the one box the person at that terminal
+ * does not need to be told about.
+ */
+export function otherBoxesLine(boxes, me, now = Date.now()) {
+  const others = (Array.isArray(boxes) ? boxes : []).filter((b) => b && b.boxId !== me);
+  if (others.length === 0) return null;
+  const parts = others.slice(0, 6).map(
+    (b) => `${b.boxName || 'an unnamed machine'} (${roleWord(b.role)} · ${heardPhrase(b, now)})`
+  );
+  const more = others.length - parts.length;
+  return `other machines on this project: ${parts.join(', ')}${more > 0 ? `, and ${more} more` : ''}`;
+}

package/bin/lib/tty.mjs

@@ -19,13 +19,29 @@
  *
  *  2. `askWithTimeout()` — while asking, install no-op SIGTTIN/SIGTTOU handlers.
  *     A handler (even an empty one) replaces the default STOP, so a misjudged
- *     foreground check degrades to a read that fails or hangs — and a hang is
- *     something the timer can now actually interrupt, because the process is
- *     still running.
+ *     foreground check degrades to a read that fails rather than a process
+ *     that is frozen.
  *
  * The detection is best-effort by design and FAILS TOWARDS ASKING: an unknown
  * platform returns true, because refusing to prompt a human who IS there is a
- * worse failure than a prompt that times out on its own.
+ * worse failure than a prompt that waits.
+ *
+ * A PROMPT A PERSON IS LOOKING AT WAITS FOR THE PERSON (2026-09-20). Both
+ * helpers used to carry a mandatory timer — 20s on the binding confirm, 60s
+ * on the project picker — on the argument that "anything longer is a restart
+ * nobody is watching, and the machine must not sit dark for it". That
+ * argument was already answered one layer up: the start path never asks at
+ * all unless `canPrompt()` says a foreground terminal is attached AND the
+ * process is not a self-update re-exec, so the unattended restart the timer
+ * was defending against cannot reach a prompt. What the timer actually did
+ * was refuse a person who went to read the list, make a coffee, or answer a
+ * message — "no answer in 60s — nothing started" — on the one path where
+ * nothing has been started yet and waiting costs nothing. The owner's ruling,
+ * verbatim: "why is there an answer time limit, remove that." So `timeoutMs`
+ * is OPTIONAL now and the start path passes none; a caller that has a real
+ * reason to bound a wait (the install prompt, where silence is "no") may
+ * still pass one. The signal handlers stay — they were never about the timer,
+ * they are what keeps a backgrounded job from freezing.
  */
 
 import { readFileSync } from 'node:fs';
@@ -80,11 +96,21 @@ export function canPrompt() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY) && inForeground();
 }
 
+/** A timer only when a caller asked for one. `clearTimeout(null)` is a no-op,
+ *  so the finally blocks need no branch. Non-finite or non-positive means
+ *  "wait for the person". */
+export function boundedTimer(timeoutMs, fire) {
+  return Number.isFinite(timeoutMs) && timeoutMs > 0 ? setTimeout(fire, timeoutMs) : null;
+}
+
 /**
- * Ask, and come back no matter what. Resolves the trimmed answer, or `null`
- * when nobody answered within `timeoutMs` — the caller decides what silence
- * means, because it is not the same answer everywhere (the binding confirm
- * serves unbound; the project picker refuses, exactly as it does headless).
+ * Ask, and come back with an answer or a refusal. Resolves the trimmed
+ * answer, or `null` when the read failed (stdin closed under us, the terminal
+ * went away) or — only when a caller passed a finite `timeoutMs` — when nobody
+ * answered in time. With no `timeoutMs` it waits for the person; see the
+ * header. The caller decides what `null` means, because it is not the same
+ * answer everywhere (the binding confirm serves unbound; the project picker
+ * refuses, exactly as it does headless).
  */
 export async function askWithTimeout(query, timeoutMs) {
   const noop = () => {};
@@ -97,7 +123,7 @@ export async function askWithTimeout(query, timeoutMs) {
     output: process.stdout,
   });
   const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  const timer = boundedTimer(timeoutMs, () => ac.abort());
   try {
     return (await rl.question(query, { signal: ac.signal })).trim();
   } catch {
@@ -153,15 +179,15 @@ const MENU_FOOTER = '↑/↓ move · enter select · 1–9 jump · esc cancel';
  * An arrow-navigable picker for the start path. Resolves one of:
  *   { index }        the row taken
  *   { cancelled }    Esc/q/Ctrl-C
- *   { timedOut }     nobody drove it within timeoutMs
+ *   { timedOut }     a caller passed `timeoutMs` and nobody drove it in time
+ *                    (the start path passes none — see the header)
  *   { unsupported }  no raw mode — the caller uses the numeric prompt instead
  *
- * Held to this file's one law — no start-path prompt may hang the daemon — the
- * same way `askWithTimeout` is: it keeps the timeout, installs the
- * SIGTTIN/SIGTTOU no-ops that keep that timer alive, restores the terminal in
- * every exit, and refuses (returns `unsupported`) rather than half-drawing when
- * raw mode is not really there. The caller still gates on `canPrompt()` before
- * ever reaching here.
+ * Held to this file's one law — no start-path prompt may STOP the daemon — the
+ * same way `askWithTimeout` is: it installs the SIGTTIN/SIGTTOU no-ops,
+ * restores the terminal in every exit, and refuses (returns `unsupported`)
+ * rather than half-drawing when raw mode is not really there. The caller still
+ * gates on `canPrompt()` before ever reaching here.
  */
 export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
   if (!menuSupported()) return { unsupported: true };
@@ -220,7 +246,7 @@ export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
     };
     process.on('SIGTTIN', noop);
     process.on('SIGTTOU', noop);
-    const timer = setTimeout(() => finish({ timedOut: true }), timeoutMs);
+    const timer = boundedTimer(timeoutMs, () => finish({ timedOut: true }));
     try {
       stdin.setRawMode(true);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.90.0",
+  "version": "0.91.1",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {