flowviant 0.91.0 → 0.91.1

package/bin/cli.mjs

@@ -350,15 +350,14 @@ if (process.argv[2] === 'env') {
 const { canPrompt, askWithTimeout, selectMenu, menuSupported } = await import('./lib/tty.mjs');
 const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
 
-/** How long the one-time binding confirm waits before serving unbound. A person
- *  who just typed `flowviant` answers in seconds; anything longer is a restart
- *  nobody is watching, and the machine must not sit dark for it. */
-const CONFIRM_TIMEOUT_MS = 20_000;
-
-/** The picker's own budget. Longer than the confirm: this one asks you to READ
- *  a list before answering, and its fallback costs you a start rather than
- *  costing you a binding. */
-const PICK_TIMEOUT_MS = 60_000;
+/** NO ANSWER TIME LIMIT on the start path (2026-09-20, the owner: "why is
+ *  there an answer time limit, remove that"). The confirm below carried 20s
+ *  and the picker 60s, each arguing that a restart nobody is watching must
+ *  not sit dark on a prompt — but `interactive` already excludes exactly that
+ *  case (no foreground terminal, or a self-update re-exec, and nothing is
+ *  asked). What was left was a person reading a list being told "no answer
+ *  in 60s — nothing started". A prompt a person can see waits for the
+ *  person; tty.mjs's header carries the argument. */
 const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own
@@ -437,15 +436,7 @@ if (!FLEET_TOKEN) {
       const res = await selectMenu({
         options,
         defaultIndex: likely >= 0 ? likely : 0,
-        timeoutMs: PICK_TIMEOUT_MS,
       });
-      if (res.timedOut) {
-        console.error(
-          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
-            `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
-        );
-        process.exit(1);
-      }
       if (res.cancelled) {
         console.error('nothing chosen — nothing started.');
         process.exit(1);
@@ -460,12 +451,13 @@ if (!FLEET_TOKEN) {
       console.log(`  ${choices.length + 1}. ${loginLabel}`);
       const hint = likely >= 0 ? ` (enter for ${creds.projectLabel(choices[likely])})` : '';
       const raw = await askWithTimeout(
-        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `,
-        PICK_TIMEOUT_MS
+        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `
       );
       if (raw === null) {
+        // The read itself failed — stdin closed, or the terminal went away
+        // mid-question. Not a timeout: there is none.
         console.error(
-          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
+          `\ncould not read an answer — nothing started. ` +
             `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
         );
         process.exit(1);
@@ -519,7 +511,10 @@ if (!FLEET_TOKEN) {
   // stop here with the machine serving nothing. A guard that only works once
   // everyone already has it is not a guard.
   //
-  // ON TIMEOUT WE SERVE, AND WE DO NOT BIND. Those are two decisions:
+  // IF THE READ FAILS WE SERVE, AND WE DO NOT BIND. (This used to say "on
+  // timeout"; there is no timeout since 2026-09-20 — a person at the prompt
+  // is waited for. `null` now means stdin closed under the question.) Those
+  // are two decisions:
   //  · SERVE, because it is what every version before 0.55.0 did with this
   //    exact store, so the silent path is the status quo rather than a new
   //    risk — and a daemon that answers is strictly better than one that does
@@ -531,13 +526,12 @@ if (!FLEET_TOKEN) {
   const creds = await import('./lib/credentials.mjs');
   const label = creds.projectLabel(CREDENTIAL.entry);
   const answered = await askWithTimeout(
-    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `,
-    CONFIRM_TIMEOUT_MS
+    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `
   );
-  const raw = answered === null ? null : answered.toLowerCase(); // null = nobody answered
+  const raw = answered === null ? null : answered.toLowerCase(); // null = the read failed
   if (raw === null) {
     console.log(
-      `\n  no answer in ${Math.round(CONFIRM_TIMEOUT_MS / 1000)}s — serving ${label} for this run ` +
+      `\n  could not read an answer — serving ${label} for this run ` +
         `without tying it to this repo. Run \`flowviant\` here and answer to make it stick.`
     );
   } else if (raw === '' || raw === 'y' || raw === 'yes') {

package/bin/lib/tty.mjs

@@ -19,13 +19,29 @@
  *
  *  2. `askWithTimeout()` — while asking, install no-op SIGTTIN/SIGTTOU handlers.
  *     A handler (even an empty one) replaces the default STOP, so a misjudged
- *     foreground check degrades to a read that fails or hangs — and a hang is
- *     something the timer can now actually interrupt, because the process is
- *     still running.
+ *     foreground check degrades to a read that fails rather than a process
+ *     that is frozen.
  *
  * The detection is best-effort by design and FAILS TOWARDS ASKING: an unknown
  * platform returns true, because refusing to prompt a human who IS there is a
- * worse failure than a prompt that times out on its own.
+ * worse failure than a prompt that waits.
+ *
+ * A PROMPT A PERSON IS LOOKING AT WAITS FOR THE PERSON (2026-09-20). Both
+ * helpers used to carry a mandatory timer — 20s on the binding confirm, 60s
+ * on the project picker — on the argument that "anything longer is a restart
+ * nobody is watching, and the machine must not sit dark for it". That
+ * argument was already answered one layer up: the start path never asks at
+ * all unless `canPrompt()` says a foreground terminal is attached AND the
+ * process is not a self-update re-exec, so the unattended restart the timer
+ * was defending against cannot reach a prompt. What the timer actually did
+ * was refuse a person who went to read the list, make a coffee, or answer a
+ * message — "no answer in 60s — nothing started" — on the one path where
+ * nothing has been started yet and waiting costs nothing. The owner's ruling,
+ * verbatim: "why is there an answer time limit, remove that." So `timeoutMs`
+ * is OPTIONAL now and the start path passes none; a caller that has a real
+ * reason to bound a wait (the install prompt, where silence is "no") may
+ * still pass one. The signal handlers stay — they were never about the timer,
+ * they are what keeps a backgrounded job from freezing.
  */
 
 import { readFileSync } from 'node:fs';
@@ -80,11 +96,21 @@ export function canPrompt() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY) && inForeground();
 }
 
+/** A timer only when a caller asked for one. `clearTimeout(null)` is a no-op,
+ *  so the finally blocks need no branch. Non-finite or non-positive means
+ *  "wait for the person". */
+export function boundedTimer(timeoutMs, fire) {
+  return Number.isFinite(timeoutMs) && timeoutMs > 0 ? setTimeout(fire, timeoutMs) : null;
+}
+
 /**
- * Ask, and come back no matter what. Resolves the trimmed answer, or `null`
- * when nobody answered within `timeoutMs` — the caller decides what silence
- * means, because it is not the same answer everywhere (the binding confirm
- * serves unbound; the project picker refuses, exactly as it does headless).
+ * Ask, and come back with an answer or a refusal. Resolves the trimmed
+ * answer, or `null` when the read failed (stdin closed under us, the terminal
+ * went away) or — only when a caller passed a finite `timeoutMs` — when nobody
+ * answered in time. With no `timeoutMs` it waits for the person; see the
+ * header. The caller decides what `null` means, because it is not the same
+ * answer everywhere (the binding confirm serves unbound; the project picker
+ * refuses, exactly as it does headless).
  */
 export async function askWithTimeout(query, timeoutMs) {
   const noop = () => {};
@@ -97,7 +123,7 @@ export async function askWithTimeout(query, timeoutMs) {
     output: process.stdout,
   });
   const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  const timer = boundedTimer(timeoutMs, () => ac.abort());
   try {
     return (await rl.question(query, { signal: ac.signal })).trim();
   } catch {
@@ -153,15 +179,15 @@ const MENU_FOOTER = '↑/↓ move · enter select · 1–9 jump · esc cancel';
  * An arrow-navigable picker for the start path. Resolves one of:
  *   { index }        the row taken
  *   { cancelled }    Esc/q/Ctrl-C
- *   { timedOut }     nobody drove it within timeoutMs
+ *   { timedOut }     a caller passed `timeoutMs` and nobody drove it in time
+ *                    (the start path passes none — see the header)
  *   { unsupported }  no raw mode — the caller uses the numeric prompt instead
  *
- * Held to this file's one law — no start-path prompt may hang the daemon — the
- * same way `askWithTimeout` is: it keeps the timeout, installs the
- * SIGTTIN/SIGTTOU no-ops that keep that timer alive, restores the terminal in
- * every exit, and refuses (returns `unsupported`) rather than half-drawing when
- * raw mode is not really there. The caller still gates on `canPrompt()` before
- * ever reaching here.
+ * Held to this file's one law — no start-path prompt may STOP the daemon — the
+ * same way `askWithTimeout` is: it installs the SIGTTIN/SIGTTOU no-ops,
+ * restores the terminal in every exit, and refuses (returns `unsupported`)
+ * rather than half-drawing when raw mode is not really there. The caller still
+ * gates on `canPrompt()` before ever reaching here.
  */
 export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
   if (!menuSupported()) return { unsupported: true };
@@ -220,7 +246,7 @@ export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
     };
     process.on('SIGTTIN', noop);
     process.on('SIGTTOU', noop);
-    const timer = setTimeout(() => finish({ timedOut: true }), timeoutMs);
+    const timer = boundedTimer(timeoutMs, () => finish({ timedOut: true }));
     try {
       stdin.setRawMode(true);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.91.0",
+  "version": "0.91.1",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {