flowviant 0.91.0 → 0.91.2

package/bin/cli.mjs

@@ -350,15 +350,14 @@ if (process.argv[2] === 'env') {
 const { canPrompt, askWithTimeout, selectMenu, menuSupported } = await import('./lib/tty.mjs');
 const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
 
-/** How long the one-time binding confirm waits before serving unbound. A person
- *  who just typed `flowviant` answers in seconds; anything longer is a restart
- *  nobody is watching, and the machine must not sit dark for it. */
-const CONFIRM_TIMEOUT_MS = 20_000;
-
-/** The picker's own budget. Longer than the confirm: this one asks you to READ
- *  a list before answering, and its fallback costs you a start rather than
- *  costing you a binding. */
-const PICK_TIMEOUT_MS = 60_000;
+/** NO ANSWER TIME LIMIT on the start path (2026-09-20, the owner: "why is
+ *  there an answer time limit, remove that"). The confirm below carried 20s
+ *  and the picker 60s, each arguing that a restart nobody is watching must
+ *  not sit dark on a prompt — but `interactive` already excludes exactly that
+ *  case (no foreground terminal, or a self-update re-exec, and nothing is
+ *  asked). What was left was a person reading a list being told "no answer
+ *  in 60s — nothing started". A prompt a person can see waits for the
+ *  person; tty.mjs's header carries the argument. */
 const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own
@@ -437,15 +436,7 @@ if (!FLEET_TOKEN) {
       const res = await selectMenu({
         options,
         defaultIndex: likely >= 0 ? likely : 0,
-        timeoutMs: PICK_TIMEOUT_MS,
       });
-      if (res.timedOut) {
-        console.error(
-          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
-            `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
-        );
-        process.exit(1);
-      }
       if (res.cancelled) {
         console.error('nothing chosen — nothing started.');
         process.exit(1);
@@ -460,12 +451,13 @@ if (!FLEET_TOKEN) {
       console.log(`  ${choices.length + 1}. ${loginLabel}`);
       const hint = likely >= 0 ? ` (enter for ${creds.projectLabel(choices[likely])})` : '';
       const raw = await askWithTimeout(
-        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `,
-        PICK_TIMEOUT_MS
+        `Which project should this daemon serve? [1-${choices.length + 1}]${hint} `
       );
       if (raw === null) {
+        // The read itself failed — stdin closed, or the terminal went away
+        // mid-question. Not a timeout: there is none.
         console.error(
-          `\nno answer in ${Math.round(PICK_TIMEOUT_MS / 1000)}s — nothing started. ` +
+          `\ncould not read an answer — nothing started. ` +
             `Name one with \`--project <name|id>\`, or run \`flowviant\` here in the foreground and pick.`
         );
         process.exit(1);
@@ -519,7 +511,10 @@ if (!FLEET_TOKEN) {
   // stop here with the machine serving nothing. A guard that only works once
   // everyone already has it is not a guard.
   //
-  // ON TIMEOUT WE SERVE, AND WE DO NOT BIND. Those are two decisions:
+  // IF THE READ FAILS WE SERVE, AND WE DO NOT BIND. (This used to say "on
+  // timeout"; there is no timeout since 2026-09-20 — a person at the prompt
+  // is waited for. `null` now means stdin closed under the question.) Those
+  // are two decisions:
   //  · SERVE, because it is what every version before 0.55.0 did with this
   //    exact store, so the silent path is the status quo rather than a new
   //    risk — and a daemon that answers is strictly better than one that does
@@ -531,13 +526,12 @@ if (!FLEET_TOKEN) {
   const creds = await import('./lib/credentials.mjs');
   const label = creds.projectLabel(CREDENTIAL.entry);
   const answered = await askWithTimeout(
-    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `,
-    CONFIRM_TIMEOUT_MS
+    `This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `
   );
-  const raw = answered === null ? null : answered.toLowerCase(); // null = nobody answered
+  const raw = answered === null ? null : answered.toLowerCase(); // null = the read failed
   if (raw === null) {
     console.log(
-      `\n  no answer in ${Math.round(CONFIRM_TIMEOUT_MS / 1000)}s — serving ${label} for this run ` +
+      `\n  could not read an answer — serving ${label} for this run ` +
         `without tying it to this repo. Run \`flowviant\` here and answer to make it stick.`
     );
   } else if (raw === '' || raw === 'y' || raw === 'yes') {

package/bin/lib/env-cli.mjs

@@ -130,7 +130,7 @@ export async function runEnvCommand(args) {
     // that file in every worktree.
     const targetFile = argAfter(args, '--file') ?? file.replace(/^\.\//, '');
     const bundle = await fetchBundle();
-    if (bundle.status !== 'enrolled') die('this machine is not enrolled — approve it in Settings → Environment first.');
+    if (bundle.status !== 'enrolled') die('this machine is not enrolled yet — leave `flowviant` running in this project; enrolment happens on its own within a poll or two.');
     if (!bundle.projectPub) die('no project env keypair yet — start the daemon once to bootstrap it.');
     const existing = new Map(bundle.keys.map((k) => [k.name, k]));
     let added = 0;
@@ -159,7 +159,7 @@ export async function runEnvCommand(args) {
     const name = args[1];
     if (!name || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) die('usage: flowviant env set <KEY> [--file <targetFile>]');
     const bundle = await fetchBundle();
-    if (bundle.status !== 'enrolled') die('this machine is not enrolled — approve it in Settings → Environment first.');
+    if (bundle.status !== 'enrolled') die('this machine is not enrolled yet — leave `flowviant` running in this project; enrolment happens on its own within a poll or two.');
     if (!bundle.projectPub) die('no project env keypair yet — start the daemon once to bootstrap it.');
     const prior = bundle.keys.find((k) => k.name === name);
     const targetFile = argAfter(args, '--file') ?? prior?.targetFile ?? '.env';
@@ -179,7 +179,7 @@ export async function runEnvCommand(args) {
 
   if (cmd === 'show') {
     const bundle = await fetchBundle();
-    if (bundle.status !== 'enrolled') die('this machine is not enrolled — approve it in Settings → Environment first.');
+    if (bundle.status !== 'enrolled') die('this machine is not enrolled yet — leave `flowviant` running in this project; enrolment happens on its own within a poll or two.');
     if (!bundle.wrappedPriv) die('no key material for this machine yet.');
     const kp = await ensureKeypair();
     const priv = sodium.crypto_box_seal_open(

package/bin/lib/env.mjs

@@ -5,15 +5,22 @@
  * server stores is ciphertext it cannot open.
  *
  * Duties per roster tick (handleRosterEnv):
- *  - register this machine's pubkey (once) → an admin approves in Settings.
+ *  - register this machine's pubkey (once) → that IS the enrolment (server
+ *    2026-09-20): the box already holds this project's machine credential,
+ *    which a person handed it by typing a device code into the app, so there is
+ *    nothing left for anybody to approve. Nobody clicks; nothing is printed
+ *    except one quiet line.
  *  - bootstrap the project keypair when none exists (first machine): generate
- *    it + a standing RECOVERY keypair wrapped under a one-time passphrase
- *    printed exactly once — rotations re-seal to the same recovery pub, so
- *    that passphrase survives forever.
+ *    it + a standing RECOVERY keypair wrapped under a one-time passphrase —
+ *    rotations re-seal to the same recovery pub, so that passphrase survives
+ *    forever. Bootstrap itself is SILENT since 2026-09-20: the passphrase is
+ *    parked in this box's keypair file and printed the first time this box
+ *    materializes a secret, which is the first moment it is about anything
+ *    (`stashRecoveryCode`).
  *  - sync: on a bundle version change, unwrap the priv, open every sealed
  *    value, cache (encrypted under a key derived from our own priv), and
  *    rematerialize env files into the agent worktrees.
- *  - execute wrap jobs (admin approved a new machine → seal the priv to it).
+ *  - execute wrap jobs (another box registered → seal the priv to it).
  *  - execute rotations (a machine was revoked → new keypair, re-seal all
  *    values, re-wrap every enrolled machine, re-seal recovery).
  *
@@ -66,33 +73,18 @@ export async function sodiumReady() {
   await sodium.ready;
 }
 
-/** 6-emoji key fingerprint — algorithm MUST match the web's pubkeyEmoji
- *  (EnvironmentSettings.tsx) so the human can compare terminal ↔ approve card. */
-// MUST stay byte-identical to the web's pubkeyEmoji (EnvironmentSettings.tsx) —
-// the human compares the two strings. 32 glyphs × 8 positions, effective ~40
-// bits. Two FNV-1a rolling hashes over the whole key + a murmur3 finalizer per
-// glyph (a plain additive sum collapsed the space to ~10 bits — grindable).
-const FP_EMOJI = ['🦊','🐙','🦕','🐝','🦉','🐬','🦁','🐸','🦄','🐢','🦋','🐺','🦜','🐳','🦔','🐌','🦩','🐿️','🦥','🐨','🦦','🐇','🦡','🦂','🦨','🐜','🦢','🐋','🦭','🐞','🦚','🐊'];
-export function pubkeyEmoji(pubkeyB64) {
-  let h1 = 0x811c9dc5 >>> 0;
-  let h2 = 0xc2b2ae35 >>> 0;
-  for (let i = 0; i < pubkeyB64.length; i++) {
-    const ch = pubkeyB64.charCodeAt(i);
-    h1 = Math.imul(h1 ^ ch, 0x01000193) >>> 0;
-    h2 = Math.imul(h2 ^ ch, 0x85ebca6b) >>> 0;
-  }
-  let out = '';
-  for (let i = 0; i < 8; i++) {
-    let x = (((i < 4 ? h1 : h2) + i * 0x9e3779b1) >>> 0);
-    x ^= x >>> 16;
-    x = Math.imul(x, 0x7feb352d) >>> 0;
-    x ^= x >>> 15;
-    x = Math.imul(x, 0x846ca68b) >>> 0;
-    x ^= x >>> 16;
-    out += FP_EMOJI[x & 31];
-  }
-  return out;
-}
+/*
+ * `pubkeyEmoji` IS DELETED (2026-09-20), and so is its byte-identical twin in
+ * the web app.
+ *
+ * It existed for exactly one gesture: the terminal printed eight glyphs, the
+ * browser's approve card printed the same eight, and a human compared them
+ * before pressing Approve. Registering IS enrolling now — the device code that
+ * gave this box the project's machine credential was the decision — so there is
+ * no approve card, no comparison, and nobody to make it. A fingerprint kept
+ * byte-identical across two repos for nobody to look at is worse than none:
+ * it reads like a live MITM defence and defends nothing.
+ */
 
 /** This machine's persistent keypair (created on first use, 0600). */
 export async function ensureKeypair() {
@@ -171,6 +163,120 @@ export function readStoredPubB64() {
   }
 }
 
+/**
+ * ── THE RECOVERY CODE WAITS UNTIL THERE IS SOMETHING TO RECOVER (2026-09-20) ──
+ *
+ * `bootstrapProject` used to end with the loudest artefact this product owns:
+ * a blank line, RECOVERY CODE in bold, a passphrase in yellow, and "the only
+ * way back into the secrets". That fired on the FIRST DAEMON OF EVERY PROJECT
+ * — a keypair is bootstrapped whether or not a single secret exists — so the
+ * overwhelming majority of the people who saw it were being handed a code for
+ * an empty vault, in custody vocabulary they had not asked for, having run
+ * `npx flowviant` to connect a machine. That is the same complaint the approve
+ * gate died of, printed instead of clicked, and leaving it in would have
+ * contradicted the change it shipped beside.
+ *
+ * So bootstrap is SILENT (one quiet line that the keypair exists) and the code
+ * is kept HERE, in this box's own keypair file, until the first time this box
+ * materializes a secret — the moment the person actually has something to
+ * protect, and the first moment the sentence is true.
+ *
+ * THE FILE IS THE RIGHT PLACE AND COSTS NOTHING. It already holds the private
+ * key the passphrase would recover — anybody who can read one can read the
+ * other — so storing it there adds no exposure that was not already the whole
+ * security model of this machine. It is 0600 and stays 0600.
+ *
+ * EXTENDING THE SHAPE IS SAFE. `ensureKeypair` reads `pub` and `priv` and
+ * ignores every other key, and it only WRITES the file when there is none, so
+ * an older daemon reading a file with a `recovery` field behaves identically
+ * and cannot clobber it.
+ *
+ * THE ONE ACCEPTED COST, stated: a box that bootstraps and never materializes
+ * anything never prints the code. That is the point — there is nothing to
+ * recover — and the code is not lost, it is on this disk beside the key.
+ */
+function readKeypairFile() {
+  try {
+    return JSON.parse(readFileSync(KEYPAIR_PATH, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** 0600 on every write, not just at creation: `writeFileSync`'s `mode` applies
+ *  only when the file is created, which is the same trap `materializeInto`
+ *  documents. Returns whether it landed — the caller has to know, because the
+ *  thing being written is unrecoverable if it does not. */
+function writeKeypairFile(stored) {
+  try {
+    writeFileSync(KEYPAIR_PATH, JSON.stringify(stored), { mode: 0o600 });
+    try {
+      chmodSync(KEYPAIR_PATH, 0o600);
+    } catch {
+      /* a filesystem without modes is not a reason to refuse */
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Park the bootstrap passphrase beside the key it recovers. False means it did
+ *  NOT land, and the caller's answer to that is to print it immediately —
+ *  losing a recovery code silently is the one outcome worse than printing it
+ *  early. */
+export function stashRecoveryCode(code, projectId) {
+  const stored = readKeypairFile();
+  if (!stored?.priv) return false;
+  stored.recovery = { code, projectId: projectId ?? null, shown: false };
+  return writeKeypairFile(stored);
+}
+
+/** Once per process at most, and once per box for real. */
+let recoveryUnprinted = true;
+
+function printRecoveryBlock(code) {
+  console.log('');
+  ok(`${c.cyan('env')} — this machine now holds this project's secrets.`);
+  console.log(`  ${c.bold('RECOVERY CODE')} ${c.dim('(shown ONCE — save it in a password manager):')}`);
+  console.log(`  ${c.bold(c.yellow(code))}`);
+  note('  If every enrolled machine is ever lost, this code is the only way back into the secrets.');
+  console.log('');
+}
+
+/**
+ * Print the parked code the first time this box writes a secret to disk, then
+ * mark it shown so it never prints again.
+ *
+ * The mark is written to the FILE, not just to the module flag, because "once"
+ * has to survive a restart. If that write fails the flag still stops this
+ * process from repeating itself and a later process prints again — noisy in
+ * the safe direction, which is the only direction available when the thing at
+ * stake is the only way back into somebody's secrets.
+ *
+ * The parked `projectId` is checked because the keypair file is per BOX while
+ * the code is per PROJECT: a daemon serves one project, so a mismatch means
+ * this code belongs to a different one and printing it here would attribute it
+ * to the wrong vault. An older stash carries no id and prints regardless.
+ */
+function printRecoveryCodeOnce() {
+  if (!recoveryUnprinted) return;
+  const stored = readKeypairFile();
+  const rec = stored?.recovery;
+  if (!rec?.code || rec.shown) {
+    recoveryUnprinted = false;
+    return;
+  }
+  if (rec.projectId && cachedProjectId && rec.projectId !== cachedProjectId) {
+    recoveryUnprinted = false; // one project per daemon — this will not change
+    return;
+  }
+  recoveryUnprinted = false;
+  printRecoveryBlock(rec.code);
+  stored.recovery = { ...rec, shown: true };
+  writeKeypairFile(stored);
+}
+
 /** Query params the roster poll carries: identity, materialized version, and
  *  the target files we REFUSED to write.
  *
@@ -623,6 +729,13 @@ export function materializeInto(wt) {
   if (anyProblem) cleanWorktrees.delete(wt);
   else cleanWorktrees.add(wt);
   everMaterialized = true;
+
+  // THE FIRST SECRET THIS BOX EVER WROTE TO DISK is the moment the recovery
+  // code stops being a warning about nothing — see `printRecoveryCodeOnce`.
+  // Gated on `written`, not on reaching this line: a pass that refused every
+  // file for a git reason materialized nothing, and the sentence would be
+  // false. Nothing is printed on any later pass.
+  if (written.length > 0) printRecoveryCodeOnce();
 }
 
 
@@ -664,8 +777,9 @@ export async function handleRosterEnv(env, { projectId } = {}) {
     // wedge registration until restart.
     if (env.status === 'none' && !registeredOnce) {
       const label = hostname() || 'daemon';
+      let registered = null;
       try {
-        await post('register', { pubkey: myPubB64(), label });
+        registered = await post('register', { pubkey: myPubB64(), label });
       } catch (e) {
         // A 429 = the project is at its machine cap; retrying every poll would
         // just hammer it. Stop for this session (a restart re-tries).
@@ -677,12 +791,45 @@ export async function handleRosterEnv(env, { projectId } = {}) {
         throw e; // transient — retry next poll (registeredOnce still false)
       }
       registeredOnce = true;
-      const fp = pubkeyEmoji(myPubB64());
-      info(`${c.cyan('env')}    · this machine requested env access as ${c.bold(label)}`);
-      note(`  fingerprint ${fp} — an admin approves it in Settings → Environment (compare the emoji).`);
+      /*
+       * ONE LINE, AND IT RELAYS WHAT THE SERVER ANSWERED.
+       *
+       * It used to print a key fingerprint and say "an admin approves it in
+       * Settings → Environment (compare the emoji)" — an instruction for a
+       * button that no longer exists, about a comparison nobody was making, on
+       * top of a credential this box was already trusted with. What replaced it
+       * asserted the opposite and just as blindly: "enrolled … secrets sync to
+       * this box automatically", printed whatever the response said. A fresh
+       * registration comes back `approved`, not `enrolled` — the key is not
+       * here yet and arrives only once some box that holds it polls — so the
+       * line was claiming a state this box was one or more ticks away from, and
+       * on an OLDER server (which still answers `pending`) it was claiming one
+       * the box would never reach at all.
+       *
+       * So the status is read off the response and each state says its own
+       * true sentence, and an answer we do not recognise — or no body at all —
+       * says only the part we measured: the registration went out.
+       */
+      const registeredAs = `${c.cyan('env')}    · registered as ${c.bold(label)}`;
+      if (registered?.status === 'enrolled') {
+        info(`${c.cyan('env')}    · enrolled as ${c.bold(label)} — secrets sync to this box automatically`);
+      } else if (registered?.status === 'approved') {
+        info(`${registeredAs} — secrets sync here as soon as a machine holding the key is online`);
+      } else if (registered?.status === 'pending') {
+        // An older server, which still has the approve gate. Say what IT is
+        // waiting on rather than what we are: this daemon cannot clear it.
+        info(`${registeredAs} — this server is waiting on an approval in Settings`);
+      } else {
+        info(registeredAs);
+      }
       return { changed: false };
     }
-    if (env.status === 'pending') return { changed: false }; // waiting on the admin
+    // A HARMLESS WAIT, and the server no longer produces this: registering IS
+    // enrolling since 2026-09-20, and a row left `pending` by the old gate is
+    // promoted on the register above. Kept because an OLDER server still
+    // answers `pending`, and a daemon must not treat an unrecognised state as a
+    // reason to act.
+    if (env.status === 'pending') return { changed: false };
     if (env.status === 'revoked') return { changed: false };
 
     // 2. Bootstrap: no project keypair exists — this machine creates it.
@@ -701,7 +848,9 @@ export async function handleRosterEnv(env, { projectId } = {}) {
     projectPriv = openSealed(bundle.wrappedPriv, keypair.publicKey, keypair.privateKey);
     const projectPub = sodium.from_base64(bundle.projectPub, B64());
 
-    // Execute approved enrollments: seal the priv to each new machine. The
+    // Execute pending enrollments: seal the priv to each newly registered
+    // machine. Registering is what puts a box on this list now — there is no
+    // approval step between the two. The
     // wrap's epoch rides along — the server rejects (stale) if a rotation moved
     // it since we fetched, so nobody enrolls with a dead key.
     if (bundle.pendingWraps.length) {
@@ -711,7 +860,7 @@ export async function handleRosterEnv(env, { projectId } = {}) {
       }));
       const res = await post('wraps', { pubkey: myPubB64(), keyEpoch: bundle.keyEpoch, wraps });
       if (res?.stale) note(`${c.cyan('env')} ${c.dim('— wraps raced a rotation; retrying next poll')}`);
-      else ok(`${c.cyan('env')} ${c.dim(`— delivered the key to ${wraps.length} newly approved machine${wraps.length === 1 ? '' : 's'}`)}`);
+      else ok(`${c.cyan('env')} ${c.dim(`— delivered the key to ${wraps.length} newly registered machine${wraps.length === 1 ? '' : 's'}`)}`);
     }
 
     // Decrypt the values we have — carrying each key's VERSION so a rotation can
@@ -777,9 +926,15 @@ export async function handleRosterEnv(env, { projectId } = {}) {
   }
 }
 
-/** First machine creates the project keypair + the standing recovery target.
- *  The recovery passphrase prints ONCE — rotations re-seal to the same
- *  recovery pub, so this passphrase works forever. */
+/**
+ * First machine creates the project keypair + the standing recovery target.
+ *
+ * THIS IS SILENT (2026-09-20). Rotations re-seal to the same recovery pub, so
+ * the passphrase minted here works forever — which is exactly why it does not
+ * have to be shouted at somebody who has no secrets yet. It is parked in this
+ * box's keypair file and printed the first time this box materializes a
+ * secret; `stashRecoveryCode`'s docblock carries the whole argument.
+ */
 async function bootstrapProject() {
   const project = sodium.crypto_box_keypair();
   const recovery = sodium.crypto_box_keypair();
@@ -816,10 +971,14 @@ async function bootstrapProject() {
     recoverySealed: seal(project.privateKey, sodium.to_base64(recovery.publicKey, B64())),
   });
 
-  console.log('');
-  ok(`${c.cyan('env')} — this machine created the project's env keypair.`);
-  console.log(`  ${c.bold('RECOVERY CODE')} ${c.dim('(shown ONCE — save it in a password manager):')}`);
-  console.log(`  ${c.bold(c.yellow(passphrase))}`);
-  note('  If every enrolled machine is ever lost, this code is the only way back into the secrets.');
-  console.log('');
+  // ONE QUIET LINE. The code goes into the keypair file and waits for the
+  // first secret. A stash that did NOT land is the one case that prints now:
+  // the passphrase exists only in this closure, and losing the only way back
+  // into a project's secrets to keep the terminal tidy is not a trade.
+  if (stashRecoveryCode(passphrase, cachedProjectId)) {
+    ok(`${c.cyan('env')} ${c.dim('— created this project\'s env keypair')}`);
+  } else {
+    warn('env: could not save the recovery code to this machine — here it is, once:');
+    printRecoveryBlock(passphrase);
+  }
 }

package/bin/lib/tty.mjs

@@ -19,13 +19,29 @@
  *
  *  2. `askWithTimeout()` — while asking, install no-op SIGTTIN/SIGTTOU handlers.
  *     A handler (even an empty one) replaces the default STOP, so a misjudged
- *     foreground check degrades to a read that fails or hangs — and a hang is
- *     something the timer can now actually interrupt, because the process is
- *     still running.
+ *     foreground check degrades to a read that fails rather than a process
+ *     that is frozen.
  *
  * The detection is best-effort by design and FAILS TOWARDS ASKING: an unknown
  * platform returns true, because refusing to prompt a human who IS there is a
- * worse failure than a prompt that times out on its own.
+ * worse failure than a prompt that waits.
+ *
+ * A PROMPT A PERSON IS LOOKING AT WAITS FOR THE PERSON (2026-09-20). Both
+ * helpers used to carry a mandatory timer — 20s on the binding confirm, 60s
+ * on the project picker — on the argument that "anything longer is a restart
+ * nobody is watching, and the machine must not sit dark for it". That
+ * argument was already answered one layer up: the start path never asks at
+ * all unless `canPrompt()` says a foreground terminal is attached AND the
+ * process is not a self-update re-exec, so the unattended restart the timer
+ * was defending against cannot reach a prompt. What the timer actually did
+ * was refuse a person who went to read the list, make a coffee, or answer a
+ * message — "no answer in 60s — nothing started" — on the one path where
+ * nothing has been started yet and waiting costs nothing. The owner's ruling,
+ * verbatim: "why is there an answer time limit, remove that." So `timeoutMs`
+ * is OPTIONAL now and the start path passes none; a caller that has a real
+ * reason to bound a wait (the install prompt, where silence is "no") may
+ * still pass one. The signal handlers stay — they were never about the timer,
+ * they are what keeps a backgrounded job from freezing.
  */
 
 import { readFileSync } from 'node:fs';
@@ -80,11 +96,21 @@ export function canPrompt() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY) && inForeground();
 }
 
+/** A timer only when a caller asked for one. `clearTimeout(null)` is a no-op,
+ *  so the finally blocks need no branch. Non-finite or non-positive means
+ *  "wait for the person". */
+export function boundedTimer(timeoutMs, fire) {
+  return Number.isFinite(timeoutMs) && timeoutMs > 0 ? setTimeout(fire, timeoutMs) : null;
+}
+
 /**
- * Ask, and come back no matter what. Resolves the trimmed answer, or `null`
- * when nobody answered within `timeoutMs` — the caller decides what silence
- * means, because it is not the same answer everywhere (the binding confirm
- * serves unbound; the project picker refuses, exactly as it does headless).
+ * Ask, and come back with an answer or a refusal. Resolves the trimmed
+ * answer, or `null` when the read failed (stdin closed under us, the terminal
+ * went away) or — only when a caller passed a finite `timeoutMs` — when nobody
+ * answered in time. With no `timeoutMs` it waits for the person; see the
+ * header. The caller decides what `null` means, because it is not the same
+ * answer everywhere (the binding confirm serves unbound; the project picker
+ * refuses, exactly as it does headless).
  */
 export async function askWithTimeout(query, timeoutMs) {
   const noop = () => {};
@@ -97,7 +123,7 @@ export async function askWithTimeout(query, timeoutMs) {
     output: process.stdout,
   });
   const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), timeoutMs);
+  const timer = boundedTimer(timeoutMs, () => ac.abort());
   try {
     return (await rl.question(query, { signal: ac.signal })).trim();
   } catch {
@@ -153,15 +179,15 @@ const MENU_FOOTER = '↑/↓ move · enter select · 1–9 jump · esc cancel';
  * An arrow-navigable picker for the start path. Resolves one of:
  *   { index }        the row taken
  *   { cancelled }    Esc/q/Ctrl-C
- *   { timedOut }     nobody drove it within timeoutMs
+ *   { timedOut }     a caller passed `timeoutMs` and nobody drove it in time
+ *                    (the start path passes none — see the header)
  *   { unsupported }  no raw mode — the caller uses the numeric prompt instead
  *
- * Held to this file's one law — no start-path prompt may hang the daemon — the
- * same way `askWithTimeout` is: it keeps the timeout, installs the
- * SIGTTIN/SIGTTOU no-ops that keep that timer alive, restores the terminal in
- * every exit, and refuses (returns `unsupported`) rather than half-drawing when
- * raw mode is not really there. The caller still gates on `canPrompt()` before
- * ever reaching here.
+ * Held to this file's one law — no start-path prompt may STOP the daemon — the
+ * same way `askWithTimeout` is: it installs the SIGTTIN/SIGTTOU no-ops,
+ * restores the terminal in every exit, and refuses (returns `unsupported`)
+ * rather than half-drawing when raw mode is not really there. The caller still
+ * gates on `canPrompt()` before ever reaching here.
  */
 export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
   if (!menuSupported()) return { unsupported: true };
@@ -220,7 +246,7 @@ export async function selectMenu({ options, defaultIndex = 0, timeoutMs }) {
     };
     process.on('SIGTTIN', noop);
     process.on('SIGTTOU', noop);
-    const timer = setTimeout(() => finish({ timedOut: true }), timeoutMs);
+    const timer = boundedTimer(timeoutMs, () => finish({ timedOut: true }));
     try {
       stdin.setRawMode(true);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.91.0",
+  "version": "0.91.2",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {