flowviant 0.92.0 → 0.92.1

package/README.md

@@ -38,7 +38,7 @@ It shows a short code. Open your project's **Workbench** in Flowviant and enter
 Prefer an explicit token? Create a machine credential in the app and pass it directly:
 
 ```bash
-FLOWVIANT_FLEET=fva_… npx flowviant@latest
+FLOWVIANT_MACHINE_TOKEN=fva_… npx flowviant@latest   # FLOWVIANT_FLEET still works
 ```
 
 Launch with `@latest` so each start pulls the newest published version — a bare `npx flowviant` can reuse a stale cache. A running daemon also keeps itself current: from **0.58.0** it restarts itself through `npx flowviant@latest` when a new version ships, so npx launches stay up to date the same way a global install does. (Before 0.58.0 that was only true of a global install — under npx the daemon printed a notice and stayed put, which is how machines ended up sitting several releases back.) It only ever restarts when no turn is running. `FLOWVIANT_NO_UPDATE=1` makes it nag-only; `flowviant update` updates now.
@@ -65,7 +65,7 @@ The daemon never executes anything the repository declares. An earlier version r
 
 | Env | What runs |
 | --- | --- |
-| _(stored login)_ or `FLOWVIANT_FLEET` | **the daemon** — the project's machine, serving its sessions |
+| _(stored login)_ or `FLOWVIANT_MACHINE_TOKEN` (`FLOWVIANT_FLEET` still read) | **the daemon** — the project's machine, serving its sessions |
 | `FLOWVIANT_SAFE=1` | restrict the toolset instead of running unattended |
 
 ## Not freezing the box

package/bin/cli.mjs

@@ -5,7 +5,7 @@
  *
  * ONE mode, one credential:
  *
- *   FLOWVIANT_FLEET=fva_…   npx flowviant@latest  # the machine daemon
+ *   FLOWVIANT_MACHINE_TOKEN=fva_…   npx flowviant@latest  # the machine daemon, headless
  *
  * `FLOWVIANT_TOKEN` (one worker, current checkout) and `FLOWVIANT_TOKENS` (a
  * comma list, one worktree each) stood beside it until 2026-08-19. Both ran the
@@ -46,7 +46,8 @@
  * because a daemon on another computer is invisible from here.
  *
  * Env:
- *   FLOWVIANT_FLEET     the machine credential (or use `flowviant login`).
+ *   FLOWVIANT_MACHINE_TOKEN  the machine credential (or use `flowviant login`);
+ *                        `FLOWVIANT_FLEET` is the old name and still works.
  *   FLOWVIANT_API_URL   default https://api.flowviant.com/api
  *   FLOWVIANT_MCP_URL   default <API_URL>/mcp
  *   FLOWVIANT_FLEET_URL default <API_URL>/fleet/agents
@@ -358,7 +359,10 @@ const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
  *  asked). What was left was a person reading a list being told "no answer
  *  in 60s — nothing started". A prompt a person can see waits for the
  *  person; tty.mjs's header carries the argument. */
-const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+const externalToken =
+  process.argv.includes('--fleet') ||
+  Boolean(process.env.FLOWVIANT_MACHINE_TOKEN) ||
+  Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own
  *  pattern: config.mjs read the store at IMPORT time, before the credential

package/bin/lib/childEnv.mjs

@@ -160,6 +160,7 @@ export function childEnv({ cwd, extra, deploy = false } = {}) {
  *  purpose: the default is what almost every caller gets, and the sample is
  *  about the default. */
 export const DROPPED_SAMPLE = [
+  'FLOWVIANT_MACHINE_TOKEN',
   'FLOWVIANT_FLEET',
   'FLOWVIANT_FLEET_URL',
   'FLOWVIANT_API_URL',

package/bin/lib/config.mjs

@@ -290,8 +290,20 @@ export const PROCESS_STARTED_AT = new Date(
 // ambiguous store with a picker, adoptStoredCredential updates every importer
 // before the daemon touches the network. Everything before that point (the
 // resolution, the flags) is settled synchronously at import, as it always was.
+// THE VARIABLE IS NAMED FOR WHAT IT IS (2026-09-21): `FLOWVIANT_MACHINE_TOKEN`.
+// The owner met `FLOWVIANT_FLEET=… npx flowviant` in the app's headless
+// credential panel and asked "what is flowviant fleet?" — a fair question,
+// because a FLEET was a pool of worker lanes deleted 2026-08-19 and the word
+// now names nothing a person can see. `FLOWVIANT_FLEET` stays as the fallback
+// forever: a CI runner somewhere may have it in its secrets, and a rename that
+// silently stops a headless box from authenticating is the substitution class
+// this codebase floors everything against.
 export let FLEET_TOKEN =
-  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || CREDENTIAL.entry?.fleetToken || '';
+  argFlag('--fleet') ||
+  process.env.FLOWVIANT_MACHINE_TOKEN ||
+  process.env.FLOWVIANT_FLEET ||
+  CREDENTIAL.entry?.fleetToken ||
+  '';
 
 /**
  * WHICH PROJECT THIS DAEMON SERVES, or null when nothing on this box names one.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.92.0",
+  "version": "0.92.1",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {