flowviant 0.92.0 → 0.93.0

package/README.md

@@ -38,7 +38,7 @@ It shows a short code. Open your project's **Workbench** in Flowviant and enter
 Prefer an explicit token? Create a machine credential in the app and pass it directly:
 
 ```bash
-FLOWVIANT_FLEET=fva_… npx flowviant@latest
+FLOWVIANT_MACHINE_TOKEN=fva_… npx flowviant@latest   # FLOWVIANT_FLEET still works
 ```
 
 Launch with `@latest` so each start pulls the newest published version — a bare `npx flowviant` can reuse a stale cache. A running daemon also keeps itself current: from **0.58.0** it restarts itself through `npx flowviant@latest` when a new version ships, so npx launches stay up to date the same way a global install does. (Before 0.58.0 that was only true of a global install — under npx the daemon printed a notice and stayed put, which is how machines ended up sitting several releases back.) It only ever restarts when no turn is running. `FLOWVIANT_NO_UPDATE=1` makes it nag-only; `flowviant update` updates now.
@@ -65,7 +65,7 @@ The daemon never executes anything the repository declares. An earlier version r
 
 | Env | What runs |
 | --- | --- |
-| _(stored login)_ or `FLOWVIANT_FLEET` | **the daemon** — the project's machine, serving its sessions |
+| _(stored login)_ or `FLOWVIANT_MACHINE_TOKEN` (`FLOWVIANT_FLEET` still read) | **the daemon** — the project's machine, serving its sessions |
 | `FLOWVIANT_SAFE=1` | restrict the toolset instead of running unattended |
 
 ## Not freezing the box

package/bin/cli.mjs

@@ -5,7 +5,7 @@
  *
  * ONE mode, one credential:
  *
- *   FLOWVIANT_FLEET=fva_…   npx flowviant@latest  # the machine daemon
+ *   FLOWVIANT_MACHINE_TOKEN=fva_…   npx flowviant@latest  # the machine daemon, headless
  *
  * `FLOWVIANT_TOKEN` (one worker, current checkout) and `FLOWVIANT_TOKENS` (a
  * comma list, one worktree each) stood beside it until 2026-08-19. Both ran the
@@ -46,7 +46,8 @@
  * because a daemon on another computer is invisible from here.
  *
  * Env:
- *   FLOWVIANT_FLEET     the machine credential (or use `flowviant login`).
+ *   FLOWVIANT_MACHINE_TOKEN  the machine credential (or use `flowviant login`);
+ *                        `FLOWVIANT_FLEET` is the old name and still works.
  *   FLOWVIANT_API_URL   default https://api.flowviant.com/api
  *   FLOWVIANT_MCP_URL   default <API_URL>/mcp
  *   FLOWVIANT_FLEET_URL default <API_URL>/fleet/agents
@@ -358,7 +359,10 @@ const interactive = canPrompt() && process.env.FLOWVIANT_REEXEC !== '1';
  *  asked). What was left was a person reading a list being told "no answer
  *  in 60s — nothing started". A prompt a person can see waits for the
  *  person; tty.mjs's header carries the argument. */
-const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+const externalToken =
+  process.argv.includes('--fleet') ||
+  Boolean(process.env.FLOWVIANT_MACHINE_TOKEN) ||
+  Boolean(process.env.FLOWVIANT_FLEET);
 
 /** Re-exec a plain `flowviant` after an inline login — the login command's own
  *  pattern: config.mjs read the store at IMPORT time, before the credential

package/bin/lib/agentPlan.mjs

@@ -157,6 +157,35 @@ export function parseProposal(text) {
   };
 }
 
+/**
+ * The running account, off whichever shape the turn ended with — `{ progress }`
+ * or nothing at all.
+ *
+ * A SPREAD RATHER THAN A FIELD, so an absent account produces no key on the
+ * result and therefore no key on the settle body. That is the whole contract
+ * with the server: absence means KEEP the last account, and an empty string
+ * sent instead would be indistinguishable from an agent saying the branch now
+ * amounts to nothing.
+ *
+ * AN ABSURDITY BOUND HERE, NOT THE DISPLAY CAP (corrected 2026-09-22, in
+ * review). This sliced to the wire's own 1000 first, which quietly INVERTED the
+ * order the caller's own comment claims to keep: `envScrub` replaces EXACT
+ * values, so handing it a paragraph already cut at 1000 hands it a credential
+ * cut in half — it matches nothing and the surviving prefix ships. The scrub is
+ * the only thing standing between a model that pasted a secret into its own
+ * summary and the wire, and a cap must never run ahead of it. So this is the
+ * same absurdity bound `summary` takes one line up (8000): enough that nothing
+ * a model writes reaches the caller unbounded, far enough above the 1000 the
+ * wire cuts to that the scrub always sees whole values. `work.mjs` scrubs and
+ * THEN cuts to 1000, and the server clamps again because the wire never trusts
+ * a machine to have clamped.
+ */
+const MAX_PROGRESS = 8000;
+const progressOf = (v) => {
+  const t = typeof v.progress === 'string' ? v.progress.trim() : '';
+  return t ? { progress: t.slice(0, MAX_PROGRESS) } : {};
+};
+
 /**
  * READING AN AGENT'S ANSWER at the end of a turn.
  *
@@ -170,6 +199,28 @@ export function parseProposal(text) {
  * `nothing`, which sends the agent to Stuck. Optimistic status from a machine
  * that quit is the one lie this board cannot afford, so anything ambiguous ends
  * up here rather than being read as success.
+ *
+ * ── AND IT CARRIES THE AGENT'S RUNNING ACCOUNT OF ITSELF (2026-09-22) ─────
+ *
+ * The owner: "we should add a brief summary of what the agent has done overall
+ * at the top that updates." `progress` is one more key on the SAME object —
+ * two or three cumulative sentences about the whole branch, rewritten fresh
+ * every turn — and it is read here because this is where everything the agent
+ * SAYS is already read. Nothing derives it: this file parses, it does not
+ * summarise, and a daemon that read the turn log and wrote its own paragraph
+ * would be the second brain the product forbids.
+ *
+ * ON BOTH SHAPES, because a turn that stopped to ask has still done work — an
+ * agent that built three quarters of a feature and then needed a decision is
+ * exactly the run whose account a person wants. It is NOT read off an
+ * unparseable turn, and that is not an omission: there is no object to read it
+ * from, and a `nothing` outcome means the CLI never got as far as saying
+ * anything about itself.
+ *
+ * MISSING IS MISSING. An older prompt, a resumed conversation that never saw
+ * the key, a model that dropped it — all of them leave it absent, and the
+ * caller omits the field rather than sending an empty string, so the server
+ * keeps the last account that was true instead of blanking the head.
  */
 export function parseTurnResult(text) {
   for (const v of candidateObjects(String(text ?? ''))) {
@@ -179,12 +230,13 @@ export function parseTurnResult(text) {
       // parks an agent with nothing to reply to. Treated as `nothing`, which
       // at least says truthfully that the machine went quiet.
       if (!question) continue;
-      return { outcome: 'question', answer: question.slice(0, 8000) };
+      return { outcome: 'question', answer: question.slice(0, 8000), ...progressOf(v) };
     }
     if (v.status === 'delivered') {
       return {
         outcome: 'delivered',
         answer: (typeof v.summary === 'string' ? v.summary : '').slice(0, 8000),
+        ...progressOf(v),
         raised: Array.isArray(v.raised)
           ? v.raised
               .filter((r) => r && typeof r.title === 'string' && r.title.trim())

package/bin/lib/childEnv.mjs

@@ -160,6 +160,7 @@ export function childEnv({ cwd, extra, deploy = false } = {}) {
  *  purpose: the default is what almost every caller gets, and the sample is
  *  about the default. */
 export const DROPPED_SAMPLE = [
+  'FLOWVIANT_MACHINE_TOKEN',
   'FLOWVIANT_FLEET',
   'FLOWVIANT_FLEET_URL',
   'FLOWVIANT_API_URL',

package/bin/lib/config.mjs

@@ -290,8 +290,20 @@ export const PROCESS_STARTED_AT = new Date(
 // ambiguous store with a picker, adoptStoredCredential updates every importer
 // before the daemon touches the network. Everything before that point (the
 // resolution, the flags) is settled synchronously at import, as it always was.
+// THE VARIABLE IS NAMED FOR WHAT IT IS (2026-09-21): `FLOWVIANT_MACHINE_TOKEN`.
+// The owner met `FLOWVIANT_FLEET=… npx flowviant` in the app's headless
+// credential panel and asked "what is flowviant fleet?" — a fair question,
+// because a FLEET was a pool of worker lanes deleted 2026-08-19 and the word
+// now names nothing a person can see. `FLOWVIANT_FLEET` stays as the fallback
+// forever: a CI runner somewhere may have it in its secrets, and a rename that
+// silently stops a headless box from authenticating is the substitution class
+// this codebase floors everything against.
 export let FLEET_TOKEN =
-  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || CREDENTIAL.entry?.fleetToken || '';
+  argFlag('--fleet') ||
+  process.env.FLOWVIANT_MACHINE_TOKEN ||
+  process.env.FLOWVIANT_FLEET ||
+  CREDENTIAL.entry?.fleetToken ||
+  '';
 
 /**
  * WHICH PROJECT THIS DAEMON SERVES, or null when nothing on this box names one.

package/bin/lib/prompts.mjs

@@ -777,6 +777,7 @@ END YOUR TURN WITH ONE JSON OBJECT AND NOTHING AFTER IT, in a \`\`\`json fence:
 {
   "status": "delivered",
   "summary": "one or two sentences on what you actually changed",
+  "progress": "two or three sentences on what you have done on this branch SO FAR, across every card",
   "raised": [{ "title": "short title", "brief": "what is wrong and what you did" }]
 }
 \`\`\`
@@ -786,13 +787,20 @@ or, if you are stopping to ask:
 \`\`\`json
 {
   "status": "blocked",
+  "progress": "two or three sentences on what you have done on this branch SO FAR, across every card",
   "question": "the specific thing you need decided, in one or two sentences"
 }
 \`\`\`
 
 "raised" is optional and only for work you did that was NOT this card. Do not
 list the card itself there. Do not put commit shas in the summary — they are
-read from git.`;
+read from git.
+
+"progress" is REQUIRED on both shapes. It is the running account a person reads
+at the top of this run, and it REPLACES the previous one whole — so write it
+fresh every turn, covering everything you have done on this branch so far and
+not only this card. Past tense, plain sentences, no commit shas and no card ids.
+"summary" is about this one card; "progress" is about the branch.`;
 
 /**
  * The turn itself.

package/bin/lib/work.mjs

@@ -5062,6 +5062,32 @@ export function createWorkManager({
         ...(commits.length ? { commits } : {}),
         ...(res.raised?.length ? { raised: res.raised } : {}),
         ...(usage ? { usage } : {}),
+        /**
+         * THE AGENT'S RUNNING ACCOUNT OF THIS BRANCH (2026-09-22).
+         *
+         * The owner: "we should add a brief summary of what the agent has done
+         * overall at the top that updates." A RELAY — the agent wrote it in its
+         * own final JSON object and nothing here composes, narrows or infers
+         * one. It rides only this settle, which is the one that follows a
+         * PARSED result: the two `nothing` settles above it come from a turn
+         * that declared no outcome at all, so there is no account to carry and
+         * inventing one would be the machine speaking for the agent.
+         *
+         * SCRUBBED BEFORE IT IS CUT, the order that matters and the one the
+         * check's output lane learned the expensive way: `envScrub` replaces
+         * EXACT values, so a paragraph capped first hands the scrub a
+         * credential already cut in half — it matches nothing and the surviving
+         * prefix ships. `parseTurnResult` trims it and bounds it for absurdity
+         * at 8000, DELIBERATELY above the 1000 below, so this slice is the
+         * first one a value of any interest meets and the scrub has already
+         * run when it does. The first cut of this feature bounded the parser at
+         * 1000 as well, which read identically and quietly put the cap first.
+         *
+         * OMITTED WHEN THE TURN DID NOT WRITE ONE, never sent empty. Absence is
+         * the server's signal to KEEP the last account that was true; an empty
+         * string would blank the head because a model dropped a key.
+         */
+        ...(res.progress ? { progress: envScrub(res.progress).slice(0, 1000) } : {}),
         branch,
         worktree: wt,
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.92.0",
+  "version": "0.93.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {