flowviant 0.94.0 → 0.96.0

package/README.md

@@ -41,8 +41,30 @@ Prefer an explicit token? Create a machine credential in the app and pass it dir
 FLOWVIANT_MACHINE_TOKEN=fva_… npx flowviant@latest   # FLOWVIANT_FLEET still works
 ```
 
+Prefer a plain command to `npx`? Install it once and every `npx flowviant@latest` in this README is just `flowviant`:
+
+```bash
+npm i -g flowviant
+flowviant login
+```
+
+Either way is fine and both stay current on their own (below). npx is the zero-install door; a global install is what you want on a box you keep running, so the daemon, `flowviant login` and `flowviant machines` are ordinary commands.
+
 Launch with `@latest` so each start pulls the newest published version — a bare `npx flowviant` can reuse a stale cache. A running daemon also keeps itself current: from **0.58.0** it restarts itself through `npx flowviant@latest` when a new version ships, so npx launches stay up to date the same way a global install does. (Before 0.58.0 that was only true of a global install — under npx the daemon printed a notice and stayed put, which is how machines ended up sitting several releases back.) It only ever restarts when no turn is running. `FLOWVIANT_NO_UPDATE=1` makes it nag-only; `flowviant update` updates now.
 
+## Machines on this box
+
+One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not — and a directory serves one project, so `npx flowviant` there refuses to start until one of them goes.
+
+On a terminal the listing is a menu: ↑/↓ over the projects, enter for what you can do about one, esc to leave. Two verbs, each acting on **this box's own connection** and nothing else:
+
+- **disconnect this box from it** — stops the daemon serving that project here (that one credential's daemon, never the others), removes this box from the project's machines list in the app, and forgets the credential here. `flowviant machines --remove <project id>` is the same thing for a script.
+- **forget it here only** — the credential is dropped from `~/.flowviant/credentials.json` and nothing else happens; the app keeps listing this box until it goes quiet. `--forget <project id>` for a script.
+
+Stopping or removing a daemon on **another** computer is done in the app (project settings → Machines), where the person pressing it can see what they are changing.
+
+**A directory serves one project.** `flowviant login` refuses to bind a second project to a repository that is already connected to one, and a store that already holds two projects for one repository refuses to start there — both name the projects and the remedy: delete the project you do not mean in Flowviant (project settings → General → Delete project), or disconnect this box from it with `flowviant machines`, then try again.
+
 ## Sessions
 
 Each tab in the Workbench is a persistent Claude session with its own worktree, and it stays where you left it — the branch outlives the tab. The daemon runs each turn in event mode and relays what the CLI is printing (thinking, reads, greps, commands) back to the tab, reports the worktree's branch and diffstat after every turn, and fetches a commit's patch when you click a sha in the app.

package/bin/cli.mjs

@@ -41,9 +41,15 @@
  * Ambiguity is a picker on a TTY and a worded refusal headless — never a
  * guess. `flowviant projects` lists what is stored; `--project <name|id>`
  * picks without a prompt. `flowviant machines` (0.91.0) asks the server which
- * BOXES have polled each of those credentials — the view-only answer to "am I
- * running duplicate or redundant daemons?", which the store alone cannot give
- * because a daemon on another computer is invisible from here.
+ * BOXES have polled each of those credentials — the answer to "am I running
+ * duplicate or redundant daemons?", which the store alone cannot give because
+ * a daemon on another computer is invisible from here; since 0.95.0 it says
+ * out loud when two projects are bound to one repo, and on a terminal it is a
+ * menu (↑/↓, enter) whose verbs disconnect THIS box from a project or forget
+ * a credential here — `--remove <id>` / `--forget <id>` for a script. A
+ * DIRECTORY SERVES ONE PROJECT: login refuses to bind a second project to a
+ * repo, and a store that already holds two for one repo refuses to start
+ * until one is deleted in the app or disconnected here.
  *
  * Env:
  *   FLOWVIANT_MACHINE_TOKEN  the machine credential (or use `flowviant login`);
@@ -82,7 +88,11 @@ import { runLogin } from './lib/login.mjs';
 // long-running process.
 if (process.argv[2] === 'login') {
   const noStart = process.argv.includes('--no-start');
-  await runLogin({ thenStart: !noStart });
+  const login = await runLogin({ thenStart: !noStart });
+  // A login the person CANCELLED at the second-project question saved nothing,
+  // so there is no credential for the child to serve — starting it would end
+  // in "no credential found" over a choice they just made on purpose.
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
   if (noStart) process.exit(0);
   // Re-exec as a plain `flowviant` rather than falling through. config.mjs reads
   // the credential at IMPORT time — which was before the login we just did — so
@@ -224,16 +234,19 @@ if (process.argv[2] === 'projects') {
 }
 
 // ── `flowviant machines` — every project connected on THIS box, and every box
-//    that has polled each of them.
+//    that has polled each of them; and, on a terminal, a menu over them.
 //
 // A THIRD COMMAND, and the owner's ruling it amends is his own: the terminal
 // surface is `npx flowviant` and `npx flowviant login`, full stop — which is
 // what deleted the old terminal flag for moving a machine — and he asked for
-// this one directly ("the CLI gets a command to list connections"). So it is
-// amended in the narrowest form that ruling allows: VIEW-ONLY. It starts
-// nothing, stops nothing, moves nothing, takes no lock and reaches no daemon.
-// The only state it can change is this box's credential file, and only behind
-// an explicit `--forget`.
+// this one directly ("the CLI gets a command to list connections"). It shipped
+// VIEW-ONLY, and on 2026-09-23 he asked for the rest: "it seems to be only a
+// read cmd but I want to be able to interact with it and use arrow keys to
+// select the machines or to remove them." So: the listing, then — only where a
+// person can drive one — a menu. Its verbs act on THIS BOX'S OWN CONNECTIONS
+// (stop the daemon here, leave the project's list in the app, forget the
+// credential here) and never on another computer's daemon; machines.mjs
+// carries the argument.
 //
 // The question is the owner's, verbatim: "is there a way to view ALL the
 // connected flowviants? because im not sure if i have any duplicate or
@@ -250,14 +263,16 @@ if (process.argv[2] === 'projects') {
 //
 // EXIT 0 whatever it finds, including nothing: the listing is the answer the
 // asker came for, and a non-zero code over "you have no projects connected"
-// would make this command unusable in anything that checks one.
+// would make this command unusable in anything that checks one. `--remove`
+// is the one exit that can be 1, when the daemon it had to stop would not.
 if (process.argv[2] === 'machines') {
   const creds = await import('./lib/credentials.mjs');
   const forgetAt = process.argv.indexOf('--forget');
   if (forgetAt >= 0) {
-    // THE ONE WRITE. Named explicitly, matched by full id or a ≥6 prefix, and
-    // AMBIGUITY REFUSES rather than guessing — this deletes a credential, and
-    // two projects that look alike is the case that produced the command.
+    // THE LOCAL-ONLY WRITE. Named explicitly, matched by full id or a ≥6
+    // prefix, and AMBIGUITY REFUSES rather than guessing — this deletes a
+    // credential, and two projects that look alike is the case that produced
+    // the command.
     const res = creds.forgetStoredProject(process.argv[forgetAt + 1]);
     if (res.error) {
       console.error(`error: ${res.error}`);
@@ -269,16 +284,29 @@ if (process.argv[2] === 'machines') {
     );
     process.exit(0);
   }
+  const { boxesUrlFrom, leaveUrlFrom, fetchBoxesFor, renderMachines, disconnectHere, realDisconnectDeps, MACHINES_FOOTER, MACHINES_FLAGS_FOOTER } =
+    await import('./lib/machines.mjs');
+  const { FLEET_URL } = await import('./lib/config.mjs');
+  const removeAt = process.argv.indexOf('--remove');
+  if (removeAt >= 0) {
+    // THE SCRIPTED DISCONNECT — the menu's first verb, named by id for a
+    // terminal nobody is sitting at. Same matcher and the same refusal of an
+    // ambiguous prefix as --forget: a name two projects share is exactly the
+    // input this command exists to untangle, and it must not pick one.
+    const m = creds.matchStoredProject(process.argv[removeAt + 1]);
+    if (m.error) {
+      console.error(`error: ${m.error}. \`flowviant machines\` lists what is stored.`);
+      process.exit(1);
+    }
+    const res = await disconnectHere(m.entry, await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL) }));
+    process.exit(res.ok ? 0 : 1);
+  }
 
-  const entries = creds.listStoredProjects();
+  let entries = creds.listStoredProjects();
   if (entries.length === 0) {
     console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
     process.exit(0);
   }
-  const { boxesUrlFrom, fetchBoxesFor, renderMachines, MACHINES_FOOTER } = await import(
-    './lib/machines.mjs'
-  );
-  const { FLEET_URL } = await import('./lib/config.mjs');
   // OUR OWN BOX ID, so the listing can mark "← this box".
   //
   // READ, NEVER CREATED. This called `ensureKeypair()` until 2026-09-19, which
@@ -299,16 +327,83 @@ if (process.argv[2] === 'machines') {
     /* unreadable keypair — nothing is marked, and nothing is claimed */
   }
   const url = boxesUrlFrom(FLEET_URL);
-  const results = {};
-  // SEQUENTIAL, not a fan-out: this is a handful of credentials on somebody's
-  // laptop, and a parallel burst against the API buys nothing a person waiting
-  // two seconds can perceive.
-  for (const e of entries) {
-    results[e.projectId] = await fetchBoxesFor(e, { url, envpub: me });
+  const listing = async () => {
+    const results = {};
+    // SEQUENTIAL, not a fan-out: this is a handful of credentials on somebody's
+    // laptop, and a parallel burst against the API buys nothing a person
+    // waiting two seconds can perceive.
+    for (const e of entries) {
+      results[e.projectId] = await fetchBoxesFor(e, { url, envpub: me });
+    }
+    console.log('');
+    for (const line of renderMachines(entries, results)) console.log(line);
+    console.log('');
+  };
+  await listing();
+
+  // THE MENU, only where a person can drive one. `canPrompt()` is the same
+  // gate the start path keeps — a backgrounded job or a pipe gets the listing
+  // and the flags, never a prompt that stops the process — and `menuSupported`
+  // is whether ↑/↓ can be read at all. Without both this is the command it was.
+  const { canPrompt, menuSupported, selectMenu, askWithTimeout } = await import('./lib/tty.mjs');
+  if (!(canPrompt() && menuSupported())) {
+    for (const line of MACHINES_FOOTER) console.log(line);
+    for (const line of MACHINES_FLAGS_FOOTER) console.log(line);
+    process.exit(0);
+  }
+  const deps = await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL) });
+  for (;;) {
+    // A ROW PER PROJECT connected on this box — the things this box can act on.
+    // The other computers under each project are printed above for the
+    // duplicate to be visible, and are not rows here: stopping or removing
+    // THEM is the app's verb, and a menu row that answers "not from here" is
+    // a control wired to a refusal.
+    console.log('  projects connected on this box — enter one for what you can do about it:');
+    const rowLabel = (e) => creds.projectRowLabel(e, entries) + (e.repoRoot ? `  — ${e.repoRoot}` : '  — not tied to a repo');
+    const pick = await selectMenu({ options: [...entries.map(rowLabel), 'done'] });
+    if (pick.cancelled || pick.unsupported || pick.index === entries.length) break;
+    const picked = entries[pick.index];
+    const who = creds.projectRowLabel(picked, entries);
+    // TWO VERBS, each row saying its whole consequence — the app's ⋯ menu on a
+    // machine row says the same two things, and a menu whose rows are verbs
+    // with the outcome in a manual somewhere is one you have to be sure about
+    // before you can use it.
+    const action = await selectMenu({
+      options: [
+        `disconnect this box from ${who} — stops its daemon here, removes this box from its machines list in the app, forgets its credential here`,
+        `forget ${who} here only — nothing is stopped; the app keeps listing this box until it goes quiet`,
+        'back',
+      ],
+    });
+    if (action.cancelled || action.unsupported || action.index === 2) continue;
+    // ONE CONFIRM, in words, because both verbs delete a credential and the
+    // arrow keys make a slip cheap. A read that failed (stdin gone) is "no".
+    const verb = action.index === 0 ? 'Disconnect this box from' : 'Forget';
+    const answer = await askWithTimeout(`  ${verb} ${who}? [y/N] `);
+    if (!/^y(es)?$/i.test(answer ?? '')) {
+      console.log('  left as it was.\n');
+      continue;
+    }
+    if (action.index === 0) {
+      await disconnectHere(picked, deps, { log: (m) => console.log(`  ${m}`) });
+    } else {
+      const res = creds.forgetStoredProject(picked.projectId);
+      console.log(
+        res.error
+          ? `  ${res.error}`
+          : `  forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box. Nothing was stopped or deleted anywhere else — \`flowviant login\` connects it again.`
+      );
+    }
+    entries = creds.listStoredProjects();
+    if (entries.length === 0) {
+      console.log('\n  no projects are connected on this box now.\n');
+      break;
+    }
+    // THE LISTING AGAIN, re-asked: the server's rows are the only true account
+    // of what the leave did, and a menu redrawn over a stale listing would be
+    // this command asserting the outcome it hoped for.
+    await listing();
   }
-  console.log('');
-  for (const line of renderMachines(entries, results)) console.log(line);
-  console.log('');
   for (const line of MACHINES_FOOTER) console.log(line);
   process.exit(0);
 }
@@ -368,7 +463,8 @@ const externalToken =
  *  pattern: config.mjs read the store at IMPORT time, before the credential
  *  existed, so this process cannot serve; the child can. */
 async function reexecAfterLogin() {
-  await runLogin({ thenStart: false });
+  const login = await runLogin({ thenStart: false });
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
   const { spawn } = await import('node:child_process');
   const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
@@ -378,7 +474,9 @@ async function reexecAfterLogin() {
 // the connected date to the COLLIDING rows only — production held two projects
 // both called "BRIF AI", both bound to the same checkout, so this picker
 // offered two identical lines and the only way to answer was to guess. See
-// credentials.mjs for why the suffix is not on every row.
+// credentials.mjs for why the suffix is not on every row. (That exact case is
+// a refusal now rather than a picker — a directory serves one project — but
+// two same-named projects can still meet in the no-match picker.)
 function listLines(entries, { projectRowLabel }) {
   return entries
     .map(
@@ -394,6 +492,20 @@ if (!FLEET_TOKEN) {
     console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
     process.exit(1);
   }
+  // A DIRECTORY SERVES ONE PROJECT (2026-09-23, the owner, verbatim: "a
+  // directory cannot have more than one project on flowviant. if one already
+  // exists, it would warn the user and ask them to delete the project on
+  // flowviant first. because 2 projects shouldnt be able to edit a directory
+  // at the same time."). This used to be a PICKER — two projects bound to one
+  // checkout, choose which this daemon serves — which is a control offering to
+  // do the forbidden thing politely. It is a refusal now, on a TTY and
+  // headless alike, naming both projects and the remedy. `credentialRefusal`
+  // is the same sentence login prints when it declines to bind a second one.
+  if (CREDENTIAL.reason === 'multiple-bound') {
+    const { directoryTakenRefusal } = await import('./lib/credentials.mjs');
+    console.error(directoryTakenRefusal(CREDENTIAL.choices, CREDENTIAL.repoRoot));
+    process.exit(1);
+  }
   if (CREDENTIAL.choices?.length && interactive) {
     const creds = await import('./lib/credentials.mjs');
     const { originSlug } = await import('./lib/git.mjs');
@@ -402,9 +514,7 @@ if (!FLEET_TOKEN) {
     console.log(
       CREDENTIAL.reason === 'outside-repo'
         ? 'flowviant is not inside a git repo, and more than one project is connected here.'
-        : CREDENTIAL.reason === 'multiple-bound'
-          ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
-          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+        : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
     );
 
     const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`;
@@ -413,16 +523,13 @@ if (!FLEET_TOKEN) {
     // this only decides which row the cursor starts on, using the repo's folder
     // name and its github repo-name against the stored project names. A unique
     // match becomes ONE keypress; a wrong guess costs nothing, because the human
-    // still confirms. `multiple-bound` gets no hint — every choice already names
-    // this repo, so nothing distinguishes them.
+    // still confirms. (Two projects bound to THIS repo never reach here: that
+    // is a refusal above, since 2026-09-23.)
     const slug = repoRoot ? originSlug(repoRoot) : null;
-    const likely =
-      CREDENTIAL.reason === 'multiple-bound'
-        ? -1
-        : creds.likelyChoiceIndex(choices, {
-            repoBasename: repoRoot ? basename(repoRoot) : null,
-            repoSlugName: slug ? slug.split('/')[1] : null,
-          });
+    const likely = creds.likelyChoiceIndex(choices, {
+      repoBasename: repoRoot ? basename(repoRoot) : null,
+      repoSlugName: slug ? slug.split('/')[1] : null,
+    });
 
     // Bounded like the confirm below, and for the same reason — but silence
     // means something DIFFERENT here and the difference is load-bearing. There

package/bin/lib/credentials.mjs

@@ -172,6 +172,97 @@ export function projectRowLabel(e, entries) {
   return `${label} (id ${String(e?.projectId ?? '').slice(0, 8)}…${when})`;
 }
 
+/**
+ * WHICH STORED PROJECTS SHARE ONE REPO — the duplicate the owner met and could
+ * not name (2026-09-23).
+ *
+ * `npx flowviant machines` printed "BRIF AI" twice, and he read it as two
+ * daemons or two "machine profiles" on one box for one project: *"when I go to
+ * BRIF AI to disconnect the duplicate, I only see one."* It was two PROJECTS
+ * with one name, both bound to one checkout — and the id-on-every-row rule
+ * (2026-09-19) had not made that legible, because two hex prefixes say
+ * "different" without saying "same repo". A project's Machines page shows its
+ * own credential's boxes, so neither page could show the other project at
+ * all.
+ *
+ * So the collision is stated as a FACT ABOUT THE REPO: every group of two or
+ * more entries bound to one directory, compared by realpath the way every
+ * other path here is. Pure over the entries; the listing prints each group as
+ * one line and the picker's row labels already carry the id and date.
+ *
+ * ONE REPO SERVES ONE PROJECT is the owner's own model ("i can have 1 daemon in
+ * one directory, 1 in another as a differentiator of projects"), which is why
+ * this is worth a sentence and an unbound duplicate is not: two projects with
+ * no repo are two things nothing has decided about yet.
+ */
+export function repoCollisions(entries) {
+  const groups = [];
+  for (const e of entries) {
+    if (!e?.repoRoot) continue;
+    const g = groups.find((x) => samePath(x.repoRoot, e.repoRoot));
+    if (g) g.entries.push(e);
+    else groups.push({ repoRoot: e.repoRoot, entries: [e] });
+  }
+  return groups.filter((g) => g.entries.length > 1);
+}
+
+/**
+ * THE OTHER PROJECTS ALREADY BOUND TO THIS REPO — what `flowviant login` asks
+ * about before it saves a second one (2026-09-23).
+ *
+ * The owner: *"im not sure how it even allowed me to run npx flowviant login
+ * twice and init a daemon twice on the same project/repository/directory in
+ * the first place."* Login binds the approved project to the repo it was run
+ * in and never looked at what was bound there already, so a second project —
+ * approved in a browser tab that happened to be open on a different project of
+ * the same name — landed beside the first without a word. The store's own
+ * resolution then turned every start into a picker between two identical
+ * rows.
+ *
+ * Excludes the project being logged into: re-running login for the SAME
+ * project is an upsert and asks nothing.
+ */
+export function boundElsewhere(entries, repoRoot, projectId) {
+  if (!repoRoot) return [];
+  return entries.filter((e) => e.projectId !== projectId && samePath(e.repoRoot, repoRoot));
+}
+
+/**
+ * THE REFUSAL, in one place, because two commands print it (2026-09-23).
+ *
+ * The owner, verbatim: "a directory cannot have more than one project on
+ * flowviant. if one already exists, it would warn the user and ask them to
+ * delete the project on flowviant first. because 2 projects shouldnt be able
+ * to edit a directory at the same time." So `flowviant login` refuses to bind
+ * a second project to a repo, and a start in a repo the store already holds
+ * two projects for refuses to serve either — the picker that used to stand
+ * there was a control offering to do the forbidden thing politely.
+ *
+ * It names every project on the directory, the rule, and the remedy in the
+ * owner's own order: delete the project in Flowviant first. The disconnect
+ * this box can do on its own (`flowviant machines`) is named second, for the
+ * case where the project must survive somewhere else — it satisfies the same
+ * rule, because a project this box no longer serves cannot edit the directory
+ * from here.
+ */
+export function directoryTakenRefusal(bound, repoRoot, { incoming } = {}) {
+  // Every project in the sentence is labelled against the WHOLE set, the
+  // incoming one included: a refusal reading "already connected to BRIF AI,
+  // so BRIF AI was not connected" is the puzzle it exists to end.
+  const all = [...bound, ...(incoming ? [incoming] : [])];
+  const names = bound.map((e) => projectRowLabel(e, all));
+  const list = names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}` : names[0];
+  const head = incoming
+    ? `${repoRoot} is already connected to ${list}, so ${projectRowLabel(incoming, all)} was not connected here.`
+    : `${repoRoot} is connected to ${list}.`;
+  return (
+    `${head}\n` +
+    'A directory serves one project — two projects must not edit it at the same time.\n' +
+    'Delete the project you do not mean in Flowviant first (project settings → General → Delete project),\n' +
+    'or disconnect this box from it with `flowviant machines`, then run this again.'
+  );
+}
+
 /** Collapse a name or slug for loose comparison: "My Project", "my-project"
  *  and "myproject" all become "myproject". */
 function normalizeName(s) {
@@ -332,6 +423,9 @@ export function matchStoredProject(ref) {
  * this returns. Shapes:
  *   { entry, source: 'project-flag' | 'repo' | 'only', needsConfirm? }
  *   { choices, reason: 'no-match' | 'multiple-bound' | 'outside-repo', repoRoot }
+ *     (`multiple-bound` is a REFUSAL in cli.mjs since 2026-09-23 — a directory
+ *     serves one project — and never a picker; the shape is kept because it
+ *     names the projects the refusal has to print)
  *   { none: true }
  *   { error }
  *

package/bin/lib/instance.mjs

@@ -780,6 +780,101 @@ function makeRelease(path) {
   return release;
 }
 
+/**
+ * ONE LOCK FILE, EXAMINED AND — IF IT NAMES A LIVE DAEMON WE CAN IDENTIFY —
+ * STOPPED. The per-file half of `stopAllDaemons`, split out (0.95.0) so that
+ * `stopDaemonFor` can run the identical ritual on ONE credential's lock: the
+ * `machines` command's disconnect stops the daemon serving the project being
+ * disconnected and must not touch the daemons serving anything else on the
+ * box, which a sweep of every lock cannot promise. Same tri-state, same
+ * sentences, same refusal to guess — there is one copy of this on purpose,
+ * for the reason `standDown` gives about SIGKILLs.
+ *
+ * `tally` is mutated in place: `running` counts locks naming a process we
+ * believe is, or might be, a daemon; the rest are what the caller reports.
+ */
+function stopLock(path, log, tally) {
+  const holder = readHolder(path);
+  if (!holder) return; // absent, truncated, half-written — no claim to answer
+  const where = holder.repoRoot ? ` in ${holder.repoRoot}` : '';
+  const what = holder.version ? ` ${holder.version}` : '';
+
+  if (!alive(holder.pid)) {
+    log(`pid ${holder.pid}${where} is already gone — nothing to stop.`);
+    return;
+  }
+  // Us. standDown refuses this too, but reaching it would print a stand-down
+  // line and then a failure for the one pid we are certain is not a daemon.
+  if (holder.pid === process.pid) return;
+
+  const identified = stillTheHolder(holder);
+  if (identified === false) {
+    // A live pid, but measured NOT to be the process that wrote this lock. The
+    // daemon is gone; the number was handed to something else. Not counted as
+    // running, and deliberately not counted as a failure either.
+    log(`pid ${holder.pid} is no longer the daemon that took this lock — nothing signalled.`);
+    return;
+  }
+  tally.running++;
+  if (identified === null) {
+    tally.unconfirmed++;
+    tally.failed++;
+    // NAMES BOTH CAUSES, because null has two and we did not measure which:
+    // the lock may carry no witness to match against (neither `entry` nor
+    // `startedAt` — a hand-edited or half-written file), or this host may hide
+    // the process from us (hidepid=2, a pid namespace, an image with no `ps`).
+    // "no readable /proc" alone is what takeover says, and said HERE it would
+    // assert a diagnosis nobody established — over a live process we are about
+    // to tell someone to kill.
+    // `kill` is not a command on Windows, where platform() is 'win32' and
+    // processStartedAt has no implementation at all — so EVERY lock lands in
+    // this branch and the whole command is a no-op that exits 1. Say that
+    // once, in the platform's own vocabulary, rather than handing someone a
+    // remedy their shell does not have.
+    const byHand =
+      platform() === 'win32'
+        ? `taskkill /PID ${holder.pid} /F`
+        : `kill ${holder.pid}`;
+    log(
+      `could not confirm that pid ${holder.pid} is still a flowviant daemon — its lock carries ` +
+        `nothing to match it against, or this host hides the process from us` +
+        `${platform() === 'win32' ? ' (identifying a process is not implemented on Windows)' : ''}` +
+        ` — so it was NOT signalled. Stop it by hand: ${byHand}`
+    );
+    return;
+  }
+
+  const bad = standDown(holder, path, log);
+  if (bad) {
+    tally.failed++;
+    log(`could not stop daemon pid ${holder.pid}${where}: ${bad.failed}`);
+    return;
+  }
+  tally.stopped++;
+  log(`stopped daemon${what} pid ${holder.pid}${where}.`);
+}
+
+/**
+ * STOP THE DAEMON SERVING ONE CREDENTIAL — `flowviant machines` disconnecting
+ * this box from one project (0.95.0).
+ *
+ * `stopAllDaemons` is the right shape for a person who does not know what is
+ * running; this is for a person who has just NAMED a project in a menu and
+ * expects exactly that project's daemon to stop. The lock is keyed on the
+ * credential (`instanceLockPath`), so the file to examine is known without a
+ * sweep, and a daemon serving a sibling project in another directory is never
+ * examined, let alone signalled.
+ *
+ * NO LOCK IS NOT AN ERROR: a project connected here but not currently running
+ * is the ordinary case for a disconnect, and the caller says "nothing was
+ * running" rather than failing. Returns the same tally `stopAllDaemons` does.
+ */
+export function stopDaemonFor(fleetToken, { log = (m) => console.log(m) } = {}) {
+  const tally = { stopped: 0, unconfirmed: 0, failed: 0, running: 0 };
+  stopLock(instanceLockPath(fleetToken), log, tally);
+  return tally;
+}
+
 /**
  * STOP EVERY FLOWVIANT DAEMON ON THIS MACHINE — `flowviant stop`.
  *
@@ -828,71 +923,9 @@ function makeRelease(path) {
  * exit code.
  */
 export function stopAllDaemons({ log = (m) => console.log(m) } = {}) {
-  let stopped = 0;
-  let unconfirmed = 0;
-  let failed = 0;
-  let running = 0; // locks naming a process we believe is, or might be, a daemon
-
-  for (const path of lockFiles()) {
-    const holder = readHolder(path);
-    if (!holder) continue; // absent, truncated, half-written — no claim to answer
-    const where = holder.repoRoot ? ` in ${holder.repoRoot}` : '';
-    const what = holder.version ? ` ${holder.version}` : '';
-
-    if (!alive(holder.pid)) {
-      log(`pid ${holder.pid}${where} is already gone — nothing to stop.`);
-      continue;
-    }
-    // Us. standDown refuses this too, but reaching it would print a stand-down
-    // line and then a failure for the one pid we are certain is not a daemon.
-    if (holder.pid === process.pid) continue;
-
-    const identified = stillTheHolder(holder);
-    if (identified === false) {
-      // A live pid, but measured NOT to be the process that wrote this lock. The
-      // daemon is gone; the number was handed to something else. Not counted as
-      // running, and deliberately not counted as a failure either.
-      log(`pid ${holder.pid} is no longer the daemon that took this lock — nothing signalled.`);
-      continue;
-    }
-    running++;
-    if (identified === null) {
-      unconfirmed++;
-      failed++;
-      // NAMES BOTH CAUSES, because null has two and we did not measure which:
-      // the lock may carry no witness to match against (neither `entry` nor
-      // `startedAt` — a hand-edited or half-written file), or this host may hide
-      // the process from us (hidepid=2, a pid namespace, an image with no `ps`).
-      // "no readable /proc" alone is what takeover says, and said HERE it would
-      // assert a diagnosis nobody established — over a live process we are about
-      // to tell someone to kill.
-      // `kill` is not a command on Windows, where platform() is 'win32' and
-      // processStartedAt has no implementation at all — so EVERY lock lands in
-      // this branch and the whole command is a no-op that exits 1. Say that
-      // once, in the platform's own vocabulary, rather than handing someone a
-      // remedy their shell does not have.
-      const byHand =
-        platform() === 'win32'
-          ? `taskkill /PID ${holder.pid} /F`
-          : `kill ${holder.pid}`;
-      log(
-        `could not confirm that pid ${holder.pid} is still a flowviant daemon — its lock carries ` +
-          `nothing to match it against, or this host hides the process from us` +
-          `${platform() === 'win32' ? ' (identifying a process is not implemented on Windows)' : ''}` +
-          ` — so it was NOT signalled. Stop it by hand: ${byHand}`
-      );
-      continue;
-    }
-
-    const bad = standDown(holder, path, log);
-    if (bad) {
-      failed++;
-      log(`could not stop daemon pid ${holder.pid}${where}: ${bad.failed}`);
-      continue;
-    }
-    stopped++;
-    log(`stopped daemon${what} pid ${holder.pid}${where}.`);
-  }
+  const tally = { stopped: 0, unconfirmed: 0, failed: 0, running: 0 };
+  for (const path of lockFiles()) stopLock(path, log, tally);
+  const { stopped, unconfirmed, failed, running } = tally;
 
   // WHAT WE ACTUALLY MEASURED IS LOCKS, so that is what this says. The old
   // sentence — "no flowviant daemon is running on this machine" — was asserted

package/bin/lib/login.mjs

@@ -7,7 +7,7 @@
  */
 
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
-import { saveLogin, detectRepoRoot, projectLabel } from './credentials.mjs';
+import { saveLogin, detectRepoRoot, projectLabel, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
@@ -73,6 +73,24 @@ export async function runLogin({ thenStart = false } = {}) {
         name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
         repoRoot,
       };
+      // A DIRECTORY SERVES ONE PROJECT (2026-09-23). The owner, verbatim: "a
+      // directory cannot have more than one project on flowviant. if one
+      // already exists, it would warn the user and ask them to delete the
+      // project on flowviant first. because 2 projects shouldnt be able to
+      // edit a directory at the same time." And his earlier question — "im not
+      // sure how it even allowed me to run npx flowviant login twice … on the
+      // same repository" — was answered by the fact that login never looked.
+      // It looks now, and REFUSES: the approval in the app minted or reused
+      // the project's credential either way, and a credential nobody holds is
+      // a row, not a machine. The refusal names both projects and the remedy
+      // (`directoryTakenRefusal`, shared with the daemon's own start).
+      const clash = boundElsewhere(listStoredProjects(), repoRoot, entry.projectId);
+      if (clash.length > 0) {
+        console.log('');
+        warn(directoryTakenRefusal(clash, repoRoot, { incoming: entry }));
+        console.log('');
+        return { saved: false };
+      }
       saveLogin(entry);
       ok(
         `connected to ${c.bold(projectLabel(entry))}` +
@@ -86,7 +104,7 @@ export async function runLogin({ thenStart = false } = {}) {
           ? `\n  ${c.dim('starting your agent — leave this running')}\n`
           : `\n  Now run:  ${c.bold('npx flowviant')}\n`
       );
-      return;
+      return { saved: true };
     }
     if (poll.status === 'expired') {
       warn('that code expired — run `flowviant login` again.');

package/bin/lib/machines.mjs

@@ -7,10 +7,30 @@
  * The terminal surface is `npx flowviant` and `npx flowviant login`, full stop.
  * That is the owner's own ruling and it is what deleted the terminal flag that
  * used to move a project's machine. This amends it BY HIS OWN REQUEST — "the CLI gets a command to list connections" —
- * and it is amended in the narrowest way the ruling can survive: this command
- * is VIEW-ONLY. It starts nothing, stops nothing, moves nothing and takes no
- * lock; the one thing it can change is the local credential file, and only
- * behind an explicit `--forget`. Every decision is still made in the app.
+ * and it shipped in the narrowest way the ruling could survive: VIEW-ONLY,
+ * starting nothing, stopping nothing, moving nothing, the one write behind an
+ * explicit `--forget`.
+ *
+ * ── AND IT GREW VERBS, ON HIS SECOND REQUEST (2026-09-23, 0.95.0) ──
+ *
+ * Verbatim: *"when i run npx flowviant machines, it just exits out of cli, it
+ * seems to be only a read cmd but I want to be able to interact with it and
+ * use arrow keys to select the machines or to remove them"* — and, of the
+ * duplicate it showed him, *"there should be a cli to remove it as well as a
+ * ui on flowviant to remove it."* So on a terminal that can draw a menu the
+ * listing is followed by one: ↑/↓ over the projects connected on THIS box,
+ * enter for a project's two verbs, esc to leave. Piped, or on a terminal with
+ * no raw mode, it is exactly the listing it was, and `--remove <id>` /
+ * `--forget <id>` are the same two verbs for a script.
+ *
+ * THE VERBS ACT ON THIS BOX'S OWN CONNECTIONS AND NOTHING ELSE. "Disconnect"
+ * stops the daemon serving that project HERE (one credential's lock, never a
+ * sweep), tells the app this box has left that project's machines list, and
+ * forgets the credential here — three things this box is entitled to do about
+ * itself. It does not stop, remove or move a daemon on another computer: those
+ * rows are printed under each project so the duplicate is visible, and the
+ * footer still says where THOSE verbs live. Decisions about other machines
+ * stay in the app, which is the ruling this amends and not the one it breaks.
  *
  * The question it answers is the owner's, verbatim: "is there a way to view ALL
  * the connected flowviants? because im not sure if i have any duplicate or
@@ -19,7 +39,12 @@
  * both named "BRIF AI" bound to the same checkout — which is why `npx
  * flowviant` there offered two identical picker rows. THE PROJECT ID IS
  * THEREFORE ALWAYS PRINTED: it is the only thing that tells those two apart,
- * and the whole listing is worth less without it.
+ * and the whole listing is worth less without it. **And since 0.95.0 the
+ * collision is SAID, not left to be noticed**: the id told him the rows were
+ * different projects, and he still read them as one project connected twice
+ * ("BRIF AI appears twice meaning I likely have 2 daemon or 'machine
+ * profiles' on my machine for the same BRIF AI project"). `renderCollisions`
+ * prints one line per repo that two projects are bound to, naming both.
  *
  * ── IT IS A RELAY ──
  *
@@ -47,6 +72,7 @@
  */
 
 import { USER_AGENT } from './config.mjs';
+import { projectLabel, repoCollisions } from './credentials.mjs';
 
 /** The boxes read, derived from the roster URL the way the diffstat post is —
  *  one place configures the API base and everything else is a suffix swap. */
@@ -54,6 +80,13 @@ export function boxesUrlFrom(fleetUrl) {
   return String(fleetUrl).replace(/\/agents\/?$/, '/boxes');
 }
 
+/** Where this box tells the server it has left a project — the boxes read's
+ *  own path with a verb on the end, so a server that has the read and not the
+ *  verb answers 404 and the caller says "older server" rather than guessing. */
+export function leaveUrlFrom(fleetUrl) {
+  return `${boxesUrlFrom(fleetUrl)}/leave`;
+}
+
 /** The one answer `agoFrom` gives that is a PHRASE rather than a duration, so
  *  it is the one answer that must not take an " ago" after it. Named because
  *  two callers have to agree about it and a bare string literal is how they
@@ -224,9 +257,45 @@ export function renderMachines(entries, results, { now = Date.now() } = {}) {
     }
     for (const b of boxes) lines.push(renderBox(b, { me: r.me, latest: r.latest }, now));
   }
+  const collisions = renderCollisions(entries);
+  if (collisions.length) lines.push('', ...collisions);
   return lines;
 }
 
+/** A project as ONE phrase for a sentence that names two of them — the name,
+ *  the id, and the connected date, which is the fact a person can match
+ *  against their own memory ("I set that one up last month"). */
+export function projectPhrase(e) {
+  const connected = connectedOn(e?.savedAt);
+  return `${projectLabel(e)} (${String(e?.projectId ?? '').slice(0, 8)}…${connected ? `, connected ${connected}` : ''})`;
+}
+
+/**
+ * TWO PROJECTS ON ONE REPO, SAID OUT LOUD (2026-09-23).
+ *
+ * The owner ran this command, saw "BRIF AI" twice, and concluded he had two
+ * daemons for one project. The id on each row said they were different
+ * projects; nothing said they were bound to the SAME checkout, which is the
+ * fact that makes it a duplicate rather than two rows. So the listing ends
+ * with one line per such repo, naming every project on it in full, the rule
+ * (a directory serves one project — the owner's 2026-09-23 ruling, which made
+ * the start there a refusal), and the remedy in his order: delete the project
+ * in Flowviant, or disconnect this box from it (the menu below, or the flags).
+ *
+ * Pure over the entries. An unbound project collides with nothing.
+ */
+export function renderCollisions(entries) {
+  return repoCollisions(entries).map((g) => {
+    const names = g.entries.map(projectPhrase);
+    const list = `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
+    return (
+      `  ! ${g.entries.length} projects are connected for ${g.repoRoot}: ${list} — ` +
+      'a directory serves one project, and `npx flowviant` there refuses to start until it does. ' +
+      'Delete the one you do not mean in Flowviant (project settings → General → Delete project), or disconnect this box from it.'
+    );
+  });
+}
+
 /**
  * THE FOOTER. Two sentences, both of which exist because this listing is the
  * moment somebody is confused — the same reason `flowviant projects` names its
@@ -245,6 +314,15 @@ export const MACHINES_FOOTER = [
   '  this lists the projects connected on THIS box; the app’s Home lists every machine on your account.',
 ];
 
+/** THE SCRIPT'S VERBS, said only when there was no menu to offer them in — a
+ *  terminal that could draw the menu was offered the same two things by name,
+ *  and repeating the flags under it would be a manual under a control. */
+export const MACHINES_FLAGS_FOOTER = [
+  '  `flowviant machines --remove <id>` disconnects this box from a project: stops its daemon here,',
+  '  removes this box from that project’s machines list in the app, and forgets its credential here.',
+  '  `--forget <id>` forgets the credential here only.',
+];
+
 /**
  * Ask one credential for its boxes. Never throws: every outcome is a shape the
  * renderer knows, because one dead project must not end the listing.
@@ -294,3 +372,136 @@ export function otherBoxesLine(boxes, me, now = Date.now()) {
   const more = others.length - parts.length;
   return `other machines on this project: ${parts.join(', ')}${more > 0 ? `, and ${more} more` : ''}`;
 }
+
+/**
+ * TELL THE SERVER THIS BOX HAS LEFT ONE PROJECT — `POST /fleet/boxes/leave`
+ * (0.95.0). Never throws; every outcome is a shape the caller can say in words.
+ *
+ * It is THIS box removing ITSELF: the body carries our own `envpub`, the same
+ * label every poll carries, and the server deletes our registry row for that
+ * credential outright — no stand-down, because the daemon that would take one
+ * has just been stopped by the same hand, and a stand-down waits on a poll
+ * that is not coming. If we were the box serving the project, the server says
+ * so (`wasHolder`) and the project has no machine until another one polls.
+ *
+ * A 404 is an OLDER SERVER (the read exists, the verb does not) and is kept
+ * apart from a 401/403, which is a credential the app has already killed: the
+ * first means "the row goes stale on its own, or remove it in the app", the
+ * second means "there was nothing to leave". Collapsing them is how a working
+ * credential gets described as dead.
+ */
+export async function leaveBoxFor(entry, { url, envpub, fetchImpl = fetch } = {}) {
+  if (!envpub) return { skipped: true };
+  try {
+    const res = await fetchImpl(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${entry.fleetToken}`,
+        'User-Agent': USER_AGENT,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ envpub }),
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (res.status === 401 || res.status === 403) return { rejected: true };
+    if (res.status === 404) return { unsupported: true };
+    if (!res.ok) return { error: `HTTP ${res.status}` };
+    const body = await res.json();
+    const data = body?.data;
+    if (!data || typeof data.removed !== 'boolean') return { error: 'unexpected answer shape' };
+    return { removed: data.removed, wasHolder: Boolean(data.wasHolder) };
+  } catch (e) {
+    return { error: String(e?.message ?? e) };
+  }
+}
+
+/**
+ * DISCONNECT THIS BOX FROM ONE PROJECT — the three steps, in the only order
+ * that is safe, with every outcome said as it happens (0.95.0).
+ *
+ *  1. STOP the daemon serving that credential HERE. One lock, identified
+ *     before it is signalled, through the same stand-down `flowviant stop`
+ *     uses — never a sweep, because the person named ONE project. A daemon
+ *     that is alive and could not be stopped ABORTS the disconnect: forgetting
+ *     a credential under a running daemon changes nothing about the daemon
+ *     (it holds the token in memory) and telling the server we have left while
+ *     it keeps polling is a row that comes back in ten seconds wearing the
+ *     name we just said was gone.
+ *  2. LEAVE in the app — see `leaveBoxFor`. Skipped, and said, when this box
+ *     has no identity file: a box that never ran a daemon never polled, so
+ *     the app has no row to remove.
+ *  3. FORGET the credential here. Last, so a failure in 1 or 2 leaves the
+ *     store able to try again.
+ *
+ * `deps` is injected so the ORDER and the SENTENCES are provable without a
+ * daemon, a socket or a credential file; `realDisconnectDeps` builds the live
+ * set. Returns `{ ok }`, false only when step 1 refused.
+ */
+export async function disconnectHere(entry, deps, { log = (m) => console.log(m) } = {}) {
+  const who = projectPhrase(entry);
+  const tally = deps.stopDaemon(entry.fleetToken);
+  if (tally.failed > 0) {
+    log(
+      `not disconnected from ${who}: a daemon for it is still running here and was not stopped. ` +
+        'Stop it first (the line above says how), then run this again.'
+    );
+    return { ok: false };
+  }
+  if (tally.running === 0) log(`no daemon for ${who} was running here.`);
+
+  const left = await deps.leave(entry);
+  if (left.skipped) {
+    log('this box has never run a daemon, so the app has no row of it to remove.');
+  } else if (left.rejected) {
+    log(`the app had already disconnected or deleted ${who} — nothing to leave.`);
+  } else if (left.unsupported) {
+    log(
+      'the app does not take a leave from a machine yet (older server) — its row goes quiet on its own, ' +
+        'or remove it in project settings → Machines.'
+    );
+  } else if (left.error) {
+    log(
+      `could not tell the app this box has left ${who} (${left.error}) — its row goes quiet on its own, ` +
+        'or remove it in project settings → Machines.'
+    );
+  } else if (!left.removed) {
+    log(`the app was not listing this box on ${who}.`);
+  } else {
+    log(
+      `removed this box from ${who}’s machines list in the app.` +
+        (left.wasHolder ? ' It was the machine serving that project, which has none until another polls.' : '')
+    );
+  }
+
+  const gone = deps.forget(entry.projectId);
+  if (gone.error) {
+    log(`could not forget the credential here: ${gone.error}`);
+    return { ok: false };
+  }
+  log(`forgot ${who}’s credential on this box. \`flowviant login\` in its repo connects it again.`);
+  return { ok: true };
+}
+
+/**
+ * THE LIVE DEPENDENCIES for `disconnectHere`, built lazily: `instance.mjs`
+ * and `env.mjs` are imported here and not at the top so that rendering the
+ * listing — the piped, scripted, most common use — loads nothing that reads a
+ * lock directory or a keypair. `readStoredPubB64` READS the key and never
+ * mints one, the rule the `machines` branch in cli.mjs is pinned to.
+ */
+export async function realDisconnectDeps({ url, log = (m) => console.log(m) } = {}) {
+  const { stopDaemonFor } = await import('./instance.mjs');
+  const { forgetStoredProject } = await import('./credentials.mjs');
+  let envpub = null;
+  try {
+    const env = await import('./env.mjs');
+    envpub = env.readStoredPubB64();
+  } catch {
+    /* unreadable keypair — the leave is skipped and said */
+  }
+  return {
+    stopDaemon: (fleetToken) => stopDaemonFor(fleetToken, { log: (m) => log(`  ${m}`) }),
+    leave: (entry) => leaveBoxFor(entry, { url, envpub }),
+    forget: (projectId) => forgetStoredProject(projectId),
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.94.0",
+  "version": "0.96.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {