flowviant 0.95.0 → 0.96.0

package/README.md

@@ -54,7 +54,7 @@ Launch with `@latest` so each start pulls the newest published version — a bar
 
 ## Machines on this box
 
-One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not: every `npx flowviant` in that directory has to ask which of them to serve.
+One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not — and a directory serves one project, so `npx flowviant` there refuses to start until one of them goes.
 
 On a terminal the listing is a menu: ↑/↓ over the projects, enter for what you can do about one, esc to leave. Two verbs, each acting on **this box's own connection** and nothing else:
 
@@ -63,7 +63,7 @@ On a terminal the listing is a menu: ↑/↓ over the projects, enter for what y
 
 Stopping or removing a daemon on **another** computer is done in the app (project settings → Machines), where the person pressing it can see what they are changing.
 
-`flowviant login` asks before it binds a second project to a repository that is already connected to one: keep both (every start there asks which to serve), replace (the repo serves the new project and this box is disconnected from the old one), or cancel.
+**A directory serves one project.** `flowviant login` refuses to bind a second project to a repository that is already connected to one, and a store that already holds two projects for one repository refuses to start there — both name the projects and the remedy: delete the project you do not mean in Flowviant (project settings → General → Delete project), or disconnect this box from it with `flowviant machines`, then try again.
 
 ## Sessions
 

package/bin/cli.mjs

@@ -46,7 +46,10 @@
  * a daemon on another computer is invisible from here; since 0.95.0 it says
  * out loud when two projects are bound to one repo, and on a terminal it is a
  * menu (↑/↓, enter) whose verbs disconnect THIS box from a project or forget
- * a credential here — `--remove <id>` / `--forget <id>` for a script.
+ * a credential here — `--remove <id>` / `--forget <id>` for a script. A
+ * DIRECTORY SERVES ONE PROJECT: login refuses to bind a second project to a
+ * repo, and a store that already holds two for one repo refuses to start
+ * until one is deleted in the app or disconnected here.
  *
  * Env:
  *   FLOWVIANT_MACHINE_TOKEN  the machine credential (or use `flowviant login`);
@@ -89,7 +92,8 @@ if (process.argv[2] === 'login') {
   // A login the person CANCELLED at the second-project question saved nothing,
   // so there is no credential for the child to serve — starting it would end
   // in "no credential found" over a choice they just made on purpose.
-  if (noStart || !login?.saved) process.exit(0);
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
+  if (noStart) process.exit(0);
   // Re-exec as a plain `flowviant` rather than falling through. config.mjs reads
   // the credential at IMPORT time — which was before the login we just did — so
   // this process still has an empty FLEET_TOKEN and would exit with "no
@@ -460,7 +464,7 @@ const externalToken =
  *  existed, so this process cannot serve; the child can. */
 async function reexecAfterLogin() {
   const login = await runLogin({ thenStart: false });
-  if (!login?.saved) process.exit(0); // cancelled at the second-project question — nothing to serve
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
   const { spawn } = await import('node:child_process');
   const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
@@ -470,7 +474,9 @@ async function reexecAfterLogin() {
 // the connected date to the COLLIDING rows only — production held two projects
 // both called "BRIF AI", both bound to the same checkout, so this picker
 // offered two identical lines and the only way to answer was to guess. See
-// credentials.mjs for why the suffix is not on every row.
+// credentials.mjs for why the suffix is not on every row. (That exact case is
+// a refusal now rather than a picker — a directory serves one project — but
+// two same-named projects can still meet in the no-match picker.)
 function listLines(entries, { projectRowLabel }) {
   return entries
     .map(
@@ -486,6 +492,20 @@ if (!FLEET_TOKEN) {
     console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
     process.exit(1);
   }
+  // A DIRECTORY SERVES ONE PROJECT (2026-09-23, the owner, verbatim: "a
+  // directory cannot have more than one project on flowviant. if one already
+  // exists, it would warn the user and ask them to delete the project on
+  // flowviant first. because 2 projects shouldnt be able to edit a directory
+  // at the same time."). This used to be a PICKER — two projects bound to one
+  // checkout, choose which this daemon serves — which is a control offering to
+  // do the forbidden thing politely. It is a refusal now, on a TTY and
+  // headless alike, naming both projects and the remedy. `credentialRefusal`
+  // is the same sentence login prints when it declines to bind a second one.
+  if (CREDENTIAL.reason === 'multiple-bound') {
+    const { directoryTakenRefusal } = await import('./lib/credentials.mjs');
+    console.error(directoryTakenRefusal(CREDENTIAL.choices, CREDENTIAL.repoRoot));
+    process.exit(1);
+  }
   if (CREDENTIAL.choices?.length && interactive) {
     const creds = await import('./lib/credentials.mjs');
     const { originSlug } = await import('./lib/git.mjs');
@@ -494,9 +514,7 @@ if (!FLEET_TOKEN) {
     console.log(
       CREDENTIAL.reason === 'outside-repo'
         ? 'flowviant is not inside a git repo, and more than one project is connected here.'
-        : CREDENTIAL.reason === 'multiple-bound'
-          ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
-          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+        : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
     );
 
     const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`;
@@ -505,16 +523,13 @@ if (!FLEET_TOKEN) {
     // this only decides which row the cursor starts on, using the repo's folder
     // name and its github repo-name against the stored project names. A unique
     // match becomes ONE keypress; a wrong guess costs nothing, because the human
-    // still confirms. `multiple-bound` gets no hint — every choice already names
-    // this repo, so nothing distinguishes them.
+    // still confirms. (Two projects bound to THIS repo never reach here: that
+    // is a refusal above, since 2026-09-23.)
     const slug = repoRoot ? originSlug(repoRoot) : null;
-    const likely =
-      CREDENTIAL.reason === 'multiple-bound'
-        ? -1
-        : creds.likelyChoiceIndex(choices, {
-            repoBasename: repoRoot ? basename(repoRoot) : null,
-            repoSlugName: slug ? slug.split('/')[1] : null,
-          });
+    const likely = creds.likelyChoiceIndex(choices, {
+      repoBasename: repoRoot ? basename(repoRoot) : null,
+      repoSlugName: slug ? slug.split('/')[1] : null,
+    });
 
     // Bounded like the confirm below, and for the same reason — but silence
     // means something DIFFERENT here and the difference is load-bearing. There

package/bin/lib/credentials.mjs

@@ -227,6 +227,42 @@ export function boundElsewhere(entries, repoRoot, projectId) {
   return entries.filter((e) => e.projectId !== projectId && samePath(e.repoRoot, repoRoot));
 }
 
+/**
+ * THE REFUSAL, in one place, because two commands print it (2026-09-23).
+ *
+ * The owner, verbatim: "a directory cannot have more than one project on
+ * flowviant. if one already exists, it would warn the user and ask them to
+ * delete the project on flowviant first. because 2 projects shouldnt be able
+ * to edit a directory at the same time." So `flowviant login` refuses to bind
+ * a second project to a repo, and a start in a repo the store already holds
+ * two projects for refuses to serve either — the picker that used to stand
+ * there was a control offering to do the forbidden thing politely.
+ *
+ * It names every project on the directory, the rule, and the remedy in the
+ * owner's own order: delete the project in Flowviant first. The disconnect
+ * this box can do on its own (`flowviant machines`) is named second, for the
+ * case where the project must survive somewhere else — it satisfies the same
+ * rule, because a project this box no longer serves cannot edit the directory
+ * from here.
+ */
+export function directoryTakenRefusal(bound, repoRoot, { incoming } = {}) {
+  // Every project in the sentence is labelled against the WHOLE set, the
+  // incoming one included: a refusal reading "already connected to BRIF AI,
+  // so BRIF AI was not connected" is the puzzle it exists to end.
+  const all = [...bound, ...(incoming ? [incoming] : [])];
+  const names = bound.map((e) => projectRowLabel(e, all));
+  const list = names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}` : names[0];
+  const head = incoming
+    ? `${repoRoot} is already connected to ${list}, so ${projectRowLabel(incoming, all)} was not connected here.`
+    : `${repoRoot} is connected to ${list}.`;
+  return (
+    `${head}\n` +
+    'A directory serves one project — two projects must not edit it at the same time.\n' +
+    'Delete the project you do not mean in Flowviant first (project settings → General → Delete project),\n' +
+    'or disconnect this box from it with `flowviant machines`, then run this again.'
+  );
+}
+
 /** Collapse a name or slug for loose comparison: "My Project", "my-project"
  *  and "myproject" all become "myproject". */
 function normalizeName(s) {
@@ -387,6 +423,9 @@ export function matchStoredProject(ref) {
  * this returns. Shapes:
  *   { entry, source: 'project-flag' | 'repo' | 'only', needsConfirm? }
  *   { choices, reason: 'no-match' | 'multiple-bound' | 'outside-repo', repoRoot }
+ *     (`multiple-bound` is a REFUSAL in cli.mjs since 2026-09-23 — a directory
+ *     serves one project — and never a picker; the shape is kept because it
+ *     names the projects the refusal has to print)
  *   { none: true }
  *   { error }
  *

package/bin/lib/login.mjs

@@ -7,7 +7,7 @@
  */
 
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
-import { saveLogin, detectRepoRoot, projectLabel, listStoredProjects, boundElsewhere } from './credentials.mjs';
+import { saveLogin, detectRepoRoot, projectLabel, listStoredProjects, boundElsewhere, directoryTakenRefusal } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
@@ -27,58 +27,6 @@ async function post(url, body) {
   return j.data ?? j;
 }
 
-/**
- * THE THREE ANSWERS to "this repo is already connected to another project",
- * as menu rows — pure, so the wording is provable. Each row says its whole
- * consequence, the same rule the `machines` menu keeps: a verb whose outcome
- * lives in a manual is one you have to be sure about before you can use it.
- *
- *  keep     both stay; `npx flowviant` in this repo asks which to serve.
- *  replace  this repo serves the NEW project; this box is disconnected from
- *           the old one (its daemon here stopped, its row left in the app,
- *           its credential forgotten here) — the whole disconnect, because a
- *           half of it leaves a daemon running on a credential the store no
- *           longer names.
- *  cancel   nothing is saved. The approval in the app minted or reused the
- *           project's credential either way; a credential nobody holds is a
- *           row, not a machine.
- */
-export function secondProjectOptions(clash, entry, repoRoot) {
-  const olds = clash.map(projectLabel).join(' and ');
-  const now = projectLabel(entry);
-  return [
-    `keep both — every \`npx flowviant\` in ${repoRoot} asks whether to serve ${olds} or ${now}`,
-    `replace — ${repoRoot} serves ${now} from now on; this box is disconnected from ${olds} (its daemon here stopped, its credential forgotten here)`,
-    `cancel — save nothing; ${repoRoot} stays connected to ${olds}`,
-  ];
-}
-
-const DECISIONS = ['keep', 'replace', 'cancel'];
-
-/** Ask, on whatever this terminal can draw. No terminal to ask on: KEEP, and
- *  say so — a headless login must not hang, and refusing would strand a
- *  runner that had just been approved in the app. */
-async function secondProjectDecision({ clash, entry, repoRoot }) {
-  const { canPrompt, menuSupported, selectMenu, askWithTimeout } = await import('./tty.mjs');
-  const olds = clash.map(projectLabel).join(' and ');
-  console.log('');
-  warn(`${repoRoot} is already connected to ${olds} on this box.`);
-  if (!canPrompt()) {
-    console.log(`  keeping both — every \`npx flowviant\` there will ask which to serve; \`flowviant machines\` removes one.\n`);
-    return 'keep';
-  }
-  const options = secondProjectOptions(clash, entry, repoRoot);
-  if (menuSupported()) {
-    const res = await selectMenu({ options });
-    if (res.cancelled) return 'cancel';
-    if (!res.unsupported) return DECISIONS[res.index];
-  }
-  console.log(options.map((o, i) => `  ${i + 1}. ${o}`).join('\n'));
-  const raw = await askWithTimeout('  Which? [1-3] ');
-  const n = Number.parseInt(raw ?? '', 10);
-  return DECISIONS[n - 1] ?? 'cancel';
-}
-
 export async function runLogin({ thenStart = false } = {}) {
   console.log(`\n  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`login · v${VERSION}`)}\n`);
   let start;
@@ -125,28 +73,23 @@ export async function runLogin({ thenStart = false } = {}) {
         name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
         repoRoot,
       };
-      // A SECOND PROJECT ON A REPO IS A QUESTION, NEVER A SILENT SAVE
-      // (2026-09-23). The owner: "im not sure how it even allowed me to run
-      // npx flowviant login twice and init a daemon twice on the same
-      // project/repository/directory in the first place." It allowed it
-      // because it never looked: the approval names a project, this repo was
-      // already bound to a different one, and both landed in the store — after
-      // which every start here was a picker between two rows that read alike.
-      // Asked while the person is still at the terminal; headless, the save
-      // goes ahead and the fact is printed, because a CI runner cannot answer
-      // and a login that silently refused would be worse than one that said.
+      // A DIRECTORY SERVES ONE PROJECT (2026-09-23). The owner, verbatim: "a
+      // directory cannot have more than one project on flowviant. if one
+      // already exists, it would warn the user and ask them to delete the
+      // project on flowviant first. because 2 projects shouldnt be able to
+      // edit a directory at the same time." And his earlier question — "im not
+      // sure how it even allowed me to run npx flowviant login twice … on the
+      // same repository" — was answered by the fact that login never looked.
+      // It looks now, and REFUSES: the approval in the app minted or reused
+      // the project's credential either way, and a credential nobody holds is
+      // a row, not a machine. The refusal names both projects and the remedy
+      // (`directoryTakenRefusal`, shared with the daemon's own start).
       const clash = boundElsewhere(listStoredProjects(), repoRoot, entry.projectId);
       if (clash.length > 0) {
-        const decision = await secondProjectDecision({ clash, entry, repoRoot });
-        if (decision === 'cancel') {
-          console.log(`\n  nothing saved — ${repoRoot} stays connected to ${clash.map(projectLabel).join(' and ')}.\n`);
-          return { saved: false };
-        }
-        if (decision === 'replace') {
-          const { disconnectHere, realDisconnectDeps, leaveUrlFrom } = await import('./machines.mjs');
-          const deps = await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL), log: (m) => console.log(`  ${m}`) });
-          for (const old of clash) await disconnectHere(old, deps, { log: (m) => console.log(`  ${m}`) });
-        }
+        console.log('');
+        warn(directoryTakenRefusal(clash, repoRoot, { incoming: entry }));
+        console.log('');
+        return { saved: false };
       }
       saveLogin(entry);
       ok(

package/bin/lib/machines.mjs

@@ -277,10 +277,10 @@ export function projectPhrase(e) {
  * daemons for one project. The id on each row said they were different
  * projects; nothing said they were bound to the SAME checkout, which is the
  * fact that makes it a duplicate rather than two rows. So the listing ends
- * with one line per such repo, naming every project on it in full, and the
- * consequence the store already enforces: every start in that directory asks
- * which project to serve. It states no remedy of its own — the menu below it
- * (or the footer, when there is no menu) is where the verbs are.
+ * with one line per such repo, naming every project on it in full, the rule
+ * (a directory serves one project — the owner's 2026-09-23 ruling, which made
+ * the start there a refusal), and the remedy in his order: delete the project
+ * in Flowviant, or disconnect this box from it (the menu below, or the flags).
  *
  * Pure over the entries. An unbound project collides with nothing.
  */
@@ -290,8 +290,8 @@ export function renderCollisions(entries) {
     const list = `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
     return (
       `  ! ${g.entries.length} projects are connected for ${g.repoRoot}: ${list} — ` +
-      'one repo serves one project, so every `npx flowviant` there asks which. ' +
-      'If one of them is a duplicate, disconnect this box from it.'
+      'a directory serves one project, and `npx flowviant` there refuses to start until it does. ' +
+      'Delete the one you do not mean in Flowviant (project settings → General → Delete project), or disconnect this box from it.'
     );
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {