flowviant 0.96.0 → 0.99.0

package/bin/cli.mjs

@@ -487,6 +487,10 @@ function listLines(entries, { projectRowLabel }) {
     .join('\n');
 }
 
+/** A repo binding the person just consented to, persisted by runFleetDaemon
+ *  only after the instance lock is taken — never before a refusal. */
+let afterLock = null;
+
 if (!FLEET_TOKEN) {
   if (CREDENTIAL.error) {
     console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
@@ -589,7 +593,12 @@ if (!FLEET_TOKEN) {
       console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
     }
     adoptStoredCredential(picked);
-    creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
+    // BOUND ONLY ONCE THE START HAS THE LOCK. Written here, the answer moved
+    // the binding even when the instance lock then refused the start — a live
+    // daemon for the same project in its own checkout — and that daemon's next
+    // unattended self-update re-exec'd into a store that no longer bound its
+    // repo, found no match headless, and exited with the machine dark.
+    afterLock = () => creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
     console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
   } else if (CREDENTIAL.choices?.length) {
     const creds = await import('./lib/credentials.mjs');
@@ -646,7 +655,8 @@ if (!FLEET_TOKEN) {
         `without tying it to this repo. Run \`flowviant\` here and answer to make it stick.`
     );
   } else if (raw === '' || raw === 'y' || raw === 'yes') {
-    creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
+    // After the lock, for the reason the picker's bind gives above.
+    afterLock = () => creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
   } else {
     console.error(
       `nothing started. Connect this repo to its own project with \`flowviant login\`, ` +
@@ -656,4 +666,4 @@ if (!FLEET_TOKEN) {
   }
 }
 
-await runFleetDaemon();
+await runFleetDaemon({ afterLock });

package/bin/lib/agentPlan.mjs

@@ -25,6 +25,10 @@
  * Run: node --test bin/lib/agentPlan.test.mjs
  */
 
+// THE UPLINK SCRUBBER, as the DEFAULT for the two readers whose every string
+// goes to the server (2026-09-24, the audit). See `parseTurnResult`.
+import { scrub as envScrub } from './env.mjs';
+
 /** The biggest a single proposal may be. Bounds on a machine, not a policy:
  *  the server caps these again at its own boundary. */
 const MAX_AGENTS = 20;
@@ -53,14 +57,60 @@ const MAX_NOTE = 1000;
  * about escapes and nobody notices, because the disagreement only shows up on a
  * card title with a quote in it.
  */
-function candidateObjects(raw) {
-  const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/);
+/**
+ * BOUNDED, BECAUSE THE TEXT IS A MODEL'S (2026-09-24, the audit).
+ *
+ * The scan used to walk from EVERY `{` to the end of the text, and parse every
+ * balanced span it found — quadratic on both counts. A final message of eighty
+ * thousand `{` (a quoted fixture, brace padding, a turn steered into writing
+ * one) took nine seconds of synchronous CPU, and while it ran nothing else on
+ * the machine moved: no poll, no lease renewal, no other lane. Three bounds,
+ * none of which a real answer comes near:
+ *
+ *  · only the LAST `MAX_SCAN_CHARS` are scanned — every contract here puts the
+ *    object LAST, and the fenced block is still looked for in the whole text;
+ *  · each `{`'s closing brace is found ONCE (see `closers`), so the scan is a
+ *    single right-to-left pass instead of one walk per brace;
+ *  · only spans that can open an object (`{` then a key or `}`) are handed to
+ *    JSON.parse. Every TOP-LEVEL span is parsed — top-level spans are
+ *    disjoint, so together they are at most the scanned window — and the
+ *    NESTED ones (a span inside an earlier candidate) share a budget of
+ *    `MAX_NESTED_PARSES` spans and `MAX_NESTED_CHARS` characters, so a run of
+ *    nested braces that parse is not re-parsed thousands of times.
+ *
+ * THE BUDGET NEVER REACHES A TOP-LEVEL SPAN, and the review found why it must
+ * not: the first cut counted every span from the left against one budget, so
+ * an answer that followed 250 JSON lines of a quoted fixture (or one large
+ * nested document) was never parsed at all — the turn read as `nothing` and a
+ * delivered agent went to Stuck. The contract puts the answer LAST and at the
+ * top level, which is the one span a budget must never cost.
+ */
+const MAX_SCAN_CHARS = 256 * 1024;
+const MAX_NESTED_PARSES = 200;
+const MAX_NESTED_CHARS = 4 * 1024 * 1024;
+
+function candidateObjects(text) {
+  const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  const raw = text.length > MAX_SCAN_CHARS ? text.slice(text.length - MAX_SCAN_CHARS) : text;
   const bodies = [];
   if (fenced) bodies.push(fenced[1]);
+  const close = closers(raw);
+  let topEnd = -1;
+  let nestedParses = 0;
+  let nestedChars = 0;
   for (let i = 0; i < raw.length; i++) {
     if (raw[i] !== '{') continue;
-    const end = balanced(raw, i);
-    if (end > i) bodies.push(raw.slice(i, end + 1));
+    const end = close.get(i);
+    if (!(end > i) || !/^\{\s*["}]/.test(raw.slice(i, i + 64))) continue;
+    if (i > topEnd) {
+      topEnd = end;
+    } else {
+      const len = end - i + 1;
+      if (nestedParses >= MAX_NESTED_PARSES || nestedChars + len > MAX_NESTED_CHARS) continue;
+      nestedParses++;
+      nestedChars += len;
+    }
+    bodies.push(raw.slice(i, end + 1));
   }
   const out = [];
   for (const body of bodies) {
@@ -75,32 +125,51 @@ function candidateObjects(raw) {
   return out;
 }
 
-function extract(raw) {
-  return candidateObjects(raw).find((v) => Array.isArray(v.agents)) ?? null;
-}
-
-/** The index of the `}` that closes the `{` at `from`, or -1. Skips string
- *  literals so a brace inside a card title cannot end the object early. */
-function balanced(s, from) {
-  let depth = 0;
-  let inStr = false;
-  let esc = false;
-  for (let i = from; i < s.length; i++) {
-    const ch = s[i];
-    if (inStr) {
-      if (esc) esc = false;
-      else if (ch === '\\') esc = true;
-      else if (ch === '"') inStr = false;
-      continue;
+/**
+ * For every `{`, the index of the `}` that closes it when read as the START of
+ * an object (outside any string), or -1 — the answer `balanced` gives, for all
+ * of them in one pass.
+ *
+ * Right to left, so every `{` AFTER the one being closed already has its
+ * answer. A walk that meets such a `{` outside a string jumps straight to that
+ * brace's closer — the string state from there on is the same for both walks,
+ * so the nested object ends where it ends — and if that brace never closes,
+ * neither does this one. What is left for each walk is its own top level.
+ */
+function closers(s) {
+  const close = new Map();
+  for (let i = s.lastIndexOf('{'); i >= 0; i = i > 0 ? s.lastIndexOf('{', i - 1) : -1) {
+    let inStr = false;
+    let esc = false;
+    let end = -1;
+    for (let k = i + 1; k < s.length; k++) {
+      const ch = s[k];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (ch === '\\') esc = true;
+        else if (ch === '"') inStr = false;
+        continue;
+      }
+      if (ch === '"') inStr = true;
+      else if (ch === '{') {
+        const inner = close.get(k);
+        if (inner === undefined || inner < 0) break;
+        k = inner;
+      } else if (ch === '}') {
+        end = k;
+        break;
+      }
     }
-    if (ch === '"') inStr = true;
-    else if (ch === '{') depth++;
-    else if (ch === '}' && --depth === 0) return i;
+    close.set(i, end);
   }
-  return -1;
+  return close;
 }
 
-export function parseProposal(text) {
+function extract(raw) {
+  return candidateObjects(raw).find((v) => Array.isArray(v.agents)) ?? null;
+}
+
+export function parseProposal(text, scrub = envScrub) {
   const raw = String(text ?? '');
   const parsed = extract(raw);
   if (!parsed) return null;
@@ -117,7 +186,7 @@ export function parseProposal(text) {
     if (taskIds.length === 0) continue;
     agents.push({
       tempId: String(g.tempId || `a${i + 1}`).slice(0, 64),
-      name: String(g.name ?? '').slice(0, MAX_NAME),
+      name: String(scrub(String(g.name ?? ''))).slice(0, MAX_NAME),
       taskIds,
       ...(Number.isFinite(g.pointsBudget) && g.pointsBudget > 0
         ? { pointsBudget: Math.min(Math.round(g.pointsBudget), 100_000) }
@@ -150,13 +219,45 @@ export function parseProposal(text) {
   }
   if (agents.length === 0) return null;
   return {
-    agents,
+    agents: uniqueTempIds(agents),
     ...(typeof parsed.note === 'string' && parsed.note.trim()
-      ? { note: parsed.note.slice(0, MAX_NOTE) }
+      ? { note: String(scrub(parsed.note)).slice(0, MAX_NOTE) }
       : {}),
   };
 }
 
+/**
+ * A DAEMON BELT ON THE SAME COLLISION THE SERVER ALREADY REFUSES TO SHIP
+ * (2026-09-24, the audit's A4a CROSS 5).
+ *
+ * Two groups can share one tempId two ways: the model repeats itself, or one
+ * group NAMES none and defaults to the positional `a${i+1}` a differently-
+ * ordered group already claimed. The web keys `draftByTask` / `proposedCards`
+ * by tempId (boardLanes.ts), so two containers sharing one id is not cosmetic —
+ * per-group Start/Decline on either one then deletes BOTH, because
+ * `planAfterGroup` filters `.agents` by tempId and both match.
+ *
+ * Kept a byte-for-byte copy of the server's own rule
+ * (`agentPlan.ts`'s `uniqueTempIds`, the boundary every daemon version passes
+ * through) rather than re-derived, so the two ends cannot disagree about which
+ * of two colliding agents keeps the id the model wrote. FIRST occurrence wins
+ * unchanged; each later collision is suffixed `-2`, `-3`, … off the ORIGINAL
+ * id (not the previous suffix), staying inside the 64-char bound the schema
+ * already enforces upstream.
+ *
+ * This is a BELT, not the fix: an older daemon proposing the same collision is
+ * still covered by the server's identical transform at its own boundary.
+ */
+function uniqueTempIds(list) {
+  const used = new Set();
+  return list.map((g) => {
+    let id = g.tempId;
+    for (let n = 2; used.has(id); n++) id = `${g.tempId.slice(0, 58)}-${n}`;
+    used.add(id);
+    return id === g.tempId ? g : { ...g, tempId: id };
+  });
+}
+
 /**
  * The running account, off whichever shape the turn ended with — `{ progress }`
  * or nothing at all.
@@ -181,9 +282,9 @@ export function parseProposal(text) {
  * a machine to have clamped.
  */
 const MAX_PROGRESS = 8000;
-const progressOf = (v) => {
+const progressOf = (v, scrub) => {
   const t = typeof v.progress === 'string' ? v.progress.trim() : '';
-  return t ? { progress: t.slice(0, MAX_PROGRESS) } : {};
+  return t ? { progress: String(scrub(t)).slice(0, MAX_PROGRESS) } : {};
 };
 
 /**
@@ -222,7 +323,28 @@ const progressOf = (v) => {
  * caller omits the field rather than sending an empty string, so the server
  * keeps the last account that was true instead of blanking the head.
  */
-export function parseTurnResult(text) {
+/*
+ * ── EVERY STRING IS SCRUBBED HERE, BEFORE ITS CAP (2026-09-24, the audit) ──
+ *
+ * `raised` cards and a proposal's `note` and names reached the server with no
+ * scrub at all — the caller redacted `answer` and `progress` and nothing
+ * else — so a build turn that quoted `STRIPE_SECRET_KEY=sk_live_…` in a
+ * raised card's brief filed it, verbatim, as an Open card every member reads
+ * and later agents are prompted with; and a planner note quoting one became a
+ * notification body. And `answer` was cut at 8000 HERE, before the caller's
+ * scrub, which is the straddling-cut bug `progress` and the precheck already
+ * record: `scrub` matches whole values, so a credential across the cut kept
+ * its prefix. So the scrub rides in, as `parsePrecheck`'s does, and runs over
+ * each whole field first.
+ *
+ * DEFAULTED TO THE REAL SCRUBBER, unlike the precheck's identity default: the
+ * production callers pass nothing, and a redaction that depends on each caller
+ * remembering is the one that is missing the day it matters. Scrubbing twice
+ * (the caller still scrubs `answer`) is harmless — a redaction marker contains
+ * no secret to match.
+ */
+export function parseTurnResult(text, scrub = envScrub) {
+  const clean = (s, cap) => String(scrub(s)).slice(0, cap);
   for (const v of candidateObjects(String(text ?? ''))) {
     if (v.status === 'blocked') {
       const question = typeof v.question === 'string' ? v.question.trim() : '';
@@ -230,21 +352,21 @@ export function parseTurnResult(text) {
       // parks an agent with nothing to reply to. Treated as `nothing`, which
       // at least says truthfully that the machine went quiet.
       if (!question) continue;
-      return { outcome: 'question', answer: question.slice(0, 8000), ...progressOf(v) };
+      return { outcome: 'question', answer: clean(question, 8000), ...progressOf(v, scrub) };
     }
     if (v.status === 'delivered') {
       return {
         outcome: 'delivered',
-        answer: (typeof v.summary === 'string' ? v.summary : '').slice(0, 8000),
-        ...progressOf(v),
+        answer: typeof v.summary === 'string' ? clean(v.summary, 8000) : '',
+        ...progressOf(v, scrub),
         raised: Array.isArray(v.raised)
           ? v.raised
               .filter((r) => r && typeof r.title === 'string' && r.title.trim())
               .slice(0, 10)
               .map((r) => ({
-                title: r.title.trim().slice(0, 300),
+                title: clean(r.title.trim(), 300),
                 ...(typeof r.brief === 'string' && r.brief.trim()
-                  ? { brief: r.brief.trim().slice(0, 2000) }
+                  ? { brief: clean(r.brief.trim(), 2000) }
                   : {}),
               }))
           : [],

package/bin/lib/artifacts.mjs

@@ -37,13 +37,27 @@
  * this is somebody's disk and one place checking is one deploy from zero) are
  * reported BY NAME and never read. Over `ARTIFACT_MAX_BYTES` likewise.
  *
- * ── TEXT IS SCRUBBED ──
+ * ── TEXT IS SCRUBBED; A BINARY CARRYING A SECRET IS WITHHELD ──
  *
  * html, md, svg, json, csv and txt pass through `envScrub` before upload — the
  * turn trace's own scrub, for the trace's own reason: a page the agent wrote
  * can quote a value out of the checkout's `.env`, and an artifact is served to
- * a browser. Binary images are not scrubbed (there is no text to match), and
- * the SERVER computes the sha256 of what it stored; the one sent here is for
+ * a browser.
+ *
+ * The binary types CAN carry text, and this header used to say they could
+ * not. A PNG has tEXt chunks, a PDF has streams that are often stored
+ * uncompressed, a docx/pptx/xlsx is a zip whose entries may be STORED rather
+ * than deflated — and a turn that can write a file can write a secret into
+ * any of them. What they cannot be is REWRITTEN: `envScrub` swapping bytes
+ * inside one corrupts it, and a corrupted binary served as the thing the agent
+ * made is worse than none. So each binary is checked against the same scrub
+ * list as exact byte substrings (`secretIn`, env.mjs) before it is uploaded,
+ * and a hit SKIPS the file with a warn line naming it and the variable — never
+ * a redacted copy, never a by-name row the page would draw as a file it merely
+ * could not show. STATED: a value inside a deflated stream is not a substring
+ * of the file, so this catches what is stored plainly and nothing more.
+ *
+ * The SERVER computes the sha256 of what it stored; the one sent here is for
  * the log.
  *
  * ── DELIVERY ──
@@ -61,15 +75,23 @@
  * that cannot show an artifact must not have the CLI told it will.
  */
 
-import { constants, closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync } from 'node:fs';
+import { constants, closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync, mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { pathToFileURL } from 'node:url';
+import { captureScreenshot } from './shot.mjs';
 
 /** Relative to the directory the turn stands in. Under `.flowviant/`, which
  *  the exclude file already hides from git (`excludeInWorktree`). */
 export const ARTIFACT_DIR = '.flowviant/artifacts';
 /** The server's per-file ceiling, re-checked here. */
 export const ARTIFACT_MAX_BYTES = 2 * 1024 * 1024;
+export const ARTIFACT_BINARY_MODEL_MAX_BYTES = 20 * 1024 * 1024;
+export const DESIGN_PREVIEW_MAX_BYTES = 2 * 1024 * 1024;
+const PREVIEW_CSP = "default-src 'none'; script-src 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net/npm/ https://unpkg.com; style-src 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net/npm/ https://unpkg.com https://fonts.googleapis.com; img-src data: blob:; font-src data: https://fonts.gstatic.com; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'";
+export const artifactMaxBytesFor = (name) => /\.(?:glb|bin)$/i.test(name)
+  ? ARTIFACT_BINARY_MODEL_MAX_BYTES : ARTIFACT_MAX_BYTES;
 /** Listed per scan, newest first — the server keeps as many per owner. */
 export const ARTIFACT_MAX_FILES = 40;
 /** A held upload is tried this many times in all, then dropped with a line. */
@@ -91,6 +113,19 @@ export const ARTIFACT_TYPES = {
   json: { mime: 'application/json', text: true },
   csv: { mime: 'text/csv', text: true },
   txt: { mime: 'text/plain', text: true },
+  // DOCUMENTS (0.97.0): a Word file, a deck, a sheet or a PDF — what the
+  // machine's docx/pptx/xlsx/pdf skills write. Binary, so never REWRITTEN (a
+  // scrub inside a zip or a PDF corrupts it) but checked for a known secret's
+  // bytes and withheld on a hit — see the header. Under the same cap. The app
+  // offers the first three as a download and frames the PDF.
+  docx: { mime: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', text: false },
+  pptx: { mime: 'application/vnd.openxmlformats-officedocument.presentationml.presentation', text: false },
+  xlsx: { mime: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', text: false },
+  pdf: { mime: 'application/pdf', text: false },
+  gltf: { mime: 'model/gltf+json', text: true },
+  obj: { mime: 'model/obj', text: true },
+  glb: { mime: 'model/gltf-binary', text: false },
+  bin: { mime: 'application/octet-stream', text: false },
 };
 
 export function artifactTypeFor(name) {
@@ -123,23 +158,23 @@ export function scanArtifacts(placeDir) {
   } catch {
     return [];
   }
-  let names;
-  try {
-    names = readdirSync(dir);
-  } catch {
-    return [];
-  }
   const out = [];
-  for (const name of names) {
-    if (name.startsWith('.')) continue; // editor swap files, `.DS_Store`
-    try {
-      const st = lstatSync(join(dir, name));
-      if (!st.isFile()) continue; // symlinks, directories, sockets: nothing
-      out.push({ name, path: join(dir, name), size: st.size, mtimeMs: st.mtimeMs });
-    } catch {
-      /* vanished between the list and the stat */
+  const walk = (at, prefix = '', depth = 0) => {
+    if (depth > 4) return;
+    let names;
+    try { names = readdirSync(at); } catch { return; }
+    for (const part of names) {
+      if (part.startsWith('.')) continue;
+      const name = prefix ? `${prefix}/${part}` : part;
+      const path = join(at, part);
+      try {
+        const st = lstatSync(path);
+        if (st.isDirectory() && !st.isSymbolicLink()) walk(path, name, depth + 1);
+        else if (st.isFile() && !st.isSymbolicLink()) out.push({ name, path, size: st.size, mtimeMs: st.mtimeMs });
+      } catch { /* vanished */ }
     }
-  }
+  };
+  walk(dir);
   out.sort((a, b) => b.mtimeMs - a.mtimeMs || a.name.localeCompare(b.name));
   return out.slice(0, ARTIFACT_MAX_FILES);
 }
@@ -177,32 +212,71 @@ function readNoFollow(path, limit) {
   }
 }
 
+/** FNV-1a, 32-bit, as 8 hex — verbatim against the server's `fnv1a8`
+ *  (apps/api/src/routes/sessionsAttachments.routes.ts). */
+function artifactFnv1a8(s) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(16).padStart(8, '0');
+}
+const ARTIFACT_SAFE_EXT_RE = /^[A-Za-z0-9]{1,10}$/;
+/**
+ * `safeFileName`, verbatim in effect (apps/api/src/routes/sessionsAttachments.
+ * routes.ts): keeps the extension through a cut. Applied to each relative
+ * path component, so a model under `scene/` keeps that relation to its page.
+ * This only differs from a component on an over-long name — but that is exactly the case the
+ * server's own `safeFileName(rawName)` would otherwise re-cut DIFFERENTLY
+ * from whatever this reported, since a bare truncation and an
+ * extension-preserving one disagree past 80 characters. Applying the same
+ * rule here means the server's re-application is a no-op and the name a
+ * design or research delivery is judged by is the one this machine reported.
+ */
+function safeArtifactName(raw) {
+  if (typeof raw === 'string' && raw.length <= 80 && /^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(raw) && !raw.endsWith('.')) return raw;
+  const clean = String(raw ?? '').replace(/[^A-Za-z0-9._-]/g, '_');
+  if (clean.length <= 80) return clean || 'artifact';
+  const dot = clean.lastIndexOf('.');
+  const ext = dot > 0 && ARTIFACT_SAFE_EXT_RE.test(clean.slice(dot + 1)) ? clean.slice(dot + 1) : '';
+  const stem = ext ? clean.slice(0, dot) : clean;
+  const tag = `-${artifactFnv1a8(clean)}`;
+  const room = 80 - tag.length - (ext ? ext.length + 1 : 0);
+  return `${stem.slice(0, room)}${tag}${ext ? `.${ext}` : ''}`;
+}
+
 /**
  * ONE UPLOAD BODY, as data — fields plus optional bytes — so a held body is
  * re-sent exactly as it was first built (scrubbed once, never re-read from a
  * disk the agent may have changed since).
  */
-export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s) {
+export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s, secretIn = () => null) {
   const type = artifactTypeFor(entry.name);
   const fields = {
     ...(sessionId ? { sessionId } : { agentId }),
     ...(turnId ? { turnId } : {}),
-    name: entry.name,
+    name: entry.name.split('/').map(safeArtifactName).join('/'),
     bytes: String(entry.size),
   };
   if (!type) return { fields, bytes: null }; // reported by name only
-  if (entry.size > ARTIFACT_MAX_BYTES) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
+  const maxBytes = artifactMaxBytesFor(entry.name);
+  if (entry.size > maxBytes) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
   let bytes;
   try {
-    bytes = readNoFollow(entry.path, ARTIFACT_MAX_BYTES);
+    bytes = readNoFollow(entry.path, maxBytes);
   } catch {
     return null; // vanished, or a symlink swapped in: nothing to say
   }
   if (!bytes) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
-  if (type.text) {
+  if (!type.text) {
+    // A binary is never rewritten; one carrying a known secret is not sent.
+    const secret = secretIn(bytes);
+    if (secret) return { withheld: secret, fields };
+  } else {
     bytes = Buffer.from(String(scrub(bytes.toString('utf8'))), 'utf8');
     // A redaction marker can be longer than the value it replaced.
-    if (bytes.byteLength > ARTIFACT_MAX_BYTES) {
+    if (bytes.byteLength > maxBytes) {
       return { fields: { ...fields, bytes: String(bytes.byteLength), tooLarge: '1' }, bytes: null };
     }
   }
@@ -217,12 +291,39 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
   };
 }
 
+/** Render the scrubbed HTML, never the checkout's unsanitized source. A
+ * failed browser measurement is explicit; older daemon reports are absent. */
+export async function renderDesignPreview(bytes, capture = captureScreenshot) {
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-design-'));
+  try {
+    const html = join(dir, 'design.html');
+    const png = join(dir, 'design.png');
+    // A fresh Chrome profile has no Flowviant credentials. Put the artifact
+    // box's network fence before any model-written markup executes.
+    writeFileSync(html, Buffer.concat([
+      Buffer.from(`<meta http-equiv="Content-Security-Policy" content="${PREVIEW_CSP}">`),
+      bytes,
+    ]));
+    const result = await capture({ url: pathToFileURL(html).href, out: png, width: 720, height: 450, timeoutMs: 15_000 });
+    if (!result.ok) return { renderState: 'unavailable' };
+    const image = readFileSync(png);
+    if (image.byteLength > DESIGN_PREVIEW_MAX_BYTES || !image.subarray(0, 8).equals(Buffer.from([137,80,78,71,13,10,26,10]))) {
+      return { renderState: 'unavailable' };
+    }
+    return { renderState: 'rendered', preview: image };
+  } catch {
+    return { renderState: 'unavailable' };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 /**
  * The reporter a work manager holds for its life. `report` is called once per
  * finished turn and never awaited by the turn (a slow uplink must not hold the
  * next turn behind a readout); `retryPending` rides the settle retry beat.
  */
-export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetchImpl, log = () => {} }) {
+export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secretIn, fetchImpl, log = () => {} }) {
   const url = String(fleetUrl).replace(/\/agents\/?$/, '/artifact');
   const doFetch = fetchImpl ?? ((...a) => fetch(...a));
   const pending = new Map(); // `${owner}:${name}` -> { body, tries }
@@ -232,6 +333,7 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetc
     const form = new FormData();
     for (const [k, v] of Object.entries(body.fields)) form.set(k, v);
     if (body.bytes) form.set('file', new Blob([body.bytes]), body.fields.name);
+    if (body.preview) form.set('preview', new Blob([body.preview], { type: 'image/png' }), 'preview.png');
     try {
       const res = await doFetch(url, {
         method: 'POST',
@@ -255,12 +357,40 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetc
     }
     pending.delete(key); // re-insert at the tail, so the cap sheds the oldest
     pending.set(key, { body, tries });
-    while (pending.size > MAX_PENDING) pending.delete(pending.keys().next().value);
+    while (pending.size > MAX_PENDING) {
+      const shed = pending.keys().next().value;
+      pending.delete(shed);
+      if (!chains.has(shed)) genOf.delete(shed);
+    }
   };
 
-  const send = async (key, body, tries) => {
-    if (await post(body)) pending.delete(key);
-    else hold(key, body, tries + 1);
+  // ONE COPY OF A FILE IS IN FLIGHT AT A TIME, AND ONLY THE NEWEST MAY
+  // DECIDE. Each report of a (owner, name) takes a fresh generation, and every
+  // post for that key is chained behind the previous one — so a slow retry of
+  // an OLD body can neither land on the server after the newer copy (the
+  // server upserts by name, so the last write wins) nor re-hold itself over
+  // the newer one when it fails. A body superseded before it went out is not
+  // sent at all; one superseded while in flight has its answer discarded.
+  let generation = 0;
+  const genOf = new Map(); // key -> the generation allowed to decide
+  const chains = new Map(); // key -> the tail of that key's post chain
+
+  const send = (key, body, tries, gen) => {
+    const run = (chains.get(key) ?? Promise.resolve()).then(async () => {
+      if (genOf.get(key) !== gen) return; // superseded before it went out
+      const ok = await post(body);
+      if (genOf.get(key) !== gen) return; // a newer copy decides for this key
+      if (ok) pending.delete(key);
+      else hold(key, body, tries + 1);
+    });
+    const tail = run.catch(() => {});
+    chains.set(key, tail);
+    tail.then(() => {
+      if (chains.get(key) !== tail) return;
+      chains.delete(key);
+      if (!pending.has(key)) genOf.delete(key); // settled: nothing left to order
+    });
+    return run;
   };
 
   let retrying = false;
@@ -270,7 +400,7 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetc
     try {
       for (const [key, held] of [...pending]) {
         if (pending.get(key) !== held) continue; // superseded meanwhile
-        await send(key, held.body, held.tries);
+        await send(key, held.body, held.tries, genOf.get(key));
       }
     } finally {
       retrying = false;
@@ -284,11 +414,22 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetc
     const changed = changedArtifacts(before, scanArtifacts(placeDir));
     let n = 0;
     for (const entry of changed) {
-      const body = buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub);
+      const body = buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub, secretIn);
       if (!body) continue;
+      if (body.withheld) {
+        log(`artifact ${entry.name}: not uploaded — it contains the value of ${body.withheld} from this machine's environment`);
+        continue;
+      }
+      if (body.bytes && /\.html?$/i.test(entry.name)) {
+        const measured = await renderDesignPreview(body.bytes);
+        body.fields.renderState = measured.renderState;
+        if (measured.preview) body.preview = measured.preview;
+      }
       const key = `${sessionId ?? agentId}:${entry.name}`;
       pending.delete(key); // this copy supersedes a held older one
-      await send(key, body, 0);
+      const gen = ++generation;
+      genOf.set(key, gen); // …and one still in flight
+      await send(key, body, 0, gen);
       n++;
     }
     return n;

package/bin/lib/authReject.mjs

@@ -0,0 +1,32 @@
+/**
+ * DID THE API REJECT THIS CREDENTIAL, OR DID SOMETHING IN FRONT OF IT ANSWER?
+ *
+ * A 401 or 403 on a machine-token route used to be read as "the credential is
+ * revoked" on sight, and the daemon exited for good — exit 0, so nothing
+ * restarts it. But Cloudflare sits in front of the API and answers this client
+ * class with its own 403s (a bot-management challenge, a 1020 firewall rule, a
+ * Browser Integrity Check false positive), as an HTML page. One of those on one
+ * poll took an unattended machine offline over a credential that was still
+ * valid: in-flight turns expired into Stuck, queued presses failed, and the
+ * board said the machine was gone.
+ *
+ * The API's own refusal always wears its JSON envelope — `app.onError` renders
+ * every HTTPException, including the machine-token middleware's "Token
+ * revoked", "Invalid machine token" and "Not a machine credential", as
+ * `{ success: false, error }` — so THAT is the credential rejection. Anything
+ * else carrying the same status is somebody else's answer, and the caller
+ * retries it like any other failed request.
+ *
+ * Reads the body, so call it only on a 401/403 whose body is not needed.
+ */
+export async function credentialRejected(res) {
+  if (res?.status !== 401 && res?.status !== 403) return false;
+  const type = String(res.headers?.get?.('content-type') ?? '');
+  if (!/\bapplication\/json\b/i.test(type)) return false;
+  try {
+    const body = await res.json();
+    return Boolean(body) && body.success === false;
+  } catch {
+    return false; // not the API's envelope — an edge page mislabelled as JSON
+  }
+}