flowviant 0.97.0 → 0.100.0

package/README.md

@@ -2,8 +2,9 @@
 
 Run your own coding CLIs as build agents for [Flowviant](https://flowviant.com) — [Claude Code](https://claude.com/claude-code), Codex or Antigravity, on your own credentials. This daemon holds your sessions, keeps a worktree per tab, and ships branches on your word. Flowviant never sees your Claude, Codex or GitHub logins.
 
-```bash
-npx flowviant@latest login   # approve the code in Flowviant → connected
+```sh
+curl -fsSL https://api.flowviant.com/install.sh | sh
+flowviant   # approve the code in Flowviant → connected
 ```
 
 Login keeps going straight into the daemon — there is no second command to run.
@@ -21,40 +22,39 @@ Because it drives the CLIs you're already logged into, **the cost is yours** (yo
 On the machine that runs the daemon:
 
 - **at least one coding CLI** installed and signed in — [Claude Code](https://claude.com/claude-code) (`claude`), Codex (`codex`) or Antigravity (`agy`)
-- **git**, and **Node 20+**
+- **git** (Node 20+ is needed only for a Node-based install)
 - **[GitHub CLI](https://cli.github.com)** (`gh`) — optional; the daemon offers to fetch an isolated copy, and `flowviant gh-auth` signs it in
 - run it from inside the git repository you want worked
 
 ## Connecting
 
-The easy way — device login, like `gh auth login`:
+Download the standalone binary, then start it in your checkout:
 
-```bash
-npx flowviant@latest login
+```sh
+curl -fsSL https://api.flowviant.com/install.sh | sh
+flowviant
 ```
 
-It shows a short code. Open your project's **Workbench** in Flowviant and enter the code where it offers to connect a machine. The credential is stored at `~/.flowviant/credentials.json`, and from then on `npx flowviant@latest` just runs.
+It shows a short code. Open your project's **Workbench** in Flowviant and enter the code where it offers to connect a machine. The credential is stored at `~/.flowviant/credentials.json`, and from then on `flowviant` just runs. The installer prints a PATH hint if needed; `FLOWVIANT_INSTALL_DIR` changes its destination. It verifies SHA-256 and never uses sudo.
 
 Prefer an explicit token? Create a machine credential in the app and pass it directly:
 
 ```bash
-FLOWVIANT_MACHINE_TOKEN=fva_… npx flowviant@latest   # FLOWVIANT_FLEET still works
+FLOWVIANT_MACHINE_TOKEN=fva_… flowviant   # FLOWVIANT_FLEET still works
 ```
 
-Prefer a plain command to `npx`? Install it once and every `npx flowviant@latest` in this README is just `flowviant`:
+With Node already installed, a global install also gives you the same command:
 
 ```bash
 npm i -g flowviant
 flowviant login
 ```
 
-Either way is fine and both stay current on their own (below). npx is the zero-install door; a global install is what you want on a box you keep running, so the daemon, `flowviant login` and `flowviant machines` are ordinary commands.
-
-Launch with `@latest` so each start pulls the newest published version — a bare `npx flowviant` can reuse a stale cache. A running daemon also keeps itself current: from **0.58.0** it restarts itself through `npx flowviant@latest` when a new version ships, so npx launches stay up to date the same way a global install does. (Before 0.58.0 that was only true of a global install — under npx the daemon printed a notice and stayed put, which is how machines ended up sitting several releases back.) It only ever restarts when no turn is running. `FLOWVIANT_NO_UPDATE=1` makes it nag-only; `flowviant update` updates now.
+The binary and global npm installs update when idle. The binary fetches the release manifest and verifies the new executable before replacing itself. The global install refreshes from npm before restarting. `flowviant update` checks on demand. `FLOWVIANT_NO_UPDATE=1` makes updates manual.
 
 ## Machines on this box
 
-One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not — and a directory serves one project, so `npx flowviant` there refuses to start until one of them goes.
+One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not — and a directory serves one project, so `flowviant` there refuses to start until one of them goes.
 
 On a terminal the listing is a menu: ↑/↓ over the projects, enter for what you can do about one, esc to leave. Two verbs, each acting on **this box's own connection** and nothing else:
 
@@ -128,6 +128,8 @@ The posture is reported on every poll and shown in the project's
 Settings → Machine section, so the team can see whether the box runs the
 guarded toolset or full permissions.
 
+With Node: `npx flowviant@latest login` runs without a global install and updates by restarting through the package runner when idle.
+
 ## License
 
 MIT — see [LICENSE](./LICENSE).

package/bin/cli.mjs

@@ -70,9 +70,31 @@
  * env (the box keypair, the uplink scrubber, the env-comparison scan) + vault
  * (the knowledge wiki, not secrets), resources, deploy, shot.
  */
-import { FLEET_TOKEN, CREDENTIAL, adoptStoredCredential } from './lib/config.mjs';
-import { runFleetDaemon } from './lib/fleet.mjs';
-import { runLogin } from './lib/login.mjs';
+// Resolve --dir before config reads the project bound to cwd. A tray process
+// starts outside the checkout; its explicit folder is the daemon's checkout.
+const dirAt = process.argv.indexOf('--dir');
+const noCheckoutCommand = new Set(['--version', '-v', 'version', 'status', 'stop', 'machines', 'projects', 'update', 'shot', 'clean', 'gh-auth', 'mcp']);
+if (dirAt >= 0 && !noCheckoutCommand.has(process.argv[2])) {
+  const dir = process.argv[dirAt + 1];
+  try {
+    if (!dir || dir.startsWith('--')) throw new Error('missing directory');
+    process.chdir(dir);
+  } catch (e) {
+    if (process.argv.includes('--json') && process.argv[2] === 'login')
+      process.stdout.write(`${JSON.stringify({ event: 'error', message: `Cannot use directory ${dir ?? ''}: ${e.message}` })}\n`);
+    else console.error(`error: cannot use directory ${dir ?? ''}: ${e.message}`);
+    process.exit(1);
+  }
+}
+const { FLEET_TOKEN, CREDENTIAL, VERSION, adoptStoredCredential } = await import('./lib/config.mjs');
+const { runFleetDaemon } = await import('./lib/fleet.mjs');
+const { runLogin } = await import('./lib/login.mjs');
+const { launchCommand, terminalCommand } = await import('./lib/launchCommand.mjs');
+
+if (process.argv.includes('--remote') && !(process.argv[2] === 'status' && process.argv.includes('--json'))) {
+  console.error('error: --remote requires status --json');
+  process.exit(1);
+}
 
 // `flowviant login` — device auth (recommended): approve a code in the app, the
 // credential is stored locally, and then we KEEP GOING into the daemon.
@@ -86,9 +108,17 @@ import { runLogin } from './lib/login.mjs';
 //
 // `--no-start` for scripts and CI, which want the credential and not a
 // long-running process.
+// `flowviant --version` prints and exits — the first thing a person runs after
+// a curl install, and it must never start a daemon.
+if (process.argv[2] === '--version' || process.argv[2] === '-v' || process.argv[2] === 'version') {
+  console.log(VERSION);
+  process.exit(0);
+}
+
 if (process.argv[2] === 'login') {
   const noStart = process.argv.includes('--no-start');
-  const login = await runLogin({ thenStart: !noStart });
+  const json = process.argv.includes('--json');
+  const login = await runLogin({ thenStart: !noStart, json, dir: process.cwd() });
   // A login the person CANCELLED at the second-project question saved nothing,
   // so there is no credential for the child to serve — starting it would end
   // in "no credential found" over a choice they just made on purpose.
@@ -101,7 +131,8 @@ if (process.argv[2] === 'login') {
   // re-exec: stay alive as a thin proxy so the user's shell keeps one foreground
   // process.
   const { spawn } = await import('node:child_process');
-  const child = spawn(process.execPath, [process.argv[1]], {
+  const startArgs = process.argv[1]?.startsWith('/$bunfs/') ? [] : [process.argv[1]];
+  const child = spawn(process.execPath, [...startArgs, ...(json ? ['--json-events'] : [])], {
     stdio: 'inherit',
     env: process.env,
   });
@@ -111,11 +142,18 @@ if (process.argv[2] === 'login') {
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
 }
 
+if (process.argv[2] === 'status' && process.argv.includes('--json')) {
+  const { desktopStatus, desktopStatusRemote } = await import('./lib/desktopContract.mjs');
+  const status = process.argv.includes('--remote') ? await desktopStatusRemote() : desktopStatus();
+  process.stdout.write(`${JSON.stringify(status)}\n`);
+  process.exit(0);
+}
+
 // `flowviant update` — install the latest published version now. The daemon also
 // self-updates on its own (at startup + when idle); this is the manual path.
 if (process.argv[2] === 'update') {
   const { runUpdateCommand } = await import('./lib/update.mjs');
-  runUpdateCommand();
+  await runUpdateCommand();
   process.exit(0);
 }
 
@@ -192,8 +230,16 @@ if (process.argv[2] === 'shot') {
 // daemon is running on this machine." is the answer the asker came for, not an
 // error. Non-zero only when something was alive and could not be stopped.
 if (process.argv[2] === 'stop') {
-  const { stopAllDaemons } = await import('./lib/instance.mjs');
-  const { failed } = stopAllDaemons({ log: (m) => console.log(m) });
+  const { stopAllDaemons, stopDaemonFor } = await import('./lib/instance.mjs');
+  let result;
+  if (process.argv.includes('--project')) {
+    const { matchStoredProject } = await import('./lib/credentials.mjs');
+    const at = process.argv.indexOf('--project');
+    const match = matchStoredProject(process.argv[at + 1]);
+    if (match.error) { console.error(`error: ${match.error}`); process.exit(1); }
+    result = stopDaemonFor(match.entry.fleetToken, { log: (m) => console.log(m) });
+  } else result = stopAllDaemons({ log: (m) => console.log(m) });
+  const { failed } = result;
   process.exit(failed > 0 ? 1 : 0);
 }
 
@@ -206,7 +252,7 @@ if (process.argv[2] === 'projects') {
   const { listStoredProjects, projectLabel } = await import('./lib/credentials.mjs');
   const entries = listStoredProjects();
   if (entries.length === 0) {
-    console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
+    console.log(`no projects connected on this machine yet — run \`${terminalCommand('login')}\` inside a repo.`);
     process.exit(0);
   }
   for (const e of entries) {
@@ -227,8 +273,8 @@ if (process.argv[2] === 'projects') {
     );
   }
   console.log(
-    '\n  `npx flowviant` picks by the repo it is started in; `--project <name|id>` overrides;\n' +
-      '  `flowviant login` in a new repo connects another project.'
+    `\n  \`${launchCommand()}\` picks by the repo it is started in; \`--project <name|id>\` overrides;\n` +
+      `  \`${terminalCommand('login')}\` in a new repo connects another project.`
   );
   process.exit(0);
 }
@@ -267,20 +313,27 @@ if (process.argv[2] === 'projects') {
 // is the one exit that can be 1, when the daemon it had to stop would not.
 if (process.argv[2] === 'machines') {
   const creds = await import('./lib/credentials.mjs');
+  const machineJson = process.argv.includes('--json');
   const forgetAt = process.argv.indexOf('--forget');
   if (forgetAt >= 0) {
+    if (machineJson && !process.argv.includes('--yes')) {
+      process.stdout.write(`${JSON.stringify({ ok: false, error: '--yes is required with --json' })}\n`);
+      process.exit(1);
+    }
     // THE LOCAL-ONLY WRITE. Named explicitly, matched by full id or a ≥6
     // prefix, and AMBIGUITY REFUSES rather than guessing — this deletes a
     // credential, and two projects that look alike is the case that produced
     // the command.
     const res = creds.forgetStoredProject(process.argv[forgetAt + 1]);
     if (res.error) {
+      if (machineJson) { process.stdout.write(`${JSON.stringify({ ok: false, error: res.error })}\n`); process.exit(1); }
       console.error(`error: ${res.error}`);
       process.exit(1);
     }
+    if (machineJson) { process.stdout.write(`${JSON.stringify({ ok: true, action: 'forget', projectId: res.entry.projectId })}\n`); process.exit(0); }
     console.log(
       `forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box.\n` +
-        '  Nothing was stopped or deleted anywhere else — `flowviant login` connects it again.'
+        `  Nothing was stopped or deleted anywhere else — \`${terminalCommand('login')}\` connects it again.`
     );
     process.exit(0);
   }
@@ -289,22 +342,28 @@ if (process.argv[2] === 'machines') {
   const { FLEET_URL } = await import('./lib/config.mjs');
   const removeAt = process.argv.indexOf('--remove');
   if (removeAt >= 0) {
+    if (machineJson && !process.argv.includes('--yes')) {
+      process.stdout.write(`${JSON.stringify({ ok: false, error: '--yes is required with --json' })}\n`);
+      process.exit(1);
+    }
     // THE SCRIPTED DISCONNECT — the menu's first verb, named by id for a
     // terminal nobody is sitting at. Same matcher and the same refusal of an
     // ambiguous prefix as --forget: a name two projects share is exactly the
     // input this command exists to untangle, and it must not pick one.
     const m = creds.matchStoredProject(process.argv[removeAt + 1]);
     if (m.error) {
-      console.error(`error: ${m.error}. \`flowviant machines\` lists what is stored.`);
+      if (machineJson) { process.stdout.write(`${JSON.stringify({ ok: false, error: m.error })}\n`); process.exit(1); }
+      console.error(`error: ${m.error}. \`${terminalCommand('machines')}\` lists what is stored.`);
       process.exit(1);
     }
-    const res = await disconnectHere(m.entry, await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL) }));
+    const res = await disconnectHere(m.entry, await realDisconnectDeps({ url: leaveUrlFrom(FLEET_URL), log: machineJson ? () => {} : undefined }), { log: machineJson ? () => {} : undefined });
+    if (machineJson) process.stdout.write(`${JSON.stringify({ ok: res.ok, action: 'disconnect', projectId: m.entry.projectId })}\n`);
     process.exit(res.ok ? 0 : 1);
   }
 
   let entries = creds.listStoredProjects();
   if (entries.length === 0) {
-    console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
+    console.log(`no projects connected on this machine yet — run \`${terminalCommand('login')}\` inside a repo.`);
     process.exit(0);
   }
   // OUR OWN BOX ID, so the listing can mark "← this box".
@@ -391,7 +450,7 @@ if (process.argv[2] === 'machines') {
       console.log(
         res.error
           ? `  ${res.error}`
-          : `  forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box. Nothing was stopped or deleted anywhere else — \`flowviant login\` connects it again.`
+          : `  forgot ${creds.projectLabel(res.entry)} (${res.entry.projectId.slice(0, 8)}…) on this box. Nothing was stopped or deleted anywhere else — \`${terminalCommand('login')}\` connects it again.`
       );
     }
     entries = creds.listStoredProjects();
@@ -466,7 +525,7 @@ async function reexecAfterLogin() {
   const login = await runLogin({ thenStart: false });
   if (!login?.saved) process.exit(1); // refused: the directory already serves another project
   const { spawn } = await import('node:child_process');
-  const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
+  const child = spawn(process.execPath, process.argv[1]?.startsWith('/$bunfs/') ? [] : [process.argv[1]], { stdio: 'inherit', env: process.env });
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
 }
 
@@ -487,9 +546,13 @@ function listLines(entries, { projectRowLabel }) {
     .join('\n');
 }
 
+/** A repo binding the person just consented to, persisted by runFleetDaemon
+ *  only after the instance lock is taken — never before a refusal. */
+let afterLock = null;
+
 if (!FLEET_TOKEN) {
   if (CREDENTIAL.error) {
-    console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
+    console.error(`error: ${CREDENTIAL.error}. \`${terminalCommand('projects')}\` lists what is stored.`);
     process.exit(1);
   }
   // A DIRECTORY SERVES ONE PROJECT (2026-09-23, the owner, verbatim: "a
@@ -517,7 +580,7 @@ if (!FLEET_TOKEN) {
         : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
     );
 
-    const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`;
+    const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (${terminalCommand('login')})`;
     // WHICH ONE LOOKS RIGHT — a pre-selection, never an auto-serve. The resolver
     // refuses to serve a project the repo PATH did not name (the skadooble law);
     // this only decides which row the cursor starts on, using the repo's folder
@@ -589,21 +652,26 @@ if (!FLEET_TOKEN) {
       console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
     }
     adoptStoredCredential(picked);
-    creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
+    // BOUND ONLY ONCE THE START HAS THE LOCK. Written here, the answer moved
+    // the binding even when the instance lock then refused the start — a live
+    // daemon for the same project in its own checkout — and that daemon's next
+    // unattended self-update re-exec'd into a store that no longer bound its
+    // repo, found no match headless, and exited with the machine dark.
+    afterLock = () => creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
     console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
   } else if (CREDENTIAL.choices?.length) {
     const creds = await import('./lib/credentials.mjs');
     console.error(
       'error: more than one project is connected on this machine and this repo is not bound to any of them:\n' +
         listLines(CREDENTIAL.choices, creds) +
-        '\nPick one with `--project <name|id>`, bind this repo by running `flowviant` here in a terminal once,\n' +
-        'or connect this repo to its own project with `flowviant login`.'
+        `\nPick one with \`--project <name|id>\`, bind this repo by running \`${terminalCommand()}\` here in a terminal once,\n` +
+        `or connect this repo to its own project with \`${terminalCommand('login')}\`.`
     );
     process.exit(1);
   } else {
     console.error(
       'error: no credential found. Easiest:\n' +
-        '  flowviant login      (approve in the app — recommended)\n' +
+        `  ${terminalCommand('login')}      (approve in the app — recommended)\n` +
         'Or set:\n' +
         '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
     );
@@ -643,17 +711,29 @@ if (!FLEET_TOKEN) {
   if (raw === null) {
     console.log(
       `\n  could not read an answer — serving ${label} for this run ` +
-        `without tying it to this repo. Run \`flowviant\` here and answer to make it stick.`
+        `without tying it to this repo. Run \`${terminalCommand()}\` here and answer to make it stick.`
     );
   } else if (raw === '' || raw === 'y' || raw === 'yes') {
-    creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
+    // After the lock, for the reason the picker's bind gives above.
+    afterLock = () => creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
   } else {
     console.error(
-      `nothing started. Connect this repo to its own project with \`flowviant login\`, ` +
-        `or see what is stored with \`flowviant projects\`.`
+      `nothing started. Connect this repo to its own project with \`${terminalCommand('login')}\`, ` +
+        `or see what is stored with \`${terminalCommand('projects')}\`.`
     );
     process.exit(1);
   }
 }
 
-await runFleetDaemon();
+if (process.argv.includes('--json-events') && dirAt >= 0 && CREDENTIAL?.entry) {
+  const { detectRepoRoot, listStoredProjects, boundElsewhere } = await import('./lib/credentials.mjs');
+  const repo = detectRepoRoot();
+  const entry = CREDENTIAL.entry;
+  if (!repo || entry.repoRoot !== repo || boundElsewhere(listStoredProjects(), repo, entry.projectId).length) {
+    console.error('error: this project is not connected to this repository. Run `flowviant login` for the selected folder.');
+    process.exit(1);
+  }
+}
+const { installDaemonLogging } = await import('./lib/desktopContract.mjs');
+installDaemonLogging(CREDENTIAL?.entry?.projectId, { jsonEvents: process.argv.includes('--json-events') });
+await runFleetDaemon({ afterLock });

package/bin/lib/agentPlan.mjs

@@ -25,6 +25,10 @@
  * Run: node --test bin/lib/agentPlan.test.mjs
  */
 
+// THE UPLINK SCRUBBER, as the DEFAULT for the two readers whose every string
+// goes to the server (2026-09-24, the audit). See `parseTurnResult`.
+import { scrub as envScrub } from './env.mjs';
+
 /** The biggest a single proposal may be. Bounds on a machine, not a policy:
  *  the server caps these again at its own boundary. */
 const MAX_AGENTS = 20;
@@ -53,14 +57,60 @@ const MAX_NOTE = 1000;
  * about escapes and nobody notices, because the disagreement only shows up on a
  * card title with a quote in it.
  */
-function candidateObjects(raw) {
-  const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/);
+/**
+ * BOUNDED, BECAUSE THE TEXT IS A MODEL'S (2026-09-24, the audit).
+ *
+ * The scan used to walk from EVERY `{` to the end of the text, and parse every
+ * balanced span it found — quadratic on both counts. A final message of eighty
+ * thousand `{` (a quoted fixture, brace padding, a turn steered into writing
+ * one) took nine seconds of synchronous CPU, and while it ran nothing else on
+ * the machine moved: no poll, no lease renewal, no other lane. Three bounds,
+ * none of which a real answer comes near:
+ *
+ *  · only the LAST `MAX_SCAN_CHARS` are scanned — every contract here puts the
+ *    object LAST, and the fenced block is still looked for in the whole text;
+ *  · each `{`'s closing brace is found ONCE (see `closers`), so the scan is a
+ *    single right-to-left pass instead of one walk per brace;
+ *  · only spans that can open an object (`{` then a key or `}`) are handed to
+ *    JSON.parse. Every TOP-LEVEL span is parsed — top-level spans are
+ *    disjoint, so together they are at most the scanned window — and the
+ *    NESTED ones (a span inside an earlier candidate) share a budget of
+ *    `MAX_NESTED_PARSES` spans and `MAX_NESTED_CHARS` characters, so a run of
+ *    nested braces that parse is not re-parsed thousands of times.
+ *
+ * THE BUDGET NEVER REACHES A TOP-LEVEL SPAN, and the review found why it must
+ * not: the first cut counted every span from the left against one budget, so
+ * an answer that followed 250 JSON lines of a quoted fixture (or one large
+ * nested document) was never parsed at all — the turn read as `nothing` and a
+ * delivered agent went to Stuck. The contract puts the answer LAST and at the
+ * top level, which is the one span a budget must never cost.
+ */
+const MAX_SCAN_CHARS = 256 * 1024;
+const MAX_NESTED_PARSES = 200;
+const MAX_NESTED_CHARS = 4 * 1024 * 1024;
+
+function candidateObjects(text) {
+  const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  const raw = text.length > MAX_SCAN_CHARS ? text.slice(text.length - MAX_SCAN_CHARS) : text;
   const bodies = [];
   if (fenced) bodies.push(fenced[1]);
+  const close = closers(raw);
+  let topEnd = -1;
+  let nestedParses = 0;
+  let nestedChars = 0;
   for (let i = 0; i < raw.length; i++) {
     if (raw[i] !== '{') continue;
-    const end = balanced(raw, i);
-    if (end > i) bodies.push(raw.slice(i, end + 1));
+    const end = close.get(i);
+    if (!(end > i) || !/^\{\s*["}]/.test(raw.slice(i, i + 64))) continue;
+    if (i > topEnd) {
+      topEnd = end;
+    } else {
+      const len = end - i + 1;
+      if (nestedParses >= MAX_NESTED_PARSES || nestedChars + len > MAX_NESTED_CHARS) continue;
+      nestedParses++;
+      nestedChars += len;
+    }
+    bodies.push(raw.slice(i, end + 1));
   }
   const out = [];
   for (const body of bodies) {
@@ -75,32 +125,51 @@ function candidateObjects(raw) {
   return out;
 }
 
-function extract(raw) {
-  return candidateObjects(raw).find((v) => Array.isArray(v.agents)) ?? null;
-}
-
-/** The index of the `}` that closes the `{` at `from`, or -1. Skips string
- *  literals so a brace inside a card title cannot end the object early. */
-function balanced(s, from) {
-  let depth = 0;
-  let inStr = false;
-  let esc = false;
-  for (let i = from; i < s.length; i++) {
-    const ch = s[i];
-    if (inStr) {
-      if (esc) esc = false;
-      else if (ch === '\\') esc = true;
-      else if (ch === '"') inStr = false;
-      continue;
+/**
+ * For every `{`, the index of the `}` that closes it when read as the START of
+ * an object (outside any string), or -1 — the answer `balanced` gives, for all
+ * of them in one pass.
+ *
+ * Right to left, so every `{` AFTER the one being closed already has its
+ * answer. A walk that meets such a `{` outside a string jumps straight to that
+ * brace's closer — the string state from there on is the same for both walks,
+ * so the nested object ends where it ends — and if that brace never closes,
+ * neither does this one. What is left for each walk is its own top level.
+ */
+function closers(s) {
+  const close = new Map();
+  for (let i = s.lastIndexOf('{'); i >= 0; i = i > 0 ? s.lastIndexOf('{', i - 1) : -1) {
+    let inStr = false;
+    let esc = false;
+    let end = -1;
+    for (let k = i + 1; k < s.length; k++) {
+      const ch = s[k];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (ch === '\\') esc = true;
+        else if (ch === '"') inStr = false;
+        continue;
+      }
+      if (ch === '"') inStr = true;
+      else if (ch === '{') {
+        const inner = close.get(k);
+        if (inner === undefined || inner < 0) break;
+        k = inner;
+      } else if (ch === '}') {
+        end = k;
+        break;
+      }
     }
-    if (ch === '"') inStr = true;
-    else if (ch === '{') depth++;
-    else if (ch === '}' && --depth === 0) return i;
+    close.set(i, end);
   }
-  return -1;
+  return close;
 }
 
-export function parseProposal(text) {
+function extract(raw) {
+  return candidateObjects(raw).find((v) => Array.isArray(v.agents)) ?? null;
+}
+
+export function parseProposal(text, scrub = envScrub) {
   const raw = String(text ?? '');
   const parsed = extract(raw);
   if (!parsed) return null;
@@ -117,7 +186,7 @@ export function parseProposal(text) {
     if (taskIds.length === 0) continue;
     agents.push({
       tempId: String(g.tempId || `a${i + 1}`).slice(0, 64),
-      name: String(g.name ?? '').slice(0, MAX_NAME),
+      name: String(scrub(String(g.name ?? ''))).slice(0, MAX_NAME),
       taskIds,
       ...(Number.isFinite(g.pointsBudget) && g.pointsBudget > 0
         ? { pointsBudget: Math.min(Math.round(g.pointsBudget), 100_000) }
@@ -150,13 +219,45 @@ export function parseProposal(text) {
   }
   if (agents.length === 0) return null;
   return {
-    agents,
+    agents: uniqueTempIds(agents),
     ...(typeof parsed.note === 'string' && parsed.note.trim()
-      ? { note: parsed.note.slice(0, MAX_NOTE) }
+      ? { note: String(scrub(parsed.note)).slice(0, MAX_NOTE) }
       : {}),
   };
 }
 
+/**
+ * A DAEMON BELT ON THE SAME COLLISION THE SERVER ALREADY REFUSES TO SHIP
+ * (2026-09-24, the audit's A4a CROSS 5).
+ *
+ * Two groups can share one tempId two ways: the model repeats itself, or one
+ * group NAMES none and defaults to the positional `a${i+1}` a differently-
+ * ordered group already claimed. The web keys `draftByTask` / `proposedCards`
+ * by tempId (boardLanes.ts), so two containers sharing one id is not cosmetic —
+ * per-group Start/Decline on either one then deletes BOTH, because
+ * `planAfterGroup` filters `.agents` by tempId and both match.
+ *
+ * Kept a byte-for-byte copy of the server's own rule
+ * (`agentPlan.ts`'s `uniqueTempIds`, the boundary every daemon version passes
+ * through) rather than re-derived, so the two ends cannot disagree about which
+ * of two colliding agents keeps the id the model wrote. FIRST occurrence wins
+ * unchanged; each later collision is suffixed `-2`, `-3`, … off the ORIGINAL
+ * id (not the previous suffix), staying inside the 64-char bound the schema
+ * already enforces upstream.
+ *
+ * This is a BELT, not the fix: an older daemon proposing the same collision is
+ * still covered by the server's identical transform at its own boundary.
+ */
+function uniqueTempIds(list) {
+  const used = new Set();
+  return list.map((g) => {
+    let id = g.tempId;
+    for (let n = 2; used.has(id); n++) id = `${g.tempId.slice(0, 58)}-${n}`;
+    used.add(id);
+    return id === g.tempId ? g : { ...g, tempId: id };
+  });
+}
+
 /**
  * The running account, off whichever shape the turn ended with — `{ progress }`
  * or nothing at all.
@@ -181,9 +282,9 @@ export function parseProposal(text) {
  * a machine to have clamped.
  */
 const MAX_PROGRESS = 8000;
-const progressOf = (v) => {
+const progressOf = (v, scrub) => {
   const t = typeof v.progress === 'string' ? v.progress.trim() : '';
-  return t ? { progress: t.slice(0, MAX_PROGRESS) } : {};
+  return t ? { progress: String(scrub(t)).slice(0, MAX_PROGRESS) } : {};
 };
 
 /**
@@ -222,7 +323,28 @@ const progressOf = (v) => {
  * caller omits the field rather than sending an empty string, so the server
  * keeps the last account that was true instead of blanking the head.
  */
-export function parseTurnResult(text) {
+/*
+ * ── EVERY STRING IS SCRUBBED HERE, BEFORE ITS CAP (2026-09-24, the audit) ──
+ *
+ * `raised` cards and a proposal's `note` and names reached the server with no
+ * scrub at all — the caller redacted `answer` and `progress` and nothing
+ * else — so a build turn that quoted `STRIPE_SECRET_KEY=sk_live_…` in a
+ * raised card's brief filed it, verbatim, as an Open card every member reads
+ * and later agents are prompted with; and a planner note quoting one became a
+ * notification body. And `answer` was cut at 8000 HERE, before the caller's
+ * scrub, which is the straddling-cut bug `progress` and the precheck already
+ * record: `scrub` matches whole values, so a credential across the cut kept
+ * its prefix. So the scrub rides in, as `parsePrecheck`'s does, and runs over
+ * each whole field first.
+ *
+ * DEFAULTED TO THE REAL SCRUBBER, unlike the precheck's identity default: the
+ * production callers pass nothing, and a redaction that depends on each caller
+ * remembering is the one that is missing the day it matters. Scrubbing twice
+ * (the caller still scrubs `answer`) is harmless — a redaction marker contains
+ * no secret to match.
+ */
+export function parseTurnResult(text, scrub = envScrub) {
+  const clean = (s, cap) => String(scrub(s)).slice(0, cap);
   for (const v of candidateObjects(String(text ?? ''))) {
     if (v.status === 'blocked') {
       const question = typeof v.question === 'string' ? v.question.trim() : '';
@@ -230,21 +352,21 @@ export function parseTurnResult(text) {
       // parks an agent with nothing to reply to. Treated as `nothing`, which
       // at least says truthfully that the machine went quiet.
       if (!question) continue;
-      return { outcome: 'question', answer: question.slice(0, 8000), ...progressOf(v) };
+      return { outcome: 'question', answer: clean(question, 8000), ...progressOf(v, scrub) };
     }
     if (v.status === 'delivered') {
       return {
         outcome: 'delivered',
-        answer: (typeof v.summary === 'string' ? v.summary : '').slice(0, 8000),
-        ...progressOf(v),
+        answer: typeof v.summary === 'string' ? clean(v.summary, 8000) : '',
+        ...progressOf(v, scrub),
         raised: Array.isArray(v.raised)
           ? v.raised
               .filter((r) => r && typeof r.title === 'string' && r.title.trim())
               .slice(0, 10)
               .map((r) => ({
-                title: r.title.trim().slice(0, 300),
+                title: clean(r.title.trim(), 300),
                 ...(typeof r.brief === 'string' && r.brief.trim()
-                  ? { brief: r.brief.trim().slice(0, 2000) }
+                  ? { brief: clean(r.brief.trim(), 2000) }
                   : {}),
               }))
           : [],