flowviant 0.97.0 → 0.100.0

package/bin/lib/artifacts.mjs

@@ -75,15 +75,23 @@
  * that cannot show an artifact must not have the CLI told it will.
  */
 
-import { constants, closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync } from 'node:fs';
+import { constants, closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync, mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { pathToFileURL } from 'node:url';
+import { captureScreenshot } from './shot.mjs';
 
 /** Relative to the directory the turn stands in. Under `.flowviant/`, which
  *  the exclude file already hides from git (`excludeInWorktree`). */
 export const ARTIFACT_DIR = '.flowviant/artifacts';
 /** The server's per-file ceiling, re-checked here. */
 export const ARTIFACT_MAX_BYTES = 2 * 1024 * 1024;
+export const ARTIFACT_BINARY_MODEL_MAX_BYTES = 20 * 1024 * 1024;
+export const DESIGN_PREVIEW_MAX_BYTES = 2 * 1024 * 1024;
+const PREVIEW_CSP = "default-src 'none'; script-src 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net/npm/ https://unpkg.com; style-src 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net/npm/ https://unpkg.com https://fonts.googleapis.com; img-src data: blob:; font-src data: https://fonts.gstatic.com; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'";
+export const artifactMaxBytesFor = (name) => /\.(?:glb|bin)$/i.test(name)
+  ? ARTIFACT_BINARY_MODEL_MAX_BYTES : ARTIFACT_MAX_BYTES;
 /** Listed per scan, newest first — the server keeps as many per owner. */
 export const ARTIFACT_MAX_FILES = 40;
 /** A held upload is tried this many times in all, then dropped with a line. */
@@ -114,6 +122,10 @@ export const ARTIFACT_TYPES = {
   pptx: { mime: 'application/vnd.openxmlformats-officedocument.presentationml.presentation', text: false },
   xlsx: { mime: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', text: false },
   pdf: { mime: 'application/pdf', text: false },
+  gltf: { mime: 'model/gltf+json', text: true },
+  obj: { mime: 'model/obj', text: true },
+  glb: { mime: 'model/gltf-binary', text: false },
+  bin: { mime: 'application/octet-stream', text: false },
 };
 
 export function artifactTypeFor(name) {
@@ -146,23 +158,23 @@ export function scanArtifacts(placeDir) {
   } catch {
     return [];
   }
-  let names;
-  try {
-    names = readdirSync(dir);
-  } catch {
-    return [];
-  }
   const out = [];
-  for (const name of names) {
-    if (name.startsWith('.')) continue; // editor swap files, `.DS_Store`
-    try {
-      const st = lstatSync(join(dir, name));
-      if (!st.isFile()) continue; // symlinks, directories, sockets: nothing
-      out.push({ name, path: join(dir, name), size: st.size, mtimeMs: st.mtimeMs });
-    } catch {
-      /* vanished between the list and the stat */
+  const walk = (at, prefix = '', depth = 0) => {
+    if (depth > 4) return;
+    let names;
+    try { names = readdirSync(at); } catch { return; }
+    for (const part of names) {
+      if (part.startsWith('.')) continue;
+      const name = prefix ? `${prefix}/${part}` : part;
+      const path = join(at, part);
+      try {
+        const st = lstatSync(path);
+        if (st.isDirectory() && !st.isSymbolicLink()) walk(path, name, depth + 1);
+        else if (st.isFile() && !st.isSymbolicLink()) out.push({ name, path, size: st.size, mtimeMs: st.mtimeMs });
+      } catch { /* vanished */ }
     }
-  }
+  };
+  walk(dir);
   out.sort((a, b) => b.mtimeMs - a.mtimeMs || a.name.localeCompare(b.name));
   return out.slice(0, ARTIFACT_MAX_FILES);
 }
@@ -200,6 +212,40 @@ function readNoFollow(path, limit) {
   }
 }
 
+/** FNV-1a, 32-bit, as 8 hex — verbatim against the server's `fnv1a8`
+ *  (apps/api/src/routes/sessionsAttachments.routes.ts). */
+function artifactFnv1a8(s) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(16).padStart(8, '0');
+}
+const ARTIFACT_SAFE_EXT_RE = /^[A-Za-z0-9]{1,10}$/;
+/**
+ * `safeFileName`, verbatim in effect (apps/api/src/routes/sessionsAttachments.
+ * routes.ts): keeps the extension through a cut. Applied to each relative
+ * path component, so a model under `scene/` keeps that relation to its page.
+ * This only differs from a component on an over-long name — but that is exactly the case the
+ * server's own `safeFileName(rawName)` would otherwise re-cut DIFFERENTLY
+ * from whatever this reported, since a bare truncation and an
+ * extension-preserving one disagree past 80 characters. Applying the same
+ * rule here means the server's re-application is a no-op and the name a
+ * design or research delivery is judged by is the one this machine reported.
+ */
+function safeArtifactName(raw) {
+  if (typeof raw === 'string' && raw.length <= 80 && /^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(raw) && !raw.endsWith('.')) return raw;
+  const clean = String(raw ?? '').replace(/[^A-Za-z0-9._-]/g, '_');
+  if (clean.length <= 80) return clean || 'artifact';
+  const dot = clean.lastIndexOf('.');
+  const ext = dot > 0 && ARTIFACT_SAFE_EXT_RE.test(clean.slice(dot + 1)) ? clean.slice(dot + 1) : '';
+  const stem = ext ? clean.slice(0, dot) : clean;
+  const tag = `-${artifactFnv1a8(clean)}`;
+  const room = 80 - tag.length - (ext ? ext.length + 1 : 0);
+  return `${stem.slice(0, room)}${tag}${ext ? `.${ext}` : ''}`;
+}
+
 /**
  * ONE UPLOAD BODY, as data — fields plus optional bytes — so a held body is
  * re-sent exactly as it was first built (scrubbed once, never re-read from a
@@ -210,14 +256,15 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
   const fields = {
     ...(sessionId ? { sessionId } : { agentId }),
     ...(turnId ? { turnId } : {}),
-    name: entry.name,
+    name: entry.name.split('/').map(safeArtifactName).join('/'),
     bytes: String(entry.size),
   };
   if (!type) return { fields, bytes: null }; // reported by name only
-  if (entry.size > ARTIFACT_MAX_BYTES) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
+  const maxBytes = artifactMaxBytesFor(entry.name);
+  if (entry.size > maxBytes) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
   let bytes;
   try {
-    bytes = readNoFollow(entry.path, ARTIFACT_MAX_BYTES);
+    bytes = readNoFollow(entry.path, maxBytes);
   } catch {
     return null; // vanished, or a symlink swapped in: nothing to say
   }
@@ -229,7 +276,7 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
   } else {
     bytes = Buffer.from(String(scrub(bytes.toString('utf8'))), 'utf8');
     // A redaction marker can be longer than the value it replaced.
-    if (bytes.byteLength > ARTIFACT_MAX_BYTES) {
+    if (bytes.byteLength > maxBytes) {
       return { fields: { ...fields, bytes: String(bytes.byteLength), tooLarge: '1' }, bytes: null };
     }
   }
@@ -244,6 +291,33 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
   };
 }
 
+/** Render the scrubbed HTML, never the checkout's unsanitized source. A
+ * failed browser measurement is explicit; older daemon reports are absent. */
+export async function renderDesignPreview(bytes, capture = captureScreenshot) {
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-design-'));
+  try {
+    const html = join(dir, 'design.html');
+    const png = join(dir, 'design.png');
+    // A fresh Chrome profile has no Flowviant credentials. Put the artifact
+    // box's network fence before any model-written markup executes.
+    writeFileSync(html, Buffer.concat([
+      Buffer.from(`<meta http-equiv="Content-Security-Policy" content="${PREVIEW_CSP}">`),
+      bytes,
+    ]));
+    const result = await capture({ url: pathToFileURL(html).href, out: png, width: 720, height: 450, timeoutMs: 15_000 });
+    if (!result.ok) return { renderState: 'unavailable' };
+    const image = readFileSync(png);
+    if (image.byteLength > DESIGN_PREVIEW_MAX_BYTES || !image.subarray(0, 8).equals(Buffer.from([137,80,78,71,13,10,26,10]))) {
+      return { renderState: 'unavailable' };
+    }
+    return { renderState: 'rendered', preview: image };
+  } catch {
+    return { renderState: 'unavailable' };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 /**
  * The reporter a work manager holds for its life. `report` is called once per
  * finished turn and never awaited by the turn (a slow uplink must not hold the
@@ -259,6 +333,7 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secr
     const form = new FormData();
     for (const [k, v] of Object.entries(body.fields)) form.set(k, v);
     if (body.bytes) form.set('file', new Blob([body.bytes]), body.fields.name);
+    if (body.preview) form.set('preview', new Blob([body.preview], { type: 'image/png' }), 'preview.png');
     try {
       const res = await doFetch(url, {
         method: 'POST',
@@ -282,12 +357,40 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secr
     }
     pending.delete(key); // re-insert at the tail, so the cap sheds the oldest
     pending.set(key, { body, tries });
-    while (pending.size > MAX_PENDING) pending.delete(pending.keys().next().value);
+    while (pending.size > MAX_PENDING) {
+      const shed = pending.keys().next().value;
+      pending.delete(shed);
+      if (!chains.has(shed)) genOf.delete(shed);
+    }
   };
 
-  const send = async (key, body, tries) => {
-    if (await post(body)) pending.delete(key);
-    else hold(key, body, tries + 1);
+  // ONE COPY OF A FILE IS IN FLIGHT AT A TIME, AND ONLY THE NEWEST MAY
+  // DECIDE. Each report of a (owner, name) takes a fresh generation, and every
+  // post for that key is chained behind the previous one — so a slow retry of
+  // an OLD body can neither land on the server after the newer copy (the
+  // server upserts by name, so the last write wins) nor re-hold itself over
+  // the newer one when it fails. A body superseded before it went out is not
+  // sent at all; one superseded while in flight has its answer discarded.
+  let generation = 0;
+  const genOf = new Map(); // key -> the generation allowed to decide
+  const chains = new Map(); // key -> the tail of that key's post chain
+
+  const send = (key, body, tries, gen) => {
+    const run = (chains.get(key) ?? Promise.resolve()).then(async () => {
+      if (genOf.get(key) !== gen) return; // superseded before it went out
+      const ok = await post(body);
+      if (genOf.get(key) !== gen) return; // a newer copy decides for this key
+      if (ok) pending.delete(key);
+      else hold(key, body, tries + 1);
+    });
+    const tail = run.catch(() => {});
+    chains.set(key, tail);
+    tail.then(() => {
+      if (chains.get(key) !== tail) return;
+      chains.delete(key);
+      if (!pending.has(key)) genOf.delete(key); // settled: nothing left to order
+    });
+    return run;
   };
 
   let retrying = false;
@@ -297,7 +400,7 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secr
     try {
       for (const [key, held] of [...pending]) {
         if (pending.get(key) !== held) continue; // superseded meanwhile
-        await send(key, held.body, held.tries);
+        await send(key, held.body, held.tries, genOf.get(key));
       }
     } finally {
       retrying = false;
@@ -317,9 +420,16 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secr
         log(`artifact ${entry.name}: not uploaded — it contains the value of ${body.withheld} from this machine's environment`);
         continue;
       }
+      if (body.bytes && /\.html?$/i.test(entry.name)) {
+        const measured = await renderDesignPreview(body.bytes);
+        body.fields.renderState = measured.renderState;
+        if (measured.preview) body.preview = measured.preview;
+      }
       const key = `${sessionId ?? agentId}:${entry.name}`;
       pending.delete(key); // this copy supersedes a held older one
-      await send(key, body, 0);
+      const gen = ++generation;
+      genOf.set(key, gen); // …and one still in flight
+      await send(key, body, 0, gen);
       n++;
     }
     return n;

package/bin/lib/authReject.mjs

@@ -0,0 +1,32 @@
+/**
+ * DID THE API REJECT THIS CREDENTIAL, OR DID SOMETHING IN FRONT OF IT ANSWER?
+ *
+ * A 401 or 403 on a machine-token route used to be read as "the credential is
+ * revoked" on sight, and the daemon exited for good — exit 0, so nothing
+ * restarts it. But Cloudflare sits in front of the API and answers this client
+ * class with its own 403s (a bot-management challenge, a 1020 firewall rule, a
+ * Browser Integrity Check false positive), as an HTML page. One of those on one
+ * poll took an unattended machine offline over a credential that was still
+ * valid: in-flight turns expired into Stuck, queued presses failed, and the
+ * board said the machine was gone.
+ *
+ * The API's own refusal always wears its JSON envelope — `app.onError` renders
+ * every HTTPException, including the machine-token middleware's "Token
+ * revoked", "Invalid machine token" and "Not a machine credential", as
+ * `{ success: false, error }` — so THAT is the credential rejection. Anything
+ * else carrying the same status is somebody else's answer, and the caller
+ * retries it like any other failed request.
+ *
+ * Reads the body, so call it only on a 401/403 whose body is not needed.
+ */
+export async function credentialRejected(res) {
+  if (res?.status !== 401 && res?.status !== 403) return false;
+  const type = String(res.headers?.get?.('content-type') ?? '');
+  if (!/\bapplication\/json\b/i.test(type)) return false;
+  try {
+    const body = await res.json();
+    return Boolean(body) && body.success === false;
+  } catch {
+    return false; // not the API's envelope — an edge page mislabelled as JSON
+  }
+}

package/bin/lib/authproxy.mjs

@@ -116,6 +116,10 @@ const MAX_SOURCES = 500;
 
 const digest = (s) => createHash('sha256').update(String(s)).digest();
 
+/** An Authorization header in the Basic scheme — the only shape the gate's own
+ *  password ever arrives in, and so the only one it grades. */
+const isBasic = (v) => typeof v === 'string' && /^\s*basic(\s|$)/i.test(v);
+
 /** Constant-time over sha256 digests, so length never leaks and a missing
  *  header costs the same as a wrong one. */
 function sameSecret(a, b) {
@@ -137,7 +141,18 @@ function sameSecret(a, b) {
  * URL under attack. A single source is blocked on its own, at MAX_FAILED,
  * without ending anybody else's share.
  */
-export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId, authorizeUrl }) {
+export function startAuthProxy({
+  targetPort,
+  // The address that reaches the ATTRIBUTED socket (listeners.mjs `originFor`)
+  // — `::1` for a dev server bound to the IPv6 loopback. Defaults to the IPv4
+  // loopback it always dialled, for a caller that measured nothing.
+  targetHost = '127.0.0.1',
+  log,
+  onAbuse,
+  grantSecret,
+  shareId,
+  authorizeUrl,
+}) {
   // ALL THREE OR NONE. Two of the three is a gate that cannot bounce anybody:
   // a secret with no authorize URL has nowhere to send them, an authorize URL
   // with no secret cannot verify what comes back. An older SERVER sends none of
@@ -217,7 +232,36 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     // whole thing down. An expired-but-validly-signed grant must never count
     // either, or a viewer who left a tab open overnight closes the share on
     // their own reload.
-    if (req.headers['authorization']) {
+    //
+    // AND ONLY A *BASIC* HEADER IS A PASSWORD ATTEMPT (audit 2026-09-24). Any
+    // Authorization header used to be graded against the gate password, so a
+    // previewed SPA calling its own `/api` with `Authorization: Bearer …` was
+    // answered 401 with a Basic challenge — over a valid grant cookie — and 25
+    // such calls blocked that viewer, eight viewers tore the share down, and
+    // the origin never saw its own header. A Bearer (or any other scheme) is
+    // the APP's credential: it is not ours to grade and it rides through.
+    //
+    // A VALID GRANT COOKIE IS ASKED FIRST, for the same reason: an app that
+    // itself speaks Basic sends a header that is not our password, and a
+    // viewer the app has vouched for must not be graded on it. A grant is
+    // HMAC-verified, so asking it first opens no brute-force path.
+    let grantVerdict = 'none';
+    if (grants) {
+      // EVERY value for our name, not the first — a duplicate must not shadow.
+      for (const raw of cookieValues(req.headers.cookie, GRANT_COOKIE)) {
+        const r = verifyGrant(raw, { secret: grantSecret, shareId });
+        if (r.ok) return 'ok';
+        if (r.reason === 'exp' && grantVerdict === 'none') {
+          lastExpired = r.payload;
+          grantVerdict = 'expired';
+        }
+      }
+      if (grantVerdict === 'none' && String(req.headers.cookie ?? '').includes(GRANT_COOKIE)) {
+        grantVerdict = 'forged';
+      }
+    }
+
+    if (isBasic(req.headers['authorization'])) {
       // A blocked source is refused BEFORE the comparison — a block that
       // still grades guesses would let the brute force run to a correct hit.
       if (sourceBlocked(req)) return 'blocked';
@@ -230,18 +274,7 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
       noteFailure(req);
       return 'badpass';
     }
-
-    if (!grants) return 'none';
-    // EVERY value for our name, not the first — a duplicate must not shadow.
-    for (const raw of cookieValues(req.headers.cookie, GRANT_COOKIE)) {
-      const r = verifyGrant(raw, { secret: grantSecret, shareId });
-      if (r.ok) return 'ok';
-      if (r.reason === 'exp') {
-        lastExpired = r.payload;
-        return 'expired';
-      }
-    }
-    return String(req.headers.cookie ?? '').includes(GRANT_COOKIE) ? 'forged' : 'none';
+    return grantVerdict;
   };
 
   /**
@@ -338,7 +371,10 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
   // its request would be us editing their app's input.
   const forwardOpts = (req) => {
     const headers = { ...req.headers };
-    delete headers.authorization;
+    // Only when it IS the gate credential. Anything else in Authorization is
+    // the previewed app's own (a Bearer to its API, its own Basic realm) and
+    // the app breaks without it; ours must still never reach branch code.
+    if (sameSecret(headers.authorization, expected)) delete headers.authorization;
     delete headers['proxy-authorization'];
     // ONLY OURS. The driver's app owns its own cookies and breaks without them;
     // our grant is a signed bearer token and must not reach branch code.
@@ -346,7 +382,7 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     if (rest) headers.cookie = rest;
     else delete headers.cookie; // never send a bare empty `cookie:`
     return {
-      host: '127.0.0.1',
+      host: targetHost,
       port: targetPort,
       method: req.method,
       path: req.url,

package/bin/lib/childEnv.mjs

@@ -223,9 +223,41 @@ export const DEPLOY_KEEP_NAMES = [...DEPLOY_KEEP];
  * never leave the box either way; names would, and a name is enough to tell
  * somebody which credential to go looking for.
  */
+/**
+ * …AND THE DAEMON'S OWN CREDENTIALS, REDACTED AND NEVER ADMITTED (2026-09-24,
+ * the audit).
+ *
+ * The list above was written about the deploy lane, and it left out every
+ * credential the DAEMON itself runs on: the machine credential
+ * (`FLOWVIANT_MACHINE_TOKEN`, or its permanent `FLOWVIANT_FLEET` fallback on a
+ * headless box), and whatever signs the operator's CLIs and `gh` in. Those are
+ * the values a CLI turn can most easily reach — a turn inherits this process's
+ * environment, and `env` is one Bash call — and a turn trace, an answer and an
+ * artifact are all posted to the server. Redacting a value we never pass costs
+ * nothing (the `CF_*` argument above), so they join the REDACTION list only;
+ * `DEPLOY_KEEP` is untouched and `childEnv` still hands none of them to anybody.
+ *
+ * The machine credential is ALSO caught by shape in `env.mjs` (`fva_…`),
+ * because the copy that matters most is not in any environment variable at all:
+ * it is every project's `fleetToken` in `~/.flowviant/credentials.json`, plus
+ * the per-turn work/capture tokens the server mints. The names here are belt.
+ */
+const REDACT_ONLY = [
+  'CF_API_TOKEN',
+  'CF_ACCOUNT_ID',
+  'FLOWVIANT_MACHINE_TOKEN',
+  'FLOWVIANT_FLEET',
+  'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  'CLAUDE_CODE_OAUTH_TOKEN',
+  'OPENAI_API_KEY',
+  'GH_TOKEN',
+  'GITHUB_TOKEN',
+];
+
 export function processEnvSecrets() {
   const out = [];
-  for (const name of [...DEPLOY_KEEP, 'CF_API_TOKEN', 'CF_ACCOUNT_ID']) {
+  for (const name of [...DEPLOY_KEEP, ...REDACT_ONLY]) {
     const value = process.env[name];
     if (typeof value === 'string' && value) out.push({ name, value });
   }