flowviant 0.97.0 → 0.100.0

package/bin/lib/env.mjs

@@ -69,8 +69,19 @@
  * caller.
  */
 
-import { readdirSync, readFileSync, writeFileSync, mkdirSync, lstatSync } from 'node:fs';
-import { createHash } from 'node:crypto';
+import {
+  readdirSync,
+  readFileSync,
+  mkdirSync,
+  lstatSync,
+  openSync,
+  writeSync,
+  fsyncSync,
+  closeSync,
+  linkSync,
+  unlinkSync,
+} from 'node:fs';
+import { createHash, randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 // STILL SUMO, and deliberately not narrowed to the standard build in the same
@@ -170,7 +181,17 @@ function characterClasses(value) {
 }
 function worthRedacting(value) {
   if (typeof value !== 'string' || value.length < SCRUB_MIN_LENGTH) return false;
-  if (SCRUB_PLAIN_RE.test(value)) return false;
+  // THE PLAIN-IDENTIFIER EXEMPTION DOES NOT COVER A CASE-AND-DIGIT MIX
+  // (2026-09-24, the audit). It was checked first and alone, so a generated
+  // password — `Tq8vZ2mKp4Lx9RbN`, the `pwgen -s 16` shape, or a twelve-
+  // character `Hx93kPq2Lm7w` — starts with a letter, fits sixteen characters of
+  // [A-Za-z0-9] and was left in plain text everywhere this daemon posts, against
+  // this block's own promise that "a case mix" is redacted. A word, a hostname,
+  // a region or a version string does not draw on upper, lower AND digits at
+  // once; a minted secret almost always does.
+  if (SCRUB_PLAIN_RE.test(value) && !(/[a-z]/.test(value) && /[A-Z]/.test(value) && /[0-9]/.test(value))) {
+    return false;
+  }
   if (value.length < 12 && characterClasses(value) < 3) return false;
   return true;
 }
@@ -277,19 +298,87 @@ export async function ensureKeypair() {
     };
     return keypair;
   }
-  keypair = sodium.crypto_box_keypair();
-  mkdirSync(dirname(KEYPAIR_PATH), { recursive: true });
-  writeFileSync(
+  const minted = sodium.crypto_box_keypair();
+  const winner = mintKeypairFile(
     KEYPAIR_PATH,
     JSON.stringify({
-      pub: sodium.to_base64(keypair.publicKey, B64()),
-      priv: sodium.to_base64(keypair.privateKey, B64()),
-    }),
-    { mode: 0o600 }
+      pub: sodium.to_base64(minted.publicKey, B64()),
+      priv: sodium.to_base64(minted.privateKey, B64()),
+    })
   );
+  keypair = {
+    publicKey: sodium.from_base64(winner.pub, B64()),
+    privateKey: sodium.from_base64(winner.priv, B64()),
+  };
   return keypair;
 }
 
+/**
+ * WRITE THE BOX'S IDENTITY ONCE, ATOMICALLY, AND LET THE FIRST WRITER WIN
+ * (2026-09-24, the audit). Returns the `{ pub, priv }` that is ON DISK after
+ * the call — ours, or the one a concurrent first start got there with.
+ *
+ * It was a plain `writeFileSync` reached by every process that saw ENOENT, so
+ * two daemons starting together on a fresh box (two projects, two units at
+ * boot) each minted a key and the LAST writer won: the first kept a key in
+ * memory the disk no longer held and arrived, after its next re-exec, as a
+ * different box. And a crash inside the write left a torn file that every later
+ * start refuses to read — the only-ENOENT-mints rule doing its job over a file
+ * nothing can fix.
+ *
+ * So the key goes to a private temp file, is fsync'd, and is LINKED into place:
+ * `link` fails with EEXIST instead of replacing, so exactly one identity is ever
+ * published and every loser reads the winner's. The file at the real path is
+ * either absent or complete — never half of one.
+ */
+export function mintKeypairFile(path, body) {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  try {
+    const fd = openSync(tmp, 'wx', 0o600);
+    try {
+      writeSync(fd, body);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    try {
+      linkSync(tmp, path);
+      return JSON.parse(body);
+    } catch (e) {
+      if (e?.code === 'EEXIST') {
+        // Somebody else published first. Theirs is the identity; ours is dropped.
+        return JSON.parse(readFileSync(path, 'utf8'));
+      }
+      // A filesystem with no hard links (some network and FUSE mounts answer
+      // EPERM/ENOTSUP) must not cost the box its identity — the plain write
+      // this replaced worked there. Fall back to an EXCLUSIVE create: still
+      // first-writer-wins, only without the torn-write guarantee.
+      if (!['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV'].includes(e?.code)) throw e;
+      let fd2;
+      try {
+        fd2 = openSync(path, 'wx', 0o600);
+      } catch (e2) {
+        if (e2?.code !== 'EEXIST') throw e2;
+        return JSON.parse(readFileSync(path, 'utf8'));
+      }
+      try {
+        writeSync(fd2, body);
+        fsyncSync(fd2);
+      } finally {
+        closeSync(fd2);
+      }
+      return JSON.parse(body);
+    }
+  } finally {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      /* already gone */
+    }
+  }
+}
+
 export function myPubB64() {
   return keypair ? sodium.to_base64(keypair.publicKey, B64()) : null;
 }
@@ -720,12 +809,35 @@ export function scanEnvForScrub(repoRoot, salt = PROJECT_ID) {
  *  ordinary word, a short flag and anything under the length floor are simply
  *  not in it. */
 export function scrub(text) {
-  if (typeof text !== 'string' || !text || !values.length) return text;
+  if (typeof text !== 'string' || !text) return text;
   let out = text;
   for (const v of values) out = out.split(v.value).join(`[REDACTED:${v.name}]`);
-  return out;
+  return out.replace(FLOWVIANT_TOKEN_RE, `[REDACTED:${FLOWVIANT_TOKEN_NAME}]`);
 }
 
+/**
+ * EVERY FLOWVIANT CREDENTIAL, CAUGHT BY SHAPE (2026-09-24, the audit).
+ *
+ * The value lists above are the CHECKOUT'S secrets and the process
+ * environment's, and neither holds the one secret that costs the project
+ * itself: the MACHINE CREDENTIAL. It sits in `~/.flowviant/credentials.json` —
+ * for EVERY project connected on this box, 0600 and readable by every turn,
+ * since a turn runs as this uid — and the server mints more of the same shape
+ * per turn (the work and capture tokens a tab's MCP server carries). A turn
+ * that read the store and wrote it into an artifact, a trace or an answer
+ * shipped it verbatim, because `scrub` had no value to match; and a design
+ * artifact runs scripts in a frame that may navigate itself, so the page that
+ * held it could carry it anywhere.
+ *
+ * Every one of them is `fva_` + 40 characters of nanoid (the server's
+ * `AGENT_TOKEN_PREFIX`), so a SHAPE catches them all, including ones this
+ * process never saw, with no store read and nothing to keep in sync. Twenty is
+ * the floor so the 12-character prefix the app shows for identification
+ * (`fva_` + 8) still reads as itself.
+ */
+const FLOWVIANT_TOKEN_RE = /fva_[A-Za-z0-9_-]{20,}/g;
+const FLOWVIANT_TOKEN_NAME = 'FLOWVIANT_TOKEN';
+
 /**
  * The NAME of the first known secret whose value appears in `bytes` as an
  * exact byte substring, or null. For the payloads `scrub` cannot touch: a
@@ -738,7 +850,12 @@ export function scrub(text) {
  * it is used (artifacts.mjs).
  */
 export function secretIn(bytes) {
-  if (!Buffer.isBuffer(bytes) || !bytes.length || !values.length) return null;
+  if (!Buffer.isBuffer(bytes) || !bytes.length) return null;
   for (const v of values) if (bytes.includes(v.value, 0, 'utf8')) return v.name;
+  // The token SHAPE too (see `scrub`). `latin1` maps every byte to one
+  // character, so the ASCII pattern matches exactly where the bytes do.
+  if (bytes.includes('fva_') && new RegExp(FLOWVIANT_TOKEN_RE.source).test(bytes.toString('latin1'))) {
+    return FLOWVIANT_TOKEN_NAME;
+  }
   return null;
 }

package/bin/lib/fleet.mjs

@@ -34,11 +34,16 @@ import {
   LIVE,
   AUTO_UPDATE,
   CREDENTIAL,
+  learnProjectId,
+  storedCredentialInUse,
 } from './config.mjs';
-import { projectLabel, setStoredProjectName } from './credentials.mjs';
-import { handleVersionSignal } from './update.mjs';
+import { projectLabel, safeName, setStoredProjectName } from './credentials.mjs';
+import { credentialRejected } from './authReject.mjs';
+import { handleVersionSignal, cmpVersion } from './update.mjs';
+import { emitMachineEvent, writeDaemonState } from './desktopContract.mjs';
 import {
   git,
+  gitNetAsync,
   resetWorktree,
   repoRootOrDie,
   detectBaseRef,
@@ -88,6 +93,8 @@ import { effectiveMaxTurns, setServerMaxTurns } from './admission.mjs';
 import { scanLocalSessions, ourConversationIds } from './localSessions.mjs';
 import { repoState } from './repoState.mjs';
 import { claudeAuthContext } from './claudeAuth.mjs';
+import { readBaseTools, runnerToolCapabilities, toolReadout } from './projectTools.mjs';
+import { runtimeOfferings } from './runtimeOfferings.mjs';
 
 /** Said once per process — see the catch around `envQueryParams` below. */
 let warnedEnvIdentity = false;
@@ -163,7 +170,8 @@ async function fetchRoster(
    *  rather than re-derived: `repoRootOrDie` is resolved once at startup and
    *  running git on every poll to re-learn a constant would be a syscall for
    *  a readout. */
-  repoRoot = null
+  repoRoot = null,
+  baseRef = null
 ) {
   const url = new URL(FLEET_URL);
   if (haveIds.length) url.searchParams.set('have', haveIds.join(','));
@@ -301,6 +309,18 @@ async function fetchRoster(
   } catch {
     /* best-effort — the poll must never fail on a readout */
   }
+  if (repoRoot && baseRef) {
+    try {
+      const offerings = detectRuntimes().some((rt) => rt.id === 'codex' && rt.installed)
+        ? runtimeOfferings(repoRoot, baseRef) : {};
+      for (const [param, report] of Object.entries(offerings)) {
+        if (Object.keys(report).length) {
+          const payload = JSON.stringify(report);
+          if (payload.length <= 8_000 && url.toString().length + encodeURIComponent(payload).length <= 14_000) url.searchParams.set(param, payload);
+        }
+      }
+    } catch { /* local readouts never fail the poll */ }
+  }
   // THIS BOX'S IDENTITY — `envpub`, and since 2026-09-21 nothing else.
   //
   // It carried two more params while the secrets vault existed: `envv` (the
@@ -424,10 +444,16 @@ async function fetchRoster(
     signal: AbortSignal.timeout(30_000), // a black-holed poll must not stall the loop
   });
   if (res.status === 401 || res.status === 403) {
-    // Fleet credential revoked/expired — retrying can't recover; signal exit.
-    const e = new Error(`fleet credential rejected (${res.status})`);
-    e.auth = true;
-    throw e;
+    // Revoked or expired — retrying can't recover, so signal exit. But ONLY on
+    // the API's own refusal: an edge 403 (Cloudflare's bot checks, which this
+    // very client class trips) is a retryable failure, and exiting on one took
+    // a machine offline for good over a credential that was still valid.
+    if (await credentialRejected(res)) {
+      const e = new Error(`fleet credential rejected (${res.status})`);
+      e.auth = true;
+      throw e;
+    }
+    throw new Error(`fleet poll refused by something in front of the API (${res.status})`);
   }
   if (!res.ok) throw new Error(`fleet poll failed (${res.status})`);
   // THE ASK IS SPENT HERE AND NOWHERE ELSE — on a poll the server actually
@@ -761,6 +787,36 @@ export async function maybeReportEnv(repoRoot) {
   }
 }
 
+const TOOLS_REPORT_URL = FLEET_URL.replace(/\/agents\/?$/, '/tools-report');
+let toolsReportSent = null;
+let toolsReportUnsupported = false;
+let toolsReportAt = 0;
+/** Repo tool readiness is a per-box daemon report. Never include env values. */
+export async function maybeReportTools(repoRoot, baseRef) {
+  if (Date.now() - toolsReportAt < 60_000) return;
+  toolsReportAt = Date.now();
+  if (toolsReportUnsupported) return;
+  const pubkey = myPubB64();
+  if (!pubkey) return;
+  let payload;
+  try {
+    const snapshot = readBaseTools(repoRoot, baseRef);
+    const installed = detectRuntimes().filter((r) => r.installed);
+    const runner = installed.find((r) => runnerToolCapabilities(r.id).mcp)?.id ?? installed[0]?.id ?? 'none';
+    payload = JSON.stringify({ pubkey, tools: toolReadout(snapshot, runner) });
+  } catch { return; }
+  if (payload === toolsReportSent) return;
+  try {
+    const res = await fetch(TOOLS_REPORT_URL, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT, 'Content-Type': 'application/json' },
+      signal: AbortSignal.timeout(15_000), body: payload,
+    });
+    if (envReportIsPermanent(res.status)) toolsReportUnsupported = true;
+    toolsReportSent = res.ok ? payload : null;
+  } catch { toolsReportSent = null; }
+}
+
 /**
  * A STOP COMMANDED BY FLOWVIANT, read off the roster poll.
  *
@@ -891,10 +947,9 @@ export function createHolderWatch({ say = () => {} } = {}) {
         const took = holder.took;
         if (took && typeof took === 'object' && !Array.isArray(took)) {
           standbyKey = null;
-          const from =
-            typeof took.from === 'string' && took.from.trim()
-              ? took.from.trim().slice(0, 64)
-              : 'another machine';
+          // scrubbed before it reaches a terminal (2026-09-24, the audit) —
+          // see printable.mjs.
+          const from = safeName(took.from)?.slice(0, 64) ?? 'another machine';
           const turns = Number.isInteger(took.turns) && took.turns > 0 ? took.turns : null;
           say(
             `took this project's machine from ${from}` +
@@ -913,10 +968,9 @@ export function createHolderWatch({ say = () => {} } = {}) {
       // The NAME is all the response carries about the other box, so it is also
       // the only thing "a distinct holder" can be keyed on. An unnamed holder
       // keys on the empty string, which is stable — one announcement, not one
-      // per poll.
-      const name = typeof holder.name === 'string' && holder.name.trim()
-        ? holder.name.trim().slice(0, 64)
-        : null;
+      // per poll. Scrubbed before it reaches a terminal (2026-09-24, the
+      // audit) — see printable.mjs.
+      const name = safeName(holder.name)?.slice(0, 64) ?? null;
       const key = name ?? '';
       if (key !== standbyKey) {
         standbyKey = key;
@@ -980,9 +1034,10 @@ export function createHolderWatch({ say = () => {} } = {}) {
 
 /** The sentence an in-flight agent turn is settled with when the machine moves
  *  out from under it. MEASURED, not inferred: the server named the box that
- *  took over, and an unnamed one says so rather than guessing. */
+ *  took over, and an unnamed one says so rather than guessing. Scrubbed
+ *  before it is relayed anywhere (2026-09-24, the audit) — see printable.mjs. */
 export function displacedTurnSentence(by) {
-  const name = typeof by === 'string' && by.trim() ? by.trim().slice(0, 64) : 'another machine';
+  const name = safeName(by)?.slice(0, 64) ?? 'another machine';
   return `The project's machine moved to ${name} while this turn was running.`;
 }
 
@@ -1048,7 +1103,9 @@ export async function standDownDisplaced({
         t.unref?.();
       }),
     ]);
-  const name = typeof by === 'string' && by.trim() ? by.trim().slice(0, 64) : null;
+  // Scrubbed before it reaches this box's own console (2026-09-24, the
+  // audit) — see printable.mjs.
+  const name = safeName(by)?.slice(0, 64) ?? null;
   /**
    * TWO KINDS, ONE CHOREOGRAPHY (2026-09-21).
    *
@@ -1064,8 +1121,7 @@ export async function standDownDisplaced({
    * drift and neither call site can invent a third.
    */
   const removed = kind === 'removed';
-  const projectName =
-    typeof project === 'string' && project.trim() ? project.trim().slice(0, 64) : 'this project';
+  const projectName = safeName(project)?.slice(0, 64) ?? 'this project';
   log.warn(
     removed
       ? `removed from ${projectName} in the app — stopping.`
@@ -1073,6 +1129,8 @@ export async function standDownDisplaced({
         ? `this project's machine moved to ${name} — standing down.`
         : "this project's machine moved to another box — standing down."
   );
+  if (removed) emitMachineEvent({ event: 'stopped', reason: 'removed' });
+  else emitMachineEvent({ event: 'displaced', message: displacedTurnSentence(by) });
   // FIRST, and awaited: an unsettled turn is the one thing here that no later
   // poll from anybody can fix — this process holds the only copy of the fact
   // that it was running.
@@ -1104,7 +1162,11 @@ export async function standDownDisplaced({
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
 // base between tasks (fresh conversation), resume in place while on a blocker.
 
-export async function runFleetDaemon() {
+export async function runFleetDaemon({ afterLock = null } = {}) {
+  let desktopProjectId = CREDENTIAL?.entry?.projectId ?? null;
+  let wasServing = false;
+  if (process.env.FLOWVIANT_UPDATE_TARGET && cmpVersion(VERSION, process.env.FLOWVIANT_UPDATE_TARGET) >= 0)
+    emitMachineEvent({ event: 'update-applied', from: process.env.FLOWVIANT_UPDATE_FROM ?? null, to: VERSION });
   console.log('');
   console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`machine daemon · v${VERSION}`)}`);
   console.log(`  ${c.dim('──────────────────────────────────────────────')}`);
@@ -1145,7 +1207,7 @@ export async function runFleetDaemon() {
   // about to serve" must not require a network round trip to answer. Only when
   // the credential came from the STORE: a --fleet/env token names no project
   // until the roster does.
-  if (CREDENTIAL?.entry) {
+  if (CREDENTIAL?.entry && storedCredentialInUse()) {
     info(`serves · ${projectLabel(CREDENTIAL.entry)} ${c.dim(`(${CREDENTIAL.entry.projectId.slice(0, 8)}…)`)}`);
   }
   info(`repo   · ${repoRoot}`);
@@ -1214,6 +1276,17 @@ export async function runFleetDaemon() {
   }
   if (instance.unguarded)
     warn('could not take the single-instance lock (unwritable ~/.flowviant) — running unguarded');
+  // The repo binding the start path's picker or confirm was answered with.
+  // Persisted HERE, after the lock, so a refused start moves nothing: moving it
+  // first stranded the daemon already serving that project's own checkout at
+  // its next unattended restart. Best-effort — an unwritable store costs the
+  // next start a question, never this one its machine.
+  try {
+    afterLock?.();
+  } catch {
+    /* the binding is asked again next time */
+  }
+  writeDaemonState(desktopProjectId, { limits: {}, holder: null });
 
   await preflight({ needGit: true });
 
@@ -1378,6 +1451,7 @@ export async function runFleetDaemon() {
     // A SAME-REPO TAKEOVER IS DELIBERATELY NOT DISTINGUISHED, and that is a
   };
   process.on('SIGINT', () => {
+    emitMachineEvent({ event: 'stopped', reason: 'signal' });
     console.log('');
     note('shutting down — stopping workers. Worktrees are kept: in-flight work resumes next run.');
     teardown();
@@ -1387,6 +1461,7 @@ export async function runFleetDaemon() {
   // handler every child survived a `systemctl stop` — the exact orphaning the
   // teardown exists to prevent.
   process.on('SIGTERM', () => {
+    emitMachineEvent({ event: 'stopped', reason: 'signal' });
     console.log('');
     note('shutting down (SIGTERM) — stopping workers. Worktrees are kept: in-flight work resumes next run.');
     teardown();
@@ -1736,10 +1811,11 @@ export async function runFleetDaemon() {
           } else if (job.branch && isValidBranch(job.branch, repoRoot, baseRef)) {
             try {
               // Explicit refspec form so a leading '-' can't be a git flag.
-              execFileSync('git', ['push', 'origin', `:refs/heads/${job.branch}`], {
-                cwd: repoRoot,
-                stdio: ['ignore', 'pipe', 'pipe'],
-              });
+              // NETWORK call, so timed and non-interactive (2026-09-24, the
+              // audit): a bare execFileSync here had no timeout and could
+              // prompt on /dev/tty, freezing every poll and lease on the
+              // machine behind this cleanup's own async loop.
+              await gitNetAsync(['push', 'origin', `:refs/heads/${job.branch}`], repoRoot);
             } catch {
               /* branch already gone — fine */
             }
@@ -2336,10 +2412,12 @@ export async function runFleetDaemon() {
         livePreviewIds(),
         heldSessionIds(),
         admit('churn'),
-        repoRoot
+        repoRoot,
+        getBaseRef()
       );
     } catch (e) {
       if (e.auth) {
+        emitMachineEvent({ event: 'stopped', reason: 'credential-revoked' });
         fail(`${e.message} — credential revoked or invalid. Shutting down.`);
         teardown();
         // EXIT 0, for the same reason the commanded-stop path does: a revoked
@@ -2361,7 +2439,7 @@ export async function runFleetDaemon() {
       // you're viewing project B's wiki) is obvious instead of a silent no-op.
       if (roster.project) {
         note(
-          `${c.cyan('project')} · ${c.bold(roster.project.name)} ${c.dim(`(${roster.project.id})`)}`
+          `${c.cyan('project')} · ${c.bold(projectLabel({ name: roster.project.name, projectId: roster.project.id }))} ${c.dim(`(${safeName(roster.project.id) ?? ''})`)}`
         );
         note(c.dim('  wiki + agents stream to THIS project — view its Code canvas in Flowviant.'));
         // Remember the NAME beside the stored credential, so the picker and
@@ -2400,6 +2478,8 @@ export async function runFleetDaemon() {
         }
       })();
     }
+    if (roster.project?.id) desktopProjectId = roster.project.id;
+    writeDaemonState(desktopProjectId, { lastPoll: new Date().toISOString() });
     if (roster.mcpUrl) mcpUrl = roster.mcpUrl;
     /**
      * HOW MANY TURNS THE APP SAYS THIS MACHINE MAY RUN (2026-09-17).
@@ -2416,6 +2496,9 @@ export async function runFleetDaemon() {
      */
     setServerMaxTurns(roster.maxTurns);
     if (roster.project?.id) wikiProjectId = roster.project.id; // keys the vault dir
+    // The server's word on which project this token serves — settles the env
+    // report's salt for a token that came from --fleet or the environment.
+    learnProjectId(roster.project?.id);
     if (roster.leaseTtlSeconds) leaseTtlSeconds = roster.leaseTtlSeconds;
     // A COMMANDED STOP OUTRANKS AN UPDATE, and that ordering is the whole reason
     // this sits ABOVE the version signal rather than inside it. Both read the
@@ -2425,6 +2508,7 @@ export async function runFleetDaemon() {
     // going away.
     const stopSignal = shouldStop(roster.daemon);
     if (stopSignal) {
+      emitMachineEvent({ event: 'stopped', reason: stopSignal.reason ?? null });
       warn(
         stopSignal.reason
           ? `stopped by Flowviant — ${stopSignal.reason}`
@@ -2510,7 +2594,7 @@ export async function runFleetDaemon() {
         // The project's NAME rather than the box that took over, because no box
         // took over. Falls back to "this project" inside — an unnamed project
         // says so rather than being guessed at.
-        project: roster.standDown.project ?? roster.project?.name,
+        project: safeName(roster.standDown.project) ?? safeName(roster.project?.name) ?? undefined,
         settleAgentTurns,
         flushReports: flushWorkReports,
         teardown,
@@ -2529,6 +2613,12 @@ export async function runFleetDaemon() {
      * would start deleting worktrees it cannot see the tabs for.
      */
     holderState = holderWatch.observe(roster.holder);
+    writeDaemonState(desktopProjectId, {
+      lastPoll: new Date().toISOString(),
+      holder: ({ mine: 'serving', standby: 'inactive' })[holderState] ?? null,
+    });
+    if (holderState === 'mine' && !wasServing) emitMachineEvent({ event: 'serving' });
+    wasServing = holderState === 'mine';
     // Keep the daemon current. Safe = no worker mid-task (true at startup, since
     // no workers are spawned yet). If it self-updates it re-execs into the new
     // version and this process becomes a proxy — stop the loop.
@@ -2550,7 +2640,7 @@ export async function runFleetDaemon() {
         safeToUpdate,
         teardown,
       });
-      if (updating) return;
+      if (await updating) return;
     }
     // Settle any turn/ship answers whose earlier report POST failed BEFORE
     // taking new work — the skip-if-pending guards make the ordering safe, but
@@ -2722,6 +2812,7 @@ export async function runFleetDaemon() {
     // throttled and deduped inside, and silent forever on an older server.
     // This is what replaced the vault's sync tick — see `maybeReportEnv`.
     void maybeReportEnv(repoRoot);
+    void maybeReportTools(repoRoot, getBaseRef());
 
     // Tell the app what this machine is doing with itself. Every reconcile,
     // best-effort, and never awaited — telemetry that can delay a dispatch is

package/bin/lib/git.mjs

@@ -1,6 +1,6 @@
 /** Git worktree helpers (fleet & static-fleet modes). */
 
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 
@@ -8,6 +8,134 @@ export function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 }
 
+/**
+ * THE SSH COMMAND A NETWORK GIT CALL RUNS UNDER when the operator has not named
+ * one. `BatchMode` turns a passphrase or host-key prompt on /dev/tty into an
+ * immediate failure; the keepalive pair ends a half-open connection (a laptop
+ * that slept, a Wi-Fi change) in ~30s instead of when the kernel gives up hours
+ * later. An agent key still works — BatchMode disables prompts, not keys.
+ */
+export const NET_SSH_COMMAND =
+  'ssh -o BatchMode=yes -o ConnectTimeout=20 -o ServerAliveInterval=15 -o ServerAliveCountMax=2';
+
+/** The default bound on one network git call. */
+export const GIT_NET_TIMEOUT_MS = 60_000;
+
+/**
+ * The environment a NETWORK git call runs under — never interactive.
+ *
+ * `GIT_TERMINAL_PROMPT=0` makes git fail instead of opening /dev/tty for a
+ * username (an HTTPS remote whose credential cache expired), and
+ * `GCM_INTERACTIVE=never` says the same to Git Credential Manager. The SSH
+ * command is set only when the operator has not chosen one — `GIT_SSH_COMMAND`,
+ * `GIT_SSH` or `core.sshCommand` — because the env var OUTRANKS the config key,
+ * and overriding somebody's `-i ~/.ssh/deploy_key` would break every fetch to
+ * make it non-interactive. Their own command is still bounded by the timeout.
+ */
+export function gitNetEnv(cwd, env = process.env) {
+  const out = { ...env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' };
+  if (env.GIT_SSH_COMMAND || env.GIT_SSH) return out;
+  let configured = '';
+  try {
+    configured = execFileSync('git', ['config', '--get', 'core.sshCommand'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5_000,
+    }).trim();
+  } catch {
+    /* unset (exit 1) or unreadable — ours, then */
+  }
+  if (!configured) out.GIT_SSH_COMMAND = NET_SSH_COMMAND;
+  return out;
+}
+
+/**
+ * A NETWORK git call (fetch, push), TIMED AND NON-INTERACTIVE.
+ *
+ * `git()` above is `execFileSync` with no timeout: right for a local
+ * `rev-parse`, and a daemon-wide freeze for a `fetch` — the call blocks the
+ * whole event loop, so a remote that prompts on /dev/tty or a connection that
+ * went half-open stops every poll, settle, lease renewal and relay on the
+ * machine until it returns. Every call that talks to a remote goes through
+ * here. Returns the untrimmed stdout; throws like `git()` does (a timeout
+ * throws with `code: 'ETIMEDOUT'`).
+ */
+export function gitNet(args, cwd, ms = GIT_NET_TIMEOUT_MS) {
+  return execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: ms,
+    killSignal: 'SIGKILL',
+    env: gitNetEnv(cwd),
+  });
+}
+
+/**
+ * The same call WITHOUT BLOCKING — for the unattended periodic fetch, where
+ * even a bounded freeze every few minutes is a daemon that goes dark for a
+ * remote's bad day. Spawned as its own process group so a timeout takes the
+ * ssh or credential helper under git with it. Resolves stdout; rejects on a
+ * non-zero exit, a spawn error or the timeout.
+ */
+export function gitNetAsync(args, cwd, ms = GIT_NET_TIMEOUT_MS) {
+  return new Promise((resolvePromise, reject) => {
+    let child;
+    try {
+      child = spawn('git', args, {
+        cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: gitNetEnv(cwd),
+        detached: true,
+      });
+    } catch (e) {
+      reject(e);
+      return;
+    }
+    let out = '';
+    let err = '';
+    let settled = false;
+    const finish = (fn, v) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(v);
+    };
+    const timer = setTimeout(() => {
+      try {
+        process.kill(-child.pid, 'SIGKILL');
+      } catch {
+        try {
+          child.kill('SIGKILL');
+        } catch {
+          /* already gone */
+        }
+      }
+      const e = new Error(`git ${args[0]} timed out after ${ms}ms`);
+      e.code = 'ETIMEDOUT';
+      finish(reject, e);
+    }, ms);
+    timer.unref?.();
+    child.stdout.on('data', (d) => {
+      out += d;
+    });
+    child.stderr.on('data', (d) => {
+      err += d;
+    });
+    child.on('error', (e) => finish(reject, e));
+    child.on('close', (code) => {
+      if (code === 0) finish(resolvePromise, out);
+      else {
+        const e = new Error(`git ${args[0]} exited ${code}`);
+        e.stderr = err;
+        e.status = code;
+        finish(reject, e);
+      }
+    });
+  });
+}
+
 /**
  * Same call, UNTRIMMED — for `-z` (NUL-separated) output, where trimming would
  * eat the final separator and the leading space of a status code.
@@ -143,9 +271,9 @@ export function baseBranchName(baseRef) {
 
 export function resetWorktree(wt, baseRef) {
   try {
-    git(['fetch', 'origin', '--quiet'], wt);
+    gitNet(['fetch', 'origin', '--quiet'], wt);
   } catch {
-    /* offline / no remote — reset to whatever we have */
+    /* offline / no remote / timed out — reset to whatever we have */
   }
   try {
     git(['checkout', '--detach', baseRef], wt);