flowviant 0.97.0 → 0.99.0

package/bin/lib/fleet.mjs

@@ -34,11 +34,15 @@ import {
   LIVE,
   AUTO_UPDATE,
   CREDENTIAL,
+  learnProjectId,
+  storedCredentialInUse,
 } from './config.mjs';
-import { projectLabel, setStoredProjectName } from './credentials.mjs';
+import { projectLabel, safeName, setStoredProjectName } from './credentials.mjs';
+import { credentialRejected } from './authReject.mjs';
 import { handleVersionSignal } from './update.mjs';
 import {
   git,
+  gitNetAsync,
   resetWorktree,
   repoRootOrDie,
   detectBaseRef,
@@ -88,6 +92,8 @@ import { effectiveMaxTurns, setServerMaxTurns } from './admission.mjs';
 import { scanLocalSessions, ourConversationIds } from './localSessions.mjs';
 import { repoState } from './repoState.mjs';
 import { claudeAuthContext } from './claudeAuth.mjs';
+import { readBaseTools, runnerToolCapabilities, toolReadout } from './projectTools.mjs';
+import { runtimeOfferings } from './runtimeOfferings.mjs';
 
 /** Said once per process — see the catch around `envQueryParams` below. */
 let warnedEnvIdentity = false;
@@ -163,7 +169,8 @@ async function fetchRoster(
    *  rather than re-derived: `repoRootOrDie` is resolved once at startup and
    *  running git on every poll to re-learn a constant would be a syscall for
    *  a readout. */
-  repoRoot = null
+  repoRoot = null,
+  baseRef = null
 ) {
   const url = new URL(FLEET_URL);
   if (haveIds.length) url.searchParams.set('have', haveIds.join(','));
@@ -301,6 +308,18 @@ async function fetchRoster(
   } catch {
     /* best-effort — the poll must never fail on a readout */
   }
+  if (repoRoot && baseRef) {
+    try {
+      const offerings = detectRuntimes().some((rt) => rt.id === 'codex' && rt.installed)
+        ? runtimeOfferings(repoRoot, baseRef) : {};
+      for (const [param, report] of Object.entries(offerings)) {
+        if (Object.keys(report).length) {
+          const payload = JSON.stringify(report);
+          if (payload.length <= 8_000 && url.toString().length + encodeURIComponent(payload).length <= 14_000) url.searchParams.set(param, payload);
+        }
+      }
+    } catch { /* local readouts never fail the poll */ }
+  }
   // THIS BOX'S IDENTITY — `envpub`, and since 2026-09-21 nothing else.
   //
   // It carried two more params while the secrets vault existed: `envv` (the
@@ -424,10 +443,16 @@ async function fetchRoster(
     signal: AbortSignal.timeout(30_000), // a black-holed poll must not stall the loop
   });
   if (res.status === 401 || res.status === 403) {
-    // Fleet credential revoked/expired — retrying can't recover; signal exit.
-    const e = new Error(`fleet credential rejected (${res.status})`);
-    e.auth = true;
-    throw e;
+    // Revoked or expired — retrying can't recover, so signal exit. But ONLY on
+    // the API's own refusal: an edge 403 (Cloudflare's bot checks, which this
+    // very client class trips) is a retryable failure, and exiting on one took
+    // a machine offline for good over a credential that was still valid.
+    if (await credentialRejected(res)) {
+      const e = new Error(`fleet credential rejected (${res.status})`);
+      e.auth = true;
+      throw e;
+    }
+    throw new Error(`fleet poll refused by something in front of the API (${res.status})`);
   }
   if (!res.ok) throw new Error(`fleet poll failed (${res.status})`);
   // THE ASK IS SPENT HERE AND NOWHERE ELSE — on a poll the server actually
@@ -761,6 +786,36 @@ export async function maybeReportEnv(repoRoot) {
   }
 }
 
+const TOOLS_REPORT_URL = FLEET_URL.replace(/\/agents\/?$/, '/tools-report');
+let toolsReportSent = null;
+let toolsReportUnsupported = false;
+let toolsReportAt = 0;
+/** Repo tool readiness is a per-box daemon report. Never include env values. */
+export async function maybeReportTools(repoRoot, baseRef) {
+  if (Date.now() - toolsReportAt < 60_000) return;
+  toolsReportAt = Date.now();
+  if (toolsReportUnsupported) return;
+  const pubkey = myPubB64();
+  if (!pubkey) return;
+  let payload;
+  try {
+    const snapshot = readBaseTools(repoRoot, baseRef);
+    const installed = detectRuntimes().filter((r) => r.installed);
+    const runner = installed.find((r) => runnerToolCapabilities(r.id).mcp)?.id ?? installed[0]?.id ?? 'none';
+    payload = JSON.stringify({ pubkey, tools: toolReadout(snapshot, runner) });
+  } catch { return; }
+  if (payload === toolsReportSent) return;
+  try {
+    const res = await fetch(TOOLS_REPORT_URL, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT, 'Content-Type': 'application/json' },
+      signal: AbortSignal.timeout(15_000), body: payload,
+    });
+    if (envReportIsPermanent(res.status)) toolsReportUnsupported = true;
+    toolsReportSent = res.ok ? payload : null;
+  } catch { toolsReportSent = null; }
+}
+
 /**
  * A STOP COMMANDED BY FLOWVIANT, read off the roster poll.
  *
@@ -891,10 +946,9 @@ export function createHolderWatch({ say = () => {} } = {}) {
         const took = holder.took;
         if (took && typeof took === 'object' && !Array.isArray(took)) {
           standbyKey = null;
-          const from =
-            typeof took.from === 'string' && took.from.trim()
-              ? took.from.trim().slice(0, 64)
-              : 'another machine';
+          // scrubbed before it reaches a terminal (2026-09-24, the audit) —
+          // see printable.mjs.
+          const from = safeName(took.from)?.slice(0, 64) ?? 'another machine';
           const turns = Number.isInteger(took.turns) && took.turns > 0 ? took.turns : null;
           say(
             `took this project's machine from ${from}` +
@@ -913,10 +967,9 @@ export function createHolderWatch({ say = () => {} } = {}) {
       // The NAME is all the response carries about the other box, so it is also
       // the only thing "a distinct holder" can be keyed on. An unnamed holder
       // keys on the empty string, which is stable — one announcement, not one
-      // per poll.
-      const name = typeof holder.name === 'string' && holder.name.trim()
-        ? holder.name.trim().slice(0, 64)
-        : null;
+      // per poll. Scrubbed before it reaches a terminal (2026-09-24, the
+      // audit) — see printable.mjs.
+      const name = safeName(holder.name)?.slice(0, 64) ?? null;
       const key = name ?? '';
       if (key !== standbyKey) {
         standbyKey = key;
@@ -980,9 +1033,10 @@ export function createHolderWatch({ say = () => {} } = {}) {
 
 /** The sentence an in-flight agent turn is settled with when the machine moves
  *  out from under it. MEASURED, not inferred: the server named the box that
- *  took over, and an unnamed one says so rather than guessing. */
+ *  took over, and an unnamed one says so rather than guessing. Scrubbed
+ *  before it is relayed anywhere (2026-09-24, the audit) — see printable.mjs. */
 export function displacedTurnSentence(by) {
-  const name = typeof by === 'string' && by.trim() ? by.trim().slice(0, 64) : 'another machine';
+  const name = safeName(by)?.slice(0, 64) ?? 'another machine';
   return `The project's machine moved to ${name} while this turn was running.`;
 }
 
@@ -1048,7 +1102,9 @@ export async function standDownDisplaced({
         t.unref?.();
       }),
     ]);
-  const name = typeof by === 'string' && by.trim() ? by.trim().slice(0, 64) : null;
+  // Scrubbed before it reaches this box's own console (2026-09-24, the
+  // audit) — see printable.mjs.
+  const name = safeName(by)?.slice(0, 64) ?? null;
   /**
    * TWO KINDS, ONE CHOREOGRAPHY (2026-09-21).
    *
@@ -1064,8 +1120,7 @@ export async function standDownDisplaced({
    * drift and neither call site can invent a third.
    */
   const removed = kind === 'removed';
-  const projectName =
-    typeof project === 'string' && project.trim() ? project.trim().slice(0, 64) : 'this project';
+  const projectName = safeName(project)?.slice(0, 64) ?? 'this project';
   log.warn(
     removed
       ? `removed from ${projectName} in the app — stopping.`
@@ -1104,7 +1159,7 @@ export async function standDownDisplaced({
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
 // base between tasks (fresh conversation), resume in place while on a blocker.
 
-export async function runFleetDaemon() {
+export async function runFleetDaemon({ afterLock = null } = {}) {
   console.log('');
   console.log(`  ${c.bold(c.cyan('◣ flowviant'))}  ${c.dim(`machine daemon · v${VERSION}`)}`);
   console.log(`  ${c.dim('──────────────────────────────────────────────')}`);
@@ -1145,7 +1200,7 @@ export async function runFleetDaemon() {
   // about to serve" must not require a network round trip to answer. Only when
   // the credential came from the STORE: a --fleet/env token names no project
   // until the roster does.
-  if (CREDENTIAL?.entry) {
+  if (CREDENTIAL?.entry && storedCredentialInUse()) {
     info(`serves · ${projectLabel(CREDENTIAL.entry)} ${c.dim(`(${CREDENTIAL.entry.projectId.slice(0, 8)}…)`)}`);
   }
   info(`repo   · ${repoRoot}`);
@@ -1214,6 +1269,16 @@ export async function runFleetDaemon() {
   }
   if (instance.unguarded)
     warn('could not take the single-instance lock (unwritable ~/.flowviant) — running unguarded');
+  // The repo binding the start path's picker or confirm was answered with.
+  // Persisted HERE, after the lock, so a refused start moves nothing: moving it
+  // first stranded the daemon already serving that project's own checkout at
+  // its next unattended restart. Best-effort — an unwritable store costs the
+  // next start a question, never this one its machine.
+  try {
+    afterLock?.();
+  } catch {
+    /* the binding is asked again next time */
+  }
 
   await preflight({ needGit: true });
 
@@ -1736,10 +1801,11 @@ export async function runFleetDaemon() {
           } else if (job.branch && isValidBranch(job.branch, repoRoot, baseRef)) {
             try {
               // Explicit refspec form so a leading '-' can't be a git flag.
-              execFileSync('git', ['push', 'origin', `:refs/heads/${job.branch}`], {
-                cwd: repoRoot,
-                stdio: ['ignore', 'pipe', 'pipe'],
-              });
+              // NETWORK call, so timed and non-interactive (2026-09-24, the
+              // audit): a bare execFileSync here had no timeout and could
+              // prompt on /dev/tty, freezing every poll and lease on the
+              // machine behind this cleanup's own async loop.
+              await gitNetAsync(['push', 'origin', `:refs/heads/${job.branch}`], repoRoot);
             } catch {
               /* branch already gone — fine */
             }
@@ -2336,7 +2402,8 @@ export async function runFleetDaemon() {
         livePreviewIds(),
         heldSessionIds(),
         admit('churn'),
-        repoRoot
+        repoRoot,
+        getBaseRef()
       );
     } catch (e) {
       if (e.auth) {
@@ -2361,7 +2428,7 @@ export async function runFleetDaemon() {
       // you're viewing project B's wiki) is obvious instead of a silent no-op.
       if (roster.project) {
         note(
-          `${c.cyan('project')} · ${c.bold(roster.project.name)} ${c.dim(`(${roster.project.id})`)}`
+          `${c.cyan('project')} · ${c.bold(projectLabel({ name: roster.project.name, projectId: roster.project.id }))} ${c.dim(`(${safeName(roster.project.id) ?? ''})`)}`
         );
         note(c.dim('  wiki + agents stream to THIS project — view its Code canvas in Flowviant.'));
         // Remember the NAME beside the stored credential, so the picker and
@@ -2416,6 +2483,9 @@ export async function runFleetDaemon() {
      */
     setServerMaxTurns(roster.maxTurns);
     if (roster.project?.id) wikiProjectId = roster.project.id; // keys the vault dir
+    // The server's word on which project this token serves — settles the env
+    // report's salt for a token that came from --fleet or the environment.
+    learnProjectId(roster.project?.id);
     if (roster.leaseTtlSeconds) leaseTtlSeconds = roster.leaseTtlSeconds;
     // A COMMANDED STOP OUTRANKS AN UPDATE, and that ordering is the whole reason
     // this sits ABOVE the version signal rather than inside it. Both read the
@@ -2510,7 +2580,7 @@ export async function runFleetDaemon() {
         // The project's NAME rather than the box that took over, because no box
         // took over. Falls back to "this project" inside — an unnamed project
         // says so rather than being guessed at.
-        project: roster.standDown.project ?? roster.project?.name,
+        project: safeName(roster.standDown.project) ?? safeName(roster.project?.name) ?? undefined,
         settleAgentTurns,
         flushReports: flushWorkReports,
         teardown,
@@ -2722,6 +2792,7 @@ export async function runFleetDaemon() {
     // throttled and deduped inside, and silent forever on an older server.
     // This is what replaced the vault's sync tick — see `maybeReportEnv`.
     void maybeReportEnv(repoRoot);
+    void maybeReportTools(repoRoot, getBaseRef());
 
     // Tell the app what this machine is doing with itself. Every reconcile,
     // best-effort, and never awaited — telemetry that can delay a dispatch is

package/bin/lib/git.mjs

@@ -1,6 +1,6 @@
 /** Git worktree helpers (fleet & static-fleet modes). */
 
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 
@@ -8,6 +8,134 @@ export function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 }
 
+/**
+ * THE SSH COMMAND A NETWORK GIT CALL RUNS UNDER when the operator has not named
+ * one. `BatchMode` turns a passphrase or host-key prompt on /dev/tty into an
+ * immediate failure; the keepalive pair ends a half-open connection (a laptop
+ * that slept, a Wi-Fi change) in ~30s instead of when the kernel gives up hours
+ * later. An agent key still works — BatchMode disables prompts, not keys.
+ */
+export const NET_SSH_COMMAND =
+  'ssh -o BatchMode=yes -o ConnectTimeout=20 -o ServerAliveInterval=15 -o ServerAliveCountMax=2';
+
+/** The default bound on one network git call. */
+export const GIT_NET_TIMEOUT_MS = 60_000;
+
+/**
+ * The environment a NETWORK git call runs under — never interactive.
+ *
+ * `GIT_TERMINAL_PROMPT=0` makes git fail instead of opening /dev/tty for a
+ * username (an HTTPS remote whose credential cache expired), and
+ * `GCM_INTERACTIVE=never` says the same to Git Credential Manager. The SSH
+ * command is set only when the operator has not chosen one — `GIT_SSH_COMMAND`,
+ * `GIT_SSH` or `core.sshCommand` — because the env var OUTRANKS the config key,
+ * and overriding somebody's `-i ~/.ssh/deploy_key` would break every fetch to
+ * make it non-interactive. Their own command is still bounded by the timeout.
+ */
+export function gitNetEnv(cwd, env = process.env) {
+  const out = { ...env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' };
+  if (env.GIT_SSH_COMMAND || env.GIT_SSH) return out;
+  let configured = '';
+  try {
+    configured = execFileSync('git', ['config', '--get', 'core.sshCommand'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5_000,
+    }).trim();
+  } catch {
+    /* unset (exit 1) or unreadable — ours, then */
+  }
+  if (!configured) out.GIT_SSH_COMMAND = NET_SSH_COMMAND;
+  return out;
+}
+
+/**
+ * A NETWORK git call (fetch, push), TIMED AND NON-INTERACTIVE.
+ *
+ * `git()` above is `execFileSync` with no timeout: right for a local
+ * `rev-parse`, and a daemon-wide freeze for a `fetch` — the call blocks the
+ * whole event loop, so a remote that prompts on /dev/tty or a connection that
+ * went half-open stops every poll, settle, lease renewal and relay on the
+ * machine until it returns. Every call that talks to a remote goes through
+ * here. Returns the untrimmed stdout; throws like `git()` does (a timeout
+ * throws with `code: 'ETIMEDOUT'`).
+ */
+export function gitNet(args, cwd, ms = GIT_NET_TIMEOUT_MS) {
+  return execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: ms,
+    killSignal: 'SIGKILL',
+    env: gitNetEnv(cwd),
+  });
+}
+
+/**
+ * The same call WITHOUT BLOCKING — for the unattended periodic fetch, where
+ * even a bounded freeze every few minutes is a daemon that goes dark for a
+ * remote's bad day. Spawned as its own process group so a timeout takes the
+ * ssh or credential helper under git with it. Resolves stdout; rejects on a
+ * non-zero exit, a spawn error or the timeout.
+ */
+export function gitNetAsync(args, cwd, ms = GIT_NET_TIMEOUT_MS) {
+  return new Promise((resolvePromise, reject) => {
+    let child;
+    try {
+      child = spawn('git', args, {
+        cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: gitNetEnv(cwd),
+        detached: true,
+      });
+    } catch (e) {
+      reject(e);
+      return;
+    }
+    let out = '';
+    let err = '';
+    let settled = false;
+    const finish = (fn, v) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(v);
+    };
+    const timer = setTimeout(() => {
+      try {
+        process.kill(-child.pid, 'SIGKILL');
+      } catch {
+        try {
+          child.kill('SIGKILL');
+        } catch {
+          /* already gone */
+        }
+      }
+      const e = new Error(`git ${args[0]} timed out after ${ms}ms`);
+      e.code = 'ETIMEDOUT';
+      finish(reject, e);
+    }, ms);
+    timer.unref?.();
+    child.stdout.on('data', (d) => {
+      out += d;
+    });
+    child.stderr.on('data', (d) => {
+      err += d;
+    });
+    child.on('error', (e) => finish(reject, e));
+    child.on('close', (code) => {
+      if (code === 0) finish(resolvePromise, out);
+      else {
+        const e = new Error(`git ${args[0]} exited ${code}`);
+        e.stderr = err;
+        e.status = code;
+        finish(reject, e);
+      }
+    });
+  });
+}
+
 /**
  * Same call, UNTRIMMED — for `-z` (NUL-separated) output, where trimming would
  * eat the final separator and the leading space of a status code.
@@ -143,9 +271,9 @@ export function baseBranchName(baseRef) {
 
 export function resetWorktree(wt, baseRef) {
   try {
-    git(['fetch', 'origin', '--quiet'], wt);
+    gitNet(['fetch', 'origin', '--quiet'], wt);
   } catch {
-    /* offline / no remote — reset to whatever we have */
+    /* offline / no remote / timed out — reset to whatever we have */
   }
   try {
     git(['checkout', '--detach', baseRef], wt);

package/bin/lib/hooks/readGuard.mjs

@@ -38,6 +38,12 @@
  *    into a flag), a newline. A read-only turn runs ONE plain command; every
  *    one of these is a second command or a redirect wearing the first one's
  *    permission.
+ *  · shell syntax that REWRITES A WORD after this guard read it — braces,
+ *    parentheses and glob characters (`{ } ( ) * ? [`). `--outp{u,u}t=x` is
+ *    `--output=x` by the time git sees it, and the substring tests below can
+ *    only judge the word as written. (Quoted or not: the normalisation above
+ *    has already dropped the quotes, so a quoted `*` is refused too — the
+ *    over-refusal the paragraph above accepts.)
  *  · the git arguments above, as substrings (so `--config` covers
  *    `--config-env`, `--output` covers `--output-directory`), plus a bare `-c`
  *    token and any token beginning `-O`.
@@ -75,6 +81,24 @@ const SHELL = [
   ['$', 'an expansion'],
   ['\n', 'a second line'],
   ['\r', 'a second line'],
+  // SHELL SYNTAX THE SUBSTRING TESTS BELOW DO NOT MODEL (2026-09-24, the
+  // audit). The shell rewrites a word AFTER this guard has read it, so a banned
+  // flag can be ASSEMBLED past a substring check: `--outp{u,u}t=x` and
+  // `-{c,c}` brace-expand into `--output=x` and `-c`, and `git log -1
+  // --outp{u,u}t=pwned.txt` wrote the file with this guard returning null
+  // (measured, git 2.55). Globs do the same with a planted file name —
+  // `-?` expands to a file called `-c` — and zsh adds glob QUALIFIERS
+  // (`*(e:…:)`, which evaluate code). None of them is something a single
+  // plain read needs, so the guard refuses the syntax rather than trying to
+  // expand it the way some shell would: over-refusal is the safe direction,
+  // and the Glob tool is the tool-shaped way to match names.
+  ['{', 'brace expansion'],
+  ['}', 'brace expansion'],
+  ['(', 'a subshell or glob qualifier'],
+  [')', 'a subshell or glob qualifier'],
+  ['*', 'a glob'],
+  ['?', 'a glob'],
+  ['[', 'a glob'],
 ];
 
 /**

package/bin/lib/instance.mjs

@@ -97,7 +97,7 @@ import {
 import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
-import { VERSION } from './config.mjs';
+import { VERSION, PROCESS_STARTED_AT } from './config.mjs';
 
 /** Deliberately a HASH: a credential must never become a filename. */
 export function instanceLockPath(fleetToken) {
@@ -139,11 +139,42 @@ function readHolder(path) {
   }
 }
 
+/**
+ * argv[1] AS IT WAS TYPED, when that differs from the resolved form.
+ *
+ * Node resolves `process.argv[1]` to an absolute path, while `/proc/<pid>/cmdline`
+ * and `ps` show the argv the process was actually given. A daemon started as
+ * `node bin/cli.mjs` (a dev checkout, `npm start`, a Docker CMD with a WORKDIR)
+ * therefore recorded `/abs/bin/cli.mjs` and was matched against `node
+ * bin/cli.mjs`, judged stale WHILE ALIVE — a second start ran beside it and
+ * `flowviant stop` signalled nothing. The raw token is recorded beside `entry`
+ * so both spellings identify the process. Linux only: `ps` joins argv with
+ * spaces, so no token can be recovered from it reliably, and there the absolute
+ * form plus the start-time check stand as before.
+ */
+function rawEntry() {
+  if (platform() !== 'linux') return null;
+  try {
+    const tokens = readFileSync('/proc/self/cmdline', 'utf8').split('\0');
+    const raw = tokens[1 + process.execArgv.length];
+    return raw && raw !== process.argv[1] ? raw : null;
+  } catch {
+    return null;
+  }
+}
+
 const record = (repoRoot) =>
   JSON.stringify({
     pid: process.pid,
     repoRoot,
-    startedAt: new Date().toISOString(),
+    // THE PROCESS'S START, not the moment the lock was written. The start path
+    // can wait on a person at the picker or the binding confirm for as long as
+    // they take (there is no answer time limit), and a lock line written three
+    // minutes after the process began put a LIVE daemon outside the 120s window
+    // startedAroundLockWrite brackets — so a second start cleared its "stale"
+    // lock and ran beside it, and stop and disconnect skipped it. The window now
+    // measures clock granularity only, whatever a prompt cost.
+    startedAt: PROCESS_STARTED_AT,
     // The script we were started from, and what we are. A takeover matches the
     // live command line against `entry` before signalling anything — a lock
     // records a PID, and a crashed daemon's PID can be reused by anything.
@@ -151,9 +182,68 @@ const record = (repoRoot) =>
     // matched on the holder's process START TIME instead; stillTheHolder says
     // why that is the weaker of the two claims and still strong enough.
     entry: process.argv[1] || '',
+    ...(rawEntry() ? { entryRaw: rawEntry() } : {}),
     version: VERSION,
   });
 
+/** Up to this many parents are walked looking for the daemon we re-exec'd from.
+ *  `npx -y flowviant@latest` puts `npm exec` (and a `sh -c`) between the old
+ *  daemon and the new one; eight is several times that chain. */
+const ANCESTOR_DEPTH = 8;
+
+/** The parent pid of `pid`, or null where it cannot be read. */
+function parentOf(pid) {
+  try {
+    if (platform() === 'linux') {
+      const raw = readFileSync(`/proc/${pid}/stat`, 'utf8');
+      const close = raw.lastIndexOf(')');
+      if (close < 0) return null;
+      const ppid = Number.parseInt(raw.slice(close + 1).trim().split(/\s+/)[1], 10);
+      return Number.isInteger(ppid) && ppid > 0 ? ppid : null;
+    }
+    if (platform() === 'darwin') {
+      const out = execFileSync('ps', ['-o', 'ppid=', '-p', String(pid)], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 3000,
+      });
+      const ppid = Number.parseInt(out.trim(), 10);
+      return Number.isInteger(ppid) && ppid > 0 ? ppid : null;
+    }
+  } catch {
+    /* unreadable — ancestry unknown */
+  }
+  return null;
+}
+
+/**
+ * IS THIS HOLDER THE DAEMON THAT RE-EXEC'D US? — the self-update case.
+ *
+ * The direct parent is the global-install path: update.mjs spawns
+ * `process.execPath` itself, so the successor's ppid IS the holder. Under npx
+ * — the documented launch — the successor is spawned by `npm exec`, which the
+ * old daemon spawned, so the holder is a GRANDPARENT and a ppid check read it
+ * as a rival: the new daemon SIGTERMed its own proxy, the foreground process
+ * exited 143 while the successor ran on detached (or, with --no-takeover, both
+ * exited and the machine went dark after every update). So update.mjs names
+ * the pid it re-exec'd from, and that pid is adopted only when it really is an
+ * ANCESTOR of this process: the env var alone is inherited by anything the
+ * daemon spawns and proves nothing on its own. Ancestry that cannot be read
+ * adopts nothing — the pre-existing takeover rules then apply.
+ */
+function isOurReexecParent(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  if (pid === process.ppid) return true;
+  if (process.env.FLOWVIANT_REEXEC_FROM !== String(pid)) return false;
+  let p = process.ppid;
+  for (let i = 0; i < ANCESTOR_DEPTH && p && p > 1; i++) {
+    const up = parentOf(p);
+    if (up === pid) return true;
+    p = up;
+  }
+  return false;
+}
+
 /** Same directory, whatever it is spelled as — symlinks and trailing slashes
  *  included. A repo compared by string would let `/repo` and `/repo/` past. */
 function samePath(a, b) {
@@ -208,7 +298,7 @@ export function daemonInSameRepo(repoRoot, ownPath) {
     if (path === ownPath) continue; // our own credential — the lock above owns that question
     const holder = readHolder(path);
     if (!holder || !alive(holder.pid)) continue;
-    if (holder.pid === process.ppid) continue; // ourselves mid self-update re-exec
+    if (isOurReexecParent(holder.pid)) continue; // ourselves mid self-update re-exec
     if (samePath(holder.repoRoot, repoRoot)) {
       NEIGHBOUR_PATHS.set(holder, path);
       return holder;
@@ -226,7 +316,10 @@ export function daemonInSameRepo(repoRoot, ownPath) {
  *  around 41s. 120s is ~3x that worst path and ~4000x the typical one, and it is
  *  still short enough that pid reuse cannot reach into it: reuse means cycling
  *  the entire pid space (4194304 by default), which no machine does inside two
- *  minutes. */
+ *  minutes. (Since the lock records the PROCESS start rather than the moment it
+ *  was written, a lock from this version sits a few milliseconds from its
+ *  process whatever the start path cost; the window's width is for locks older
+ *  daemons wrote, which still stamp the write.) */
 const TAKEOVER_START_WINDOW_MS = 120_000;
 
 /** ...and how far the OTHER way, which is a unit problem rather than a real
@@ -421,15 +514,20 @@ function stillTheHolder(holder) {
   // alive, so it takes the same road as a missing one.
   if (!want) return startedAroundLockWrite(holder);
   let cmdline;
+  let tokens;
   try {
-    cmdline =
-      platform() === 'linux'
-        ? readFileSync(`/proc/${holder.pid}/cmdline`, 'utf8').replace(/\0/g, ' ')
-        : execFileSync('ps', ['-o', 'command=', '-p', String(holder.pid)], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            timeout: 3000,
-          });
+    if (platform() === 'linux') {
+      const raw = readFileSync(`/proc/${holder.pid}/cmdline`, 'utf8');
+      tokens = raw.split('\0');
+      cmdline = raw.replace(/\0/g, ' ');
+    } else {
+      cmdline = execFileSync('ps', ['-o', 'command=', '-p', String(holder.pid)], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 3000,
+      });
+      tokens = cmdline.trim().split(/\s+/);
+    }
   } catch {
     // NOT `false`. takeOverFrom already returned early if the pid were gone, so
     // reaching here means the process is alive and we could not READ it —
@@ -437,7 +535,10 @@ function stillTheHolder(holder) {
     // here is what made the refusal claim the pid belonged to somebody else.
     return null;
   }
-  if (!cmdline.includes(want)) return false;
+  // The typed spelling is matched as a whole TOKEN, never a substring: a
+  // relative `bin/cli.mjs` is a fragment of countless command lines.
+  const raw = typeof holder.entryRaw === 'string' && holder.entryRaw ? holder.entryRaw : null;
+  if (!cmdline.includes(want) && !(raw && tokens.includes(raw))) return false;
   // AN ENTRY MATCH ALONE IS NOT IDENTITY. Every daemon on the box shares one
   // entry path under a global install, so "cmdline contains this cli.mjs"
   // proves "is SOME flowviant daemon", not "is the daemon that wrote THIS
@@ -711,7 +812,7 @@ export function acquireInstanceLock(fleetToken, repoRoot, opts = {}) {
       // ownership-checked, so it will not delete the lock it handed over.
       // (`flowviant login` also proxies a child, but that parent never reached
       // the daemon and holds nothing — the child simply acquires.)
-      if (holder.pid === process.ppid) {
+      if (isOurReexecParent(holder.pid)) {
         try {
           writeFileSync(path, record(repoRoot));
         } catch {