flowviant 0.102.2 → 0.104.0

package/bin/lib/runtimes.mjs

@@ -7,8 +7,10 @@
  * and a set of sentinel words the turn loop reads out of stdout. A second CLI is
  * not a different binary name — it is a different answer to each of those.
  *
- * So each runtime declares its own answers here, and everything else in the
- * daemon asks this module rather than knowing them.
+ * So each runtime declares its own answers — one row per vendor, in
+ * runtimeClaude.mjs, runtimeCodex.mjs and runtimeAntigravity.mjs, assembled
+ * into RUNTIMES here — and everything else in the daemon asks this module
+ * rather than knowing them.
  *
  * WHAT A RUNTIME MUST BE ABLE TO DO to build a Flowviant task at all:
  *   1. run headless from one prompt and exit,
@@ -19,7 +21,7 @@
  *   4. emit machine-readable progress, or the thread goes silent for the length
  *      of a build.
  * Claude Code and Codex both do all four. Antigravity does 1, 3 and 4 and is
- * declared below with the exact reason it cannot yet do 2.
+ * declared in runtimeAntigravity.mjs with the exact reason it cannot yet do 2.
  *
  * BUT ONLY A BUILD NEEDS ALL FOUR, and that qualifier was missing long enough to
  * cost Antigravity every capability it has. Requirement 2 is the CONTROL PLANE —
@@ -32,482 +34,25 @@
  *
  * WHAT THIS MODULE DELIBERATELY DOES NOT DO: pick. Which runtime runs a task is
  * decided in the app, by @mentioning it (CLAUDE.md: the @mention is the only
- * dispatch), and arrives on the brief. Detection here answers "what does this
- * machine HAVE" — activity, never capacity, and never a default we invented.
- */
-
-import { execFileSync, spawn } from 'node:child_process';
-import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir, tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { SAFE, MODEL, USER_AGENT } from './config.mjs';
-
-/** Truncate for a one-line activity label. */
-const oneLine = (s, n = 140) =>
-  String(s ?? '').replace(/\s+/g, ' ').trim().slice(0, n);
-
-/**
- * `label` IS THE READOUT; `full` IS THE RELAY (2026-09-16) — the convention
- * every prose activity in this daemon follows, stated once here because three
- * parsers produce one and three consumers read them.
- *
- * `label` is one collapsed, clamped line, because its first two consumers are a
- * terminal console and a one-line pulse that is overwritten every two seconds,
- * and neither can show a paragraph. The turn TRACE is a third consumer with the
- * opposite need: it is scrollback, and clipping a sentence at 140 characters
- * there is the product summarizing its own agent.
- *
- * So a prose activity may ALSO carry `full`: the text EXACTLY as the CLI
- * emitted it, uncollapsed and unclipped. Nothing derives it and nothing but the
- * trace reads it — `label` is untouched, so the console and the pulse are
- * byte-identical to before. Absent means there was no fuller text than the
- * label (a tool line, a bare thinking marker), and the trace falls back to the
- * label — which is what every pre-0.87.0 daemon does for everything.
- *
- * THE MARKER BELOW IS THE label-ONLY CASE, and one definition with four
- * readers: claude.mjs writes it, this file's codex parser falls back to it, and
- * TWO collapses key on it — `trace.mjs` for the turn trace, `fleet.mjs` for the
- * wiki sweep's feed. A collapse keyed on a string typed out four times would
- * silently stop collapsing the first time somebody reworded one of them, and a
- * collapse that stops collapsing fails no test — it just fills a feed.
- *
- * It exists at all because the CLIs do not hand over the thinking itself:
- * measured 2026-09-16 across three real transcripts, 93 thinking blocks, every
- * one of them empty (signature only), and a live probe with MAX_THINKING_TOKENS
- * and `--include-partial-messages` returned an empty `thinking_delta` and a
- * zero-length complete block. So the marker is the honest whole of what is
- * known — "it is reasoning, not hung" — and the day text does arrive it rides
- * `full` and this marker is simply not used.
- */
-export const THINK_MARKER = 'thinking…';
-
-const shortPath = (p, cwd) => {
-  const s = String(p ?? '');
-  return cwd && s.startsWith(cwd) ? s.slice(cwd.length).replace(/^\//, '') : s;
-};
-
-// ── Claude Code ────────────────────────────────────────────────────────────
-
-/**
- * Tool-call → one line of activity. Claude's tool names, unchanged from when
- * this lived in claude.mjs; `kind` is the daemon's own vocabulary and every
- * runtime's parser must speak it (`read` is what the wiki file counter counts,
- * `write` carries `path` so distinct pages can be counted).
- */
-export function humanizeClaudeTool(name, input = {}, cwd = '') {
-  switch (name) {
-    case 'Read':
-      return { kind: 'read', label: `read ${shortPath(input.file_path, cwd)}` };
-    case 'Write':
-    case 'Edit': {
-      const p = String(input.file_path ?? '');
-      const tail = p.split('/').slice(-2).join('/');
-      return { kind: 'write', path: p, label: `${name === 'Write' ? '+ page' : '~ page'} ${tail}` };
-    }
-    case 'Grep':
-      return {
-        kind: 'search',
-        label: `grep ${JSON.stringify(input.pattern ?? '')}${input.path ? ` in ${shortPath(input.path, cwd)}` : ''}`,
-      };
-    case 'Glob':
-      return { kind: 'glob', label: `glob ${input.pattern ?? ''}` };
-    case 'LS':
-      return { kind: 'list', label: `ls ${shortPath(input.path ?? '.', cwd)}` };
-    case 'Bash':
-      // `command` rides beside the display label, VERBATIM (capped): the label
-      // is a 60-char readout for a console and the rail, and truncation is
-      // fine there — but the admin's command audit exists to answer "what
-      // actually ran on our box", and an ellipsis is exactly where the part
-      // that matters would hide.
-      return {
-        kind: 'bash',
-        command: String(input.command ?? '').slice(0, 2000),
-        label: `$ ${oneLine(input.command, 60)}`,
-      };
-    case 'TodoWrite': {
-      // The CLI's own todo list — the plan the transcript's PLAN card renders.
-      // The label narrates the change ("plan: 2 of 5 — cut over /api/session");
-      // the structured items ride through toolEventOf below.
-      const todos = Array.isArray(input.todos) ? input.todos : [];
-      if (todos.length === 0) return null;
-      const done = todos.filter((t) => t?.status === 'completed').length;
-      const active = todos.find((t) => t?.status === 'in_progress');
-      return {
-        kind: 'plan',
-        label: `plan: ${done} of ${todos.length}${active?.content ? ` — ${oneLine(active.content, 60)}` : ''}`,
-      };
-    }
-    default:
-      return null; // other tools: silent
-  }
-}
-
-/** Count '\n' without materializing a split — a Write's content can be a
- *  multi-MB generated file, and `split('\n')` re-allocates all of it as line
- *  strings on the synchronous stream path the narrator and wake socket share.
- *  Numbers cannot leak, so counting runs on the RAW string. */
-export function countLines(s) {
-  const str = String(s ?? '');
-  if (!str) return 0;
-  let n = 1;
-  let i = -1;
-  while ((i = str.indexOf('\n', i + 1)) !== -1) n++;
-  return n;
-}
-
-/** How much raw string the scrubber sees before any cap is applied. A secret
- *  can only surface in the first ~capped chars of a field; giving the scrub a
- *  window this much larger means a secret would have to be longer than the
- *  window minus the cap to straddle out of it — no real credential is. */
-const SCRUB_WINDOW = 8_192;
-
-/**
- * Tool-call → ONE STRUCTURED EVENT for the transcript's tool cards — the
- * relay's durable form, where `humanizeClaudeTool` above is its one-line live
- * form. Same source (the CLI's own tool_use input), zero inference: every
- * field is something the CLI emitted, and a tool this doesn't know renders as
- * nothing rather than as a guess.
- *
- * Wire vocabulary (compact keys — this rides a 1.5s-throttled POST):
- *   t: read|edit|write|grep|glob|bash|task|plan
- *   p: path (worktree-relative)   q: pattern/description   c: command
- *   a/d: line counts added/deleted (from the input's own strings)
- *   dl: a few "-/+" prefixed preview lines of an Edit
- *   items: the plan's todos, x = text, s = done|active|open
- *
- * SCRUB BEFORE CAP — the order is load-bearing (review, 2026-09-01). The
- * caller passes its `envScrub`; every string is scrubbed over a bounded
- * window FIRST and capped LAST, because the reverse order had two failures:
- * a secret straddling the cap boundary was cut into a prefix the
- * exact-substring scrub could no longer match (a partial credential on the
- * wire), and a scrub REPLACEMENT that grew a string past the cap tripped the
- * server's field limits. `scrub` defaults to identity so this stays testable
- * without a vault.
- */
-export function toolEventOf(name, input = {}, cwd = '', scrub = (s) => s) {
-  // Window → scrub → cap. The window bounds what a multi-MB input costs; the
-  // cap is applied AFTER the scrub so a replacement cannot overflow it.
-  const clean = (v, cap) => scrub(String(v ?? '').slice(0, SCRUB_WINDOW)).slice(0, cap);
-  const rel = (p) => clean(shortPath(p, cwd), 300);
-  // The first k lines of a side, from a scrubbed bounded prefix — never a
-  // full split of the raw string.
-  const firstLines = (s, k) =>
-    scrub(String(s ?? '').slice(0, SCRUB_WINDOW)).split('\n', k).slice(0, k);
-  switch (name) {
-    case 'Read':
-      return { t: 'read', p: rel(input.file_path) };
-    case 'Write':
-      return { t: 'write', p: rel(input.file_path), a: countLines(input.content) };
-    case 'Edit': {
-      const oldS = String(input.old_string ?? '');
-      const newS = String(input.new_string ?? '');
-      // A MINI-DIFF, not the diff: the first lines of each side, enough to
-      // recognise the change at a glance. The real diff lives in git.
-      const dl = [
-        ...firstLines(oldS, 2).map((l) => `- ${l}`),
-        ...firstLines(newS, 3).map((l) => `+ ${l}`),
-      ].map((l) => l.slice(0, 160));
-      return { t: 'edit', p: rel(input.file_path), a: countLines(newS), d: countLines(oldS), dl };
-    }
-    case 'Grep':
-      return {
-        t: 'grep',
-        q: clean(input.pattern, 200),
-        ...(input.path ? { p: rel(input.path) } : {}),
-      };
-    case 'Glob':
-      return { t: 'glob', q: clean(input.pattern, 200) };
-    case 'Bash':
-      return { t: 'bash', c: clean(input.command, 200) };
-    case 'Task':
-      return { t: 'task', q: clean(input.description, 200) };
-    case 'TodoWrite': {
-      const todos = Array.isArray(input.todos) ? input.todos.slice(0, 20) : [];
-      const items = todos
-        .map((td) => ({
-          x: clean(td?.content, 120),
-          s: td?.status === 'completed' ? 'done' : td?.status === 'in_progress' ? 'active' : 'open',
-        }))
-        .filter((i) => i.x);
-      return items.length ? { t: 'plan', items } : null;
-    }
-    default:
-      return null;
-  }
-}
-
-/**
- * THE ACTIVITY KINDS `toolEventOf` ALSO ANSWERS — the dedupe rule, stated once.
- *
- * A Claude tool call goes down BOTH paths in claude.mjs: `humanizeClaudeTool`
- * makes a one-line activity and `toolEventOf` makes a structured event, from
- * the same `tool_use`. A consumer taking both — the agent turn's trace — would
- * otherwise render every read twice, once as a sentence and once as a card.
- *
- * It is the KINDS the structured builder answers, not every tool kind: `LS`
- * produces a `list` activity and no tool event, so dropping `list` would delete
- * it from the trace entirely. And it is only safe to apply on the runtimes
- * whose stream reaches `onToolEvent` at all — codex and agy have their own
- * parsers, never call it, and would go silent. Both halves are pinned in
- * trace.test.mjs, because the two functions are edited independently and the
- * failure is invisible: a dropped prose line looks exactly like a quiet turn.
- */
-export const CLAUDE_TOOL_PROSE_KINDS = new Set([
-  'read',
-  'write',
-  'search',
-  'glob',
-  'bash',
-  'plan',
-]);
-
-// ── Codex ──────────────────────────────────────────────────────────────────
-
-/**
- * Codex item → activity, in the daemon's vocabulary.
- *
- * The event names and item types below are not guesses: they were read off the
- * shipped 0.147 binary (`ThreadStarted`/`TurnCompleted`/`ItemCompleted`, items
- * `agent_message` / `reasoning` / `command_execution` / `file_change` /
- * `mcp_tool_call` / `web_search` / `todo_list`). Unknown item types return null
- * and stay silent rather than printing a raw JSON blob into someone's console.
- */
-function humanizeCodexItem(item = {}, cwd = '') {
-  switch (item.item_type ?? item.type) {
-    // `full` rides beside the label wherever the item carries more than the
-    // label can hold — see the `label`/`full` note above. Codex is the runtime
-    // that actually SENDS reasoning text today, so its `think` is the one place
-    // in this daemon where a real thought reaches the trace whole.
-    case 'agent_message': {
-      const text = String(item.text ?? item.message ?? '');
-      return { kind: 'say', label: oneLine(text), ...(text ? { full: text } : {}) };
-    }
-    case 'reasoning': {
-      const text = String(item.text ?? '');
-      return {
-        kind: 'think',
-        label: oneLine(text) || THINK_MARKER,
-        ...(text.trim() ? { full: text } : {}),
-      };
-    }
-    case 'command_execution':
-      return {
-        kind: 'bash',
-        command: String(item.command ?? '').slice(0, 2000),
-        label: `$ ${oneLine(item.command, 60)}`,
-      };
-    case 'file_change': {
-      // `changes` is a list of touched paths; the daemon counts distinct files,
-      // so emit one activity per path rather than one for the batch.
-      const first = (item.changes ?? [])[0] ?? {};
-      const p = String(first.path ?? '');
-      const tail = p.split('/').slice(-2).join('/');
-      const verb = first.kind === 'add' ? '+' : first.kind === 'delete' ? '-' : '~';
-      return { kind: 'write', path: p, label: `${verb} ${tail || 'file'}` };
-    }
-    case 'mcp_tool_call':
-      return { kind: 'tool', label: `${item.server ?? 'mcp'}.${item.tool ?? ''}` };
-    case 'web_search':
-      return { kind: 'search', label: `search ${oneLine(item.query, 60)}` };
-    default:
-      return null;
-  }
-}
-
-/**
- * Codex `--json` emits JSONL of ThreadEvents. Returns `{ activity, text,
- * threadId }` — `text` accumulates the agent's own words, because the turn
- * loop reads its sentinels (NOTHING / BLOCKED:<id> / DONE) out of exactly
- * that; `threadId` surfaces once, off the lifecycle event, for callers that
- * need to resume THIS conversation later (runTurn's onThreadId).
- */
-function parseCodexLine(line, cwd) {
-  let ev;
-  try {
-    ev = JSON.parse(line);
-  } catch {
-    return null; // not every line is JSON (warnings go to stderr, but be safe)
-  }
-  switch (ev.type) {
-    // The conversation's own id, announced before any item (`ThreadStarted` on
-    // the shipped 0.147 binary, like the measured events below). Surfaced so a
-    // SESSION turn can resume this exact thread next time: `resume --last` is
-    // a machine-global guess, and on a box running two tabs — or a tab plus a
-    // dispatch — it resumes someone else's conversation. No activity and no
-    // text: nothing here is the model speaking.
-    case 'thread.started':
-      return { activity: null, text: '', threadId: String(ev.thread_id ?? '') || null };
-    case 'item.completed': {
-      const item = ev.item ?? {};
-      const activity = humanizeCodexItem(item, cwd);
-      // Only the agent's MESSAGES are sentinel-bearing text. Reasoning is not:
-      // a model that muses "I could output NOTHING here" must not end the turn.
-      const isMessage = (item.item_type ?? item.type) === 'agent_message';
-      const text = isMessage ? `${item.text ?? item.message ?? ''}\n` : '';
-      // `answer` is the SAME message, surfaced alone: `text` accumulates every
-      // message plus every error and stderr line, so a caller that needs "what
-      // the agent said LAST" (the agent lane's final JSON object) cannot recover
-      // it from `out`. Claude's stream has this for free under
-      // `answerFromResult`; codex needed it said.
-      return { activity, text, ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
-    }
-    // THE TURN'S OWN TOKEN COUNT (2026-09-24). `codex exec --json` closes a
-    // turn with `turn.completed` carrying `usage` — the codex twin of Claude's
-    // `result.usage`, and until now dropped on the floor, so a codex agent
-    // reported no spend at all. Mapped onto the daemon's four counters:
-    // OpenAI's `input_tokens` INCLUDES the cached part, Claude's excludes it,
-    // so the cached share is subtracted out rather than counted twice. Codex
-    // has no cache-creation figure; zero is what it reported, not a guess.
-    // Output already includes reasoning tokens on OpenAI's side.
-    case 'turn.completed': {
-      const u = ev.usage;
-      if (!u || typeof u !== 'object') return null;
-      const n = (v) => (Number.isFinite(Number(v)) && Number(v) > 0 ? Math.floor(Number(v)) : 0);
-      const cached = n(u.cached_input_tokens);
-      return {
-        activity: null,
-        text: '',
-        // `usageFromResult`'s shape (claude.mjs), so every consumer of
-        // `onUsage` reads one vocabulary whichever CLI counted it.
-        usage: {
-          input: Math.max(0, n(u.input_tokens) - cached),
-          output: n(u.output_tokens),
-          cacheCreate: 0,
-          cacheRead: cached,
-        },
-      };
-    }
-    case 'turn.failed': {
-      // An error is prose too, and the sentence that explains a failed turn is
-      // routinely longer than a 140-char label — a stack-shaped message loses
-      // its cause exactly where somebody is reading to find it.
-      //
-      // THE LABEL KEEPS ITS OWN `??`, not `msg || …`, and the difference is one
-      // input: an EXPLICITLY EMPTY message. `??` lets `''` through as an empty
-      // label, which every consumer swallows (`if (!label)`); `||` would print
-      // "turn failed" and fire a pulse where this daemon printed nothing. That
-      // may well be the better readout, but it is a change to the console and
-      // the pulse, and `full` shipped on the promise that neither moved — so it
-      // is argued for on its own day, not smuggled in beside a relay field.
-      const msg = String(ev.error?.message ?? '');
-      return {
-        activity: {
-          kind: 'error',
-          label: oneLine(ev.error?.message ?? 'turn failed'),
-          ...(msg.trim() ? { full: msg } : {}),
-        },
-        // THE FAILURE'S OWN WORDS REACH `text` (2026-09-24), the rule the bare
-        // `error` arm below already keeps. This returned '' — so a codex turn
-        // that failed on a usage limit handed the limit matcher nothing, the
-        // agent landed in Stuck as "produced no output", and every other codex
-        // agent kept spending into the same wall.
-        text: msg.trim() ? `${msg}\n` : '',
-      };
-    }
-    // A bare `error` event — the shape an auth failure arrives in ("401
-    // Unauthorized: Missing bearer…", observed against 0.147.0 with no
-    // credentials). It used to fall through to `default` and be dropped, which
-    // meant a signed-out Codex produced an EMPTY turn: no sentinel, so the
-    // driver nudged twice and reported `stalled`, and the thread said the agent
-    // gave up rather than that the CLI is not signed in. The message goes into
-    // `text` so it reaches the operator's console AND the usage-limit
-    // classifier, which reads exactly this stream.
-    case 'error': {
-      // Same split as the arm above: `??` for the label (untouched behaviour),
-      // `msg` for the relay field only.
-      const msg = String(ev.message ?? '');
-      return {
-        activity: {
-          kind: 'error',
-          label: oneLine(ev.message ?? 'error'),
-          ...(msg.trim() ? { full: msg } : {}),
-        },
-        text: `${ev.message ?? ''}\n`,
-      };
-    }
-    default:
-      return null; // turn.started / item.started / item.updated
-  }
-}
-
-// ── Antigravity ────────────────────────────────────────────────────────────
-
-/**
- * `agy --output-format stream-json` emits `{event: init|step_update|result}`.
- * Tool names read off a live 1.1.12 session rather than guessed.
- */
-function humanizeAgyTool(name, p = {}, cwd = '') {
-  const path = p.TargetFile ?? p.AbsolutePath ?? p.DirectoryPath ?? p.File ?? '';
-  const tail = String(path).split('/').slice(-2).join('/');
-  switch (name) {
-    case 'view_file':
-    case 'read_resource':
-      return { kind: 'read', label: `read ${shortPath(path, cwd)}` };
-    case 'write_to_file':
-    case 'replace_file_content':
-    case 'multi_replace_file_content':
-      return {
-        kind: 'write',
-        path: String(path),
-        label: `${name === 'write_to_file' ? '+ page' : '~ page'} ${tail || 'file'}`,
-      };
-    case 'grep_search':
-      return { kind: 'search', label: `grep ${oneLine(p.Query ?? p.SearchTerm ?? '', 60)}` };
-    case 'find_by_name':
-      return { kind: 'glob', label: `find ${oneLine(p.Pattern ?? '', 60)}` };
-    case 'list_dir':
-      return { kind: 'list', label: `ls ${shortPath(path, cwd)}` };
-    case 'run_command':
-      return {
-        kind: 'bash',
-        command: String(p.CommandLine ?? '').slice(0, 2000),
-        label: `$ ${oneLine(p.CommandLine, 60)}`,
-      };
-    case 'call_mcp_tool':
-      return { kind: 'tool', label: `mcp.${p.ToolName ?? ''}` };
-    default:
-      return null;
-  }
-}
-
-function parseAgyLine(line, cwd) {
-  let ev;
-  try {
-    ev = JSON.parse(line);
-  } catch {
-    return null;
-  }
-  if (ev.event === 'step_update') {
-    const su = ev.step_update ?? {};
-    const ti = su.tool_info;
-    if (!ti) return null;
-    const err = ti.error?.message;
-    // Same rule as codex's error lines: the label is the console's, `full` is
-    // the trace's, and a tool error's message is exactly the kind of sentence a
-    // 140-char clamp cuts the cause out of.
-    if (err)
-      return {
-        activity: { kind: 'error', label: oneLine(err), full: String(err) },
-        text: '',
-      };
-    // Each tool is reported twice — once ACTIVE, once DONE — so only the
-    // terminal state emits, otherwise every action appears in the thread twice.
-    if (su.state && su.state !== 'DONE') return null;
-    return { activity: humanizeAgyTool(ti.name, ti.parameters ?? {}, cwd), text: '' };
-  }
-  if (ev.event === 'result') {
-    const r = ev.result ?? {};
-    // The final answer is the ONLY sentinel-bearing text: agy has no incremental
-    // assistant-message event, so a turn's whole verdict arrives here at once.
-    return {
-      activity: r.error
-        ? { kind: 'error', label: oneLine(r.error), full: String(r.error) }
-        : null,
-      text: `${r.response ?? ''}${r.error ? `\n${r.error}` : ''}\n`,
-    };
-  }
-  return null;
-}
+ * dispatch), and arrives on the brief. Detection (runtimeDetection.mjs) answers
+ * "what does this machine HAVE" — activity, never capacity, and never a
+ * default we invented.
+ *
+ * WHAT MOVED OUT (2026-09-26, SOLID F045), each to the module named for its
+ * own reason to change: what a CLI's stream MEANT → runtimeEvents.mjs; which
+ * CLIs this box has, and which runs an unmentioned job → runtimeDetection.mjs;
+ * the skills and MCP servers a CLI reported, and the one-shot probe that
+ * learns them → runtimeCapabilities.mjs; and each vendor's own row (argv,
+ * profiles, efforts, MCP mint) → runtime{Claude,Codex,Antigravity}.mjs, since
+ * a vendor renaming a flag is no reason to open another vendor's builder. This
+ * file keeps the registry's assembly, the lookup and the per-profile
+ * drivability rule.
+ */
+
+import { SAFE } from './config.mjs';
+import { CLAUDE_RUNTIME } from './runtimeClaude.mjs';
+import { CODEX_RUNTIME } from './runtimeCodex.mjs';
+import { ANTIGRAVITY_RUNTIME } from './runtimeAntigravity.mjs';
 
 // ── The registry ───────────────────────────────────────────────────────────
 
@@ -526,524 +71,14 @@ function parseAgyLine(line, cwd) {
  * read the bearer token from an ENV VAR (`bearer_token_env_var`), so its token
  * never touches disk at all — strictly better, and the reason Codex was the
  * first second-runtime rather than the easiest-looking one.
+ *
+ * Each row's `mcp` is that mint (`claudeMcp` in runtimeClaude.mjs, `codexMcp`
+ * in runtimeCodex.mjs); Antigravity's is null, and its row says why.
  */
-function claudeMcp(token, mcpUrl) {
-  const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
-  const path = join(dir, 'mcp.json');
-  writeFileSync(
-    path,
-    JSON.stringify({
-      mcpServers: {
-        flowviant: {
-          type: 'http',
-          url: mcpUrl,
-          headers: { Authorization: `Bearer ${token}`, 'User-Agent': USER_AGENT },
-        },
-      },
-    }),
-    { mode: 0o600 }
-  );
-  return { dir, args: ['--mcp-config', path], env: {} };
-}
-
-function codexMcp(token, mcpUrl) {
-  return {
-    dir: null, // nothing written — the token rides in the environment
-    args: [
-      '-c',
-      `mcp_servers.flowviant.url="${mcpUrl}"`,
-      '-c',
-      'mcp_servers.flowviant.bearer_token_env_var="FLOWVIANT_MCP_TOKEN"',
-    ],
-    env: { FLOWVIANT_MCP_TOKEN: token },
-  };
-}
-
 export const RUNTIMES = {
-  claude: {
-    id: 'claude',
-    label: 'Claude Code',
-    vendor: 'Anthropic',
-    bin: 'claude',
-    install: 'npm i -g @anthropic-ai/claude-code',
-    login: 'claude',
-    /** The Agent-SDK live session (persistent, injectable mid-task) is Claude
-     *  only — it is an Anthropic SDK, not a CLI contract. Everything else runs
-     *  the subprocess path. */
-    live: true,
-    /**
-     * Every profile, because every profile is DEFINED in its vocabulary: the
-     * four `--allowedTools` lists in claude.mjs are what "build", "wiki",
-     * "consult" and "plan" currently mean. That is a statement about where the
-     * contract was written, not a claim that only Claude could ever satisfy it.
-     */
-    // `design` and `research` (0.97.0) are Claude's alone: each is an
-    // `--allowedTools` list with a PATH-SCOPED write (claude.mjs), and neither
-    // codex's sandbox modes nor agy's flags were measured to express "write
-    // only this directory". A runtime that does not declare them is refused
-    // such a card before spawn, in words — never handed a build turn instead.
-    profiles: ['build', 'wiki', 'consult', 'plan', 'design', 'research'],
-    mcp: claudeMcp,
-    /**
-     * Claude takes the operating contract as a real system prompt, which is the
-     * strongest form of it available anywhere: `--append-system-prompt` sits
-     * above the conversation rather than inside it.
-     */
-    args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools }) {
-      const a = [];
-      // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
-      // are mutually exclusive, never combined.
-      //
-      // ADOPTION: `--resume <id> --fork-session` finds the session globally
-      // (any cwd), carries its full context, and writes the FORK natively into
-      // THIS cwd's own store, leaving the original transcript untouched
-      // (measured on 2.1.234).
-      //
-      // BY ID: the conversation THIS TAB spoke under last time, learned from
-      // the CLI's own `system.init` event and pinned per session. It exists
-      // because `--continue` is CWD-KEYED, and a directory stopped being one
-      // tab the day tabs moved into their driver's project folder — two tabs
-      // sharing a directory both said `--continue` and both resumed whichever
-      // conversation spoke most recently there, so tab B inherited tab A's
-      // entire context and every turn after that ping-ponged between them.
-      // Exactly the failure codex's own note warns about for `resume --last`,
-      // arriving for Claude by a different route. An id is unambiguous wherever
-      // the tab is standing.
-      //
-      // `--continue` is the LAST resort, and only where nothing better is
-      // known.
-      if (adoptResumeId) a.push('--resume', adoptResumeId, '--fork-session');
-      else if (resumeThreadId) a.push('--resume', resumeThreadId);
-      else if (resume) a.push('--continue');
-      a.push('-p', prompt, '--append-system-prompt', system);
-      if (agentTools) {
-        // Keep personal settings, but never load the agent-editable project's
-        // settings, hooks, skills or CLAUDE.md discovery. A resumed agent must
-        // render the CURRENT base snapshot, not the first turn's prompt cache.
-        a.push('--setting-sources', 'user', '--system-prompt-snapshot', 'off');
-        if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
-      }
-      // These fenced postures have no project MCP, even if Claude discovers a
-      // .mcp.json in the agent's worktree. Build gets its reviewed base config
-      // explicitly from the caller; the plan profile keeps its own principal.
-      if (['consult', 'wiki', 'design', 'research'].includes(profile)) a.push('--strict-mcp-config');
-      a.push(...mcp, ...resultSchemaArgs);
-      a.push('--model', model || MODEL);
-      if (effort) a.push('--effort', effort);
-      if (streamJson) a.push('--output-format', 'stream-json', '--verbose');
-      // The knowledge library (0.94.0) sits in the checkout, outside a
-      // worktree's cwd: named as a readable directory so a curated profile
-      // does not refuse the path the prompt just handed it. Before `perm`,
-      // because `--allowedTools` is variadic and would swallow the flag.
-      if (knowledgeDir) a.push('--add-dir', knowledgeDir);
-      a.push(...perm);
-      return a;
-    },
-    parse: null, // claude.mjs owns its own stream parser (unchanged)
-  },
-
-  codex: {
-    id: 'codex',
-    label: 'Codex',
-    vendor: 'OpenAI',
-    bin: 'codex',
-    install: 'npm i -g @openai/codex',
-    login: 'codex login',
-    live: false,
-    /**
-     * BUILD AND CONSULT. See `args()` below for how consult is expressed — the
-     * short version is that Codex keeps the promise at the kernel rather than in
-     * a verb allowlist, and for a consult's actual threat (exfiltration driven
-     * by an injected question) that is sufficient and arguably stronger.
-     *
-     * ALL THREE, and `wiki` is the one worth pausing on: Codex expresses it
-     * MORE strictly than Claude does. A cartographer must read the repo and
-     * write only the vault; Claude's WIKI_PERM cannot path-scope Write and says
-     * so, leaning on the worktree reset as a backstop. Codex's permission
-     * profiles enforce the same rule in the kernel — measured: repo readable,
-     * vault writable, repo writes refused, network off.
-     *
-     * Enforcement was verified on Linux (bubblewrap + seccomp). macOS Seatbelt
-     * and Windows are UNTESTED; if this daemon starts running there, re-verify
-     * before trusting the consult posture on those platforms.
-     */
-    profiles: ['build', 'consult', 'wiki', 'plan'],
-    mcp: codexMcp,
-    /**
-     * Codex has NO system-prompt flag. The contract therefore rides inside the
-     * prompt, fenced and placed first, and this is a genuine weakening worth
-     * stating plainly: a system prompt is a rule, and a prompt preamble is a
-     * strong suggestion the model may drift from over a long turn. It is the
-     * best available; AGENTS.md was the alternative and is worse, because it is
-     * a FILE IN THE WORKTREE — one `git add -A` from being committed into the
-     * user's repository, which is not a risk worth taking for a slightly
-     * stickier instruction.
-     *
-     * Agent turns additionally pass reviewed base instructions as a developer
-     * config override when the personal config has no developer instruction;
-     * the prompt always carries them too. Workbench tabs keep their normal
-     * checkout discovery.
-     *
-     * `--skip-git-repo-check` is deliberately NOT passed: a task always builds
-     * in a git worktree, and if it somehow is not one, failing loudly beats
-     * silently editing files nobody can diff.
-     *
-     * THE PROMPT IS LAST, and that is load-bearing rather than tidy. Codex takes
-     * it as a trailing POSITIONAL, so every flag — including the two `-c` MCP
-     * overrides, which the caller hands in rather than appending — has to be
-     * placed before it. Appending them after the positional is the kind of argv
-     * that parses today and stops parsing on some future clap upgrade.
-     */
-    args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools }) {
-      // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
-      // agy moves) — codex has no adoptable store wired yet. Reaching here
-      // with an adopt id is a wiring mistake upstream, and it fails loudly on
-      // purpose: quietly dropping the flag would answer that session's held
-      // context with a different brain.
-      if (adoptResumeId) throw new Error("codex has no adoptable terminal store — an adopt id can't reach this builder");
-      const a = ['exec'];
-      // BY ID when the caller knows WHICH conversation this is — a Workbench
-      // tab's held context, captured off thread.started and stored with its
-      // worktree. `--last` resumes the machine's most recent codex conversation,
-      // which is only safe on the dispatch path (one lane, one turn at a time,
-      // in its own worktree); for a session it is a machine-global guess that
-      // two tabs — or a tab plus a dispatch — would cross-resume.
-      if (resumeThreadId) a.push('resume', resumeThreadId);
-      else if (resume) a.push('resume', '--last');
-      a.push('--json');
-      if (agentTools) {
-        a.push('-c', 'project_doc_max_bytes=0');
-        // A person's existing developer instructions keep their authority.
-        // The base snapshot is also present in the per-turn prompt preamble.
-        if (!agentTools.personalDeveloperInstructions)
-          a.push('-c', `developer_instructions=${JSON.stringify(agentTools.instructions)}`);
-      }
-      if (model) a.push('--model', model);
-      // Effort is a config value on Codex rather than a flag.
-      if (effort) a.push('-c', `model_reasoning_effort="${effort}"`);
-
-      if (profile === 'consult') {
-        // A CONSULT, EXPRESSED THE ONLY WAY CODEX CAN EXPRESS IT — and it is a
-        // different shape from Claude's, which is the whole reason `profile` is
-        // a promise rather than a flag list.
-        //
-        // Claude gets a VERB allowlist: Read, Grep, Glob and a handful of
-        // read-only Bash forms, with nothing that reaches the network. Codex has
-        // no such thing — it has no file-read tool at all, so reading the repo
-        // IS command execution (`cat`, `rg`). Removing the shell leaves the
-        // model with exactly ["update_plan","request_user_input"], which cannot
-        // answer a question about a codebase. You get both capabilities or
-        // neither.
-        //
-        // So the promise is kept one layer down instead. `read-only` is
-        // kernel-enforced (bubblewrap + seccomp on Linux): writes fail, and a
-        // direct-IP connect fails with "Operation not permitted" — socket() is
-        // denied, not merely DNS. An injected command still RUNS and still
-        // cannot take the repository anywhere, which is the threat a consult
-        // actually has: its prompt is steered by a question any project editor
-        // can type. Arguably a stronger guarantee than the allowlist, being
-        // below the agent rather than inside it.
-        a.push('--sandbox', 'read-only');
-
-        // THE HOLE THE SANDBOX DOES NOT COVER. `web_search` ships in `codex
-        // exec`'s default tool list even without --search, and it executes
-        // SERVER-SIDE at OpenAI — no local sandbox touches it. An injected turn
-        // could pack repo contents into a query and egress them straight past
-        // everything above. Both spellings, because the two config systems
-        // disagree about which one is live.
-        a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
-
-        // Sub-agents would be a second turn whose posture nobody here chose.
-        a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false');
-
-        // HERMETIC. Without these a user's ~/.codex/config.toml, a project
-        // `.rules` execpolicy file, or their own MCP servers can widen a posture
-        // we are asserting on their behalf — silently, and on the one turn whose
-        // prompt comes from someone else's typing.
-        a.push('--ignore-user-config', '--ignore-rules');
-      } else if (profile === 'plan') {
-        // A PLANNING SESSION. Read-only on the filesystem, exactly like a
-        // consult — the writes it makes go through the control plane, not
-        // through this box — so the kernel sandbox is the same one, and for the
-        // same reason: this turn's prompt is steered by anything a project
-        // editor can type.
-        //
-        // Everything the consult branch above closes stays closed, and the
-        // reasoning is unchanged, so it is not restated: web_search egresses
-        // server-side at OpenAI where no local sandbox reaches it, sub-agents
-        // would be a turn whose posture nobody here chose, and a user's own
-        // config or MCP servers must not widen a posture we are asserting on
-        // their behalf.
-        //
-        // What differs from a consult is the ONE thing this profile exists for:
-        // an MCP config IS passed, carrying the plan principal's token. That
-        // token's whole tool set is the five plan tools — the server refuses
-        // anything else on it — so the control plane being open here does not
-        // widen what a hijacked turn could reach beyond the plan it is already
-        // sitting in.
-        a.push('--sandbox', 'read-only');
-        a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
-        a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false');
-        a.push('--ignore-user-config', '--ignore-rules');
-      } else if (profile === 'wiki' && vaultDir) {
-        // THE CARTOGRAPHER, AND THIS ONE IS STRICTER THAN CLAUDE'S.
-        //
-        // A wiki turn reads the whole repo and writes ONLY the vault. Claude
-        // cannot actually express that: WIKI_PERM hands it Write/Edit and its own
-        // comment admits "Write/Edit can't be path-scoped here; the worktree
-        // reset is the backstop" — i.e. the cartographer CAN scribble on the
-        // checkout and we clean up afterwards.
-        //
-        // Codex's permission profiles take a per-path filesystem map, so the
-        // rule is enforced by the kernel instead of apologised for. Measured:
-        // repo readable, vault writable, repo writes fail "Read-only file
-        // system", and curl returns 000 — the network is off, which is the half
-        // WIKI_PERM was really protecting (its comment: "Command execution is
-        // the line: it enables network exfil").
-        //
-        // The table is set WHOLE rather than as a dotted key, and that is not
-        // style: `-c permissions.wiki.filesystem."<path>"="write"` splits the
-        // dotted path on the dots INSIDE the path, and every real vault lives
-        // under `~/.flowviant/vaults/…`. It fails with "filesystem path must be
-        // absolute", which reads like a path problem and is a parsing one.
-        a.push('-c', 'permissions.flowviantwiki.extends=":read-only"');
-        a.push('-c', `permissions.flowviantwiki.filesystem={"${vaultDir}"="write"}`);
-        a.push('-P', 'flowviantwiki');
-        a.push('--ignore-user-config', '--ignore-rules');
-      } else {
-        // The daemon's build posture, mapped: SAFE keeps writes inside the
-        // workspace, the default lets the agent run its own tests and git
-        // commands. Neither asks a human — there is no human on this end of the
-        // pipe. Deliberately NOT hermetic: a build is work the user asked for by
-        // @mentioning this CLI, and their own config is theirs to apply.
-        a.push('--sandbox', SAFE ? 'workspace-write' : 'danger-full-access');
-      }
-
-      a.push(...mcp, ...resultSchemaArgs);
-      a.push(`${system}\n\n---\n\n${prompt}`);
-      return a;
-    },
-    parse: parseCodexLine,
-    /** `codex exec --output-schema <file>` constrains the FINAL message to a
-     *  JSON Schema. Only needed on the mediated path; the direct path reports
-     *  through MCP tool calls, which are already structured. */
-    resultSchema: (path) => ['--output-schema', path],
-  },
-
-  /**
-   * DECLARED, NOT DRIVABLE — and this is now MEASURED rather than argued.
-   *
-   * The reason went wrong twice before it went right, so the evidence is written
-   * down here in full. First it cited upstream antigravity-cli#60, which is about
-   * `.antigravitycli/mcp_config.json` — the project-DISCOVERY folder — while
-   * claiming it was about `.agents/`, the workspace-CUSTOMIZATION folder. Then,
-   * on reading the docs (antigravity.google/docs/mcp describes `.agents/`, and
-   * Google's own codelab creates it), this comment swung the other way and said
-   * the blocker looked wrong. Both were reasoning from paperwork.
-   *
-   * THE TEST, run against agy 1.1.12, signed in, in a real git repo:
-   * the SAME minimal stdio MCP server, declared two ways.
-   *   • workspace `<worktree>/.agents/mcp_config.json` → the server process is
-   *     NEVER SPAWNED. Not connected-and-failed: never launched. The model
-   *     answers "NO_MCP".
-   *   • global `~/.gemini/config/mcp_config.json` → spawns immediately and
-   *     handshakes: server/discover, initialize, notifications/initialized,
-   *     tools/list.
-   * stdio deliberately, to remove every confound — no bearer token to reject,
-   * no network, no TLS. The difference is the config LOCATION and nothing else.
-   *
-   * AND IT SURVIVES THE TRUST VARIABLE, which was the obvious objection: agy
-   * keeps a `trustedWorkspaces` list in settings.json, a fresh per-task worktree
-   * is not on it, and an untrusted folder demonstrably changes behaviour (the
-   * model stops treating cwd as its workspace and works out of its own scratch
-   * dir). Adding the worktree to `trustedWorkspaces` and re-running changed
-   * nothing: the server still never spawned, the model still answered NO_MCP.
-   * So the workspace config is not trust-gated, it is simply not read.
-   *
-   * So Antigravity's MCP config is machine-wide IN PRACTICE, and the original
-   * blocker's conclusion stands even though its cited reason never did: every
-   * lane on the box would share one worker token, which is exactly the blast
-   * radius the per-lane token exists to prevent. That is why this stays
-   * undrivable, and it is a property of the CLI rather than something we can
-   * work around from here.
-   *
-   * A TRAP FOR WHOEVER RE-TESTS THIS: agy exposes MCP through a single generic
-   * `call_mcp_tool` dispatcher, so per-server tools NEVER appear in the `init`
-   * event's tools array even when a server is loaded correctly. Reading that
-   * array tells you nothing. Watch the server process instead, or ask the model.
-   *
-   * FOUR MORE FACTS from the same session, each an independent obstacle:
-   *   1. AUTH IS INTERACTIVE OAUTH (bubbletea TUI; needs a real /dev/tty), with
-   *      no headless credential path. A signed-out `agy -p` prints a consent URL
-   *      and then SITS until `--print-timeout` (default 5m) before erroring — so
-   *      a lane on a signed-out agy burns five minutes per turn looking like a
-   *      hang. Preflight cannot see it: `--version` succeeds while signed out.
-   *   2. `--sandbox` IS A BOOLEAN ("terminal restrictions enabled"), not a mode
-   *      selector — but a CONSULT POSTURE IS STILL EXPRESSIBLE, and this was
-   *      recorded backwards here for a while. It does not come from `--sandbox`
-   *      at all; it comes from headless mode's default. Any tool needing a
-   *      permission that cannot be prompted for is AUTO-DENIED:
-   *        "User denied permission to run command: <cmd>"
-   *        "a tool required the 'command' permission that headless mode cannot
-   *         prompt for, so it was auto-denied."
-   *      Observed repeatedly, including for an entirely benign `pwd && ls -la`,
-   *      and a local listener confirmed no egress in any run. Reads (list_dir,
-   *      file reads) work throughout. So: NOT passing
-   *      `--dangerously-skip-permissions` IS the consult posture, and passing it
-   *      is the build posture — both per invocation, both harness-enforced
-   *      rather than model-instructed. `--mode plan` is a separate, WEAKER thing:
-   *      it steers behaviour and blocks workspace writes, but it is not what
-   *      stops command execution.
-   *      RESIDUAL RISK, and it has no fix from here: `permissions.allow` in the
-   *      machine-wide settings.json is inherited, so a user who has allowed
-   *      `command(...)` widens every consult on that box. Codex has
-   *      `--ignore-user-config` for exactly this; agy has no equivalent.
-   *   3. No `mcp` subcommand; `/mcp` is interactive-only.
-   *   4. It attempts to INSTALL PLAYWRIGHT at startup (observed failing 404
-   *      against playwright.azureedge.net). A daemon runtime that downloads and
-   *      runs a browser driver is worth knowing before it goes on a machine the
-   *      project leaves running.
-   *
-   * There is no npm package. `antigravity-cli` (0.0.1, "placeholder") and `agy`
-   * (0.0.0, empty) on npm are SQUATS by unrelated accounts; the real channel is
-   * the install script at antigravity.google, which is why `install` below says
-   * to see the docs rather than naming an npm command.
-   *
-   * WHAT WOULD UNBLOCK IT: a per-invocation MCP flag or env var, or workspace
-   * configs actually being honoured. Re-test with the two-location stdio probe
-   * above — it is five minutes and it answers the question outright. Pin any
-   * wiring to >= 1.1.10 (`--model`/`--effort` were ignored in headless before it;
-   * `--output-format` arrived in 1.1.8).
-   */
-  antigravity: {
-    id: 'antigravity',
-    label: 'Antigravity',
-    vendor: 'Google',
-    bin: 'agy',
-    install: 'see antigravity.google/docs/cli',
-    login: 'agy',
-    live: false,
-    /** None, because it cannot reach the MCP server at all — see `blocked`. */
-    /**
-     * WIKI AND CONSULT, BUT NOT BUILD — and the split is the whole point of
-     * making drivability per-profile rather than one verdict.
-     *
-     * Only a BUILD needs the MCP control plane: claiming, reporting a blocker,
-     * attaching a PR, completing. A wiki turn writes markdown files that the
-     * daemon syncs afterwards, and a consult answers a question in prose; BOTH
-     * already run with no MCP at all on every runtime, Claude included. Gating
-     * them on an MCP capability they never use was a test of the wrong thing,
-     * and it is what kept Antigravity at zero for months.
-     *
-     * Build returns here when the mediated adapter lands (the daemon holds the
-     * MCP connection and the CLI just returns schema-enforced JSON via
-     * `--json-schema`), which needs no per-invocation MCP config from the vendor
-     * at all.
-     *
-     * PLAN IS ABSENT ON PURPOSE, and NOT because a planning turn is beyond it —
-     * it reads code as well as anything here. A plan session is a conversation
-     * that makes many control-plane calls as it goes (spawn a slice, re-shape
-     * it, drop it, rewrite the spec), and mediation turns a turn into ONE
-     * schema-enforced form the daemon then applies. That shape fits a build,
-     * whose outcome is a single structured result; it does not yet fit an
-     * argument. Note that `canRun` would otherwise say yes via `mediated()` and
-     * hand this runtime a job it cannot finish — declaring the profile is the
-     * only thing standing between here and that. Mediated planning is a real
-     * design (the session returns its writes as a batch), just not a built one.
-     */
-    profiles: ['build', 'wiki', 'consult'],
-    mcp: null,
-    args({ prompt, system, model, effort, resume, resumeConversationId, profile = 'build', vaultDir, resultSchemaArgs = [], adoptResumeId }) {
-      const a = [];
-      // WHICH CONVERSATION IS THIS — one decision, answered one way (the same
-      // rule as Claude's --resume/--continue). By id when the caller knows:
-      // `--conversation <id>` resumes globally, any cwd (measured on 1.1.12).
-      // Adoption is the SAME argv because agy has no fork — the id in the db
-      // is the identity (a renamed copy fails "trajectory not found",
-      // measured), so adopting MOVES the conversation: the tab continues the
-      // terminal session itself, appending to its one store. `--continue` is
-      // the cwd-keyed fallback for a session whose id was never learned.
-      if (adoptResumeId || resumeConversationId) a.push('--conversation', adoptResumeId || resumeConversationId);
-      else if (resume) a.push('--continue');
-      // No system-prompt flag, same weakening as Codex: the contract rides in
-      // the prompt, fenced and first.
-      a.push('-p', `${system}\n\n---\n\n${prompt}`);
-      a.push('--output-format', 'stream-json');
-      if (model) a.push('--model', model);
-      if (effort) a.push('--effort', effort);
-      a.push(...resultSchemaArgs);
-
-      if (profile === 'wiki') {
-        // THE CARTOGRAPHER, at the same bar WIKI_PERM sets for Claude — writes
-        // allowed, network shut. Both halves measured on 1.1.12:
-        //   • headless cannot prompt, so anything needing approval is
-        //     auto-denied — including the file writes a wiki turn exists to
-        //     make. `--dangerously-skip-permissions` is what grants them.
-        //   • `--sandbox` blocks egress: with it, curl returned 400 and a local
-        //     listener saw nothing; without it, 200 and the request arrived.
-        // Upstream #36 warns these two cancel out (skip-permissions
-        // auto-approving the sandbox-bypass prompt). It does NOT reproduce on
-        // 1.1.12 — tested together, the write landed and the network stayed
-        // shut. Re-check on upgrade: if it ever does cancel, this posture
-        // silently becomes "wiki turn with internet", which is the one line
-        // WIKI_PERM draws ("Command execution is the line: it enables network
-        // exfil").
-        if (vaultDir) a.push('--add-dir', vaultDir);
-        a.push('--sandbox', '--dangerously-skip-permissions');
-        // A sweep reads a whole repository; the 5m default would guillotine it.
-        a.push('--print-timeout', '60m');
-      } else if (profile === 'build') {
-        // A BUILD WRITES, and headless auto-denies anything needing approval —
-        // so without this every edit comes back "User denied permission" and the
-        // turn reports failure having touched nothing. Caught only because an
-        // end-to-end test had to add the flag by hand to work.
-        //
-        // NOT `--sandbox` here, unlike wiki: a build has to `git push`, so it
-        // needs the network by definition.
-        //
-        // AND NOTHING ELSE CONTAINS IT EITHER. This comment used to end "the
-        // containment is the worktree, as it is for every runtime", which was
-        // false and is the kind of false that stops people looking: `cwd` is a
-        // starting directory, not a jail. A build turn runs with the operator's
-        // full user permissions — it can write outside the worktree, to their
-        // home directory, to their other checkouts. Claude gets
-        // --dangerously-skip-permissions, codex gets --sandbox
-        // danger-full-access, and agy gets no sandbox flag at all. The only
-        // real boundary today is that the person driving the tab is trusted.
-        //
-        // FLOWVIANT_SAFE HAS NO EXPRESSION ON THIS RUNTIME. Claude narrows to an
-        // allowlist and Codex to `workspace-write`; agy's only per-invocation
-        // control is this boolean, and its allow/deny engine is machine-wide.
-        // So a SAFE-mode operator gets an agy build that is not actually
-        // narrowed — which is why `mediatedSafeGap` is surfaced rather than
-        // quietly ignored.
-        a.push('--dangerously-skip-permissions');
-        a.push('--print-timeout', '60m');
-      } else if (profile === 'consult') {
-        // NOTHING GRANTED, deliberately. The headless default IS the consult
-        // posture: `run_command` comes back "User denied permission… headless
-        // mode cannot prompt for it, so it was auto-denied", observed even for a
-        // benign `pwd && ls -la`, with no egress in any run. Reads keep working,
-        // which is all a consult needs. Passing --dangerously-skip-permissions
-        // here would hand a question ANY project editor can type a shell.
-        a.push('--print-timeout', '10m');
-      }
-      return a;
-    },
-    parse: parseAgyLine,
-    /**
-     * `--json-schema` enforces the shape of the final result — verified against
-     * 1.1.12, which returned exactly the object asked for. This is what makes a
-     * BUILD possible on a runtime that cannot be handed an MCP config: the CLI
-     * stops needing to CALL anything and just returns a filled-in form, and the
-     * daemon makes the control-plane calls on its behalf with the lane's own
-     * per-lane token. Strictly better than parsing markers out of prose, which a
-     * model can wrap in a code fence, truncate or hallucinate.
-     */
-    resultSchema: (path) => ['--json-schema', path],
-    blocked:
-      'its MCP config is machine-wide — a workspace .agents/mcp_config.json is never loaded (measured), so every lane would share one token',
-  },
+  claude: CLAUDE_RUNTIME,
+  codex: CODEX_RUNTIME,
+  antigravity: ANTIGRAVITY_RUNTIME,
 };
 
 // DELETED: `DISPATCHABLE`, a `mcp && args` filter last described as "runtimes
@@ -1054,7 +89,17 @@ export const RUNTIMES = {
 // constant would have silently undone this release. `canRun(rt, profile)` /
 // `drivableHere(rt)` below are the answers.
 
-export const runtimeById = (id) => RUNTIMES[id] ?? RUNTIMES.claude;
+/**
+ * The adapter for a runtime id, or NULL for an id this daemon does not declare.
+ *
+ * NEVER A SUBSTITUTE (2026-09-26, SOLID F048). This used to fall back to
+ * Claude, so a misspelled id — or one a newer server learned ahead of this
+ * daemon — minted Claude's MCP config or spawned Claude under another
+ * runtime's requested identity. The callers (`mcpFor`, `runTurn`) refuse a
+ * null in words, naming the id they were given. A caller that OMITS the
+ * runtime still gets Claude, from its own explicit default, never from here.
+ */
+export const runtimeById = (id) => (typeof id === 'string' && Object.hasOwn(RUNTIMES, id) ? RUNTIMES[id] : null);
 
 /**
  * Can the worker this daemon is running actually DRIVE this runtime right now?
@@ -1089,7 +134,7 @@ export const runtimeById = (id) => RUNTIMES[id] ?? RUNTIMES.claude;
  * is the control plane, and a runtime that cannot reach it cannot participate.
  * A WIKI turn writes markdown the daemon syncs afterwards. A CONSULT answers a
  * question in prose. Neither passes an MCP config on ANY runtime today, Claude
- * included — check the two call sites in fleet.mjs, they hand `runTurn` no
+ * included — check the two call sites in wikiRunner.mjs, they hand `runTurn` no
  * `mcpArgs` at all.
  *
  * A PLAN is the second one, and it is the reason the consult stopped being the
@@ -1143,408 +188,3 @@ export const canRun = (rt, profile) =>
  * which is why a runtime can be undispatchable and still run wiki and consult.
  */
 export const drivableHere = (rt) => canRun(rt, 'build');
-
-/**
- * WHICH RUNTIME RUNS A JOB THAT NOBODY @MENTIONED.
- *
- * Building a task has an author: you @mentioned a CLI, and that is the only
- * dispatch in this product. The other turns have none — the wiki sweep, the
- * re-ground, the plan check, the quick edit and the consult are all started by
- * the daemon or the server, and until now every one of them took `runTurn`'s
- * default parameter value and ran Claude. That was not a decision; it was five
- * call sites omitting an argument, and it only looked correct while Claude was
- * the only runtime and preflight refused to start without it.
- *
- * A PROFILE is a promise about what is IMPOSSIBLE during the turn, not a flag
- * list — flag lists are per-vendor, promises are not, and the goal is that every
- * runtime behaves the same way predictably. A runtime declares the profiles it
- * can actually express; one that cannot express a profile does not get that job,
- * rather than getting it with weaker guarantees nobody wrote down.
- *
- * Claude first when it qualifies — not favouritism, and worth saying plainly:
- * these prompts were written and tuned against it, so it is the known-good
- * answer and anything else is a substitution. When it is absent, any runtime
- * that can express the profile runs the job, which is the whole point.
- */
-export function pickRuntimeFor(profile, { detected } = {}) {
-  const rows = detected ?? detectRuntimes();
-  const ok = (id) =>
-    canRun(RUNTIMES[id], profile) && Boolean(rows.find((d) => d.id === id)?.installed);
-  if (ok('claude')) return 'claude';
-  return Object.keys(RUNTIMES).find(ok) ?? null;
-}
-
-// ── Detection ──────────────────────────────────────────────────────────────
-
-/**
- * Which of these is on this machine, asked at most once per DETECT_TTL_MS.
- *
- * `--version` rather than `which`: a binary on PATH that cannot execute (a
- * broken install, a wrong-arch download, a shell alias pointing at nothing) is
- * not a runtime you can dispatch to, and reporting it as one sends work into a
- * hole. 5s is generous for a version print and short enough that three missing
- * CLIs cannot stall a roster poll.
- *
- * Reported to the server on the roster poll so the app can stop saying "we have
- * not looked". It is a statement about THIS MACHINE and nothing else — no
- * account, no quota, no entitlement. Flowviant relays; it does not enforce.
- */
-let detectedCache = null;
-let detectedAt = 0;
-// The cache EXPIRES rather than living for the process: pickRuntimeFor's whole
-// premise is "a CLI can be installed while the daemon runs", and both it and
-// the roster poll read this cache — a forever-cache made that comment a lie
-// (nothing after preflight ever passed refresh, so a mid-run install was
-// invisible until restart, to the server included). 5 minutes keeps the probes
-// (3 sync --version execs) off the hot path while an install still surfaces on
-// the next poll or job.
-const DETECT_TTL_MS = 5 * 60 * 1000;
-export function detectRuntimes({ refresh = false } = {}) {
-  if (detectedCache && !refresh && Date.now() - detectedAt < DETECT_TTL_MS) return detectedCache;
-  detectedAt = Date.now();
-  detectedCache = Object.values(RUNTIMES).map((rt) => {
-    let version = null;
-    try {
-      version = String(
-        execFileSync(rt.bin, ['--version'], {
-          timeout: 5000,
-          stdio: ['ignore', 'pipe', 'ignore'],
-        })
-      )
-        .trim()
-        .split('\n')[0]
-        .slice(0, 40);
-    } catch {
-      version = null;
-    }
-    return {
-      id: rt.id,
-      installed: version !== null,
-      version,
-      // Installed and drivable are different questions, and conflating them is
-      // how a user ends up @mentioning something that silently never starts.
-      // THREE questions, in fact — see `drivableHere`: the CLI can be installed,
-      // and this module can know how to spawn it, and the worker this daemon is
-      // running can still be unable to drive it.
-      dispatchable: version !== null && drivableHere(rt),
-      blocked: rt.blocked ?? null,
-    };
-  });
-  return detectedCache;
-}
-
-/**
- * WHAT THE CLI SAID IT CAN BE ASKED FOR BY NAME — the machine's skills.
- *
- * Learned, never scanned. Claude Code's `system.init` event names its own
- * resolved skill set on every stream-json turn, and the daemon already parses
- * that stream (claude.mjs), so this costs nothing and is authoritative: it has
- * plugins, this repo's `.claude/skills`, and whatever project settings enabled
- * or disabled already folded in. A `~/.claude/skills` scan of our own would be
- * a second implementation of the CLI's resolution rules, and would drift.
- *
- * THE PRICE OF LEARNING RATHER THAN PROBING is that a machine which has not run
- * a turn yet knows nothing, and says nothing. That is the honest answer: the
- * app renders no menu rather than an empty one, and a slash typed into a tab
- * still reaches the CLI either way — the menu is an autocomplete, never a gate.
- * We do NOT probe for it: a `claude -p` run purely to populate a dropdown would
- * spend the operator's quota on a UI affordance.
- *
- * PER MACHINE, not per session. Every session worktree is a checkout of the one
- * repo this daemon serves, so project skills are identical across tabs and
- * personal skills are machine-wide. Last turn wins, which is what makes a skill
- * added mid-run show up on the next poll.
- */
-let skillsCache = null;
-
-/** Claude Code's own names: letters, digits, dash, underscore, and the colon a
- *  plugin skill wears (`plugin:skill`). Anything else is not a name we could
- *  put after a `/` anyway, so it is dropped rather than relayed as garbage. */
-const SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9_:-]{0,63}$/;
-
-/** Record what a turn's init event reported. Bounded and sorted so the poll's
- *  query param has a stable length and a stable order — an unstable order would
- *  make the server write a "change" on every single poll. */
-export function recordSkills(names) {
-  if (!Array.isArray(names)) return;
-  const clean = [...new Set(names.map((n) => String(n).trim()).filter((n) => SKILL_NAME.test(n)))]
-    .sort()
-    .slice(0, 100);
-  // An empty report is a FACT (a machine with no skills installed), so it is
-  // recorded as []. Never conflated with null, which stays "no turn has run".
-  skillsCache = clean;
-}
-
-/** What to send on the roster poll — null until a turn has taught us. */
-export function knownSkills() {
-  return skillsCache;
-}
-
-/**
- * WHICH MCP SERVERS AND CLAUDE.AI CONNECTORS THE CLI MOUNTED, AND HOW EACH
- * STANDS (2026-09-23, 0.97.0) — learned off the same `system.init` event the
- * skills are, so it costs nothing and cannot drift from what a turn reaches.
- *
- * MEASURED on Claude Code 2.1.281 (`claude -p hi --model haiku --output-format
- * stream-json --verbose`): the init event carries `mcp_servers: [{ name,
- * status, source }]` — statuses seen `connected`, `failed`, `needs-auth` and
- * `pending`; a claude.ai connector arrives named `claude.ai <Name>` with
- * `source: "claudeai"`, a server a turn mounts with `--mcp-config` with
- * `source: "dynamic"`. A connector that needs a one-time sign-in AT THIS BOX
- * reads `needs-auth` here long before a turn fails on it, and the app's
- * Machines page names it.
- *
- * `flowviant` IS EXCLUDED: it is the server THIS daemon mounts on every tab
- * turn, always present, and not something a person can act on. A status off
- * the closed list is relayed as `other` rather than dropped — the CLI said
- * something about the server, and silence would be the daemon deciding it did
- * not. Bounded (40 entries, names cut at 60) and sorted, the `recordSkills`
- * discipline: a stable param, so an unchanged report writes nothing.
- *
- * ONLY WHAT IS NOT CONNECTED LEAVES THE BOX (2026-09-23). The first cut
- * relayed every server, connected ones included — so the operator's whole set
- * of signed-in services (their mail, their brokerage, their calendar) rode the
- * poll to the server and into every teammate's read of the Machines page,
- * which renders only the servers that are NOT connected anyway. A connected
- * connector is good news and good news is not a line; it is also nobody
- * else's business. So `connected` is dropped HERE, before the cap, and what is
- * sent is exactly what the page can say something about.
- *
- * THREE STATES, the skills split: null = no turn has taught us (the param is
- * not sent), [] = nothing of the person's own needs anything (every server is
- * connected, or none is mounted), a list = the ones that do. Last turn wins,
- * so a connector somebody signs into leaves the list on the next turn's init,
- * and an all-connected turn sends `[]`, which clears a stale list server-side.
- */
-let mcpServersCache = null;
-
-export const MCP_STATUSES = new Set(['connected', 'failed', 'needs-auth', 'pending']);
-export const MAX_MCP_SERVERS = 40;
-export const MCP_NAME_MAX = 60;
-
-export function recordMcpServers(list) {
-  if (!Array.isArray(list)) return;
-  const seen = new Map();
-  for (const e of list) {
-    if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
-    const n = e.name.trim().slice(0, MCP_NAME_MAX).trim();
-    if (!n || n === 'flowviant' || seen.has(n)) continue;
-    if (e.status === 'connected') continue; // see the header: never relayed
-    seen.set(n, { n, s: MCP_STATUSES.has(e.status) ? e.status : 'other' });
-  }
-  mcpServersCache = [...seen.values()]
-    .sort((a, b) => (a.n < b.n ? -1 : a.n > b.n ? 1 : 0))
-    .slice(0, MAX_MCP_SERVERS);
-}
-
-/** What to send on the roster poll as `mcp` — null until a turn has taught us. */
-export function knownMcpServers() {
-  return mcpServersCache;
-}
-
-/**
- * LEARN WHAT `/` CAN OFFER, ON A MACHINE NO TURN HAS TAUGHT.
- *
- * WHY THIS EXISTS. `recordSkills` above is fed from the init event of a tab
- * turn — authoritative and free, but with a hole nobody priced: THE FIRST THING
- * ANYONE DOES IN A NEW TAB IS TYPE `/`, and that is by definition before that
- * machine has run a turn. The menu was guaranteed empty exactly where it is
- * first reached. Not a theoretical hole: checked against production on
- * 2026-08-25, `agent_tokens.skills` was NULL for EVERY machine credential that
- * has ever existed, because the only tab turns ever run predated the release
- * that reports. The feature had never worked for anyone, once.
- *
- * IT COSTS ONE SMALL REQUEST, AND THAT IS THE HONEST NUMBER. This file used to
- * forbid probing outright — "a `claude -p` run purely to populate a dropdown
- * would spend the operator's quota on an affordance" — and that rule was
- * written picturing a COMPLETED TURN. This is not one: Claude Code emits
- * `system.init`, carrying its own fully resolved skill set, within ~0.5s and
- * long before it finishes answering, so the child is killed the moment that
- * event is read. But the request HAS gone out by then — measured on 2.1.245 by
- * reading the transcript a killed probe left behind: 2 input tokens, 4 output,
- * ~6k cache-creation. Two zero-request routes were tried and both failed: an
- * empty prompt errors before init is emitted, and `--input-format stream-json`
- * emits nothing at all until a message arrives. So the cost is one cheap turn,
- * ONCE per daemon process, on the cheapest model, and only on a machine no turn
- * has taught. Do not let this grow into a per-tab or per-poll probe.
- *
- * `--model haiku` for that reason, and it is safe by this repo's own rule: a
- * name lives in AGENT_MODELS only once `claude --model <name>` is known to be
- * accepted on a real install. If it were ever refused the probe simply learns
- * nothing and the machine stays unmeasured — which is exactly today's state, so
- * the failure mode is the status quo rather than a regression.
- *
- * IT SCANS FOR THE INIT EVENT, never assuming it is line 1 — and that is not
- * defensive padding, it is measured. With `--model haiku` the CLI prints a
- * `system/status` line FIRST and init lands on line 2; with the default model
- * init is line 1. A first-line-only reader (the version this replaced) silently
- * learned nothing the moment a model flag was added.
- *
- * IT CLEANS UP AFTER ITSELF, and this is not optional. `claude -p` writes a
- * transcript to `~/.claude/projects/<munged-cwd>/<session-id>.jsonl` the moment
- * it starts, and `localSessions.mjs` reports the newest ENDED session per
- * directory to the Workbench as an ADOPTABLE row. Left behind, every daemon
- * start would put a phantom untitled session in the `+` menu offering to adopt
- * a conversation that never happened. The init event names its own session id,
- * so the file is ours by name and is removed by it.
- *
- * IT IS BEST-EFFORT IN EVERY DIRECTION. No claude, no PATH, a CLI that changed
- * its event shape, an unwritable home — all leave `skillsCache` exactly as it
- * was (null, "nobody looked"), which is the honest answer and the one the app
- * already renders correctly. Nothing here may throw, and nothing may block the
- * poll it is called from.
- */
-
-/** Long enough for a cold CLI start on a slow box, short enough that a hung
- *  child is not left holding a session for the life of the daemon. */
-const SKILL_PROBE_TIMEOUT_MS = 30_000;
-
-/** Init arrives within the first couple of events or not at all; this is the
- *  guard against parsing a whole turn's output looking for it. */
-const SKILL_PROBE_MAX_LINES = 20;
-
-let skillProbeStarted = false;
-
-/** Where Claude Code keeps a transcript for `cwd`: `/` and `.` both become `-`. */
-function transcriptCandidates(cwd, sessionId) {
-  const base = join(homedir(), '.claude', 'projects');
-  const out = [join(base, cwd.replace(/[/.]/g, '-'), `${sessionId}.jsonl`)];
-  // The munge is Claude Code's, not ours, so a version that changes it must not
-  // leave the file behind: fall back to finding our own session id by name.
-  try {
-    for (const d of readdirSync(base)) out.push(join(base, d, `${sessionId}.jsonl`));
-  } catch {
-    /* no project store — nothing was written either */
-  }
-  return out;
-}
-
-/**
- * Delete the transcript a headless `-p` turn left behind.
- *
- * EXPORTED because the skills probe is no longer the only thing that runs one:
- * resolving a project's dev command is a background Claude turn too, and every
- * such turn has the same footprint. `claude -p` writes
- * `~/.claude/projects/<munged-cwd>/<id>.jsonl` at startup, and
- * `localSessions.mjs` offers the newest ENDED session per directory as
- * ADOPTABLE — so anything we run for our own purposes would put a phantom
- * untitled session in somebody's `+` menu.
- */
-export function removeProbeTranscript(cwd, sessionId) {
-  if (!sessionId || !/^[A-Za-z0-9_-]{8,64}$/.test(sessionId)) return;
-  for (const f of transcriptCandidates(cwd, sessionId)) {
-    try {
-      if (existsSync(f)) {
-        rmSync(f, { force: true });
-        return;
-      }
-    } catch {
-      /* best-effort */
-    }
-  }
-}
-
-/**
- * One line of the probe's stdout → the init event's payload, or null for "not
- * it, keep reading".
- *
- * SEPARATE FROM THE SCAN LOOP so the thing that actually broke can be tested
- * without spawning a CLI. The first version of this probe read line 1 and
- * stopped, which was measured-correct with the default model and silently
- * WRONG with `--model haiku`: that path prints a `system/status` line first and
- * puts init on line 2, so the probe learned nothing and reported nothing, which
- * is indistinguishable from the bug it was written to fix.
- *
- * A line that is not JSON is not a failure — a CLI warning on stdout is a line
- * to skip, not a reason to abandon the probe.
- */
-export function parseInitLine(line) {
-  let ev;
-  try {
-    ev = JSON.parse(line);
-  } catch {
-    return null;
-  }
-  if (!ev || ev.type !== 'system' || ev.subtype !== 'init') return null;
-  return {
-    // An init event WITHOUT skills is still the init event: stop reading, but
-    // record nothing. Conflating the two would keep the probe scanning a whole
-    // turn's output on a CLI that does not report them.
-    skills: Array.isArray(ev.skills) ? ev.skills : null,
-    // The CLI's mounted MCP servers (0.97.0) — `recordMcpServers` normalises.
-    mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : null,
-    sessionId: typeof ev.session_id === 'string' ? ev.session_id : null,
-  };
-}
-
-/**
- * Kick off the one-shot probe. Returns immediately; the result lands in
- * `skillsCache` and rides the NEXT poll, so nothing waits on it.
- *
- * A no-op once a turn has taught us (`skillsCache !== null`) — a turn's init
- * event and this one say the same thing, and the turn is free.
- */
-export function probeSkillsOnce(cwd) {
-  if (skillProbeStarted || skillsCache !== null) return;
-  skillProbeStarted = true;
-  let child;
-  try {
-    // Claude Code specifically, not the `wiki` profile's runtime pick: `skills`
-    // is Claude Code's own field and the `/` tray only renders for claude tabs.
-    child = spawn(
-      RUNTIMES.claude.bin,
-      ['-p', 'x', '--model', 'haiku', '--output-format', 'stream-json', '--verbose'],
-      { cwd, stdio: ['ignore', 'pipe', 'ignore'] }
-    );
-  } catch {
-    return; // no claude on PATH — the machine simply stays unmeasured
-  }
-  let buf = '';
-  let lines = 0;
-  let settled = false;
-  const finish = (sessionId) => {
-    if (settled) return;
-    settled = true;
-    clearTimeout(timer);
-    try {
-      child.kill('SIGKILL');
-    } catch {
-      /* already gone */
-    }
-    // AFTER the kill, and on a delay: the transcript is the CHILD's file, so
-    // deleting it while the child still lives races a recreate.
-    if (sessionId) setTimeout(() => removeProbeTranscript(cwd, sessionId), 750).unref?.();
-  };
-  const timer = setTimeout(() => finish(null), SKILL_PROBE_TIMEOUT_MS);
-  timer.unref?.();
-  child.on('error', () => finish(null));
-  child.on('exit', () => finish(null));
-  // UTF-8 mode on the STREAM, not a per-chunk `.toString()` — a multi-byte
-  // character straddling a chunk boundary decodes to mojibake (or a stray
-  // replacement byte) when each chunk is decoded on its own; the stream's
-  // own decoder holds the partial sequence over to the next chunk instead.
-  child.stdout.setEncoding('utf8');
-  child.stdout.on('data', (d) => {
-    if (settled) return;
-    buf += d;
-    let nl;
-    while (!settled && (nl = buf.indexOf('\n')) >= 0) {
-      const line = buf.slice(0, nl);
-      buf = buf.slice(nl + 1);
-      if (!line.trim()) continue;
-      if (++lines > SKILL_PROBE_MAX_LINES) {
-        finish(null);
-        return;
-      }
-      const init = parseInitLine(line);
-      if (!init) continue;
-      if (init.skills) recordSkills(init.skills);
-      if (init.mcpServers) recordMcpServers(init.mcpServers);
-      finish(init.sessionId);
-      return;
-    }
-    // A single line this long is not an init event; stop buffering a whole
-    // turn's output into memory waiting for one.
-    if (!settled && buf.length > 1_000_000) finish(null);
-  });
-}