flowviant 0.114.0 → 0.114.2

package/bin/lib/prompts.mjs

@@ -20,7 +20,7 @@
 import { agentTaskKindOf } from './agentTaskKinds.mjs';
 // A card's type (0.106.0) likewise: the table holds the words, this file prints them.
 import { AGENT_TASK_TYPES, agentTaskTypeFor, agentTaskTypeOf } from './agentTaskTypes.mjs';
-import { ARTIFACT_CONTRACT_TAIL, SYSTEM_AGENT_DECK, SYSTEM_AGENT_IMAGE, SYSTEM_AGENT_MODEL } from './artifactContracts.mjs';
+import { ARTIFACT_CONTRACT_TAIL, LOOK_HEADLESS, SYSTEM_AGENT_DECK, SYSTEM_AGENT_IMAGE, SYSTEM_AGENT_MODEL } from './artifactContracts.mjs';
 import { isLibraryReference } from './knowledgeLibrary.mjs';
 import { readCardThread } from './cardThread.mjs';
 import { AGENT_FILE_LINE_MAX, AGENT_FILES_PER_MESSAGE_MAX, CARD_FILES_PER_TURN_MAX } from './agentFiles.mjs';
@@ -466,6 +466,23 @@ const kickoff = ({ message, askedByName, head, tail }) => {
  *   · Rule 9 is the `assumed` param on the staging verbs: a guess the chat did
  *     not ask about is SAID, one line under the staged row, never folded into
  *     the brief where it reads as something the person asked for.
+ *
+ * STAGE, THEN ASK — A QUESTION NEVER STANDS IN FOR A CARD (2026-09-29). The
+ * owner: "it ignored a subsequent ask … but it worked after i tried again."
+ * The follow-ups were not lost; rule 5 said "ask … then wait for the answer",
+ * so a new ask with one open detail came back as a question and no card, and
+ * to a person watching the Staged rail a reply that stages nothing reads as
+ * ignored. Re-sending the same words got a card only because the chat judged
+ * the question already asked. So the order flips: the best guess is STAGED
+ * first, said through `assumed` (the rail shows it under the row), and the
+ * one question follows in chips; the answer moves that row in place
+ * (`edit_staged` — restaging loses what the person typed into it). Rule 7's
+ * two-product case is the same order. Rule 11 says the chat stays open: a
+ * later message is a new ask, never an occasion to recite the staged batch.
+ * Rule 1 lost "what you need to know" as a reply in place of a card, and now
+ * says the final reply is always words — a turn that ends with none settles
+ * as failed on the tab. Rule 4 lost "what earlier chats left": list_staged
+ * holds this chat's own rows too, and its tool description says so.
  */
 export const SYSTEM_CAPTURE = `You are the human's chosen CLI, in their repository, with ONE job: turn what
 they say into well-cut task cards on their Flowviant board. You are READ-ONLY
@@ -480,21 +497,29 @@ with the matching name your CLI exposes.
 
 1. NARRATE WHILE YOU WORK. Call stream_session_turn with short progress lines
    as you read and stage. Your FINAL reply is delivered automatically when the
-   turn ends — do not repeat it through the tool. Keep replies short: what you
-   staged, or what you need to know — one line each.
+   turn ends — always end with it, in words, even when it only says what you
+   staged; do not also send it through the tool. Keep it short: what you
+   staged, what you guessed, and your one question if you have one — a line
+   each.
 2. STAGE, NEVER FILE. stage_card proposes a new card; stage_card_edit proposes
    a change to an existing one (read_card first — never replace fields you
-   have not seen). Everything you stage waits in an area the person reviews
-   and lands themselves; nothing you do reaches the board directly.
+   have not seen); edit_staged changes a row already staged, in place.
+   Everything you stage waits in an area the person reviews and lands
+   themselves; nothing you do reaches the board directly.
 3. ONE CARD PER SHIPPABLE UNIT. Break a big ask into the units that will build
    it, in landing order. Never card-ify chatter, questions, or one unit split
    thin.
 4. DEDUPE FIRST, EVERY TIME. Before staging, call list_cards (the OPEN QUEUE —
    capped, and cards agents already hold are absent from it) and list_staged
-   (what earlier chats left). If the work exists, say so and point at it;
-   stage_card_edit it if the ask adds something. Never stage a twin.
-5. ASK ONLY FOR WHAT SHAPES THE CARD. Before staging, ask when — and only
-   when — the answer changes the card itself:
+   (everything waiting to be landed — what you staged earlier in THIS chat
+   included). If the work exists, say so and point at it; when the ask adds
+   something to it, stage_card_edit a card or edit_staged a staged row.
+   Never stage a twin — and never take new work for old: an ask for
+   something different gets its own card (rule 11).
+5. STAGE FIRST, THEN ASK ONLY FOR WHAT SHAPES THE CARD. A question never
+   stands in for a card: a message that asks for work ends this turn with
+   that work staged. A question is worth asking when — and only when — the
+   answer changes the card itself:
    - its KIND — what it hands back — when the words could mean more than one
      product (rule 7);
    - its SCOPE — which pages, screens or parts, when the ask names a family
@@ -503,9 +528,15 @@ with the matching name your CLI exposes.
      acceptance criteria;
    - a CONSTRAINT the repository cannot answer — a vendor, a deadline, a
      browser to support, what must not change.
+   Even then, stage your best guess FIRST, the guessed part named in
+   \`assumed\` (rule 9); say in one line what you guessed; THEN ask your
+   question, as rule 8 says. When they answer, change that staged row in
+   place with edit_staged — only the fields the answer moves, and \`assumed\`
+   as "" once it is settled — never unstage_card and a fresh stage_card.
    Never ask what reading the repo answers: read it. One question per
-   message, asked as rule 8 says, then wait for the answer. A clear ask
-   stages without ceremony — no question for the sake of one.
+   message; any other guess stays said in \`assumed\`, where the person can
+   correct it on the row. A clear ask stages without ceremony — no question
+   for the sake of one.
 6. A GOOD CARD: a title naming the outcome, a brief a stranger could start
    from, acceptance criteria only when the person stated (or the code shows)
    what done means. No sizes, no owners, no statuses — none of those are
@@ -526,11 +557,13 @@ with the matching name your CLI exposes.
      "a deck", "a presentation", "a pitch".
    - "research": a write-up — read the repo and the web; no code changed.
      "Find out", "research", "compare", "how does X do it", "write up".
-   When the words fit two products, ASK before staging — rule 5 — in chips, one
-   option per product that fits, its description its consequence. "Redesign the
+   When the words fit two products, STAGE the likelier one, the guess named
+   in \`assumed\` ("assumed a code change, not a mockup first"), then ask —
+   rule 5 — in chips, one option per product that fits, its description its
+   consequence; the answer re-files the row with edit_staged. "Redesign the
    landing page" fits code and design; "make a chair for the scene" fits code
    (commit the asset) and model (a model to look at first). Never stage a
-   guessed kind.
+   guessed kind without saying it is a guess.
 8. HAND THEM THE CHOICES. A question with answers you can name ends your
    reply with a fenced block the sheet renders as options; picking one sends
    its label as their next message, so every label must read as an answer a
@@ -558,18 +591,23 @@ with the matching name your CLI exposes.
    above the block as well: a client that doesn't render the fence shows it
    as plain text, so the reply has to read as a question with its options
    either way.
-9. SAY WHAT YOU ASSUMED. When you stage a card on a GUESS you did not ask
-   about, pass \`assumed\` on stage_card (or stage_card_edit): one short
-   sentence naming the guess — "assumed the mobile layout too", "assumed
-   English only". It shows under the staged row, where the person can
-   correct it before the card lands. Never bury a guess in the brief, where
-   it reads as something they asked for, and never pass \`assumed\` for
-   something they said.
+9. SAY WHAT YOU ASSUMED. When you stage a card on a GUESS — the one your
+   question is about (rule 5), or one not worth a question —
+   pass \`assumed\` on stage_card (or stage_card_edit): one short sentence
+   naming the guess — "assumed the mobile layout too", "assumed English
+   only". It shows under the staged row, where the person can correct it
+   before the card lands. Never bury a guess in the brief, where it reads as
+   something they asked for, and never pass \`assumed\` for something they
+   said.
 10. REFERENCE WHAT THE PROJECT KEPT. When the ask names a kept mockup, 3D model,
    image, deck or write-up ("implement design A"), call list_library and pass its id as
    \`references\` on the card you stage, so the agent reads it. When the person's
    message includes attached library items, pass those ids as \`references\` on
-   the cards you stage from that message.`;
+   the cards you stage from that message.
+11. THE CHAT STAYS OPEN. Every message is a new ask, however many turns came
+   before it (an answer to your question moves its row instead — rule 5).
+   When they ask for more after a staged batch, stage the new cards; never
+   answer a new ask by restating what is already staged.`;
 
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
   kickoff({
@@ -1022,6 +1060,8 @@ WHAT TO DO:
    images are data: URIs or inline SVG. Several pages asked for in one card
    go in the ONE file (sections, or tabs you script). Keep it under 2 MB.
 
+   ${LOOK_HEADLESS}
+
 ${ARTIFACT_CONTRACT_TAIL({
   ask: `If you cannot draw it without a DECISION only a person can make — which of
    two directions, which page, what the content should say — STOP AND ASK. Do

package/bin/lib/resumeLost.mjs

@@ -32,6 +32,12 @@ const RESUME_LOST = [
   /session .{0,80}not found/i,
   /conversation .{0,80}not found/i,
   /thread .{0,80}not found/i,
+  // Codex 0.156's words for a pinned thread whose rollout file is gone
+  // (2026-09-29): "Error: thread/resume: thread/resume failed: no rollout
+  // found for thread id <id> (code -32600)" on stderr, exit 1, no event on
+  // stdout. Every agent thread filed under a deleted per-turn /tmp home says
+  // exactly this, and none of the phrases above matched it.
+  /no rollout found/i,
   /trajectory not found/i,
 ];
 /**
@@ -72,9 +78,23 @@ export const resumeConversationLost = (text, { runtime, sawInit } = {}) => {
  * is gone. `sawInit` is whether THIS spawn's CLI emitted `system.init` (only
  * Claude's does, and only Claude's is read). A fresh turn is never retried:
  * `resume` false answers false whatever the text says.
+ *
+ * …AND AN EMPTY CLAUDE RESUME THAT FOUND ITS CONVERSATION IS AN EMPTY ANSWER,
+ * NOT A LOST CONVERSATION (2026-09-29). Empty used to retry fresh whatever the
+ * evidence, so a Claude that emitted init — the conversation WAS there — and
+ * then said nothing had the message answered again by a Claude with no memory
+ * of the chat, and that fresh conversation's id re-pinned the tab: the
+ * follow-up read as if the chat had never happened, and so did every one
+ * after it. With init seen, the empty answer stands and settles as what it
+ * is, the conversation kept for the next message. Unmeasured init (`sawInit`
+ * not true) and the other CLIs keep the old reading: empty is the only sign
+ * they give of a conversation that is gone.
  */
-export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) =>
-  Boolean(resume) && (!String(out || '').trim() || resumeConversationLost(out, { runtime, sawInit }));
+export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) => {
+  if (!resume) return false;
+  if (!String(out || '').trim()) return !(runtime === 'claude' && sawInit === true);
+  return resumeConversationLost(out, { runtime, sawInit });
+};
 
 /**
  * ONE SPAWN, AND AT MOST ONE FRESH RETRY — the agent lane's whole sequence,

package/bin/lib/runTurn.mjs

@@ -13,6 +13,7 @@
 import { spawn } from 'node:child_process';
 import { runtimeById } from './runtimes.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
+import { openBrowserHome, withoutWindows } from './noWindowEnv.mjs';
 import { resolveTurnProfile } from './turnProfile.mjs';
 import { claudePermFor } from './claudePosture.mjs';
 import { handleStreamLine } from './claudeStream.mjs';
@@ -38,9 +39,18 @@ const CODEX_MODEL_READ_MS = 1_500;
  * the MCP config file. So those two names, and only those, are removed —
  * by the one rule in machineEnv.mjs, which the project check obeys too.
  */
-export function cliEnv(mcpEnv) {
+/**
+ * …AND, UNLESS A PERSON IS AT THE KEYBOARD, NO WAY TO A WINDOW (2026-09-29).
+ * `display: true` is the Terminal tab's alone: a person typing there may ask
+ * for a window and gets their own environment. Every other turn — an agent's,
+ * its pre-review, the planner, the wiki, intake, the capture chat, and any
+ * lane added later that does not say otherwise — runs under
+ * `withoutWindows` (noWindowEnv.mjs), its browsers in `browserHome`.
+ */
+export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
   // After the merge, so an mcpEnv can never smuggle one back in.
-  return withoutMachineCredentials({ ...process.env, ...(mcpEnv ?? {}) });
+  const env = withoutMachineCredentials({ ...process.env, ...(mcpEnv ?? {}) });
+  return display === true ? env : withoutWindows(env, browserHome);
 }
 
 // One Claude Code turn. Output is captured (for sentinel detection) and streamed
@@ -53,7 +63,7 @@ export function cliEnv(mcpEnv) {
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
 export function runTurn(opts) {
-  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId } = opts;
+  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
   /**
    * AFTER THE TEARDOWN, NO TURN STARTS AND NO TURN ENDS (standDownGate.mjs).
    * A stand-down that drains a deploy keeps this process alive; without this
@@ -195,6 +205,11 @@ export function runTurn(opts) {
     // Which credential is correct, and whether an account may be shared, is
     // between the operator and the vendor. Flowviant does not detect it and does
     // not enforce it; it runs the CLI the ordinary way and relays what happens.
+    //
+    // A turn nobody is sitting at keeps its browsers in a home of its own —
+    // the lane's kept one (an agent's), else this spawn's, removed when the
+    // CLI closes. See `cliEnv`.
+    const browser = display === true ? null : openBrowserHome(browserHome);
     const child = spawn(rt.bin, args, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -219,10 +234,15 @@ export function runTurn(opts) {
       detached: true,
       // Only ADDS to the environment (the worker token, for runtimes that read
       // it from there). Never replaces it: the CLI's own credentials live in
-      // this environment, and handing it a curated one signs it out. The one
-      // thing it REMOVES is this daemon's machine credential — see `cliEnv`.
-      env: cliEnv(mcpEnv),
+      // this environment, and handing it a curated one signs it out. What it
+      // REMOVES is this daemon's machine credential and, for a turn nobody is
+      // sitting at, every way to a window — see `cliEnv`.
+      env: cliEnv(mcpEnv, { display: display === true, browserHome: browser?.dir }),
     });
+    if (browser) {
+      child.once('close', browser.cleanup);
+      child.once('error', browser.cleanup);
+    }
     onSpawn?.(child);
     // When this turn began, for the Codex rollout read: a `turn_context` older
     // than this is a previous turn's (turnModel.mjs).

package/bin/lib/runtimeClaude.mjs

@@ -14,6 +14,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
+import { NO_SETTING_SOURCES, personalClaudeSettings, withPersonalSettings } from './claudePersonal.mjs';
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -72,7 +73,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools }) {
+  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools, personalSettings }) {
     const a = [];
     // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
     // are mutually exclusive, never combined.
@@ -99,11 +100,38 @@ export const CLAUDE_RUNTIME = {
     else if (resumeThreadId) a.push('--resume', resumeThreadId);
     else if (resume) a.push('--continue');
     a.push('-p', prompt, '--append-system-prompt', system);
+    /**
+     * WHOSE SETTINGS A TURN READS (2026-09-29, claudePersonal.mjs).
+     *
+     * EVERY FENCED POSTURE READS NONE — every profile but `build`: an agent's
+     * design and research cards, the pre-review, the planner, intake, the
+     * wiki and the capture chat. Its permissions and hooks are its posture's
+     * alone; of the person's file it keeps only the login and the model
+     * defaults, folded into the posture's `--settings`. Keyed on `build`
+     * rather than on a list of fenced names, so a posture added later is
+     * fenced unless it is the build.
+     *
+     * THE BUILD POSTURE KEEPS THE PERSON'S OWN, on a code agent and on a
+     * Terminal tab alike. `--dangerously-skip-permissions` already admits
+     * everything, so no personal rule can widen it; what a personal file adds
+     * there is the operator narrowing their own box (a deny rule held a
+     * bypass turn, measured) and their own CLAUDE.md, skills and subagents,
+     * which an empty source list would take away with no flag to keep them.
+     * Codex's build is not hermetic either, for the same reason
+     * (runtimeCodex.mjs). STATED, not closed: under FLOWVIANT_SAFE=1 the
+     * build is a curated list, and the operator's own allow rules or
+     * `defaultMode` can still widen it — two choices of the same operator on
+     * their own box, and a personal allow is the only way a SAFE build runs a
+     * tool its list does not name (`pnpm`, `cargo`, `make`). A code agent names `user` so the agent-editable
+     * worktree's settings and hooks never load; a Terminal tab names nothing
+     * and is the person's Claude Code, project files included. A resumed
+     * agent renders the CURRENT base snapshot, not the first turn's cache.
+     */
+    const fenced = profile !== 'build';
+    if (fenced) a.push(...NO_SETTING_SOURCES);
+    else if (agentTools) a.push('--setting-sources', 'user');
     if (agentTools) {
-      // Keep personal settings, but never load the agent-editable project's
-      // settings, hooks, skills or CLAUDE.md discovery. A resumed agent must
-      // render the CURRENT base snapshot, not the first turn's prompt cache.
-      a.push('--setting-sources', 'user', '--system-prompt-snapshot', 'off');
+      a.push('--system-prompt-snapshot', 'off');
       if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     }
     // These fenced postures have no project MCP, even if Claude discovers a
@@ -119,7 +147,9 @@ export const CLAUDE_RUNTIME = {
     // does not refuse the path the prompt just handed it. Before `perm`,
     // because `--allowedTools` is variadic and would swallow the flag.
     if (knowledgeDir) a.push('--add-dir', knowledgeDir);
-    a.push(...perm);
+    // `personalSettings` is the caller's copy when it has one (a test); a
+    // turn reads the person's file here, at spawn, as the CLI would.
+    a.push(...(fenced ? withPersonalSettings(perm, personalSettings ?? personalClaudeSettings()) : perm));
     return a;
   },
   parse: null, // claudeStream.mjs owns its own stream parser (unchanged)

package/bin/lib/runtimeCodex.mjs

@@ -243,9 +243,10 @@ export const CODEX_RUNTIME = {
       // one under `$CODEX_HOME/generated_images/…` and says the path (the
       // binary's own words: "Generated images are saved to … by default. If
       // you need to use a generated image at another path, copy it"). An agent
-      // turn's CODEX_HOME is its isolated per-turn home (projectToolRuntimes);
-      // `:root` reads admit it, so the agent copies what it keeps into the one
-      // writable directory, where the artifact scan finds it.
+      // turn's CODEX_HOME is the agent's own isolated home (projectToolRuntimes,
+      // kept per agent since 2026-09-29); `:root` reads admit it, so the agent
+      // copies what it keeps into the one writable directory, where the
+      // artifact scan finds it.
       //
       // IMAGE GENERATION IS SWITCHED ON HERE AND ONLY HERE — a decision. This
       // is the one turn whose card asks for pictures, so it must not depend

package/bin/lib/startProject.mjs

@@ -33,7 +33,7 @@ async function reexecAfterLogin() {
 
 // TWO ROWS THAT READ ALIKE ARE NOT A CHOICE. `projectRowLabel` adds the id and
 // the connected date to the COLLIDING rows only — production held two projects
-// both called "BRIF AI", both bound to the same checkout, so this picker
+// with one name, both bound to the same checkout, so this picker
 // offered two identical lines and the only way to answer was to guess. See
 // credentials.mjs for why the suffix is not on every row. (That exact case is
 // a refusal now rather than a picker — a directory serves one project — but
@@ -62,7 +62,7 @@ export async function resolveStartProject({ dirGiven }) {
   // binds it, and a headless start with no unambiguous answer refuses in words
   // that name every stored project and every way out. The one thing this block
   // must never do is serve a project the resolution did not name — "it said
-  // skadooble in my calendar repo" is the confusion this exists to end.
+  // contoso in my calendar repo" is the confusion this exists to end.
   // A RESTART IS NOT A PERSON. `reexec` (update.mjs) inherits stdio, so an
   // auto-updated daemon's child sees two TTYs; without this it would stop on the
   // binding confirm below and the machine would stay dark until somebody typed a
@@ -122,7 +122,7 @@ export async function resolveStartProject({ dirGiven }) {
 
       const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (${terminalCommand('login')})`;
       // WHICH ONE LOOKS RIGHT — a pre-selection, never an auto-serve. The resolver
-      // refuses to serve a project the repo PATH did not name (the skadooble law);
+      // refuses to serve a project the repo PATH did not name (the contoso law);
       // this only decides which row the cursor starts on, using the repo's folder
       // name and its github repo-name against the stored project names. A unique
       // match becomes ONE keypress; a wrong guess costs nothing, because the human
@@ -136,7 +136,7 @@ export async function resolveStartProject({ dirGiven }) {
 
       // Bounded like the confirm below, and for the same reason — but silence
       // means something DIFFERENT here and the difference is load-bearing. There
-      // is a real ambiguity to resolve; serving a guess is the skadooble bug.
+      // is a real ambiguity to resolve; serving a guess is the contoso bug.
       // So no answer REFUSES, which is exactly what this branch already does
       // headless, and the message says how to answer without being present.
       let chosen = null; // 0-based into [...choices, login]
@@ -220,7 +220,7 @@ export async function resolveStartProject({ dirGiven }) {
   } else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
     // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
     // yes binds and every later start is silent. This is the exact question
-    // whose absence had a calendar checkout serving skadooble.
+    // whose absence had a calendar checkout serving contoso.
     //
     // AND IT TIMES OUT, because a prompt on a start path is a way for a machine
     // to go dark. `FLOWVIANT_REEXEC` above covers the restart THIS version
@@ -240,7 +240,7 @@ export async function resolveStartProject({ dirGiven }) {
     //    not, which is the whole reason this product has exactly one refusal.
     //  · DO NOT BIND, because binding is the thing the question was FOR. Nobody
     //    answered, so nothing is cemented; the next human start asks again. That
-    //    keeps the skadooble case fixed for the person who is actually looking,
+    //    keeps the contoso case fixed for the person who is actually looking,
     //    which is the only person it could ever have been fixed for.
     const creds = await import('./credentials.mjs');
     const label = creds.projectLabel(CREDENTIAL.entry);

package/bin/lib/work.mjs

@@ -330,6 +330,8 @@ export function createWorkManager({
     postBestEffort,
     workChildren,
     groupKillChildren,
+    // Only to find the agent's browser profile (noWindowEnv.mjs).
+    sessionMetaPath,
   });
   const { runPrecheck } = createWorkAgentPrecheck({
     baseRef,

package/bin/lib/workAgentCheck.mjs

@@ -17,6 +17,7 @@ import { warn } from './ui.mjs';
 import { ARTIFACT_DIR, artifactTypeFor } from './artifacts.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
+import { agentBrowserHome, openBrowserHome, withoutWindows } from './noWindowEnv.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 import { workLanesStopped } from './standDownGate.mjs';
 
@@ -85,11 +86,14 @@ export function clearNonArtifacts(wt) {
  * authenticates with; everything else is what the agent's own turn saw when it
  * ran the same tests.
  */
-export function checkEnv(env = process.env) {
-  return withoutMachineCredentials(env);
+export function checkEnv(env = process.env, browserHome = null) {
+  // …and, like that turn since 2026-09-29, no way to a window: a test run
+  // nobody is watching that opens a headed browser or an HTML report opens it
+  // on nobody's behalf (noWindowEnv.mjs). The agent's own browser profile.
+  return withoutWindows(withoutMachineCredentials(env), browserHome);
 }
 
-export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, groupKillChildren }) {
+export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, groupKillChildren, sessionMetaPath }) {
   const AGENT_CHECK_DONE_URL = fleetEndpoint('agent-check-done', FLEET_URL);
 
   // ── THE PROJECT'S OWN CHECK, and the MERGE ─────────────────────────────────
@@ -142,6 +146,7 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
       warn(
         `agent ${agentId}: removed ${cleared.length} non-artifact file(s) from ${ARTIFACT_DIR} before the check — ${cleared.slice(0, 5).join(', ')}`
       );
+    const browser = openBrowserHome(agentBrowserHome(sessionMetaPath, wt, agentId));
     const out = await new Promise((resolve) => {
       let text = '';
       let done = false;
@@ -178,7 +183,7 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
           shell: true,
           detached: true,
           stdio: ['ignore', 'pipe', 'pipe'],
-          env: checkEnv(),
+          env: checkEnv(process.env, browser.dir),
         });
         /**
          * …AND IT IS TRACKED, so a stop or a takeover takes it with them.
@@ -266,6 +271,7 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
         finish(code === 0 ? 'passed' : 'failed');
       });
     });
+    browser.cleanup();
     await postCheck({
       agentId,
       status: out.status,

package/bin/lib/workAgentPrecheck.mjs

@@ -20,6 +20,7 @@ import { removeProbeTranscript } from './runtimeCapabilities.mjs';
 import { taskIdsFromMessage } from './worktreeDiff.mjs';
 import { limitLine } from './cliLimit.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workChildren }) {
   const AGENT_PRECHECK_URL = fleetEndpoint('agent-precheck', FLEET_URL);
@@ -257,6 +258,9 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
         profile: 'consult',
         cwd: wt,
         runtime: rt,
+        // The agent's own browser profile, in the worktree this reader stands
+        // in; no display either way (noWindowEnv.mjs, 2026-09-29).
+        browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
         // NO `resume`, AND THAT IS THE FEATURE. A resumed turn would be the
         // agent grading its own homework out of its own context; this is a
         // stranger reading a diff.

package/bin/lib/workAgentTurnExecution.mjs

@@ -38,6 +38,7 @@ import { brainFor } from './workBrain.mjs';
 import { begunTurnRefusal } from './workAgentTurnBegun.mjs';
 import { agentTurnSettlement } from './workAgentTurnOutcome.mjs';
 import { ensureArtifactDir } from './artifacts.mjs';
+import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createAgentTurnExecution({
   baseRef,
@@ -286,6 +287,23 @@ export function createAgentTurnExecution({
       rt === 'codex'
         ? Boolean(codexResumeId)
         : rt === 'claude' && Boolean(ranMarker && existsSync(ranMarker));
+    /**
+     * …AND THE HOME THAT THREAD IS FILED UNDER, KEPT PER AGENT (2026-09-29).
+     *
+     * Codex's thread index records each rollout under the CODEX_HOME the turn
+     * ran with, as that path — not the personal store the link leads to — so
+     * the per-turn home in /tmp every turn used to get died with its turn and
+     * took the pinned thread with it: the next card's `resume` failed "no
+     * rollout found" and the agent went to Stuck. Beside the thread marker,
+     * in the worktree's private git dir: outside the working tree (never
+     * committed, never seen by `git add -A`), refreshed by every turn and
+     * removed only with the worktree, when the agent retires and its threads
+     * stop mattering. One agent runs one turn at a time (its place's writer
+     * lock), so no two turns refresh it at once. Null (no git dir to hold it)
+     * is the per-turn home again, and a lost resume then runs once fresh.
+     */
+    const codexAgentHome =
+      rt === 'codex' ? sessionMetaPath(wt, 'flowviant-agent-codex-home', agentId) : null;
 
     /**
      * THE TURN'S FILES, ON DISK BEFORE THE PROMPT NAMES THEM (0.112.0) — the
@@ -376,6 +394,15 @@ export function createAgentTurnExecution({
 
     let out = '';
     let child = null;
+    /**
+     * EVERY CHILD THIS TURN SPAWNED, not only the last (2026-09-29). A lost
+     * resume runs once more fresh (runTurnResumingOnce), so a turn can own two
+     * CLIs, and `child` names only the second: the first stayed in
+     * `workChildren` for the life of the daemon — one phantom live turn per
+     * retry, held against the machine's ceiling, and `workBusy()` true for
+     * ever, which holds the self-update and the tray's install for ever.
+     */
+    const spawnedChildren = new Set();
     /**
      * WHAT THIS TURN SPENT, AS THE CLI COUNTED IT (2026-09-19).
      *
@@ -409,7 +436,7 @@ export function createAgentTurnExecution({
     try {
       // A turn reads the base ref afresh. Changes the agent has made to its
       // own worktree cannot silently change the next turn's tools.
-      projectTools = prepareAgentTools(readBaseTools(repoRoot, baseRef()), rt, process.env, wt);
+      projectTools = prepareAgentTools(readBaseTools(repoRoot, baseRef()), rt, process.env, wt, { codexHome: codexAgentHome });
       const agentTurnArgs = {
         prompt:
           job.kind === 'task' && job.task
@@ -450,6 +477,11 @@ export function createAgentTurnExecution({
         }) + (projectTools.instructions ? `\n\n${projectTools.instructions}` : ''),
         agentTools: projectTools,
         ...(projectTools.codexHome ? { mcpEnv: { CODEX_HOME: projectTools.codexHome } } : {}),
+        // NOBODY IS AT THIS SCREEN (2026-09-29): no display, BROWSER=none, and
+        // a browser profile of the agent's own, kept beside its Codex home —
+        // so a Chrome it starts to look at its page never reaches the
+        // person's (noWindowEnv.mjs).
+        browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
         ...(posture === 'build' && rt === 'claude'
           ? { mcpArgs: ['--strict-mcp-config', '--mcp-config', projectTools.mcpPath] }
           : posture === 'build' && rt === 'codex'
@@ -531,6 +563,7 @@ export function createAgentTurnExecution({
         },
         onSpawn: (ch) => {
           child = ch;
+          spawnedChildren.add(ch);
           // The AGENT it serves — what the machine snapshot charges this
           // child's memory to.
           workChildren.set(ch, agentId);
@@ -585,7 +618,7 @@ export function createAgentTurnExecution({
        */
       trace.stop();
       await trace.flush(TRACE_FINAL_FLUSH_MS);
-      if (child) workChildren.delete(child);
+      for (const ch of spawnedChildren) workChildren.delete(ch);
       if (agentChildren.get(place) === child) agentChildren.delete(place);
       if (ranMarker && rt === 'claude') {
         try {