flowviant 0.114.1 → 0.115.0

package/README.md

@@ -147,6 +147,15 @@ Two knobs bound the blast radius, and both are worth setting on a shared box:
   its permission engine is machine-wide — which is surfaced in the app rather
   than papered over.
 
+Fenced turns — design, 3D-model, deck and research cards, the pre-review,
+the planner, intake, the wiki and the New task chat — read none of your Claude
+Code settings files: their permissions and hooks are Flowviant's posture
+alone, and of `~/.claude/settings.json` they keep only how Claude signs in
+(`apiKeyHelper`, `env` and the like) and your model defaults. Code agents and
+Terminal tabs still read yours, so your own allow rules and `defaultMode` add
+to `FLOWVIANT_SAFE=1`'s allowlist there. Codex's fenced turns run with
+`--ignore-user-config` the same way.
+
 The posture is reported on every poll and shown in the project's
 Settings → Machine section, so the team can see whether the box runs the
 guarded toolset or full permissions.

package/bin/lib/agentTaskKinds.mjs

@@ -33,9 +33,13 @@
  *    sentence a turn settles `nothing` with when the proof was not written;
  *  - `offRuntime(rt)`: the sentence when the chosen CLI cannot run the posture.
  */
-/** The mockup, 3D-model, presentation and write-up kinds run on Claude: the one
- *  CLI that declares their postures (`design`, `research`). */
-const CLAUDE_ONLY = 'mockup, 3D model, presentation and write-up cards run on Claude on this machine';
+/** The mockup, 3D-model and presentation kinds run under the `design` posture,
+ *  which Claude and — since 0.115.0 — Codex declare (2026-09-29, measured:
+ *  runtimeCodex.mjs `codexDesignFence`). */
+const DESIGN_CLIS = 'mockup, 3D model and presentation cards run on Claude or Codex on this machine';
+/** The write-up kind runs on Claude alone: Codex cannot fence the web it needs
+ *  apart from the whole-box reads its sandbox allows (same place). */
+const CLAUDE_ONLY = 'write-up cards run on Claude on this machine';
 /** The image kind runs on Codex: the one CLI that declares its posture, because
  *  the pictures come from Codex's own image tool on its own login. */
 const CODEX_ONLY = 'image cards run on Codex on this machine';
@@ -52,7 +56,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.html?$/i,
       missing: 'the turn ended without writing a mockup under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => DESIGN_CLIS,
   }),
   /**
    * THE 3D-MODEL KIND (0.105.0; one page since 0.107.0): a three.js page that
@@ -69,7 +73,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.html?$/i,
       missing: 'the turn ended without writing a 3D model page under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => DESIGN_CLIS,
   }),
   /**
    * THE IMAGE KIND (0.114.0): one or more raster pictures, generated by
@@ -97,7 +101,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.html?$/i,
       missing: 'the turn ended without writing a deck under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => DESIGN_CLIS,
   }),
   research: Object.freeze({
     posture: 'research',

package/bin/lib/artifacts.mjs

@@ -74,7 +74,7 @@
  * that cannot show an artifact must not have the CLI told it will.
  */
 
-import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync } from 'node:fs';
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { cutKeepingExtension } from './safeFileName.mjs';
@@ -138,6 +138,48 @@ export function ensureArtifactDir(placeDir) {
   return real(parent) === true && real(dir) === true;
 }
 
+/**
+ * A FENCED TURN'S OWN SCRATCH — `<place>/.flowviant/tmp`, beside the artifacts
+ * directory, under the `.flowviant/` git already ignores (0.115.0, 2026-09-29).
+ *
+ * MEASURED on codex-cli 0.156.1: under an artifacts-only profile `/tmp` is
+ * read-only, and a shell here-document needs a temp file (zsh writes it under
+ * `$TMPPREFIX`, bash and `mktemp` under `$TMPDIR`) — so `cat > page.html
+ * <<EOF` failed "can't create temp file for here document: read-only file
+ * system", left an empty page, and the turn stopped to ask why the artifacts
+ * directory was read-only. Codex's design fence grants this directory and
+ * points both variables at it (runtimeCodex.mjs `codexDesignFence`), so the
+ * shell works like a shell; nothing here is uploaded, committed or read back.
+ *
+ * Made EMPTY before each turn (a previous turn's scratch is nobody's), and
+ * only as a real directory under a real `.flowviant` — the artifacts
+ * directory's rule, for its reason: a fence grant on a path through a
+ * committed symlink is a write grant on its target. False creates nothing
+ * that matters, and the caller refuses the turn in words.
+ */
+export const FENCE_TMP_DIR = '.flowviant/tmp';
+export function ensureFenceScratch(placeDir) {
+  const parent = join(placeDir, '.flowviant');
+  const dir = join(placeDir, FENCE_TMP_DIR);
+  const kind = (p) => {
+    try {
+      const st = lstatSync(p);
+      return st.isDirectory() && !st.isSymbolicLink() ? 'dir' : 'other';
+    } catch (e) {
+      return e?.code === 'ENOENT' ? 'none' : 'other';
+    }
+  };
+  if (kind(parent) !== 'dir' || kind(dir) === 'other') return false;
+  try {
+    // A real directory (checked above): its contents go, never through a link.
+    if (kind(dir) === 'dir') rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dir);
+  } catch {
+    return false;
+  }
+  return kind(parent) === 'dir' && kind(dir) === 'dir';
+}
+
 export function artifactTypeFor(name) {
   const dot = String(name).lastIndexOf('.');
   if (dot <= 0) return null;

package/bin/lib/claudePersonal.mjs

@@ -0,0 +1,145 @@
+/**
+ * A FENCED CLAUDE TURN TAKES ITS PERMISSIONS AND HOOKS FROM FLOWVIANT ALONE
+ * (2026-09-29, the owner, asked whether an agent's fence should ignore the
+ * person's own permission settings: "yes, the agent's fence can ignore").
+ *
+ * A 3D-model agent under the design posture, whose whole shell is
+ * `Bash(ls:*)`, ran `google-chrome` and Playwright scripts. Every fenced lane
+ * read the person's `~/.claude/settings.json` — an agent turn through
+ * `--setting-sources user`, the pre-review, planner, intake, wiki and capture
+ * chat by naming no source at all, which ALSO reads the cwd's
+ * `.claude/settings*.json`, and the pre-review's cwd is the agent's own
+ * worktree. A settings file is a second author of the posture. MEASURED on
+ * Claude Code 2.1.284 — see claudePersonal.test.mjs for the probes and the
+ * offline check that pins them on the real CLI. In short: a personal
+ * `permissions.allow` rule admitted a command the list refused, a personal
+ * `defaultMode: "bypassPermissions"` turned the fenced turn into a bypass, and
+ * personal and worktree hooks fired; under `--setting-sources ''` none of them
+ * loaded, and the turn ran on the same login.
+ *
+ * AN EMPTY SOURCE LIST DROPS THE WHOLE USER SOURCE, not only its permissions:
+ * `~/.claude/CLAUDE.md`, personal skills and subagents went too (measured),
+ * and with the file go the plugins it enables. No flag keeps half of it — a
+ * flag setting's allow rules only add to the person's. On a fenced lane that
+ * is the right loss: the posture and the contract are Flowviant's, the base
+ * branch's instructions and skills arrive through the prompt and the reviewed
+ * plugin (`--plugin-dir` still loads, measured), and a personal plugin brings
+ * hooks of its own. Codex's fenced postures are hermetic the same way
+ * (`--ignore-user-config`, runtimeCodex.mjs).
+ *
+ * WHAT IS KEPT is what makes the CLI the person's CLI, never what it may do:
+ * how it signs in and reaches its provider, how a model the turn does not pin
+ * runs, and how long the person's own store is kept. An ALLOWLIST, so a key a
+ * later CLI adds — a sandbox auto-allow, a permission mode — never rides by
+ * default. It rides INSIDE the posture's own `--settings`, because the CLI
+ * reads one: given two, only the last one's hook fired (measured).
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { MACHINE_CREDENTIAL_ENV } from './machineEnv.mjs';
+import { WINDOW_ENV_REMOVED, withoutWindows } from './noWindowEnv.mjs';
+
+/** The flag pair that loads no settings file — user, project or local.
+ *  Managed (policy) settings and `--settings` still apply. */
+export const NO_SETTING_SOURCES = Object.freeze(['--setting-sources', '']);
+
+/**
+ * The personal settings a fenced turn keeps, by key.
+ *
+ *  · THE LOGIN — the helpers the CLI runs to authenticate and where it signs
+ *    in, and `env`, where a login routes (ANTHROPIC_BASE_URL,
+ *    CLAUDE_CODE_USE_BEDROCK, AWS_PROFILE). `env` gives the person's file no
+ *    more reach than the operator's shell, which every turn inherits already;
+ *    what a turn's environment promises is still removed from it
+ *    (`keptEnv`).
+ *  · HOW AN UNPINNED MODEL RUNS ("Machine default uses the CLI's own
+ *    setting"): per-model effort, thinking, the model map a provider needs.
+ *    `model` itself is not here: every Claude turn names `--model`, the
+ *    daemon's pin when the card has none (config.mjs), so the person's
+ *    default model never reached a daemon turn before either.
+ *  · THE PERSON'S OWN STORE: how long transcripts live and whether memory is
+ *    kept, so a fenced turn's start never prunes or writes on a default the
+ *    person turned off.
+ */
+export const PERSONAL_KEPT = Object.freeze([
+  'apiKeyHelper',
+  'proxyAuthHelper',
+  'awsAuthRefresh',
+  'awsCredentialExport',
+  'gcpAuthRefresh',
+  'forceLoginMethod',
+  'forceLoginOrgUUID',
+  'forceLoginGatewayUrl',
+  'env',
+  'modelOverrides',
+  'modelSettings',
+  'effortLevel',
+  'maxEffortLevel',
+  'alwaysThinkingEnabled',
+  'fallbackModel',
+  'cleanupPeriodDays',
+  'autoMemoryEnabled',
+]);
+
+/** What a turn nobody is sitting at has set or removed (noWindowEnv.mjs) and
+ *  the machine credential (machineEnv.mjs): never put back by a settings file. */
+const TURN_OWNED_ENV = new Set([
+  ...MACHINE_CREDENTIAL_ENV,
+  ...WINDOW_ENV_REMOVED,
+  ...Object.keys(withoutWindows({}, '/')),
+]);
+function keptEnv(env) {
+  if (!env || typeof env !== 'object' || Array.isArray(env)) return null;
+  const out = {};
+  for (const [k, v] of Object.entries(env)) if (typeof v === 'string' && !TURN_OWNED_ENV.has(k)) out[k] = v;
+  return Object.keys(out).length ? out : null;
+}
+
+/** Far past any real settings file; a bigger one is not read. */
+const SETTINGS_MAX_BYTES = 1024 * 1024;
+
+/**
+ * The person's user settings file — `$CLAUDE_CONFIG_DIR/settings.json`, else
+ * `~/.claude/settings.json`, where the CLI itself looks — reduced to
+ * PERSONAL_KEPT. `{}` when it is absent, unreadable or not a JSON object: the
+ * turn then runs on the CLI's stored login and defaults, and the fence is the
+ * same either way.
+ */
+export function personalClaudeSettings(env = process.env) {
+  const dir = env.CLAUDE_CONFIG_DIR || join(env.HOME || homedir(), '.claude');
+  const path = join(dir, 'settings.json');
+  let raw;
+  try {
+    if (statSync(path).size > SETTINGS_MAX_BYTES) return {};
+    raw = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return {};
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+  const out = {};
+  for (const key of PERSONAL_KEPT) {
+    if (!Object.hasOwn(raw, key) || raw[key] == null) continue;
+    if (key !== 'env') out[key] = raw[key];
+    else {
+      const kept = keptEnv(raw.env);
+      if (kept) out.env = kept;
+    }
+  }
+  return out;
+}
+
+/**
+ * `perm` with `kept` folded into its `--settings` — the posture's keys win, so
+ * a kept key a posture ever names is the fence's word. A posture with no
+ * `--settings` gets one before its lists (`--allowedTools` is variadic). With
+ * nothing kept, `perm` is returned as it was.
+ */
+export function withPersonalSettings(perm, kept) {
+  const personal = kept && typeof kept === 'object' && !Array.isArray(kept) ? kept : {};
+  if (!Object.keys(personal).length) return [...perm];
+  const at = perm.indexOf('--settings');
+  if (at < 0) return ['--settings', JSON.stringify(personal), ...perm];
+  const posture = JSON.parse(perm[at + 1]);
+  return [...perm.slice(0, at), '--settings', JSON.stringify({ ...personal, ...posture }), ...perm.slice(at + 2)];
+}