flowviant 0.114.1 → 0.115.0

package/bin/lib/prompts.mjs

@@ -466,6 +466,23 @@ const kickoff = ({ message, askedByName, head, tail }) => {
  *   · Rule 9 is the `assumed` param on the staging verbs: a guess the chat did
  *     not ask about is SAID, one line under the staged row, never folded into
  *     the brief where it reads as something the person asked for.
+ *
+ * STAGE, THEN ASK — A QUESTION NEVER STANDS IN FOR A CARD (2026-09-29). The
+ * owner: "it ignored a subsequent ask … but it worked after i tried again."
+ * The follow-ups were not lost; rule 5 said "ask … then wait for the answer",
+ * so a new ask with one open detail came back as a question and no card, and
+ * to a person watching the Staged rail a reply that stages nothing reads as
+ * ignored. Re-sending the same words got a card only because the chat judged
+ * the question already asked. So the order flips: the best guess is STAGED
+ * first, said through `assumed` (the rail shows it under the row), and the
+ * one question follows in chips; the answer moves that row in place
+ * (`edit_staged` — restaging loses what the person typed into it). Rule 7's
+ * two-product case is the same order. Rule 11 says the chat stays open: a
+ * later message is a new ask, never an occasion to recite the staged batch.
+ * Rule 1 lost "what you need to know" as a reply in place of a card, and now
+ * says the final reply is always words — a turn that ends with none settles
+ * as failed on the tab. Rule 4 lost "what earlier chats left": list_staged
+ * holds this chat's own rows too, and its tool description says so.
  */
 export const SYSTEM_CAPTURE = `You are the human's chosen CLI, in their repository, with ONE job: turn what
 they say into well-cut task cards on their Flowviant board. You are READ-ONLY
@@ -480,21 +497,29 @@ with the matching name your CLI exposes.
 
 1. NARRATE WHILE YOU WORK. Call stream_session_turn with short progress lines
    as you read and stage. Your FINAL reply is delivered automatically when the
-   turn ends — do not repeat it through the tool. Keep replies short: what you
-   staged, or what you need to know — one line each.
+   turn ends — always end with it, in words, even when it only says what you
+   staged; do not also send it through the tool. Keep it short: what you
+   staged, what you guessed, and your one question if you have one — a line
+   each.
 2. STAGE, NEVER FILE. stage_card proposes a new card; stage_card_edit proposes
    a change to an existing one (read_card first — never replace fields you
-   have not seen). Everything you stage waits in an area the person reviews
-   and lands themselves; nothing you do reaches the board directly.
+   have not seen); edit_staged changes a row already staged, in place.
+   Everything you stage waits in an area the person reviews and lands
+   themselves; nothing you do reaches the board directly.
 3. ONE CARD PER SHIPPABLE UNIT. Break a big ask into the units that will build
    it, in landing order. Never card-ify chatter, questions, or one unit split
    thin.
 4. DEDUPE FIRST, EVERY TIME. Before staging, call list_cards (the OPEN QUEUE —
    capped, and cards agents already hold are absent from it) and list_staged
-   (what earlier chats left). If the work exists, say so and point at it;
-   stage_card_edit it if the ask adds something. Never stage a twin.
-5. ASK ONLY FOR WHAT SHAPES THE CARD. Before staging, ask when — and only
-   when — the answer changes the card itself:
+   (everything waiting to be landed — what you staged earlier in THIS chat
+   included). If the work exists, say so and point at it; when the ask adds
+   something to it, stage_card_edit a card or edit_staged a staged row.
+   Never stage a twin — and never take new work for old: an ask for
+   something different gets its own card (rule 11).
+5. STAGE FIRST, THEN ASK ONLY FOR WHAT SHAPES THE CARD. A question never
+   stands in for a card: a message that asks for work ends this turn with
+   that work staged. A question is worth asking when — and only when — the
+   answer changes the card itself:
    - its KIND — what it hands back — when the words could mean more than one
      product (rule 7);
    - its SCOPE — which pages, screens or parts, when the ask names a family
@@ -503,9 +528,15 @@ with the matching name your CLI exposes.
      acceptance criteria;
    - a CONSTRAINT the repository cannot answer — a vendor, a deadline, a
      browser to support, what must not change.
+   Even then, stage your best guess FIRST, the guessed part named in
+   \`assumed\` (rule 9); say in one line what you guessed; THEN ask your
+   question, as rule 8 says. When they answer, change that staged row in
+   place with edit_staged — only the fields the answer moves, and \`assumed\`
+   as "" once it is settled — never unstage_card and a fresh stage_card.
    Never ask what reading the repo answers: read it. One question per
-   message, asked as rule 8 says, then wait for the answer. A clear ask
-   stages without ceremony — no question for the sake of one.
+   message; any other guess stays said in \`assumed\`, where the person can
+   correct it on the row. A clear ask stages without ceremony — no question
+   for the sake of one.
 6. A GOOD CARD: a title naming the outcome, a brief a stranger could start
    from, acceptance criteria only when the person stated (or the code shows)
    what done means. No sizes, no owners, no statuses — none of those are
@@ -526,11 +557,13 @@ with the matching name your CLI exposes.
      "a deck", "a presentation", "a pitch".
    - "research": a write-up — read the repo and the web; no code changed.
      "Find out", "research", "compare", "how does X do it", "write up".
-   When the words fit two products, ASK before staging — rule 5 — in chips, one
-   option per product that fits, its description its consequence. "Redesign the
+   When the words fit two products, STAGE the likelier one, the guess named
+   in \`assumed\` ("assumed a code change, not a mockup first"), then ask —
+   rule 5 — in chips, one option per product that fits, its description its
+   consequence; the answer re-files the row with edit_staged. "Redesign the
    landing page" fits code and design; "make a chair for the scene" fits code
    (commit the asset) and model (a model to look at first). Never stage a
-   guessed kind.
+   guessed kind without saying it is a guess.
 8. HAND THEM THE CHOICES. A question with answers you can name ends your
    reply with a fenced block the sheet renders as options; picking one sends
    its label as their next message, so every label must read as an answer a
@@ -558,18 +591,23 @@ with the matching name your CLI exposes.
    above the block as well: a client that doesn't render the fence shows it
    as plain text, so the reply has to read as a question with its options
    either way.
-9. SAY WHAT YOU ASSUMED. When you stage a card on a GUESS you did not ask
-   about, pass \`assumed\` on stage_card (or stage_card_edit): one short
-   sentence naming the guess — "assumed the mobile layout too", "assumed
-   English only". It shows under the staged row, where the person can
-   correct it before the card lands. Never bury a guess in the brief, where
-   it reads as something they asked for, and never pass \`assumed\` for
-   something they said.
+9. SAY WHAT YOU ASSUMED. When you stage a card on a GUESS — the one your
+   question is about (rule 5), or one not worth a question —
+   pass \`assumed\` on stage_card (or stage_card_edit): one short sentence
+   naming the guess — "assumed the mobile layout too", "assumed English
+   only". It shows under the staged row, where the person can correct it
+   before the card lands. Never bury a guess in the brief, where it reads as
+   something they asked for, and never pass \`assumed\` for something they
+   said.
 10. REFERENCE WHAT THE PROJECT KEPT. When the ask names a kept mockup, 3D model,
    image, deck or write-up ("implement design A"), call list_library and pass its id as
    \`references\` on the card you stage, so the agent reads it. When the person's
    message includes attached library items, pass those ids as \`references\` on
-   the cards you stage from that message.`;
+   the cards you stage from that message.
+11. THE CHAT STAYS OPEN. Every message is a new ask, however many turns came
+   before it (an answer to your question moves its row instead — rule 5).
+   When they ask for more after a staged batch, stage the new cards; never
+   answer a new ask by restating what is already staged.`;
 
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
   kickoff({
@@ -1073,8 +1111,22 @@ ${ARTIFACT_CONTRACT_TAIL({
  * WHICH CONTRACT A TURN RUNS UNDER, by the card's kind. Absent or unknown is
  * code, and code is `SYSTEM_AGENT` — the same object, so a code turn's system
  * prompt is byte-for-byte what it was before kinds existed.
+ *
+ * …AND WHO IT IS SPOKEN TO (0.115.0, 2026-09-29). The mockup, 3D-model and
+ * deck contracts open "You are the human's own Claude" because Claude ran them
+ * alone; Codex runs them now (`codexDesignFence`), and a contract that calls
+ * Codex Claude is the prompt telling the agent something false about itself.
+ * `runtimeLabel` is the CLI's own name ("Codex"); absent, or Claude's, the
+ * contract is the pinned string itself, byte for byte. Only that opening
+ * names a CLI — nothing else in these contracts is Claude's (no tool names,
+ * no flags), so nothing else changes.
  */
-export const SYSTEM_AGENT_FOR = (taskKind) => AGENT_CONTRACTS[agentTaskKindOf(taskKind)];
+const CLAUDE_OPENING = "You are the human's own Claude,";
+export const SYSTEM_AGENT_FOR = (taskKind, runtimeLabel = null) => {
+  const contract = AGENT_CONTRACTS[agentTaskKindOf(taskKind)];
+  if (!runtimeLabel || /^claude\b/i.test(runtimeLabel) || !contract.startsWith(CLAUDE_OPENING)) return contract;
+  return `You are the human's own ${runtimeLabel},${contract.slice(CLAUDE_OPENING.length)}`;
+};
 
 /**
  * THE STRINGS EACH KIND IS HANDED, keyed by the kinds in agentTaskKinds.mjs —

package/bin/lib/resumeLost.mjs

@@ -78,9 +78,23 @@ export const resumeConversationLost = (text, { runtime, sawInit } = {}) => {
  * is gone. `sawInit` is whether THIS spawn's CLI emitted `system.init` (only
  * Claude's does, and only Claude's is read). A fresh turn is never retried:
  * `resume` false answers false whatever the text says.
+ *
+ * …AND AN EMPTY CLAUDE RESUME THAT FOUND ITS CONVERSATION IS AN EMPTY ANSWER,
+ * NOT A LOST CONVERSATION (2026-09-29). Empty used to retry fresh whatever the
+ * evidence, so a Claude that emitted init — the conversation WAS there — and
+ * then said nothing had the message answered again by a Claude with no memory
+ * of the chat, and that fresh conversation's id re-pinned the tab: the
+ * follow-up read as if the chat had never happened, and so did every one
+ * after it. With init seen, the empty answer stands and settles as what it
+ * is, the conversation kept for the next message. Unmeasured init (`sawInit`
+ * not true) and the other CLIs keep the old reading: empty is the only sign
+ * they give of a conversation that is gone.
  */
-export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) =>
-  Boolean(resume) && (!String(out || '').trim() || resumeConversationLost(out, { runtime, sawInit }));
+export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) => {
+  if (!resume) return false;
+  if (!String(out || '').trim()) return !(runtime === 'claude' && sawInit === true);
+  return resumeConversationLost(out, { runtime, sawInit });
+};
 
 /**
  * ONE SPAWN, AND AT MOST ONE FRESH RETRY — the agent lane's whole sequence,

package/bin/lib/runTurn.mjs

@@ -123,6 +123,23 @@ export function runTurn(opts) {
       resolve('');
       return;
     }
+    /**
+     * THE PERSON'S LOGIN, FOR A POSTURE THAT READS NONE OF THEIR CONFIG
+     * (2026-09-29, codexPersonal.mjs). Asked of the runtime that has one
+     * (Codex; Claude reads its own inside its adapter), with the environment
+     * this turn's CLI will run in — its CODEX_HOME is the agent's own when the
+     * lane keeps one — so the file read is the file the CLI would have read.
+     * Its `args` go to the adapter; its `env`, the literal secrets those name,
+     * to the child below and never to argv.
+     */
+    const personal =
+      rt.personal?.({
+        profile: turnProfile.adapterProfile,
+        vaultDir,
+        model,
+        effort,
+        env: { ...process.env, ...(mcpEnv ?? {}) },
+      }) ?? null;
     // Pin the model — never inherit the user's global default (which for Claude
     // may be a 1M/long-context tier their subscription can't bill autonomous
     // work on). A per-task override (chosen in the app, validated server-side
@@ -139,6 +156,7 @@ export function runTurn(opts) {
     // which posture a turn is running under. There is no precedence chain left
     // to get wrong: the caller named one profile (turnProfile.mjs).
     const args = rt.args({
+      personal,
       prompt,
       system,
       model,
@@ -237,7 +255,12 @@ export function runTurn(opts) {
       // this environment, and handing it a curated one signs it out. What it
       // REMOVES is this daemon's machine credential and, for a turn nobody is
       // sitting at, every way to a window — see `cliEnv`.
-      env: cliEnv(mcpEnv, { display: display === true, browserHome: browser?.dir }),
+      // The login's literal secrets first, so nothing of the lane's (its MCP
+      // token, its CODEX_HOME) can be overwritten by one.
+      env: cliEnv(personal?.env ? { ...personal.env, ...(mcpEnv ?? {}) } : mcpEnv, {
+        display: display === true,
+        browserHome: browser?.dir,
+      }),
     });
     if (browser) {
       child.once('close', browser.cleanup);

package/bin/lib/runtimeClaude.mjs

@@ -14,6 +14,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
+import { NO_SETTING_SOURCES, personalClaudeSettings, withPersonalSettings } from './claudePersonal.mjs';
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -51,11 +52,14 @@ export const CLAUDE_RUNTIME = {
    * "consult" and "plan" currently mean. That is a statement about where the
    * contract was written, not a claim that only Claude could ever satisfy it.
    */
-  // `design` and `research` (0.97.0) are Claude's alone: each is an
-  // `--allowedTools` list with a PATH-SCOPED write (claudePosture.mjs), and neither
-  // codex's sandbox modes nor agy's flags were measured to express "write
-  // only this directory". A runtime that does not declare them is refused
-  // such a card before spawn, in words — never handed a build turn instead.
+  // `design` and `research` (0.97.0): each is an `--allowedTools` list with a
+  // PATH-SCOPED write (claudePosture.mjs). `research` is Claude's alone;
+  // `design` is Codex's too since 0.115.0 (2026-09-29), whose permission
+  // profile was measured to write only the artifacts directory
+  // (runtimeCodex.mjs `codexDesignFence`). agy's flags cannot express "write
+  // only this directory" (runtimeAntigravity.mjs). A runtime that does not
+  // declare a posture is refused such a card before spawn, in words — never
+  // handed a build turn instead.
   profiles: ['build', 'wiki', 'consult', 'plan', 'design', 'research'],
   /**
    * THE EFFORTS THIS CLI SPELLS — the daemon's copy of the server's
@@ -72,7 +76,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools }) {
+  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools, personalSettings }) {
     const a = [];
     // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
     // are mutually exclusive, never combined.
@@ -99,11 +103,38 @@ export const CLAUDE_RUNTIME = {
     else if (resumeThreadId) a.push('--resume', resumeThreadId);
     else if (resume) a.push('--continue');
     a.push('-p', prompt, '--append-system-prompt', system);
+    /**
+     * WHOSE SETTINGS A TURN READS (2026-09-29, claudePersonal.mjs).
+     *
+     * EVERY FENCED POSTURE READS NONE — every profile but `build`: an agent's
+     * design and research cards, the pre-review, the planner, intake, the
+     * wiki and the capture chat. Its permissions and hooks are its posture's
+     * alone; of the person's file it keeps only the login and the model
+     * defaults, folded into the posture's `--settings`. Keyed on `build`
+     * rather than on a list of fenced names, so a posture added later is
+     * fenced unless it is the build.
+     *
+     * THE BUILD POSTURE KEEPS THE PERSON'S OWN, on a code agent and on a
+     * Terminal tab alike. `--dangerously-skip-permissions` already admits
+     * everything, so no personal rule can widen it; what a personal file adds
+     * there is the operator narrowing their own box (a deny rule held a
+     * bypass turn, measured) and their own CLAUDE.md, skills and subagents,
+     * which an empty source list would take away with no flag to keep them.
+     * Codex's build is not hermetic either, for the same reason
+     * (runtimeCodex.mjs). STATED, not closed: under FLOWVIANT_SAFE=1 the
+     * build is a curated list, and the operator's own allow rules or
+     * `defaultMode` can still widen it — two choices of the same operator on
+     * their own box, and a personal allow is the only way a SAFE build runs a
+     * tool its list does not name (`pnpm`, `cargo`, `make`). A code agent names `user` so the agent-editable
+     * worktree's settings and hooks never load; a Terminal tab names nothing
+     * and is the person's Claude Code, project files included. A resumed
+     * agent renders the CURRENT base snapshot, not the first turn's cache.
+     */
+    const fenced = profile !== 'build';
+    if (fenced) a.push(...NO_SETTING_SOURCES);
+    else if (agentTools) a.push('--setting-sources', 'user');
     if (agentTools) {
-      // Keep personal settings, but never load the agent-editable project's
-      // settings, hooks, skills or CLAUDE.md discovery. A resumed agent must
-      // render the CURRENT base snapshot, not the first turn's prompt cache.
-      a.push('--setting-sources', 'user', '--system-prompt-snapshot', 'off');
+      a.push('--system-prompt-snapshot', 'off');
       if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     }
     // These fenced postures have no project MCP, even if Claude discovers a
@@ -119,7 +150,9 @@ export const CLAUDE_RUNTIME = {
     // does not refuse the path the prompt just handed it. Before `perm`,
     // because `--allowedTools` is variadic and would swallow the flag.
     if (knowledgeDir) a.push('--add-dir', knowledgeDir);
-    a.push(...perm);
+    // `personalSettings` is the caller's copy when it has one (a test); a
+    // turn reads the person's file here, at spawn, as the CLI would.
+    a.push(...(fenced ? withPersonalSettings(perm, personalSettings ?? personalClaudeSettings()) : perm));
     return a;
   },
   parse: null, // claudeStream.mjs owns its own stream parser (unchanged)

package/bin/lib/runtimeCodex.mjs

@@ -12,8 +12,30 @@
 import { isAbsolute, join } from 'node:path';
 import { SAFE } from './config.mjs';
 import { parseCodexLine } from './runtimeEvents.mjs';
-import { ARTIFACT_DIR } from './artifacts.mjs';
+import { ARTIFACT_DIR, FENCE_TMP_DIR } from './artifacts.mjs';
+import { codexPersonalTurn } from './codexPersonal.mjs';
 
+/**
+ * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
+ * (2026-09-29). The owner's Codex New task chat staged nothing: "flowviant
+ * rejected the tool calls because approval is required and this session's
+ * policy forbids it". MEASURED on codex-cli 0.156.1 with a fake MCP server
+ * whose one tool carries no annotations (Flowviant's carry none): under the
+ * capture chat's read-only argv the call failed "MCP tool call requires
+ * approval, but approval policy is never" and never reached the server; under
+ * the build posture (workspace-write) the same call ran unasked. With
+ * `mcp_servers.flowviant.default_tools_approval_mode="approve"` beside the
+ * read-only argv it ran — and in the same turn a shell write still failed
+ * "Read-only file system" and an escalation still failed "approval policy is
+ * Never; reject command".
+ *
+ * So the approval is this ONE server's, never a blanket `approval_policy`:
+ * what its tools may do is the per-turn token's scope, which the server
+ * enforces (a capture token stages and reads; it files nothing), and every
+ * other door — the shell, file writes, escalation, any other server — keeps
+ * the posture's own rule. Wherever the server is mounted: the capture chat
+ * needs it, and a Terminal tab's build posture already ran the calls.
+ */
 function codexMcp(token, mcpUrl) {
   return {
     dir: null, // nothing written — the token rides in the environment
@@ -22,11 +44,23 @@ function codexMcp(token, mcpUrl) {
       `mcp_servers.flowviant.url="${mcpUrl}"`,
       '-c',
       'mcp_servers.flowviant.bearer_token_env_var="FLOWVIANT_MCP_TOKEN"',
+      '-c',
+      'mcp_servers.flowviant.default_tools_approval_mode="approve"',
     ],
     env: { FLOWVIANT_MCP_TOKEN: token },
   };
 }
 
+/**
+ * THE POSTURES THAT READ NONE OF THE PERSON'S CONFIG — the branches of `args()`
+ * below that pass `--ignore-user-config`, said once so the adapter and its
+ * `personal` hook cannot disagree about which turns carry the person's login
+ * back (codexPersonal.mjs). A wiki turn with no vault is a build turn there,
+ * and so here.
+ */
+export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
+  profile === 'consult' || profile === 'plan' || profile === 'image' || profile === 'design' || (profile === 'wiki' && Boolean(vaultDir));
+
 /**
  * WHAT A FENCED CODEX TURN MAY NOT REACH FOR (0.114.0). codex-cli 0.156.1
  * ships `browser_use` (and its external and full-CDP forms), an in-app
@@ -71,8 +105,13 @@ export const CODEX_RUNTIME = {
    * AND `image` (0.114.0), which ONLY Codex declares: the image card's fence —
    * see the branch in `args()`. It is the one kind posture that is not
    * Claude's, because the pictures come from Codex's own image tool.
+   *
+   * AND `design` (0.115.0), shared with Claude: the mockup, 3D-model and deck
+   * cards' fence, expressed as `codexDesignFence` below. Research is NOT
+   * declared: its web and Codex's whole-box reads cannot be fenced apart
+   * (see that function).
    */
-  profiles: ['build', 'consult', 'wiki', 'plan', 'image'],
+  profiles: ['build', 'consult', 'wiki', 'plan', 'image', 'design'],
   /** `model_reasoning_effort` tops out at `xhigh` — there is no `max`, and a
    *  queued or skewed job naming it would be an argument Codex refuses. */
   efforts: ['low', 'medium', 'high', 'xhigh'],
@@ -102,7 +141,7 @@ export const CODEX_RUNTIME = {
    * placed before it. Appending them after the positional is the kind of argv
    * that parses today and stops parsing on some future clap upgrade.
    */
-  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools }) {
+  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null }) {
     // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
     // agy moves) — codex has no adoptable store wired yet. Reaching here
     // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -163,6 +202,10 @@ export const CODEX_RUNTIME = {
 
       // Sub-agents would be a second turn whose posture nobody here chose.
       a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
+      // Image generation ships ON in codex-cli 0.156.1 even under
+      // --ignore-user-config (measured 2026-09-29): a turn that asked for no
+      // picture is handed no tool that spends image credits.
+      a.push('--disable', 'image_generation');
 
       // HERMETIC. Without these a user's ~/.codex/config.toml, a project
       // `.rules` execpolicy file, or their own MCP servers can widen a posture
@@ -190,6 +233,10 @@ export const CODEX_RUNTIME = {
       a.push('-c', 'sandbox_mode="read-only"');
       a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
       a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
+      // Image generation ships ON in codex-cli 0.156.1 even under
+      // --ignore-user-config (measured 2026-09-29): a turn that asked for no
+      // picture is handed no tool that spends image credits.
+      a.push('--disable', 'image_generation');
       a.push('--ignore-user-config', '--ignore-rules');
     } else if (profile === 'wiki' && vaultDir) {
       // THE CARTOGRAPHER, AND THIS ONE IS STRICTER THAN CLAUDE'S.
@@ -217,6 +264,7 @@ export const CODEX_RUNTIME = {
       // Selected by config: `codex exec` (0.156.1) has no `-P`, so every Codex
       // wiki turn was refused before it started (0.114.0).
       a.push('-c', 'default_permissions="flowviantwiki"');
+      a.push('--disable', 'image_generation');
       a.push(...NO_REACH_OUT);
       a.push('--ignore-user-config', '--ignore-rules');
     } else if (profile === 'image') {
@@ -261,7 +309,12 @@ export const CODEX_RUNTIME = {
       a.push('-c', 'permissions.flowviantimage.extends=":read-only"');
       // The table WHOLE (the wiki branch's reason: a dotted key splits on the
       // dots inside the path), the path as a TOML basic string.
-      a.push('-c', `permissions.flowviantimage.filesystem={${JSON.stringify(artifacts)}="write"}`);
+      // …and the fence's own scratch (2026-09-29, the design fence's
+      // measurement: a `cat > x <<EOF` needs a temp file, and /tmp is
+      // read-only in here), named for the shells through TMPDIR/TMPPREFIX.
+      const scratch = join(cwd, FENCE_TMP_DIR);
+      a.push('-c', `permissions.flowviantimage.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`);
+      a.push('-c', `shell_environment_policy.set={TMPDIR=${JSON.stringify(scratch)},TMPPREFIX=${JSON.stringify(join(scratch, 'zsh'))}}`);
       a.push('-c', 'default_permissions="flowviantimage"');
       a.push(...NO_REACH_OUT);
       // Nobody is on this end of the pipe to approve an escalation.
@@ -272,6 +325,10 @@ export const CODEX_RUNTIME = {
       a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
       a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
       a.push('--ignore-user-config', '--ignore-rules');
+    } else if (profile === 'design') {
+      // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
+      // `codexDesignFence`'s, argued and measured at its definition below.
+      a.push(...codexDesignFence(cwd));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -286,13 +343,117 @@ export const CODEX_RUNTIME = {
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
     }
 
+    /**
+     * …AND THE PERSON'S LOGIN RIDES BACK BESIDE THE FLAG (2026-09-29,
+     * codexPersonal.mjs): where the login lives, the provider and endpoint it
+     * signs into, and the model an unpinned turn runs — `-c` pairs after
+     * `--ignore-user-config`, never a key that widens the posture above.
+     * Keyed on the flag itself, so a fenced branch added later carries the
+     * login the day it ignores the file. `personal` is runTurn's, read where
+     * the turn's Codex will look (the `personal` hook below); a caller that
+     * hands none gets the posture as it was.
+     */
+    if (a.includes('--ignore-user-config')) a.push(...(personal?.args ?? []));
+
     a.push(...mcp, ...resultSchemaArgs);
     a.push(`${system}\n\n---\n\n${prompt}`);
     return a;
   },
+  /**
+   * THE PERSON'S LOGIN FOR A FENCED TURN, read once per spawn by runTurn from
+   * the turn's own environment (its CODEX_HOME — an agent's own home when the
+   * lane keeps one): `{ args, env }`, the `-c` pairs `args()` places and the
+   * literal secrets they name, which ride the child's environment, never argv.
+   * Null for a turn that reads the person's config itself.
+   */
+  personal: ({ profile, vaultDir, env, model, effort } = {}) =>
+    codexIgnoresUserConfig({ profile, vaultDir }) ? codexPersonalTurn({ env, model, effort }) : null,
   parse: parseCodexLine,
   /** `codex exec --output-schema <file>` constrains the FINAL message to a
    *  JSON Schema. Only needed on the mediated path; the direct path reports
    *  through MCP tool calls, which are already structured. */
   resultSchema: (path) => ['--output-schema', path],
 };
+
+/**
+ * THE MOCKUP, 3D-MODEL AND DECK CARDS' FENCE ON CODEX (0.115.0; 2026-09-29, the
+ * owner: "its saying 3d models run on claude only but thats not true").
+ *
+ * The image fence's shape without the image tool: a permission profile that
+ * reads the repo and writes ONLY `<worktree>/.flowviant/artifacts/`, selected
+ * by `default_permissions` (`codex exec` and `exec resume` refuse `-P` on
+ * 0.156.1), no network, no web search, no sub-agents, no browser, computer or
+ * apps, nobody's config or rules, and no approvals to wait on. Nothing about
+ * the card's contract needs more: every one of the three is one HTML page, and
+ * a page's CDN scripts load in the viewer, never on this machine.
+ *
+ * MEASURED on codex-cli 0.156.1 (Linux, bubblewrap), with gpt-6-luna at low
+ * effort, in a scratch git repository (2026-09-29), with exactly this argv:
+ *  · the WRITE FENCE holds for both of Codex's ways to write: its
+ *    `apply_patch` of `src/escape-patch.txt` was refused by Codex itself
+ *    ("patch rejected: writing outside of the project; rejected by user
+ *    approval settings"), and `echo x > src/escape-shell.txt` and
+ *    `echo x > /tmp/fv-escape.txt` each failed "read-only file system";
+ *    `apply_patch` of `.flowviant/artifacts/ok-patch.txt` landed;
+ *  · NO NETWORK: `curl https://example.com` failed "Could not resolve host";
+ *    NO WEB: the model reported no search tool;
+ *  · THE TOOL LIST was `apply_patch`, `clock__curr_time`, `exec_command`,
+ *    `view_image`, `write_stdin` — and `image_gen__imagegen` WITHOUT
+ *    `--disable image_generation`: image generation ships ON in 0.156.1 even
+ *    under `--ignore-user-config`, so it is switched off here by name, and a
+ *    mockup never spends the person's image credits;
+ *  · THE CONTRACTS DELIVER: the real mockup, 3D-model and deck contracts each
+ *    produced their one page under `.flowviant/artifacts/` (the model page
+ *    with its `glb-ready`/`export-glb` handshake and GLTFExporter, the deck
+ *    with its sections, arrow keys and print rules) and changed no repository
+ *    file (`git status` clean but for the ignored directory);
+ *  · THE SCRATCH IS LOAD-BEARING: a deck turn that wrote its page with a
+ *    here-document got "can't create temp file for here document: read-only
+ *    file system", left a 0-byte page and stopped to ask; with the scratch
+ *    granted and named (below) the same here-document wrote the page, and a
+ *    resumed turn (`exec resume <id>` with this argv, as `CODEX_RUNTIME.args`
+ *    builds it) edited it in place.
+ *
+ * STATED, not closed: Codex's permission profile READS the whole box, where
+ * Claude's design list reads only the worktree and the knowledge library. It
+ * cannot be narrowed on 0.156.1 — a `"none"` entry over the home directory
+ * hides Codex's own sandbox helper when Codex is installed there ("bwrap:
+ * execvp …/codex: No such file or directory"), and masking a second FILE
+ * fails every command ("bwrap: Can't write data to file …: Bad file
+ * descriptor"). With the network and the web shut, the one road out is the
+ * artifact itself, which is scrubbed of the machine's known secret values and
+ * of any Flowviant credential by shape on the way up — the image fence's
+ * standing (0.114.0), and why RESEARCH is not declared here: a write-up needs
+ * the web, and a turn that can read `.env` and `~/.flowviant/credentials.json`
+ * while holding `web_search` (both measured readable under this profile with
+ * `web_search="live"`) is the exfiltration Claude's research list was fenced
+ * to prevent.
+ */
+export function codexDesignFence(cwd) {
+  if (!cwd || !isAbsolute(cwd)) {
+    throw new Error("a design turn needs its worktree to fence — none reached codex's builder");
+  }
+  const artifacts = join(cwd, ARTIFACT_DIR);
+  // THE TURN'S OWN SCRATCH (artifacts.mjs `ensureFenceScratch`, made empty by
+  // the lane before spawn): `/tmp` is read-only in here, and a here-document
+  // needs a temp file — measured, a `cat > page.html <<EOF` failed "can't
+  // create temp file for here document: read-only file system" and the turn
+  // stopped to ask. Granted, and named by the two variables the shells read
+  // (`TMPDIR`; zsh's `TMPPREFIX`), set for every command through
+  // `shell_environment_policy.set` — measured to reach the sandboxed shell.
+  const scratch = join(cwd, FENCE_TMP_DIR);
+  return [
+    '-c', 'permissions.flowviantdesign.extends=":read-only"',
+    // The table WHOLE and the path a TOML basic string — the wiki branch's
+    // reason: a dotted key splits on the dots inside the path.
+    '-c', `permissions.flowviantdesign.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`,
+    '-c', `shell_environment_policy.set={TMPDIR=${JSON.stringify(scratch)},TMPPREFIX=${JSON.stringify(join(scratch, 'zsh'))}}`,
+    '-c', 'default_permissions="flowviantdesign"',
+    '-c', 'approval_policy="never"',
+    '--disable', 'image_generation',
+    '-c', 'tools.web_search=false', '-c', 'web_search="disabled"',
+    '-c', 'features.multi_agent=false', '-c', 'features.goals=false',
+    ...NO_REACH_OUT,
+    '--ignore-user-config', '--ignore-rules',
+  ];
+}

package/bin/lib/runtimeEvents.mjs

@@ -277,8 +277,15 @@ function humanizeCodexItem(item = {}, cwd = '') {
       const verb = first.kind === 'add' ? '+' : first.kind === 'delete' ? '-' : '~';
       return { kind: 'write', path: p, label: `${verb} ${tail || 'file'}` };
     }
-    case 'mcp_tool_call':
-      return { kind: 'tool', label: `${item.server ?? 'mcp'}.${item.tool ?? ''}` };
+    case 'mcp_tool_call': {
+      // A FAILED CALL KEEPS ITS OWN WORDS (2026-09-29), beside a label that is
+      // unchanged: codex-cli 0.156.1 closes a call it would not run as
+      // `status: "failed"`, `error.message` "MCP tool call requires approval,
+      // but approval policy is never" (measured), and the tab lane says so
+      // in words (codexRelay.mjs) instead of leaving a chat that staged nothing.
+      const error = String(item.error?.message ?? '');
+      return { kind: 'tool', label: `${item.server ?? 'mcp'}.${item.tool ?? ''}`, ...(error ? { error } : {}) };
+    }
     case 'web_search':
       return { kind: 'search', label: `search ${oneLine(item.query, 60)}` };
     default:

package/bin/lib/turnProfile.mjs

@@ -22,8 +22,9 @@
  *  - design / research / image — a non-code card's posture
  *                (agentTaskKinds.mjs), refused on any runtime that does not
  *                DECLARE it, because every other adapter's fallback is its
- *                build branch. design and research are Claude Code's; image
- *                (0.114.0) is Codex's.
+ *                build branch. research is Claude Code's; design is
+ *                Claude Code's and, since 0.115.0, Codex's; image (0.114.0)
+ *                is Codex's.
  *
  * Claude's permission list for each name lives beside the lists themselves
  * (`claudePermFor`, claudePosture.mjs); this module owns the vocabulary and the