flowviant 0.114.2 → 0.115.0

package/bin/lib/agentTaskKinds.mjs

@@ -33,9 +33,13 @@
  *    sentence a turn settles `nothing` with when the proof was not written;
  *  - `offRuntime(rt)`: the sentence when the chosen CLI cannot run the posture.
  */
-/** The mockup, 3D-model, presentation and write-up kinds run on Claude: the one
- *  CLI that declares their postures (`design`, `research`). */
-const CLAUDE_ONLY = 'mockup, 3D model, presentation and write-up cards run on Claude on this machine';
+/** The mockup, 3D-model and presentation kinds run under the `design` posture,
+ *  which Claude and — since 0.115.0 — Codex declare (2026-09-29, measured:
+ *  runtimeCodex.mjs `codexDesignFence`). */
+const DESIGN_CLIS = 'mockup, 3D model and presentation cards run on Claude or Codex on this machine';
+/** The write-up kind runs on Claude alone: Codex cannot fence the web it needs
+ *  apart from the whole-box reads its sandbox allows (same place). */
+const CLAUDE_ONLY = 'write-up cards run on Claude on this machine';
 /** The image kind runs on Codex: the one CLI that declares its posture, because
  *  the pictures come from Codex's own image tool on its own login. */
 const CODEX_ONLY = 'image cards run on Codex on this machine';
@@ -52,7 +56,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.html?$/i,
       missing: 'the turn ended without writing a mockup under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => DESIGN_CLIS,
   }),
   /**
    * THE 3D-MODEL KIND (0.105.0; one page since 0.107.0): a three.js page that
@@ -69,7 +73,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.html?$/i,
       missing: 'the turn ended without writing a 3D model page under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => DESIGN_CLIS,
   }),
   /**
    * THE IMAGE KIND (0.114.0): one or more raster pictures, generated by
@@ -97,7 +101,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.html?$/i,
       missing: 'the turn ended without writing a deck under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => DESIGN_CLIS,
   }),
   research: Object.freeze({
     posture: 'research',

package/bin/lib/artifacts.mjs

@@ -74,7 +74,7 @@
  * that cannot show an artifact must not have the CLI told it will.
  */
 
-import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync } from 'node:fs';
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { cutKeepingExtension } from './safeFileName.mjs';
@@ -138,6 +138,48 @@ export function ensureArtifactDir(placeDir) {
   return real(parent) === true && real(dir) === true;
 }
 
+/**
+ * A FENCED TURN'S OWN SCRATCH — `<place>/.flowviant/tmp`, beside the artifacts
+ * directory, under the `.flowviant/` git already ignores (0.115.0, 2026-09-29).
+ *
+ * MEASURED on codex-cli 0.156.1: under an artifacts-only profile `/tmp` is
+ * read-only, and a shell here-document needs a temp file (zsh writes it under
+ * `$TMPPREFIX`, bash and `mktemp` under `$TMPDIR`) — so `cat > page.html
+ * <<EOF` failed "can't create temp file for here document: read-only file
+ * system", left an empty page, and the turn stopped to ask why the artifacts
+ * directory was read-only. Codex's design fence grants this directory and
+ * points both variables at it (runtimeCodex.mjs `codexDesignFence`), so the
+ * shell works like a shell; nothing here is uploaded, committed or read back.
+ *
+ * Made EMPTY before each turn (a previous turn's scratch is nobody's), and
+ * only as a real directory under a real `.flowviant` — the artifacts
+ * directory's rule, for its reason: a fence grant on a path through a
+ * committed symlink is a write grant on its target. False creates nothing
+ * that matters, and the caller refuses the turn in words.
+ */
+export const FENCE_TMP_DIR = '.flowviant/tmp';
+export function ensureFenceScratch(placeDir) {
+  const parent = join(placeDir, '.flowviant');
+  const dir = join(placeDir, FENCE_TMP_DIR);
+  const kind = (p) => {
+    try {
+      const st = lstatSync(p);
+      return st.isDirectory() && !st.isSymbolicLink() ? 'dir' : 'other';
+    } catch (e) {
+      return e?.code === 'ENOENT' ? 'none' : 'other';
+    }
+  };
+  if (kind(parent) !== 'dir' || kind(dir) === 'other') return false;
+  try {
+    // A real directory (checked above): its contents go, never through a link.
+    if (kind(dir) === 'dir') rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dir);
+  } catch {
+    return false;
+  }
+  return kind(parent) === 'dir' && kind(dir) === 'dir';
+}
+
 export function artifactTypeFor(name) {
   const dot = String(name).lastIndexOf('.');
   if (dot <= 0) return null;

package/bin/lib/codexPersonal.mjs

@@ -0,0 +1,467 @@
+/**
+ * A FENCED CODEX TURN STILL SIGNS IN AS THE PERSON'S CODEX (2026-09-29).
+ *
+ * The owner's New task chat on Codex failed on their WSL machine with
+ * `401 Unauthorized: Missing bearer or basic authentication in header` — Codex
+ * sent the request with no login at all — while their Codex agents' build
+ * turns ran. Every fenced Codex posture (consult, plan and the capture chat,
+ * wiki, image) passes `--ignore-user-config` so no personal config can widen a
+ * posture asserted on the person's behalf (runtimeCodex.mjs). Codex 0.156.1's
+ * own words for that flag: "Do not load `$CODEX_HOME/config.toml`; auth still
+ * uses `CODEX_HOME`". The FILE of credentials is still found; everything
+ * config.toml says about WHERE the login lives and WHICH endpoint it signs
+ * into is dropped with the rest. MEASURED on codex-cli 0.156.1 with scratch
+ * CODEX_HOMEs and a local fake Responses endpoint (~/.codex untouched):
+ *  · `cli_auth_credentials_store = "keyring"` (or "auto" where a keyring
+ *    answers): `codex login` stores the login in the OS keyring and writes no
+ *    auth.json. Under the flag the store is the default "file", the file is
+ *    not there, and the request went out with no Authorization header;
+ *    `-c cli_auth_credentials_store="keyring"` beside the flag put the bearer
+ *    back.
+ *  · a custom `model_provider` with its `[model_providers.<id>]` table: under
+ *    the flag the turn went to api.openai.com/v1/responses with no login —
+ *    word for word the owner's error; the provider's keys as `-c` pairs put
+ *    it back on the person's endpoint with its `env_key` bearer.
+ *  · `openai_base_url` routes the built-in provider and `chatgpt_base_url` a
+ *    ChatGPT login's workspace discovery; both were dropped by the flag.
+ *
+ * So each fenced posture carries back ONLY what makes the CLI the person's
+ * CLI — how it signs in, which provider and endpoint it reaches, and the
+ * model it runs when the turn pins none — as `-c` overrides beside the flag.
+ * An ALLOWLIST, the Claude mirror's rule (claudePersonal.mjs): sandbox and
+ * approval settings, permission profiles, the shell environment policy, MCP
+ * servers, features, tools and web search, projects, hooks, profiles and
+ * instructions never ride, and a key a later Codex adds never rides by
+ * default. A config that does not parse carries nothing, which is the turn as
+ * it ran before this.
+ *
+ * A LITERAL SECRET NEVER RIDES ARGV. Every process on the box can read
+ * another's command line, and the daemon already keeps its own MCP token in
+ * the environment for that reason (runtimeCodex.mjs `codexMcp`). A header
+ * value or a bearer token written into config.toml rides in the turn's
+ * ENVIRONMENT instead, named by the CLI's own indirection (`env_http_headers`,
+ * `env_key`). The environment is kept from the box's other users; argv is
+ * not. It is NOT kept from the turn's own model, and cannot usefully be: `env`
+ * in a fenced turn's shell listed every variable Codex was started with (a
+ * provider key and FLOWVIANT_MCP_TOKEN among them — measured), Codex's shell
+ * snapshot put back a name `shell_environment_policy.exclude` had removed
+ * (measured), and the read-only sandbox reads `~/.codex/config.toml`, where
+ * the literal is written, anyway.
+ *
+ * STATED, NOT CLOSED: a login chosen by a legacy `profile = "…"` table is not
+ * carried (profiles never ride), and Codex keys a keyring login by its
+ * CODEX_HOME's path, so a keyring login is invisible from an agent's own
+ * CODEX_HOME whichever posture it runs (measured: another home with the same
+ * config read "Not logged in").
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { toml } from './projectToolRuntimes.mjs';
+
+/** Where the login lives and which endpoint it signs into — top-level keys,
+ *  each confirmed in codex-cli 0.156.1 (`preferred_auth_method` is not one:
+ *  0.156.1 has no such key, so it is not carried). */
+export const CODEX_LOGIN_KEPT = Object.freeze([
+  'cli_auth_credentials_store',
+  'forced_login_method',
+  'forced_chatgpt_workspace_id',
+  'chatgpt_base_url',
+  'openai_base_url',
+]);
+
+/**
+ * The selected provider's table, field by field (0.156.1's ModelProviderInfo):
+ * its name and endpoint, how it authenticates (`env_key`, the command helper
+ * `auth`, `aws`, `gateway_oauth`, `requires_openai_auth`, headers), and how it
+ * is reached. Not `supports_standalone_web_search` — web search is exactly
+ * what a fenced turn switches off — and not `model_catalog_url`.
+ */
+export const CODEX_PROVIDER_KEPT = Object.freeze([
+  'name',
+  'base_url',
+  'env_key',
+  'env_key_instructions',
+  'experimental_bearer_token',
+  'auth',
+  'aws',
+  'gateway_oauth',
+  'requires_openai_auth',
+  'wire_api',
+  'query_params',
+  'http_headers',
+  'env_http_headers',
+  'request_max_retries',
+  'stream_max_retries',
+  'stream_idle_timeout_ms',
+  'websocket_connect_timeout_ms',
+  'supports_websockets',
+]);
+
+/** The environment names a literal secret rides under (see above). */
+export const CODEX_BEARER_ENV = 'FLOWVIANT_CODEX_BEARER_TOKEN';
+export const CODEX_HEADER_ENV_PREFIX = 'FLOWVIANT_CODEX_SECRET_HEADER_';
+
+/** Far past any real config.toml; a bigger one is not read. */
+const CONFIG_MAX_BYTES = 1024 * 1024;
+/** Arrays and inline tables nest no deeper than this in a file we read. */
+const MAX_DEPTH = 32;
+
+/** A number, date or time, kept as written so it is carried as written. */
+export class TomlRaw {
+  constructor(text) {
+    this.text = text;
+  }
+}
+const newTable = () => Object.create(null);
+const isTable = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && !(v instanceof TomlRaw);
+
+const BARE = /[A-Za-z0-9_-]+/y;
+// First match wins, so the forms that begin like an integer come first.
+const SCALAR =
+  /[+-]?(?:inf|nan)|0x[0-9A-Fa-f](?:_?[0-9A-Fa-f])*|0o[0-7](?:_?[0-7])*|0b[01](?:_?[01])*|\d{4}-\d{2}-\d{2}(?:[Tt ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:[Zz]|[+-]\d{2}:\d{2})?)?|\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?|[+-]?\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?/y;
+
+/**
+ * A BOUNDED TOML READER — the repo carries no TOML library, and the one file
+ * it reads is Codex's own config. Whole documents: tables, arrays of tables
+ * (the daemon's own `[[skills.config]]` in an agent's home), dotted and quoted
+ * keys, the four string forms, arrays, inline tables, booleans, and numbers,
+ * dates and times kept as written. Anything else throws, and the caller
+ * carries nothing — a partial read is never a license to guess.
+ */
+export function parseCodexToml(text) {
+  const src = String(text).replace(/^/, '');
+  const n = src.length;
+  let i = 0;
+  const fail = (why) => {
+    throw new Error(`config.toml: ${why} at offset ${i}`);
+  };
+  const ws = () => {
+    while (i < n && (src[i] === ' ' || src[i] === '\t')) i++;
+  };
+  const comment = () => {
+    if (src[i] === '#') while (i < n && src[i] !== '\n') i++;
+  };
+  const newline = () => {
+    if (src[i] === '\n') return (i += 1), true;
+    if (src[i] === '\r' && src[i + 1] === '\n') return (i += 2), true;
+    return false;
+  };
+  /** Blank lines, comments and whitespace, as between array items. */
+  const gap = () => {
+    for (;;) {
+      ws();
+      comment();
+      if (!newline()) return;
+    }
+  };
+  const endOfLine = () => {
+    ws();
+    comment();
+    if (i < n && !newline()) fail('expected the end of the line');
+  };
+  const hexChar = (len) => {
+    const h = src.slice(i, i + len);
+    if (h.length !== len || !/^[0-9A-Fa-f]+$/.test(h)) fail('bad escape');
+    i += len;
+    const cp = parseInt(h, 16);
+    if (cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff)) fail('bad escape');
+    return String.fromCodePoint(cp);
+  };
+  const escape = () => {
+    const e = src[i + 1];
+    i += 2;
+    switch (e) {
+      case 'b': return '\b';
+      case 't': return '\t';
+      case 'n': return '\n';
+      case 'f': return '\f';
+      case 'r': return '\r';
+      case 'e': return '\x1b';
+      case '"': return '"';
+      case '\\': return '\\';
+      case 'x': return hexChar(2);
+      case 'u': return hexChar(4);
+      case 'U': return hexChar(8);
+      default: return fail('bad escape');
+    }
+  };
+  const basicString = () => {
+    i += 1;
+    let s = '';
+    for (;;) {
+      if (i >= n) fail('unterminated string');
+      const ch = src[i];
+      if (ch === '"') return (i += 1), s;
+      if (ch === '\n' || ch === '\r') fail('newline in a string');
+      if (ch === '\\') s += escape();
+      else (s += ch), (i += 1);
+    }
+  };
+  const literalString = () => {
+    const end = src.indexOf("'", i + 1);
+    if (end < 0) fail('unterminated string');
+    const s = src.slice(i + 1, end);
+    if (/[\r\n]/.test(s)) fail('newline in a string');
+    i = end + 1;
+    return s;
+  };
+  const LINE_END_BACKSLASH = /\\[ \t]*\r?\n/y;
+  const multiline = (quote, escapes) => {
+    i += 3;
+    newline(); // a newline straight after the opening quotes is not content
+    let s = '';
+    for (;;) {
+      if (i >= n) fail('unterminated string');
+      if (src.startsWith(quote.repeat(3), i)) {
+        let q = 3;
+        while (q < 5 && src[i + q] === quote) q++; // up to two belong to the content
+        s += quote.repeat(q - 3);
+        i += q;
+        return s;
+      }
+      if (escapes && src[i] === '\\') {
+        LINE_END_BACKSLASH.lastIndex = i;
+        if (LINE_END_BACKSLASH.test(src)) {
+          i = LINE_END_BACKSLASH.lastIndex;
+          while (i < n && /[ \t\r\n]/.test(src[i])) i++;
+        } else s += escape();
+      } else (s += src[i]), (i += 1);
+    }
+  };
+  const key = () => {
+    const parts = [];
+    for (;;) {
+      ws();
+      if (src[i] === '"') {
+        if (src.startsWith('"""', i)) fail('a multi-line key');
+        parts.push(basicString());
+      } else if (src[i] === "'") {
+        if (src.startsWith("'''", i)) fail('a multi-line key');
+        parts.push(literalString());
+      } else {
+        BARE.lastIndex = i;
+        const m = BARE.exec(src);
+        if (!m) fail('expected a key');
+        parts.push(m[0]);
+        i = BARE.lastIndex;
+      }
+      ws();
+      if (src[i] !== '.') return parts;
+      i += 1;
+    }
+  };
+  const assign = (target, path, v) => {
+    let t = target;
+    for (const k of path.slice(0, -1)) {
+      if (!Object.hasOwn(t, k)) t[k] = newTable();
+      else if (!isTable(t[k])) fail(`"${k}" is not a table`);
+      t = t[k];
+    }
+    const last = path.at(-1);
+    if (Object.hasOwn(t, last)) fail(`"${last}" is defined twice`);
+    t[last] = v;
+  };
+  let depth = 0;
+  const nested = (open) => {
+    if (++depth > MAX_DEPTH) fail('nested too deep');
+    try {
+      return open();
+    } finally {
+      depth -= 1;
+    }
+  };
+  const array = () => {
+    i += 1;
+    const out = [];
+    for (;;) {
+      gap();
+      if (src[i] === ']') return (i += 1), out;
+      out.push(value());
+      gap();
+      if (src[i] === ',') i += 1;
+      else if (src[i] === ']') return (i += 1), out;
+      else fail('expected , or ]');
+    }
+  };
+  const inlineTable = () => {
+    i += 1;
+    const t = newTable();
+    for (;;) {
+      gap();
+      if (src[i] === '}') return (i += 1), t;
+      keyValue(t);
+      gap();
+      if (src[i] === ',') i += 1;
+      else if (src[i] === '}') return (i += 1), t;
+      else fail('expected , or }');
+    }
+  };
+  const word = (w) => src.startsWith(w, i) && !/[A-Za-z0-9_-]/.test(src[i + w.length] ?? '');
+  const value = () => {
+    const ch = src[i];
+    if (ch === '"') return src.startsWith('"""', i) ? multiline('"', true) : basicString();
+    if (ch === "'") return src.startsWith("'''", i) ? multiline("'", false) : literalString();
+    if (ch === '[') return nested(array);
+    if (ch === '{') return nested(inlineTable);
+    if (word('true')) return (i += 4), true;
+    if (word('false')) return (i += 5), false;
+    SCALAR.lastIndex = i;
+    const m = SCALAR.exec(src);
+    if (!m) fail('a value this reader does not know');
+    i = SCALAR.lastIndex;
+    if (/[A-Za-z0-9_.:+-]/.test(src[i] ?? '')) fail('a value this reader does not know');
+    return new TomlRaw(m[0]);
+  };
+  const keyValue = (target) => {
+    const path = key();
+    if (src[i] !== '=') fail('expected =');
+    i += 1;
+    ws();
+    assign(target, path, value());
+  };
+
+  const root = newTable();
+  let current = root;
+  for (;;) {
+    gap();
+    if (i >= n) return root;
+    if (src[i] !== '[') {
+      keyValue(current);
+      endOfLine();
+      continue;
+    }
+    const many = src[i + 1] === '[';
+    i += many ? 2 : 1;
+    const path = key();
+    if (many ? !src.startsWith(']]', i) : src[i] !== ']') fail('an unclosed table header');
+    i += many ? 2 : 1;
+    endOfLine();
+    let t = root;
+    for (const k of path.slice(0, -1)) {
+      if (!Object.hasOwn(t, k)) t[k] = newTable();
+      const v = Array.isArray(t[k]) ? t[k].at(-1) : t[k];
+      if (!isTable(v)) fail(`"${k}" is not a table`);
+      t = v;
+    }
+    const last = path.at(-1);
+    if (many) {
+      if (!Object.hasOwn(t, last)) t[last] = [];
+      if (!Array.isArray(t[last])) fail(`"${last}" is not an array of tables`);
+      current = newTable();
+      t[last].push(current);
+    } else {
+      if (!Object.hasOwn(t, last)) t[last] = newTable();
+      else if (!isTable(t[last])) fail(`"${last}" is not a table`);
+      current = t[last];
+    }
+  }
+}
+
+/**
+ * The person's config.toml, where the turn's Codex would look —
+ * `$CODEX_HOME/config.toml` (an agent's own home when its lane keeps one),
+ * else `~/.codex/config.toml` — parsed. Null when it is absent, too big or
+ * not a document this reader can read whole.
+ */
+export function readPersonalCodexConfig(env = process.env) {
+  const home = env.CODEX_HOME || join(env.HOME || homedir(), '.codex');
+  const path = join(home, 'config.toml');
+  try {
+    if (statSync(path).size > CONFIG_MAX_BYTES) return null;
+    return parseCodexToml(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** One value as TOML, as a `-c` override's value is parsed. */
+const bareKeyOr = (k) => (/^[A-Za-z0-9_-]+$/.test(k) ? k : toml(k));
+export function tomlValue(v) {
+  if (typeof v === 'string') return toml(v);
+  if (typeof v === 'boolean') return String(v);
+  if (v instanceof TomlRaw) return v.text;
+  if (Array.isArray(v)) return `[${v.map(tomlValue).join(',')}]`;
+  if (isTable(v)) return `{${Object.keys(v).map((k) => `${bareKeyOr(k)}=${tomlValue(v[k])}`).join(',')}}`;
+  throw new Error('not a TOML value');
+}
+
+const isString = (v) => typeof v === 'string';
+const isStringList = (v) => Array.isArray(v) && v.every(isString);
+const nonEmpty = (v) => typeof v === 'string' && v.trim() !== '';
+
+/**
+ * The selected provider's kept fields, with its literal secrets moved into
+ * `env` (see the header). Mutates nothing it was handed.
+ */
+function keptProvider(table, env, turnEnv) {
+  const out = newTable();
+  for (const k of CODEX_PROVIDER_KEPT) if (Object.hasOwn(table, k)) out[k] = table[k];
+  if (isString(out.experimental_bearer_token)) {
+    // Codex puts this token before `env_key`, so taking `env_key`'s place
+    // keeps the person's precedence.
+    env[CODEX_BEARER_ENV] = out.experimental_bearer_token;
+    out.env_key = CODEX_BEARER_ENV;
+  }
+  delete out.experimental_bearer_token;
+  if (isTable(out.http_headers)) {
+    const byEnv = isTable(out.env_http_headers) ? { ...out.env_http_headers } : newTable();
+    let n = 0;
+    for (const [header, literal] of Object.entries(out.http_headers)) {
+      if (!isString(literal)) continue;
+      // An env header whose variable is set already wins over the literal in
+      // Codex; only where it would not does the literal ride.
+      if (Object.hasOwn(byEnv, header) && nonEmpty(turnEnv[byEnv[header]])) continue;
+      const name = `${CODEX_HEADER_ENV_PREFIX}${n++}`;
+      env[name] = literal;
+      byEnv[header] = name;
+    }
+    if (Object.keys(byEnv).length) out.env_http_headers = Object.assign(newTable(), byEnv);
+  }
+  delete out.http_headers;
+  return out;
+}
+
+/**
+ * What a fenced turn carries of `config`: `args` — `-c key=value` pairs for
+ * the posture's argv — and `env`, the literal secrets they name.
+ *
+ *  · the login keys, when they hold what Codex takes (a string; the workspace
+ *    id may be a list of strings) — a wrong-typed one is skipped, never
+ *    guessed at;
+ *  · `model_provider` and that provider's table, whole-table form, so an id
+ *    with a dot in it survives (`-c` splits a dotted path on every dot); only
+ *    the SELECTED provider — the built-in `openai` cannot be overridden (the
+ *    CLI refuses the file), and an unselected table signs nothing in;
+ *  · `model` and `model_reasoning_effort` ONLY where the turn pins none — an
+ *    explicit pin is the argv's own `--model` / effort override and wins. An
+ *    unpinned fenced turn then runs on "Machine default" as the person's CLI
+ *    means it, and a custom provider gets a model it serves.
+ */
+export function codexPersonalCarry(config, { model = null, effort = null, env: turnEnv = {} } = {}) {
+  const args = [];
+  const env = {};
+  if (!isTable(config)) return { args, env };
+  const push = (k, v) => args.push('-c', `${k}=${tomlValue(v)}`);
+  for (const k of CODEX_LOGIN_KEPT) {
+    const v = config[k];
+    if (isString(v) || (k === 'forced_chatgpt_workspace_id' && isStringList(v))) push(k, v);
+  }
+  const id = config.model_provider;
+  if (isString(id) && id) {
+    const table = isTable(config.model_providers) ? config.model_providers[id] : undefined;
+    if (isTable(table)) {
+      const kept = keptProvider(table, env, turnEnv);
+      if (Object.keys(kept).length) push('model_providers', Object.assign(newTable(), { [id]: kept }));
+    }
+    push('model_provider', id);
+  }
+  if (!model && nonEmpty(config.model)) push('model', config.model);
+  if (!effort && nonEmpty(config.model_reasoning_effort)) push('model_reasoning_effort', config.model_reasoning_effort);
+  return { args, env };
+}
+
+/** The carry for one turn: the config its Codex would read, reduced. */
+export function codexPersonalTurn({ env = process.env, model = null, effort = null } = {}) {
+  return codexPersonalCarry(readPersonalCodexConfig(env), { model, effort, env });
+}

package/bin/lib/codexRelay.mjs

@@ -0,0 +1,63 @@
+/**
+ * WHAT A CODEX TURN'S OWN WORDS SAY WENT WRONG, SAID IN THE MACHINE'S WORDS
+ * (2026-09-29) — for the Terminal tab and the New task chat, whose reply is
+ * whatever the turn printed.
+ *
+ * Two failures the owner met on a Codex New task chat, both measured on
+ * codex-cli 0.156.1:
+ *  · NO LOGIN. The request went out with no credentials and the provider
+ *    refused it: `unexpected status 401 Unauthorized: Missing bearer or basic
+ *    authentication in header`, five retries on the websocket and five on
+ *    HTTPS, then `turn.failed` — and the chat's reply was that retry log. A
+ *    login the provider REFUSED reads `unexpected status 401 Unauthorized:
+ *    Incorrect API key provided: …` instead (measured with a made-up key).
+ *  · A TOOL CALL NOBODY COULD APPROVE. An MCP tool Codex holds to need
+ *    approval, under an approval policy that cannot ask, fails the call with
+ *    `MCP tool call requires approval, but approval policy is never` — and
+ *    the chat said only whatever the model made of it, with nothing staged.
+ *
+ * Literal matches on those sentences, like cliLimit.mjs: a trigger, never a
+ * classifier. The sentence names what was measured and the one remedy the
+ * machine's own CLI offers; Codex's own words stay beside it.
+ */
+import { scrub as envScrub } from './uplinkScrub.mjs';
+import { CODEX_RUNTIME } from './runtimeCodex.mjs';
+
+const NO_LOGIN = /unexpected status 401 Unauthorized: Missing bearer or basic authentication/;
+const REFUSED_LOGIN = /unexpected status 401 Unauthorized/;
+export const APPROVAL_REFUSED = /MCP tool call requires approval, but approval policy is never/;
+
+/** 'missing' | 'refused' | null — what a turn's output says of its login. */
+export function codexLoginFailure(out) {
+  const s = String(out ?? '');
+  if (NO_LOGIN.test(s)) return 'missing';
+  if (REFUSED_LOGIN.test(s)) return 'refused';
+  return null;
+}
+
+/** The sentence for `codexLoginFailure`'s answer; `login` is the registry's
+ *  own sign-in command. */
+export function codexLoginSentence(failure, login = CODEX_RUNTIME.login) {
+  if (failure === 'missing')
+    return `Codex isn't signed in for this chat on the machine — it sent the request with no login, and the provider refused it (401 Unauthorized). Run \`${login}\` there, then send the message again.`;
+  if (failure === 'refused')
+    return `Codex's login on the machine was refused for this chat (401 Unauthorized) — run \`${login}\` there, then send the message again.`;
+  return null;
+}
+
+/** The sentence for tool calls Codex refused for want of an approval, named
+ *  as the turn named them (`server.tool`). Null when there were none. */
+export function codexApprovalSentence(refused) {
+  const names = [...new Set((refused ?? []).filter(Boolean))];
+  const n = (refused ?? []).length;
+  if (!n) return null;
+  const which = names.length ? ` (${names.join(', ')})` : '';
+  return `Codex on the machine refused ${n} tool call${n === 1 ? '' : 's'} in this turn${which} — "MCP tool call requires approval, but approval policy is never" — so nothing ${n === 1 ? 'it' : 'they'} would have done was done.`;
+}
+
+/** A reply with the sentence first and Codex's own words kept under it,
+ *  scrubbed like every reply and cut to the lane's cap. */
+export function withRelay(sentence, raw, cap = 16000) {
+  const words = envScrub(String(raw ?? '')).trim();
+  return (words ? `${sentence}\n\n${words}` : sentence).slice(0, cap);
+}

package/bin/lib/prompts.mjs

@@ -1111,8 +1111,22 @@ ${ARTIFACT_CONTRACT_TAIL({
  * WHICH CONTRACT A TURN RUNS UNDER, by the card's kind. Absent or unknown is
  * code, and code is `SYSTEM_AGENT` — the same object, so a code turn's system
  * prompt is byte-for-byte what it was before kinds existed.
+ *
+ * …AND WHO IT IS SPOKEN TO (0.115.0, 2026-09-29). The mockup, 3D-model and
+ * deck contracts open "You are the human's own Claude" because Claude ran them
+ * alone; Codex runs them now (`codexDesignFence`), and a contract that calls
+ * Codex Claude is the prompt telling the agent something false about itself.
+ * `runtimeLabel` is the CLI's own name ("Codex"); absent, or Claude's, the
+ * contract is the pinned string itself, byte for byte. Only that opening
+ * names a CLI — nothing else in these contracts is Claude's (no tool names,
+ * no flags), so nothing else changes.
  */
-export const SYSTEM_AGENT_FOR = (taskKind) => AGENT_CONTRACTS[agentTaskKindOf(taskKind)];
+const CLAUDE_OPENING = "You are the human's own Claude,";
+export const SYSTEM_AGENT_FOR = (taskKind, runtimeLabel = null) => {
+  const contract = AGENT_CONTRACTS[agentTaskKindOf(taskKind)];
+  if (!runtimeLabel || /^claude\b/i.test(runtimeLabel) || !contract.startsWith(CLAUDE_OPENING)) return contract;
+  return `You are the human's own ${runtimeLabel},${contract.slice(CLAUDE_OPENING.length)}`;
+};
 
 /**
  * THE STRINGS EACH KIND IS HANDED, keyed by the kinds in agentTaskKinds.mjs —

package/bin/lib/runTurn.mjs

@@ -123,6 +123,23 @@ export function runTurn(opts) {
       resolve('');
       return;
     }
+    /**
+     * THE PERSON'S LOGIN, FOR A POSTURE THAT READS NONE OF THEIR CONFIG
+     * (2026-09-29, codexPersonal.mjs). Asked of the runtime that has one
+     * (Codex; Claude reads its own inside its adapter), with the environment
+     * this turn's CLI will run in — its CODEX_HOME is the agent's own when the
+     * lane keeps one — so the file read is the file the CLI would have read.
+     * Its `args` go to the adapter; its `env`, the literal secrets those name,
+     * to the child below and never to argv.
+     */
+    const personal =
+      rt.personal?.({
+        profile: turnProfile.adapterProfile,
+        vaultDir,
+        model,
+        effort,
+        env: { ...process.env, ...(mcpEnv ?? {}) },
+      }) ?? null;
     // Pin the model — never inherit the user's global default (which for Claude
     // may be a 1M/long-context tier their subscription can't bill autonomous
     // work on). A per-task override (chosen in the app, validated server-side
@@ -139,6 +156,7 @@ export function runTurn(opts) {
     // which posture a turn is running under. There is no precedence chain left
     // to get wrong: the caller named one profile (turnProfile.mjs).
     const args = rt.args({
+      personal,
       prompt,
       system,
       model,
@@ -237,7 +255,12 @@ export function runTurn(opts) {
       // this environment, and handing it a curated one signs it out. What it
       // REMOVES is this daemon's machine credential and, for a turn nobody is
       // sitting at, every way to a window — see `cliEnv`.
-      env: cliEnv(mcpEnv, { display: display === true, browserHome: browser?.dir }),
+      // The login's literal secrets first, so nothing of the lane's (its MCP
+      // token, its CODEX_HOME) can be overwritten by one.
+      env: cliEnv(personal?.env ? { ...personal.env, ...(mcpEnv ?? {}) } : mcpEnv, {
+        display: display === true,
+        browserHome: browser?.dir,
+      }),
     });
     if (browser) {
       child.once('close', browser.cleanup);

package/bin/lib/runtimeClaude.mjs

@@ -52,11 +52,14 @@ export const CLAUDE_RUNTIME = {
    * "consult" and "plan" currently mean. That is a statement about where the
    * contract was written, not a claim that only Claude could ever satisfy it.
    */
-  // `design` and `research` (0.97.0) are Claude's alone: each is an
-  // `--allowedTools` list with a PATH-SCOPED write (claudePosture.mjs), and neither
-  // codex's sandbox modes nor agy's flags were measured to express "write
-  // only this directory". A runtime that does not declare them is refused
-  // such a card before spawn, in words — never handed a build turn instead.
+  // `design` and `research` (0.97.0): each is an `--allowedTools` list with a
+  // PATH-SCOPED write (claudePosture.mjs). `research` is Claude's alone;
+  // `design` is Codex's too since 0.115.0 (2026-09-29), whose permission
+  // profile was measured to write only the artifacts directory
+  // (runtimeCodex.mjs `codexDesignFence`). agy's flags cannot express "write
+  // only this directory" (runtimeAntigravity.mjs). A runtime that does not
+  // declare a posture is refused such a card before spawn, in words — never
+  // handed a build turn instead.
   profiles: ['build', 'wiki', 'consult', 'plan', 'design', 'research'],
   /**
    * THE EFFORTS THIS CLI SPELLS — the daemon's copy of the server's

package/bin/lib/runtimeCodex.mjs

@@ -12,8 +12,30 @@
 import { isAbsolute, join } from 'node:path';
 import { SAFE } from './config.mjs';
 import { parseCodexLine } from './runtimeEvents.mjs';
-import { ARTIFACT_DIR } from './artifacts.mjs';
+import { ARTIFACT_DIR, FENCE_TMP_DIR } from './artifacts.mjs';
+import { codexPersonalTurn } from './codexPersonal.mjs';
 
+/**
+ * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
+ * (2026-09-29). The owner's Codex New task chat staged nothing: "flowviant
+ * rejected the tool calls because approval is required and this session's
+ * policy forbids it". MEASURED on codex-cli 0.156.1 with a fake MCP server
+ * whose one tool carries no annotations (Flowviant's carry none): under the
+ * capture chat's read-only argv the call failed "MCP tool call requires
+ * approval, but approval policy is never" and never reached the server; under
+ * the build posture (workspace-write) the same call ran unasked. With
+ * `mcp_servers.flowviant.default_tools_approval_mode="approve"` beside the
+ * read-only argv it ran — and in the same turn a shell write still failed
+ * "Read-only file system" and an escalation still failed "approval policy is
+ * Never; reject command".
+ *
+ * So the approval is this ONE server's, never a blanket `approval_policy`:
+ * what its tools may do is the per-turn token's scope, which the server
+ * enforces (a capture token stages and reads; it files nothing), and every
+ * other door — the shell, file writes, escalation, any other server — keeps
+ * the posture's own rule. Wherever the server is mounted: the capture chat
+ * needs it, and a Terminal tab's build posture already ran the calls.
+ */
 function codexMcp(token, mcpUrl) {
   return {
     dir: null, // nothing written — the token rides in the environment
@@ -22,11 +44,23 @@ function codexMcp(token, mcpUrl) {
       `mcp_servers.flowviant.url="${mcpUrl}"`,
       '-c',
       'mcp_servers.flowviant.bearer_token_env_var="FLOWVIANT_MCP_TOKEN"',
+      '-c',
+      'mcp_servers.flowviant.default_tools_approval_mode="approve"',
     ],
     env: { FLOWVIANT_MCP_TOKEN: token },
   };
 }
 
+/**
+ * THE POSTURES THAT READ NONE OF THE PERSON'S CONFIG — the branches of `args()`
+ * below that pass `--ignore-user-config`, said once so the adapter and its
+ * `personal` hook cannot disagree about which turns carry the person's login
+ * back (codexPersonal.mjs). A wiki turn with no vault is a build turn there,
+ * and so here.
+ */
+export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
+  profile === 'consult' || profile === 'plan' || profile === 'image' || profile === 'design' || (profile === 'wiki' && Boolean(vaultDir));
+
 /**
  * WHAT A FENCED CODEX TURN MAY NOT REACH FOR (0.114.0). codex-cli 0.156.1
  * ships `browser_use` (and its external and full-CDP forms), an in-app
@@ -71,8 +105,13 @@ export const CODEX_RUNTIME = {
    * AND `image` (0.114.0), which ONLY Codex declares: the image card's fence —
    * see the branch in `args()`. It is the one kind posture that is not
    * Claude's, because the pictures come from Codex's own image tool.
+   *
+   * AND `design` (0.115.0), shared with Claude: the mockup, 3D-model and deck
+   * cards' fence, expressed as `codexDesignFence` below. Research is NOT
+   * declared: its web and Codex's whole-box reads cannot be fenced apart
+   * (see that function).
    */
-  profiles: ['build', 'consult', 'wiki', 'plan', 'image'],
+  profiles: ['build', 'consult', 'wiki', 'plan', 'image', 'design'],
   /** `model_reasoning_effort` tops out at `xhigh` — there is no `max`, and a
    *  queued or skewed job naming it would be an argument Codex refuses. */
   efforts: ['low', 'medium', 'high', 'xhigh'],
@@ -102,7 +141,7 @@ export const CODEX_RUNTIME = {
    * placed before it. Appending them after the positional is the kind of argv
    * that parses today and stops parsing on some future clap upgrade.
    */
-  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools }) {
+  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null }) {
     // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
     // agy moves) — codex has no adoptable store wired yet. Reaching here
     // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -163,6 +202,10 @@ export const CODEX_RUNTIME = {
 
       // Sub-agents would be a second turn whose posture nobody here chose.
       a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
+      // Image generation ships ON in codex-cli 0.156.1 even under
+      // --ignore-user-config (measured 2026-09-29): a turn that asked for no
+      // picture is handed no tool that spends image credits.
+      a.push('--disable', 'image_generation');
 
       // HERMETIC. Without these a user's ~/.codex/config.toml, a project
       // `.rules` execpolicy file, or their own MCP servers can widen a posture
@@ -190,6 +233,10 @@ export const CODEX_RUNTIME = {
       a.push('-c', 'sandbox_mode="read-only"');
       a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
       a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
+      // Image generation ships ON in codex-cli 0.156.1 even under
+      // --ignore-user-config (measured 2026-09-29): a turn that asked for no
+      // picture is handed no tool that spends image credits.
+      a.push('--disable', 'image_generation');
       a.push('--ignore-user-config', '--ignore-rules');
     } else if (profile === 'wiki' && vaultDir) {
       // THE CARTOGRAPHER, AND THIS ONE IS STRICTER THAN CLAUDE'S.
@@ -217,6 +264,7 @@ export const CODEX_RUNTIME = {
       // Selected by config: `codex exec` (0.156.1) has no `-P`, so every Codex
       // wiki turn was refused before it started (0.114.0).
       a.push('-c', 'default_permissions="flowviantwiki"');
+      a.push('--disable', 'image_generation');
       a.push(...NO_REACH_OUT);
       a.push('--ignore-user-config', '--ignore-rules');
     } else if (profile === 'image') {
@@ -261,7 +309,12 @@ export const CODEX_RUNTIME = {
       a.push('-c', 'permissions.flowviantimage.extends=":read-only"');
       // The table WHOLE (the wiki branch's reason: a dotted key splits on the
       // dots inside the path), the path as a TOML basic string.
-      a.push('-c', `permissions.flowviantimage.filesystem={${JSON.stringify(artifacts)}="write"}`);
+      // …and the fence's own scratch (2026-09-29, the design fence's
+      // measurement: a `cat > x <<EOF` needs a temp file, and /tmp is
+      // read-only in here), named for the shells through TMPDIR/TMPPREFIX.
+      const scratch = join(cwd, FENCE_TMP_DIR);
+      a.push('-c', `permissions.flowviantimage.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`);
+      a.push('-c', `shell_environment_policy.set={TMPDIR=${JSON.stringify(scratch)},TMPPREFIX=${JSON.stringify(join(scratch, 'zsh'))}}`);
       a.push('-c', 'default_permissions="flowviantimage"');
       a.push(...NO_REACH_OUT);
       // Nobody is on this end of the pipe to approve an escalation.
@@ -272,6 +325,10 @@ export const CODEX_RUNTIME = {
       a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
       a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
       a.push('--ignore-user-config', '--ignore-rules');
+    } else if (profile === 'design') {
+      // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
+      // `codexDesignFence`'s, argued and measured at its definition below.
+      a.push(...codexDesignFence(cwd));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -286,13 +343,117 @@ export const CODEX_RUNTIME = {
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
     }
 
+    /**
+     * …AND THE PERSON'S LOGIN RIDES BACK BESIDE THE FLAG (2026-09-29,
+     * codexPersonal.mjs): where the login lives, the provider and endpoint it
+     * signs into, and the model an unpinned turn runs — `-c` pairs after
+     * `--ignore-user-config`, never a key that widens the posture above.
+     * Keyed on the flag itself, so a fenced branch added later carries the
+     * login the day it ignores the file. `personal` is runTurn's, read where
+     * the turn's Codex will look (the `personal` hook below); a caller that
+     * hands none gets the posture as it was.
+     */
+    if (a.includes('--ignore-user-config')) a.push(...(personal?.args ?? []));
+
     a.push(...mcp, ...resultSchemaArgs);
     a.push(`${system}\n\n---\n\n${prompt}`);
     return a;
   },
+  /**
+   * THE PERSON'S LOGIN FOR A FENCED TURN, read once per spawn by runTurn from
+   * the turn's own environment (its CODEX_HOME — an agent's own home when the
+   * lane keeps one): `{ args, env }`, the `-c` pairs `args()` places and the
+   * literal secrets they name, which ride the child's environment, never argv.
+   * Null for a turn that reads the person's config itself.
+   */
+  personal: ({ profile, vaultDir, env, model, effort } = {}) =>
+    codexIgnoresUserConfig({ profile, vaultDir }) ? codexPersonalTurn({ env, model, effort }) : null,
   parse: parseCodexLine,
   /** `codex exec --output-schema <file>` constrains the FINAL message to a
    *  JSON Schema. Only needed on the mediated path; the direct path reports
    *  through MCP tool calls, which are already structured. */
   resultSchema: (path) => ['--output-schema', path],
 };
+
+/**
+ * THE MOCKUP, 3D-MODEL AND DECK CARDS' FENCE ON CODEX (0.115.0; 2026-09-29, the
+ * owner: "its saying 3d models run on claude only but thats not true").
+ *
+ * The image fence's shape without the image tool: a permission profile that
+ * reads the repo and writes ONLY `<worktree>/.flowviant/artifacts/`, selected
+ * by `default_permissions` (`codex exec` and `exec resume` refuse `-P` on
+ * 0.156.1), no network, no web search, no sub-agents, no browser, computer or
+ * apps, nobody's config or rules, and no approvals to wait on. Nothing about
+ * the card's contract needs more: every one of the three is one HTML page, and
+ * a page's CDN scripts load in the viewer, never on this machine.
+ *
+ * MEASURED on codex-cli 0.156.1 (Linux, bubblewrap), with gpt-6-luna at low
+ * effort, in a scratch git repository (2026-09-29), with exactly this argv:
+ *  · the WRITE FENCE holds for both of Codex's ways to write: its
+ *    `apply_patch` of `src/escape-patch.txt` was refused by Codex itself
+ *    ("patch rejected: writing outside of the project; rejected by user
+ *    approval settings"), and `echo x > src/escape-shell.txt` and
+ *    `echo x > /tmp/fv-escape.txt` each failed "read-only file system";
+ *    `apply_patch` of `.flowviant/artifacts/ok-patch.txt` landed;
+ *  · NO NETWORK: `curl https://example.com` failed "Could not resolve host";
+ *    NO WEB: the model reported no search tool;
+ *  · THE TOOL LIST was `apply_patch`, `clock__curr_time`, `exec_command`,
+ *    `view_image`, `write_stdin` — and `image_gen__imagegen` WITHOUT
+ *    `--disable image_generation`: image generation ships ON in 0.156.1 even
+ *    under `--ignore-user-config`, so it is switched off here by name, and a
+ *    mockup never spends the person's image credits;
+ *  · THE CONTRACTS DELIVER: the real mockup, 3D-model and deck contracts each
+ *    produced their one page under `.flowviant/artifacts/` (the model page
+ *    with its `glb-ready`/`export-glb` handshake and GLTFExporter, the deck
+ *    with its sections, arrow keys and print rules) and changed no repository
+ *    file (`git status` clean but for the ignored directory);
+ *  · THE SCRATCH IS LOAD-BEARING: a deck turn that wrote its page with a
+ *    here-document got "can't create temp file for here document: read-only
+ *    file system", left a 0-byte page and stopped to ask; with the scratch
+ *    granted and named (below) the same here-document wrote the page, and a
+ *    resumed turn (`exec resume <id>` with this argv, as `CODEX_RUNTIME.args`
+ *    builds it) edited it in place.
+ *
+ * STATED, not closed: Codex's permission profile READS the whole box, where
+ * Claude's design list reads only the worktree and the knowledge library. It
+ * cannot be narrowed on 0.156.1 — a `"none"` entry over the home directory
+ * hides Codex's own sandbox helper when Codex is installed there ("bwrap:
+ * execvp …/codex: No such file or directory"), and masking a second FILE
+ * fails every command ("bwrap: Can't write data to file …: Bad file
+ * descriptor"). With the network and the web shut, the one road out is the
+ * artifact itself, which is scrubbed of the machine's known secret values and
+ * of any Flowviant credential by shape on the way up — the image fence's
+ * standing (0.114.0), and why RESEARCH is not declared here: a write-up needs
+ * the web, and a turn that can read `.env` and `~/.flowviant/credentials.json`
+ * while holding `web_search` (both measured readable under this profile with
+ * `web_search="live"`) is the exfiltration Claude's research list was fenced
+ * to prevent.
+ */
+export function codexDesignFence(cwd) {
+  if (!cwd || !isAbsolute(cwd)) {
+    throw new Error("a design turn needs its worktree to fence — none reached codex's builder");
+  }
+  const artifacts = join(cwd, ARTIFACT_DIR);
+  // THE TURN'S OWN SCRATCH (artifacts.mjs `ensureFenceScratch`, made empty by
+  // the lane before spawn): `/tmp` is read-only in here, and a here-document
+  // needs a temp file — measured, a `cat > page.html <<EOF` failed "can't
+  // create temp file for here document: read-only file system" and the turn
+  // stopped to ask. Granted, and named by the two variables the shells read
+  // (`TMPDIR`; zsh's `TMPPREFIX`), set for every command through
+  // `shell_environment_policy.set` — measured to reach the sandboxed shell.
+  const scratch = join(cwd, FENCE_TMP_DIR);
+  return [
+    '-c', 'permissions.flowviantdesign.extends=":read-only"',
+    // The table WHOLE and the path a TOML basic string — the wiki branch's
+    // reason: a dotted key splits on the dots inside the path.
+    '-c', `permissions.flowviantdesign.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`,
+    '-c', `shell_environment_policy.set={TMPDIR=${JSON.stringify(scratch)},TMPPREFIX=${JSON.stringify(join(scratch, 'zsh'))}}`,
+    '-c', 'default_permissions="flowviantdesign"',
+    '-c', 'approval_policy="never"',
+    '--disable', 'image_generation',
+    '-c', 'tools.web_search=false', '-c', 'web_search="disabled"',
+    '-c', 'features.multi_agent=false', '-c', 'features.goals=false',
+    ...NO_REACH_OUT,
+    '--ignore-user-config', '--ignore-rules',
+  ];
+}

package/bin/lib/runtimeEvents.mjs

@@ -277,8 +277,15 @@ function humanizeCodexItem(item = {}, cwd = '') {
       const verb = first.kind === 'add' ? '+' : first.kind === 'delete' ? '-' : '~';
       return { kind: 'write', path: p, label: `${verb} ${tail || 'file'}` };
     }
-    case 'mcp_tool_call':
-      return { kind: 'tool', label: `${item.server ?? 'mcp'}.${item.tool ?? ''}` };
+    case 'mcp_tool_call': {
+      // A FAILED CALL KEEPS ITS OWN WORDS (2026-09-29), beside a label that is
+      // unchanged: codex-cli 0.156.1 closes a call it would not run as
+      // `status: "failed"`, `error.message` "MCP tool call requires approval,
+      // but approval policy is never" (measured), and the tab lane says so
+      // in words (codexRelay.mjs) instead of leaving a chat that staged nothing.
+      const error = String(item.error?.message ?? '');
+      return { kind: 'tool', label: `${item.server ?? 'mcp'}.${item.tool ?? ''}`, ...(error ? { error } : {}) };
+    }
     case 'web_search':
       return { kind: 'search', label: `search ${oneLine(item.query, 60)}` };
     default:

package/bin/lib/turnProfile.mjs

@@ -22,8 +22,9 @@
  *  - design / research / image — a non-code card's posture
  *                (agentTaskKinds.mjs), refused on any runtime that does not
  *                DECLARE it, because every other adapter's fallback is its
- *                build branch. design and research are Claude Code's; image
- *                (0.114.0) is Codex's.
+ *                build branch. research is Claude Code's; design is
+ *                Claude Code's and, since 0.115.0, Codex's; image (0.114.0)
+ *                is Codex's.
  *
  * Claude's permission list for each name lives beside the lists themselves
  * (`claudePermFor`, claudePosture.mjs); this module owns the vocabulary and the

package/bin/lib/workAgentTurnExecution.mjs

@@ -37,7 +37,7 @@ import { CODEX_THREAD_RE } from './workSessionRuntime.mjs';
 import { brainFor } from './workBrain.mjs';
 import { begunTurnRefusal } from './workAgentTurnBegun.mjs';
 import { agentTurnSettlement } from './workAgentTurnOutcome.mjs';
-import { ensureArtifactDir } from './artifacts.mjs';
+import { ensureArtifactDir, ensureFenceScratch } from './artifacts.mjs';
 import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createAgentTurnExecution({
@@ -176,7 +176,8 @@ export function createAgentTurnExecution({
      * posture, which can write ONLY `.flowviant/artifacts/` (claudePosture.mjs).
      *
      * A RUNTIME THAT CANNOT EXPRESS THE POSTURE IS REFUSED, NOT IMPROVISED.
-     * Codex and antigravity declare neither (runtimeCodex.mjs,
+     * Antigravity declares none of them and Codex declares `design` (since
+     * 0.115.0) and `image` but not `research` (runtimeCodex.mjs,
      * runtimeAntigravity.mjs), and the only
      * alternative to refusing is running the card as a BUILD turn with
      * permissions skipped — an agent writing code for an ask that was a
@@ -248,6 +249,23 @@ export function createAgentTurnExecution({
       });
       return;
     }
+    /**
+     * …AND ITS SCRATCH BESIDE IT, EMPTY (0.115.0): a fenced shell's temp files
+     * (a here-document, `mktemp`) go under `.flowviant/tmp`, which Codex's
+     * design fence grants because `/tmp` is read-only in there
+     * (`ensureFenceScratch`). Made for every file kind — one rule, no kind
+     * named — and refused in words where it cannot stand as a real directory.
+     */
+    if (kind.artifact && !ensureFenceScratch(wt)) {
+      await postAgentTurn({
+        turnId,
+        outcome: 'nothing',
+        answer: "this worktree's .flowviant/tmp is not a real directory, so the fenced turn has no scratch to work in",
+        branch,
+        worktree: wt,
+      });
+      return;
+    }
 
     // ONE AGENT IS ONE DIRECTORY, so the CLI's own cwd-keyed resume is exactly
     // right here — the ambiguity that forced per-tab session pinning in the
@@ -469,7 +487,9 @@ export function createAgentTurnExecution({
         // The knowledge paragraph, when this box holds a library — the same
         // composer the tabs use, so an agent and a tab can never be told two
         // different things about the same directory.
-        system: withProjectContext(SYSTEM_AGENT_FOR(taskKind), {
+        // Spoken to the CLI that runs it (0.115.0): a mockup on Codex is
+        // told it is Codex, never Claude.
+        system: withProjectContext(SYSTEM_AGENT_FOR(taskKind, RUNTIMES[rt]?.label), {
           knowledgeDir: knowledgeDirFor(repoRoot),
           // ARTIFACTS (0.94.0), while the server can show one — an agent's
           // land on its page, under the facts row.

package/bin/lib/workSessionTurns.mjs

@@ -42,6 +42,7 @@ import { REPO_PLACE } from './workPlaces.mjs';
 import { CODEX_THREAD_RE, AGY_CONV_RE } from './workSessionRuntime.mjs';
 import { createToolLog } from './workToolLog.mjs';
 import { createCommandAudit } from './workCommandAudit.mjs';
+import { APPROVAL_REFUSED, codexApprovalSentence, codexLoginFailure, codexLoginSentence, withRelay } from './codexRelay.mjs';
 
 /**
  * THE ONE SENTENCE A PLAN TURN'S SYSTEM PROMPT GAINS (0.97.0), composed here
@@ -625,6 +626,11 @@ export function createWorkSessionTurns({
           let out;
           let seenThreadId = null; // codex's conversation id, off thread.started
           let seenClaudeSession = null; // claude's own conversation id, off system.init
+          // What a Codex turn's own events say went wrong (codexRelay.mjs):
+          // whether the agent said anything at all, and each tool call Codex
+          // refused for want of an approval, by `server.tool`.
+          let codexSpoke = false;
+          const approvalRefused = [];
           const spawned = []; // this turn's children, for the teardown registry
           // THE TURN'S TOOL LOG — see workToolLog.mjs for its shape rules.
           const turnLog = createToolLog(dir.wt);
@@ -733,6 +739,12 @@ export function createWorkSessionTurns({
               onActivity: (a) => {
                 narrator.line(a?.label);
                 auditCommand(a);
+                if (a?.kind === 'tool' && APPROVAL_REFUSED.test(a.error ?? '')) approvalRefused.push(a.label);
+              },
+              // One Codex agent MESSAGE (runtimeEvents.mjs `answer`): the turn
+              // spoke, so a 401 in its words is its words, not its failure.
+              onAnswer: (a) => {
+                if (String(a ?? '').trim()) codexSpoke = true;
               },
               // The structured twin of the line above — see toolLog.
               onToolEvent: pushToolEvent,
@@ -949,17 +961,31 @@ export function createWorkSessionTurns({
             rt.id === 'claude' && seenClaudeSession
               ? 'Claude Code ran in this conversation and returned no words — send the message again'
               : 'the turn produced no output on the machine — its CLI may be signed out; try again';
+          /**
+           * A CODEX TURN SAYS WHAT ITS OWN WORDS MEASURED (2026-09-29,
+           * codexRelay.mjs). A turn that never spoke and whose output is a
+           * 401 was not answered: it fails, its sentence first and Codex's
+           * retry log kept under it — it used to settle as the chat's REPLY.
+           * Tool calls Codex refused for want of an approval are named above
+           * whatever the agent said, so a chat that staged nothing says why.
+           */
+          const loginFailure = rt.id === 'codex' && !codexSpoke ? codexLoginFailure(answer) : null;
+          const refusedLine = rt.id === 'codex' ? codexApprovalSentence(approvalRefused) : null;
+          const spoke = answer.length > 0 && !loginFailure;
           await settleTurn(job.id, {
-            ok: answer.length > 0,
-            answer:
-              answer.length > 0
-                ? // Scrub: a reply can quote config or env-adjacent code.
-                  envScrub(answer).slice(0, 16000)
-                : noWords,
+            ok: spoke,
+            answer: loginFailure
+              ? withRelay(codexLoginSentence(loginFailure), answer)
+              : answer.length > 0
+                ? refusedLine
+                  ? withRelay(refusedLine, answer)
+                  : // Scrub: a reply can quote config or env-adjacent code.
+                    envScrub(answer).slice(0, 16000)
+                : (refusedLine ?? noWords),
             // Only a turn that actually SPOKE proves a conversation lives
             // here. Recording the path unconditionally is how a crashed first
             // turn used to brick resume for the session's whole life.
-            ...(answer.length > 0 ? { sessionRef: dir.wt } : {}),
+            ...(spoke ? { sessionRef: dir.wt } : {}),
             // The turn's tool log, in final form — the durable copy that lands
             // on the settled message (the live copy on the record is cleared
             // at settle). Already scrubbed at collection.
@@ -967,7 +993,8 @@ export function createWorkSessionTurns({
             ...(usage ? { usage } : {}),
             ...(model ? { model } : {}),
           });
-          if (answer.length > 0) ok(`${c.cyan('tab')} ${c.dim('— replied in the session')}`);
+          if (spoke) ok(`${c.cyan('tab')} ${c.dim('— replied in the session')}`);
+          else if (loginFailure) warn('codex answered 401 for this session turn — settled as failed, in words');
           else warn('session turn produced no output — settled as failed');
         } catch (e) {
           await settleTurn(job.id, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.114.2",
+  "version": "0.115.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {