flowviant 0.115.0 → 0.117.0

package/README.md

@@ -1,6 +1,6 @@
 # flowviant
 
-Run your own coding CLIs as build agents for [Flowviant](https://flowviant.com) — [Claude Code](https://claude.com/claude-code), Codex or Antigravity, on your own credentials. This daemon holds your sessions, keeps a worktree per tab, and ships branches on your word. Flowviant never sees your Claude, Codex or GitHub logins.
+Run your own coding CLIs as build agents for [Flowviant](https://flowviant.com) — [Claude Code](https://claude.com/claude-code), Codex or Antigravity, on your own credentials. This daemon holds your sessions, keeps a worktree per tab, and ships branches on your word. The daemon does not send your Claude, Codex or GitHub logins to Flowviant; it shells out to CLIs you signed in yourself.
 
 ```sh
 curl -fsSL https://api.flowviant.com/install.sh | sh
@@ -15,7 +15,7 @@ A Flowviant project has ONE machine, and this is it: one box, running one Claude
 
 You work in the **Workbench**, where your sessions are TABS — each one a held context plus a persistent git worktree on its own `session/<id>` branch. The browser is a terminal projected onto this machine, so you reach the same session from any device. When you say ship, the tab merges its own branch into base with `--no-ff` — no squash, so the commit shas the work reported still exist on main.
 
-Because it drives the CLIs you're already logged into, **the cost is yours** (your Claude subscription, your GitHub) and **the daemon never handles a credential** — it shells out to tools you authenticated yourself.
+Because it drives the CLIs you're already logged into, **the cost is yours** (your Claude subscription, your GitHub) and **the daemon does not send your logins** — it shells out to tools you authenticated yourself, and reads Claude Code's credential file only for its expiry and plan type. What a turn prints is relayed as printed, after redaction (see [Security posture](#security-posture)).
 
 ## Requirements
 
@@ -102,7 +102,7 @@ From **0.86.0**, a project whose owner turns on **Publish agent branches** has e
 
 ## Sharing a preview
 
-You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed) behind a **mandatory password gate**. Flowviant stores only the tunnel URL; your browser talks to it directly. Since 0.72.0 the gate also lets the Workbench embed the share in a frame: it rewrites the response's frame policy to permit exactly the app's origin, and a framed sign-in gets a partitioned cookie so it works where third-party cookies are blocked.
+You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed), behind the daemon's own gate. Viewers reach the share through Flowviant's relay at `<name>.flowviant.dev`, never the tunnel's own address, and the gate admits only the share's password or a short-lived grant signed with the share's key. Flowviant stores that key and the password with the share, and its relay mints grants for signed-in project members — or for anyone with the link, if the share's owner opens it to everyone. Since 0.72.0 the gate also lets the Workbench embed the share in a frame: it rewrites the response's frame policy to permit exactly the app's origin, and a framed sign-in gets a partitioned cookie so it works where third-party cookies are blocked.
 
 The daemon never executes anything the repository declares. An earlier version read a `.flowviant/preview.json` from the branch and spawned the command it named — that start path was removed in 0.53.0 and is not coming back; see the header of `bin/lib/preview.mjs` for exactly what it did, so nobody rebuilds it.
 
@@ -111,7 +111,7 @@ The daemon never executes anything the repository declares. An earlier version r
 | Env | What runs |
 | --- | --- |
 | _(stored login)_ or `FLOWVIANT_MACHINE_TOKEN` (`FLOWVIANT_FLEET` still read) | **the daemon** — the project's machine, serving its sessions |
-| `FLOWVIANT_SAFE=1` | restrict the toolset instead of running unattended |
+| `FLOWVIANT_SAFE=1` | a permission list instead of running unattended (not a sandbox — see below) |
 
 ## Not freezing the box
 
@@ -133,7 +133,7 @@ Workbench tab executes a coding agent with the daemon's own OS permissions.
 Membership is the consent boundary, the same trust plane as the shared
 repository: invite people you would give a shell to.
 
-Two knobs bound the blast radius, and both are worth setting on a shared box:
+Two knobs are worth setting on a shared box, and only the first is a boundary:
 
 - **Run the daemon under a dedicated OS user** that owns only the repository
   checkout and `~/.flowviant`. This is the single biggest hardening available
@@ -141,19 +141,38 @@ Two knobs bound the blast radius, and both are worth setting on a shared box:
   home directory, or the rest of the machine. A plain separate account works;
   a systemd unit with `ProtectHome=read-only` and `ReadWritePaths=` works
   better.
-- **`FLOWVIANT_SAFE=1`** narrows the toolset: Claude to an allowlist
-  (edit/read/search plus `git`/`gh`/`npm`/`bun` — no arbitrary shell), Codex
-  to a workspace-write sandbox. Antigravity has no per-invocation narrowing —
-  its permission engine is machine-wide — which is surfaced in the app rather
-  than papered over.
+- **`FLOWVIANT_SAFE=1`** replaces unattended mode with a permission list for
+  Claude (edit/read/search plus `git`, `gh`, `npm` and `bun`) and a
+  workspace-write sandbox for Codex. Those programs can run arbitrary code
+  themselves (scripts, hooks, `bun -e`), so this narrows what a confused agent
+  reaches for; it is not a sandbox. The dedicated OS user is the boundary.
+  Antigravity has no per-invocation narrowing — its permission engine is
+  machine-wide — which is surfaced in the app rather than papered over.
+
+What leaves the box is redacted. Before it posts what a turn
+printed (answers, narration, tool calls, commands, the trace, artifacts, wiki
+notes, deploy and check output, commit diffs), the daemon replaces the values in
+your checkout's root `.env*` files and in the env files a deploy copies, the
+deploy and CLI credentials in its own environment, your Codex provider's
+secrets, its own Flowviant credential, and well-known token shapes (Anthropic,
+OpenAI, GitHub, AWS, Slack, OAuth token fields, PEM private keys) with
+`[REDACTED:NAME]`. A value that does not look generated (a short one, a word, a
+hostname, a lowercase hex string) is left as it is, and a secret in none of
+those is relayed as printed. What your CLI writes through Flowviant's own tools
+(such as a tab's progress messages and purpose line, or the cards a New task
+chat stages) goes from the CLI to Flowviant, not through the daemon, as written.
+The full list, and the exact test for what looks generated, are in
+[SECURITY.md](./SECURITY.md#what-is-redacted).
 
 Fenced turns — design, 3D-model, deck and research cards, the pre-review,
 the planner, intake, the wiki and the New task chat — read none of your Claude
 Code settings files: their permissions and hooks are Flowviant's posture
 alone, and of `~/.claude/settings.json` they keep only how Claude signs in
-(`apiKeyHelper`, `env` and the like) and your model defaults. Code agents and
+(`apiKeyHelper`, `env` and the like) and your model defaults — handed to Claude
+in a file only your user can read (`~/.flowviant/run/`, removed when the turn
+ends), never on the command line, where every local user could read it. Code agents and
 Terminal tabs still read yours, so your own allow rules and `defaultMode` add
-to `FLOWVIANT_SAFE=1`'s allowlist there. Codex's fenced turns run with
+to `FLOWVIANT_SAFE=1`'s permission list there. Codex's fenced turns run with
 `--ignore-user-config` the same way.
 
 The posture is reported on every poll and shown in the project's

package/bin/cli.mjs

@@ -104,7 +104,7 @@ if (dirAt >= 0 && commandUsesCheckout(process.argv[2])) {
 const { CREDENTIAL, VERSION } = await import('./lib/config.mjs');
 const { runFleetDaemon } = await import('./lib/fleet.mjs');
 const { runLogin } = await import('./lib/login.mjs');
-const { launchCommand, terminalCommand } = await import('./lib/launchCommand.mjs');
+const { launchCommand, relaunchSelf, selfArgv, terminalCommand } = await import('./lib/launchCommand.mjs');
 
 if (process.argv.includes('--remote') && !(process.argv[2] === 'status' && process.argv.includes('--json'))) {
   console.error('error: --remote requires status --json');
@@ -159,19 +159,14 @@ async function loginCommand() {
   // Re-exec as a plain `flowviant` rather than falling through. config.mjs reads
   // the credential at IMPORT time — which was before the login we just did — so
   // this process still has an empty FLEET_TOKEN and would exit with "no
-  // credential found" seconds after saving one. Same shape as the self-update
-  // re-exec: stay alive as a thin proxy so the user's shell keeps one foreground
-  // process.
-  const { spawn } = await import('node:child_process');
-  const startArgs = process.argv[1]?.startsWith('/$bunfs/') ? [] : [process.argv[1]];
-  const child = spawn(process.execPath, [...startArgs, ...(json ? ['--json-events'] : [])], {
-    stdio: 'inherit',
-    env: process.env,
-  });
-  // AWAIT it. Registering an exit handler and falling through would run the rest
-  // of this file in the parent — which has no credential — and print "no
-  // credential found" over the daemon that just started in the child.
-  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
+  // credential found" seconds after saving one. The one relaunch proxy
+  // (launchCommand.mjs) keeps this process alive as the child's stand-in, so the
+  // user's shell keeps one foreground process.
+  // AWAIT it: it ends this process with the child's exit code, so the await
+  // never returns. Falling through would run the rest of this file in the
+  // parent — which has no credential — and print "no credential found" over
+  // the daemon that just started in the child.
+  await relaunchSelf({ argv: selfArgv(json ? ['--json-events'] : []), env: process.env });
 }
 
 // `flowviant status` — each project connected here. `--json` is the tray's
@@ -242,13 +237,14 @@ async function ghAuthCommand() {
 // blocks re-adding a path.
 async function cleanCommand() {
   const { rmSync, existsSync } = await import('node:fs');
-  const { join } = await import('node:path');
-  const { homedir } = await import('node:os');
   const { execFileSync } = await import('node:child_process');
+  // The root the daemon keys every checkout's worktree home under — the one
+  // derivation (statePaths.mjs), so this sweeps exactly the daemon's directory.
+  const { worktreesRoot } = await import('./lib/statePaths.mjs');
   // Also reap any preview dev-server/tunnel groups a crashed daemon left running.
   const { reapOrphanPreviews } = await import('./lib/previewRegistry.mjs');
   reapOrphanPreviews((m) => console.log(m));
-  const dir = join(homedir(), '.flowviant', 'worktrees');
+  const dir = worktreesRoot();
   if (!existsSync(dir)) {
     console.log('nothing to clean — no worktrees at ~/.flowviant/worktrees.');
     process.exit(0);

package/bin/lib/admission.mjs

@@ -79,7 +79,7 @@
  * idempotent so doing both is the normal case rather than a bug.
  */
 
-import { MAX_CONCURRENT, MAX_CONCURRENT_FROM_ENV } from './config.mjs';
+import { MAX_CONCURRENT, MAX_CONCURRENT_FROM_ENV, clampTurnCeiling } from './config.mjs';
 import { measurePressure } from './resources.mjs';
 import { pressureVerdict, readPressureThresholds } from './pressurePolicy.mjs';
 
@@ -126,15 +126,11 @@ export function livePressureVerdict(level, { measure = measurePressure, env = pr
  *    sentinel number that could be mistaken for a bound.
  *
  * Pure, and exported, so the order can be proved without a server, a poll or a
- * box of any particular size.
+ * box of any particular size. Each author is read through config.mjs's one
+ * `clampTurnCeiling` (2026-10-10, audit F070).
  */
 export function pickMaxTurns({ env = null, server = null, derived = 1 } = {}) {
-  const clamp = (n) => {
-    const v = Number(n);
-    if (!Number.isFinite(v) || v < 1) return null;
-    return Math.min(Math.floor(v), 32);
-  };
-  return clamp(env) ?? clamp(server) ?? clamp(derived) ?? 1;
+  return clampTurnCeiling(env) ?? clampTurnCeiling(server) ?? clampTurnCeiling(derived) ?? 1;
 }
 
 /**
@@ -164,8 +160,7 @@ let serverMaxTurns = null;
  *    dial back to Auto would be unspellable.
  */
 export function setServerMaxTurns(raw) {
-  const v = Number(raw);
-  serverMaxTurns = Number.isFinite(v) && v >= 1 ? Math.min(Math.floor(v), 32) : null;
+  serverMaxTurns = clampTurnCeiling(raw);
   return serverMaxTurns;
 }
 
@@ -206,10 +201,8 @@ export function createAdmission({
      * unguarded spawn loop that froze somebody's computer. The local derivation
      * is the one value in this process that cannot be garbage.
      */
-    const asked =
-      typeof maxConcurrent === 'function' ? Number(maxConcurrent()) : Number(maxConcurrent);
-    const ceiling =
-      Number.isFinite(asked) && asked >= 1 ? Math.min(Math.floor(asked), 32) : MAX_CONCURRENT;
+    const asked = typeof maxConcurrent === 'function' ? maxConcurrent() : maxConcurrent;
+    const ceiling = clampTurnCeiling(asked) ?? MAX_CONCURRENT;
     if (live >= ceiling)
       return {
         reason: `the machine is already running ${live} CLI turn${live === 1 ? '' : 's'}`,

package/bin/lib/agentInternalWait.mjs

@@ -0,0 +1,83 @@
+/** Recover a CLI that yielded to its own background work, inside the original
+ * turn and place writer lock. Tool requests establish intent; prose is never
+ * classified. No new server turn is created and no intermediate settle is sent.
+ * The bounded recovery either finishes, asks a real question, or throws a
+ * measured failure for the lane's existing one-shot settlement. */
+import { parseTurnResult } from './agentPlan.mjs';
+import { limitLine } from './cliLimit.mjs';
+
+export const INTERNAL_WAIT_RECOVERIES = 2;
+export const INTERNAL_WAIT_CONTRACT = `Your own command or test still running is internal work, never a human blocker.
+Wait using the command's completion/read tools, read its result, finish the card
+and commit before returning the final JSON. A progress update is not a final
+answer. Do not end the CLI to await a background notification or ScheduleWakeup:
+this unattended runner does not deliver those after the CLI exits. Only a real
+person-only decision or unavailable input belongs in blocked.question.`;
+
+export async function runAgentWithInternalWaits(run, options) {
+  let thread = options.resumeThreadId;
+  let total = null;
+  for (let attempt = 0; ; attempt++) {
+    let requestedWait = false;
+    let exitCode = null;
+    let exitSignal = null;
+    let cliFailed = false;
+    let lastAnswer = null;
+    let currentUsage = null;
+    const combine = () => {
+      if (!currentUsage) return total;
+      return Object.fromEntries(['input', 'output', 'cacheCreate', 'cacheRead'].map((k) =>
+        [k, (total?.[k] ?? 0) + (currentUsage[k] ?? 0)]));
+    };
+    const out = await run({
+      ...options,
+      ...(attempt ? {
+        resume: Boolean(thread),
+        resumeThreadId: thread,
+        prompt: `${options.prompt ?? ''}\n\nContinue THIS SAME CARD after yielding to internal work. Inspect the existing\nbackground command/task and read its result; do not restart a still-running test suite or\nstart a duplicate command. If the CLI killed the background job, confirm that\nfrom its task status/output before rerunning the required check. Use completion/read tools until it finishes. Then\nfinish the work, check the result and commit. ${INTERNAL_WAIT_CONTRACT}`,
+      } : {}),
+      onCliFailure: () => {
+        cliFailed = true;
+        options.onCliFailure?.();
+      },
+      onExit: (code, signal) => {
+        exitCode = code;
+        exitSignal = signal;
+        options.onExit?.(code, signal);
+      },
+      onInit: (init) => {
+        if (typeof init.sessionId === 'string') thread = init.sessionId;
+        options.onInit?.(init);
+      },
+      onThreadId: (id) => {
+        thread = id;
+        options.onThreadId?.(id);
+      },
+      onAnswer: (text) => {
+        lastAnswer = text;
+        options.onAnswer?.(text);
+      },
+      onUsage: (usage) => {
+        currentUsage = usage;
+        options.onUsage?.(combine());
+      },
+      onToolEvent: (name, input) => {
+        // The actual incident was ScheduleWakeup(noop:true) after Bash returned
+        // a background task id. No tool-name guesses or sentence matching.
+        if ((name === 'ScheduleWakeup' && input?.noop === true) ||
+            (name === 'Bash' && input?.run_in_background === true) ||
+            (name === 'TaskOutput' && input?.block === true)) requestedWait = true;
+        options.onToolEvent?.(name, input);
+      },
+    }, attempt > 0);
+    total = combine();
+    // A declared question/delivery always wins. Missing JSON alone never
+    // retries. A crash/signal/limit cannot be disguised by an earlier wait.
+    if (parseTurnResult(lastAnswer ?? out) || !requestedWait || exitCode !== 0 ||
+        exitSignal || cliFailed || limitLine(out)) return out;
+    if (attempt >= INTERNAL_WAIT_RECOVERIES)
+      throw new Error('internal wait recovery exhausted: the CLI exited without a result after two continuations on the same card');
+    if (!thread) throw new Error('internal wait recovery could not resume: the CLI reported no session id');
+    options.onContinuation?.(attempt + 1);
+  }
+}

package/bin/lib/agentPlan.mjs

@@ -25,9 +25,10 @@
  * Run: node --test bin/lib/agentPlan.test.mjs
  */
 
-// THE UPLINK SCRUBBER, as the DEFAULT for the two readers whose every string
-// goes to the server (2026-09-24, the audit). See `parseTurnResult`.
-import { scrub as envScrub } from './uplinkScrub.mjs';
+// THE UPLINK SCRUBBER, as the DEFAULT for the three readers whose every string
+// goes to the server (2026-09-24, the audit; the precheck joined 2026-10-10).
+// See `parseTurnResult`. `scrubCut` is the scrub-then-cut order, spelled once.
+import { scrub as envScrub, scrubCut } from './uplinkScrub.mjs';
 
 /** The biggest a single proposal may be. Bounds on a machine, not a policy:
  *  the server caps these again at its own boundary. */
@@ -68,7 +69,8 @@ const MAX_NOTE = 1000;
  * none of which a real answer comes near:
  *
  *  · only the LAST `MAX_SCAN_CHARS` are scanned — every contract here puts the
- *    object LAST, and the fenced block is still looked for in the whole text;
+ *    object LAST, and the fenced block is still looked for in the whole text,
+ *    by a LINEAR scan (`fencedBody`) since 2026-10-10;
  *  · each `{`'s closing brace is found ONCE (see `closers`), so the scan is a
  *    single right-to-left pass instead of one walk per brace;
  *  · only spans that can open an object (`{` then a key or `}`) are handed to
@@ -90,10 +92,10 @@ const MAX_NESTED_PARSES = 200;
 const MAX_NESTED_CHARS = 4 * 1024 * 1024;
 
 export function candidateObjects(text) {
-  const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  const fenced = fencedBody(text);
   const raw = text.length > MAX_SCAN_CHARS ? text.slice(text.length - MAX_SCAN_CHARS) : text;
   const bodies = [];
-  if (fenced) bodies.push(fenced[1]);
+  if (fenced !== null) bodies.push(fenced);
   const close = closers(raw);
   let topEnd = -1;
   let nestedParses = 0;
@@ -125,6 +127,35 @@ export function candidateObjects(text) {
   return out;
 }
 
+/**
+ * THE FIRST FENCED BLOCK'S BODY, or null — what
+ * `text.match(/```(?:json)?\s*([\s\S]*?)```/)[1]` answered, found in ONE
+ * forward pass (2026-10-10, the audit's F079).
+ *
+ * That regex ran over the WHOLE text — the only search the `MAX_SCAN_CHARS`
+ * bound above skipped — and it backtracks quadratically on an opening fence
+ * followed by a long whitespace run with no closing fence: the greedy `\s*` and
+ * the lazy body re-scan the run from every split. Measured: 80 KB took 0.6 s,
+ * 320 KB nine seconds, of synchronous CPU in which no poll, lease or other
+ * lane moved — and a turn's stdout is model-written and uncapped. Same
+ * answer, by `indexOf`: the first ``` anywhere, an optional `json`, the
+ * whitespace after it skipped, and the body runs to the next ```. If that
+ * opening has no closer, no later opening can have one either, so there is no
+ * fence. The search stays over the whole text, as the bound above promises.
+ */
+const FENCE_SPACE = /\s*/y;
+function fencedBody(text) {
+  const open = text.indexOf('```');
+  if (open < 0) return null;
+  let at = open + 3;
+  if (text.startsWith('json', at)) at += 4;
+  FENCE_SPACE.lastIndex = at;
+  FENCE_SPACE.exec(text);
+  at = FENCE_SPACE.lastIndex;
+  const close = text.indexOf('```', at);
+  return close < 0 ? null : text.slice(at, close);
+}
+
 /**
  * For every `{`, the index of the `}` that closes it when read as the START of
  * an object (outside any string), or -1 — the answer `balanced` gives, for all
@@ -186,7 +217,7 @@ export function parseProposal(text, scrub = envScrub) {
     if (taskIds.length === 0) continue;
     agents.push({
       tempId: String(g.tempId || `a${i + 1}`).slice(0, 64),
-      name: String(scrub(String(g.name ?? ''))).slice(0, MAX_NAME),
+      name: scrubCut(g.name, MAX_NAME, scrub),
       taskIds,
       ...(Number.isFinite(g.pointsBudget) && g.pointsBudget > 0
         ? { pointsBudget: Math.min(Math.round(g.pointsBudget), 100_000) }
@@ -221,7 +252,7 @@ export function parseProposal(text, scrub = envScrub) {
   return {
     agents: uniqueTempIds(agents),
     ...(typeof parsed.note === 'string' && parsed.note.trim()
-      ? { note: String(scrub(parsed.note)).slice(0, MAX_NOTE) }
+      ? { note: scrubCut(parsed.note, MAX_NOTE, scrub) }
       : {}),
   };
 }
@@ -284,7 +315,7 @@ function uniqueTempIds(list) {
 const MAX_PROGRESS = 8000;
 const progressOf = (v, scrub) => {
   const t = typeof v.progress === 'string' ? v.progress.trim() : '';
-  return t ? { progress: String(scrub(t)).slice(0, MAX_PROGRESS) } : {};
+  return t ? { progress: scrubCut(t, MAX_PROGRESS, scrub) } : {};
 };
 
 /**
@@ -337,14 +368,14 @@ const progressOf = (v, scrub) => {
  * its prefix. So the scrub rides in, as `parsePrecheck`'s does, and runs over
  * each whole field first.
  *
- * DEFAULTED TO THE REAL SCRUBBER, unlike the precheck's identity default: the
- * production callers pass nothing, and a redaction that depends on each caller
- * remembering is the one that is missing the day it matters. Scrubbing twice
- * (the caller still scrubs `answer`) is harmless — a redaction marker contains
- * no secret to match.
+ * DEFAULTED TO THE REAL SCRUBBER, like `parseProposal` and (since 2026-10-10)
+ * `parsePrecheck`: the production callers pass nothing, and a redaction that
+ * depends on each caller remembering is the one that is missing the day it
+ * matters. Scrubbing twice (the caller still scrubs `answer`) is harmless — a
+ * redaction marker contains no secret to match.
  */
 export function parseTurnResult(text, scrub = envScrub) {
-  const clean = (s, cap) => String(scrub(s)).slice(0, cap);
+  const clean = (s, cap) => scrubCut(s, cap, scrub);
   for (const v of candidateObjects(String(text ?? ''))) {
     if (v.status === 'blocked') {
       const question = typeof v.question === 'string' ? v.question.trim() : '';
@@ -416,11 +447,15 @@ const MAX_PRECHECK_OVERALL = 1200;
  * line is the ordinary way to reach it. The fix is `toolEventOf`'s: the scrub
  * rides INTO the builder and runs over the whole field, before the cap.
  *
- * DEFAULTED TO IDENTITY so the parser stays testable on its own, and so a
- * caller that forgets loses redaction rather than the whole reading — but the
- * ONE production caller passes `envScrub`, and `work.test.mjs` pins the order.
+ * DEFAULTED TO THE REAL SCRUBBER (2026-10-10, the audit's F072), like its two
+ * neighbours. It used to default to identity "so a caller that forgets loses
+ * redaction rather than the whole reading" — the opposite stance from
+ * `parseTurnResult`'s for the same class of model-written text, and a
+ * redaction that depends on each caller remembering is the one that is missing
+ * the day it matters. Tests that want the raw reading pass identity; the one
+ * production caller passes `envScrub`, and `work.test.mjs` pins the order.
  */
-export function parsePrecheck(text, scrub = (s) => s) {
+export function parsePrecheck(text, scrub = envScrub) {
   const parsed = candidateObjects(String(text ?? '')).find((v) => Array.isArray(v.cards));
   if (!parsed) return null;
 
@@ -434,14 +469,11 @@ export function parsePrecheck(text, scrub = (s) => s) {
     seen.add(taskId);
     // SCRUB, THEN CUT — see the docblock. The whole field is in hand here, so an
     // exact-value match still finds a secret that spans the cap.
-    const note =
-      typeof c.note === 'string' ? scrub(c.note.trim()).slice(0, MAX_PRECHECK_NOTE) : '';
+    const note = typeof c.note === 'string' ? scrubCut(c.note.trim(), MAX_PRECHECK_NOTE, scrub) : '';
     cards.push({ taskId, verdict: c.verdict, ...(note ? { note } : {}) });
   }
   const overall =
-    typeof parsed.overall === 'string'
-      ? scrub(parsed.overall.trim()).slice(0, MAX_PRECHECK_OVERALL)
-      : '';
+    typeof parsed.overall === 'string' ? scrubCut(parsed.overall.trim(), MAX_PRECHECK_OVERALL, scrub) : '';
   /**
    * AN ANSWER THAT SAYS NOTHING IS NOT AN ANSWER. No readable card verdict and
    * no overall means the model produced the right punctuation and no content —

package/bin/lib/agentPublish.mjs

@@ -27,7 +27,7 @@
  * SHAPE, never a path, never a value that reaches argv unread.
  */
 
-import { isSafePathSegment } from './git.mjs';
+import { isValidSha, sessionBranchRef, stripUrlUserinfo } from './git.mjs';
 
 /**
  * THE SHAPE A PUBLISHED REF MAY HAVE — the server's own `PUBLISH_REF_RE`,
@@ -52,19 +52,19 @@ export function isPublishRef(ref) {
   return typeof ref === 'string' && PUBLISH_REF_RE.test(ref);
 }
 
-/** The local branch an agent works on. One definition, so a push, a fetch and
- *  the begun-guard's own `rev-parse` can never name three different branches. */
-export function agentBranchRef(place) {
-  return isSafePathSegment(place) ? `refs/heads/session/${place}` : null;
-}
+/** The local branch an agent works on. One definition — git.mjs's
+ *  `sessionBranchRef`, the same name the cutter and the begun-guard read — so
+ *  a push, a fetch and the guard's own `rev-parse` can never name three
+ *  different branches. */
+export const agentBranchRef = sessionBranchRef;
 
 /** A sha this machine MEASURED, in the one form `rev-parse` prints. The lease
  *  below is built from nothing else: an unrecognised value is treated as no
- *  observation at all rather than interpolated into argv. */
-const SHA_RE = /^[0-9a-f]{7,40}$/;
-export function isSha(v) {
-  return typeof v === 'string' && SHA_RE.test(v);
-}
+ *  observation at all rather than interpolated into argv. git.mjs's
+ *  `isValidSha`, re-exported under the name this module's readers use — it
+ *  was a verbatim copy of that regex, so a tightening could land in one and
+ *  not the other (audit 2026-10-10, F749). */
+export const isSha = isValidSha;
 
 /**
  * PUSH THIS AGENT'S BRANCH TO ITS PUBLISHED NAME.
@@ -153,8 +153,7 @@ export function publishDeleteArgs(ref) {
  */
 const DIAGNOSTIC_RE = /^(fatal:|error:|remote:|!)|\b(denied|rejected|refused)\b/i;
 export function publishErrorText(raw) {
-  const lines = String(raw ?? '')
-    .replace(/\/\/[^/@\s]+@/g, '//')
+  const lines = stripUrlUserinfo(raw)
     .split('\n')
     .map((l) => l.trim())
     .filter(Boolean);

package/bin/lib/agentTaskKinds.mjs

@@ -37,9 +37,9 @@
  *  which Claude and — since 0.115.0 — Codex declare (2026-09-29, measured:
  *  runtimeCodex.mjs `codexDesignFence`). */
 const DESIGN_CLIS = 'mockup, 3D model and presentation cards run on Claude or Codex on this machine';
-/** The write-up kind runs on Claude alone: Codex cannot fence the web it needs
- *  apart from the whole-box reads its sandbox allows (same place). */
-const CLAUDE_ONLY = 'write-up cards run on Claude on this machine';
+/** Write-ups run on Claude or isolated Codex (0.117.0); the copied input view
+ *  keeps host credentials outside the web-enabled tool fence. */
+const RESEARCH_CLIS = 'write-up cards run on Claude or Codex on this machine';
 /** The image kind runs on Codex: the one CLI that declares its posture, because
  *  the pictures come from Codex's own image tool on its own login. */
 const CODEX_ONLY = 'image cards run on Codex on this machine';
@@ -109,7 +109,7 @@ export const AGENT_TASK_KINDS = Object.freeze({
       match: /\.md$/i,
       missing: 'the turn ended without writing a write-up under .flowviant/artifacts/',
     }),
-    offRuntime: () => CLAUDE_ONLY,
+    offRuntime: () => RESEARCH_CLIS,
   }),
 });
 
@@ -144,9 +144,6 @@ export const unknownAgentTaskKind = (v) =>
     ? null
     : String(v).replace(/[\u0000-\u001f\u007f]/g, '').slice(0, 40);
 
-/** The table entry for a kind value, read the printing way (unknown → code). */
-export const agentTaskKind = (v) => AGENT_TASK_KINDS[agentTaskKindOf(v)];
-
 /** The postures only a card's kind selects (every kind's but code's), each
  *  once: the 3D-model and presentation kinds reuse the design posture; the
  *  image kind has its own. */

package/bin/lib/agySessions.mjs

@@ -13,6 +13,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { procPids, scanProcs } from './procScan.mjs';
+import { AGY_CONV_RE } from './conversationIds.mjs';
 
 // agy's store is nothing like Claude's: one SQLite db per conversation at
 // ~/.gemini/antigravity-cli/conversations/<uuid>.db (global, not cwd-keyed),
@@ -24,13 +25,12 @@ import { procPids, scanProcs } from './procScan.mjs';
 // the person at that keyboard, i.e. the one worth offering to adopt.
 
 const AGY_DIR = () => join(homedir(), '.gemini', 'antigravity-cli');
-const AGY_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 /** Newest write to the conversation's store — the wal carries recent turns,
  *  so its mtime (not the db's) is the real "last active" (measured: a resume
  *  touched db+wal, and never the presence lock). 0 = no such conversation. */
 function agyLastWriteMs(id) {
-  if (!AGY_UUID_RE.test(id)) return 0;
+  if (!AGY_CONV_RE.test(id)) return 0;
   let newest = 0;
   for (const suffix of ['.db', '.db-wal']) {
     try {
@@ -121,7 +121,7 @@ export function scanAgyConversations({ ours, mine, cutoff, processAlive = agyPro
     if (!map || typeof map !== 'object') return out;
     const processUp = processAlive();
     for (const [cwd, id] of Object.entries(map)) {
-      if (typeof id !== 'string' || !AGY_UUID_RE.test(id)) continue;
+      if (typeof id !== 'string' || !AGY_CONV_RE.test(id)) continue;
       // The operator's own agy TAB, whose conversation is registered against
       // the checkout exactly as a terminal one would be.
       if (mine.has(id)) continue;