flowviant 0.116.0 → 0.117.0

package/bin/lib/procStat.mjs

@@ -0,0 +1,76 @@
+/**
+ * ONE READER OF `/proc/<pid>/stat` (audit 2026-10-10, F050/F089).
+ *
+ * Six modules used to parse this line by hand, each counting its own field
+ * index from "rest[0] is field 3" in a comment. The parse is the whole trap:
+ * field 2 is `comm`, which the kernel wraps in parens and which may contain
+ * BOTH spaces and parens — it is the first 15 bytes of the executable's name,
+ * and a name is not a token. A naive whitespace split taking $22 lands on
+ * `nice` for any such process, and `nice` is a small integer, so the answer
+ * is not a parse error but a plausible-looking "started at boot" that sails
+ * past any isFinite guard. Measured: a binary named `ev (i l) x` read 28308s
+ * too old that way (instance.mjs, which gates a SIGTERM and then a SIGKILL on
+ * this read).
+ *
+ * Every field after `comm` is a number or a single-character state, so no ')'
+ * can appear later: the LAST ')' in the line is always the kernel's own
+ * closing paren, even when comm itself ends in one. Fields are NAMED here so
+ * no caller counts again.
+ *
+ * Linux only, and a leaf: node builtins, nothing of ours. Null on any read or
+ * shape failure — which every caller already read as "cannot tell".
+ */
+
+import { readFileSync } from 'node:fs';
+
+/** Index of each named field in the list AFTER `comm` (index 0 is field 3). */
+const FIELD = Object.freeze({ state: 0, ppid: 1, pgrp: 2, session: 3, tpgid: 5, starttime: 19 });
+
+/** A kernel integer token: digits, with tpgid's `-1` for "no terminal". */
+const int = (token) => (/^-?\d+$/.test(token ?? '') ? Number(token) : null);
+
+/**
+ * The named fields of one `/proc/<pid>/stat` line, or null when the line has
+ * no `comm` close or is too short to carry `starttime` (field 22).
+ */
+export function parseProcStat(text) {
+  if (typeof text !== 'string') return null;
+  const close = text.lastIndexOf(')');
+  if (close < 0) return null;
+  const rest = text.slice(close + 1).trim().split(/\s+/);
+  if (rest.length <= FIELD.starttime) return null;
+  const out = { state: rest[FIELD.state] };
+  for (const name of ['ppid', 'pgrp', 'session', 'tpgid', 'starttime']) {
+    const value = int(rest[FIELD[name]]);
+    if (value === null) return null;
+    out[name] = value;
+  }
+  return out;
+}
+
+/** A pid this reader will put in a path: a positive integer, its digit
+ *  string (what a /proc listing hands back), or 'self'. */
+function procName(pid) {
+  if (pid === 'self') return 'self';
+  if (Number.isSafeInteger(pid) && pid > 0) return String(pid);
+  if (typeof pid === 'string' && /^\d+$/.test(pid) && Number(pid) > 0) return pid;
+  return null;
+}
+
+/**
+ * `{ state, ppid, pgrp, session, tpgid, starttime }` for `pid` (or 'self'),
+ * or null: no such process, no /proc (macOS, hidepid=2, a pid namespace), or
+ * a line this parser does not recognise. `starttime` is in clock ticks since
+ * boot (USER_HZ); `tpgid` is -1 without a controlling terminal.
+ */
+export function procStat(pid, { read = readFileSync } = {}) {
+  const name = procName(pid);
+  if (!name) return null;
+  let text;
+  try {
+    text = read(`/proc/${name}/stat`, 'utf8');
+  } catch {
+    return null;
+  }
+  return parseProcStat(String(text));
+}

package/bin/lib/processGroup.mjs

@@ -0,0 +1,48 @@
+/**
+ * SIGNAL A DETACHED CHILD'S WHOLE PROCESS GROUP, FALLING BACK TO THE CHILD
+ * (2026-10-10, the audit's F086 / F145) — the one home of a block that was
+ * hand-written six times: the project check's timeout, the teardown of a
+ * check, the deploy command's timeout, the async network git call's timeout,
+ * a preview tunnel's stop and the reap of an orphaned tunnel.
+ *
+ * Why the GROUP: the daemon spawns these `detached`, so the child's pid is its
+ * process group, and the child is usually a shell (`shell: true`) or a tool
+ * that starts helpers (git's ssh, cloudflared). Signalling the child alone
+ * leaves what it started running — holding the worktree, its writer lock, or
+ * a pipe the caller is waiting on (workChildren.mjs tells the incident).
+ *
+ * Why the FALLBACK: a group that has already gone, a pid that is not a group
+ * leader, and a platform with no process groups (Windows throws on a negative
+ * pid) all throw on the group signal; the child itself is then signalled.
+ *
+ * NEVER A GROUP THE DAEMON DID NOT START: a pid that is not an integer above 1
+ * signals nothing by number — `kill(-1)` is every process the user owns, and
+ * `kill(0)` is the daemon's own group. Import-free, so git.mjs can use it.
+ *
+ * @param {import('node:child_process').ChildProcess | number} target
+ * @param {NodeJS.Signals} [signal]
+ * @returns {boolean} whether a signal was delivered
+ */
+export function killGroup(target, signal = 'SIGKILL') {
+  const child = target !== null && typeof target === 'object' ? target : null;
+  const pid = child ? child.pid : target;
+  const leader = Number.isInteger(pid) && pid > 1;
+  if (leader) {
+    try {
+      process.kill(-pid, signal);
+      return true;
+    } catch {
+      /* gone, not a leader, or no groups here — the process itself next */
+    }
+  }
+  try {
+    if (child) return child.kill(signal) === true;
+    if (leader) {
+      process.kill(pid, signal);
+      return true;
+    }
+  } catch {
+    /* already gone */
+  }
+  return false;
+}

package/bin/lib/processes.mjs

@@ -47,6 +47,7 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { platform } from 'node:os';
 import { procPids, scanProcs } from './procScan.mjs';
+import { procStat } from './procStat.mjs';
 
 // THE WALK'S BOUND is `procScan.mjs`'s: matched rows collected before the walk
 // stops early — a bound on the WORK done for one pathological group, never on
@@ -69,21 +70,13 @@ export function processesSupported() {
 
 /**
  * `pid (comm) state ppid pgrp …` — comm is arbitrary text and CAN contain a
- * `)`, so the fields are read after the LAST one rather than by splitting the
- * whole line. A process named `foo) bar` is not hypothetical; it is what
- * anything that sets its own title can produce.
+ * `)`, which is why the line is read by procStat.mjs, the one parser that
+ * knows where comm ends. A process named `foo) bar` is not hypothetical; it is
+ * what anything that sets its own title can produce. Null when the pid is gone
+ * between readdir and read — ordinary.
  */
 function pgrpOf(pid) {
-  let stat;
-  try {
-    stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
-  } catch {
-    return null; // gone between readdir and read — ordinary
-  }
-  const close = stat.lastIndexOf(')');
-  if (close < 0) return null;
-  const rest = stat.slice(close + 1).trim().split(/\s+/);
-  const pgrp = Number(rest[2]);
+  const pgrp = procStat(pid)?.pgrp;
   return Number.isInteger(pgrp) && pgrp > 0 ? pgrp : null;
 }
 
@@ -172,18 +165,11 @@ function scanDarwin(pgids) {
 }
 
 /**
- * Live processes in any of `pgids`.
+ * Live processes in any of `pgids`, and the TOTAL the cap was applied to.
  *
- * Returns null where the platform cannot answer — never `[]`, which means
- * "looked, found none" and is a different fact a surface renders differently.
- */
-export function processesInGroups(pgids, { scrub } = {}) {
-  const m = measureProcesses(pgids, { scrub });
-  return m === null ? null : m.rows;
-}
-
-/**
- * …and the TOTAL the cap was applied to.
+ * Returns null where the platform cannot answer — never an empty measurement,
+ * which means "looked, found none" and is a different fact a surface renders
+ * differently.
  *
  * The rows alone are a lie about scale the moment a group has more than twelve
  * members: a dashboard summing them states an incomplete figure as a complete

package/bin/lib/projectToolRuntimes.mjs

@@ -17,7 +17,7 @@
 
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { homedir } from 'node:os';
+import { codexHome } from './codexHome.mjs';
 
 export const toml = (value) => JSON.stringify(String(value));
 
@@ -43,6 +43,72 @@ function linkPersonalEntry(target, link) {
   }
 }
 
+/** A table header's dotted keys, unquoted — null for one this reader cannot
+ *  split, which is then nobody's to strip. */
+function headerKeys(section) {
+  const key = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*(?:\.|$)/y;
+  const keys = [];
+  for (let i = 0; i < section.length; ) {
+    key.lastIndex = i;
+    const m = key.exec(section);
+    if (!m || key.lastIndex === i) return null;
+    try {
+      keys.push(m[1] !== undefined ? JSON.parse(`"${m[1]}"`) : m[2] ?? m[3]);
+    } catch {
+      return null;
+    }
+    i = key.lastIndex;
+  }
+  return keys;
+}
+
+/** The key a `key = …` / `key.sub = …` line defines, unquoted, or null. */
+const lineKey = (line) => {
+  const m = /^\s*(?:"([^"\\]*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*[.=]/.exec(line);
+  return m ? (m[1] ?? m[2] ?? m[3]) : null;
+};
+
+/**
+ * THE REPO'S MCP SERVERS, AS THE AGENT'S OWN CONFIG (2026-10-10, the audit).
+ * A Codex build turn was handed the base branch's servers as `-c` pairs —
+ * `mcp_servers.<n>.env.<K>=<value>`, `…http_headers={…}`, `…url=…` — with
+ * every `${VAR}` already expanded, so a token the repo's `.mcp.json` names
+ * sat in /proc/<pid>/cmdline, every local user's to read, against this
+ * daemon's own rule (codexPersonal.mjs: "A LITERAL SECRET NEVER RIDES
+ * ARGV"). They are written here instead, as tables of the agent's private
+ * CODEX_HOME config.toml (0600, in a 0700 home), which a build turn reads and
+ * every fenced posture ignores (`--ignore-user-config`) — the same turns the
+ * `-c` pairs reached. Written in the shape codexPersonal.mjs's bounded reader
+ * parses, since a fenced turn reads this file for its login.
+ *
+ * SO THE EXPANDED VALUES NOW SIT ON DISK, AND THAT IS STATED (2026-10-10). The
+ * `-c` pairs died with the turn; these tables live as long as the home does.
+ * An agent's home is kept between its turns in the worktree's private git dir
+ * (workAgentTurnExecution.mjs `codexAgentHome`) and goes only with the
+ * worktree, when the agent retires — until then this 0600 file holds every
+ * secret the repo's `.mcp.json` named. Each turn rewrites it whole, so a
+ * server the base branch dropped, or a variable since unset, leaves with the
+ * next turn; a home with no git dir to hold it dies with its turn. NOT DONE:
+ * a URL that would carry an expanded secret is written as any other — refusing
+ * it ('missing') is an open follow-up from the same audit finding (F660).
+ */
+function codexServerTables(servers) {
+  let out = '';
+  for (const [name, server] of Object.entries(servers ?? {})) {
+    out += `\n[mcp_servers.${name}]\n`;
+    if (typeof server.command === 'string') {
+      out += `command = ${toml(server.command)}\nargs = [${(server.args ?? []).map(toml).join(', ')}]\n`;
+      const env = Object.entries(server.env ?? {}).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key));
+      if (env.length) out += `[mcp_servers.${name}.env]\n${env.map(([key, value]) => `${key} = ${toml(value)}`).join('\n')}\n`;
+    } else {
+      out += `url = ${toml(server.url)}\n`;
+      const headers = Object.entries(server.headers ?? {});
+      if (headers.length) out += `[mcp_servers.${name}.http_headers]\n${headers.map(([key, value]) => `${toml(key)} = ${toml(value)}`).join('\n')}\n`;
+    }
+  }
+  return out;
+}
+
 /**
  * Keep personal Codex files, but do not copy its project trust grants. An
  * untrusted worktree's .codex/config.toml is ignored by Codex 0.156.1.
@@ -58,23 +124,39 @@ function linkPersonalEntry(target, link) {
  * worktree's skills can change between turns), and what Codex made here
  * itself under a name the person has not got is kept.
  */
-function isolatedCodexHome(dest, env, worktree) {
-  const source = resolve(env.CODEX_HOME || join(homedir(), '.codex'));
+function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
+  const source = resolve(codexHome(env));
   const configPath = join(source, 'config.toml');
   const sourceConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
   const topLevel = sourceConfig.split(/^\s*\[/m, 1)[0];
   const personalDeveloperInstructions = /^\s*developer_instructions\s*=/m.test(topLevel);
-  // These sections alone grant a checkout permission to supply project
-  // settings. Keep every other personal setting, skill and session store.
+  // The repo's servers replace a personal server of the same name whole —
+  // its `[mcp_servers.<n>…]` tables are dropped below. A personal
+  // `mcp_servers` written inline cannot be told apart line by line, so it
+  // fails closed, as an inline `skills.config` does below.
+  const repoServers = new Set(Object.keys(mcpServers ?? {}));
+  const inline = () => new Error('Cannot isolate Codex project MCP servers beside an inline mcp_servers entry in config.toml');
+  if (repoServers.size && /^\s*["']?mcp_servers["']?\s*[.=]/m.test(topLevel)) throw inline();
+  // The `projects` sections alone grant a checkout permission to supply
+  // project settings. Keep every other personal setting, skill and session
+  // store.
   const lines = sourceConfig.split('\n');
-  let inProject = false;
+  let dropping = false;
+  let inServers = false;
   let config = lines.filter((line) => {
     const header = /^\s*(?:\[\[([^\]]+)\]\]|\[([^\]]+)\])\s*(?:#.*)?$/.exec(line);
     if (header) {
       const section = header[1] ?? header[2];
-      inProject = section === 'projects' || section.startsWith('projects.');
+      const keys = headerKeys(section);
+      inServers = keys?.length === 1 && keys[0] === 'mcp_servers';
+      dropping =
+        section === 'projects' ||
+        section.startsWith('projects.') ||
+        (keys?.[0] === 'mcp_servers' && keys.length > 1 && repoServers.has(keys[1]));
+    } else if (inServers && repoServers.has(lineKey(line))) {
+      throw inline();
     }
-    return !inProject;
+    return !dropping;
   }).join('\n');
   if (worktree) {
     // Codex discovers these even in an untrusted project. Disable exactly the
@@ -92,6 +174,7 @@ function isolatedCodexHome(dest, env, worktree) {
       throw new Error('Cannot isolate Codex project skills with inline skills.config');
     for (const skill of worktreeSkills) config += `\n[[skills.config]]\npath = ${toml(skill)}\nenabled = false\n`;
   }
+  config += codexServerTables(mcpServers);
 
   // The home itself, only once the config is decided: a refused turn touches
   // nothing here. A home that is not a real directory is not ours to write
@@ -139,8 +222,10 @@ function reviewedClaudePlugin(dir, snapshot) {
 /**
  * The table. `refuseMcp(config)` names why this runtime cannot take one MCP
  * configuration it otherwise could; `prepare(dir, snapshot, env, worktree,
- * kept)` returns the runner-specific part of prepareAgentTools' result — under
- * `dir`, which dies with the turn, except what `kept` names a lasting place for.
+ * turn)` returns the runner-specific part of prepareAgentTools' result — under
+ * `dir`, which dies with the turn, except what `turn.codexHome` names a
+ * lasting place for. `turn.mcpServers` is the base branch's servers this
+ * runtime takes, expanded.
  */
 const TOOL_RUNTIMES = {
   claude: {
@@ -156,8 +241,8 @@ const TOOL_RUNTIMES = {
     // The agent's own lasting home when the caller has one (2026-09-29: its
     // threads are indexed under it — see isolatedCodexHome), else one that
     // dies with the turn, as every home did before.
-    prepare: (dir, _snapshot, env, worktree, kept) => {
-      const isolated = isolatedCodexHome(kept?.codexHome ?? join(dir, 'codex-home'), env, worktree);
+    prepare: (dir, _snapshot, env, worktree, turn) => {
+      const isolated = isolatedCodexHome(turn?.codexHome ?? join(dir, 'codex-home'), env, worktree, turn?.mcpServers);
       return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions };
     },
   },
@@ -189,8 +274,8 @@ export function skillsRefusal(runner) {
   return runner === 'none' ? 'no installed CLI can take instructions' : `${runner} cannot take instructions`;
 }
 
-/** The runner-specific files a turn needs, written under `dir` — or, for what
- *  `kept` names, where the caller keeps it between turns. */
-export function prepareForRunner(runner, dir, snapshot, env, worktree, kept = {}) {
-  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, kept) ?? {}) };
+/** The runner-specific files a turn needs, written under `dir` — or, for the
+ *  `codexHome` it names, where the caller keeps it between turns. */
+export function prepareForRunner(runner, dir, snapshot, env, worktree, turn = {}) {
+  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, turn) ?? {}) };
 }

package/bin/lib/projectTools.mjs

@@ -1,27 +1,28 @@
 /** Repo-owned tool configuration, read from the base ref for every agent turn. */
-import { execFileSync } from 'node:child_process';
 import { accessSync, constants, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { delimiter, isAbsolute, join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { mcpRefusal, prepareForRunner, skillsRefusal, toml } from './projectToolRuntimes.mjs';
+import { git, gitRaw, splitNul } from './git.mjs';
+import { withoutMachineCredentials } from './machineEnv.mjs';
+import { mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
 
 const MAX_TOOLS = 40;
 const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
 const MAX_INSTRUCTION_FILES = 80;
 const MAX_INSTRUCTION_BYTES = 512 * 1024;
 const nameOk = (name) => /^[A-Za-z0-9_-]{1,80}$/.test(name) && name !== 'flowviant';
+/** Base-ref reads are QUIET (git's "does not exist in" for an absent file is
+ *  an answer here, not a message for the daemon's terminal) and keep a 1 MiB
+ *  cap per file. */
+const SHOW = Object.freeze({ stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024 });
 const show = (root, ref, path) => {
   try {
-    return execFileSync('git', ['show', `${ref}:${path}`], {
-      cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-    });
+    return gitRaw(['show', `${ref}:${path}`], root, SHOW);
   } catch { return null; }
 };
 const showBytes = (root, ref, path) => {
   try {
-    return execFileSync('git', ['show', `${ref}:${path}`], {
-      cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-    });
+    return gitRaw(['show', `${ref}:${path}`], root, { ...SHOW, encoding: 'buffer' });
   } catch { return null; }
 };
 
@@ -39,11 +40,39 @@ function referenced(value) {
   return [...String(value).matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
 }
 
-export function readBaseTools(root, ref, env = process.env) {
+/**
+ * THE ENVIRONMENT A `${VAR}` IN THE REPO'S `.mcp.json` IS READ FROM: the
+ * caller's, MINUS THE MACHINE CREDENTIAL AND EVERY OTHER `FLOWVIANT_*` NAME,
+ * whatever the caller passed (2026-10-10, the audit). A base-branch
+ * `"url": "https://x/mcp?k=${FLOWVIANT_FLEET}"` delivered the credential this
+ * daemon authenticates with to that host on every agent turn — the
+ * inherited-credential leak machineEnv.mjs exists to close. The daemon's own
+ * names are nobody's repo config to read, so such a server reads as
+ * `missing` ("env FLOWVIANT_FLEET unset").
+ */
+const expansionEnv = (env) =>
+  Object.fromEntries(Object.entries(withoutMachineCredentials(env ?? process.env)).filter(([key]) => !key.startsWith('FLOWVIANT_')));
+
+/**
+ * A TREE LISTING IS NUL-SEPARATED AND SIZED FOR A REAL REPOSITORY (2026-10-10,
+ * the audit). The whole-tree listing that finds nested CLAUDE.md/AGENTS.md ran
+ * under a 1 MiB buffer — about 20k paths — and nothing caught the ENOBUFS, so
+ * EVERY agent turn on a larger repository settled `nothing` before its CLI
+ * started. 64 MiB is workAdoptCarry.mjs's precedent; MAX_INSTRUCTION_FILES and
+ * MAX_INSTRUCTION_BYTES stay the real bounds. `-z` because git C-quotes a path
+ * that is not plain ASCII (`"d\303\251j\303\240/CLAUDE.md"`), which the name
+ * filter never matched (git.mjs's `-z` rule).
+ */
+const LIST_MAX_BUFFER = 64 * 1024 * 1024;
+const listTree = (root, args) =>
+  splitNul(gitRaw(['ls-tree', '-r', '-z', '--name-only', ...args], root, {
+    stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: LIST_MAX_BUFFER,
+  }));
+
+export function readBaseTools(root, ref, callerEnv = process.env) {
+  const env = expansionEnv(callerEnv);
   // Resolve once: a base branch may advance while the turn is being prepared.
-  const commit = execFileSync('git', ['rev-parse', '--verify', ref], {
-    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-  }).trim();
+  const commit = git(['rev-parse', '--verify', ref], root, { stdio: ['ignore', 'pipe', 'ignore'] });
   const raw = show(root, commit, '.mcp.json');
   let servers = {};
   if (raw != null) {
@@ -53,9 +82,7 @@ export function readBaseTools(root, ref, env = process.env) {
   const skills = [];
   const skillFiles = [];
   try {
-    const paths = execFileSync('git', ['ls-tree', '-r', '--name-only', commit, '--', '.claude/skills'], {
-      cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-    }).split('\n');
+    const paths = listTree(root, [commit, '--', '.claude/skills']);
     let bytes = 0;
     for (const path of paths) {
       if (!/^\.claude\/skills\/[A-Za-z0-9_-]+\/(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+$/.test(path)) continue;
@@ -82,9 +109,7 @@ export function readBaseTools(root, ref, env = process.env) {
   // Nested instructions are normally discovered when a CLI enters that path.
   // Their worktree copies must not regain authority through that discovery.
   const instructions = [];
-  const paths = execFileSync('git', ['ls-tree', '-r', '--name-only', commit], {
-    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-  }).split('\n').filter((path) => /(^|\/)(CLAUDE|AGENTS)\.md$/.test(path));
+  const paths = listTree(root, [commit]).filter((path) => /(^|\/)(CLAUDE|AGENTS)\.md$/.test(path));
   if (paths.length > MAX_INSTRUCTION_FILES) throw new Error('Base branch has too many agent instruction files');
   let instructionBytes = 0;
   for (const path of paths) {
@@ -107,32 +132,26 @@ const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]
  * removed by `cleanup`, because Codex indexes a thread under the home it ran
  * in and the next card resumes that thread. Absent, a Codex turn gets a home
  * that dies with it.
+ *
+ * NO EXPANDED VALUE RIDES ARGV (2026-10-10, the audit): Claude's servers go
+ * to this turn's 0600 mcp.json, Codex's into the isolated home's config.toml
+ * (projectToolRuntimes.mjs) — never `-c` pairs on the command line.
  */
-export function prepareAgentTools(snapshot, runner, env = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
+export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
+  const env = expansionEnv(callerEnv);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
   const mcpServers = {};
-  const codexArgs = [];
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
       const command = expand(config.command, env);
       const args = Array.isArray(config.args) ? config.args.map((v) => expand(v, env)) : [];
       const vars = Object.fromEntries(Object.entries(config.env ?? {}).map(([k, v]) => [k, expand(v, env)]));
       mcpServers[name] = { command, args, env: vars };
-      codexArgs.push('-c', `mcp_servers.${name}.command=${toml(command)}`);
-      codexArgs.push('-c', `mcp_servers.${name}.args=${JSON.stringify(args)}`);
-      for (const [key, value] of Object.entries(vars)) {
-        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) codexArgs.push('-c', `mcp_servers.${name}.env.${key}=${toml(value)}`);
-      }
     } else if (typeof config.url === 'string') {
       const url = expand(config.url, env);
       const headers = Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v, env)]));
       mcpServers[name] = { type: config.type ?? 'http', url, ...(Object.keys(headers).length ? { headers } : {}) };
-      codexArgs.push('-c', `mcp_servers.${name}.url=${toml(url)}`);
-      if (Object.keys(headers).length) {
-        const inline = Object.entries(headers).map(([key, value]) => `${toml(key)}=${toml(value)}`).join(',');
-        codexArgs.push('-c', `mcp_servers.${name}.http_headers={${inline}}`);
-      }
     }
   }
   const mcpPath = join(dir, 'mcp.json');
@@ -150,7 +169,7 @@ export function prepareAgentTools(snapshot, runner, env = process.env, worktree
   ].filter(Boolean).join('\n\n');
   let prepared;
   try {
-    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome });
+    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome, mcpServers });
   } catch (error) {
     rmSync(dir, { recursive: true, force: true });
     throw error;
@@ -158,7 +177,6 @@ export function prepareAgentTools(snapshot, runner, env = process.env, worktree
   const { pluginDir, codexHome, personalDeveloperInstructions } = prepared;
   return {
     mcpPath,
-    codexArgs,
     instructions,
     pluginDir,
     codexHome,

package/bin/lib/prompts.mjs

@@ -209,6 +209,23 @@ const fence = (label, content) =>
   `${String(content ?? '').replace(/<<<|>>>/g, (m) => m.split('').join('\u200b'))}\n` +
   `<<<END ${label}>>>`;
 
+/** One line, capped — a title or name is a server string headed into a
+ *  prompt, and a line break would forge a second entry (a reference, a
+ *  `- id:` row, a `brief:` line). Above every use (2026-10-10): it was declared
+ *  far below the builders that call it. Every line break Unicode names, not
+ *  only `\r` and `\n`: a U+2028 starts a line as surely as `\n` does. */
+const oneLine = (v, max) => String(v ?? '').replace(/[\r\n\v\f\u0085\u2028\u2029]+/g, ' ').trim().slice(0, max);
+
+/**
+ * A CARD ID FIT TO PRINT OUTSIDE THE FENCE (2026-10-10, the audit). The commit
+ * trailer is OUR instruction, after the card's fence closes, and a card id is
+ * a doc key a member can write — the server checks only its length, so a
+ * newline and a sentence ride in it. A plain token (what the server mints is
+ * a UUID) prints as it is; anything else prints nothing, and the trailer
+ * paragraph is not said, as it is not on a card with nothing to commit.
+ */
+const trailerId = (id) => (typeof id === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(id) ? id : '');
+
 
 
 
@@ -373,11 +390,14 @@ MECHANICS OF THIS TAB:
    \`\`\`
 
    ONE block per reply, and always the LAST thing in it. Two to eight options,
-   each label short enough to sit on a button. multiSelect true only for a
-   genuine check-several-of-these case. NEVER for an open question — ask those
-   in prose, like anyone would. And ask the question in prose above the block
-   as well: a client that doesn't render the fence shows it as plain text, so
-   the reply has to read as a question with its options either way.
+   each label short enough to sit on a button — a few words, never a comma
+   (multi-select answers arrive as the chosen labels comma-joined, in the order
+   listed). Do NOT add an "Other" option — the card offers a free-text path
+   itself. multiSelect true only for a genuine check-several-of-these case.
+   NEVER for an open question — ask those in prose, like anyone would. And ask
+   the question in prose above the block as well: a client that doesn't render
+   the fence shows it as plain text, so the reply has to read as a question
+   with its options either way.
 
 THERE IS NO LATER. Your turn ends when you stop writing, and nothing of yours
 runs after that — so never promise to report back, keep watching, or tell them
@@ -651,11 +671,12 @@ export const WORK_TURN_KICKOFF_PLAIN = ({ sessionName, message, askedByName }) =
  * REPORTER's ticket title verbatim, so a stranger can put words in it. That
  * string rides the ship report into `code_map_reground_jobs`, comes back on the
  * roster, and landed here as a bare `Feature: <text>` line — no delimiter, no
- * instruction not to obey it. This turn runs UNATTENDED under `WIKI_PERM`,
- * which grants Write, Edit, `Bash(mkdir:*)` and `Bash(rm:*)`, and whose own
- * comment concedes that Write/Edit cannot be path-scoped here — the worktree
- * reset is the backstop, and it only cleans the wiki worktree. Anything written
- * outside it survives.
+ * instruction not to obey it. This turn runs UNATTENDED, with `Bash(mkdir:*)`
+ * and `Bash(rm:*)` and a write to the vault — every page of which is uploaded
+ * to the project's wiki. Since 2026-10-10 Claude's list scopes that write to
+ * the vault and fences its reads (claudePosture.mjs `wikiPermFor`), but the
+ * fence here is still the prompt's half: what the turn WRITES into the vault
+ * is what members read.
  *
  * The predicted pages come off the roster exactly as the title does — a
  * planner wrote them from card text, and card text is member-authored — so an
@@ -886,7 +907,9 @@ export const AGENT_PLAN_KICKOFF = ({ tasks, liveAgents, agentCap }) => {
   const cards = tasks
     .map(
       (t) =>
-        `- id: ${t.id}\n  title: ${t.title}\n` +
+        // THE TITLE ON ONE LINE (2026-10-10): a member writes it, and a line
+        // break in it forged a second `- id:` row inside the fence.
+        `- id: ${t.id}\n  title: ${oneLine(t.title, 300)}\n` +
         // EVERY card says its kind, code included — the planner is splitting
         // by it (SYSTEM_PLAN rule 8), and an absent line would read as "not
         // stated" rather than as the default. Absent on the wire IS code.
@@ -1170,9 +1193,11 @@ export const AGENT_TASK_KICKOFF = ({ agentName, task, cardThread, cardFiles, pos
       `on this branch. Everything you commit here is reviewed and merged TOGETHER with ` +
       `the other cards in this run.\n\n` +
       `${fence('THE CARD', taskBlock(task, cardThread, cardFiles))}\n\n` +
-      `When you commit, put this trailer on the LAST line of each commit message so ` +
-      `the card can find its own commits:\n` +
-      `Flowviant-Task: ${task?.id ?? ''}\n\n` +
+      (trailerId(task?.id)
+        ? `When you commit, put this trailer on the LAST line of each commit message so ` +
+          `the card can find its own commits:\n` +
+          `Flowviant-Task: ${trailerId(task?.id)}\n\n`
+        : '') +
       `Do it, commit it, and end with the JSON object.`
     : // A NON-CODE CARD (0.97.0; 3D model and presentation 0.105.0; image 0.114.0) has nothing to commit, so the trailer
       // paragraph — an instruction to do the one thing its contract forbids —
@@ -1211,7 +1236,8 @@ const safeName = (n) =>
  */
 export const AGENT_TASK_SPEC = (task, cardThread, cardFiles) =>
   `id: ${task?.id ?? ''}\n` +
-  `title: ${task?.title ?? ''}\n` +
+  // On one line (2026-10-10): a line break forged a `brief:` or `done when:`.
+  `title: ${oneLine(task?.title, 300)}\n` +
   // THE KIND, when it is news (0.97.0). A code card's spec stays byte-for-byte
   // what it was — the reviewer's stash and the agent's prompt both read this,
   // and a line saying "kind: code" on every card is a change to every prompt
@@ -1324,10 +1350,6 @@ const cardFilesText = (files) => {
  *  The server has sent `designs/<slug>-vN/` since 0.99.0, and the folder list
  *  this file used to spell for itself dropped every one until 0.105.0. */
 const isReference = (r) => !!r && isLibraryReference(r.name) && typeof r.title === 'string';
-/** One line, capped — a reference title is a server string headed into a
- *  prompt, and a line break would forge a second entry. */
-const oneLine = (v, max) => String(v ?? '').replace(/[\r\n]+/g, ' ').trim().slice(0, max);
-
 const taskBlock = AGENT_TASK_SPEC;
 
 /**

package/bin/lib/repoPath.mjs

@@ -11,6 +11,7 @@
  * deleted checkout still matches the lock or entry that names it.
  */
 import { realpathSync } from 'node:fs';
+import { sep } from 'node:path';
 
 /** Same directory, whatever it is spelled as. A blank side matches nothing. */
 export function samePath(a, b) {
@@ -24,3 +25,21 @@ export function samePath(a, b) {
   };
   return norm(a) === norm(b);
 }
+
+/**
+ * `p` IS `root` OR INSIDE IT — a pure prefix test on already-RESOLVED absolute
+ * paths, never a sibling that merely shares the prefix (`/repo-other` is not
+ * inside `/repo`). No filesystem: each caller resolves (or deliberately keeps
+ * a literal) before asking.
+ *
+ * One predicate for the fences that decide on it (audit 2026-10-10, F106 /
+ * F161): the adopt fence offered and accepted on both sides (localSessions.mjs)
+ * and the listener attribution behind a public preview tunnel (procScan.mjs's
+ * insideDir). Three hand copies meant a containment fix — a root of `/`, a
+ * case-insensitive filesystem — had to land three times or the fences would
+ * disagree about the same path.
+ */
+export function isPathInside(p, root) {
+  if (typeof p !== 'string' || typeof root !== 'string') return false;
+  return p === root || p.startsWith(root.endsWith(sep) ? root : root + sep);
+}