flowviant 0.116.0 → 0.117.0

package/bin/lib/runtimeAntigravity.mjs

@@ -136,6 +136,16 @@ export const ANTIGRAVITY_RUNTIME = {
   /** No measured ladder, and ignorance never refuses: the full list, as the
    *  server's `RUNTIME_EFFORTS.antigravity` keeps it. */
   efforts: ['low', 'medium', 'high', 'xhigh', 'max'],
+  /**
+   * A TERMINAL TAB ON AGY RUNS PLAIN (audit 2026-10-10, F159; see
+   * runtimeClaude.mjs for the three facts): no MCP to mount — no credential,
+   * no cards, no streaming; the answer lands through the daemon's own report.
+   * No plan mode. Adoption MOVES the conversation (`--conversation <id>`,
+   * below): agy has no fork, so the tab continues the terminal's own store.
+   */
+  tab: 'plain',
+  planTurns: false,
+  adopt: 'move',
   mcp: null,
   args({ prompt, system, model, effort, resume, resumeConversationId, profile = 'build', vaultDir, resultSchemaArgs = [], adoptResumeId }) {
     const a = [];
@@ -158,8 +168,10 @@ export const ANTIGRAVITY_RUNTIME = {
     a.push(...resultSchemaArgs);
 
     if (profile === 'wiki') {
-      // THE CARTOGRAPHER, at the same bar WIKI_PERM sets for Claude — writes
-      // allowed, network shut. Both halves measured on 1.1.12:
+      // THE CARTOGRAPHER, at the bar Claude's old wiki list set — writes
+      // allowed, network shut. (Claude's list scopes the write to the vault
+      // since 2026-10-10; agy's flags cannot express "write only this
+      // directory", so this one does not.) Both halves measured on 1.1.12:
       //   • headless cannot prompt, so anything needing approval is
       //     auto-denied — including the file writes a wiki turn exists to
       //     make. `--dangerously-skip-permissions` is what grants them.
@@ -169,9 +181,8 @@ export const ANTIGRAVITY_RUNTIME = {
       // auto-approving the sandbox-bypass prompt). It does NOT reproduce on
       // 1.1.12 — tested together, the write landed and the network stayed
       // shut. Re-check on upgrade: if it ever does cancel, this posture
-      // silently becomes "wiki turn with internet", which is the one line
-      // WIKI_PERM draws ("Command execution is the line: it enables network
-      // exfil").
+      // silently becomes "wiki turn with internet" — and the vault it writes
+      // is uploaded either way.
       if (vaultDir) a.push('--add-dir', vaultDir);
       a.push('--sandbox', '--dangerously-skip-permissions');
       // A sweep reads a whole repository; the 5m default would guillotine it.

package/bin/lib/runtimeCapabilities.mjs

@@ -16,6 +16,9 @@ import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { RUNTIMES } from './runtimes.mjs';
+import { unattendedEnv } from './noWindowEnv.mjs';
+import { claudeProjectDir } from './claudeSessions.mjs';
+import { CLAUDE_SESSION_RE } from './conversationIds.mjs';
 
 /**
  * WHAT THE CLI SAID IT CAN BE ASKED FOR BY NAME — the machine's skills.
@@ -103,29 +106,83 @@ export function knownSkills() {
 let mcpServersCache = null;
 
 export const MCP_STATUSES = new Set(['connected', 'failed', 'needs-auth', 'pending']);
+/** The server's own bounds (shared `MAX_MACHINE_MCP_SERVERS` and
+ *  `MCP_SERVER_NAME_MAX`); scripts/check-app-parity.mjs holds them equal. */
 export const MAX_MCP_SERVERS = 40;
 export const MCP_NAME_MAX = 60;
+/** The name charset the server's Codex report parser admits
+ *  (runtimeOfferings.ts `name`) — Claude's report has none, and its connector
+ *  names carry a space (`claude.ai Gmail`). */
+export const CODEX_MCP_NAME = /^[A-Za-z0-9_.:-]+$/;
 
-export function recordMcpServers(list) {
-  if (!Array.isArray(list)) return;
+/**
+ * ONE SHAPE FOR EVERY MCP REPORT THAT LEAVES THE BOX (2026-10-10, the audit)
+ * — Claude's `mcp` off a turn's init, and Codex's `rtp.codex`
+ * (runtimeOfferings.mjs) — bounded exactly as the server re-applies it, so
+ * nothing is cut silently at the boundary: names trimmed and CLIPPED at
+ * MCP_NAME_MAX (never dropped for length), `charset` when the server's parser
+ * has one, this daemon's own `flowviant` and every `connected` server dropped
+ * (see the header), the first of a name kept, sorted, at most
+ * MAX_MCP_SERVERS. A status off the closed list is `other`. `entries` are
+ * `{ name, status }`.
+ */
+export function normalizeMcpReport(entries, { charset = null } = {}) {
   const seen = new Map();
-  for (const e of list) {
+  for (const e of Array.isArray(entries) ? entries : []) {
     if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
     const n = e.name.trim().slice(0, MCP_NAME_MAX).trim();
     if (!n || n === 'flowviant' || seen.has(n)) continue;
+    if (charset && !charset.test(n)) continue;
     if (e.status === 'connected') continue; // see the header: never relayed
     seen.set(n, { n, s: MCP_STATUSES.has(e.status) ? e.status : 'other' });
   }
-  mcpServersCache = [...seen.values()]
+  return [...seen.values()]
     .sort((a, b) => (a.n < b.n ? -1 : a.n > b.n ? 1 : 0))
     .slice(0, MAX_MCP_SERVERS);
 }
 
+export function recordMcpServers(list) {
+  if (!Array.isArray(list)) return;
+  mcpServersCache = normalizeMcpReport(list);
+}
+
 /** What to send on the roster poll as `mcp` — null until a turn has taught us. */
 export function knownMcpServers() {
   return mcpServersCache;
 }
 
+/**
+ * WHICH TURNS ARE A MEASUREMENT OF THE MACHINE (2026-10-10, the audit) —
+ * asked by runTurn.mjs, the one spawn point, of the argv the adapter built.
+ *
+ * Every report above is "last turn wins", so a turn whose CLI was told to see
+ * less than the machine has must not be recorded: a fenced turn
+ * (`--setting-sources ''` — the planner, the wiki, the capture chat, a design
+ * card) reads no personal or project skills, and an agent's code turn reads
+ * `--setting-sources user` plus the reviewed `--plugin-dir`; a
+ * `--strict-mcp-config` turn mounts only what its argv names. Recorded, each
+ * wrote its narrowed list over the machine's — a claude.ai connector that
+ * needs a sign-in vanished from the Machines page until the next tab turn put
+ * it back. ANY NAMED SOURCE LIST NARROWS MCP TOO, strict or not: the person's
+ * plugins ride the user file (claudePersonal.mjs), so an empty list drops
+ * their servers, and a project `.mcp.json` is admitted by the project and
+ * local files. The capture chat is fenced but not strict — gated on strict
+ * alone, its init still wrote over the machine's report. So skills are
+ * harvested only off a turn that names no setting source and no plugin, MCP
+ * only off one that names no setting source and is not strict, and both only
+ * off Claude Code, whose init carries them. A box that runs only agents
+ * learns from the startup probe and its Terminal tabs.
+ */
+export function initHarvestFor(rt, args) {
+  const argv = Array.isArray(args) ? args : [];
+  const claude = rt?.id === 'claude';
+  const sourcesNamed = argv.includes('--setting-sources');
+  return {
+    skills: claude && !sourcesNamed && !argv.includes('--plugin-dir'),
+    mcp: claude && !sourcesNamed && !argv.includes('--strict-mcp-config'),
+  };
+}
+
 /**
  * LEARN WHAT `/` CAN OFFER, ON A MACHINE NO TURN HAS TAUGHT.
  *
@@ -189,10 +246,20 @@ const SKILL_PROBE_MAX_LINES = 20;
 
 let skillProbeStarted = false;
 
-/** Where Claude Code keeps a transcript for `cwd`: `/` and `.` both become `-`. */
+/**
+ * Where Claude Code keeps a transcript for `cwd`: its own directory rule,
+ * `claudeProjectDir` (claudeSessions.mjs), first.
+ *
+ * ONE RULE, NOT TWO (2026-10-10, the audit). This spelled the munge itself as
+ * `replace(/[/.]/g, '-')` — the rule claudeSessions.mjs retired on 2026-09-24
+ * because it disagrees with Claude Code for any path holding a character other
+ * than a letter, digit, `/` or `.` — so a checkout at `~/code/my_app` built the
+ * wrong primary path and every removal fell through to the scan below. The
+ * store's root is unchanged: `~/.claude`, as it was.
+ */
 function transcriptCandidates(cwd, sessionId) {
   const base = join(homedir(), '.claude', 'projects');
-  const out = [join(base, cwd.replace(/[/.]/g, '-'), `${sessionId}.jsonl`)];
+  const out = [join(base, claudeProjectDir(cwd), `${sessionId}.jsonl`)];
   // The munge is Claude Code's, not ours, so a version that changes it must not
   // leave the file behind: fall back to finding our own session id by name.
   try {
@@ -207,15 +274,15 @@ function transcriptCandidates(cwd, sessionId) {
  * Delete the transcript a headless `-p` turn left behind.
  *
  * EXPORTED because the skills probe is no longer the only thing that runs one:
- * resolving a project's dev command is a background Claude turn too, and every
- * such turn has the same footprint. `claude -p` writes
- * `~/.claude/projects/<munged-cwd>/<id>.jsonl` at startup, and
+ * the planner, the pre-review and intake each run a read-only consult turn
+ * (workCappedTurn.mjs), and every such turn has the same footprint.
+ * `claude -p` writes `~/.claude/projects/<munged-cwd>/<id>.jsonl` at startup, and
  * `claudeSessions.mjs` offers the newest ENDED session per directory as
  * ADOPTABLE — so anything we run for our own purposes would put a phantom
  * untitled session in somebody's `+` menu.
  */
 export function removeProbeTranscript(cwd, sessionId) {
-  if (!sessionId || !/^[A-Za-z0-9_-]{8,64}$/.test(sessionId)) return;
+  if (!sessionId || !CLAUDE_SESSION_RE.test(sessionId)) return;
   for (const f of transcriptCandidates(cwd, sessionId)) {
     try {
       if (existsSync(f)) {
@@ -228,6 +295,21 @@ export function removeProbeTranscript(cwd, sessionId) {
   }
 }
 
+/**
+ * REMOVE IT SOON, NOT NOW — the one spelling of the delayed removal every
+ * headless turn of ours keeps (the skills probe here, and the capped consult
+ * turn of workCappedTurn.mjs that the planner, the pre-review and intake run).
+ *
+ * AFTER the kill and ON A DELAY: the transcript is the CHILD's file, so
+ * deleting it while the child is still dying races a recreate. Unref'd — a
+ * cleanup must never hold the process open. A turn that never named its
+ * conversation has nothing of ours to remove.
+ */
+export function removeTranscriptSoon(cwd, sessionId, ms = 750) {
+  if (!sessionId) return;
+  setTimeout(() => removeProbeTranscript(cwd, sessionId), ms).unref?.();
+}
+
 /**
  * One line of the probe's stdout → the init event's payload, or null for "not
  * it, keep reading".
@@ -261,25 +343,50 @@ export function parseInitLine(line) {
   };
 }
 
+/**
+ * THE PROBE IS AN UNATTENDED CLAUDE SESSION, AND RUNS AS ONE (2026-10-10, the
+ * audit). It runs in the operator's checkout at every daemon start, and its
+ * `claude` started the person's stdio MCP servers and fired SessionStart hooks
+ * — the checkout's `.claude/settings.json` ones included, which fire even in
+ * an untrusted workspace (decisions.md, 2026-09-29) — with the daemon's whole
+ * environment, the machine credential in it. So:
+ *  · its environment is every unattended child's (`unattendedEnv`): no
+ *    machine credential, no display;
+ *  · `disableAllHooks` rides a FLAG setting, which outranks the user and
+ *    project files — and only hooks go: the probe mirrors what a Terminal tab
+ *    sees, so no `--setting-sources` narrowing. MEASURED on Claude Code
+ *    2.1.296, offline: with the flag, neither a personal nor a project
+ *    SessionStart hook started (no `hook_started`), and the init still named
+ *    the personal and the project skill;
+ *  · its own process group, killed whole when it finishes, so nothing it
+ *    started — an MCP server, a backgrounded hook — outlives the probe.
+ */
+export const SKILL_PROBE_ARGS = Object.freeze([
+  '-p', 'x', '--model', 'haiku', '--output-format', 'stream-json', '--verbose',
+  '--settings', JSON.stringify({ disableAllHooks: true }),
+]);
+
 /**
  * Kick off the one-shot probe. Returns immediately; the result lands in
  * `skillsCache` and rides the NEXT poll, so nothing waits on it.
  *
  * A no-op once a turn has taught us (`skillsCache !== null`) — a turn's init
- * event and this one say the same thing, and the turn is free.
+ * event and this one say the same thing, and the turn is free. `spawn` is a
+ * test's.
  */
-export function probeSkillsOnce(cwd) {
+export function probeSkillsOnce(cwd, { spawn: spawnChild = spawn } = {}) {
   if (skillProbeStarted || skillsCache !== null) return;
   skillProbeStarted = true;
   let child;
   try {
     // Claude Code specifically, not the `wiki` profile's runtime pick: `skills`
     // is Claude Code's own field and the `/` tray only renders for claude tabs.
-    child = spawn(
-      RUNTIMES.claude.bin,
-      ['-p', 'x', '--model', 'haiku', '--output-format', 'stream-json', '--verbose'],
-      { cwd, stdio: ['ignore', 'pipe', 'ignore'] }
-    );
+    child = spawnChild(RUNTIMES.claude.bin, [...SKILL_PROBE_ARGS], {
+      cwd,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      detached: true,
+      env: unattendedEnv(),
+    });
   } catch {
     return; // no claude on PATH — the machine simply stays unmeasured
   }
@@ -290,14 +397,20 @@ export function probeSkillsOnce(cwd) {
     if (settled) return;
     settled = true;
     clearTimeout(timer);
+    // The whole group: what the CLI started goes with it.
     try {
-      child.kill('SIGKILL');
+      if (child.pid) process.kill(-child.pid, 'SIGKILL');
+      else child.kill('SIGKILL');
     } catch {
-      /* already gone */
+      try {
+        child.kill('SIGKILL');
+      } catch {
+        /* already gone */
+      }
     }
     // AFTER the kill, and on a delay: the transcript is the CHILD's file, so
     // deleting it while the child still lives races a recreate.
-    if (sessionId) setTimeout(() => removeProbeTranscript(cwd, sessionId), 750).unref?.();
+    removeTranscriptSoon(cwd, sessionId);
   };
   const timer = setTimeout(() => finish(null), SKILL_PROBE_TIMEOUT_MS);
   timer.unref?.();
@@ -332,3 +445,10 @@ export function probeSkillsOnce(cwd) {
     if (!settled && buf.length > 1_000_000) finish(null);
   });
 }
+
+/** Tests only: forget what was learned, and that the probe ran. */
+export function resetCapabilitiesForTest() {
+  skillsCache = null;
+  mcpServersCache = null;
+  skillProbeStarted = false;
+}

package/bin/lib/runtimeClaude.mjs

@@ -14,7 +14,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
-import { NO_SETTING_SOURCES, personalClaudeSettings, withPersonalSettings } from './claudePersonal.mjs';
+import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings } from './claudePersonal.mjs';
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -53,7 +53,8 @@ export const CLAUDE_RUNTIME = {
    * contract was written, not a claim that only Claude could ever satisfy it.
    */
   // `design` and `research` (0.97.0): each is an `--allowedTools` list with a
-  // PATH-SCOPED write (claudePosture.mjs). `research` is Claude's alone;
+  // PATH-SCOPED write (claudePosture.mjs). `research` is Codex's too since
+  // 0.117.0, over an isolated copy (codexResearch.mjs);
   // `design` is Codex's too since 0.115.0 (2026-09-29), whose permission
   // profile was measured to write only the artifacts directory
   // (runtimeCodex.mjs `codexDesignFence`). agy's flags cannot express "write
@@ -70,13 +71,41 @@ export const CLAUDE_RUNTIME = {
    * fails when any runtime's row differs from the server's.
    */
   efforts: ['low', 'medium', 'high', 'xhigh', 'max'],
+  /**
+   * HOW A TERMINAL TAB SPEAKS ON THIS CLI (audit 2026-10-10, F159) — the
+   * facts the session turn's shape reads (workTurnShape.mjs), declared on the
+   * row instead of spelled as an id check in the lane. Daemon-internal:
+   * runtimeDetection maps rows to fields of its own, so none of this is on
+   * the wire.
+   *   tab: 'mcp' — the session tools ride a per-invocation MCP config.
+   *   planTurns — a tab's plan turn can run here: `--permission-mode plan`
+   *     is Claude Code's own switch (claudePosture.mjs, PLAN_MODE_PERM). Not
+   *     named `planMode`, the retired runTurn switch (turnProfile.mjs,
+   *     RETIRED_POSTURE_KEYS), so no spelling of it reads as one.
+   *   adopt: 'fork' — a terminal conversation is forked into the tab's
+   *     worktree (`--resume <id> --fork-session`).
+   */
+  tab: 'mcp',
+  planTurns: true,
+  adopt: 'fork',
   mcp: claudeMcp,
   /**
    * Claude takes the operating contract as a real system prompt, which is the
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools, personalSettings }) {
+  args({ prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings }) {
+    // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
+    // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
+    // with no vault, or one no rule can name, has no list — refused here in
+    // words, as Codex's builder refuses an image turn with no worktree, and
+    // never run on a list it did not build.
+    if (profile === 'wiki' && !vaultDir) {
+      throw new Error("a wiki turn needs its vault to fence — none reached claude's builder");
+    }
+    if (profile === 'wiki' && !Array.isArray(perm)) {
+      throw new Error(`a wiki turn's vault must be a path a Claude Code permission rule can name — ${JSON.stringify(vaultDir)} is not`);
+    }
     const a = [];
     // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
     // are mutually exclusive, never combined.
@@ -132,6 +161,14 @@ export const CLAUDE_RUNTIME = {
      */
     const fenced = profile !== 'build';
     if (fenced) a.push(...NO_SETTING_SOURCES);
+    // A FENCED POSTURE NAMES ITS OWN MODE (2026-10-10). Its lists fence only
+    // under the CLI's `default` mode, where a tool the list does not name is
+    // refused because nobody is there to approve it. With no settings read,
+    // Claude Code 2.1.296 measured its built-in mode as `auto` (init
+    // `permissionMode: "auto"`, claudePersonal.test.mjs's real-CLI case) — a
+    // classifier that may approve what the list never named. So the posture
+    // states `default` itself, unless its own list names a mode (plan-mode).
+    if (fenced && !perm.includes('--permission-mode')) a.push('--permission-mode', 'default');
     else if (agentTools) a.push('--setting-sources', 'user');
     if (agentTools) {
       a.push('--system-prompt-snapshot', 'off');
@@ -144,16 +181,29 @@ export const CLAUDE_RUNTIME = {
     a.push(...mcp, ...resultSchemaArgs);
     a.push('--model', model || MODEL);
     if (effort) a.push('--effort', effort);
-    if (streamJson) a.push('--output-format', 'stream-json', '--verbose');
+    // ALWAYS THE EVENT STREAM (2026-10-10): runTurn reads every turn line by
+    // line — the activity, the init's skills and servers, the result.
+    a.push('--output-format', 'stream-json', '--verbose');
     // The knowledge library (0.94.0) sits in the checkout, outside a
     // worktree's cwd: named as a readable directory so a curated profile
     // does not refuse the path the prompt just handed it. Before `perm`,
     // because `--allowedTools` is variadic and would swallow the flag.
     if (knowledgeDir) a.push('--add-dir', knowledgeDir);
+    // THE VAULT, likewise (2026-10-10): it lives under ~/.flowviant/vaults,
+    // outside the wiki worktree, and its `mkdir`/`rm` are path-validated to the
+    // working directories — the list's `Edit(//<vault>/**)` names the write,
+    // this names the directory. Antigravity's adapter hands it over the same way.
+    if (profile === 'wiki') a.push('--add-dir', vaultDir);
     // `personalSettings` is the caller's copy when it has one (a test); a
-    // turn reads the person's file here, at spawn, as the CLI would.
+    // turn reads the person's file here, at spawn, as the CLI would. What is
+    // kept is written to a private file, never onto argv (claudePersonal.mjs)
+    // — so this is the LAST thing built: nothing after it may throw and
+    // leave the file with no turn to release it.
     a.push(...(fenced ? withPersonalSettings(perm, personalSettings ?? personalClaudeSettings()) : perm));
     return a;
   },
+  /** What `args` wrote for a turn — the fenced posture's settings file —
+   *  removed when runTurn's child settles. */
+  releaseArgs: releaseTurnSettings,
   parse: null, // claudeStream.mjs owns its own stream parser (unchanged)
 };