flowviant 0.116.0 → 0.124.0

package/bin/lib/loginPath.mjs

@@ -11,17 +11,27 @@
  * measured "not installed" under the tray (2026-09-25).
  *
  * So the daemon asks the person's login shell for its PATH once, and keeps
- * every entry it already had FIRST (a terminal start is unchanged) with the
+ * every entry it already had FIRST (a terminal start keeps its order) with the
  * shell's additions after it; then the usual per-user bin directories that
  * exist. Best-effort and bounded: a shell that hangs or prints nothing costs a
- * few seconds once, and nothing is ever removed from PATH.
+ * few seconds once.
+ *
+ * ONLY ABSOLUTE ENTRIES ARE KEPT, from every input — the current PATH too
+ * (2026-10-10, F118). A relative entry (`node_modules/.bin`, `.`, and the empty
+ * entry, which also means "here") resolves against whatever directory a child
+ * is spawned in, and the daemon spawns `git`, `gh`, `cloudflared` and the CLIs
+ * by bare name with `cwd` set to an agent's worktree: a binary an agent plants
+ * there would run as the daemon, outside any sandbox, with its credentials. A
+ * common ~/.bashrc idiom is enough to open that. `FLOWVIANT_KEEP_PATH=1` is the
+ * operator's explicit opt-out and leaves PATH exactly as they set it.
  */
 
-import { execFileSync, spawn } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { existsSync, readdirSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
 import { compareVersions } from './versionOrder.mjs';
+import { relaunchSelf, selfArgv } from './launchCommand.mjs';
 
 const MARK = '__FLOWVIANT_PATH__=';
 
@@ -60,12 +70,13 @@ export function userBinDirs({ home = homedir(), exists = existsSync, list = read
   return dirs.filter((d) => exists(d));
 }
 
-/** Current entries first, then any the others add. Order-preserving, deduped. */
+/** Current entries first, then any the others add. Order-preserving, deduped,
+ *  absolute only (see the header): an empty or relative entry is dropped. */
 export function mergePath(current, ...more) {
   const seen = new Set();
   const out = [];
   for (const part of [current, ...more].flatMap((p) => (Array.isArray(p) ? p : String(p ?? '').split(':')))) {
-    if (!part || seen.has(part)) continue;
+    if (!part || !part.startsWith('/') || seen.has(part)) continue;
     seen.add(part);
     out.push(part);
   }
@@ -91,24 +102,18 @@ export function adoptLoginPath({ shell = true, env = process.env, ...deps } = {}
  * processes are looked up and started with the environment the process
  * STARTED with unless a spawn passes `env` — a later `process.env.PATH = …` is
  * invisible to them (measured 2026-09-25: node found ~/.local/bin/claude after
- * the change, the compiled binary did not). So when the PATH grew, the
- * binary restarts itself once with it: a thin proxy, the same shape as the
- * self-update re-exec, stdio inherited, exit code and signals passed through.
- * Node needs none of that and adopts in place.
+ * the change, the compiled binary did not). So when the PATH changed, the
+ * binary restarts itself once with it through the one relaunch proxy
+ * (launchCommand.mjs `relaunchSelf`): stdio inherited, exit code and signals
+ * passed through. Node needs none of that and adopts in place.
  */
 export async function adoptLoginPathForProcess(opts = {}) {
   if (process.env.FLOWVIANT_PATH_ADOPTED === '1') return;
   const before = process.env.PATH;
   const after = adoptLoginPath(opts);
   if (!process.versions.bun || after === before) return;
-  const compiled = process.argv[1]?.startsWith('/$bunfs/');
-  const child = spawn(process.execPath, process.argv.slice(compiled ? 2 : 1), {
-    stdio: 'inherit',
+  await relaunchSelf({
+    argv: selfArgv(process.argv.slice(2)),
     env: { ...process.env, FLOWVIANT_PATH_ADOPTED: '1' },
   });
-  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
-    process.on(signal, () => { try { child.kill(signal); } catch { /* gone */ } });
-  }
-  const code = await new Promise((resolve) => child.on('exit', (status, signal) => resolve(status ?? (signal ? 1 : 0))));
-  process.exit(code);
 }

package/bin/lib/machineListing.mjs

@@ -92,11 +92,14 @@ const JUST_NOW = 'just now';
 /**
  * A coarse age. Never "0s": a box heard a moment ago reads as "just now",
  * because a daemon that polled four hundred milliseconds ago has not been
- * silent for no time at all — the same rule `agoLabel` keeps in holder.mjs and
- * `elapsed` keeps in the web.
+ * silent for no time at all — the same rule `elapsed` keeps in the web.
  *
  * NULL for anything unmeasurable, so the caller DROPS the clause rather than
- * printing a duration nobody took.
+ * printing a duration nobody took — the one rule this shares with holder.mjs's
+ * `agoLabel`. That one is a different formatter on purpose (2026-10-10, F084:
+ * this comment used to claim it kept the "never 0s" rule too): it prints a
+ * measured zero as "0s" and steps at 60s/60m/48h, and holder.test.mjs pins
+ * both.
  */
 export function agoFrom(iso, now = Date.now()) {
   const t = Date.parse(iso ?? '');

package/bin/lib/maintenance.mjs

@@ -0,0 +1,47 @@
+/** A manual tray restart drains intake without signalling any existing run.
+ * The lease expires if the tray crashes. A daemon acknowledges only at the
+ * reconcile boundary, after all previously admitted work has been counted. */
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const MAINTENANCE_LEASE_MS = 120_000;
+const pathFor = (home) => join(home, '.flowviant', 'maintenance.json');
+export function readMaintenanceRequest({ home = homedir(), now = Date.now() } = {}) {
+  try {
+    const value = JSON.parse(readFileSync(pathFor(home), 'utf8'));
+    return typeof value.token === 'string' && /^[a-zA-Z0-9-]{1,100}$/.test(value.token) && typeof value.epoch === 'string' &&
+      Number.isFinite(value.expires) && value.expires > now && value.expires <= now + MAINTENANCE_LEASE_MS
+      ? value : null;
+  } catch { return null; }
+}
+export function readMaintenance(options) { return readMaintenanceRequest(options)?.token ?? null; }
+export function requestMaintenance(token, { home = homedir(), now = Date.now() } = {}) {
+  if (typeof token !== 'string' || !/^[a-zA-Z0-9-]{1,100}$/.test(token)) throw new Error('Invalid restart request');
+  const current = readMaintenanceRequest({ home, now });
+  if (current && current.token !== token) throw new Error('Another WSL restart is pending');
+  mkdirSync(join(home, '.flowviant'), { recursive: true });
+  const path = pathFor(home);
+  const tmp = `${path}.${process.pid}.tmp`;
+  const epoch = current?.epoch ?? randomUUID();
+  writeFileSync(tmp, JSON.stringify({ token, epoch, expires: now + MAINTENANCE_LEASE_MS }), { mode: 0o600 });
+  renameSync(tmp, path);
+  return epoch;
+}
+export function releaseMaintenance(token, { home = homedir(), now = Date.now() } = {}) {
+  if (readMaintenance({ home, now }) === token) rmSync(pathFor(home), { force: true });
+}
+
+/** The paused branch does only reporting. In particular, an acknowledgement
+ * can never be copied from a pre-pause idle measurement. */
+export async function maintenanceTick({ request = readMaintenanceRequest, busy, agents, flush, report }) {
+  const lease = request();
+  if (!lease) return false;
+  await flush();
+  // A slow network flush can outlive the request. Never acknowledge an
+  // expired generation whose next reconcile is allowed to admit work again.
+  if (request()?.epoch !== lease.epoch) return true;
+  report({ maintenance: lease.token, maintenanceEpoch: lease.epoch, busy: busy(), liveAgents: agents(), busyAt: new Date().toISOString() });
+  return true;
+}

package/bin/lib/maintenanceInventory.mjs

@@ -0,0 +1,39 @@
+/** The restart must also see live locks not backed by a stored project, and
+ * unguarded processes recorded in state. Neither is an empty machine. */
+import { instanceLockPath, listDaemonLocks } from './daemonLocks.mjs';
+import { daemonLockPid, readDaemonState } from './daemonState.mjs';
+import { listStoredProjects } from './credentials.mjs';
+import { processAlive } from './procRegistry.mjs';
+
+export function unknownMaintenanceDaemons({ entries = listStoredProjects(), locks = listDaemonLocks(),
+  stateFor = readDaemonState, pidFor = daemonLockPid, alive = processAlive } = {}) {
+  const known = new Set();
+  const unknown = new Set();
+  for (const entry of entries) {
+    const state = stateFor(entry.projectId);
+    const pid = pidFor(entry.fleetToken);
+    if (pid != null && pid === state.pid) known.add(pid);
+    if (Number.isInteger(state.pid) && state.pid > 0 && state.pid !== pid && alive(state.pid)) unknown.add(state.pid);
+  }
+  for (const { path, holder } of locks) {
+    if (!holder) unknown.add(path); // unreadable is not absent
+    else if (alive(holder.pid) && !known.has(holder.pid)) unknown.add(holder.pid);
+  }
+  return unknown.size;
+}
+
+/** The ordinary tray status reserves null for an absent lock. For a global
+ * restart we additionally measure the whole lock directory: no lock and no
+ * live state PID means this stored project's daemon is stopped. Unreadable
+ * directories throw rather than becoming a fabricated empty machine. */
+export function maintenanceInventory(status, { entries = listStoredProjects(), locks = listDaemonLocks({ strict: true }),
+  stateFor = readDaemonState, pidFor = daemonLockPid, alive = processAlive } = {}) {
+  const paths = new Set(locks.map(lock => lock.path));
+  const projects = status.projects.map(row => {
+    const entry = entries.find(entry => entry.projectId === row.id);
+    if (row.running !== null || !entry || paths.has(instanceLockPath(entry.fleetToken))) return row;
+    const pid = stateFor(row.id).pid;
+    return Number.isInteger(pid) && pid > 0 && alive(pid) ? row : { ...row, running: false };
+  });
+  return { projects, unknownDaemons: unknownMaintenanceDaemons({ entries, locks, stateFor, pidFor, alive }) };
+}

package/bin/lib/mcp-cli.mjs

@@ -17,13 +17,16 @@
  * never from a CLI credential sitting on a shared machine.
  */
 
-import { FLEET_TOKEN, USER_AGENT, MCP_URL, FLEET_URL } from './config.mjs';
+import { FLEET_TOKEN, MCP_URL, FLEET_URL } from './config.mjs';
 import { terminalCommand } from './launchCommand.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { postFleetJson } from './fleetPost.mjs';
 
 const CLI_TOKEN_URL = fleetEndpoint('cli-token', FLEET_URL);
 
-export async function runMcpCommand(args = []) {
+/** `timeoutMs` is the request's ceiling — injectable only so a test can prove
+ *  a hung server is abandoned without waiting thirty seconds. */
+export async function runMcpCommand(args = [], { timeoutMs = 30_000 } = {}) {
   if (!FLEET_TOKEN) {
     console.error(
       `error: no credential resolves here. Run \`${terminalCommand('login')}\` first — or, with\n` +
@@ -33,16 +36,12 @@ export async function runMcpCommand(args = []) {
     process.exit(1);
   }
 
+  // BOUNDED (audit 2026-10-10, F102): this was the one fleet request with no
+  // timeout, so a hung server held the command forever. A timeout lands in
+  // the catch below and says so like any other unreachable server.
   let res;
   try {
-    res = await fetch(CLI_TOKEN_URL, {
-      method: 'POST',
-      headers: {
-        authorization: `Bearer ${FLEET_TOKEN}`,
-        'content-type': 'application/json',
-        'user-agent': USER_AGENT,
-      },
-    });
+    res = await postFleetJson(CLI_TOKEN_URL, undefined, { timeoutMs });
   } catch (err) {
     console.error(`error: could not reach Flowviant (${err?.message || err})`);
     process.exit(1);

package/bin/lib/mcpInstall.mjs

@@ -0,0 +1,163 @@
+/**
+ * A CONFIRMED MCP INSTALL (2026-10-13, the owner; the app's half is
+ * packages/shared `mcpSetup.ts`). A project owner pressed "Install on <this
+ * machine>" on the Machines page and confirmed the exact command; the roster
+ * hands it to THIS box as `mcpInstallJobs`.
+ *
+ * WHAT THIS DOES, AND ALL IT DOES:
+ *  · claims the job (single-flight across processes, bound to this box);
+ *  · refuses, without running anything, a command its own copy of the rule
+ *    refuses (`mcpInstallCommandRefusal` — a privilege word, more than one
+ *    line, over the cap; parity rule 36 holds it to the server's);
+ *  · runs EXACTLY the text it was handed through `/bin/sh -c`, in the
+ *    project's checkout, as this daemon's own user, never with sudo, stdin
+ *    closed, as an unattended child (no machine credential, no display), in
+ *    its own process group killed whole at the timeout;
+ *  · streams the output's tail back about once a second, and at the end the
+ *    exit code;
+ *  · then looks again (`recheck`): the tool report is rescanned and posted,
+ *    and Claude Code is probed with the base branch's servers mounted, so the
+ *    page's checklist clears when the server starts.
+ *
+ * The command is never rewritten, prefixed or appended to.
+ */
+import { spawn } from 'node:child_process';
+import { DAEMON_INSTANCE, FLEET_URL } from './config.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, postBestEffort, settleLease } from './fleetPost.mjs';
+import { killGroup } from './processGroup.mjs';
+import { unattendedEnv } from './noWindowEnv.mjs';
+import { scrubTail } from './uplinkScrub.mjs';
+import { c, note, ok, warn } from './ui.mjs';
+import { printableLine } from './printable.mjs';
+
+/** The server's bounds (shared `mcpSetup.ts`; parity rule 36). */
+export const MCP_INSTALL_COMMAND_MAX = 500;
+export const MCP_INSTALL_OUTPUT_MAX = 16_000;
+export const MCP_INSTALL_TIMEOUT_MS = 10 * 60_000;
+export const MCP_INSTALL_PRIVILEGE_WORDS = Object.freeze(['sudo', 'doas', 'su', 'pkexec', 'run0']);
+
+/** Why this command cannot run, or null — the shared rule, word for word. */
+export function mcpInstallCommandRefusal(command) {
+  if (typeof command !== 'string' || !command.trim()) return 'The install command is empty.';
+  if (command.length > MCP_INSTALL_COMMAND_MAX) return `The install command is over ${MCP_INSTALL_COMMAND_MAX} characters.`;
+  if (/[\r\n\0]/.test(command)) return 'The install command must be one line.';
+  const words = command.split(/[^A-Za-z0-9_-]+/);
+  const word = MCP_INSTALL_PRIVILEGE_WORDS.find((w) => words.includes(w));
+  if (word) return `Flowviant never installs with ${word}. Use a command that installs as the machine's own user.`;
+  return null;
+}
+
+const url = (tail) => fleetEndpoint(tail, FLEET_URL);
+const tail = (text) => (text.length > MCP_INSTALL_OUTPUT_MAX ? text.slice(text.length - MCP_INSTALL_OUTPUT_MAX) : text);
+
+/**
+ * Run one command and hand back `{ code, out }`. `onOutput(out)` hears the
+ * tail as it grows. `spawnChild` is a test's.
+ */
+export function runInstallCommand(command, { cwd, timeoutMs = MCP_INSTALL_TIMEOUT_MS, env = unattendedEnv(), onOutput = () => {}, spawnChild = spawn } = {}) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnChild('/bin/sh', ['-c', command], { cwd, env, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch (error) {
+      resolve({ code: -1, out: `[flowviant] could not start the command: ${error?.message ?? error}` });
+      return;
+    }
+    let buf = '';
+    let settled = false;
+    const settle = (v) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(v);
+    };
+    const take = (d) => {
+      buf += d;
+      if (buf.length > 2 * MCP_INSTALL_OUTPUT_MAX) buf = scrubTail(buf, MCP_INSTALL_OUTPUT_MAX);
+      onOutput(scrubTail(buf, MCP_INSTALL_OUTPUT_MAX));
+    };
+    child.stdout?.setEncoding('utf8');
+    child.stderr?.setEncoding('utf8');
+    child.stdout?.on('data', take);
+    child.stderr?.on('data', take);
+    const timer = setTimeout(() => {
+      killGroup(child, 'SIGKILL');
+      const minutes = Math.round(timeoutMs / 60_000);
+      settle({ code: -1, out: scrubTail(`${buf}\n[flowviant] the command ran past ${minutes >= 1 ? `${minutes} minutes` : `${timeoutMs}ms`} and was stopped`, MCP_INSTALL_OUTPUT_MAX) });
+    }, timeoutMs);
+    timer.unref?.();
+    child.on('error', (error) => settle({ code: -1, out: scrubTail(`${buf}\n[flowviant] ${error?.message ?? error}`, MCP_INSTALL_OUTPUT_MAX) }));
+    child.on('close', (code) => settle({ code: code ?? -1, out: scrubTail(buf, MCP_INSTALL_OUTPUT_MAX) }));
+  });
+}
+
+/** Job ids this process has taken — never run twice in one process. */
+const seen = new Set();
+let running = 0;
+/** Installs this process is running — the machine is busy while one is. */
+export const mcpInstallsInFlight = () => running;
+
+/**
+ * The roster's `mcpInstallJobs` for this box. `ctx` = { repoRoot, myPubB64,
+ * recheck }, and for tests `run`, `claim`, `report` and `final`.
+ */
+export function processMcpInstallJobs(jobs, ctx) {
+  if (!Array.isArray(jobs)) return;
+  for (const job of jobs) {
+    if (!job || typeof job.id !== 'string' || typeof job.command !== 'string' || seen.has(job.id)) continue;
+    seen.add(job.id);
+    void runJob(job, ctx);
+  }
+}
+
+async function runJob(job, ctx) {
+  const pubkey = ctx.myPubB64?.();
+  if (!pubkey) return;
+  const claim = ctx.claim ?? ((fields) => claimFleetLease(url('mcp-install-claim'), fields));
+  const report = ctx.report ?? ((body) => settleLease(url('mcp-install-report'), body, { timeoutMs: 15_000 }));
+  const final = ctx.final ?? ((body) => postBestEffort(url('mcp-install-report'), { ...body, instance: DAEMON_INSTANCE }));
+  const run = ctx.run ?? runInstallCommand;
+  if (!(await claim({ jobId: job.id, pubkey }))) return;
+  const name = printableLine(String(job.serverName ?? 'MCP server'), 60);
+  const refusal = mcpInstallCommandRefusal(job.command);
+  if (refusal) {
+    warn(`${c.cyan('mcp')} ${c.dim(`— not installing ${name}: ${refusal}`)}`);
+    await final({ jobId: job.id, pubkey, output: `[flowviant] ${refusal}`, done: true, exitCode: -1 });
+    return;
+  }
+  running += 1;
+  note(`${c.cyan('mcp')} ${c.dim(`— installing ${name}, as confirmed in the app: ${printableLine(job.command, 200)}`)}`);
+  let latest = '';
+  let sentAt = 0;
+  let sending = false;
+  const beat = () => {
+    if (sending || latest === '' || Date.now() - sentAt < 1000) return;
+    sending = true;
+    sentAt = Date.now();
+    const output = latest;
+    void Promise.resolve(report({ jobId: job.id, pubkey, output, done: false, exitCode: null })).catch(() => {}).finally(() => { sending = false; });
+  };
+  const timer = setInterval(beat, 1000);
+  timer.unref?.();
+  try {
+    const timeoutMs = Number.isInteger(job.timeoutMs) && job.timeoutMs > 0 ? Math.min(job.timeoutMs, MCP_INSTALL_TIMEOUT_MS) : MCP_INSTALL_TIMEOUT_MS;
+    const { code, out } = await run(job.command, { cwd: ctx.repoRoot, timeoutMs, onOutput: (o) => { latest = tail(o); } });
+    clearInterval(timer);
+    await final({ jobId: job.id, pubkey, output: tail(out), done: true, exitCode: code });
+    if (code === 0) ok(`${c.cyan('mcp')} ${c.dim(`— installed ${name}; checking it again`)}`);
+    else warn(`${c.cyan('mcp')} ${c.dim(`— installing ${name} exited ${code}`)}`);
+  } finally {
+    clearInterval(timer);
+    running -= 1;
+    try {
+      await ctx.recheck?.();
+    } catch { /* a re-check is best-effort; the next beat looks anyway */ }
+  }
+}
+
+/** Tests only. */
+export function resetMcpInstallsForTest() {
+  seen.clear();
+  running = 0;
+}

package/bin/lib/mcpInventory.mjs

@@ -0,0 +1,119 @@
+/**
+ * EVERY MCP SERVER EACH CLI ON THIS BOX HAS, FOR THE MACHINES PAGE (2026-10-13,
+ * the owner: "see at a glance what Flowviant can do on this project, from what
+ * the serving machine's CLIs actually have").
+ *
+ * Per installed CLI, one list: the servers the CLI itself reported (Claude
+ * Code's init, harvested in runtimeCapabilities.mjs; Codex's `mcp list`, read
+ * in runtimeOfferings.mjs) and every server the base branch's `.mcp.json`
+ * declares (projectTools.mjs). Rides this box's own `tools-report`
+ * (fleetReports.mjs), so its 60-second beat and write-on-change dedup are the
+ * lane's; the server stores it per box (packages/shared `mcpInventory.ts`,
+ * the shape and the bounds, held equal by parity rule 35).
+ *
+ * DECLARED IS NOT PRESENT. A base `.mcp.json` server the CLI did not report
+ * running is `declared`, with the reason this daemon would leave it unmounted
+ * (`env X unset`, `command y not on PATH`, a transport the CLI refuses) when
+ * there is one — never shown as available because the file lists it.
+ *
+ * Names, statuses, sources, reasons and tool names only: no env value, header,
+ * token, URL or path leaves the box.
+ */
+import { toolReadout } from './projectTools.mjs';
+import { MCP_NAME_MAX } from './runtimeCapabilities.mjs';
+
+/** The server's bounds (shared `mcpInventory.ts`; parity rule 35). */
+export const MCP_INVENTORY_MAX_SERVERS = 80;
+export const MCP_INVENTORY_NAME_MAX = MCP_NAME_MAX;
+export const MCP_INVENTORY_TOOLS_PER_SERVER = 100;
+export const MCP_INVENTORY_TOOLS_PER_CLI = 1000;
+export const MCP_INVENTORY_TOOL_NAME_MAX = 64;
+export const MCP_INVENTORY_REASON_MAX = 200;
+
+const SOURCE_ORDER = { project: 0, personal: 1, claudeai: 2 };
+const TOOL_NAME = /^[A-Za-z0-9_.:-]+$/;
+
+/**
+ * Claude Code's scope word → the page's source. `project` is a checkout's
+ * `.mcp.json`; `claudeai` an account connector; `dynamic` is a server named on
+ * the command line, which on a turn the harvest records is the base copy when
+ * the name is declared and otherwise this daemon's own — not the person's.
+ * Every other scope (user, local, plugin, enterprise, managed, agent) is the
+ * CLI's own config on this box.
+ */
+function claudeSource(scope, name, declared) {
+  if (scope === 'claudeai' || name.startsWith('claude.ai ')) return 'claudeai';
+  if (scope === 'project') return 'project';
+  if (scope === 'dynamic') return declared.has(name) ? 'project' : null;
+  return 'personal';
+}
+
+const declaredRows = (snapshot, runner) =>
+  snapshot ? toolReadout(snapshot, runner).filter((t) => t.kind === 'mcp') : [];
+
+/** One CLI's list, bounded the way the server re-applies it. */
+function bound(servers) {
+  let budget = MCP_INVENTORY_TOOLS_PER_CLI;
+  const seen = new Set();
+  return servers
+    .map((s) => ({ ...s, name: s.name.trim().slice(0, MCP_INVENTORY_NAME_MAX).trim() }))
+    .filter((s) => s.name && s.name !== 'flowviant' && !seen.has(s.name) && seen.add(s.name))
+    .sort((a, b) => SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source] || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+    .slice(0, MCP_INVENTORY_MAX_SERVERS)
+    .map((s) => {
+      let tools = null;
+      if (Array.isArray(s.tools)) {
+        tools = [...new Set(s.tools.filter((t) => typeof t === 'string' && t.length <= MCP_INVENTORY_TOOL_NAME_MAX && TOOL_NAME.test(t)))]
+          .sort()
+          .slice(0, Math.min(MCP_INVENTORY_TOOLS_PER_SERVER, budget));
+        budget -= tools.length;
+      }
+      return { name: s.name, source: s.source, status: s.status, reason: s.reason == null ? null : String(s.reason).slice(0, MCP_INVENTORY_REASON_MAX), tools };
+    });
+}
+
+/** Claude Code: what its init reported, then each declaration it did not. */
+export function claudeInventory(harvested, snapshot) {
+  const declared = new Map(declaredRows(snapshot, 'claude').map((t) => [t.name, t]));
+  const servers = [];
+  for (const h of harvested ?? []) {
+    const source = claudeSource(h.scope, h.name, declared);
+    if (!source) continue;
+    const why = source === 'project' && h.status !== 'connected' ? declared.get(h.name)?.reason ?? null : null;
+    servers.push({ name: h.name, source, status: h.status, reason: why, tools: h.status === 'connected' ? h.tools ?? [] : null });
+  }
+  const running = new Set(servers.filter((s) => s.source === 'project').map((s) => s.name));
+  for (const [name, d] of declared) {
+    if (!running.has(name)) servers.push({ name, source: 'project', status: 'declared', reason: d.reason, tools: null });
+  }
+  return { reported: harvested != null, servers: bound(servers) };
+}
+
+/**
+ * Codex: its own config's servers, then each declaration. A declared server
+ * replaces a personal one of the same name on a card's turn
+ * (projectToolRuntimes.mjs `isolatedCodexHome`), so the declaration is the
+ * row. Codex names no tools without starting a server, so `tools` is null.
+ */
+export function codexInventory(rows, snapshot) {
+  const declared = declaredRows(snapshot, 'codex');
+  const names = new Set(declared.map((d) => d.name));
+  const servers = [
+    ...declared.map((d) => ({ name: d.name, source: 'project', status: 'declared', reason: d.reason, tools: null })),
+    ...(rows ?? []).filter((r) => !names.has(r.name)).map((r) => ({ name: r.name, source: 'personal', status: r.status, reason: r.reason, tools: null })),
+  ];
+  return { reported: rows != null, servers: bound(servers) };
+}
+
+/**
+ * The `mcp` key of the tools report: `{ claude?, codex? }`, a CLI only when it
+ * is installed here. `snapshot` is the base-branch read (null when it could
+ * not be read — the declarations are then unknown, and only the CLI's own
+ * list is said).
+ */
+export function buildMcpInventory({ installed, snapshot, claude, codex }) {
+  const out = {};
+  if (installed.includes('claude')) out.claude = claudeInventory(claude, snapshot);
+  if (installed.includes('codex')) out.codex = codexInventory(codex, snapshot);
+  return out;
+}

package/bin/lib/noWindowEnv.mjs

@@ -41,9 +41,11 @@
  * purpose through WSL interop (`explorer.exe`, `cmd.exe /c start`); the kind
  * contracts ask it not to (artifactContracts.mjs, `NO_WINDOW`).
  */
-import { lstatSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { withoutMachineCredentials } from './machineEnv.mjs';
+import { ensureOwnDir } from './ownedDirs.mjs';
 
 /** Removed outright; WAYLAND_DISPLAY is kept but emptied (see above). */
 export const WINDOW_ENV_REMOVED = Object.freeze(['DISPLAY', 'WAYLAND_SOCKET']);
@@ -62,6 +64,24 @@ export function withoutWindows(env, browserHome = null) {
   return out;
 }
 
+/**
+ * EVERY CLI CHILD THE DAEMON SPAWNS UNATTENDED, ONE RULE (2026-10-10, the
+ * audit): no machine credential (machineEnv.mjs), and no way to a window
+ * unless a person at the keyboard asked for one (`display: true`, a Terminal
+ * tab's alone). It was composed by hand twice — a turn's `cliEnv`
+ * (runTurn.mjs) and the project check's `checkEnv` (workAgentCheck.mjs) — and
+ * skipped outright by the two spawns the daemon makes for its own purposes:
+ * the startup skills probe (runtimeCapabilities.mjs), whose `claude` started
+ * the person's stdio MCP servers and the checkout's SessionStart hooks with
+ * the machine credential in their environment, and the Codex offerings reads
+ * (runtimeOfferings.mjs), whose `codex mcp list` may start configured servers.
+ * Every one of them now asks here. Never mutates its input.
+ */
+export function unattendedEnv(env = process.env, { display = false, browserHome = null } = {}) {
+  const out = withoutMachineCredentials(env);
+  return display === true ? out : withoutWindows(out, browserHome);
+}
+
 /**
  * AN AGENT'S BROWSER HOME is kept beside its Codex home, in its worktree's
  * private git dir: never committed, the same profile turn after turn, and
@@ -82,8 +102,8 @@ export const agentBrowserHome = (sessionMetaPath, wt, agentId) =>
 export function openBrowserHome(kept) {
   if (kept) {
     try {
-      try { if (!lstatSync(kept).isDirectory()) rmSync(kept, { force: true }); } catch { /* absent */ }
-      mkdirSync(kept, { recursive: true, mode: 0o700 });
+      // ownedDirs.mjs (2026-10-10): the link goes, never its target.
+      ensureOwnDir(kept, { mode: 0o700 });
       return { dir: kept, cleanup: () => {} };
     } catch { /* fall through to a turn's own */ }
   }

package/bin/lib/ownedDirs.mjs

@@ -0,0 +1,99 @@
+/**
+ * DIRECTORIES THE DAEMON WRITES INTO THAT A REPOSITORY COULD HAVE PLANTED —
+ * one home for the rule "never follow a link a checkout carries under
+ * `.flowviant/`" (2026-10-10, the audit's F100 / F080).
+ *
+ * git commits symlinks. A checkout can arrive carrying `.flowviant -> ~/.ssh`,
+ * or `.flowviant/uploads -> ../../../../.ssh` (a worktree's depth under
+ * `~/.flowviant/worktrees` is deterministic), and any daemon write through
+ * either lands outside the place it was meant for, as the operator. The rule
+ * that stops it was hand-written in ten places in four shapes — a boolean, a
+ * true/null/false, a 'dir'/'none'/'other', a replace-then-mkdir — and the
+ * attachment lane, the one that writes a MEMBER'S bytes under a member's name,
+ * had none of them. Each new `.flowviant/<x>` writer had to rediscover it.
+ *
+ * TWO POLICIES, deliberately two doors:
+ *
+ *  - REFUSED, NEVER REPLACED (`ensureRealSubdir`): `.flowviant/` and the
+ *    directories under it a repository could hold — the artifacts directory,
+ *    the uploads directory. `.flowviant/` is not only ours (a repo declares
+ *    `check.json` and `deploy.json` there), so a link or a file at one of
+ *    these names is the repository's content: Flowviant deleting it would be
+ *    destroying what it did not create, and following it is the write outside
+ *    the worktree. Either answer is "no", and the caller says so in words.
+ *  - REPLACED, NEVER FOLLOWED (`ensureOwnDir`): a path that is wholly the
+ *    daemon's — the knowledge library under a parent its caller has already
+ *    checked, a kept browser home. A link or a file planted there is removed
+ *    (the link, never its target) and a real directory made in its place.
+ *
+ * Leaf: node:fs and node:path only.
+ */
+import { lstatSync, mkdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * What stands at `p`, by `lstat` and never followed: `'dir'` for a real
+ * directory, `'none'` for nothing at all, `'other'` for anything else — a
+ * symlink (to a directory or dangling), a regular file, or a path this cannot
+ * look at (a component that is a file, no permission). The unknown case is
+ * `'other'`, never `'none'`: an answer of "absent" invites a create.
+ */
+export function realDirState(p) {
+  try {
+    const st = lstatSync(p);
+    return st.isDirectory() && !st.isSymbolicLink() ? 'dir' : 'other';
+  } catch (e) {
+    return e?.code === 'ENOENT' ? 'none' : 'other';
+  }
+}
+
+/** `<placeDir>/.flowviant`, by the same three states. */
+export const flowviantParentState = (placeDir) => realDirState(join(placeDir, '.flowviant'));
+
+/**
+ * `<placeDir>/<rel>` as a real directory, every component of `rel` a real
+ * directory too — or FALSE, with nothing replaced.
+ *
+ * Each component must already be a real directory or be absent; any one that
+ * is a link or a non-directory refuses before anything is made. The missing
+ * ones are made, and then EVERY component is checked again: a link swapped in
+ * between the look and the make is caught here, and the caller writes
+ * nothing. `rel` is a relative path of plain names (`.flowviant/uploads`); a
+ * `..`, an empty or an absolute component refuses.
+ */
+export function ensureRealSubdir(placeDir, rel) {
+  const parts = String(rel).split('/');
+  if (parts.some((p) => p === '' || p === '.' || p === '..')) return false;
+  const paths = parts.map((_, i) => join(placeDir, ...parts.slice(0, i + 1)));
+  if (paths.some((p) => realDirState(p) === 'other')) return false;
+  try {
+    mkdirSync(paths[paths.length - 1], { recursive: true });
+  } catch {
+    return false;
+  }
+  return paths.every((p) => realDirState(p) === 'dir');
+}
+
+/**
+ * A directory that is wholly the daemon's, made real: anything at `path` that
+ * is not a real directory is removed — non-recursively, so a link goes and its
+ * target never does — and the directory made (`mode` for each directory this
+ * creates). Returns `path`; THROWS when a real directory cannot be had there,
+ * a link reappearing between the remove and the make included, so a caller
+ * never writes through one.
+ *
+ * Only for paths that are OURS. A path a repository may legitimately hold is
+ * `ensureRealSubdir`'s, which refuses rather than removes.
+ */
+export function ensureOwnDir(path, { mode } = {}) {
+  if (realDirState(path) !== 'dir') {
+    try {
+      rmSync(path, { force: true });
+    } catch {
+      /* the make below says why */
+    }
+  }
+  mkdirSync(path, mode === undefined ? { recursive: true } : { recursive: true, mode });
+  if (realDirState(path) !== 'dir') throw new Error(`${path} is not a real directory`);
+  return path;
+}