flowviant 0.116.0 → 0.124.0

package/bin/lib/procStat.mjs

@@ -0,0 +1,76 @@
+/**
+ * ONE READER OF `/proc/<pid>/stat` (audit 2026-10-10, F050/F089).
+ *
+ * Six modules used to parse this line by hand, each counting its own field
+ * index from "rest[0] is field 3" in a comment. The parse is the whole trap:
+ * field 2 is `comm`, which the kernel wraps in parens and which may contain
+ * BOTH spaces and parens — it is the first 15 bytes of the executable's name,
+ * and a name is not a token. A naive whitespace split taking $22 lands on
+ * `nice` for any such process, and `nice` is a small integer, so the answer
+ * is not a parse error but a plausible-looking "started at boot" that sails
+ * past any isFinite guard. Measured: a binary named `ev (i l) x` read 28308s
+ * too old that way (instance.mjs, which gates a SIGTERM and then a SIGKILL on
+ * this read).
+ *
+ * Every field after `comm` is a number or a single-character state, so no ')'
+ * can appear later: the LAST ')' in the line is always the kernel's own
+ * closing paren, even when comm itself ends in one. Fields are NAMED here so
+ * no caller counts again.
+ *
+ * Linux only, and a leaf: node builtins, nothing of ours. Null on any read or
+ * shape failure — which every caller already read as "cannot tell".
+ */
+
+import { readFileSync } from 'node:fs';
+
+/** Index of each named field in the list AFTER `comm` (index 0 is field 3). */
+const FIELD = Object.freeze({ state: 0, ppid: 1, pgrp: 2, session: 3, tpgid: 5, starttime: 19 });
+
+/** A kernel integer token: digits, with tpgid's `-1` for "no terminal". */
+const int = (token) => (/^-?\d+$/.test(token ?? '') ? Number(token) : null);
+
+/**
+ * The named fields of one `/proc/<pid>/stat` line, or null when the line has
+ * no `comm` close or is too short to carry `starttime` (field 22).
+ */
+export function parseProcStat(text) {
+  if (typeof text !== 'string') return null;
+  const close = text.lastIndexOf(')');
+  if (close < 0) return null;
+  const rest = text.slice(close + 1).trim().split(/\s+/);
+  if (rest.length <= FIELD.starttime) return null;
+  const out = { state: rest[FIELD.state] };
+  for (const name of ['ppid', 'pgrp', 'session', 'tpgid', 'starttime']) {
+    const value = int(rest[FIELD[name]]);
+    if (value === null) return null;
+    out[name] = value;
+  }
+  return out;
+}
+
+/** A pid this reader will put in a path: a positive integer, its digit
+ *  string (what a /proc listing hands back), or 'self'. */
+function procName(pid) {
+  if (pid === 'self') return 'self';
+  if (Number.isSafeInteger(pid) && pid > 0) return String(pid);
+  if (typeof pid === 'string' && /^\d+$/.test(pid) && Number(pid) > 0) return pid;
+  return null;
+}
+
+/**
+ * `{ state, ppid, pgrp, session, tpgid, starttime }` for `pid` (or 'self'),
+ * or null: no such process, no /proc (macOS, hidepid=2, a pid namespace), or
+ * a line this parser does not recognise. `starttime` is in clock ticks since
+ * boot (USER_HZ); `tpgid` is -1 without a controlling terminal.
+ */
+export function procStat(pid, { read = readFileSync } = {}) {
+  const name = procName(pid);
+  if (!name) return null;
+  let text;
+  try {
+    text = read(`/proc/${name}/stat`, 'utf8');
+  } catch {
+    return null;
+  }
+  return parseProcStat(String(text));
+}

package/bin/lib/processGroup.mjs

@@ -0,0 +1,48 @@
+/**
+ * SIGNAL A DETACHED CHILD'S WHOLE PROCESS GROUP, FALLING BACK TO THE CHILD
+ * (2026-10-10, the audit's F086 / F145) — the one home of a block that was
+ * hand-written six times: the project check's timeout, the teardown of a
+ * check, the deploy command's timeout, the async network git call's timeout,
+ * a preview tunnel's stop and the reap of an orphaned tunnel.
+ *
+ * Why the GROUP: the daemon spawns these `detached`, so the child's pid is its
+ * process group, and the child is usually a shell (`shell: true`) or a tool
+ * that starts helpers (git's ssh, cloudflared). Signalling the child alone
+ * leaves what it started running — holding the worktree, its writer lock, or
+ * a pipe the caller is waiting on (workChildren.mjs tells the incident).
+ *
+ * Why the FALLBACK: a group that has already gone, a pid that is not a group
+ * leader, and a platform with no process groups (Windows throws on a negative
+ * pid) all throw on the group signal; the child itself is then signalled.
+ *
+ * NEVER A GROUP THE DAEMON DID NOT START: a pid that is not an integer above 1
+ * signals nothing by number — `kill(-1)` is every process the user owns, and
+ * `kill(0)` is the daemon's own group. Import-free, so git.mjs can use it.
+ *
+ * @param {import('node:child_process').ChildProcess | number} target
+ * @param {NodeJS.Signals} [signal]
+ * @returns {boolean} whether a signal was delivered
+ */
+export function killGroup(target, signal = 'SIGKILL') {
+  const child = target !== null && typeof target === 'object' ? target : null;
+  const pid = child ? child.pid : target;
+  const leader = Number.isInteger(pid) && pid > 1;
+  if (leader) {
+    try {
+      process.kill(-pid, signal);
+      return true;
+    } catch {
+      /* gone, not a leader, or no groups here — the process itself next */
+    }
+  }
+  try {
+    if (child) return child.kill(signal) === true;
+    if (leader) {
+      process.kill(pid, signal);
+      return true;
+    }
+  } catch {
+    /* already gone */
+  }
+  return false;
+}

package/bin/lib/processes.mjs

@@ -47,6 +47,7 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { platform } from 'node:os';
 import { procPids, scanProcs } from './procScan.mjs';
+import { procStat } from './procStat.mjs';
 
 // THE WALK'S BOUND is `procScan.mjs`'s: matched rows collected before the walk
 // stops early — a bound on the WORK done for one pathological group, never on
@@ -69,21 +70,13 @@ export function processesSupported() {
 
 /**
  * `pid (comm) state ppid pgrp …` — comm is arbitrary text and CAN contain a
- * `)`, so the fields are read after the LAST one rather than by splitting the
- * whole line. A process named `foo) bar` is not hypothetical; it is what
- * anything that sets its own title can produce.
+ * `)`, which is why the line is read by procStat.mjs, the one parser that
+ * knows where comm ends. A process named `foo) bar` is not hypothetical; it is
+ * what anything that sets its own title can produce. Null when the pid is gone
+ * between readdir and read — ordinary.
  */
 function pgrpOf(pid) {
-  let stat;
-  try {
-    stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
-  } catch {
-    return null; // gone between readdir and read — ordinary
-  }
-  const close = stat.lastIndexOf(')');
-  if (close < 0) return null;
-  const rest = stat.slice(close + 1).trim().split(/\s+/);
-  const pgrp = Number(rest[2]);
+  const pgrp = procStat(pid)?.pgrp;
   return Number.isInteger(pgrp) && pgrp > 0 ? pgrp : null;
 }
 
@@ -172,18 +165,11 @@ function scanDarwin(pgids) {
 }
 
 /**
- * Live processes in any of `pgids`.
+ * Live processes in any of `pgids`, and the TOTAL the cap was applied to.
  *
- * Returns null where the platform cannot answer — never `[]`, which means
- * "looked, found none" and is a different fact a surface renders differently.
- */
-export function processesInGroups(pgids, { scrub } = {}) {
-  const m = measureProcesses(pgids, { scrub });
-  return m === null ? null : m.rows;
-}
-
-/**
- * …and the TOTAL the cap was applied to.
+ * Returns null where the platform cannot answer — never an empty measurement,
+ * which means "looked, found none" and is a different fact a surface renders
+ * differently.
  *
  * The rows alone are a lie about scale the moment a group has more than twelve
  * members: a dashboard summing them states an incomplete figure as a complete

package/bin/lib/projectToolRuntimes.mjs

@@ -15,9 +15,10 @@
  * projectTools.mjs. projectTools.test.mjs pins every transport word to here.
  */
 
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { homedir } from 'node:os';
+import { codexHome } from './codexHome.mjs';
+import { parseCodexToml, TomlRaw } from './codexPersonal.mjs';
 
 export const toml = (value) => JSON.stringify(String(value));
 
@@ -43,6 +44,72 @@ function linkPersonalEntry(target, link) {
   }
 }
 
+/** A table header's dotted keys, unquoted — null for one this reader cannot
+ *  split, which is then nobody's to strip. */
+function headerKeys(section) {
+  const key = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*(?:\.|$)/y;
+  const keys = [];
+  for (let i = 0; i < section.length; ) {
+    key.lastIndex = i;
+    const m = key.exec(section);
+    if (!m || key.lastIndex === i) return null;
+    try {
+      keys.push(m[1] !== undefined ? JSON.parse(`"${m[1]}"`) : m[2] ?? m[3]);
+    } catch {
+      return null;
+    }
+    i = key.lastIndex;
+  }
+  return keys;
+}
+
+/** The key a `key = …` / `key.sub = …` line defines, unquoted, or null. */
+const lineKey = (line) => {
+  const m = /^\s*(?:"([^"\\]*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*[.=]/.exec(line);
+  return m ? (m[1] ?? m[2] ?? m[3]) : null;
+};
+
+/**
+ * THE REPO'S MCP SERVERS, AS THE AGENT'S OWN CONFIG (2026-10-10, the audit).
+ * A Codex build turn was handed the base branch's servers as `-c` pairs —
+ * `mcp_servers.<n>.env.<K>=<value>`, `…http_headers={…}`, `…url=…` — with
+ * every `${VAR}` already expanded, so a token the repo's `.mcp.json` names
+ * sat in /proc/<pid>/cmdline, every local user's to read, against this
+ * daemon's own rule (codexPersonal.mjs: "A LITERAL SECRET NEVER RIDES
+ * ARGV"). They are written here instead, as tables of the agent's private
+ * CODEX_HOME config.toml (0600, in a 0700 home), which a build turn reads and
+ * every fenced posture ignores (`--ignore-user-config`) — the same turns the
+ * `-c` pairs reached. Written in the shape codexPersonal.mjs's bounded reader
+ * parses, since a fenced turn reads this file for its login.
+ *
+ * SO THE EXPANDED VALUES NOW SIT ON DISK, AND THAT IS STATED (2026-10-10). The
+ * `-c` pairs died with the turn; these tables live as long as the home does.
+ * An agent's home is kept between its turns in the worktree's private git dir
+ * (workAgentTurnExecution.mjs `codexAgentHome`) and goes only with the
+ * worktree, when the agent retires — until then this 0600 file holds every
+ * secret the repo's `.mcp.json` named. Each turn rewrites it whole, so a
+ * server the base branch dropped, or a variable since unset, leaves with the
+ * next turn; a home with no git dir to hold it dies with its turn. NOT DONE:
+ * a URL that would carry an expanded secret is written as any other — refusing
+ * it ('missing') is an open follow-up from the same audit finding (F660).
+ */
+function codexServerTables(servers) {
+  let out = '';
+  for (const [name, server] of Object.entries(servers ?? {})) {
+    out += `\n[mcp_servers.${name}]\n`;
+    if (typeof server.command === 'string') {
+      out += `command = ${toml(server.command)}\nargs = [${(server.args ?? []).map(toml).join(', ')}]\n`;
+      const env = Object.entries(server.env ?? {}).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key));
+      if (env.length) out += `[mcp_servers.${name}.env]\n${env.map(([key, value]) => `${key} = ${toml(value)}`).join('\n')}\n`;
+    } else {
+      out += `url = ${toml(server.url)}\n`;
+      const headers = Object.entries(server.headers ?? {});
+      if (headers.length) out += `[mcp_servers.${name}.http_headers]\n${headers.map(([key, value]) => `${toml(key)} = ${toml(value)}`).join('\n')}\n`;
+    }
+  }
+  return out;
+}
+
 /**
  * Keep personal Codex files, but do not copy its project trust grants. An
  * untrusted worktree's .codex/config.toml is ignored by Codex 0.156.1.
@@ -58,23 +125,39 @@ function linkPersonalEntry(target, link) {
  * worktree's skills can change between turns), and what Codex made here
  * itself under a name the person has not got is kept.
  */
-function isolatedCodexHome(dest, env, worktree) {
-  const source = resolve(env.CODEX_HOME || join(homedir(), '.codex'));
+function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
+  const source = resolve(codexHome(env));
   const configPath = join(source, 'config.toml');
   const sourceConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
   const topLevel = sourceConfig.split(/^\s*\[/m, 1)[0];
   const personalDeveloperInstructions = /^\s*developer_instructions\s*=/m.test(topLevel);
-  // These sections alone grant a checkout permission to supply project
-  // settings. Keep every other personal setting, skill and session store.
+  // The repo's servers replace a personal server of the same name whole —
+  // its `[mcp_servers.<n>…]` tables are dropped below. A personal
+  // `mcp_servers` written inline cannot be told apart line by line, so it
+  // fails closed, as an inline `skills.config` does below.
+  const repoServers = new Set(Object.keys(mcpServers ?? {}));
+  const inline = () => new Error('Cannot isolate Codex project MCP servers beside an inline mcp_servers entry in config.toml');
+  if (repoServers.size && /^\s*["']?mcp_servers["']?\s*[.=]/m.test(topLevel)) throw inline();
+  // The `projects` sections alone grant a checkout permission to supply
+  // project settings. Keep every other personal setting, skill and session
+  // store.
   const lines = sourceConfig.split('\n');
-  let inProject = false;
+  let dropping = false;
+  let inServers = false;
   let config = lines.filter((line) => {
     const header = /^\s*(?:\[\[([^\]]+)\]\]|\[([^\]]+)\])\s*(?:#.*)?$/.exec(line);
     if (header) {
       const section = header[1] ?? header[2];
-      inProject = section === 'projects' || section.startsWith('projects.');
+      const keys = headerKeys(section);
+      inServers = keys?.length === 1 && keys[0] === 'mcp_servers';
+      dropping =
+        section === 'projects' ||
+        section.startsWith('projects.') ||
+        (keys?.[0] === 'mcp_servers' && keys.length > 1 && repoServers.has(keys[1]));
+    } else if (inServers && repoServers.has(lineKey(line))) {
+      throw inline();
     }
-    return !inProject;
+    return !dropping;
   }).join('\n');
   if (worktree) {
     // Codex discovers these even in an untrusted project. Disable exactly the
@@ -92,6 +175,7 @@ function isolatedCodexHome(dest, env, worktree) {
       throw new Error('Cannot isolate Codex project skills with inline skills.config');
     for (const skill of worktreeSkills) config += `\n[[skills.config]]\npath = ${toml(skill)}\nenabled = false\n`;
   }
+  config += codexServerTables(mcpServers);
 
   // The home itself, only once the config is decided: a refused turn touches
   // nothing here. A home that is not a real directory is not ours to write
@@ -99,9 +183,14 @@ function isolatedCodexHome(dest, env, worktree) {
   try { if (!lstatSync(dest).isDirectory()) rmSync(dest, { force: true }); } catch { /* absent */ }
   mkdirSync(dest, { recursive: true, mode: 0o700 });
   chmodSync(dest, 0o700);
-  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml') : [];
+  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml' && name !== 'generated_images') : [];
   for (const name of personal) linkPersonalEntry(join(source, name), join(dest, name));
-  const linked = new Set(personal);
+  // Native supporting images belong to this agent, not the person's shared
+  // image directory. Repair homes created before this distinction.
+  const generated = join(dest, 'generated_images');
+  try { if (lstatSync(generated).isSymbolicLink()) rmSync(generated); } catch { /* absent */ }
+  mkdirSync(generated, { recursive: true, mode: 0o700 });
+  const linked = new Set([...personal, 'generated_images']);
   for (const name of readdirSync(dest)) {
     if (linked.has(name) || name === 'config.toml') continue;
     // Only a LINK is ours to drop: a real entry under a name the person has
@@ -122,6 +211,212 @@ function isolatedCodexHome(dest, env, worktree) {
   return { path: dest, personalDeveloperInstructions };
 }
 
+/** The environment names a fenced Codex turn's MCP header values ride under,
+ *  one per header (`codexFencedMount`). */
+export const MCP_HEADER_ENV_PREFIX = 'FLOWVIANT_MCP_HEADER_';
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SERVER_NAME = /^[A-Za-z0-9_-]{1,80}$/;
+const expands = (value) => /\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(String(value));
+/**
+ * Names this machine's Codex, or the shell and tools under it, read for
+ * themselves. A server's env value rides in the CLI's own environment
+ * (`env_vars` forwards it), so a name the machine does not already set to that
+ * value would change how the CLI itself runs — a proxy, a CA bundle, a
+ * provider key. Such a server is left unmounted, in words.
+ */
+const CLI_ENV =
+  /^(PATH|HOME|SHELL|USER|LOGNAME|PWD|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|DISPLAY|WAYLAND_DISPLAY|BROWSER|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|RUST_LOG|RUST_BACKTRACE|HTTPS?_PROXY|ALL_PROXY|NO_PROXY|https?_proxy|all_proxy|no_proxy)$|^(LC|XDG|LD|DYLD|OPENAI|CODEX|AZURE_OPENAI|FLOWVIANT)_/;
+
+/** This machine's own Codex servers: its config.toml's `[mcp_servers.*]`,
+ *  read the way codexPersonal.mjs reads the login (bounded; a file that does
+ *  not parse carries nothing). */
+function machineCodexServers(machineEnv) {
+  try {
+    const path = join(resolve(codexHome(machineEnv)), 'config.toml');
+    const st = statSync(path);
+    if (!st.isFile() || st.size > 1024 * 1024) return [];
+    const servers = parseCodexToml(readFileSync(path, 'utf8'))?.mcp_servers;
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return [];
+    return Object.entries(servers).filter(([, v]) => v && typeof v === 'object' && !Array.isArray(v));
+  } catch {
+    return [];
+  }
+}
+const tomlScalar = (v) => (v instanceof TomlRaw ? v.text : typeof v === 'number' && Number.isFinite(v) ? String(v) : null);
+const words = (v) => (Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : null);
+const table = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+
+/**
+ * THE MCP SERVERS ON A FENCED CODEX TURN — the project's and, since 2026-10-11,
+ * the machine's own (the owner: "the server that is running flowviant's claude
+ * HAS these MCPs yet the agents are not using them"). A Codex build reads both
+ * from the agent's config.toml (`isolatedCodexHome`: the person's own tables
+ * kept, the repo's beside them). Every fenced posture — write-up, mockup,
+ * 3D model, deck, image — passes `--ignore-user-config`, which drops that
+ * file, and a `-p` profile layered beside the flag was measured to load no
+ * server either (codex-cli 0.159.2, artifactProjectMcp.test.mjs). So these
+ * turns take the servers as `-c` pairs, the way codexPersonal.mjs carries a
+ * login back, under the same rule: A LITERAL SECRET NEVER RIDES ARGV.
+ *
+ *  · A stdio server's command and arguments ride as written: they are the
+ *    server process's own command line once Codex starts it, so `-c` adds no
+ *    reader. A project server whose command or arguments expand a `${VAR}`
+ *    is still left unmounted (the 2026-10-10 audit took expanded values off
+ *    argv, and this keeps that line).
+ *  · Every env value rides in the turn's ENVIRONMENT under its own name,
+ *    forwarded by Codex's `env_vars` — except a project value with no `${VAR}`,
+ *    which is text of the reviewed file and rides as written. Refused (the
+ *    server is left unmounted, with the reason) when the name is the
+ *    daemon's own (`FLOWVIANT_*`, `CODEX_HOME`), when this machine already
+ *    sets it to something else, or when it is one the CLI reads itself
+ *    (`CLI_ENV`) and the machine does not set it.
+ *  · Every header value rides in the environment, named by
+ *    `env_http_headers`. A machine server's own `env_http_headers`,
+ *    `bearer_token_env_var` and `env_vars` are names, and ride as written.
+ *  · A URL that expands a `${VAR}`, or carries a query, fragment or
+ *    credentials, has no indirection in Codex's config: left unmounted.
+ *  · A machine server keeps its own `cwd`, timeouts and tool lists; it is
+ *    skipped where the person turned it off (`enabled = false`), and a
+ *    project server of the same name replaces it, as on the build.
+ *  · Each mounted server's tools are approved by name: an unannotated tool
+ *    under a fenced posture failed "MCP tool call requires approval, but
+ *    approval policy is never" (measured, 0.159.2) — never a blanket
+ *    approval policy.
+ *
+ * `usable` is the base snapshot's ready entries; `expand` reads a value the
+ * way projectTools.mjs does; `machineEnv` is the caller's own (what the child
+ * would inherit). Returns `{ args, env, mounted, machine, unmounted }`:
+ * `mounted` the project servers, `machine` the machine's own, and
+ * `unmounted` `[{ name, reason, source: 'project' | 'machine' }]`.
+ */
+function codexFencedMount(usable, expand, machineEnv) {
+  const args = [];
+  const childEnv = {};
+  const mounted = [];
+  const machine = [];
+  const unmounted = [];
+  let header = 0;
+  /** A refusal sentence, or null with the value staged in `extra`. */
+  const forward = (key, value, extra) => {
+    if (key.startsWith('FLOWVIANT_') || key === 'CODEX_HOME') return `its env ${key} is a name this daemon keeps for itself`;
+    const has = machineEnv[key];
+    if (has !== undefined) return has === value ? null : `its env ${key} would replace this machine's own ${key}, which a fenced Codex turn cannot do`;
+    if (CLI_ENV.test(key)) return `its env ${key} is one this machine's Codex reads itself, which a fenced Codex turn cannot set`;
+    const staged = childEnv[key] ?? extra[key];
+    if (staged !== undefined && staged !== value) return `its env ${key} would replace another server's ${key}`;
+    extra[key] = value;
+    return null;
+  };
+  const headerEnv = (headers, extra) =>
+    Object.entries(headers).map(([key, value]) => {
+      const envName = `${MCP_HEADER_ENV_PREFIX}${header++}`;
+      extra[envName] = value;
+      return `${toml(key)}=${toml(envName)}`;
+    });
+  const accept = (name, pairs, extra, list) => {
+    args.push(...pairs, '-c', `mcp_servers.${name}.default_tools_approval_mode="approve"`);
+    Object.assign(childEnv, extra);
+    list.push(name);
+  };
+
+  for (const { name, config } of usable) {
+    const pairs = [];
+    const extra = {};
+    let refused = null;
+    if (typeof config.command === 'string') {
+      const rawArgs = Array.isArray(config.args) ? config.args : [];
+      if (expands(config.command) || rawArgs.some(expands)) {
+        refused = 'its command or arguments name a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(String(config.command))}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map((v) => toml(String(v))).join(',')}]`);
+        const forwarded = [];
+        for (const [key, value] of Object.entries(config.env ?? {})) {
+          if (!ENV_NAME.test(key)) continue;
+          if (!expands(value)) {
+            pairs.push('-c', `mcp_servers.${name}.env.${key}=${toml(String(value))}`);
+            continue;
+          }
+          refused = forward(key, expand(value), extra);
+          if (refused) break;
+          forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+      }
+    } else if (typeof config.url === 'string') {
+      if (expands(config.url)) {
+        refused = 'its URL names a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(String(config.url))}`);
+        const named = headerEnv(Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v)])), extra);
+        if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+      }
+    } else continue;
+    if (refused) unmounted.push({ name, reason: refused, source: 'project' });
+    else accept(name, pairs, extra, mounted);
+  }
+
+  const projectNames = new Set(usable.map((t) => t.name));
+  for (const [name, server] of machineCodexServers(machineEnv)) {
+    if (projectNames.has(name) || name === 'flowviant' || server.enabled === false) continue;
+    if (typeof server.command !== 'string' && typeof server.url !== 'string') continue;
+    const pairs = [];
+    const extra = {};
+    let refused = SERVER_NAME.test(name) ? null : 'its name cannot be spelled as a command-line setting';
+    if (!refused && typeof server.command === 'string') {
+      const rawArgs = server.args === undefined ? [] : words(server.args);
+      if (!rawArgs) refused = 'its args are not a list of words';
+      else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(server.command)}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map(toml).join(',')}]`);
+        const forwarded = [...(words(server.env_vars) ?? []).filter((k) => ENV_NAME.test(k))];
+        for (const [key, value] of Object.entries(table(server.env))) {
+          if (!ENV_NAME.test(key) || typeof value !== 'string') {
+            refused = `its env ${String(key).slice(0, 40)} is not a name and text`;
+            break;
+          }
+          refused = forward(key, value, extra);
+          if (refused) break;
+          if (!forwarded.includes(key)) forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+        if (typeof server.cwd === 'string') pairs.push('-c', `mcp_servers.${name}.cwd=${toml(server.cwd)}`);
+      }
+    } else if (!refused) {
+      let url = null;
+      try { url = new URL(server.url); } catch { /* refused below */ }
+      if (!url || url.search || url.hash || url.username || url.password) {
+        refused = 'its URL carries a query, fragment or credentials, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(server.url)}`);
+        if (typeof server.bearer_token_env_var === 'string' && ENV_NAME.test(server.bearer_token_env_var))
+          pairs.push('-c', `mcp_servers.${name}.bearer_token_env_var=${toml(server.bearer_token_env_var)}`);
+        const literal = table(server.http_headers);
+        const byName = table(server.env_http_headers);
+        if (Object.values(literal).some((v) => typeof v !== 'string') || Object.values(byName).some((v) => typeof v !== 'string' || !ENV_NAME.test(v))) {
+          refused = 'its headers are not text';
+        } else {
+          const named = [...headerEnv(literal, extra), ...Object.entries(byName).map(([key, envName]) => `${toml(key)}=${toml(envName)}`)];
+          if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+        }
+      }
+    }
+    if (!refused) {
+      for (const key of ['startup_timeout_sec', 'startup_timeout_ms', 'tool_timeout_sec']) {
+        const v = tomlScalar(server[key]);
+        if (v != null && /^[0-9_.]+$/.test(v)) pairs.push('-c', `mcp_servers.${name}.${key}=${v}`);
+      }
+      for (const key of ['enabled_tools', 'disabled_tools']) {
+        const list = words(server[key]);
+        if (list) pairs.push('-c', `mcp_servers.${name}.${key}=[${list.map(toml).join(',')}]`);
+      }
+    }
+    if (refused) unmounted.push({ name, reason: refused, source: 'machine' });
+    else accept(name, pairs, extra, machine);
+  }
+  return { args, env: childEnv, mounted, machine, unmounted };
+}
+
 /** Claude takes the base branch's skills as a plugin written for this turn. */
 function reviewedClaudePlugin(dir, snapshot) {
   if (!snapshot.skillFiles.length) return null;
@@ -139,8 +434,10 @@ function reviewedClaudePlugin(dir, snapshot) {
 /**
  * The table. `refuseMcp(config)` names why this runtime cannot take one MCP
  * configuration it otherwise could; `prepare(dir, snapshot, env, worktree,
- * kept)` returns the runner-specific part of prepareAgentTools' result — under
- * `dir`, which dies with the turn, except what `kept` names a lasting place for.
+ * turn)` returns the runner-specific part of prepareAgentTools' result — under
+ * `dir`, which dies with the turn, except what `turn.codexHome` names a
+ * lasting place for. `turn.mcpServers` is the base branch's servers this
+ * runtime takes, expanded.
  */
 const TOOL_RUNTIMES = {
   claude: {
@@ -156,10 +453,12 @@ const TOOL_RUNTIMES = {
     // The agent's own lasting home when the caller has one (2026-09-29: its
     // threads are indexed under it — see isolatedCodexHome), else one that
     // dies with the turn, as every home did before.
-    prepare: (dir, _snapshot, env, worktree, kept) => {
-      const isolated = isolatedCodexHome(kept?.codexHome ?? join(dir, 'codex-home'), env, worktree);
+    prepare: (dir, _snapshot, env, worktree, turn) => {
+      const isolated = isolatedCodexHome(turn?.codexHome ?? join(dir, 'codex-home'), env, worktree, turn?.mcpServers);
       return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions };
     },
+    // A fenced posture ignores that home's config.toml (2026-10-10).
+    fencedMount: codexFencedMount,
   },
   antigravity: { mcp: false, skills: false },
 };
@@ -168,6 +467,16 @@ const TOOL_RUNTIMES = {
 const takesNothing = { mcp: false, skills: false };
 const rowFor = (runner) => (Object.hasOwn(TOOL_RUNTIMES, runner) ? TOOL_RUNTIMES[runner] : takesNothing);
 
+/** The servers as a fenced posture takes them where it ignores the runner's
+ *  own file — Codex's `-c` pairs and environment (`codexFencedMount`) — or
+ *  null for a runner whose fenced turns read the same file as its build
+ *  (Claude's strict mcp.json) or that takes none. `usable` is the base
+ *  snapshot's ready entries; `expand(value)` reads a `${VAR}`. */
+export function fencedMountFor(runner, usable, expand, machineEnv = process.env) {
+  const mount = rowFor(runner).fencedMount;
+  return mount ? mount(usable, expand, machineEnv) : null;
+}
+
 /** Pure mapping used before a future tool-attach gesture is offered. */
 export function runnerToolCapabilities(runner) {
   const { mcp, skills } = rowFor(runner);
@@ -189,8 +498,8 @@ export function skillsRefusal(runner) {
   return runner === 'none' ? 'no installed CLI can take instructions' : `${runner} cannot take instructions`;
 }
 
-/** The runner-specific files a turn needs, written under `dir` — or, for what
- *  `kept` names, where the caller keeps it between turns. */
-export function prepareForRunner(runner, dir, snapshot, env, worktree, kept = {}) {
-  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, kept) ?? {}) };
+/** The runner-specific files a turn needs, written under `dir` — or, for the
+ *  `codexHome` it names, where the caller keeps it between turns. */
+export function prepareForRunner(runner, dir, snapshot, env, worktree, turn = {}) {
+  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, turn) ?? {}) };
 }