flowviant 0.116.0 → 0.124.0

package/bin/lib/projectTools.mjs

@@ -1,27 +1,28 @@
 /** Repo-owned tool configuration, read from the base ref for every agent turn. */
-import { execFileSync } from 'node:child_process';
-import { accessSync, constants, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { delimiter, isAbsolute, join } from 'node:path';
+import { accessSync, constants, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
-import { mcpRefusal, prepareForRunner, skillsRefusal, toml } from './projectToolRuntimes.mjs';
+import { git, gitRaw, splitNul } from './git.mjs';
+import { withoutMachineCredentials } from './machineEnv.mjs';
+import { fencedMountFor, mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
 
 const MAX_TOOLS = 40;
 const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
 const MAX_INSTRUCTION_FILES = 80;
 const MAX_INSTRUCTION_BYTES = 512 * 1024;
 const nameOk = (name) => /^[A-Za-z0-9_-]{1,80}$/.test(name) && name !== 'flowviant';
+/** Base-ref reads are QUIET (git's "does not exist in" for an absent file is
+ *  an answer here, not a message for the daemon's terminal) and keep a 1 MiB
+ *  cap per file. */
+const SHOW = Object.freeze({ stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024 });
 const show = (root, ref, path) => {
   try {
-    return execFileSync('git', ['show', `${ref}:${path}`], {
-      cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-    });
+    return gitRaw(['show', `${ref}:${path}`], root, SHOW);
   } catch { return null; }
 };
 const showBytes = (root, ref, path) => {
   try {
-    return execFileSync('git', ['show', `${ref}:${path}`], {
-      cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-    });
+    return gitRaw(['show', `${ref}:${path}`], root, { ...SHOW, encoding: 'buffer' });
   } catch { return null; }
 };
 
@@ -39,11 +40,39 @@ function referenced(value) {
   return [...String(value).matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
 }
 
-export function readBaseTools(root, ref, env = process.env) {
+/**
+ * THE ENVIRONMENT A `${VAR}` IN THE REPO'S `.mcp.json` IS READ FROM: the
+ * caller's, MINUS THE MACHINE CREDENTIAL AND EVERY OTHER `FLOWVIANT_*` NAME,
+ * whatever the caller passed (2026-10-10, the audit). A base-branch
+ * `"url": "https://x/mcp?k=${FLOWVIANT_FLEET}"` delivered the credential this
+ * daemon authenticates with to that host on every agent turn — the
+ * inherited-credential leak machineEnv.mjs exists to close. The daemon's own
+ * names are nobody's repo config to read, so such a server reads as
+ * `missing` ("env FLOWVIANT_FLEET unset").
+ */
+const expansionEnv = (env) =>
+  Object.fromEntries(Object.entries(withoutMachineCredentials(env ?? process.env)).filter(([key]) => !key.startsWith('FLOWVIANT_')));
+
+/**
+ * A TREE LISTING IS NUL-SEPARATED AND SIZED FOR A REAL REPOSITORY (2026-10-10,
+ * the audit). The whole-tree listing that finds nested CLAUDE.md/AGENTS.md ran
+ * under a 1 MiB buffer — about 20k paths — and nothing caught the ENOBUFS, so
+ * EVERY agent turn on a larger repository settled `nothing` before its CLI
+ * started. 64 MiB is workAdoptCarry.mjs's precedent; MAX_INSTRUCTION_FILES and
+ * MAX_INSTRUCTION_BYTES stay the real bounds. `-z` because git C-quotes a path
+ * that is not plain ASCII (`"d\303\251j\303\240/CLAUDE.md"`), which the name
+ * filter never matched (git.mjs's `-z` rule).
+ */
+const LIST_MAX_BUFFER = 64 * 1024 * 1024;
+const listTree = (root, args) =>
+  splitNul(gitRaw(['ls-tree', '-r', '-z', '--name-only', ...args], root, {
+    stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: LIST_MAX_BUFFER,
+  }));
+
+export function readBaseTools(root, ref, callerEnv = process.env) {
+  const env = expansionEnv(callerEnv);
   // Resolve once: a base branch may advance while the turn is being prepared.
-  const commit = execFileSync('git', ['rev-parse', '--verify', ref], {
-    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-  }).trim();
+  const commit = git(['rev-parse', '--verify', ref], root, { stdio: ['ignore', 'pipe', 'ignore'] });
   const raw = show(root, commit, '.mcp.json');
   let servers = {};
   if (raw != null) {
@@ -53,9 +82,7 @@ export function readBaseTools(root, ref, env = process.env) {
   const skills = [];
   const skillFiles = [];
   try {
-    const paths = execFileSync('git', ['ls-tree', '-r', '--name-only', commit, '--', '.claude/skills'], {
-      cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-    }).split('\n');
+    const paths = listTree(root, [commit, '--', '.claude/skills']);
     let bytes = 0;
     for (const path of paths) {
       if (!/^\.claude\/skills\/[A-Za-z0-9_-]+\/(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+$/.test(path)) continue;
@@ -82,9 +109,7 @@ export function readBaseTools(root, ref, env = process.env) {
   // Nested instructions are normally discovered when a CLI enters that path.
   // Their worktree copies must not regain authority through that discovery.
   const instructions = [];
-  const paths = execFileSync('git', ['ls-tree', '-r', '--name-only', commit], {
-    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
-  }).split('\n').filter((path) => /(^|\/)(CLAUDE|AGENTS)\.md$/.test(path));
+  const paths = listTree(root, [commit]).filter((path) => /(^|\/)(CLAUDE|AGENTS)\.md$/.test(path));
   if (paths.length > MAX_INSTRUCTION_FILES) throw new Error('Base branch has too many agent instruction files');
   let instructionBytes = 0;
   for (const path of paths) {
@@ -99,6 +124,7 @@ export function readBaseTools(root, ref, env = process.env) {
 
 const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
 
+
 /**
  * Temporary per-turn files are removed after the last retry. No personal CLI config is written.
  *
@@ -107,32 +133,33 @@ const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]
  * removed by `cleanup`, because Codex indexes a thread under the home it ran
  * in and the next card resumes that thread. Absent, a Codex turn gets a home
  * that dies with it.
+ *
+ * NO EXPANDED VALUE RIDES ARGV (2026-10-10, the audit): Claude's servers go
+ * to this turn's 0600 mcp.json, Codex's into the isolated home's config.toml
+ * (projectToolRuntimes.mjs) — never `-c` pairs on the command line. A fenced
+ * Codex turn, which ignores that file, takes `fencedMount` instead: the
+ * repo's own words as `-c` pairs and every expanded value in its environment.
  */
-export function prepareAgentTools(snapshot, runner, env = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
+export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
+  const env = expansionEnv(callerEnv);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
+  // What the base lists and this turn cannot mount, and why — the turn is told
+  // (postureTools.mjs), so a missing server is a named fact, never a guess.
+  const mcpUnmounted = snapshot.tools
+    .filter((t) => !usable.includes(t))
+    .map((t) => ({ name: t.name, reason: String(mcpRefusal(runner, t.config) ?? t.reason ?? 'not mounted').slice(0, 200) }));
   const mcpServers = {};
-  const codexArgs = [];
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
       const command = expand(config.command, env);
       const args = Array.isArray(config.args) ? config.args.map((v) => expand(v, env)) : [];
       const vars = Object.fromEntries(Object.entries(config.env ?? {}).map(([k, v]) => [k, expand(v, env)]));
       mcpServers[name] = { command, args, env: vars };
-      codexArgs.push('-c', `mcp_servers.${name}.command=${toml(command)}`);
-      codexArgs.push('-c', `mcp_servers.${name}.args=${JSON.stringify(args)}`);
-      for (const [key, value] of Object.entries(vars)) {
-        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) codexArgs.push('-c', `mcp_servers.${name}.env.${key}=${toml(value)}`);
-      }
     } else if (typeof config.url === 'string') {
       const url = expand(config.url, env);
       const headers = Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v, env)]));
       mcpServers[name] = { type: config.type ?? 'http', url, ...(Object.keys(headers).length ? { headers } : {}) };
-      codexArgs.push('-c', `mcp_servers.${name}.url=${toml(url)}`);
-      if (Object.keys(headers).length) {
-        const inline = Object.entries(headers).map(([key, value]) => `${toml(key)}=${toml(value)}`).join(',');
-        codexArgs.push('-c', `mcp_servers.${name}.http_headers={${inline}}`);
-      }
     }
   }
   const mcpPath = join(dir, 'mcp.json');
@@ -150,7 +177,7 @@ export function prepareAgentTools(snapshot, runner, env = process.env, worktree
   ].filter(Boolean).join('\n\n');
   let prepared;
   try {
-    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome });
+    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome, mcpServers });
   } catch (error) {
     rmSync(dir, { recursive: true, force: true });
     throw error;
@@ -158,7 +185,12 @@ export function prepareAgentTools(snapshot, runner, env = process.env, worktree
   const { pluginDir, codexHome, personalDeveloperInstructions } = prepared;
   return {
     mcpPath,
-    codexArgs,
+    /** The names of the servers mounted, as Claude's allow rules need them. */
+    mcpServers: Object.keys(mcpServers),
+    mcpUnmounted,
+    /** The mount a fenced turn takes where the runner's file is ignored
+     *  (`fencedMountFor`, projectToolRuntimes.mjs); null where it has none. */
+    fencedMount: fencedMountFor(runner, usable, (value) => expand(value, env), callerEnv),
     instructions,
     pluginDir,
     codexHome,
@@ -179,3 +211,46 @@ export function toolReadout(snapshot, runner) {
   }));
   return [...mcp, ...instructions].slice(0, MAX_REPORT_TOOLS);
 }
+
+const MCP_JSON_MAX_BYTES = 1024 * 1024;
+const MCP_JSON_MAX_NAMES = 500;
+/**
+ * EVERY SERVER NAMED IN A `.mcp.json` FROM `dir` UP TO `/` (2026-10-11). An
+ * agent turn that mounts the machine's MCP servers is not strict, and Claude
+ * Code then reads `.mcp.json` in its cwd and every parent wherever a settings
+ * scope approves one (measured, 2.1.290). The base branch's copy is the
+ * project's only `.mcp.json` input to an agent, so each of these names is
+ * disabled for the turn (claudePosture.mjs `withMachineMcp`): the agent's edit
+ * of its worktree's file mounts only after review lands it on base. A server
+ * the machine should have everywhere belongs in its CLI's user scope.
+ *
+ * NULL when the answer cannot be bounded — a `.mcp.json` over 1 MiB, or more
+ * than 500 names — and the lane then mounts strictly (the base copy alone)
+ * rather than leave one discovered. A file that does not parse names nothing:
+ * the CLI cannot read it either.
+ */
+export function mcpJsonServerNamesAbove(dir) {
+  const names = new Set();
+  let at = resolve(dir);
+  for (;;) {
+    const file = join(at, '.mcp.json');
+    let raw = null;
+    try {
+      const st = statSync(file);
+      if (st.isFile()) {
+        if (st.size > MCP_JSON_MAX_BYTES) return null;
+        raw = readFileSync(file, 'utf8');
+      }
+    } catch { /* none here */ }
+    if (raw != null) {
+      try {
+        const servers = JSON.parse(raw)?.mcpServers;
+        if (servers && typeof servers === 'object' && !Array.isArray(servers)) for (const name of Object.keys(servers)) names.add(name);
+      } catch { /* the CLI cannot parse it either */ }
+    }
+    if (names.size > MCP_JSON_MAX_NAMES) return null;
+    const up = dirname(at);
+    if (up === at) return [...names];
+    at = up;
+  }
+}