flowviant 0.116.0 → 0.124.0

package/bin/lib/runTurn.mjs

@@ -10,16 +10,19 @@
  * (runtimeEvents.mjs).
  */
 
+import { runIsolatedResearch } from './codexResearch.mjs';
 import { spawn } from 'node:child_process';
 import { runtimeById } from './runtimes.mjs';
-import { withoutMachineCredentials } from './machineEnv.mjs';
-import { openBrowserHome, withoutWindows } from './noWindowEnv.mjs';
+import { openBrowserHome, unattendedEnv } from './noWindowEnv.mjs';
 import { resolveTurnProfile } from './turnProfile.mjs';
 import { claudePermFor } from './claudePosture.mjs';
 import { handleStreamLine } from './claudeStream.mjs';
 import { never, workLanesStopped } from './standDownGate.mjs';
 import { learnCodexLimits, recordClaudeRateLimit } from './runtimeLimits.mjs';
+import { initHarvestFor, recordMcpServers, recordSkills } from './runtimeCapabilities.mjs';
 import { codexTurnModel } from './turnModel.mjs';
+import { printableText } from './printable.mjs';
+import { startTurnDiagnostics } from './turnDiagnostics.mjs';
 
 /** How long a Codex turn's answer may wait on its rollout's model line. */
 const CODEX_MODEL_READ_MS = 1_500;
@@ -37,7 +40,9 @@ const CODEX_MODEL_READ_MS = 1_500;
  * needs it: the daemon authenticates to the server itself, and a turn that
  * needs the project's tools gets its own per-turn token through `mcpEnv` or
  * the MCP config file. So those two names, and only those, are removed —
- * by the one rule in machineEnv.mjs, which the project check obeys too.
+ * by the one rule in machineEnv.mjs, composed for every unattended CLI child
+ * by `unattendedEnv` (noWindowEnv.mjs), which the project check, the skills
+ * probe and the Codex offerings reads obey too.
  */
 /**
  * …AND, UNLESS A PERSON IS AT THE KEYBOARD, NO WAY TO A WINDOW (2026-09-29).
@@ -49,21 +54,27 @@ const CODEX_MODEL_READ_MS = 1_500;
  */
 export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
   // After the merge, so an mcpEnv can never smuggle one back in.
-  const env = withoutMachineCredentials({ ...process.env, ...(mcpEnv ?? {}) });
-  return display === true ? env : withoutWindows(env, browserHome);
+  return unattendedEnv({ ...process.env, ...(mcpEnv ?? {}) }, { display, browserHome });
 }
 
-// One Claude Code turn. Output is captured (for sentinel detection) and streamed
+// One CLI turn. Output is captured (for sentinel detection) and streamed
 // through, line-prefixed with the worker label so a fleet stays legible.
 //
-// `streamJson` switches to `--output-format stream-json` and parses the event
-// stream: only the humanized tool activity reaches the console (a legible
-// stream of `read …`, `grep …`, `+ node …`), assistant text is folded into the
-// returned string for sentinel detection, and each activity is handed to
-// `onActivity` so the caller can forward progress. Build-agent turns leave it
-// off and keep the raw text passthrough + line sentinels.
+// The event stream is parsed, always: only the humanized tool activity reaches
+// the console (a legible stream of `read …`, `grep …`, `+ node …`), assistant
+// text is folded into the returned string for sentinel detection, and each
+// activity is handed to `onActivity` so the caller can forward progress.
 export function runTurn(opts) {
-  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
+  // A Codex write-up runs over an isolated copy of its worktree
+  // (codexResearch.mjs). After the teardown it copies nothing either: the
+  // stand-down gate below is asked before the copy, not only before the spawn.
+  if (opts.runtime === 'codex' && opts.profile === 'research')
+    return workLanesStopped() ? never() : runIsolatedResearch(opts, runPlainTurn);
+  return runPlainTurn(opts);
+}
+
+function runPlainTurn(opts) {
+  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
   /**
    * AFTER THE TEARDOWN, NO TURN STARTS AND NO TURN ENDS (standDownGate.mjs).
    * A stand-down that drains a deploy keeps this process alive; without this
@@ -157,12 +168,12 @@ export function runTurn(opts) {
     // to get wrong: the caller named one profile (turnProfile.mjs).
     const args = rt.args({
       personal,
+      researchIsolation: opts.researchIsolation,
       prompt,
       system,
       model,
       effort,
       resume,
-      streamJson,
       profile: turnProfile.adapterProfile,
       agentTools,
       // Adopting a terminal session (workSessionTurns.mjs): Claude turns it into
@@ -172,9 +183,9 @@ export function runTurn(opts) {
       // so a mis-wired adoption fails as a loud turn error rather than a
       // silent fresh conversation wearing an adopted session's name.
       adoptResumeId,
-      // Only the wiki profile uses it, but it is passed unconditionally: a
-      // runtime that can path-scope its writes needs to know WHERE the vault is,
-      // and Claude — which cannot — simply ignores it.
+      // Only the wiki profile uses it, but it is passed unconditionally: every
+      // runtime that runs a cartographer path-scopes its writes to the vault
+      // and needs to know WHERE it is — Claude's list names it too (2026-10-10).
       vaultDir,
       // The turn's own directory, for a runtime that fences its writes to a
       // path under it: Codex's image profile makes `<cwd>/.flowviant/artifacts`
@@ -185,8 +196,8 @@ export function runTurn(opts) {
       // prompt hands an absolute path OUTSIDE the cwd — and a curated Claude
       // profile (the capture chat's read-only list, `FLOWVIANT_SAFE=1`) may
       // refuse a read there. `--add-dir` says the directory is one it may read.
-      // Only Claude's adapter uses it; codex's sandboxes read the filesystem
-      // already, and agy's `--add-dir` is spent on the wiki vault.
+      // Claude adds it as a directory; Codex includes only this library in
+      // its project read boundary; agy's `--add-dir` is spent on the vault.
       knowledgeDir,
       // Structured-output flags for the MEDIATED path. Handed to the adapter
       // rather than appended here for the same reason `mcp` is: Codex takes its
@@ -196,7 +207,16 @@ export function runTurn(opts) {
       // PLAN MODE REPLACES THE POSTURE, never joins it: beside
       // `--dangerously-skip-permissions` the bypass wins silently (measured —
       // see PLAN_MODE_PERM).
-      perm: claudePermFor(turnProfile.name, knowledgeDir),
+      //
+      // …AND THE PROJECT SERVERS IT MAY CALL (2026-10-10): the names of the
+      // base `.mcp.json` servers the caller mounted, each allowed by name on a
+      // profile that mounts them (`projectMcp`, turnProfile.mjs) — never on
+      // one that does not, whatever a caller passes.
+      perm: claudePermFor(turnProfile.name, knowledgeDir, vaultDir, turnProfile.projectMcp ? (opts.projectMcpServers ?? []) : []),
+      // …AND THE MACHINE'S OWN MCP SERVERS (2026-10-11): the `.mcp.json`
+      // server names an agent lane disables beside them, on a profile that
+      // mounts project servers — never on one that does not.
+      machineMcp: turnProfile.projectMcp ? opts.machineMcp : undefined,
       // Handed to the adapter rather than appended here, because WHERE these go
       // is a property of the CLI: Codex reads its prompt as a trailing
       // positional, so a flag after it is a flag in the wrong place.
@@ -223,45 +243,78 @@ export function runTurn(opts) {
     // Which credential is correct, and whether an account may be shared, is
     // between the operator and the vendor. Flowviant does not detect it and does
     // not enforce it; it runs the CLI the ordinary way and relays what happens.
-    //
-    // A turn nobody is sitting at keeps its browsers in a home of its own —
-    // the lane's kept one (an agent's), else this spawn's, removed when the
-    // CLI closes. See `cliEnv`.
-    const browser = display === true ? null : openBrowserHome(browserHome);
-    const child = spawn(rt.bin, args, {
-      cwd,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      /**
-       * ITS OWN PROCESS GROUP, so what the agent starts stays attributable.
-       *
-       * Everything the CLI spawns inherits this pgid and KEEPS it through
-       * `nohup` and `setsid` — which is exactly when attribution by descendancy
-       * fails, because reparenting to init breaks the ppid chain the moment a
-       * process becomes long-running. `processes.mjs` reads the group; the
-       * Workbench renders it.
-       *
-       * TEARDOWN IS DELIBERATELY UNCHANGED: `shutdownWork` still SIGTERMs this
-       * CHILD and never the group. Signalling the group would kill the dev
-       * server the driver started every time the daemon restarts — including
-       * on an ordinary auto-update, unattended — which is the outcome the
-       * deleted dev-run supervisor spent a whole registry avoiding. Flowviant
-       * does not manage those processes; it reports them.
-       *
-       * Not `unref`'d: the daemon must still wait on this turn.
-       */
-      detached: true,
-      // Only ADDS to the environment (the worker token, for runtimes that read
-      // it from there). Never replaces it: the CLI's own credentials live in
-      // this environment, and handing it a curated one signs it out. What it
-      // REMOVES is this daemon's machine credential and, for a turn nobody is
-      // sitting at, every way to a window — see `cliEnv`.
-      // The login's literal secrets first, so nothing of the lane's (its MCP
-      // token, its CODEX_HOME) can be overwritten by one.
-      env: cliEnv(personal?.env ? { ...personal.env, ...(mcpEnv ?? {}) } : mcpEnv, {
+    /**
+     * WHAT THE ADAPTER WROTE FOR THIS ARGV goes when the turn settles — once,
+     * on close or on a spawn error: Claude's fenced `--settings` file, which
+     * holds the person's login settings (claudePersonal.mjs, 2026-10-10).
+     * Everything between the argv and the spawn sits inside the `try` below,
+     * so no throw on the way leaves that file behind: the sweep takes only a
+     * dead process's leftovers, and this one names the daemon's own pid.
+     */
+    let argsReleased = false;
+    const releaseArgs = () => {
+      if (argsReleased) return;
+      argsReleased = true;
+      try {
+        rt.releaseArgs?.(args);
+      } catch {
+        /* best effort — a later write sweeps it */
+      }
+    };
+    let browser = null;
+    let child;
+    let finishDiagnostics = () => {};
+    try {
+      // A turn nobody is sitting at keeps its browsers in a home of its own —
+      // the lane's kept one (an agent's), else this spawn's, removed when the
+      // CLI closes. See `cliEnv`.
+      browser = display === true ? null : openBrowserHome(browserHome);
+      const childEnv = cliEnv(personal?.env ? { ...personal.env, ...(mcpEnv ?? {}) } : mcpEnv, {
         display: display === true,
         browserHome: browser?.dir,
-      }),
-    });
+      });
+      finishDiagnostics = startTurnDiagnostics({ runtime, bin: rt.bin, env: childEnv,
+        cwd, args, profile: turnProfile.name, planId: opts.diagnosticPlanId });
+      child = spawn(rt.bin, args, {
+        cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        /**
+         * ITS OWN PROCESS GROUP, so what the agent starts stays attributable.
+         *
+         * Everything the CLI spawns inherits this pgid and KEEPS it through
+         * `nohup` and `setsid` — which is exactly when attribution by descendancy
+         * fails, because reparenting to init breaks the ppid chain the moment a
+         * process becomes long-running. `processes.mjs` reads the group; the
+         * Workbench renders it.
+         *
+         * TEARDOWN IS DELIBERATELY UNCHANGED: `shutdownWork` still SIGTERMs this
+         * CHILD and never the group. Signalling the group would kill the dev
+         * server the driver started every time the daemon restarts — including
+         * on an ordinary auto-update, unattended — which is the outcome the
+         * deleted dev-run supervisor spent a whole registry avoiding. Flowviant
+         * does not manage those processes; it reports them.
+         *
+         * Not `unref`'d: the daemon must still wait on this turn.
+         */
+        detached: true,
+        // Only ADDS to the environment (the worker token, for runtimes that read
+        // it from there). Never replaces it: the CLI's own credentials live in
+        // this environment, and handing it a curated one signs it out. What it
+        // REMOVES is this daemon's machine credential and, for a turn nobody is
+        // sitting at, every way to a window — see `cliEnv`.
+        // The login's literal secrets first, so nothing of the lane's (its MCP
+        // token, its CODEX_HOME) can be overwritten by one.
+        env: childEnv,
+      });
+    } catch (error) {
+      finishDiagnostics({ spawnError: typeof error?.code === 'string' ? error.code : 'SPAWN_THROW' });
+      // A spawn that throws (an argument it refuses), or anything on the way
+      // to it, still takes what the adapter wrote with it — and this spawn's
+      // own browser home.
+      releaseArgs();
+      browser?.cleanup();
+      throw error;
+    }
     if (browser) {
       child.once('close', browser.cleanup);
       child.once('error', browser.cleanup);
@@ -272,170 +325,194 @@ export function runTurn(opts) {
     const spawnedAt = Date.now();
     let out = '';
     const pfx = label ? `${label} ` : '';
-    const emit = (s) => process.stdout.write(pfx ? s.replace(/\n/g, `\n${pfx}`) : s);
+    /**
+     * THE ONE SINK FOR WHAT A CLI OR A MODEL WROTE (2026-10-10, the audit's
+     * F133): activity labels — a Bash command, a Codex `say`, a file path —
+     * and the CLI's raw stderr. A prompt-injected agent can put an OSC 52 in
+     * a tool command as easily as in prose, and this wrote it to the
+     * operator's terminal as-is. Scrubbed HERE, before the daemon's own
+     * coloured `label` is added, so the prefix keeps its colour and nothing
+     * the model wrote keeps an escape sequence (printable.mjs, `printableText`).
+     */
+    const emit = (s) => {
+      const text = printableText(String(s));
+      process.stdout.write(pfx ? text.replace(/\n/g, `\n${pfx}`) : text);
+    };
 
-    // A runtime with its own parser is ALWAYS line-parsed — for Codex the JSONL
-    // stream is the only output there is, so treating it as raw text would print
-    // event objects at the operator and, worse, hand the sentinel matcher a
-    // string containing every word the model reasoned about.
-    const lineParsed = streamJson || Boolean(rt.parse);
-    if (lineParsed) {
-      let buf = '';
-      const appendText = (t) => {
-        out += t;
-      };
-      /**
-       * THE PLAN'S WINDOWS, LEARNED OFF EVERY TURN THIS DAEMON RUNS (0.109.0).
-       *
-       * This is the one spawn point — agent turns, Terminal tabs, capture
-       * chats, the planner, the pre-review and the wiki all come through here
-       * — so it is the one place that sees every CLI's word on its plan.
-       * Claude says it on the stream (`rate_limit_event`), recorded as it
-       * arrives; a caller's own `onRateLimit` still hears it. Codex writes it
-       * into the thread's rollout file instead, so the thread this turn spoke
-       * under (announced on `thread.started`, else the one it resumed) is read
-       * AFTER the child closes, on the next tick — the turn's answer never
-       * waits on a file read. See runtimeLimits.mjs.
-       */
-      const onRate = (info) => {
-        recordClaudeRateLimit(info);
-        onRateLimit?.(info);
-      };
-      let codexThread = rt.id === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;
-      /**
-       * THE MODEL THIS SPAWN RAN ON, ONCE (2026-09-29, turnModel.mjs). Claude
-       * names it in its init event and again on every reply; the first valid
-       * one is the answer, so the init wins and the first reply is the
-       * fallback. Codex names it only in its rollout, read at close below.
-       */
-      let ranOn = null;
-      const onRanOn = (m) => {
-        if (ranOn || !m) return;
-        ranOn = m;
-        onModel?.(m);
-      };
-      /** One line of the child's stdout, in whichever dialect it speaks. */
-      const onLine = (line) => {
-        if (!rt.parse)
-          return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit: onRate, onModel: onRanOn });
-        const ev = rt.parse(line, cwd);
-        if (!ev) return;
-        // The conversation id, when the runtime announces one (codex's
-        // thread.started). Purely additive: callers that pass no onThreadId —
-        // every dispatch path — see zero behavior change.
-        if (ev.threadId) {
-          if (rt.id === 'codex') codexThread = ev.threadId;
-          onThreadId?.(ev.threadId);
-        }
-        // The runtime's own token count (codex's `turn.completed`) — the same
-        // `onUsage` Claude's result event feeds, so a caller charges a turn
-        // identically whichever CLI ran it.
-        if (ev.usage) onUsage?.(ev.usage);
-        // One agent MESSAGE, alone — see parseCodexLine's `answer`. Last call
-        // wins at the caller, which is what "the final answer" means.
-        if (typeof ev.answer === 'string') onAnswer?.(ev.answer);
-        if (ev.text) appendText(ev.text);
-        if (ev.activity) {
-          emit(`${ev.activity.label}\n`);
-          onActivity?.(ev.activity);
-        }
-      };
-      // DECODED AS A STREAM, never chunk by chunk (2026-09-24, the audit): a
-      // pipe read can end inside a multi-byte character — the em dash models
-      // write constantly — and `d.toString()` per chunk turned each half into
-      // U+FFFD, which JSON.parse accepts and the reply then carried verbatim.
-      // `setEncoding` holds the partial bytes over to the next chunk.
-      child.stdout.setEncoding('utf8');
-      child.stderr.setEncoding('utf8');
-      child.stdout.on('data', (d) => {
-        buf += d;
-        let nl;
-        while ((nl = buf.indexOf('\n')) >= 0) {
-          const line = buf.slice(0, nl);
-          buf = buf.slice(nl + 1);
-          if (line.trim()) onLine(line);
-        }
-      });
-      // stderr is not JSON (warnings/errors) — pass through and keep for sentinels.
-      child.stderr.on('data', (s) => {
-        out += s;
-        emit(s);
-      });
-      child.on('error', (e) => {
-        if (e.code === 'ENOENT') {
-          // A MISSING CLI FAILS THE TURN, NOT THE DAEMON. This called
-          // process.exit(1), which was defensible while `claude` was the only
-          // runtime and preflight refused to start without it — the process
-          // could not reach here. Both halves of that are gone: preflight is now
-          // fatal only when NOTHING is drivable, so a Codex-only machine starts
-          // legitimately, and the wiki/plan-check/consult turns still ask for
-          // Claude by default. On such a machine the first wiki sweep would have
-          // killed the whole daemon, taking every in-flight build with it,
-          // because one background job could not find one binary.
-          console.error(`\nerror: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
-          resolve('');
-          return;
-        }
-        console.error(e);
-        resolve(out);
-      });
-      child.on('close', () => {
-        if (buf.trim()) onLine(buf);
-        const handBack = () => {
-          resolve(out);
-          // After the answer is handed back, never before it: see `onRate`.
-          if (codexThread) {
-            const thread = codexThread;
-            setImmediate(() => void learnCodexLimits(thread));
-          }
-        };
-        /**
-         * A CODEX TURN'S MODEL IS IN ITS ROLLOUT, so a caller that asked for
-         * it waits for one bounded read before the answer goes back — the
-         * settle it rides is built from that answer. Only then: a caller that
-         * passes no `onModel` hands back exactly as before. A read that fails
-         * or overruns reports nothing (never a guess).
-         */
-        if (codexThread && onModel && !ranOn) {
-          const thread = codexThread;
-          let timer = null;
-          const cap = new Promise((res) => {
-            timer = setTimeout(() => res(null), CODEX_MODEL_READ_MS);
-          });
-          void Promise.race([codexTurnModel(thread, { since: spawnedAt }), cap])
-            .then(onRanOn, () => {})
-            .finally(() => {
-              clearTimeout(timer);
-              handBack();
-            });
-          return;
+    // EVERY TURN IS LINE-PARSED (2026-10-10, the audit). Claude's adapter
+    // always asks for `--output-format stream-json` and every other runtime
+    // brings its own `parse` — for Codex the JSONL stream is the only output
+    // there is. A raw-text path survived for a `streamJson: false` no caller
+    // passed any more, with a second copy of the spawn-error rule that had
+    // already drifted once (it called process.exit(1)); both are gone. A line
+    // that is not JSON is still kept as text (claudeStream.mjs), and stderr
+    // still lands in the haystack the sentinels read.
+    let buf = '';
+    const appendText = (t) => {
+      out += t;
+    };
+    /**
+     * THE PLAN'S WINDOWS, LEARNED OFF EVERY TURN THIS DAEMON RUNS (0.109.0).
+     *
+     * This is the one spawn point — agent turns, Terminal tabs, capture
+     * chats, the planner, the pre-review and the wiki all come through here
+     * — so it is the one place that sees every CLI's word on its plan.
+     * Claude says it on the stream (`rate_limit_event`), recorded as it
+     * arrives; a caller's own `onRateLimit` still hears it. Codex writes it
+     * into the thread's rollout file instead, so the thread this turn spoke
+     * under (announced on `thread.started`, else the one it resumed) is read
+     * AFTER the child closes, on the next tick — the turn's answer never
+     * waits on a file read. See runtimeLimits.mjs.
+     */
+    const onRate = (info) => {
+      recordClaudeRateLimit(info);
+      onRateLimit?.(info);
+    };
+    let codexThread = rt.id === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;
+    /**
+     * THE MODEL THIS SPAWN RAN ON, ONCE (2026-09-29, turnModel.mjs). Claude
+     * names it in its init event and again on every reply; the first valid
+     * one is the answer, so the init wins and the first reply is the
+     * fallback. Codex names it only in its rollout, read at close below.
+     */
+    let ranOn = null;
+    const onRanOn = (m) => {
+      if (ranOn || !m) return;
+      ranOn = m;
+      onModel?.(m);
+    };
+    /**
+     * WHAT THE CLI SAID IT HAS — its skills and MCP servers — recorded HERE
+     * for every lane (2026-10-10, the audit), beside the plan's windows: four
+     * lanes each kept a copy of the harvest, and they drifted until a fenced
+     * turn's narrowed list overwrote the machine's report. Only a turn whose
+     * argv narrows neither is recorded (`initHarvestFor`,
+     * runtimeCapabilities.mjs); a caller's own `onInit` still hears every
+     * init.
+     */
+    const harvest = initHarvestFor(rt, args);
+    const onInitAll = (i) => {
+      if (harvest.skills) recordSkills(i?.skills);
+      if (harvest.mcp) recordMcpServers(i?.mcpServers, i?.tools);
+      onInit?.(i);
+    };
+    /** One line of the child's stdout, in whichever dialect it speaks. */
+    let cliFailed = false;
+    const onLine = (line) => {
+      try {
+        const event = JSON.parse(line);
+        if ((event.type === 'result' && event.is_error === true) ||
+            event.type === 'error' || event.type === 'turn.failed') {
+          cliFailed = true;
+          opts.onCliFailure?.();
         }
-        handBack();
-      });
-      return;
-    }
-
-    const onChunk = (s) => {
-      out += s;
-      emit(s);
+      } catch { /* ordinary non-JSON CLI output */ }
+      if (!rt.parse)
+        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn });
+      const ev = rt.parse(line, cwd);
+      if (!ev) return;
+      // The conversation id, when the runtime announces one (codex's
+      // thread.started). Purely additive: callers that pass no onThreadId —
+      // every dispatch path — see zero behavior change.
+      if (ev.threadId) {
+        if (rt.id === 'codex') codexThread = ev.threadId;
+        onThreadId?.(ev.threadId);
+      }
+      // The runtime's own token count (codex's `turn.completed`) — the same
+      // `onUsage` Claude's result event feeds, so a caller charges a turn
+      // identically whichever CLI ran it.
+      if (ev.toolEvent) onToolEvent?.(...ev.toolEvent);
+      if (ev.usage) onUsage?.(ev.usage);
+      // One agent MESSAGE, alone — see parseCodexLine's `answer`. Last call
+      // wins at the caller, which is what "the final answer" means.
+      if (typeof ev.answer === 'string') onAnswer?.(ev.answer);
+      if (ev.text) appendText(ev.text);
+      if (ev.activity) {
+        emit(`${ev.activity.label}\n`);
+        onActivity?.(ev.activity);
+      }
     };
-    // Stream-decoded for the same reason as the line-parsed path above.
+    // DECODED AS A STREAM, never chunk by chunk (2026-09-24, the audit): a
+    // pipe read can end inside a multi-byte character — the em dash models
+    // write constantly — and `d.toString()` per chunk turned each half into
+    // U+FFFD, which JSON.parse accepts and the reply then carried verbatim.
+    // `setEncoding` holds the partial bytes over to the next chunk.
     child.stdout.setEncoding('utf8');
     child.stderr.setEncoding('utf8');
-    child.stdout.on('data', onChunk);
-    child.stderr.on('data', onChunk);
-    child.on('error', (e) => {
+    child.stdout.on('data', (d) => {
+      buf += d;
+      let nl;
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 1);
+        if (line.trim()) onLine(line);
+      }
+    });
+    // stderr is not JSON (warnings/errors) — pass through and keep for sentinels.
+    child.stderr.on('data', (s) => {
+      out += s;
+      emit(s);
+    });
+    /**
+     * A SPAWN THAT FAILS FAILS THE TURN, NOT THE DAEMON — the one copy of the
+     * rule. A missing CLI resolves '' with the install line; this called
+     * process.exit(1), which was defensible while `claude` was the only
+     * runtime and preflight refused to start without it — the process could
+     * not reach here. Both halves of that are gone: preflight is now fatal
+     * only when NOTHING is drivable, so a Codex-only machine starts
+     * legitimately, and the wiki/plan-check/consult turns still ask for Claude
+     * by default. On such a machine the first wiki sweep would have killed the
+     * whole daemon, taking every in-flight build with it, because one
+     * background job could not find one binary. Any other spawn error
+     * resolves what was captured so far.
+     */
+    const onSpawnError = (e) => {
+      finishDiagnostics({ pid: child.pid, spawnError: typeof e.code === 'string' ? e.code : 'SPAWN_ERROR' });
+      releaseArgs();
       if (e.code === 'ENOENT') {
-        // A MISSING CLI FAILS THE TURN, NOT THE DAEMON — same fix as the
-        // line-parsed path above; this raw-output duplicate used to
-        // process.exit(1) and take every in-flight worker down with it.
         console.error(`\nerror: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
         resolve('');
         return;
       }
       console.error(e);
       resolve(out);
+    };
+    child.on('error', onSpawnError);
+    child.on('close', (code, signal) => {
+      releaseArgs();
+      opts.onExit?.(code, signal);
+      if (buf.trim()) onLine(buf);
+      finishDiagnostics({ code, signal, pid: child.pid, output: out, cliFailed });
+      const handBack = () => {
+        resolve(out);
+        // After the answer is handed back, never before it: see `onRate`.
+        if (codexThread) {
+          const thread = codexThread;
+          setImmediate(() => void learnCodexLimits(thread));
+        }
+      };
+      /**
+       * A CODEX TURN'S MODEL IS IN ITS ROLLOUT, so a caller that asked for
+       * it waits for one bounded read before the answer goes back — the
+       * settle it rides is built from that answer. Only then: a caller that
+       * passes no `onModel` hands back exactly as before. A read that fails
+       * or overruns reports nothing (never a guess).
+       */
+      if (codexThread && onModel && !ranOn) {
+        const thread = codexThread;
+        let timer = null;
+        const cap = new Promise((res) => {
+          timer = setTimeout(() => res(null), CODEX_MODEL_READ_MS);
+        });
+        void Promise.race([codexTurnModel(thread, { since: spawnedAt }), cap])
+          .then(onRanOn, () => {})
+          .finally(() => {
+            clearTimeout(timer);
+            handBack();
+          });
+        return;
+      }
+      handBack();
     });
-    child.on('close', () => resolve(out));
   });
 }

package/bin/lib/runtimeAntigravity.mjs

@@ -136,6 +136,16 @@ export const ANTIGRAVITY_RUNTIME = {
   /** No measured ladder, and ignorance never refuses: the full list, as the
    *  server's `RUNTIME_EFFORTS.antigravity` keeps it. */
   efforts: ['low', 'medium', 'high', 'xhigh', 'max'],
+  /**
+   * A TERMINAL TAB ON AGY RUNS PLAIN (audit 2026-10-10, F159; see
+   * runtimeClaude.mjs for the three facts): no MCP to mount — no credential,
+   * no cards, no streaming; the answer lands through the daemon's own report.
+   * No plan mode. Adoption MOVES the conversation (`--conversation <id>`,
+   * below): agy has no fork, so the tab continues the terminal's own store.
+   */
+  tab: 'plain',
+  planTurns: false,
+  adopt: 'move',
   mcp: null,
   args({ prompt, system, model, effort, resume, resumeConversationId, profile = 'build', vaultDir, resultSchemaArgs = [], adoptResumeId }) {
     const a = [];
@@ -158,8 +168,10 @@ export const ANTIGRAVITY_RUNTIME = {
     a.push(...resultSchemaArgs);
 
     if (profile === 'wiki') {
-      // THE CARTOGRAPHER, at the same bar WIKI_PERM sets for Claude — writes
-      // allowed, network shut. Both halves measured on 1.1.12:
+      // THE CARTOGRAPHER, at the bar Claude's old wiki list set — writes
+      // allowed, network shut. (Claude's list scopes the write to the vault
+      // since 2026-10-10; agy's flags cannot express "write only this
+      // directory", so this one does not.) Both halves measured on 1.1.12:
       //   • headless cannot prompt, so anything needing approval is
       //     auto-denied — including the file writes a wiki turn exists to
       //     make. `--dangerously-skip-permissions` is what grants them.
@@ -169,9 +181,8 @@ export const ANTIGRAVITY_RUNTIME = {
       // auto-approving the sandbox-bypass prompt). It does NOT reproduce on
       // 1.1.12 — tested together, the write landed and the network stayed
       // shut. Re-check on upgrade: if it ever does cancel, this posture
-      // silently becomes "wiki turn with internet", which is the one line
-      // WIKI_PERM draws ("Command execution is the line: it enables network
-      // exfil").
+      // silently becomes "wiki turn with internet" — and the vault it writes
+      // is uploaded either way.
       if (vaultDir) a.push('--add-dir', vaultDir);
       a.push('--sandbox', '--dangerously-skip-permissions');
       // A sweep reads a whole repository; the 5m default would guillotine it.