flowviant 0.116.0 → 0.124.0

package/bin/lib/runtimeCapabilities.mjs

@@ -16,6 +16,9 @@ import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { RUNTIMES } from './runtimes.mjs';
+import { unattendedEnv } from './noWindowEnv.mjs';
+import { claudeProjectDir } from './claudeSessions.mjs';
+import { CLAUDE_SESSION_RE } from './conversationIds.mjs';
 
 /**
  * WHAT THE CLI SAID IT CAN BE ASKED FOR BY NAME — the machine's skills.
@@ -103,29 +106,134 @@ export function knownSkills() {
 let mcpServersCache = null;
 
 export const MCP_STATUSES = new Set(['connected', 'failed', 'needs-auth', 'pending']);
+/** The server's own bounds (shared `MAX_MACHINE_MCP_SERVERS` and
+ *  `MCP_SERVER_NAME_MAX`); scripts/check-app-parity.mjs holds them equal. */
 export const MAX_MCP_SERVERS = 40;
 export const MCP_NAME_MAX = 60;
+/** The name charset the server's Codex report parser admits
+ *  (runtimeOfferings.ts `name`) — Claude's report has none, and its connector
+ *  names carry a space (`claude.ai Gmail`). */
+export const CODEX_MCP_NAME = /^[A-Za-z0-9_.:-]+$/;
 
-export function recordMcpServers(list) {
-  if (!Array.isArray(list)) return;
+/**
+ * ONE SHAPE FOR EVERY MCP REPORT THAT LEAVES THE BOX (2026-10-10, the audit)
+ * — Claude's `mcp` off a turn's init, and Codex's `rtp.codex`
+ * (runtimeOfferings.mjs) — bounded exactly as the server re-applies it, so
+ * nothing is cut silently at the boundary: names trimmed and CLIPPED at
+ * MCP_NAME_MAX (never dropped for length), `charset` when the server's parser
+ * has one, this daemon's own `flowviant` and every `connected` server dropped
+ * (see the header), the first of a name kept, sorted, at most
+ * MAX_MCP_SERVERS. A status off the closed list is `other`. `entries` are
+ * `{ name, status }`.
+ */
+export function normalizeMcpReport(entries, { charset = null } = {}) {
   const seen = new Map();
-  for (const e of list) {
+  for (const e of Array.isArray(entries) ? entries : []) {
     if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
     const n = e.name.trim().slice(0, MCP_NAME_MAX).trim();
     if (!n || n === 'flowviant' || seen.has(n)) continue;
+    if (charset && !charset.test(n)) continue;
     if (e.status === 'connected') continue; // see the header: never relayed
     seen.set(n, { n, s: MCP_STATUSES.has(e.status) ? e.status : 'other' });
   }
-  mcpServersCache = [...seen.values()]
+  return [...seen.values()]
     .sort((a, b) => (a.n < b.n ? -1 : a.n > b.n ? 1 : 0))
     .slice(0, MAX_MCP_SERVERS);
 }
 
+/**
+ * EVERY SERVER CLAUDE CODE REPORTED, CONNECTED ONES INCLUDED, WITH ITS SOURCE
+ * AND — WHEN CONNECTED — ITS TOOLS' NAMES (2026-10-13, the owner: name every
+ * MCP server and capability each CLI gives the project). Learned off the same
+ * init as the list above, under the same harvest rule; it leaves the box only
+ * on this box's own `tools-report` (mcpInventory.mjs), never on the poll, and
+ * carries names, statuses and sources alone. The header's "only what is not
+ * connected leaves the box" still holds for the poll's `mcp`, which an older
+ * app reads.
+ *
+ * `scope` is the CLI's own word (measured on Claude Code 2.1.296's scope list:
+ * local, user, project, dynamic, enterprise, claudeai, managed, agent);
+ * mcpInventory.mjs maps it to a source. Tool names come from the init's
+ * `tools`, where a server's tools are `mcp__<server>__<tool>` and the server
+ * part is its name with every character outside `[A-Za-z0-9_-]` made `_`
+ * (`claude.ai Gmail` → `claude_ai_Gmail`, measured 2026-10-11).
+ */
+let mcpInventoryCache = null;
+const MAX_INVENTORY_SERVERS = 80;
+const mcpToolPrefix = (name) => `mcp__${name.replace(/[^A-Za-z0-9_-]/g, '_')}__`;
+
+/** The init's servers and tools → `[{ name, status, scope, tools }]`. */
+export function claudeMcpInventoryOf(list, tools) {
+  const names = Array.isArray(tools) ? tools.filter((t) => typeof t === 'string' && t.startsWith('mcp__')) : [];
+  const seen = new Map();
+  for (const e of list) {
+    if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
+    const name = e.name.trim().slice(0, MCP_NAME_MAX).trim();
+    if (!name || name === 'flowviant' || seen.has(name)) continue;
+    const status = MCP_STATUSES.has(e.status) ? e.status : 'other';
+    seen.set(name, { name, status, scope: typeof e.scope === 'string' ? e.scope : typeof e.source === 'string' ? e.source : null, prefix: mcpToolPrefix(e.name.trim()), tools: status === 'connected' ? [] : null });
+  }
+  // The longest prefix wins, so `a_b` never claims `a`'s tools or the reverse.
+  const byPrefix = [...seen.values()].sort((a, b) => b.prefix.length - a.prefix.length);
+  for (const tool of names) {
+    const owner = byPrefix.find((s) => tool.startsWith(s.prefix));
+    if (owner?.tools) owner.tools.push(tool.slice(owner.prefix.length));
+  }
+  return [...seen.values()]
+    .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+    .slice(0, MAX_INVENTORY_SERVERS)
+    .map(({ prefix, ...server }) => server);
+}
+
+export function recordMcpServers(list, tools) {
+  if (!Array.isArray(list)) return;
+  mcpServersCache = normalizeMcpReport(list);
+  mcpInventoryCache = claudeMcpInventoryOf(list, tools);
+}
+
 /** What to send on the roster poll as `mcp` — null until a turn has taught us. */
 export function knownMcpServers() {
   return mcpServersCache;
 }
 
+/** Claude Code's whole server list for the box's inventory — null until a
+ *  turn (or the probe) has taught us. */
+export function knownClaudeMcpInventory() {
+  return mcpInventoryCache;
+}
+
+/**
+ * WHICH TURNS ARE A MEASUREMENT OF THE MACHINE (2026-10-10, the audit) —
+ * asked by runTurn.mjs, the one spawn point, of the argv the adapter built.
+ *
+ * Every report above is "last turn wins", so a turn whose CLI was told to see
+ * less than the machine has must not be recorded: a fenced turn
+ * (`--setting-sources ''` — the planner, the wiki, the capture chat, a design
+ * card) reads no personal or project skills, and an agent's code turn reads
+ * `--setting-sources user` plus the reviewed `--plugin-dir`; a
+ * `--strict-mcp-config` turn mounts only what its argv names. Recorded, each
+ * wrote its narrowed list over the machine's — a claude.ai connector that
+ * needs a sign-in vanished from the Machines page until the next tab turn put
+ * it back. ANY NAMED SOURCE LIST NARROWS MCP TOO, strict or not: the person's
+ * plugins ride the user file (claudePersonal.mjs), so an empty list drops
+ * their servers, and a project `.mcp.json` is admitted by the project and
+ * local files. The capture chat is fenced but not strict — gated on strict
+ * alone, its init still wrote over the machine's report. So skills are
+ * harvested only off a turn that names no setting source and no plugin, MCP
+ * only off one that names no setting source and is not strict, and both only
+ * off Claude Code, whose init carries them. A box that runs only agents
+ * learns from the startup probe and its Terminal tabs.
+ */
+export function initHarvestFor(rt, args) {
+  const argv = Array.isArray(args) ? args : [];
+  const claude = rt?.id === 'claude';
+  const sourcesNamed = argv.includes('--setting-sources');
+  return {
+    skills: claude && !sourcesNamed && !argv.includes('--plugin-dir'),
+    mcp: claude && !sourcesNamed && !argv.includes('--strict-mcp-config'),
+  };
+}
+
 /**
  * LEARN WHAT `/` CAN OFFER, ON A MACHINE NO TURN HAS TAUGHT.
  *
@@ -189,10 +297,20 @@ const SKILL_PROBE_MAX_LINES = 20;
 
 let skillProbeStarted = false;
 
-/** Where Claude Code keeps a transcript for `cwd`: `/` and `.` both become `-`. */
+/**
+ * Where Claude Code keeps a transcript for `cwd`: its own directory rule,
+ * `claudeProjectDir` (claudeSessions.mjs), first.
+ *
+ * ONE RULE, NOT TWO (2026-10-10, the audit). This spelled the munge itself as
+ * `replace(/[/.]/g, '-')` — the rule claudeSessions.mjs retired on 2026-09-24
+ * because it disagrees with Claude Code for any path holding a character other
+ * than a letter, digit, `/` or `.` — so a checkout at `~/code/my_app` built the
+ * wrong primary path and every removal fell through to the scan below. The
+ * store's root is unchanged: `~/.claude`, as it was.
+ */
 function transcriptCandidates(cwd, sessionId) {
   const base = join(homedir(), '.claude', 'projects');
-  const out = [join(base, cwd.replace(/[/.]/g, '-'), `${sessionId}.jsonl`)];
+  const out = [join(base, claudeProjectDir(cwd), `${sessionId}.jsonl`)];
   // The munge is Claude Code's, not ours, so a version that changes it must not
   // leave the file behind: fall back to finding our own session id by name.
   try {
@@ -207,15 +325,15 @@ function transcriptCandidates(cwd, sessionId) {
  * Delete the transcript a headless `-p` turn left behind.
  *
  * EXPORTED because the skills probe is no longer the only thing that runs one:
- * resolving a project's dev command is a background Claude turn too, and every
- * such turn has the same footprint. `claude -p` writes
- * `~/.claude/projects/<munged-cwd>/<id>.jsonl` at startup, and
+ * the planner, the pre-review and intake each run a read-only consult turn
+ * (workCappedTurn.mjs), and every such turn has the same footprint.
+ * `claude -p` writes `~/.claude/projects/<munged-cwd>/<id>.jsonl` at startup, and
  * `claudeSessions.mjs` offers the newest ENDED session per directory as
  * ADOPTABLE — so anything we run for our own purposes would put a phantom
  * untitled session in somebody's `+` menu.
  */
 export function removeProbeTranscript(cwd, sessionId) {
-  if (!sessionId || !/^[A-Za-z0-9_-]{8,64}$/.test(sessionId)) return;
+  if (!sessionId || !CLAUDE_SESSION_RE.test(sessionId)) return;
   for (const f of transcriptCandidates(cwd, sessionId)) {
     try {
       if (existsSync(f)) {
@@ -228,6 +346,21 @@ export function removeProbeTranscript(cwd, sessionId) {
   }
 }
 
+/**
+ * REMOVE IT SOON, NOT NOW — the one spelling of the delayed removal every
+ * headless turn of ours keeps (the skills probe here, and the capped consult
+ * turn of workCappedTurn.mjs that the planner, the pre-review and intake run).
+ *
+ * AFTER the kill and ON A DELAY: the transcript is the CHILD's file, so
+ * deleting it while the child is still dying races a recreate. Unref'd — a
+ * cleanup must never hold the process open. A turn that never named its
+ * conversation has nothing of ours to remove.
+ */
+export function removeTranscriptSoon(cwd, sessionId, ms = 750) {
+  if (!sessionId) return;
+  setTimeout(() => removeProbeTranscript(cwd, sessionId), ms).unref?.();
+}
+
 /**
  * One line of the probe's stdout → the init event's payload, or null for "not
  * it, keep reading".
@@ -257,30 +390,76 @@ export function parseInitLine(line) {
     skills: Array.isArray(ev.skills) ? ev.skills : null,
     // The CLI's mounted MCP servers (0.97.0) — `recordMcpServers` normalises.
     mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : null,
+    // Its tool names, for the inventory's per-server lists (2026-10-13).
+    tools: Array.isArray(ev.tools) ? ev.tools : null,
     sessionId: typeof ev.session_id === 'string' ? ev.session_id : null,
   };
 }
 
+/**
+ * THE PROBE IS AN UNATTENDED CLAUDE SESSION, AND RUNS AS ONE (2026-10-10, the
+ * audit). It runs in the operator's checkout at every daemon start, and its
+ * `claude` started the person's stdio MCP servers and fired SessionStart hooks
+ * — the checkout's `.claude/settings.json` ones included, which fire even in
+ * an untrusted workspace (decisions.md, 2026-09-29) — with the daemon's whole
+ * environment, the machine credential in it. So:
+ *  · its environment is every unattended child's (`unattendedEnv`): no
+ *    machine credential, no display;
+ *  · `disableAllHooks` rides a FLAG setting, which outranks the user and
+ *    project files — and only hooks go: the probe mirrors what a Terminal tab
+ *    sees, so no `--setting-sources` narrowing. MEASURED on Claude Code
+ *    2.1.296, offline: with the flag, neither a personal nor a project
+ *    SessionStart hook started (no `hook_started`), and the init still named
+ *    the personal and the project skill;
+ *  · its own process group, killed whole when it finishes, so nothing it
+ *    started — an MCP server, a backgrounded hook — outlives the probe.
+ */
+export const SKILL_PROBE_ARGS = Object.freeze([
+  '-p', 'x', '--model', 'haiku', '--output-format', 'stream-json', '--verbose',
+  '--settings', JSON.stringify({ disableAllHooks: true }),
+]);
+
 /**
  * Kick off the one-shot probe. Returns immediately; the result lands in
  * `skillsCache` and rides the NEXT poll, so nothing waits on it.
  *
  * A no-op once a turn has taught us (`skillsCache !== null`) — a turn's init
- * event and this one say the same thing, and the turn is free.
+ * event and this one say the same thing, and the turn is free. `spawn` is a
+ * test's.
  */
-export function probeSkillsOnce(cwd) {
+export function probeSkillsOnce(cwd, { spawn: spawnChild = spawn } = {}) {
   if (skillProbeStarted || skillsCache !== null) return;
   skillProbeStarted = true;
+  runInitProbe(cwd, [], spawnChild);
+}
+
+/**
+ * LOOK AGAIN, NOW, WITH THE BASE BRANCH'S SERVERS MOUNTED (2026-10-13) — the
+ * re-check after a confirmed MCP install (mcpInstall.mjs). The same cheap
+ * probe, same rules (hooks off, unattended, its group killed), with the base
+ * copy added through `--mcp-config` so Claude Code says whether each project
+ * server now starts; that is what clears a machine's checklist on the Machines
+ * page. A person pressed Install for this, so it is not the once-per-process
+ * probe: it runs every time it is asked, which is once per finished install.
+ * Resolves when the probe has finished (or given up).
+ */
+export function probeMcpNow(cwd, mcpConfigPath, { spawn: spawnChild = spawn } = {}) {
+  return new Promise((resolve) => runInitProbe(cwd, mcpConfigPath ? ['--mcp-config', mcpConfigPath] : [], spawnChild, resolve));
+}
+
+function runInitProbe(cwd, extraArgs, spawnChild, done = () => {}) {
   let child;
   try {
     // Claude Code specifically, not the `wiki` profile's runtime pick: `skills`
     // is Claude Code's own field and the `/` tray only renders for claude tabs.
-    child = spawn(
-      RUNTIMES.claude.bin,
-      ['-p', 'x', '--model', 'haiku', '--output-format', 'stream-json', '--verbose'],
-      { cwd, stdio: ['ignore', 'pipe', 'ignore'] }
-    );
+    child = spawnChild(RUNTIMES.claude.bin, [...SKILL_PROBE_ARGS, ...extraArgs], {
+      cwd,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      detached: true,
+      env: unattendedEnv(),
+    });
   } catch {
+    done();
     return; // no claude on PATH — the machine simply stays unmeasured
   }
   let buf = '';
@@ -290,14 +469,21 @@ export function probeSkillsOnce(cwd) {
     if (settled) return;
     settled = true;
     clearTimeout(timer);
+    // The whole group: what the CLI started goes with it.
     try {
-      child.kill('SIGKILL');
+      if (child.pid) process.kill(-child.pid, 'SIGKILL');
+      else child.kill('SIGKILL');
     } catch {
-      /* already gone */
+      try {
+        child.kill('SIGKILL');
+      } catch {
+        /* already gone */
+      }
     }
     // AFTER the kill, and on a delay: the transcript is the CHILD's file, so
     // deleting it while the child still lives races a recreate.
-    if (sessionId) setTimeout(() => removeProbeTranscript(cwd, sessionId), 750).unref?.();
+    removeTranscriptSoon(cwd, sessionId);
+    done();
   };
   const timer = setTimeout(() => finish(null), SKILL_PROBE_TIMEOUT_MS);
   timer.unref?.();
@@ -323,7 +509,7 @@ export function probeSkillsOnce(cwd) {
       const init = parseInitLine(line);
       if (!init) continue;
       if (init.skills) recordSkills(init.skills);
-      if (init.mcpServers) recordMcpServers(init.mcpServers);
+      if (init.mcpServers) recordMcpServers(init.mcpServers, init.tools);
       finish(init.sessionId);
       return;
     }
@@ -332,3 +518,11 @@ export function probeSkillsOnce(cwd) {
     if (!settled && buf.length > 1_000_000) finish(null);
   });
 }
+
+/** Tests only: forget what was learned, and that the probe ran. */
+export function resetCapabilitiesForTest() {
+  skillsCache = null;
+  mcpServersCache = null;
+  mcpInventoryCache = null;
+  skillProbeStarted = false;
+}

package/bin/lib/runtimeClaude.mjs

@@ -14,7 +14,12 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
-import { NO_SETTING_SOURCES, personalClaudeSettings, withPersonalSettings } from './claudePersonal.mjs';
+import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings } from './claudePersonal.mjs';
+import { withMachineMcp } from './claudePosture.mjs';
+
+/** The profiles an agent lane mounts the machine's MCP servers on (2026-10-11):
+ *  the ones whose turn profile says `projectMcp` and that Claude declares. */
+const MACHINE_MCP_PROFILES = Object.freeze(['build', 'design', 'research']);
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -53,7 +58,10 @@ export const CLAUDE_RUNTIME = {
    * contract was written, not a claim that only Claude could ever satisfy it.
    */
   // `design` and `research` (0.97.0): each is an `--allowedTools` list with a
-  // PATH-SCOPED write (claudePosture.mjs). `research` is Claude's alone;
+  // PATH-SCOPED write (claudePosture.mjs); an agent's turn mounts the
+  // project's base MCP servers (2026-10-10) and this machine's own
+  // (2026-10-11). `research` is Codex's too since 0.117.0,
+  // over an isolated copy (codexResearch.mjs);
   // `design` is Codex's too since 0.115.0 (2026-09-29), whose permission
   // profile was measured to write only the artifacts directory
   // (runtimeCodex.mjs `codexDesignFence`). agy's flags cannot express "write
@@ -70,13 +78,41 @@ export const CLAUDE_RUNTIME = {
    * fails when any runtime's row differs from the server's.
    */
   efforts: ['low', 'medium', 'high', 'xhigh', 'max'],
+  /**
+   * HOW A TERMINAL TAB SPEAKS ON THIS CLI (audit 2026-10-10, F159) — the
+   * facts the session turn's shape reads (workTurnShape.mjs), declared on the
+   * row instead of spelled as an id check in the lane. Daemon-internal:
+   * runtimeDetection maps rows to fields of its own, so none of this is on
+   * the wire.
+   *   tab: 'mcp' — the session tools ride a per-invocation MCP config.
+   *   planTurns — a tab's plan turn can run here: `--permission-mode plan`
+   *     is Claude Code's own switch (claudePosture.mjs, PLAN_MODE_PERM). Not
+   *     named `planMode`, the retired runTurn switch (turnProfile.mjs,
+   *     RETIRED_POSTURE_KEYS), so no spelling of it reads as one.
+   *   adopt: 'fork' — a terminal conversation is forked into the tab's
+   *     worktree (`--resume <id> --fork-session`).
+   */
+  tab: 'mcp',
+  planTurns: true,
+  adopt: 'fork',
   mcp: claudeMcp,
   /**
    * Claude takes the operating contract as a real system prompt, which is the
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools, personalSettings }) {
+  args({ prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp }) {
+    // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
+    // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
+    // with no vault, or one no rule can name, has no list — refused here in
+    // words, as Codex's builder refuses an image turn with no worktree, and
+    // never run on a list it did not build.
+    if (profile === 'wiki' && !vaultDir) {
+      throw new Error("a wiki turn needs its vault to fence — none reached claude's builder");
+    }
+    if (profile === 'wiki' && !Array.isArray(perm)) {
+      throw new Error(`a wiki turn's vault must be a path a Claude Code permission rule can name — ${JSON.stringify(vaultDir)} is not`);
+    }
     const a = [];
     // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
     // are mutually exclusive, never combined.
@@ -132,28 +168,60 @@ export const CLAUDE_RUNTIME = {
      */
     const fenced = profile !== 'build';
     if (fenced) a.push(...NO_SETTING_SOURCES);
+    // A FENCED POSTURE NAMES ITS OWN MODE (2026-10-10). Its lists fence only
+    // under the CLI's `default` mode, where a tool the list does not name is
+    // refused because nobody is there to approve it. With no settings read,
+    // Claude Code 2.1.296 measured its built-in mode as `auto` (init
+    // `permissionMode: "auto"`, claudePersonal.test.mjs's real-CLI case) — a
+    // classifier that may approve what the list never named. So the posture
+    // states `default` itself, unless its own list names a mode (plan-mode).
+    if (fenced && !perm.includes('--permission-mode')) a.push('--permission-mode', 'default');
     else if (agentTools) a.push('--setting-sources', 'user');
     if (agentTools) {
       a.push('--system-prompt-snapshot', 'off');
       if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     }
-    // These fenced postures have no project MCP, even if Claude discovers a
-    // .mcp.json in the agent's worktree. Build gets its reviewed base config
-    // explicitly from the caller; the plan profile keeps its own principal.
-    if (['consult', 'wiki', 'design', 'research'].includes(profile)) a.push('--strict-mcp-config');
+    // WHICH MCP SERVERS A TURN MOUNTS. An agent's code, write-up and
+    // mockup/3D-model/deck turns (2026-10-11, the owner) mount this machine's
+    // own — its user and local servers and the account's claude.ai connectors —
+    // beside the base branch's `.mcp.json` copy the caller passes, so they are
+    // not strict; `machineMcp` names every `.mcp.json` server from the
+    // worktree up, which `withMachineMcp` disables so a worktree edit never
+    // mounts before review (claudePosture.mjs). Every other fenced posture —
+    // consult, wiki, and a design/research turn no lane mounted for — stays
+    // strict: it never discovers a .mcp.json, nor loads the machine's servers.
+    // The plan profile keeps its own principal.
+    const machine = Array.isArray(machineMcp) && MACHINE_MCP_PROFILES.includes(profile);
+    if (['consult', 'wiki', 'design', 'research'].includes(profile) && !machine && !mcp.includes('--strict-mcp-config')) a.push('--strict-mcp-config');
     a.push(...mcp, ...resultSchemaArgs);
     a.push('--model', model || MODEL);
     if (effort) a.push('--effort', effort);
-    if (streamJson) a.push('--output-format', 'stream-json', '--verbose');
+    // ALWAYS THE EVENT STREAM (2026-10-10): runTurn reads every turn line by
+    // line — the activity, the init's skills and servers, the result.
+    // A completed thinking block can arrive minutes after reasoning began.
+    // Ask for its start too, so both live surfaces can relay that fact.
+    a.push('--output-format', 'stream-json', '--verbose', '--include-partial-messages');
     // The knowledge library (0.94.0) sits in the checkout, outside a
     // worktree's cwd: named as a readable directory so a curated profile
     // does not refuse the path the prompt just handed it. Before `perm`,
     // because `--allowedTools` is variadic and would swallow the flag.
     if (knowledgeDir) a.push('--add-dir', knowledgeDir);
+    // THE VAULT, likewise (2026-10-10): it lives under ~/.flowviant/vaults,
+    // outside the wiki worktree, and its `mkdir`/`rm` are path-validated to the
+    // working directories — the list's `Edit(//<vault>/**)` names the write,
+    // this names the directory. Antigravity's adapter hands it over the same way.
+    if (profile === 'wiki') a.push('--add-dir', vaultDir);
     // `personalSettings` is the caller's copy when it has one (a test); a
-    // turn reads the person's file here, at spawn, as the CLI would.
-    a.push(...(fenced ? withPersonalSettings(perm, personalSettings ?? personalClaudeSettings()) : perm));
+    // turn reads the person's file here, at spawn, as the CLI would. What is
+    // kept is written to a private file, never onto argv (claudePersonal.mjs)
+    // — so this is the LAST thing built: nothing after it may throw and
+    // leave the file with no turn to release it.
+    const postured = machine ? withMachineMcp(perm, machineMcp) : perm;
+    a.push(...(fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured));
     return a;
   },
+  /** What `args` wrote for a turn — the fenced posture's settings file —
+   *  removed when runTurn's child settles. */
+  releaseArgs: releaseTurnSettings,
   parse: null, // claudeStream.mjs owns its own stream parser (unchanged)
 };