flowviant 0.116.0 → 0.124.0

package/bin/lib/runtimeCodex.mjs

@@ -14,6 +14,8 @@ import { SAFE } from './config.mjs';
 import { parseCodexLine } from './runtimeEvents.mjs';
 import { ARTIFACT_DIR, FENCE_TMP_DIR } from './artifacts.mjs';
 import { codexPersonalTurn } from './codexPersonal.mjs';
+import { researchFence } from './codexResearch.mjs';
+import { projectReadBoundary, projectReadFence } from './codexProjectRead.mjs';
 
 /**
  * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
@@ -51,16 +53,6 @@ function codexMcp(token, mcpUrl) {
   };
 }
 
-/**
- * THE POSTURES THAT READ NONE OF THE PERSON'S CONFIG — the branches of `args()`
- * below that pass `--ignore-user-config`, said once so the adapter and its
- * `personal` hook cannot disagree about which turns carry the person's login
- * back (codexPersonal.mjs). A wiki turn with no vault is a build turn there,
- * and so here.
- */
-export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
-  profile === 'consult' || profile === 'plan' || profile === 'image' || profile === 'design' || (profile === 'wiki' && Boolean(vaultDir));
-
 /**
  * WHAT A FENCED CODEX TURN MAY NOT REACH FOR (0.114.0). codex-cli 0.156.1
  * ships `browser_use` (and its external and full-CDP forms), an in-app
@@ -69,12 +61,101 @@ export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
  * a browser or the desktop is a way around a filesystem fence. A build turn
  * keeps the person's own config.
  */
-const NO_REACH_OUT = [
+export const NO_REACH_OUT = Object.freeze([
   '-c', 'features.browser_use=false',
   '-c', 'features.browser_use_external=false',
   '-c', 'features.in_app_browser=false',
   '-c', 'features.computer_use=false',
   '-c', 'features.apps=false',
+]);
+
+/**
+ * THE HOLE NO SANDBOX COVERS. `web_search` ships in `codex exec`'s default
+ * tool list even without --search, and it executes SERVER-SIDE at OpenAI — no
+ * local sandbox touches it. An injected turn could pack what it read into a
+ * query and egress it straight past every filesystem and network fence. Both
+ * spellings, because the two config systems disagree about which one is live.
+ */
+export const NO_WEB = Object.freeze(['-c', 'tools.web_search=false', '-c', 'web_search="disabled"']);
+
+/** Sub-agents would be a second turn whose posture nobody here chose. */
+export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '-c', 'features.goals=false']);
+
+/**
+ * HERMETIC. Without these a user's ~/.codex/config.toml, a project `.rules`
+ * execpolicy file, or their own MCP servers can widen a posture we are
+ * asserting on their behalf — silently, and on the turns whose prompt comes
+ * from someone else's typing. Last in every fence: the person's login rides
+ * back right after `--ignore-user-config` (see `args()`).
+ */
+export const HERMETIC = Object.freeze(['--ignore-user-config', '--ignore-rules']);
+
+/**
+ * Every fenced posture keeps config isolation, desktop/app closure and the
+ * delegation policy. Artifact postures explicitly enable native images as a
+ * supporting capability; consult, plan and wiki keep them off. Native web
+ * needs the isolated research read fence because broad-read tools can read
+ * host credentials. Feature flags do not prove account/model entitlement.
+ */
+export const fencedTail = ({ imageGeneration = false, web = false } = {}) => [
+  // Native web is paired with the copied, root-denied read fence.
+  ...(web ? [] : NO_WEB),
+  ...NO_SUBAGENTS,
+  ...NO_REACH_OUT,
+  imageGeneration ? '--enable' : '--disable',
+  'image_generation',
+  ...HERMETIC,
+];
+
+/**
+ * THE FENCED POSTURES, AS A PREDICATE (2026-10-10, the audit) — which turns
+ * run under a fence of Flowviant's (and so read none of the person's config),
+ * answered WITHOUT building argv: the `personal` hook asks with only the
+ * profile and the vault, and the image and design builders need a worktree.
+ * `args()` picks its fence builder by the same keys (CODEX_FENCES below), so
+ * the hook that carries the person's login back and the argv that ignores
+ * their file cannot disagree. A wiki turn with no vault has no fence to build
+ * and is a build turn, here and in `args()`.
+ */
+export const CODEX_FENCED = Object.freeze({
+  consult: () => true,
+  plan: () => true,
+  wiki: ({ vaultDir } = {}) => Boolean(vaultDir),
+  image: () => true,
+  design: () => true,
+  research: () => true,
+});
+
+export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
+  Object.hasOwn(CODEX_FENCED, profile) && CODEX_FENCED[profile]({ vaultDir });
+
+/** Consult/capture use root-denied tool reads over the actual project,
+ * knowledge and Git metadata. Scrubbing remains supplemental. */
+/**
+ * THE CARTOGRAPHER: read the repo, write ONLY the vault. Codex's permission
+ * profiles take a per-path filesystem map, so the rule is enforced by the
+ * kernel. Measured: repo readable, vault writable, repo writes fail
+ * "Read-only file system", and curl returns 000 — the network is off. The
+ * vault is an uplink (every page is synced to the project's wiki), so web
+ * search and sub-agents are shut here as on every other fence (2026-10-10:
+ * this copy had drifted without them, and no ruling ever granted them). The
+ * write covers the vault's own `.git` too, which is why the daemon's git
+ * there runs nothing the vault's config names (vault.mjs `vaultGit`).
+ *
+ * The table is set WHOLE rather than as a dotted key, and that is not style:
+ * `-c permissions.wiki.filesystem."<path>"="write"` splits the dotted path on
+ * the dots INSIDE the path, and every real vault lives under
+ * `~/.flowviant/vaults/…`. It fails with "filesystem path must be absolute",
+ * which reads like a path problem and is a parsing one. The path is a TOML
+ * basic string (JSON's escapes), as the artifact fences' are. Selected by
+ * config: `codex exec` (0.156.1) has no `-P`, so every Codex wiki turn was
+ * refused before it started (0.114.0).
+ */
+const codexWikiFence = (vaultDir) => [
+  '-c', 'permissions.flowviantwiki.extends=":read-only"',
+  '-c', `permissions.flowviantwiki.filesystem={${JSON.stringify(vaultDir)}="write"}`,
+  '-c', 'default_permissions="flowviantwiki"',
+  ...fencedTail(),
 ];
 
 export const CODEX_RUNTIME = {
@@ -91,12 +172,12 @@ export const CODEX_RUNTIME = {
    * a verb allowlist, and for a consult's actual threat (exfiltration driven
    * by an injected question) that is sufficient and arguably stronger.
    *
-   * ALL THREE, and `wiki` is the one worth pausing on: Codex expresses it
-   * MORE strictly than Claude does. A cartographer must read the repo and
-   * write only the vault; Claude's WIKI_PERM cannot path-scope Write and says
-   * so, leaning on the worktree reset as a backstop. Codex's permission
-   * profiles enforce the same rule in the kernel — measured: repo readable,
-   * vault writable, repo writes refused, network off.
+   * ALL THREE, and `wiki` is the one worth pausing on: a cartographer must
+   * read the repo and write only the vault. Claude's list says so in rules
+   * (`wikiPermFor`, probed 2026-10-10); Codex's permission profiles enforce
+   * the write half in the kernel — measured: repo readable, vault writable,
+   * repo writes refused, network off — while reading the whole box, as every
+   * Codex fence does (see `codexArtifactFence`).
    *
    * Enforcement was verified on Linux (bubblewrap + seccomp). macOS Seatbelt
    * and Windows are UNTESTED; if this daemon starts running there, re-verify
@@ -107,14 +188,23 @@ export const CODEX_RUNTIME = {
    * Claude's, because the pictures come from Codex's own image tool.
    *
    * AND `design` (0.115.0), shared with Claude: the mockup, 3D-model and deck
-   * cards' fence, expressed as `codexDesignFence` below. Research is NOT
-   * declared: its web and Codex's whole-box reads cannot be fenced apart
-   * (see that function).
+   * cards' fence, expressed as `codexDesignFence` below.
+   * AND `research` (0.117.0): live web over a copied view under a root-denied
+   * Linux tool fence (`codexResearch.mjs`), outside the login and checkout.
    */
-  profiles: ['build', 'consult', 'wiki', 'plan', 'image', 'design'],
+  profiles: ['build', 'consult', 'wiki', 'plan', 'image', 'design', 'research'],
   /** `model_reasoning_effort` tops out at `xhigh` — there is no `max`, and a
    *  queued or skewed job naming it would be an argument Codex refuses. */
   efforts: ['low', 'medium', 'high', 'xhigh'],
+  /**
+   * A TERMINAL TAB ON CODEX (audit 2026-10-10, F159; see runtimeClaude.mjs
+   * for the three facts): an MCP tab like Claude's, with no plan mode (there
+   * is no flag to spell it) and no adoption — Codex has no adoptable
+   * terminal store yet, and `args()` backstops an adopt id with a throw.
+   */
+  tab: 'mcp',
+  planTurns: false,
+  adopt: null,
   mcp: codexMcp,
   /**
    * Codex has NO system-prompt flag. The contract therefore rides inside the
@@ -131,9 +221,11 @@ export const CODEX_RUNTIME = {
    * the prompt always carries them too. Workbench tabs keep their normal
    * checkout discovery.
    *
-   * `--skip-git-repo-check` is deliberately NOT passed: a task always builds
-   * in a git worktree, and if it somehow is not one, failing loudly beats
-   * silently editing files nobody can diff.
+   * `--skip-git-repo-check` is deliberately NOT passed by the build or any
+   * fence but research's: a task always builds in a git worktree, and if it
+   * somehow is not one, failing loudly beats silently editing files nobody
+   * can diff. A write-up reads a COPY with no `.git` and never resumes
+   * (codexResearch.mjs), so its fence passes it.
    *
    * THE PROMPT IS LAST, and that is load-bearing rather than tidy. Codex takes
    * it as a trailing POSITIONAL, so every flag — including the two `-c` MCP
@@ -141,7 +233,7 @@ export const CODEX_RUNTIME = {
    * placed before it. Appending them after the positional is the kind of argv
    * that parses today and stops parsing on some future clap upgrade.
    */
-  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null }) {
+  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation, knowledgeDir, projectReads }) {
     // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
     // agy moves) — codex has no adoptable store wired yet. Reaching here
     // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -169,166 +261,11 @@ export const CODEX_RUNTIME = {
     // Effort is a config value on Codex rather than a flag.
     if (effort) a.push('-c', `model_reasoning_effort="${effort}"`);
 
-    if (profile === 'consult') {
-      // A CONSULT, EXPRESSED THE ONLY WAY CODEX CAN EXPRESS IT — and it is a
-      // different shape from Claude's, which is the whole reason `profile` is
-      // a promise rather than a flag list.
-      //
-      // Claude gets a VERB allowlist: Read, Grep, Glob and a handful of
-      // read-only Bash forms, with nothing that reaches the network. Codex has
-      // no such thing — it has no file-read tool at all, so reading the repo
-      // IS command execution (`cat`, `rg`). Removing the shell leaves the
-      // model with exactly ["update_plan","request_user_input"], which cannot
-      // answer a question about a codebase. You get both capabilities or
-      // neither.
-      //
-      // So the promise is kept one layer down instead. `read-only` is
-      // kernel-enforced (bubblewrap + seccomp on Linux): writes fail, and a
-      // direct-IP connect fails with "Operation not permitted" — socket() is
-      // denied, not merely DNS. An injected command still RUNS and still
-      // cannot take the repository anywhere, which is the threat a consult
-      // actually has: its prompt is steered by a question any project editor
-      // can type. Arguably a stronger guarantee than the allowlist, being
-      // below the agent rather than inside it.
-      a.push('-c', 'sandbox_mode="read-only"');
-
-      // THE HOLE THE SANDBOX DOES NOT COVER. `web_search` ships in `codex
-      // exec`'s default tool list even without --search, and it executes
-      // SERVER-SIDE at OpenAI — no local sandbox touches it. An injected turn
-      // could pack repo contents into a query and egress them straight past
-      // everything above. Both spellings, because the two config systems
-      // disagree about which one is live.
-      a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
-
-      // Sub-agents would be a second turn whose posture nobody here chose.
-      a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
-      // Image generation ships ON in codex-cli 0.156.1 even under
-      // --ignore-user-config (measured 2026-09-29): a turn that asked for no
-      // picture is handed no tool that spends image credits.
-      a.push('--disable', 'image_generation');
-
-      // HERMETIC. Without these a user's ~/.codex/config.toml, a project
-      // `.rules` execpolicy file, or their own MCP servers can widen a posture
-      // we are asserting on their behalf — silently, and on the one turn whose
-      // prompt comes from someone else's typing.
-      a.push('--ignore-user-config', '--ignore-rules');
-    } else if (profile === 'plan') {
-      // A PLANNING SESSION. Read-only on the filesystem, exactly like a
-      // consult — the writes it makes go through the control plane, not
-      // through this box — so the kernel sandbox is the same one, and for the
-      // same reason: this turn's prompt is steered by anything a project
-      // editor can type.
-      //
-      // Everything the consult branch above closes stays closed, and the
-      // reasoning is unchanged, so it is not restated: web_search egresses
-      // server-side at OpenAI where no local sandbox reaches it, sub-agents
-      // would be a turn whose posture nobody here chose, and a user's own
-      // config or MCP servers must not widen a posture we are asserting on
-      // their behalf.
-      //
-      // What differs from a consult is the ONE thing this profile exists for:
-      // an MCP config IS passed, carrying this turn's scoped token. The plan
-      // token has the planning tools; a capture token has only staging and
-      // transcript tools. The server refuses everything outside that scope.
-      a.push('-c', 'sandbox_mode="read-only"');
-      a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
-      a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
-      // Image generation ships ON in codex-cli 0.156.1 even under
-      // --ignore-user-config (measured 2026-09-29): a turn that asked for no
-      // picture is handed no tool that spends image credits.
-      a.push('--disable', 'image_generation');
-      a.push('--ignore-user-config', '--ignore-rules');
-    } else if (profile === 'wiki' && vaultDir) {
-      // THE CARTOGRAPHER, AND THIS ONE IS STRICTER THAN CLAUDE'S.
-      //
-      // A wiki turn reads the whole repo and writes ONLY the vault. Claude
-      // cannot actually express that: WIKI_PERM hands it Write/Edit and its own
-      // comment admits "Write/Edit can't be path-scoped here; the worktree
-      // reset is the backstop" — i.e. the cartographer CAN scribble on the
-      // checkout and we clean up afterwards.
-      //
-      // Codex's permission profiles take a per-path filesystem map, so the
-      // rule is enforced by the kernel instead of apologised for. Measured:
-      // repo readable, vault writable, repo writes fail "Read-only file
-      // system", and curl returns 000 — the network is off, which is the half
-      // WIKI_PERM was really protecting (its comment: "Command execution is
-      // the line: it enables network exfil").
-      //
-      // The table is set WHOLE rather than as a dotted key, and that is not
-      // style: `-c permissions.wiki.filesystem."<path>"="write"` splits the
-      // dotted path on the dots INSIDE the path, and every real vault lives
-      // under `~/.flowviant/vaults/…`. It fails with "filesystem path must be
-      // absolute", which reads like a path problem and is a parsing one.
-      a.push('-c', 'permissions.flowviantwiki.extends=":read-only"');
-      a.push('-c', `permissions.flowviantwiki.filesystem={"${vaultDir}"="write"}`);
-      // Selected by config: `codex exec` (0.156.1) has no `-P`, so every Codex
-      // wiki turn was refused before it started (0.114.0).
-      a.push('-c', 'default_permissions="flowviantwiki"');
-      a.push('--disable', 'image_generation');
-      a.push(...NO_REACH_OUT);
-      a.push('--ignore-user-config', '--ignore-rules');
-    } else if (profile === 'image') {
-      // AN IMAGE CARD (0.114.0): read the repo, write ONLY the worktree's
-      // `.flowviant/artifacts/`, generate pictures, and nothing else. The
-      // cartographer's shape — a permission profile whose filesystem map the
-      // kernel enforces — pointed at the artifacts directory instead of a
-      // vault. MEASURED on codex-cli 0.156.1 (Linux, bubblewrap), with no model
-      // turn spent: under this profile a `cp` from a CODEX_HOME-shaped folder
-      // into the artifacts directory landed, a write to a repo file failed
-      // "Read-only file system", and curl got no network; `codex debug
-      // prompt-input` with these overrides renders a managed profile of
-      // `write <worktree>/.flowviant/artifacts` + `read :root`, "Approval
-      // policy is currently never".
-      //
-      // SELECTED BY `default_permissions`, NOT `-P`: `codex exec` (and `exec
-      // resume`) on 0.156.1 refuse `-P` as an unexpected argument — only
-      // `codex sandbox` takes it — while `-c default_permissions="<name>"`
-      // resolves the named profile in both. The directory must EXIST before
-      // spawn (measured: a missing one cannot be created from inside the
-      // fence), which the agent lane sees to (`ensureArtifactDir`).
-      //
-      // WHERE THE PICTURES COME FROM. Codex's own `image_gen` tool saves each
-      // one under `$CODEX_HOME/generated_images/…` and says the path (the
-      // binary's own words: "Generated images are saved to … by default. If
-      // you need to use a generated image at another path, copy it"). An agent
-      // turn's CODEX_HOME is the agent's own isolated home (projectToolRuntimes,
-      // kept per agent since 2026-09-29); `:root` reads admit it, so the agent
-      // copies what it keeps into the one writable directory, where the
-      // artifact scan finds it.
-      //
-      // IMAGE GENERATION IS SWITCHED ON HERE AND ONLY HERE — a decision. This
-      // is the one turn whose card asks for pictures, so it must not depend
-      // on whatever the person's config says about the feature. A BUILD turn
-      // keeps the person's own config (not hermetic, by design — see below),
-      // and the other fenced postures (consult, plan, wiki) never asked for a
-      // picture, so none of them is handed a tool that spends image credits.
-      if (!cwd || !isAbsolute(cwd)) {
-        throw new Error("an image turn needs its worktree to fence — none reached codex's builder");
-      }
-      const artifacts = join(cwd, ARTIFACT_DIR);
-      a.push('-c', 'permissions.flowviantimage.extends=":read-only"');
-      // The table WHOLE (the wiki branch's reason: a dotted key splits on the
-      // dots inside the path), the path as a TOML basic string.
-      // …and the fence's own scratch (2026-09-29, the design fence's
-      // measurement: a `cat > x <<EOF` needs a temp file, and /tmp is
-      // read-only in here), named for the shells through TMPDIR/TMPPREFIX.
-      const scratch = join(cwd, FENCE_TMP_DIR);
-      a.push('-c', `permissions.flowviantimage.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`);
-      a.push('-c', `shell_environment_policy.set={TMPDIR=${JSON.stringify(scratch)},TMPPREFIX=${JSON.stringify(join(scratch, 'zsh'))}}`);
-      a.push('-c', 'default_permissions="flowviantimage"');
-      a.push(...NO_REACH_OUT);
-      // Nobody is on this end of the pipe to approve an escalation.
-      a.push('-c', 'approval_policy="never"');
-      a.push('--enable', 'image_generation');
-      // No web: the consult branch's two spellings, for its reason — web
-      // search runs server-side where no sandbox reaches it.
-      a.push('-c', 'tools.web_search=false', '-c', 'web_search="disabled"');
-      a.push('-c', 'features.multi_agent=false', '-c', 'features.goals=false', ...NO_REACH_OUT);
-      a.push('--ignore-user-config', '--ignore-rules');
-    } else if (profile === 'design') {
-      // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
-      // `codexDesignFence`'s, argued and measured at its definition below.
-      a.push(...codexDesignFence(cwd));
+    // THE FENCE, picked by the same keys as `codexIgnoresUserConfig`: a fenced
+    // posture builds its own (CODEX_FENCES below); anything else is a build.
+    const fenced = codexIgnoresUserConfig({ profile, vaultDir });
+    if (fenced) {
+      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads }));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -356,7 +293,10 @@ export const CODEX_RUNTIME = {
     if (a.includes('--ignore-user-config')) a.push(...(personal?.args ?? []));
 
     a.push(...mcp, ...resultSchemaArgs);
-    a.push(`${system}\n\n---\n\n${prompt}`);
+    const readers = profile === 'consult' || profile === 'plan'
+      ? '\nUse exec_command with shell="/bin/bash" and login=false for project discovery. Project files, local Git history and the project knowledge directory are readable; host files are outside this turn’s read boundary.'
+      : '';
+    a.push(`${system}${readers}\n\n---\n\n${prompt}`);
     return a;
   },
   /**
@@ -376,16 +316,19 @@ export const CODEX_RUNTIME = {
 };
 
 /**
- * THE MOCKUP, 3D-MODEL AND DECK CARDS' FENCE ON CODEX (0.115.0; 2026-09-29, the
- * owner: "its saying 3d models run on claude only but thats not true").
+ * THE ARTIFACT CARDS' FENCE ON CODEX — the image card's (0.114.0, the image
+ * tool switched on) and the mockup, 3D-model and deck cards' (0.115.0;
+ * 2026-09-29, the owner: "its saying 3d models run on claude only but thats
+ * not true"), one builder under each card's own profile name since 2026-10-10.
  *
- * The image fence's shape without the image tool: a permission profile that
- * reads the repo and writes ONLY `<worktree>/.flowviant/artifacts/`, selected
+ * Design and image share supporting native image generation and a
+ * permission profile that reads the repo and writes ONLY
+ * `<worktree>/.flowviant/artifacts/` (and the turn's scratch), selected
  * by `default_permissions` (`codex exec` and `exec resume` refuse `-P` on
  * 0.156.1), no network, no web search, no sub-agents, no browser, computer or
- * apps, nobody's config or rules, and no approvals to wait on. Nothing about
- * the card's contract needs more: every one of the three is one HTML page, and
- * a page's CDN scripts load in the viewer, never on this machine.
+ * apps, nobody's config or rules, and no approvals to wait on. Needed image
+ * generation supports the page without changing its end product. CDN scripts
+ * load in the viewer, never on this machine.
  *
  * MEASURED on codex-cli 0.156.1 (Linux, bubblewrap), with gpt-6-luna at low
  * effort, in a scratch git repository (2026-09-29), with exactly this argv:
@@ -423,15 +366,16 @@ export const CODEX_RUNTIME = {
  * descriptor"). With the network and the web shut, the one road out is the
  * artifact itself, which is scrubbed of the machine's known secret values and
  * of any Flowviant credential by shape on the way up — the image fence's
- * standing (0.114.0), and why RESEARCH is not declared here: a write-up needs
- * the web, and a turn that can read `.env` and `~/.flowviant/credentials.json`
- * while holding `web_search` (both measured readable under this profile with
- * `web_search="live"`) is the exfiltration Claude's research list was fenced
- * to prevent.
+ * standing (0.114.0), and why RESEARCH does not use this fence: a write-up
+ * needs the web, and a turn that can read `.env` and
+ * `~/.flowviant/credentials.json` while holding `web_search` (both measured
+ * readable under this profile with `web_search="live"`) is the exfiltration
+ * Claude's research list was fenced to prevent. Codex research (0.117.0) runs
+ * under its own fence instead, over a copied view (CODEX_FENCES `research`).
  */
-export function codexDesignFence(cwd) {
+export function codexArtifactFence(cwd, { name, imageGeneration = false, what }) {
   if (!cwd || !isAbsolute(cwd)) {
-    throw new Error("a design turn needs its worktree to fence — none reached codex's builder");
+    throw new Error(`${what} needs its worktree to fence — none reached codex's builder`);
   }
   const artifacts = join(cwd, ARTIFACT_DIR);
   // THE TURN'S OWN SCRATCH (artifacts.mjs `ensureFenceScratch`, made empty by
@@ -443,17 +387,81 @@ export function codexDesignFence(cwd) {
   // `shell_environment_policy.set` — measured to reach the sandboxed shell.
   const scratch = join(cwd, FENCE_TMP_DIR);
   return [
-    '-c', 'permissions.flowviantdesign.extends=":read-only"',
-    // The table WHOLE and the path a TOML basic string — the wiki branch's
+    '-c', `permissions.${name}.extends=":read-only"`,
+    // The table WHOLE and the path a TOML basic string — the wiki fence's
     // reason: a dotted key splits on the dots inside the path.
-    '-c', `permissions.flowviantdesign.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`,
+    '-c', `permissions.${name}.filesystem={${JSON.stringify(artifacts)}="write",${JSON.stringify(scratch)}="write"}`,
     '-c', `shell_environment_policy.set={TMPDIR=${JSON.stringify(scratch)},TMPPREFIX=${JSON.stringify(join(scratch, 'zsh'))}}`,
-    '-c', 'default_permissions="flowviantdesign"',
+    '-c', `default_permissions="${name}"`,
+    // Nobody is on this end of the pipe to approve an escalation.
     '-c', 'approval_policy="never"',
-    '--disable', 'image_generation',
-    '-c', 'tools.web_search=false', '-c', 'web_search="disabled"',
-    '-c', 'features.multi_agent=false', '-c', 'features.goals=false',
-    ...NO_REACH_OUT,
-    '--ignore-user-config', '--ignore-rules',
+    ...fencedTail({ imageGeneration }),
   ];
 }
+
+/** The design card's fence — `codexArtifactFence` under its own profile name,
+ *  with native image generation available for supporting assets. */
+export const codexDesignFence = (cwd) =>
+  codexArtifactFence(cwd, { name: 'flowviantdesign', imageGeneration: true, what: 'a design turn' });
+
+/**
+ * EVERY FENCED POSTURE'S ARGV, by the keys of CODEX_FENCED (a test holds the
+ * two tables to one key set), each built from the shared pieces above.
+ */
+const CODEX_FENCES = {
+  // A CONSULT, EXPRESSED THE ONLY WAY CODEX CAN EXPRESS IT — a different
+  // shape from Claude's verb allowlist, which is the whole reason `profile` is
+  // a promise rather than a flag list. See codexProjectRead.mjs.
+  consult: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
+  // A PLANNING SESSION. Read-only on the filesystem, exactly like a consult —
+  // the writes it makes go through the control plane, not through this box —
+  // and for the same reason: its prompt is steered by anything a project
+  // editor can type. What differs is the ONE thing this profile exists for:
+  // an MCP config IS passed (by the caller, after the fence), carrying this
+  // turn's scoped token. The plan token has the planning tools; a capture
+  // token has only staging and transcript tools. The server refuses
+  // everything outside that scope.
+  plan: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
+  wiki: ({ vaultDir }) => codexWikiFence(vaultDir),
+  // AN IMAGE CARD (0.114.0): read the repo, write ONLY the worktree's
+  // `.flowviant/artifacts/`, generate pictures, and nothing else. MEASURED on
+  // codex-cli 0.156.1 (Linux, bubblewrap), with no model turn spent: under
+  // this profile a `cp` from a CODEX_HOME-shaped folder into the artifacts
+  // directory landed, a write to a repo file failed "Read-only file system",
+  // and curl got no network; `codex debug prompt-input` with these overrides
+  // renders a managed profile of `write <worktree>/.flowviant/artifacts` +
+  // `read :root`, "Approval policy is currently never".
+  //
+  // SELECTED BY `default_permissions`, NOT `-P`: `codex exec` (and `exec
+  // resume`) on 0.156.1 refuse `-P` as an unexpected argument — only `codex
+  // sandbox` takes it — while `-c default_permissions="<name>"` resolves the
+  // named profile in both. The directory must EXIST before spawn (measured: a
+  // missing one cannot be created from inside the fence), which the agent lane
+  // sees to (`ensureArtifactDir`).
+  //
+  // WHERE THE PICTURES COME FROM. Codex's own `image_gen` tool saves each one
+  // under `$CODEX_HOME/generated_images/…` and says the path (the binary's own
+  // words: "Generated images are saved to … by default. If you need to use a
+  // generated image at another path, copy it"). An agent turn's CODEX_HOME is
+  // the agent's own isolated home (projectToolRuntimes, kept per agent since
+  // 2026-09-29); `:root` reads admit it, so the agent copies what it keeps
+  // into the one writable directory, where the artifact scan finds it.
+  //
+  // Native images support every artifact kind; this profile still delivers
+  // PNG/WebP, while design/model/deck still deliver their self-contained page.
+  image: ({ cwd }) => codexArtifactFence(cwd, { name: 'flowviantimage', imageGeneration: true, what: 'an image turn' }),
+  // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
+  // `codexDesignFence`'s, argued and measured at `codexArtifactFence` above.
+  design: ({ cwd }) => codexDesignFence(cwd),
+  // A WRITE-UP CARD (0.117.0): live web over a COPIED view of the worktree,
+  // never the checkout or the login store, under a root-denied tool fence
+  // (codexResearch.mjs `researchFence`, built by runTurn's
+  // `runIsolatedResearch`). It is the one fence that keeps the web, so its
+  // tail leaves NO_WEB out and closes everything else.
+  research: ({ researchIsolation }) => {
+    if (!researchIsolation) throw new Error('Codex research requires its isolated input copy.');
+    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true })];
+  },
+};
+/** The fenced profile names — for the test that holds both tables to one set. */
+export const CODEX_FENCE_PROFILES = Object.freeze(Object.keys(CODEX_FENCES));

package/bin/lib/runtimeDetection.mjs

@@ -14,7 +14,7 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { RUNTIMES, canRun, drivableHere } from './runtimes.mjs';
+import { RUNTIMES, canRun, drivableHere, runtimeById } from './runtimes.mjs';
 
 /**
  * WHICH RUNTIME RUNS A JOB THAT NOBODY @MENTIONED.
@@ -41,7 +41,7 @@ import { RUNTIMES, canRun, drivableHere } from './runtimes.mjs';
 export function pickRuntimeFor(profile, { detected } = {}) {
   const rows = detected ?? detectRuntimes();
   const ok = (id) =>
-    canRun(RUNTIMES[id], profile) && Boolean(rows.find((d) => d.id === id)?.installed);
+    canRun(runtimeById(id), profile) && Boolean(rows.find((d) => d.id === id)?.installed);
   if (ok('claude')) return 'claude';
   return Object.keys(RUNTIMES).find(ok) ?? null;
 }
@@ -86,6 +86,12 @@ export function runtimesReport(detected) {
     .join(',');
 }
 
+/** Existing probe evidence only; diagnostics never spawn another CLI. */
+export function measuredRuntimeVersion(id) {
+  const row = detectedCache?.find((runtime) => runtime.id === id);
+  return row ? { version: row.version, measuredAt: new Date(detectedAt).toISOString() } : null;
+}
+
 export function detectRuntimes({ refresh = false } = {}) {
   if (detectedCache && !refresh && Date.now() - detectedAt < DETECT_TTL_MS) return detectedCache;
   detectedAt = Date.now();

package/bin/lib/runtimeEvents.mjs

@@ -86,14 +86,20 @@ export function humanizeClaudeTool(name, input = {}, cwd = '') {
     case 'LS':
       return { kind: 'list', label: `ls ${shortPath(input.path ?? '.', cwd)}` };
     case 'Bash':
-      // `command` rides beside the display label, VERBATIM (capped): the label
-      // is a 60-char readout for a console and the rail, and truncation is
-      // fine there — but the admin's command audit exists to answer "what
+      // `command` rides beside the display label, VERBATIM (windowed): the
+      // label is a 60-char readout for a console and the rail, and truncation
+      // is fine there — but the admin's command audit exists to answer "what
       // actually ran on our box", and an ellipsis is exactly where the part
       // that matters would hide.
+      //
+      // WINDOWED, NOT CAPPED (2026-10-10, the audit's F128). This cut at the
+      // server's 2000 before the audit scrubbed it — the cap-then-scrub order
+      // `toolEventOf` below records as a leak: a secret straddling character
+      // 2000 kept its prefix. The window only bounds memory; the audit
+      // scrubs, THEN cuts to the server's cap (workCommandAudit.mjs).
       return {
         kind: 'bash',
-        command: String(input.command ?? '').slice(0, 2000),
+        command: String(input.command ?? '').slice(0, SCRUB_WINDOW),
         label: `$ ${oneLine(input.command, 60)}`,
       };
     case 'TodoWrite': {
@@ -265,7 +271,7 @@ function humanizeCodexItem(item = {}, cwd = '') {
     case 'command_execution':
       return {
         kind: 'bash',
-        command: String(item.command ?? '').slice(0, 2000),
+        command: String(item.command ?? '').slice(0, SCRUB_WINDOW), // windowed, not capped — see Claude's Bash
         label: `$ ${oneLine(item.command, 60)}`,
       };
     case 'file_change': {
@@ -295,9 +301,9 @@ function humanizeCodexItem(item = {}, cwd = '') {
 
 /**
  * Codex `--json` emits JSONL of ThreadEvents. Returns `{ activity, text,
- * threadId }` — `text` accumulates the agent's own words, because the turn
- * loop reads its sentinels (NOTHING / BLOCKED:<id> / DONE) out of exactly
- * that; `threadId` surfaces once, off the lifecycle event, for callers that
+ * threadId }` — `text` accumulates the agent's own words, because the wiki
+ * lane reads its sentinels (WIKI_DONE / REGROUND_DONE, claude.mjs
+ * `sawSentinel`) out of exactly that; `threadId` surfaces once, off the lifecycle event, for callers that
  * need to resume THIS conversation later (runTurn's onThreadId).
  */
 export function parseCodexLine(line, cwd) {
@@ -316,11 +322,16 @@ export function parseCodexLine(line, cwd) {
     // text: nothing here is the model speaking.
     case 'thread.started':
       return { activity: null, text: '', threadId: String(ev.thread_id ?? '') || null };
+    case 'item.started': {
+      const item = ev.item ?? {};
+      if ((item.item_type ?? item.type) !== 'command_execution') return null;
+      return { toolEvent: ['Bash', { command: item.command }, { id: item.id, runtime: 'codex' }] };
+    }
     case 'item.completed': {
       const item = ev.item ?? {};
       const activity = humanizeCodexItem(item, cwd);
       // Only the agent's MESSAGES are sentinel-bearing text. Reasoning is not:
-      // a model that muses "I could output NOTHING here" must not end the turn.
+      // a model that muses "I could print WIKI_DONE now" must not end the turn.
       const isMessage = (item.item_type ?? item.type) === 'agent_message';
       const text = isMessage ? `${item.text ?? item.message ?? ''}\n` : '';
       // `answer` is the SAME message, surfaced alone: `text` accumulates every
@@ -328,7 +339,13 @@ export function parseCodexLine(line, cwd) {
       // the agent said LAST" (the agent lane's final JSON object) cannot recover
       // it from `out`. Claude's stream has this for free under
       // `answerFromResult`; codex needed it said.
-      return { activity, text, ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
+      const command = (item.item_type ?? item.type) === 'command_execution';
+      const toolEvent = command ? ['Bash', { command: item.command }, {
+        id: item.id, result: true, runtime: 'codex',
+        exitCode: item.exit_code, isError: item.status === 'failed',
+        output: item.aggregated_output ?? '',
+      }] : null;
+      return { activity, text, ...(toolEvent ? { toolEvent } : {}), ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
     }
     // THE TURN'S OWN TOKEN COUNT (2026-09-24). `codex exec --json` closes a
     // turn with `turn.completed` carrying `usage` — the codex twin of Claude's
@@ -439,7 +456,7 @@ function humanizeAgyTool(name, p = {}, cwd = '') {
     case 'run_command':
       return {
         kind: 'bash',
-        command: String(p.CommandLine ?? '').slice(0, 2000),
+        command: String(p.CommandLine ?? '').slice(0, SCRUB_WINDOW), // windowed, not capped — see Claude's Bash
         label: `$ ${oneLine(p.CommandLine, 60)}`,
       };
     case 'call_mcp_tool':