flowviant 0.116.0 → 0.124.0

package/bin/lib/uplinkScrub.mjs

@@ -10,7 +10,11 @@
  * the PRESENT values of `childEnv`'s `DEPLOY_KEEP` names out of this process's
  * own environment, which is where an operator's `CLOUDFLARE_API_TOKEN`
  * actually lives and which the deploy lane hands to a command whose stdout it
- * then streams to the server. It redacts on SHAPE, never on meaning: a value
+ * then streams to the server. (Three more feeds joined on 2026-10-10: the
+ * person's Codex provider secrets, the nested env files a deploy job copies in
+ * for that job's life, and a short list of vendor token SHAPES — see
+ * `learnSecrets`, `learnExtraSecrets` and `TOKEN_SHAPES`.) It redacts on
+ * SHAPE, never on meaning: a value
  * that looks like an ordinary word is left alone, because a relay that swaps
  * the CLI's own words for `[REDACTED:NODE_ENV]` has stopped being a relay.
  * NOTHING HERE EVER REACHES THE WIRE — it is a list of what to hide, not a
@@ -30,6 +34,9 @@
 // two drifting; `processEnvSecrets`'s docblock carries the whole argument,
 // including why none of it ever reaches the wire.
 import { processEnvSecrets } from './childEnv.mjs';
+// THE PERSON'S CODEX PROVIDER SECRETS (2026-10-10, the audit's F073), read on
+// the same beat as the process half — see `learnSecrets`.
+import { readPersonalCodexSecrets } from './codexPersonal.mjs';
 
 // ── What `scrub` will redact ───────────────────────────────────────────────
 //
@@ -76,25 +83,36 @@ const SCRUB_MIN_LENGTH = 6;
  * than meaning (nothing here classifies, guesses, or asks a model):
  *
  *  · A PLAIN IDENTIFIER — starts with a letter, runs at most sixteen
- *    characters, and is made only of letters, digits and `.` `/` `-`. That is
- *    what a word, a hostname, a short version string and an enum value all look
- *    like. `_` is deliberately NOT in the set: an underscore is rare in prose
- *    and common in key material (`sk-live_…`), so its presence is the cheapest
- *    honest signal that a string was minted rather than written.
+ *    characters, and is made only of letters, digits and `.` `_` `/` `-`, and
+ *    does not mix upper case, lower case AND digits (the case-and-digit rule
+ *    in `worthRedacting`, below). That is what a word, a hostname, a short
+ *    version string, an enum value and a snake_case name all look like. The
+ *    underscore IS in the set (`SCRUB_PLAIN_RE`) and has been since the first
+ *    public release: `db_pass_2024` and `abc_defghijk` are plain and left as
+ *    they are. (This comment said until 2026-10-10 that `_` was deliberately
+ *    left out of the set as the mark of a minted string; the code never did
+ *    that, the public pages — SECURITY.md and the app's Privacy page — follow
+ *    the code, and dropping `_` is an open owner call that needs a dated
+ *    ruling, a release and both pages changed.)
  *  · A SHORT VALUE WITH LITTLE VARIETY — under twelve characters and drawing on
  *    fewer than three of {lower, upper, digit, symbol}. A real credential short
  *    enough to be under twelve characters is mixed; `us-east-1` and `verbose`
  *    are not.
  *
+ * Anything under `SCRUB_MIN_LENGTH` (six) is left alone before either test.
+ *
  * THE ACCEPTED COST, STATED RATHER THAN HIDDEN: a genuinely secret value that
- * is short and lowercase — `hunter2secret`, a thirteen-character all-letters
- * password — is NOT redacted. Under-redaction is chosen here over making the
- * product illegible, because the alternative is a trace nobody can read and a
- * product that silently rewrites its own CLI's output. An operator whose secret
- * is a dictionary word has a problem this function cannot fix. Anything with a
- * symbol, a case mix, twelve-plus characters, or an underscore — which is every
- * token, key, URL, JWT and hex digest anybody actually pastes into a `.env` —
- * is redacted.
+ * is plain or short and unvaried — `hunter2secret`, a thirteen-character
+ * lowercase-and-digit password, or `deadbeef12345678`, a sixteen-character
+ * lowercase hex key that starts with a letter — is NOT redacted. Under-redaction is chosen here over making the product
+ * illegible, because the alternative is a trace nobody can read and a product
+ * that silently rewrites its own CLI's output. An operator whose secret is a
+ * dictionary word has a problem this function cannot fix. What IS redacted is
+ * a value of six or more characters that is not a plain identifier (longer
+ * than sixteen, a character outside the set, a leading non-letter, or an
+ * upper-lower-digit mix) and is twelve or more characters or draws on three
+ * of {lower, upper, digit, symbol} — which covers the long tokens, keys,
+ * URLs, JWTs and hex digests people actually paste into a `.env`.
  */
 const SCRUB_PLAIN_RE = /^[A-Za-z][A-Za-z0-9._/-]{0,15}$/;
 function characterClasses(value) {
@@ -112,7 +130,7 @@ function worthRedacting(value) {
   // password — `Tq8vZ2mKp4Lx9RbN`, the `pwgen -s 16` shape, or a twelve-
   // character `Hx93kPq2Lm7w` — starts with a letter, fits sixteen characters of
   // [A-Za-z0-9] and was left in plain text everywhere this daemon posts, against
-  // this block's own promise that "a case mix" is redacted. A word, a hostname,
+  // the block's promise then that "a case mix" is redacted. A word, a hostname,
   // a region or a version string does not draw on upper, lower AND digits at
   // once; a minted secret almost always does.
   if (SCRUB_PLAIN_RE.test(value) && !(/[a-z]/.test(value) && /[A-Z]/.test(value) && /[0-9]/.test(value))) {
@@ -144,7 +162,8 @@ function worthRedacting(value) {
  * ── TWO SOURCES, KEPT IN TWO VARIABLES (2026-09-21, the review) ──
  *
  * `values` is what `scrub` reads and is rebuilt on every scan as
- * `processEnvSecrets()` ++ `fileValues`. The split exists because the two halves
+ * `processEnvSecrets()` ++ `fileValues` (++ the Codex and per-job halves below,
+ * since 2026-10-10 — see `rebuild`). The split exists because the two halves
  * have opposite failure modes. The CHECKOUT half can come back empty for two
  * different reasons — the operator deleted `.env`, or this pass could not read
  * the directory — so an empty read must NOT replace it (see `learnSecrets`).
@@ -164,7 +183,46 @@ function worthRedacting(value) {
  * because the filter is about redaction and the read is about what is on disk.
  */
 let fileValues = [];
-let values = processEnvSecrets().filter((v) => worthRedacting(v.value));
+/**
+ * THE PERSON'S CODEX PROVIDER SECRETS (2026-10-10, the audit's F073) — the
+ * selected provider's `experimental_bearer_token` and literal `http_headers`
+ * out of `config.toml`, plus the present values its `env_key` and
+ * `env_http_headers` name (`readPersonalCodexSecrets`). A fenced Codex turn
+ * carries the literals in its own environment, where `env` prints them, and
+ * every posture can read `~/.codex/config.toml` itself — so they are learned
+ * WHATEVER the posture, and a turn that prints them relays a redaction.
+ *
+ * Kept apart for the file half's reason: the read is a FILE, which can blink,
+ * so only a read that found something replaces it (see `learnSecrets`). Not
+ * read at import — that would be I/O on every import of this module; the
+ * daemon's first `learnSecrets` runs before its first poll (fleet.mjs).
+ */
+let codexValues = [];
+/**
+ * PER-JOB EXTRAS (2026-10-10, the audit's F085) — `key → [{ name, value }]`,
+ * added and removed by their owner (`learnExtraSecrets` / `forgetExtraSecrets`)
+ * and never touched by the 60s rescan. The deploy lane registers the nested
+ * env files it copied into a job's worktree here for that job's life.
+ */
+const extraValues = new Map();
+let values = [];
+rebuild();
+
+/**
+ * THE ONE PLACE `values` IS BUILT, from every half above (2026-10-10).
+ *
+ * LONGEST FIRST: `scrub` replaces values one after another, so a short value
+ * that sits INSIDE a longer one (a password inside a connection URL) was
+ * replaced first whenever the scan happened to list it first, and the longer
+ * value — now holding a marker where its substring was — no longer matched,
+ * leaving the rest of it in plain text. Replacing the longer value first
+ * removes both.
+ */
+function rebuild() {
+  values = [...processEnvSecrets(), ...codexValues, ...fileValues, ...[...extraValues.values()].flat()]
+    .filter((v) => worthRedacting(v.value))
+    .sort((a, b) => b.value.length - a.value.length);
+}
 
 /**
  * HAND THE SCRUBBER A FRESH READ OF THE CHECKOUT'S `.env*` VALUES —
@@ -199,24 +257,87 @@ let values = processEnvSecrets().filter((v) => worthRedacting(v.value));
  * in this daemon takes. The REPORT half is the scan's, and is unaffected: it
  * returns the real (empty) read, so the app is told what was actually measured.
  */
-export function learnSecrets(scannedValues) {
+export function learnSecrets(scannedValues, codexSecrets = readCodexHalf()) {
   if (scannedValues.length) fileValues = scannedValues;
-  // FILTERED ONCE, HERE — see the predicate's own block above: `scrub` is a hot
-  // path and a value that can never match must not survive into its loop.
-  values = [...processEnvSecrets(), ...fileValues].filter((v) => worthRedacting(v.value));
+  // THE CODEX HALF RIDES THE SAME BEAT (2026-10-10), under the file half's
+  // rule: `config.toml` is a file, so a read that found nothing — the person
+  // removed the provider, or the read blinked — leaves what was learned.
+  if (Array.isArray(codexSecrets) && codexSecrets.length) codexValues = codexSecrets;
+  // FILTERED ONCE, IN `rebuild` — see the predicate's own block above: `scrub`
+  // is a hot path and a value that can never match must not survive into its
+  // loop.
+  rebuild();
+}
+
+/** The Codex half's read, which must never cost the file half its beat: the
+ *  read swallows its own I/O errors, and anything else it could throw reads
+ *  as "nothing new" (2026-10-10). */
+function readCodexHalf() {
+  try {
+    return readPersonalCodexSecrets();
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * A SECOND, ADDITIVE DOOR, OWNED BY WHOEVER OPENED IT (2026-10-10, the audit's
+ * F085).
+ *
+ * `learnSecrets` REPLACES the file half on every read that found something,
+ * so a value fed through it a second time would be wiped by the next 60s root
+ * scan. The deploy lane copies NESTED env files (`apps/api/.dev.vars`,
+ * `apps/web/.env.production`) into the worktree its build runs in — files the
+ * root-only scan deliberately never reads (env.mjs) — and then relays that
+ * build's output. It knows exactly which files it copied, so it teaches their
+ * values here under its job's key and forgets them when the job's checkout is
+ * gone. Filtered by `worthRedacting` like every other half; nothing here
+ * reaches the wire.
+ */
+export function learnExtraSecrets(key, list) {
+  extraValues.set(key, (Array.isArray(list) ? list : []).filter((v) => typeof v?.value === 'string'));
+  rebuild();
+}
+
+/** Drop what `learnExtraSecrets` was taught under `key`. */
+export function forgetExtraSecrets(key) {
+  if (extraValues.delete(key)) rebuild();
 }
 
 // ── Uplink scrubbing ───────────────────────────────────────────────────────
 
-/** Redact every known secret value from daemon-posted text. The list has
- *  already been through `worthRedacting`, so this makes no decisions: an
- *  ordinary word, a short flag and anything under the length floor are simply
- *  not in it. */
+/** Redact every known secret value, then every known token SHAPE, from
+ *  daemon-posted text. The value list has already been through
+ *  `worthRedacting`, so this makes no decisions: an ordinary word, a short flag
+ *  and anything under the length floor are simply not in it. */
 export function scrub(text) {
   if (typeof text !== 'string' || !text) return text;
   let out = text;
   for (const v of values) out = out.split(v.value).join(`[REDACTED:${v.name}]`);
-  return out.replace(FLOWVIANT_TOKEN_RE, `[REDACTED:${FLOWVIANT_TOKEN_NAME}]`);
+  return redactShapes(out);
+}
+
+/**
+ * SCRUB THE WHOLE VALUE, THEN CUT IT (2026-10-10, the audit's F072/F143).
+ *
+ * `scrub` matches EXACT values, so a credential that straddles a cap and is cut
+ * FIRST arrives in two halves that match nothing, and the surviving half ships.
+ * This daemon has shipped that order and recorded learning it more than once
+ * (workAgentCheck.mjs, agentPlan.mjs's `progressOf`, runtimeEvents.mjs's
+ * `toolEventOf`). These two make the right order the one that is spelled: the
+ * whole field is scrubbed, and only the result is cut — so a replacement that
+ * grows a string can never push it past `cap` either. `fn` is the scrubber,
+ * injectable for the parsers that take one as a parameter.
+ */
+export function scrubCut(text, cap, fn = scrub) {
+  return String(fn(String(text ?? ''))).slice(0, cap);
+}
+
+/** `scrubCut`'s tail form — the LAST `cap` characters of the scrubbed text,
+ *  for output whose end says why it failed. */
+export function scrubTail(text, cap, fn = scrub) {
+  const out = String(fn(String(text ?? '')));
+  return cap > 0 ? out.slice(-cap) : '';
 }
 
 /**
@@ -238,10 +359,142 @@ export function scrub(text) {
  * process never saw, with no store read and nothing to keep in sync. Twenty is
  * the floor so the 12-character prefix the app shows for identification
  * (`fva_` + 8) still reads as itself.
+ *
+ * ONE SPELLING OF THE PREFIX, HELD BY THE RELEASE GATE (2026-10-10, audit
+ * F146). The pattern and the byte probe are both built from
+ * `FLOWVIANT_TOKEN_PREFIX`, and `scripts/check-app-parity.mjs` holds it to the
+ * app's `AGENT_TOKEN_PREFIX` and the floor to the length the app mints: a
+ * renamed token family would otherwise pass through every redaction here,
+ * silently, until a credential sat in a trace.
  */
-const FLOWVIANT_TOKEN_RE = /fva_[A-Za-z0-9_-]{20,}/g;
+export const FLOWVIANT_TOKEN_PREFIX = 'fva_';
+export const FLOWVIANT_TOKEN_FLOOR = 20;
+const FLOWVIANT_TOKEN_RE = new RegExp(`${FLOWVIANT_TOKEN_PREFIX}[A-Za-z0-9_-]{${FLOWVIANT_TOKEN_FLOOR},}`, 'g');
 const FLOWVIANT_TOKEN_NAME = 'FLOWVIANT_TOKEN';
 
+/**
+ * THE VENDOR LOGINS, CAUGHT BY SHAPE TOO (2026-10-10, the audit's F014).
+ *
+ * The value lists hold what this box was TOLD about — `.env` files, a few named
+ * environment variables, the Codex config. They never held the logins the CLIs
+ * themselves keep: Claude Code's OAuth pair in `~/.claude/.credentials.json`
+ * (`sk-ant-oat…` / `sk-ant-ort…`), an Anthropic or OpenAI key a shell profile
+ * exports under a name nobody listed, Codex's `auth.json` tokens, `gh auth
+ * token`'s `gho_…`, a GitHub App's `ghs_…` installation token in a remote URL.
+ * A turn that printed one — `cat ~/.claude/.credentials.json`, `gh auth token`
+ * — relayed it verbatim into a trace every member of the project reads. So the
+ * shapes the vendors document are redacted wherever they appear, whether or
+ * not this process ever saw the value.
+ *
+ * REDACTION MASKS, IT NEVER WITHHOLDS: the line is still relayed, with the
+ * token replaced. Each floor is long enough that an ordinary word sharing the
+ * prefix (`sk-learn`, `ghost_town`, a `github_pat_` mentioned in prose) is left
+ * alone — the canaries in uplinkScrub.test.mjs pin one per shape. Order
+ * matters: `sk-ant-` is named before the wider `sk-` rule.
+ */
+const TOKEN_SHAPES = [
+  { name: FLOWVIANT_TOKEN_NAME, re: FLOWVIANT_TOKEN_RE, needle: FLOWVIANT_TOKEN_PREFIX },
+  { name: 'ANTHROPIC_TOKEN', re: /sk-ant-[A-Za-z0-9_-]{20,}/g, needle: 'sk-ant-' },
+  { name: 'OPENAI_API_KEY', re: /\bsk-[A-Za-z0-9_-]{32,}/g, needle: 'sk-' },
+  // No word boundary on GitHub's shapes, like `fva_` (2026-10-10, F056): a
+  // token after a JSON-escaped newline (`\nghs_…`) or inside URL encoding
+  // (`%3Aghs_…`) follows a word character, and a hosted box's installation
+  // token reaches gh from a file, so no learned value ever holds it.
+  { name: 'GITHUB_TOKEN', re: /gh[pousr]_[A-Za-z0-9]{30,}/g, needle: '_' },
+  { name: 'GITHUB_TOKEN', re: /github_pat_[A-Za-z0-9_]{40,}/g, needle: 'github_pat_' },
+  { name: 'AWS_ACCESS_KEY_ID', re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, needle: 'A' },
+  { name: 'SLACK_TOKEN', re: /\bxox[abpr]-[A-Za-z0-9-]{20,}/g, needle: 'xox' },
+];
+
+/**
+ * AN OAUTH TOKEN IN A JSON FIELD — Codex's `auth.json` (`access_token`,
+ * `refresh_token`, `id_token`: JWTs with no vendor prefix) and Claude's
+ * credential file (`accessToken`, `refreshToken`). The key is kept and only
+ * the value is replaced, so the line still reads as what it was. Also matched
+ * with escaped quotes, as the field reads once it is itself inside a JSON
+ * string (a tool result relayed whole). A value something above already
+ * redacted is left as it is.
+ */
+const OAUTH_FIELD_RE =
+  /(\\?"(?:access_token|refresh_token|id_token|accessToken|refreshToken|idToken)\\?"\s*:\s*\\?")(?!\[REDACTED:)[^"\\]{20,}/g;
+const OAUTH_FIELD_NAME = 'OAUTH_TOKEN';
+
+/**
+ * A PEM PRIVATE KEY — a `-----BEGIN … PRIVATE KEY-----` block (`cat
+ * ~/.ssh/id_ed25519`, a service-account JSON's `private_key`). The whole block
+ * is replaced: from BEGIN to END when everything between is key material
+ * (base64, line breaks, the legacy `Proc-Type`/`DEK-Info` headers) holding at
+ * least one 16-character base64 run; or, when no END follows (a `head` of the
+ * file), the BEGIN line and the base64 lines straight after it. A BEGIN line
+ * alone is a header named in prose, and is left alone.
+ *
+ * LINEAR, ON PURPOSE. A regex with a lazy body between BEGIN and END rescans
+ * the rest of the text from every BEGIN that has no END — quadratic on a text
+ * of nothing but BEGIN lines, the freeze `candidateObjects` was hardened
+ * against. So the three forward searches each keep a cursor that only moves
+ * forward, and the block regexes are sticky.
+ */
+const PEM_BEGIN_RE = /-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+const PEM_END_RE = /-----END [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+const PEM_NOT_BODY_RE = /[^A-Za-z0-9+/=\s\\:,.-]/g;
+const PEM_RUN_RE = /[A-Za-z0-9+/=]{16}/g;
+const PEM_LINES_RE = /(?:(?:\r?\n|\\r\\n|\\n)[ \t]*[A-Za-z0-9+/=]+)+/y;
+const PEM_MAX_BODY = 32 * 1024;
+const PEM_NAME = 'PRIVATE_KEY';
+
+function redactPem(text) {
+  if (!text.includes('PRIVATE KEY-----')) return text;
+  let out = '';
+  let at = 0;
+  // Cursors: the first END / non-key character / 16-char run at or after the
+  // position each was last searched from (-1: none in the rest of the text).
+  let end = -2;
+  let endLen = 0;
+  let bad = -2;
+  let run = -2;
+  const after = (re, cursor, from) => {
+    if (cursor === -1 || cursor >= from) return cursor;
+    re.lastIndex = from;
+    const m = re.exec(text);
+    return m ? m.index : -1;
+  };
+  PEM_BEGIN_RE.lastIndex = 0;
+  for (let m; (m = PEM_BEGIN_RE.exec(text)); ) {
+    const body = m.index + m[0].length;
+    let stop = -1;
+    if (end !== -1 && end < body) {
+      PEM_END_RE.lastIndex = body;
+      const e = PEM_END_RE.exec(text);
+      end = e ? e.index : -1;
+      endLen = e ? e[0].length : 0;
+    }
+    if (end >= 0 && end - body <= PEM_MAX_BODY) {
+      bad = after(PEM_NOT_BODY_RE, bad, body);
+      run = after(PEM_RUN_RE, run, body);
+      if ((bad === -1 || bad >= end) && run >= 0 && run + 16 <= end) stop = end + endLen;
+    }
+    if (stop < 0) {
+      PEM_LINES_RE.lastIndex = body;
+      const lines = PEM_LINES_RE.exec(text);
+      if (lines && /[A-Za-z0-9+/=]{16}/.test(lines[0])) stop = body + lines[0].length;
+    }
+    if (stop < 0) continue;
+    out += `${text.slice(at, m.index)}[REDACTED:${PEM_NAME}]`;
+    at = stop;
+    PEM_BEGIN_RE.lastIndex = stop;
+  }
+  return at === 0 ? text : out + text.slice(at);
+}
+
+function redactShapes(text) {
+  let out = text;
+  for (const s of TOKEN_SHAPES) {
+    if (out.includes(s.needle)) out = out.replace(s.re, `[REDACTED:${s.name}]`);
+  }
+  if (out.includes('oken')) out = out.replace(OAUTH_FIELD_RE, `$1[REDACTED:${OAUTH_FIELD_NAME}]`);
+  return redactPem(out);
+}
+
 /**
  * The NAME of the first known secret whose value appears in `bytes` as an
  * exact byte substring, or null. For the payloads `scrub` cannot touch: a
@@ -256,10 +509,22 @@ const FLOWVIANT_TOKEN_NAME = 'FLOWVIANT_TOKEN';
 export function secretIn(bytes) {
   if (!Buffer.isBuffer(bytes) || !bytes.length) return null;
   for (const v of values) if (bytes.includes(v.value, 0, 'utf8')) return v.name;
-  // The token SHAPE too (see `scrub`). `latin1` maps every byte to one
-  // character, so the ASCII pattern matches exactly where the bytes do.
-  if (bytes.includes('fva_') && new RegExp(FLOWVIANT_TOKEN_RE.source).test(bytes.toString('latin1'))) {
-    return FLOWVIANT_TOKEN_NAME;
+  // The token SHAPES too (see `scrub`). `latin1` maps every byte to one
+  // character, so an ASCII pattern matches exactly where the bytes do. Fresh,
+  // non-global copies: a `/g` regex's `test` keeps `lastIndex` between calls.
+  let text = null;
+  for (const s of TOKEN_SHAPES) {
+    if (!bytes.includes(s.needle)) continue;
+    text ??= bytes.toString('latin1');
+    if (new RegExp(s.re.source).test(text)) return s.name;
+  }
+  if (bytes.includes('oken')) {
+    text ??= bytes.toString('latin1');
+    if (new RegExp(OAUTH_FIELD_RE.source).test(text)) return OAUTH_FIELD_NAME;
+  }
+  if (bytes.includes('PRIVATE KEY-----')) {
+    text ??= bytes.toString('latin1');
+    if (redactPem(text) !== text) return PEM_NAME;
   }
   return null;
 }

package/bin/lib/vault.mjs

@@ -27,16 +27,79 @@ import {
 } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { join, relative, sep } from 'node:path';
+import { gitRaw } from './git.mjs';
 import { planVaultSync } from './vaultDiff.mjs';
 
 const SYNC_STATE = '.flowviant-sync.json';
 
-/** Create the vault dir + its private git history (best-effort). */
+/**
+ * EVERY GIT CALL IN THE VAULT, AND NONE OF THE VAULT'S OWN PROGRAMS
+ * (2026-10-10, the audit). The vault is a directory a cartographer turn writes:
+ * Codex's wiki profile can write all of it, `.git` included, and Claude's list
+ * denies its `.git` only as far as the CLI keeps its word. A `core.fsmonitor`
+ * planted in `<vault>/.git/config` ran on the daemon's own `git add -A` — the
+ * daemon, with the daemon's environment, outside every turn's fence — and a
+ * planted hook would run on its `git commit`. So the daemon's git here runs
+ * with the monitor off and hooks pointed at nothing, and commits `--no-verify`.
+ * Command-line `-c` outranks every config file.
+ */
+const VAULT_GIT_FENCE = Object.freeze(['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null']);
+export function vaultGit(args, dir) {
+  return execFileSync('git', [...VAULT_GIT_FENCE, ...args], { cwd: dir, stdio: 'ignore' });
+}
+
+/**
+ * …AND NO PROGRAM THE VAULT'S CONFIG NAMES. `-c` can switch off the monitor
+ * and the hooks by name, but not a program the config invents a name for: a
+ * `[filter "x"] clean = <cmd>` beside a `.gitattributes` of `* filter=x` ran
+ * on the fenced `git add -A` all the same (measured, git 2.55), and so would a
+ * `gpg.program` under `commit.gpgSign`. Nothing a vault needs is in its config
+ * beyond what `git init` writes, so a config holding anything else was not the
+ * daemon's — and the local commit is skipped, in words, rather than run. The
+ * sync itself is unaffected: it reads files, never git. A config git cannot
+ * read is the same answer.
+ */
+const INIT_CONFIG_KEYS = new Set([
+  'core.repositoryformatversion',
+  'core.filemode',
+  'core.bare',
+  'core.logallrefupdates',
+  'core.ignorecase',
+  'core.precomposeunicode',
+  'core.symlinks',
+  'extensions.objectformat',
+  'extensions.refstorage',
+]);
+export function vaultConfigForeignKey(dir) {
+  let listed;
+  try {
+    // `--local` reads the config THIS repository resolves to — through a
+    // planted `commondir` or a `.git` file too. It does NOT follow includes
+    // (a file option turns them off), so an `include.path` is caught by its
+    // own key (measured, git 2.55). Reading config runs nothing.
+    listed = gitRaw([...VAULT_GIT_FENCE, 'config', '--local', '--list', '-z'], dir, { stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch {
+    return '(unreadable)';
+  }
+  // `-z`: each entry is `key\nvalue\0`, so a value with a newline in it
+  // cannot pass for a key of its own.
+  for (const entry of listed.split('\0')) {
+    if (!entry) continue;
+    const key = entry.split('\n')[0].toLowerCase();
+    if (!INIT_CONFIG_KEYS.has(key)) return key;
+  }
+  return null;
+}
+
+/** Create the vault dir + its private git history (best-effort). With NO
+ *  template (2026-10-10): a person's `init.templateDir` can carry a `config`
+ *  of its own, which `git init` copies in (measured, git 2.55) — and which the
+ *  check above would then refuse on every sync. A vault needs none of it. */
 export function ensureVault(dir) {
   mkdirSync(dir, { recursive: true });
   if (!existsSync(join(dir, '.git'))) {
     try {
-      execFileSync('git', ['init', '-q'], { cwd: dir, stdio: 'ignore' });
+      vaultGit(['init', '-q', '--template='], dir);
     } catch {
       /* git unavailable — the vault still works, just unversioned */
     }
@@ -68,14 +131,19 @@ function walkMd(dir, base = dir, out = [], errors = { count: 0 }) {
 
 /** Best-effort local history commit — identity pinned so it works on machines
  *  with no global git config, and never touches the user's identity. */
-function commitVault(dir, message) {
+function commitVault(dir, message, warn) {
+  // No `.git` of its own (git was unavailable at init, or a turn removed it):
+  // unversioned — and never a `git add -A` that walks UP into whatever
+  // repository encloses the vault.
+  if (!existsSync(join(dir, '.git'))) return;
+  const foreign = vaultConfigForeignKey(dir);
+  if (foreign) {
+    warn(`wiki vault history not committed — its git config holds \`${foreign}\`, which Flowviant did not write (${dir})`);
+    return;
+  }
   try {
-    execFileSync('git', ['add', '-A'], { cwd: dir, stdio: 'ignore' });
-    execFileSync(
-      'git',
-      ['-c', 'user.name=flowviant', '-c', 'user.email=wiki@flowviant.local', 'commit', '-q', '-m', message],
-      { cwd: dir, stdio: 'ignore' }
-    );
+    vaultGit(['add', '-A'], dir);
+    vaultGit(['-c', 'user.name=flowviant', '-c', 'user.email=wiki@flowviant.local', 'commit', '-q', '--no-verify', '-m', message], dir);
   } catch {
     /* nothing to commit / git unavailable — fine */
   }
@@ -124,6 +192,6 @@ export async function syncVault({ dir, url, token, userAgent, finalize, grounded
   }
 
   writeFileSync(join(dir, SYNC_STATE), JSON.stringify(plan.state));
-  commitVault(dir, plan.finalized ? `sweep${groundedAtSha ? ` @ ${groundedAtSha.slice(0, 7)}` : ''}` : `update${groundedAtSha ? ` @ ${groundedAtSha.slice(0, 7)}` : ''}`);
+  commitVault(dir, plan.finalized ? `sweep${groundedAtSha ? ` @ ${groundedAtSha.slice(0, 7)}` : ''}` : `update${groundedAtSha ? ` @ ${groundedAtSha.slice(0, 7)}` : ''}`, warn);
   return { pages: plan.pages, uploaded: plan.uploaded, deleted: plan.deleted };
 }

package/bin/lib/vaultDiff.mjs

@@ -21,9 +21,12 @@ import { createHash } from 'node:crypto';
 
 // Mirror the server contract (shared schema) — a page that violates it is
 // skipped with a warning (and carried forward if previously synced), never
-// allowed to 400 the whole request and wedge the sync.
+// allowed to 400 the whole request and wedge the sync. The release parity gate
+// (scripts/check-app-parity.mjs, 2026-10-10, audit F142) holds these to the
+// shared WIKI_VAULT_* names, CHUNK_FILES within the per-request file cap, and
+// isSafePath to isSafeVaultPath over a vector list.
 export const MAX_FILE_BYTES = 262_144;
-const MAX_PATH_CHARS = 300;
+export const MAX_PATH_CHARS = 300;
 export const MAX_FILES = 400;
 export const CHUNK_FILES = 30;
 export const CHUNK_BYTES = 700_000;