flowviant 0.116.0 → 0.124.0

package/bin/lib/claudePosture.mjs

@@ -12,6 +12,7 @@
 
 import { fileURLToPath } from 'node:url';
 import { SAFE } from './config.mjs';
+import { runningCompiledBinary } from './launchCommand.mjs';
 
 /**
  * THE READ GUARD, ON EVERY CURATED POSTURE (2026-09-23) — see
@@ -35,20 +36,40 @@ import { SAFE } from './config.mjs';
  * `process.execPath`, never a `node` looked up on a PATH the operator may not
  * have, because a hook that fails to START is a non-blocking error and the
  * command runs anyway.
+ *
+ * …AND AS `<flowviant> __hook read-guard` UNDER THE COMPILED BINARY
+ * (2026-10-11). There `process.execPath` IS flowviant and the script path is
+ * Bun's virtual `/$bunfs/…`, so the old command was `flowviant
+ * '/$bunfs/root/hooks/readGuard.mjs'`: the CLI answered "is not a command"
+ * with exit 1 (measured on the installed 0.116.0), a non-blocking error, and
+ * every guarded command ran — the curl install had no read guard. The CLI now
+ * runs the hook itself (bin/cli.mjs, `__hook`), before anything else loads.
  */
 export const READ_GUARD_PATH = fileURLToPath(new URL('./hooks/readGuard.mjs', import.meta.url));
+export const MCP_ALLOW_PATH = fileURLToPath(new URL('./hooks/mcpAllow.mjs', import.meta.url));
 const hookQuote = (s) =>
   process.platform === 'win32' ? `"${s}"` : `'${String(s).replace(/'/g, `'\\''`)}'`;
+/** The command a hook runs as: this node and the script, or this binary and
+ *  its `__hook` word (`compiled` is runningCompiledBinary's answer; a test
+ *  passes it). */
+export function hookCommand(name, scriptPath, { compiled = runningCompiledBinary() } = {}) {
+  return compiled ? `${hookQuote(process.execPath)} __hook ${name}` : `${hookQuote(process.execPath)} ${hookQuote(scriptPath)}`;
+}
 export const READ_GUARD_SETTINGS = JSON.stringify({
   hooks: {
     PreToolUse: [
       {
         matcher: 'Bash',
-        hooks: [{ type: 'command', command: `${hookQuote(process.execPath)} ${hookQuote(READ_GUARD_PATH)}` }],
+        hooks: [{ type: 'command', command: hookCommand('read-guard', READ_GUARD_PATH) }],
       },
     ],
   },
 });
+/** The MCP allow hook's entry (hooks/mcpAllow.mjs), matched on MCP tools only. */
+export const MCP_ALLOW_HOOK = Object.freeze({
+  matcher: 'mcp__.*',
+  hooks: [{ type: 'command', command: hookCommand('mcp-allow', MCP_ALLOW_PATH) }],
+});
 /** Spread FIRST into a curated list: `--allowedTools` is variadic, so the
  *  `--settings` pair must stand before it or be swallowed as a tool name. */
 const READ_GUARD = ['--settings', READ_GUARD_SETTINGS];
@@ -91,12 +112,22 @@ function fencedReads(knowledgeDir) {
   ];
 }
 
-/** The shell readers CONSULT and PLAN keep. Each one is PATH-VALIDATED by the
- *  CLI itself — measured on 2.1.281 (2026-09-24): with `Bash(cat:*)`,
- *  `Bash(head:*)` and `Bash(ls:*)` allowed, `cat`/`ls`/`head` on a file outside
- *  the working directories were each refused ("Claude Code may only
- *  concatenate files from the allowed working directories") — so it is the
- *  Read/Grep/Glob TOOLS, not these, that needed the fence above. */
+/** The shell readers CONSULT and PLAN keep. `cat`, `ls` and `head` are
+ *  PATH-VALIDATED by the CLI itself — measured on 2.1.281 (2026-09-24): with
+ *  `Bash(cat:*)`, `Bash(head:*)` and `Bash(ls:*)` allowed, each was refused a
+ *  file outside the working directories ("Claude Code may only concatenate
+ *  files from the allowed working directories") — so it is the Read/Grep/Glob
+ *  TOOLS, not these, that needed the fence above.
+ *
+ *  THE GIT READERS WERE NEVER MEASURED THAT WAY (2026-10-10, the audit), and
+ *  `git diff` reads any file on the box: `--no-index` compares two arbitrary
+ *  paths, and git switches to it on its own when a path lies outside the work
+ *  tree (`git diff ~/.ssh/id_ed25519 /dev/null` prints the key). So the read
+ *  guard is their path fence: it refuses `--no-index`, and a git argument that
+ *  is absolute, `~`-rooted or climbs a `..` segment (revision ranges `a..b`
+ *  still pass). It also refuses every one of these readers the checkout's
+ *  secret files by name — the shell's half of CHECKOUT_SECRETS below, since a
+ *  Read deny says nothing about `cat`. See hooks/readGuard.mjs. */
 const CONSULT_BASH = [
   'Bash(ls:*)',
   'Bash(wc:*)',
@@ -108,6 +139,14 @@ const CONSULT_BASH = [
   'Bash(git rev-parse:*)',
 ];
 
+/** The checkout's own secrets, denied BY NAME on the postures that read the
+ *  repo and hand what they read to someone (2026-10-10, the audit): consult
+ *  (intake's brief lands with no press), plan and the wiki (every page is
+ *  uploaded). Research's measured pair — `Read(./**)` read `.env` without it —
+ *  plus Wrangler's `.dev.vars`, which no root `.env*` scan sees. The read guard
+ *  refuses the same files to the shell readers (hooks/readGuard.mjs). */
+const CHECKOUT_SECRETS = ['Read(./.env*)', 'Read(./**/.env*)', 'Read(./**/.dev.vars)'];
+
 /**
  * PLAN — read the repo, write the plan, never the code.
  *
@@ -120,10 +159,11 @@ const CONSULT_BASH = [
  * hijacked turn's most destructive reachable act is dropping a slice from the
  * plan it is already in, which a human can see and undo in the thread.
  *
- * Note what is absent versus WIKI_PERM: Write, Edit, mkdir and rm. The
- * cartographer needs those because it authors files; a planner authors records
- * through an API, and there is no file on this machine it has any business
- * touching.
+ * Note what is absent versus the wiki's list: Edit, mkdir and rm. The
+ * cartographer needs those because it authors files (in the vault, and only
+ * there); a planner authors records through an API, and there is no file on
+ * this machine it has any business touching. The checkout's secrets are denied
+ * by name (CHECKOUT_SECRETS), as on consult.
  */
 export function planPermFor(knowledgeDir) {
   return [
@@ -132,6 +172,8 @@ export function planPermFor(knowledgeDir) {
     'mcp__flowviant',
     ...fencedReads(knowledgeDir),
     ...CONSULT_BASH,
+    '--disallowedTools',
+    ...CHECKOUT_SECRETS,
   ];
 }
 
@@ -153,24 +195,13 @@ const PERM = SAFE
     ]
   : ['--dangerously-skip-permissions'];
 
-// Wiki turns are read-the-repo + write-the-vault ONLY — always curated, never
-// --dangerously-skip-permissions: no gh, no push-capable git, no package
-// managers, and nothing that can EXECUTE arbitrary commands — no `find`
-// (-exec/-delete) and no `git grep` (-O<pager> runs a shell; the Grep tool
-// covers search). Command execution is the line: it enables network exfil,
-// which plain file writes never do. `rm` IS allowed: pruning a stale vault
-// page requires a real file deletion (that's how the sync protocol learns of
-// it), and the blast radius is bounded — the daemon resets the repo worktree
-// after every wiki turn, and the vault has its own git history.
-// (Write/Edit can't be path-scoped here; the worktree reset is the backstop.)
-const WIKI_PERM = [
-  ...READ_GUARD,
-  '--allowedTools',
-  'Read',
-  'Grep',
-  'Glob',
-  'Edit',
-  'Write',
+/** The cartographer's shell: the consult readers, plus `mkdir` and `rm` for
+ *  the vault (pruning a stale page needs a real deletion — that is how the
+ *  sync protocol learns of it) and `git status`. The CLI path-validates
+ *  `mkdir`/`rm` to the working directories, which is why the vault is handed
+ *  over by `--add-dir` (runtimeClaude.mjs). No `find` (-exec/-delete) and no
+ *  `git grep` (-O<pager> runs a shell; the Grep tool covers search). */
+const WIKI_BASH = [
   'Bash(ls:*)',
   'Bash(wc:*)',
   'Bash(head:*)',
@@ -184,24 +215,93 @@ const WIKI_PERM = [
   'Bash(git rev-parse:*)',
 ];
 
+/**
+ * THE CARTOGRAPHER — read the repo, write the vault, and nothing else
+ * (2026-10-10, the audit: it joins the fenced postures of 2026-09-24).
+ *
+ * It ran on bare Read/Grep/Glob/Edit/Write, and its comment said file writes
+ * "never" exfiltrate and the worktree reset was the backstop. Neither held.
+ * The vault is an UPLINK — every page is synced to the project's wiki — so a
+ * bare Read of `~/.flowviant/credentials.json` copied into a page leaves the
+ * box; and the reset cleans the wiki worktree only, never a write outside it:
+ * `<vault>/.git/config` with a `core.fsmonitor` the daemon's own `git add`
+ * then ran, the checkout's `.flowviant/check.json`, a shell rc file. This turn
+ * runs UNATTENDED after every merge, on a member-written card title and on
+ * repo text, so the list is the enforcement and the prompt is only prose.
+ *
+ * Reads are the read fence (`fencedReads`: the worktree, the knowledge library
+ * when one is passed) plus the vault by its absolute path; Grep carries no
+ * allow rule, as in consult. The ONE write is `Edit(//<vault>/**)`, the vault's
+ * `.git` is denied both ways, and the checkout's secrets are denied by name.
+ *
+ * PROBED on Claude Code 2.1.296 before relying on it (2026-10-10), this exact
+ * list as the adapter builds it (`--add-dir <vault>`, stated `default` mode),
+ * cwd a detached worktree, the vault under `<home>/.flowviant/vaults/<id>`, a
+ * `-p` turn told to try each in turn:
+ *  · ALLOWED: Write of a new `<vault>/pages/x.md` and Edit of `<vault>/index.md`
+ *    (the Edit rule governs Write too; where ARTIFACT_WRITE's 2.1.281 note
+ *    below reads anchored spellings as no write, this `//`-anchored Edit rule
+ *    scoped as written on 2.1.296); `ls`, `rm` and `mkdir` in the vault; Read
+ *    and Glob in the vault and the worktree.
+ *  · REFUSED: Write of a canary outside both ("Claude requested permissions to
+ *    write to …, but you haven't granted it yet"), of the checkout's
+ *    `.flowviant/check.json`, of a file in the worktree itself, and of
+ *    `<vault>/.git/config` ("File is in a directory that is denied by your
+ *    permission settings"); Read of `<home>/.flowviant/credentials.json`, of the
+ *    checkout's `.git/config`, and of the worktree's `.env` (denied by name).
+ *    Every refused write left the disk unchanged.
+ *  · CONTROLS: without the Edit rule the vault page was refused too — so
+ *    `--add-dir` admits reads, never writes, and the rule is load-bearing;
+ *    without the `.git` deny, the `.git/config` write was still refused by the
+ *    CLI's own check ("… which is a sensitive file") — so the deny is a belt
+ *    on this CLI, kept because that check is the vendor's and unpinned.
+ *
+ * A vault no permission rule can name (not absolute, or carrying glob or rule
+ * syntax) gets NO list: `claudePermFor` answers null and Claude's adapter
+ * refuses the turn in words, rather than running it unfenced or unable to
+ * write.
+ */
+export function wikiPermFor(knowledgeDir, vaultDir) {
+  const vault = ruleSafeAbsolute(vaultDir);
+  if (!vault) return null;
+  return [
+    ...READ_GUARD,
+    '--allowedTools',
+    ...fencedReads(knowledgeDir),
+    `Read(/${vault}/**)`,
+    `Glob(/${vault}/**)`,
+    `Edit(/${vault}/**)`,
+    ...WIKI_BASH,
+    '--disallowedTools',
+    ...CHECKOUT_SECRETS,
+    `Read(/${vault}/.git/**)`,
+    `Edit(/${vault}/.git/**)`,
+  ];
+}
+
 // A CONSULT reads and answers. Nothing else.
 //
-// It used to run on WIKI_PERM, whose comment two blocks up says the quiet part:
-// Write/Edit "can't be path-scoped here; the worktree reset is the backstop".
-// That is a fine trade for the cartographer, which exists to author files and
-// gets reset after every turn. It is the wrong trade for a consult, whose prompt
-// is steered by a question ANY project editor can write and which had no reset
-// behind it — so a sentence in a chat box could reach Write, rm and mkdir on
-// someone else's machine. The permission list is the enforcement; the prompt's
-// "do not change anything" is only an instruction, and instructions are exactly
-// what an injected question competes with.
+// It used to run on the cartographer's old list, whose comment said the quiet
+// part: Write/Edit "can't be path-scoped here; the worktree reset is the
+// backstop". That was the wrong trade for a consult, whose prompt is steered
+// by a question ANY project editor can write and which had no reset behind it
+// — so a sentence in a chat box could reach Write, rm and mkdir on someone
+// else's machine (and it was the wrong trade for the cartographer too: see
+// `wikiPermFor`). The permission list is the enforcement; the prompt's "do not
+// change anything" is only an instruction, and instructions are exactly what
+// an injected question competes with.
+//
+// The checkout's secrets are denied by name (2026-10-10): a consult's answer
+// leaves the box, and intake's drafted brief lands on the board with no press.
 export function consultPermFor(knowledgeDir) {
-  return [...READ_GUARD, '--allowedTools', ...fencedReads(knowledgeDir), ...CONSULT_BASH];
+  return [...READ_GUARD, '--allowedTools', ...fencedReads(knowledgeDir), ...CONSULT_BASH, '--disallowedTools', ...CHECKOUT_SECRETS];
 }
 
 /**
  * THE TWO NON-CODE POSTURES (0.97.0) — a design card and a research card may
- * WRITE, and only under `.flowviant/artifacts/`.
+ * HISTORICAL ARTIFACT PROBES before 2026-10-12. Current artifact lists below
+ * add guarded readers, web and scratch; arbitrary programs still cannot
+ * bypass the write fence. WRITE was only under `.flowviant/artifacts/`.
  *
  * The card's words are steered by anyone who can file a card, so "change
  * nothing" as prose is only an instruction, and the permission list is the
@@ -260,11 +360,26 @@ export function consultPermFor(knowledgeDir) {
  *    explicit `Bash(git log:*)` prefix the old list carried). With `Bash` in
  *    `--disallowedTools` the tool was not there at all.
  *
- * NO MCP, and no shell that could commit: the agent turn has no MCP anyway
- * (see SYSTEM_AGENT's header), and a posture that could run `git commit` could
- * commit the mockup it was told to keep out of git.
+ * THE PROJECT'S MCP SERVERS (2026-10-10, the owner): each list allows
+ * `mcp__<server>` for every server the agent lane mounted from the base
+ * branch's reviewed `.mcp.json` (projectTools.mjs) — the set a code card gets.
+ * Under `--allowedTools` an MCP tool with no rule is refused ("Claude requested
+ * permissions to use mcp__…, but you haven't granted it yet", measured on the
+ * plan posture), so the rule IS the mount. AND THE MACHINE'S OWN (2026-10-11):
+ * an agent turn mounts this machine's user/local servers and claude.ai
+ * connectors too, whose names only the CLI knows, so the lane adds the MCP
+ * allow hook (`withMachineMcp`, below). No shell that could commit: a posture
+ * that could run `git commit` could commit the mockup it was told to keep out
+ * of git.
  *
- * STATED, not closed: research may still read any file in the worktree and
+ * STATED, not closed: an MCP server is a process of its own, outside every
+ * list here — it reads, writes and reaches the network as the person who runs
+ * it, and a turn steered by a card's words can hand it anything the turn read,
+ * or ask it to act: the machine's claude.ai connectors are its owner's
+ * accounts. On research that sits beside the web. The base branch's
+ * `.mcp.json` is the repository's reviewed choice, and the machine's servers
+ * are its owner's (docs/decisions.md, 2026-10-10 and 2026-10-11).
+ * Research may still read any file in the worktree and
  * name it in a WebFetch URL — the repository is what a research card is about,
  * and a turn that could not read it could not answer. Design may read any
  * file in its worktree and put it in an artifact the server stores; text
@@ -279,6 +394,12 @@ export function consultPermFor(knowledgeDir) {
  * the guard's hook sees a subagent's own calls was not measured here.
  */
 const ARTIFACT_WRITE = 'Edit(.flowviant/artifacts/**)';
+/** `mcp__<server>` for each mounted project server — a name the base snapshot
+ *  already admitted (projectTools.mjs `nameOk`), checked again here because a
+ *  rule is a pattern: anything but a plain server name gets no rule, and
+ *  Flowviant's own control plane is never a project's server. */
+const projectMcpRules = (names = []) =>
+  names.filter((n) => typeof n === 'string' && /^[A-Za-z0-9_-]{1,80}$/.test(n) && n !== 'flowviant').map((n) => `mcp__${n}`);
 /**
  * PLAN MODE (0.97.0) — a Workbench tab's `planMode` switch, and Claude Code's
  * own `--permission-mode plan` INSTEAD OF every list above: the CLI reads,
@@ -306,20 +427,25 @@ const ARTIFACT_WRITE = 'Edit(.flowviant/artifacts/**)';
  *    `readOnlyHint: true`, and none of the session tools (stream_session_turn,
  *    log_work, file_card …) are read-only or annotated so. So a plan turn runs
  *    PLAIN — no MCP, the plain tab's contract — rather than mounting a control
- *    plane whose every call the CLI refuses. See workSessionTurns.mjs.
+ *    plane whose every call the CLI refuses. See workTurnShape.mjs.
  */
 export const PLAN_MODE_PERM = ['--permission-mode', 'plan'];
-export function designPermFor(knowledgeDir) {
+export function designPermFor(knowledgeDir, projectMcp = []) {
   return [
     ...READ_GUARD,
     '--allowedTools',
     ...fencedReads(knowledgeDir),
-    'Bash(ls:*)',
+    ...CONSULT_BASH,
+    'WebSearch',
+    'WebFetch',
     ARTIFACT_WRITE,
+    'Edit(.flowviant/tmp/**)',
+    ...projectMcpRules(projectMcp),
     // A mockup is uploaded and runs scripts in a frame that may navigate
     // itself, so the checkout's own secrets are denied by name too — the same
     // pair research carries, measured load-bearing there.
     '--disallowedTools',
+    'Agent',
     'Read(./.env*)',
     'Read(./**/.env*)',
   ];
@@ -331,18 +457,21 @@ export const DESIGN_PERM = designPermFor(null);
  * outside the worktree it may read, and only the spawn knows where that is.
  * `//` is the CLI's own spelling for an absolute path in a rule.
  */
-export function researchPerm(knowledgeDir) {
+export function researchPerm(knowledgeDir, projectMcp = []) {
   return [
     ...READ_GUARD,
     '--allowedTools',
     ...fencedReads(knowledgeDir),
+    ...CONSULT_BASH,
     'WebSearch',
     'WebFetch',
     ARTIFACT_WRITE,
+    'Edit(.flowviant/tmp/**)',
+    ...projectMcpRules(projectMcp),
     '--disallowedTools',
+    'Agent',
     'Read(./.env*)',
     'Read(./**/.env*)',
-    'Bash',
   ];
 }
 /** The list with no library — what a project that keeps none runs under. */
@@ -352,15 +481,17 @@ export const RESEARCH_PERM = researchPerm(null);
  * CLAUDE'S PERMISSION LIST FOR A TURN PROFILE, by the profile's name — one
  * entry per name in turnProfile.mjs (a test holds the two tables equal). The
  * builders that take the knowledge directory get it; the fixed lists ignore it.
+ * `projectMcp` is the names of the project servers the lane mounted; only the
+ * design and research lists take them (`projectMcp` in turnProfile.mjs).
  */
 const CLAUDE_PERM = {
   build: () => PERM,
-  wiki: () => WIKI_PERM,
+  wiki: (kd, vaultDir) => wikiPermFor(kd, vaultDir),
   consult: (kd) => consultPermFor(kd),
   plan: (kd) => planPermFor(kd),
   'plan-mode': () => PLAN_MODE_PERM,
-  design: (kd) => designPermFor(kd),
-  research: (kd) => researchPerm(kd),
+  design: (kd, _vault, mcp) => designPermFor(kd, mcp),
+  research: (kd, _vault, mcp) => researchPerm(kd, mcp),
   // THE IMAGE POSTURE IS CODEX'S (0.114.0) and Claude does not declare it
   // (runtimeClaude.mjs `profiles`), so turnProfile.mjs refuses a Claude turn
   // under it before argv is built. The entry exists because `runTurn` looks
@@ -370,8 +501,50 @@ const CLAUDE_PERM = {
   image: (kd) => consultPermFor(kd),
 };
 export const CLAUDE_PERM_PROFILES = Object.freeze(Object.keys(CLAUDE_PERM));
-export function claudePermFor(profileName, knowledgeDir) {
+export function claudePermFor(profileName, knowledgeDir, vaultDir, projectMcp = []) {
   const build = Object.hasOwn(CLAUDE_PERM, profileName) ? CLAUDE_PERM[profileName] : null;
   if (!build) throw new Error(`no Claude permission list for profile '${profileName}'`);
-  return build(knowledgeDir);
+  return build(knowledgeDir, vaultDir, projectMcp);
+}
+
+/**
+ * THE MACHINE'S MCP SERVERS ON AN AGENT TURN (2026-10-11, the owner: "the
+ * server that is running flowviant's claude HAS these MCPs yet the agents are
+ * not using them"). A code, write-up, mockup, 3D-model or deck turn mounts what
+ * this machine's Claude Code has — its user and local servers and the account's
+ * claude.ai connectors — beside the base branch's `.mcp.json` copy. So the turn
+ * drops `--strict-mcp-config` (runtimeClaude.mjs), and its one `--settings`
+ * carries two things:
+ *
+ *  · `disabledMcpjsonServers`, every server named in a `.mcp.json` from the
+ *    worktree up to `/`. Without strict, Claude Code reads `.mcp.json` in the
+ *    cwd AND EVERY PARENT (measured, 2.1.290: a parent directory's server
+ *    loaded) wherever a settings scope approves it, so the agent's own edit of
+ *    its worktree's file would mount before review. A flag
+ *    `enableAllProjectMcpServers: false` did NOT override a lower scope's
+ *    `true`; the disabled list did, by name, and left the base copy loaded
+ *    through `--mcp-config` (a `dynamic` server) untouched — measured with both
+ *    a lower `enableAllProjectMcpServers` and a lower `enabledMcpjsonServers`.
+ *  · the MCP allow hook (`MCP_ALLOW_HOOK`), because a fenced list refuses an
+ *    MCP tool it does not name and a connector's name is the account's. The
+ *    build's bypass needs no hook; a SAFE build's curated list does, and the
+ *    hook is harmless under the bypass, so every mount carries it.
+ *
+ * `perm` is the posture's list; a list with no `--settings` (the build) gets
+ * one before its lists (`--allowedTools` is variadic). The fenced turn's
+ * personal keys are folded in after (claudePersonal.mjs); the posture's keys
+ * win there, and none of the person's kept keys is one of these.
+ *
+ * STATED, not closed: plugins stay the person's own on the build and out of
+ * every fenced turn (`--setting-sources ''`), so a plugin's MCP servers reach
+ * code cards only — a plugin also brings hooks, which would be a second author
+ * of a fenced posture.
+ */
+export function withMachineMcp(perm, disabledProjectMcp) {
+  const extra = { disabledMcpjsonServers: [...disabledProjectMcp] };
+  const at = perm.indexOf('--settings');
+  if (at < 0) return ['--settings', JSON.stringify({ ...extra, hooks: { PreToolUse: [MCP_ALLOW_HOOK] } }), ...perm];
+  const posture = JSON.parse(perm[at + 1]);
+  const hooks = { ...(posture.hooks ?? {}), PreToolUse: [...(posture.hooks?.PreToolUse ?? []), MCP_ALLOW_HOOK] };
+  return [...perm.slice(0, at), '--settings', JSON.stringify({ ...posture, ...extra, hooks }), ...perm.slice(at + 2)];
 }

package/bin/lib/claudeSessions.mjs

@@ -24,6 +24,8 @@ import {
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { execFileSync } from 'node:child_process';
+import { parseProcStat } from './procStat.mjs';
+import { CLAUDE_SESSION_RE } from './conversationIds.mjs';
 
 // ENDED sessions are the adoptable inventory, and the useful ones are FRESH:
 // newest per directory, few. (The window itself is the coordinator's.)
@@ -87,7 +89,7 @@ function transcriptTitle(file, mtimeMs) {
  * the tab keeps whatever name it has.
  */
 export function titleForSession(cwd, sessionId) {
-  if (!cwd || typeof sessionId !== 'string' || !/^[A-Za-z0-9_-]{8,64}$/.test(sessionId)) {
+  if (!cwd || typeof sessionId !== 'string' || !CLAUDE_SESSION_RE.test(sessionId)) {
     return null;
   }
   const projects = join(homedir(), '.claude', 'projects');
@@ -137,8 +139,8 @@ export function claudeProjectDir(path) {
  * else, the file stays. `/proc/<pid>` existing only proves A process; the
  * starttime (field 22 of /proc/<pid>/stat) proves it is THAT process. The comm
  * field (parenthesised, may itself contain spaces and parens) makes naive
- * whitespace-splitting wrong, so fields are counted from after the LAST ')':
- * the first post-comm field is field 3, which puts starttime at index 19.
+ * whitespace-splitting wrong, so the line is read by procStat.mjs, the one
+ * parser that knows where `comm` ends.
  */
 function pidAlive(pid, procStart) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -174,10 +176,8 @@ function pidAlive(pid, procStart) {
     return false; // /proc is real and has no entry — the process is gone
   }
   if (procStart == null) return true; // nothing recorded to compare against
-  const close = stat.lastIndexOf(')');
-  if (close === -1) return false;
-  const fields = stat.slice(close + 1).trim().split(/\s+/);
-  return fields[19] === String(procStart);
+  const fields = parseProcStat(stat);
+  return fields !== null && String(fields.starttime) === String(procStart);
 }
 
 /**

package/bin/lib/claudeStream.mjs

@@ -12,16 +12,12 @@
 import { humanizeClaudeTool, THINK_MARKER } from './runtimeEvents.mjs';
 import { turnModelOf } from './turnModel.mjs';
 
-// Turn one Claude tool_use into a compact activity {kind, label}, or null for
-// tools not worth surfacing. `kind:'read'` is what the file counter counts; a
-// Write/Edit of a vault page is the "writing" signal. Used by wiki turns to
-// stream exactly which files Claude is touching (daemon console + app cover).
-//
-// The body moved to runtimeEvents.mjs, beside Codex's equivalent, because they are
-// the same job for two vendors and keeping them apart is how the two activity
-// vocabularies drift. Re-exported under its original name: a dozen call sites
-// know it, and none of them care where it lives.
-export const humanizeToolUse = humanizeClaudeTool;
+// One Claude tool_use becomes a compact activity {kind, label}, or null for
+// tools not worth surfacing, through `humanizeClaudeTool` — in runtimeEvents.mjs,
+// beside Codex's equivalent, because they are the same job for two vendors and
+// keeping them apart is how the two activity vocabularies drift. (Its old
+// alias here, `humanizeToolUse`, claimed a dozen call sites; the stream loop
+// below was the only one, and it calls the real name.)
 
 // Collapse whitespace + clip so a narration/thinking snippet is one tidy feed line.
 const oneLine = (s, n = 160) => String(s).replace(/\s+/g, ' ').trim().slice(0, n);
@@ -97,7 +93,16 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
     emit(a.label + '\n');
     onActivity?.(a);
   };
-  if (ev.type === 'assistant' && Array.isArray(ev.message?.content)) {
+  if (ev.type === 'stream_event') {
+    // Partial messages announce reasoning before the completed assistant
+    // block. Relay only that measured start here: text and tool inputs still
+    // come from the complete blocks below, once, with their full contents.
+    const block = ev.event?.content_block;
+    if (ev.event?.type === 'content_block_start' &&
+        (block?.type === 'thinking' || block?.type === 'redacted_thinking')) {
+      push({ kind: 'think', label: THINK_MARKER });
+    }
+  } else if (ev.type === 'assistant' && Array.isArray(ev.message?.content)) {
     // THE MODEL THAT ANSWERED (2026-09-29, turnModel.mjs) — the fallback for an
     // init that named none. The turn's own messages only: a subagent's carry
     // `parent_tool_use_id`, and its model is not the turn's.
@@ -141,13 +146,21 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
         // the page to read.
         push({ kind: 'say', label: oneLine(b.text), full: b.text });
       } else if (b.type === 'tool_use') {
-        push(humanizeToolUse(b.name, b.input || {}, cwd));
+        push(humanizeClaudeTool(b.name, b.input || {}, cwd));
         // The STRUCTURED form of the same event, for the transcript's tool
         // cards — raw name + input, so the collector can keep what the
         // one-line humanizer drops (an Edit's counts, the plan's items).
-        onToolEvent?.(b.name, b.input || {});
+        onToolEvent?.(b.name, b.input || {}, { id: b.id });
       }
     }
+  } else if (ev.type === 'user' && Array.isArray(ev.message?.content)) {
+    for (const b of ev.message.content) {
+      if (b.type === 'tool_result') onToolEvent?.(null, {}, {
+        id: b.tool_use_id, result: true, isError: b.is_error === true,
+        output: typeof b.content === 'string' ? b.content : Array.isArray(b.content) ? b.content.slice(0, 8).filter(x => x?.type === 'text' && typeof x.text === 'string').map(x => x.text).join('\n') : '',
+        exitCode: ev.tool_use_result?.exit_code ?? ev.tool_use_result?.exitCode,
+      });
+    }
   } else if (ev.type === 'system' && ev.subtype === 'init') {
     // WHAT THIS MACHINE'S CLI CAN BE ASKED FOR BY NAME. The init event is the
     // CLI's OWN answer — it has already resolved personal skills, this repo's
@@ -181,6 +194,7 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
         skills: Array.isArray(ev.skills) ? ev.skills.map(String) : undefined,
         sessionId: typeof ev.session_id === 'string' ? ev.session_id : undefined,
         mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : undefined,
+        tools: Array.isArray(ev.tools) ? ev.tools : undefined,
       });
     }
   } else if (ev.type === 'result') {

package/bin/lib/cliLimit.mjs

@@ -5,7 +5,7 @@
  * which parks on it, and the pre-review, which only skips) and neither owns
  * it: it is a fact about what the CLIs print.
  */
-import { scrub as envScrub } from './uplinkScrub.mjs';
+import { scrubCut } from './uplinkScrub.mjs';
 
 /**
  * DID THE ACCOUNT HIT A LIMIT?
@@ -28,7 +28,7 @@ const LIMIT_PHRASES = [
 export const limitLine = (text) => {
   for (const line of String(text ?? '').split('\n')) {
     const t = line.trim();
-    if (t && LIMIT_PHRASES.some((re) => re.test(t))) return envScrub(t).slice(0, 300);
+    if (t && LIMIT_PHRASES.some((re) => re.test(t))) return scrubCut(t, 300);
   }
   return null;
 };

package/bin/lib/codexHome.mjs

@@ -0,0 +1,17 @@
+/**
+ * WHERE THIS ENVIRONMENT'S CODEX KEEPS ITS FILES (audit 2026-10-10, F126) —
+ * `$CODEX_HOME`, else `~/.codex`, with `~` resolved the way the CLI resolves
+ * it: the environment's own HOME first, the process's home only without one.
+ *
+ * A LEAF: node imports only. The login reader (codexPersonal.mjs), the
+ * rollout reader behind plan limits and "which model ran" (runtimeLimits.mjs),
+ * the offerings readout (runtimeOfferings.mjs) and an agent's isolated home
+ * (projectToolRuntimes.mjs) each spelled this rule, one of them differently;
+ * every one of them is a relay that must look where the CLI wrote.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export function codexHome(env = process.env) {
+  return env.CODEX_HOME || join(env.HOME || homedir(), '.codex');
+}

package/bin/lib/codexPersonal.mjs

@@ -55,9 +55,9 @@
  * config read "Not logged in").
  */
 import { readFileSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { toml } from './projectToolRuntimes.mjs';
+import { codexHome } from './codexHome.mjs';
 
 /** Where the login lives and which endpoint it signs into — top-level keys,
  *  each confirmed in codex-cli 0.156.1 (`preferred_auth_method` is not one:
@@ -365,8 +365,7 @@ export function parseCodexToml(text) {
  * not a document this reader can read whole.
  */
 export function readPersonalCodexConfig(env = process.env) {
-  const home = env.CODEX_HOME || join(env.HOME || homedir(), '.codex');
-  const path = join(home, 'config.toml');
+  const path = join(codexHome(env), 'config.toml');
   try {
     if (statSync(path).size > CONFIG_MAX_BYTES) return null;
     return parseCodexToml(readFileSync(path, 'utf8'));
@@ -461,6 +460,48 @@ export function codexPersonalCarry(config, { model = null, effort = null, env: t
   return { args, env };
 }
 
+/**
+ * THE PERSON'S CODEX PROVIDER SECRETS, FOR THE UPLINK SCRUBBER ONLY
+ * (2026-10-10, the audit's F073) — `[{ name, value }]`, never a report.
+ *
+ * The header above says why the turn's own model can read these (`env` lists
+ * the carried literals; the read-only sandbox reads config.toml), and nothing
+ * taught the scrubber any of them, so a turn that printed one relayed it to
+ * every member of the project. The SELECTED provider's
+ * `experimental_bearer_token` and literal `http_headers` values, named as the
+ * carry names them (`CODEX_BEARER_ENV`, `CODEX_HEADER_ENV_PREFIX` + n), plus
+ * the present values of the variables its `env_key` and `env_http_headers`
+ * name, under those names. Whatever the posture: a build turn's Codex reads
+ * the same file. An unreadable or provider-less config gives `[]`, which the
+ * scrubber treats as "nothing new", never as "forget".
+ */
+export function codexSecretsOf(config, env = {}) {
+  const out = [];
+  if (!isTable(config)) return out;
+  const id = config.model_provider;
+  const table = isString(id) && id && isTable(config.model_providers) ? config.model_providers[id] : undefined;
+  if (!isTable(table)) return out;
+  if (nonEmpty(table.experimental_bearer_token)) {
+    out.push({ name: CODEX_BEARER_ENV, value: table.experimental_bearer_token });
+  }
+  if (isTable(table.http_headers)) {
+    let n = 0;
+    for (const literal of Object.values(table.http_headers)) {
+      if (nonEmpty(literal)) out.push({ name: `${CODEX_HEADER_ENV_PREFIX}${n++}`, value: literal });
+    }
+  }
+  const named = [table.env_key, ...(isTable(table.env_http_headers) ? Object.values(table.env_http_headers) : [])];
+  for (const name of named) {
+    if (nonEmpty(name) && nonEmpty(env[name])) out.push({ name, value: env[name] });
+  }
+  return out;
+}
+
+/** `codexSecretsOf` over the config this process's Codex would read. */
+export function readPersonalCodexSecrets(env = process.env) {
+  return codexSecretsOf(readPersonalCodexConfig(env), env);
+}
+
 /** The carry for one turn: the config its Codex would read, reduced. */
 export function codexPersonalTurn({ env = process.env, model = null, effort = null } = {}) {
   return codexPersonalCarry(readPersonalCodexConfig(env), { model, effort, env });