flowviant 0.117.0 → 0.124.0

package/bin/lib/projectToolRuntimes.mjs

@@ -15,9 +15,10 @@
  * projectTools.mjs. projectTools.test.mjs pins every transport word to here.
  */
 
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { codexHome } from './codexHome.mjs';
+import { parseCodexToml, TomlRaw } from './codexPersonal.mjs';
 
 export const toml = (value) => JSON.stringify(String(value));
 
@@ -182,9 +183,14 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
   try { if (!lstatSync(dest).isDirectory()) rmSync(dest, { force: true }); } catch { /* absent */ }
   mkdirSync(dest, { recursive: true, mode: 0o700 });
   chmodSync(dest, 0o700);
-  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml') : [];
+  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml' && name !== 'generated_images') : [];
   for (const name of personal) linkPersonalEntry(join(source, name), join(dest, name));
-  const linked = new Set(personal);
+  // Native supporting images belong to this agent, not the person's shared
+  // image directory. Repair homes created before this distinction.
+  const generated = join(dest, 'generated_images');
+  try { if (lstatSync(generated).isSymbolicLink()) rmSync(generated); } catch { /* absent */ }
+  mkdirSync(generated, { recursive: true, mode: 0o700 });
+  const linked = new Set([...personal, 'generated_images']);
   for (const name of readdirSync(dest)) {
     if (linked.has(name) || name === 'config.toml') continue;
     // Only a LINK is ours to drop: a real entry under a name the person has
@@ -205,6 +211,212 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
   return { path: dest, personalDeveloperInstructions };
 }
 
+/** The environment names a fenced Codex turn's MCP header values ride under,
+ *  one per header (`codexFencedMount`). */
+export const MCP_HEADER_ENV_PREFIX = 'FLOWVIANT_MCP_HEADER_';
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SERVER_NAME = /^[A-Za-z0-9_-]{1,80}$/;
+const expands = (value) => /\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(String(value));
+/**
+ * Names this machine's Codex, or the shell and tools under it, read for
+ * themselves. A server's env value rides in the CLI's own environment
+ * (`env_vars` forwards it), so a name the machine does not already set to that
+ * value would change how the CLI itself runs — a proxy, a CA bundle, a
+ * provider key. Such a server is left unmounted, in words.
+ */
+const CLI_ENV =
+  /^(PATH|HOME|SHELL|USER|LOGNAME|PWD|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|DISPLAY|WAYLAND_DISPLAY|BROWSER|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|RUST_LOG|RUST_BACKTRACE|HTTPS?_PROXY|ALL_PROXY|NO_PROXY|https?_proxy|all_proxy|no_proxy)$|^(LC|XDG|LD|DYLD|OPENAI|CODEX|AZURE_OPENAI|FLOWVIANT)_/;
+
+/** This machine's own Codex servers: its config.toml's `[mcp_servers.*]`,
+ *  read the way codexPersonal.mjs reads the login (bounded; a file that does
+ *  not parse carries nothing). */
+function machineCodexServers(machineEnv) {
+  try {
+    const path = join(resolve(codexHome(machineEnv)), 'config.toml');
+    const st = statSync(path);
+    if (!st.isFile() || st.size > 1024 * 1024) return [];
+    const servers = parseCodexToml(readFileSync(path, 'utf8'))?.mcp_servers;
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return [];
+    return Object.entries(servers).filter(([, v]) => v && typeof v === 'object' && !Array.isArray(v));
+  } catch {
+    return [];
+  }
+}
+const tomlScalar = (v) => (v instanceof TomlRaw ? v.text : typeof v === 'number' && Number.isFinite(v) ? String(v) : null);
+const words = (v) => (Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : null);
+const table = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+
+/**
+ * THE MCP SERVERS ON A FENCED CODEX TURN — the project's and, since 2026-10-11,
+ * the machine's own (the owner: "the server that is running flowviant's claude
+ * HAS these MCPs yet the agents are not using them"). A Codex build reads both
+ * from the agent's config.toml (`isolatedCodexHome`: the person's own tables
+ * kept, the repo's beside them). Every fenced posture — write-up, mockup,
+ * 3D model, deck, image — passes `--ignore-user-config`, which drops that
+ * file, and a `-p` profile layered beside the flag was measured to load no
+ * server either (codex-cli 0.159.2, artifactProjectMcp.test.mjs). So these
+ * turns take the servers as `-c` pairs, the way codexPersonal.mjs carries a
+ * login back, under the same rule: A LITERAL SECRET NEVER RIDES ARGV.
+ *
+ *  · A stdio server's command and arguments ride as written: they are the
+ *    server process's own command line once Codex starts it, so `-c` adds no
+ *    reader. A project server whose command or arguments expand a `${VAR}`
+ *    is still left unmounted (the 2026-10-10 audit took expanded values off
+ *    argv, and this keeps that line).
+ *  · Every env value rides in the turn's ENVIRONMENT under its own name,
+ *    forwarded by Codex's `env_vars` — except a project value with no `${VAR}`,
+ *    which is text of the reviewed file and rides as written. Refused (the
+ *    server is left unmounted, with the reason) when the name is the
+ *    daemon's own (`FLOWVIANT_*`, `CODEX_HOME`), when this machine already
+ *    sets it to something else, or when it is one the CLI reads itself
+ *    (`CLI_ENV`) and the machine does not set it.
+ *  · Every header value rides in the environment, named by
+ *    `env_http_headers`. A machine server's own `env_http_headers`,
+ *    `bearer_token_env_var` and `env_vars` are names, and ride as written.
+ *  · A URL that expands a `${VAR}`, or carries a query, fragment or
+ *    credentials, has no indirection in Codex's config: left unmounted.
+ *  · A machine server keeps its own `cwd`, timeouts and tool lists; it is
+ *    skipped where the person turned it off (`enabled = false`), and a
+ *    project server of the same name replaces it, as on the build.
+ *  · Each mounted server's tools are approved by name: an unannotated tool
+ *    under a fenced posture failed "MCP tool call requires approval, but
+ *    approval policy is never" (measured, 0.159.2) — never a blanket
+ *    approval policy.
+ *
+ * `usable` is the base snapshot's ready entries; `expand` reads a value the
+ * way projectTools.mjs does; `machineEnv` is the caller's own (what the child
+ * would inherit). Returns `{ args, env, mounted, machine, unmounted }`:
+ * `mounted` the project servers, `machine` the machine's own, and
+ * `unmounted` `[{ name, reason, source: 'project' | 'machine' }]`.
+ */
+function codexFencedMount(usable, expand, machineEnv) {
+  const args = [];
+  const childEnv = {};
+  const mounted = [];
+  const machine = [];
+  const unmounted = [];
+  let header = 0;
+  /** A refusal sentence, or null with the value staged in `extra`. */
+  const forward = (key, value, extra) => {
+    if (key.startsWith('FLOWVIANT_') || key === 'CODEX_HOME') return `its env ${key} is a name this daemon keeps for itself`;
+    const has = machineEnv[key];
+    if (has !== undefined) return has === value ? null : `its env ${key} would replace this machine's own ${key}, which a fenced Codex turn cannot do`;
+    if (CLI_ENV.test(key)) return `its env ${key} is one this machine's Codex reads itself, which a fenced Codex turn cannot set`;
+    const staged = childEnv[key] ?? extra[key];
+    if (staged !== undefined && staged !== value) return `its env ${key} would replace another server's ${key}`;
+    extra[key] = value;
+    return null;
+  };
+  const headerEnv = (headers, extra) =>
+    Object.entries(headers).map(([key, value]) => {
+      const envName = `${MCP_HEADER_ENV_PREFIX}${header++}`;
+      extra[envName] = value;
+      return `${toml(key)}=${toml(envName)}`;
+    });
+  const accept = (name, pairs, extra, list) => {
+    args.push(...pairs, '-c', `mcp_servers.${name}.default_tools_approval_mode="approve"`);
+    Object.assign(childEnv, extra);
+    list.push(name);
+  };
+
+  for (const { name, config } of usable) {
+    const pairs = [];
+    const extra = {};
+    let refused = null;
+    if (typeof config.command === 'string') {
+      const rawArgs = Array.isArray(config.args) ? config.args : [];
+      if (expands(config.command) || rawArgs.some(expands)) {
+        refused = 'its command or arguments name a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(String(config.command))}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map((v) => toml(String(v))).join(',')}]`);
+        const forwarded = [];
+        for (const [key, value] of Object.entries(config.env ?? {})) {
+          if (!ENV_NAME.test(key)) continue;
+          if (!expands(value)) {
+            pairs.push('-c', `mcp_servers.${name}.env.${key}=${toml(String(value))}`);
+            continue;
+          }
+          refused = forward(key, expand(value), extra);
+          if (refused) break;
+          forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+      }
+    } else if (typeof config.url === 'string') {
+      if (expands(config.url)) {
+        refused = 'its URL names a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(String(config.url))}`);
+        const named = headerEnv(Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v)])), extra);
+        if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+      }
+    } else continue;
+    if (refused) unmounted.push({ name, reason: refused, source: 'project' });
+    else accept(name, pairs, extra, mounted);
+  }
+
+  const projectNames = new Set(usable.map((t) => t.name));
+  for (const [name, server] of machineCodexServers(machineEnv)) {
+    if (projectNames.has(name) || name === 'flowviant' || server.enabled === false) continue;
+    if (typeof server.command !== 'string' && typeof server.url !== 'string') continue;
+    const pairs = [];
+    const extra = {};
+    let refused = SERVER_NAME.test(name) ? null : 'its name cannot be spelled as a command-line setting';
+    if (!refused && typeof server.command === 'string') {
+      const rawArgs = server.args === undefined ? [] : words(server.args);
+      if (!rawArgs) refused = 'its args are not a list of words';
+      else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(server.command)}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map(toml).join(',')}]`);
+        const forwarded = [...(words(server.env_vars) ?? []).filter((k) => ENV_NAME.test(k))];
+        for (const [key, value] of Object.entries(table(server.env))) {
+          if (!ENV_NAME.test(key) || typeof value !== 'string') {
+            refused = `its env ${String(key).slice(0, 40)} is not a name and text`;
+            break;
+          }
+          refused = forward(key, value, extra);
+          if (refused) break;
+          if (!forwarded.includes(key)) forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+        if (typeof server.cwd === 'string') pairs.push('-c', `mcp_servers.${name}.cwd=${toml(server.cwd)}`);
+      }
+    } else if (!refused) {
+      let url = null;
+      try { url = new URL(server.url); } catch { /* refused below */ }
+      if (!url || url.search || url.hash || url.username || url.password) {
+        refused = 'its URL carries a query, fragment or credentials, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(server.url)}`);
+        if (typeof server.bearer_token_env_var === 'string' && ENV_NAME.test(server.bearer_token_env_var))
+          pairs.push('-c', `mcp_servers.${name}.bearer_token_env_var=${toml(server.bearer_token_env_var)}`);
+        const literal = table(server.http_headers);
+        const byName = table(server.env_http_headers);
+        if (Object.values(literal).some((v) => typeof v !== 'string') || Object.values(byName).some((v) => typeof v !== 'string' || !ENV_NAME.test(v))) {
+          refused = 'its headers are not text';
+        } else {
+          const named = [...headerEnv(literal, extra), ...Object.entries(byName).map(([key, envName]) => `${toml(key)}=${toml(envName)}`)];
+          if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+        }
+      }
+    }
+    if (!refused) {
+      for (const key of ['startup_timeout_sec', 'startup_timeout_ms', 'tool_timeout_sec']) {
+        const v = tomlScalar(server[key]);
+        if (v != null && /^[0-9_.]+$/.test(v)) pairs.push('-c', `mcp_servers.${name}.${key}=${v}`);
+      }
+      for (const key of ['enabled_tools', 'disabled_tools']) {
+        const list = words(server[key]);
+        if (list) pairs.push('-c', `mcp_servers.${name}.${key}=[${list.map(toml).join(',')}]`);
+      }
+    }
+    if (refused) unmounted.push({ name, reason: refused, source: 'machine' });
+    else accept(name, pairs, extra, machine);
+  }
+  return { args, env: childEnv, mounted, machine, unmounted };
+}
+
 /** Claude takes the base branch's skills as a plugin written for this turn. */
 function reviewedClaudePlugin(dir, snapshot) {
   if (!snapshot.skillFiles.length) return null;
@@ -245,6 +457,8 @@ const TOOL_RUNTIMES = {
       const isolated = isolatedCodexHome(turn?.codexHome ?? join(dir, 'codex-home'), env, worktree, turn?.mcpServers);
       return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions };
     },
+    // A fenced posture ignores that home's config.toml (2026-10-10).
+    fencedMount: codexFencedMount,
   },
   antigravity: { mcp: false, skills: false },
 };
@@ -253,6 +467,16 @@ const TOOL_RUNTIMES = {
 const takesNothing = { mcp: false, skills: false };
 const rowFor = (runner) => (Object.hasOwn(TOOL_RUNTIMES, runner) ? TOOL_RUNTIMES[runner] : takesNothing);
 
+/** The servers as a fenced posture takes them where it ignores the runner's
+ *  own file — Codex's `-c` pairs and environment (`codexFencedMount`) — or
+ *  null for a runner whose fenced turns read the same file as its build
+ *  (Claude's strict mcp.json) or that takes none. `usable` is the base
+ *  snapshot's ready entries; `expand(value)` reads a `${VAR}`. */
+export function fencedMountFor(runner, usable, expand, machineEnv = process.env) {
+  const mount = rowFor(runner).fencedMount;
+  return mount ? mount(usable, expand, machineEnv) : null;
+}
+
 /** Pure mapping used before a future tool-attach gesture is offered. */
 export function runnerToolCapabilities(runner) {
   const { mcp, skills } = rowFor(runner);

package/bin/lib/projectTools.mjs

@@ -1,10 +1,10 @@
 /** Repo-owned tool configuration, read from the base ref for every agent turn. */
-import { accessSync, constants, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { delimiter, isAbsolute, join } from 'node:path';
+import { accessSync, constants, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { git, gitRaw, splitNul } from './git.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
-import { mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
+import { fencedMountFor, mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
 
 const MAX_TOOLS = 40;
 const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
@@ -124,6 +124,7 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
 
 const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
 
+
 /**
  * Temporary per-turn files are removed after the last retry. No personal CLI config is written.
  *
@@ -135,12 +136,19 @@ const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]
  *
  * NO EXPANDED VALUE RIDES ARGV (2026-10-10, the audit): Claude's servers go
  * to this turn's 0600 mcp.json, Codex's into the isolated home's config.toml
- * (projectToolRuntimes.mjs) — never `-c` pairs on the command line.
+ * (projectToolRuntimes.mjs) — never `-c` pairs on the command line. A fenced
+ * Codex turn, which ignores that file, takes `fencedMount` instead: the
+ * repo's own words as `-c` pairs and every expanded value in its environment.
  */
 export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
   const env = expansionEnv(callerEnv);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
+  // What the base lists and this turn cannot mount, and why — the turn is told
+  // (postureTools.mjs), so a missing server is a named fact, never a guess.
+  const mcpUnmounted = snapshot.tools
+    .filter((t) => !usable.includes(t))
+    .map((t) => ({ name: t.name, reason: String(mcpRefusal(runner, t.config) ?? t.reason ?? 'not mounted').slice(0, 200) }));
   const mcpServers = {};
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
@@ -177,6 +185,12 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   const { pluginDir, codexHome, personalDeveloperInstructions } = prepared;
   return {
     mcpPath,
+    /** The names of the servers mounted, as Claude's allow rules need them. */
+    mcpServers: Object.keys(mcpServers),
+    mcpUnmounted,
+    /** The mount a fenced turn takes where the runner's file is ignored
+     *  (`fencedMountFor`, projectToolRuntimes.mjs); null where it has none. */
+    fencedMount: fencedMountFor(runner, usable, (value) => expand(value, env), callerEnv),
     instructions,
     pluginDir,
     codexHome,
@@ -197,3 +211,46 @@ export function toolReadout(snapshot, runner) {
   }));
   return [...mcp, ...instructions].slice(0, MAX_REPORT_TOOLS);
 }
+
+const MCP_JSON_MAX_BYTES = 1024 * 1024;
+const MCP_JSON_MAX_NAMES = 500;
+/**
+ * EVERY SERVER NAMED IN A `.mcp.json` FROM `dir` UP TO `/` (2026-10-11). An
+ * agent turn that mounts the machine's MCP servers is not strict, and Claude
+ * Code then reads `.mcp.json` in its cwd and every parent wherever a settings
+ * scope approves one (measured, 2.1.290). The base branch's copy is the
+ * project's only `.mcp.json` input to an agent, so each of these names is
+ * disabled for the turn (claudePosture.mjs `withMachineMcp`): the agent's edit
+ * of its worktree's file mounts only after review lands it on base. A server
+ * the machine should have everywhere belongs in its CLI's user scope.
+ *
+ * NULL when the answer cannot be bounded — a `.mcp.json` over 1 MiB, or more
+ * than 500 names — and the lane then mounts strictly (the base copy alone)
+ * rather than leave one discovered. A file that does not parse names nothing:
+ * the CLI cannot read it either.
+ */
+export function mcpJsonServerNamesAbove(dir) {
+  const names = new Set();
+  let at = resolve(dir);
+  for (;;) {
+    const file = join(at, '.mcp.json');
+    let raw = null;
+    try {
+      const st = statSync(file);
+      if (st.isFile()) {
+        if (st.size > MCP_JSON_MAX_BYTES) return null;
+        raw = readFileSync(file, 'utf8');
+      }
+    } catch { /* none here */ }
+    if (raw != null) {
+      try {
+        const servers = JSON.parse(raw)?.mcpServers;
+        if (servers && typeof servers === 'object' && !Array.isArray(servers)) for (const name of Object.keys(servers)) names.add(name);
+      } catch { /* the CLI cannot parse it either */ }
+    }
+    if (names.size > MCP_JSON_MAX_NAMES) return null;
+    const up = dirname(at);
+    if (up === at) return [...names];
+    at = up;
+  }
+}