flowviant 0.117.0 → 0.124.1

package/bin/lib/runtimeCapabilities.mjs

@@ -141,9 +141,54 @@ export function normalizeMcpReport(entries, { charset = null } = {}) {
     .slice(0, MAX_MCP_SERVERS);
 }
 
-export function recordMcpServers(list) {
+/**
+ * EVERY SERVER CLAUDE CODE REPORTED, CONNECTED ONES INCLUDED, WITH ITS SOURCE
+ * AND — WHEN CONNECTED — ITS TOOLS' NAMES (2026-10-13, the owner: name every
+ * MCP server and capability each CLI gives the project). Learned off the same
+ * init as the list above, under the same harvest rule; it leaves the box only
+ * on this box's own `tools-report` (mcpInventory.mjs), never on the poll, and
+ * carries names, statuses and sources alone. The header's "only what is not
+ * connected leaves the box" still holds for the poll's `mcp`, which an older
+ * app reads.
+ *
+ * `scope` is the CLI's own word (measured on Claude Code 2.1.296's scope list:
+ * local, user, project, dynamic, enterprise, claudeai, managed, agent);
+ * mcpInventory.mjs maps it to a source. Tool names come from the init's
+ * `tools`, where a server's tools are `mcp__<server>__<tool>` and the server
+ * part is its name with every character outside `[A-Za-z0-9_-]` made `_`
+ * (`claude.ai Gmail` → `claude_ai_Gmail`, measured 2026-10-11).
+ */
+let mcpInventoryCache = null;
+const MAX_INVENTORY_SERVERS = 80;
+const mcpToolPrefix = (name) => `mcp__${name.replace(/[^A-Za-z0-9_-]/g, '_')}__`;
+
+/** The init's servers and tools → `[{ name, status, scope, tools }]`. */
+export function claudeMcpInventoryOf(list, tools) {
+  const names = Array.isArray(tools) ? tools.filter((t) => typeof t === 'string' && t.startsWith('mcp__')) : [];
+  const seen = new Map();
+  for (const e of list) {
+    if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
+    const name = e.name.trim().slice(0, MCP_NAME_MAX).trim();
+    if (!name || name === 'flowviant' || seen.has(name)) continue;
+    const status = MCP_STATUSES.has(e.status) ? e.status : 'other';
+    seen.set(name, { name, status, scope: typeof e.scope === 'string' ? e.scope : typeof e.source === 'string' ? e.source : null, prefix: mcpToolPrefix(e.name.trim()), tools: status === 'connected' ? [] : null });
+  }
+  // The longest prefix wins, so `a_b` never claims `a`'s tools or the reverse.
+  const byPrefix = [...seen.values()].sort((a, b) => b.prefix.length - a.prefix.length);
+  for (const tool of names) {
+    const owner = byPrefix.find((s) => tool.startsWith(s.prefix));
+    if (owner?.tools) owner.tools.push(tool.slice(owner.prefix.length));
+  }
+  return [...seen.values()]
+    .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+    .slice(0, MAX_INVENTORY_SERVERS)
+    .map(({ prefix, ...server }) => server);
+}
+
+export function recordMcpServers(list, tools) {
   if (!Array.isArray(list)) return;
   mcpServersCache = normalizeMcpReport(list);
+  mcpInventoryCache = claudeMcpInventoryOf(list, tools);
 }
 
 /** What to send on the roster poll as `mcp` — null until a turn has taught us. */
@@ -151,6 +196,12 @@ export function knownMcpServers() {
   return mcpServersCache;
 }
 
+/** Claude Code's whole server list for the box's inventory — null until a
+ *  turn (or the probe) has taught us. */
+export function knownClaudeMcpInventory() {
+  return mcpInventoryCache;
+}
+
 /**
  * WHICH TURNS ARE A MEASUREMENT OF THE MACHINE (2026-10-10, the audit) —
  * asked by runTurn.mjs, the one spawn point, of the argv the adapter built.
@@ -339,6 +390,8 @@ export function parseInitLine(line) {
     skills: Array.isArray(ev.skills) ? ev.skills : null,
     // The CLI's mounted MCP servers (0.97.0) — `recordMcpServers` normalises.
     mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : null,
+    // Its tool names, for the inventory's per-server lists (2026-10-13).
+    tools: Array.isArray(ev.tools) ? ev.tools : null,
     sessionId: typeof ev.session_id === 'string' ? ev.session_id : null,
   };
 }
@@ -377,17 +430,36 @@ export const SKILL_PROBE_ARGS = Object.freeze([
 export function probeSkillsOnce(cwd, { spawn: spawnChild = spawn } = {}) {
   if (skillProbeStarted || skillsCache !== null) return;
   skillProbeStarted = true;
+  runInitProbe(cwd, [], spawnChild);
+}
+
+/**
+ * LOOK AGAIN, NOW, WITH THE BASE BRANCH'S SERVERS MOUNTED (2026-10-13) — the
+ * re-check after a confirmed MCP install (mcpInstall.mjs). The same cheap
+ * probe, same rules (hooks off, unattended, its group killed), with the base
+ * copy added through `--mcp-config` so Claude Code says whether each project
+ * server now starts; that is what clears a machine's checklist on the Machines
+ * page. A person pressed Install for this, so it is not the once-per-process
+ * probe: it runs every time it is asked, which is once per finished install.
+ * Resolves when the probe has finished (or given up).
+ */
+export function probeMcpNow(cwd, mcpConfigPath, { spawn: spawnChild = spawn } = {}) {
+  return new Promise((resolve) => runInitProbe(cwd, mcpConfigPath ? ['--mcp-config', mcpConfigPath] : [], spawnChild, resolve));
+}
+
+function runInitProbe(cwd, extraArgs, spawnChild, done = () => {}) {
   let child;
   try {
     // Claude Code specifically, not the `wiki` profile's runtime pick: `skills`
     // is Claude Code's own field and the `/` tray only renders for claude tabs.
-    child = spawnChild(RUNTIMES.claude.bin, [...SKILL_PROBE_ARGS], {
+    child = spawnChild(RUNTIMES.claude.bin, [...SKILL_PROBE_ARGS, ...extraArgs], {
       cwd,
       stdio: ['ignore', 'pipe', 'ignore'],
       detached: true,
       env: unattendedEnv(),
     });
   } catch {
+    done();
     return; // no claude on PATH — the machine simply stays unmeasured
   }
   let buf = '';
@@ -411,6 +483,7 @@ export function probeSkillsOnce(cwd, { spawn: spawnChild = spawn } = {}) {
     // AFTER the kill, and on a delay: the transcript is the CHILD's file, so
     // deleting it while the child still lives races a recreate.
     removeTranscriptSoon(cwd, sessionId);
+    done();
   };
   const timer = setTimeout(() => finish(null), SKILL_PROBE_TIMEOUT_MS);
   timer.unref?.();
@@ -436,7 +509,7 @@ export function probeSkillsOnce(cwd, { spawn: spawnChild = spawn } = {}) {
       const init = parseInitLine(line);
       if (!init) continue;
       if (init.skills) recordSkills(init.skills);
-      if (init.mcpServers) recordMcpServers(init.mcpServers);
+      if (init.mcpServers) recordMcpServers(init.mcpServers, init.tools);
       finish(init.sessionId);
       return;
     }
@@ -450,5 +523,6 @@ export function probeSkillsOnce(cwd, { spawn: spawnChild = spawn } = {}) {
 export function resetCapabilitiesForTest() {
   skillsCache = null;
   mcpServersCache = null;
+  mcpInventoryCache = null;
   skillProbeStarted = false;
 }

package/bin/lib/runtimeClaude.mjs

@@ -15,6 +15,11 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
 import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings } from './claudePersonal.mjs';
+import { withMachineMcp } from './claudePosture.mjs';
+
+/** The profiles an agent lane mounts the machine's MCP servers on (2026-10-11):
+ *  the ones whose turn profile says `projectMcp` and that Claude declares. */
+const MACHINE_MCP_PROFILES = Object.freeze(['build', 'design', 'research']);
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -53,8 +58,10 @@ export const CLAUDE_RUNTIME = {
    * contract was written, not a claim that only Claude could ever satisfy it.
    */
   // `design` and `research` (0.97.0): each is an `--allowedTools` list with a
-  // PATH-SCOPED write (claudePosture.mjs). `research` is Codex's too since
-  // 0.117.0, over an isolated copy (codexResearch.mjs);
+  // PATH-SCOPED write (claudePosture.mjs); an agent's turn mounts the
+  // project's base MCP servers (2026-10-10) and this machine's own
+  // (2026-10-11). `research` is Codex's too since 0.117.0,
+  // over an isolated copy (codexResearch.mjs);
   // `design` is Codex's too since 0.115.0 (2026-09-29), whose permission
   // profile was measured to write only the artifacts directory
   // (runtimeCodex.mjs `codexDesignFence`). agy's flags cannot express "write
@@ -94,7 +101,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, streamInput = false }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -131,7 +138,9 @@ export const CLAUDE_RUNTIME = {
     if (adoptResumeId) a.push('--resume', adoptResumeId, '--fork-session');
     else if (resumeThreadId) a.push('--resume', resumeThreadId);
     else if (resume) a.push('--continue');
-    a.push('-p', prompt, '--append-system-prompt', system);
+    if (streamInput) a.push('-p', '--input-format', 'stream-json', '--replay-user-messages');
+    else a.push('-p', prompt);
+    a.push('--append-system-prompt', system);
     /**
      * WHOSE SETTINGS A TURN READS (2026-09-29, claudePersonal.mjs).
      *
@@ -174,20 +183,31 @@ export const CLAUDE_RUNTIME = {
       a.push('--system-prompt-snapshot', 'off');
       if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     }
-    // These fenced postures have no project MCP, even if Claude discovers a
-    // .mcp.json in the agent's worktree. Build gets its reviewed base config
-    // explicitly from the caller; the plan profile keeps its own principal.
-    if (['consult', 'wiki', 'design', 'research'].includes(profile)) a.push('--strict-mcp-config');
+    // WHICH MCP SERVERS A TURN MOUNTS. An agent's code, write-up and
+    // mockup/3D-model/deck turns (2026-10-11, the owner) mount this machine's
+    // own — its user and local servers and the account's claude.ai connectors —
+    // beside the base branch's `.mcp.json` copy the caller passes, so they are
+    // not strict; `machineMcp` names every `.mcp.json` server from the
+    // worktree up, which `withMachineMcp` disables so a worktree edit never
+    // mounts before review (claudePosture.mjs). Every other fenced posture —
+    // consult, wiki, and a design/research turn no lane mounted for — stays
+    // strict: it never discovers a .mcp.json, nor loads the machine's servers.
+    // The plan profile keeps its own principal.
+    const machine = Array.isArray(machineMcp) && MACHINE_MCP_PROFILES.includes(profile);
+    if (['consult', 'wiki', 'design', 'research'].includes(profile) && !machine && !mcp.includes('--strict-mcp-config')) a.push('--strict-mcp-config');
     a.push(...mcp, ...resultSchemaArgs);
     a.push('--model', model || MODEL);
     if (effort) a.push('--effort', effort);
     // ALWAYS THE EVENT STREAM (2026-10-10): runTurn reads every turn line by
     // line — the activity, the init's skills and servers, the result.
-    a.push('--output-format', 'stream-json', '--verbose');
+    // A completed thinking block can arrive minutes after reasoning began.
+    // Ask for its start too, so both live surfaces can relay that fact.
+    a.push('--output-format', 'stream-json', '--verbose', '--include-partial-messages');
     // The knowledge library (0.94.0) sits in the checkout, outside a
     // worktree's cwd: named as a readable directory so a curated profile
     // does not refuse the path the prompt just handed it. Before `perm`,
     // because `--allowedTools` is variadic and would swallow the flag.
+    if (profile === 'build') for (const dir of writableDirs) a.push('--add-dir', dir);
     if (knowledgeDir) a.push('--add-dir', knowledgeDir);
     // THE VAULT, likewise (2026-10-10): it lives under ~/.flowviant/vaults,
     // outside the wiki worktree, and its `mkdir`/`rm` are path-validated to the
@@ -199,7 +219,8 @@ export const CLAUDE_RUNTIME = {
     // kept is written to a private file, never onto argv (claudePersonal.mjs)
     // — so this is the LAST thing built: nothing after it may throw and
     // leave the file with no turn to release it.
-    a.push(...(fenced ? withPersonalSettings(perm, personalSettings ?? personalClaudeSettings()) : perm));
+    const postured = machine ? withMachineMcp(perm, machineMcp) : perm;
+    a.push(...(fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured));
     return a;
   },
   /** What `args` wrote for a turn — the fenced posture's settings file —

package/bin/lib/runtimeCodex.mjs

@@ -15,6 +15,7 @@ import { parseCodexLine } from './runtimeEvents.mjs';
 import { ARTIFACT_DIR, FENCE_TMP_DIR } from './artifacts.mjs';
 import { codexPersonalTurn } from './codexPersonal.mjs';
 import { researchFence } from './codexResearch.mjs';
+import { projectReadBoundary, projectReadFence } from './codexProjectRead.mjs';
 
 /**
  * FLOWVIANT'S OWN TOOLS NEED NO APPROVAL FROM A CHAT NOBODY CAN ANSWER
@@ -90,21 +91,14 @@ export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '
 export const HERMETIC = Object.freeze(['--ignore-user-config', '--ignore-rules']);
 
 /**
- * THE TAIL EVERY FENCED POSTURE ENDS IN (2026-10-10, the audit), built once so
- * no fence can drift from it: no web unless the posture IS the write-up
- * card's (`web: true`, 0.117.0), no sub-agents, no browser, desktop or apps,
- * image generation off unless the posture IS the image card's, and nobody's
- * config or rules. It was hand-copied into five branches, and the
- * wiki's copy had already lost the web and sub-agent closures.
- *
- * Image generation ships ON in codex-cli 0.156.1 even under
- * --ignore-user-config (measured 2026-09-29): a turn that asked for no picture
- * is handed no tool that spends image credits, and the one that did must not
- * depend on the person's config to have it.
+ * Every fenced posture keeps config isolation, desktop/app closure and the
+ * delegation policy. Artifact postures explicitly enable native images as a
+ * supporting capability; consult, plan and wiki keep them off. Native web
+ * needs the isolated research read fence because broad-read tools can read
+ * host credentials. Feature flags do not prove account/model entitlement.
  */
 export const fencedTail = ({ imageGeneration = false, web = false } = {}) => [
-  // The web stays on for one posture alone, the write-up card's, whose fence
-  // reads only a copied view (CODEX_FENCES `research`).
+  // Native web is paired with the copied, root-denied read fence.
   ...(web ? [] : NO_WEB),
   ...NO_SUBAGENTS,
   ...NO_REACH_OUT,
@@ -135,33 +129,8 @@ export const CODEX_FENCED = Object.freeze({
 export const codexIgnoresUserConfig = ({ profile = 'build', vaultDir } = {}) =>
   Object.hasOwn(CODEX_FENCED, profile) && CODEX_FENCED[profile]({ vaultDir });
 
-/**
- * READ-ONLY, KERNEL-ENFORCED — the consult's and the plan's filesystem.
- *
- * Claude gets a VERB allowlist: Read, Grep, Glob and a handful of read-only
- * Bash forms. Codex has no such thing — it has no file-read tool at all, so
- * reading the repo IS command execution (`cat`, `rg`). Removing the shell
- * leaves the model with exactly ["update_plan","request_user_input"], which
- * cannot answer a question about a codebase. You get both capabilities or
- * neither.
- *
- * So the promise is kept one layer down instead. `read-only` is
- * kernel-enforced (bubblewrap + seccomp on Linux): writes fail, and a
- * direct-IP connect fails with "Operation not permitted" — socket() is
- * denied, not merely DNS. An injected command still RUNS, and cannot write
- * or send anything itself.
- *
- * THE WAY OUT IS THE ANSWER. What such a turn reads can leave the box in
- * the words it hands back — a consult's reply, a plan's proposal, and
- * intake's drafted brief, which lands on the board with no press — and this
- * profile READS the whole box (see `codexArtifactFence`'s STATED note). Those
- * words are scrubbed on the way up (uplinkScrub.mjs) — of the machine's known
- * secret values and the token shapes that scrub knows, and of nothing else; it
- * is that scrub, not this sandbox, that stands between a read secret and the
- * board.
- */
-const READ_ONLY_SANDBOX = ['-c', 'sandbox_mode="read-only"'];
-
+/** Consult/capture use root-denied tool reads over the actual project,
+ * knowledge and Git metadata. Scrubbing remains supplemental. */
 /**
  * THE CARTOGRAPHER: read the repo, write ONLY the vault. Codex's permission
  * profiles take a per-path filesystem map, so the rule is enforced by the
@@ -264,7 +233,7 @@ export const CODEX_RUNTIME = {
    * placed before it. Appending them after the positional is the kind of argv
    * that parses today and stops parsing on some future clap upgrade.
    */
-  args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation, knowledgeDir, projectReads }) {
     // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
     // agy moves) — codex has no adoptable store wired yet. Reaching here
     // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -296,7 +265,7 @@ export const CODEX_RUNTIME = {
     // posture builds its own (CODEX_FENCES below); anything else is a build.
     const fenced = codexIgnoresUserConfig({ profile, vaultDir });
     if (fenced) {
-      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation }));
+      a.push(...CODEX_FENCES[profile]({ cwd, vaultDir, researchIsolation, knowledgeDir, projectReads }));
     } else {
       // The daemon's build posture, mapped: SAFE keeps writes inside the
       // workspace, the default lets the agent run its own tests and git
@@ -308,6 +277,7 @@ export const CODEX_RUNTIME = {
       // `--sandbox` flag (codex-cli 0.156.1 lists only `-c`/`--enable`/…), so
       // every resumed turn — an agent's second card, an answer — was refused
       // before it started. `-c sandbox_mode=` means the same on both.
+      if (writableDirs.length) a.push('-c', `sandbox_workspace_write.writable_roots=${JSON.stringify(writableDirs)}`);
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
     }
 
@@ -324,7 +294,10 @@ export const CODEX_RUNTIME = {
     if (a.includes('--ignore-user-config')) a.push(...(personal?.args ?? []));
 
     a.push(...mcp, ...resultSchemaArgs);
-    a.push(`${system}\n\n---\n\n${prompt}`);
+    const readers = profile === 'consult' || profile === 'plan'
+      ? '\nUse exec_command with shell="/bin/bash" and login=false for project discovery. Project files, local Git history and the project knowledge directory are readable; host files are outside this turn’s read boundary.'
+      : '';
+    a.push(`${system}${readers}\n\n---\n\n${prompt}`);
     return a;
   },
   /**
@@ -349,14 +322,14 @@ export const CODEX_RUNTIME = {
  * 2026-09-29, the owner: "its saying 3d models run on claude only but thats
  * not true"), one builder under each card's own profile name since 2026-10-10.
  *
- * The design card's shape is the image fence's without the image tool: a
+ * Design and image share supporting native image generation and a
  * permission profile that reads the repo and writes ONLY
  * `<worktree>/.flowviant/artifacts/` (and the turn's scratch), selected
  * by `default_permissions` (`codex exec` and `exec resume` refuse `-P` on
  * 0.156.1), no network, no web search, no sub-agents, no browser, computer or
- * apps, nobody's config or rules, and no approvals to wait on. Nothing about
- * the card's contract needs more: every one of the three is one HTML page, and
- * a page's CDN scripts load in the viewer, never on this machine.
+ * apps, nobody's config or rules, and no approvals to wait on. Needed image
+ * generation supports the page without changing its end product. CDN scripts
+ * load in the viewer, never on this machine.
  *
  * MEASURED on codex-cli 0.156.1 (Linux, bubblewrap), with gpt-6-luna at low
  * effort, in a scratch git repository (2026-09-29), with exactly this argv:
@@ -428,9 +401,9 @@ export function codexArtifactFence(cwd, { name, imageGeneration = false, what })
 }
 
 /** The design card's fence — `codexArtifactFence` under its own profile name,
- *  with no image tool. */
+ *  with native image generation available for supporting assets. */
 export const codexDesignFence = (cwd) =>
-  codexArtifactFence(cwd, { name: 'flowviantdesign', what: 'a design turn' });
+  codexArtifactFence(cwd, { name: 'flowviantdesign', imageGeneration: true, what: 'a design turn' });
 
 /**
  * EVERY FENCED POSTURE'S ARGV, by the keys of CODEX_FENCED (a test holds the
@@ -439,8 +412,8 @@ export const codexDesignFence = (cwd) =>
 const CODEX_FENCES = {
   // A CONSULT, EXPRESSED THE ONLY WAY CODEX CAN EXPRESS IT — a different
   // shape from Claude's verb allowlist, which is the whole reason `profile` is
-  // a promise rather than a flag list. See READ_ONLY_SANDBOX.
-  consult: () => [...READ_ONLY_SANDBOX, ...fencedTail()],
+  // a promise rather than a flag list. See codexProjectRead.mjs.
+  consult: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
   // A PLANNING SESSION. Read-only on the filesystem, exactly like a consult —
   // the writes it makes go through the control plane, not through this box —
   // and for the same reason: its prompt is steered by anything a project
@@ -449,7 +422,7 @@ const CODEX_FENCES = {
   // turn's scoped token. The plan token has the planning tools; a capture
   // token has only staging and transcript tools. The server refuses
   // everything outside that scope.
-  plan: () => [...READ_ONLY_SANDBOX, ...fencedTail()],
+  plan: (opts) => [...projectReadFence(opts.projectReads ?? projectReadBoundary(opts)), ...fencedTail()],
   wiki: ({ vaultDir }) => codexWikiFence(vaultDir),
   // AN IMAGE CARD (0.114.0): read the repo, write ONLY the worktree's
   // `.flowviant/artifacts/`, generate pictures, and nothing else. MEASURED on
@@ -475,12 +448,8 @@ const CODEX_FENCES = {
   // 2026-09-29); `:root` reads admit it, so the agent copies what it keeps
   // into the one writable directory, where the artifact scan finds it.
   //
-  // IMAGE GENERATION IS SWITCHED ON HERE AND ONLY HERE — a decision. This is
-  // the one turn whose card asks for pictures, so it must not depend on
-  // whatever the person's config says about the feature. A BUILD turn keeps
-  // the person's own config (not hermetic, by design), and the other fenced
-  // postures never asked for a picture, so none of them is handed a tool that
-  // spends image credits.
+  // Native images support every artifact kind; this profile still delivers
+  // PNG/WebP, while design/model/deck still deliver their self-contained page.
   image: ({ cwd }) => codexArtifactFence(cwd, { name: 'flowviantimage', imageGeneration: true, what: 'an image turn' }),
   // A MOCKUP, 3D-MODEL OR DECK CARD (0.115.0): the fence is
   // `codexDesignFence`'s, argued and measured at `codexArtifactFence` above.
@@ -492,7 +461,7 @@ const CODEX_FENCES = {
   // tail leaves NO_WEB out and closes everything else.
   research: ({ researchIsolation }) => {
     if (!researchIsolation) throw new Error('Codex research requires its isolated input copy.');
-    return [...researchFence(researchIsolation), ...fencedTail({ web: true })];
+    return [...researchFence(researchIsolation), ...fencedTail({ web: true, imageGeneration: true })];
   },
 };
 /** The fenced profile names — for the test that holds both tables to one set. */

package/bin/lib/runtimeDetection.mjs

@@ -86,6 +86,12 @@ export function runtimesReport(detected) {
     .join(',');
 }
 
+/** Existing probe evidence only; diagnostics never spawn another CLI. */
+export function measuredRuntimeVersion(id) {
+  const row = detectedCache?.find((runtime) => runtime.id === id);
+  return row ? { version: row.version, measuredAt: new Date(detectedAt).toISOString() } : null;
+}
+
 export function detectRuntimes({ refresh = false } = {}) {
   if (detectedCache && !refresh && Date.now() - detectedAt < DETECT_TTL_MS) return detectedCache;
   detectedAt = Date.now();

package/bin/lib/runtimeEvents.mjs

@@ -322,6 +322,11 @@ export function parseCodexLine(line, cwd) {
     // text: nothing here is the model speaking.
     case 'thread.started':
       return { activity: null, text: '', threadId: String(ev.thread_id ?? '') || null };
+    case 'item.started': {
+      const item = ev.item ?? {};
+      if ((item.item_type ?? item.type) !== 'command_execution') return null;
+      return { toolEvent: ['Bash', { command: item.command }, { id: item.id, runtime: 'codex' }] };
+    }
     case 'item.completed': {
       const item = ev.item ?? {};
       const activity = humanizeCodexItem(item, cwd);
@@ -334,7 +339,13 @@ export function parseCodexLine(line, cwd) {
       // the agent said LAST" (the agent lane's final JSON object) cannot recover
       // it from `out`. Claude's stream has this for free under
       // `answerFromResult`; codex needed it said.
-      return { activity, text, ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
+      const command = (item.item_type ?? item.type) === 'command_execution';
+      const toolEvent = command ? ['Bash', { command: item.command }, {
+        id: item.id, result: true, runtime: 'codex',
+        exitCode: item.exit_code, isError: item.status === 'failed',
+        output: item.aggregated_output ?? '',
+      }] : null;
+      return { activity, text, ...(toolEvent ? { toolEvent } : {}), ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
     }
     // THE TURN'S OWN TOKEN COUNT (2026-09-24). `codex exec --json` closes a
     // turn with `turn.completed` carrying `usage` — the codex twin of Claude's

package/bin/lib/runtimeOfferings.mjs

@@ -1,7 +1,7 @@
 /** Local, bounded Codex readouts. No agent turn is started for these reports. */
 import { execFileSync } from 'node:child_process';
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { accessSync, constants, readFileSync, readdirSync, statSync } from 'node:fs';
+import { basename, delimiter, isAbsolute, join } from 'node:path';
 import { readBaseTools } from './projectTools.mjs';
 import { mcpRefusal } from './projectToolRuntimes.mjs';
 import { CODEX_MCP_NAME, normalizeMcpReport } from './runtimeCapabilities.mjs';
@@ -52,6 +52,7 @@ export function localCodexOfferings({ env = process.env, runCodex = run, read =
   } catch (error) { if (error?.code === 'ENOENT') result.skills = []; }
   try {
     const servers = JSON.parse(runCodex(['mcp', 'list', '--json'], env));
+    if (Array.isArray(servers)) result.servers = codexServerRows(servers, env);
     if (Array.isArray(servers)) result.mcp = codexMcpReport(servers
       // Unknown/unsupported auth is not proof of disconnection. Keep their
       // names local, just as connected servers stay local.
@@ -61,11 +62,82 @@ export function localCodexOfferings({ env = process.env, runCodex = run, read =
   return result;
 }
 
-export function runtimeOfferings(repoRoot, baseRef, { refresh = false } = {}) {
+/** A bare command found on PATH, or an absolute one that is executable. */
+function commandFound(command, env) {
+  if (isAbsolute(command)) {
+    try { accessSync(command, constants.X_OK); return true; } catch { return false; }
+  }
+  if (command.includes('/')) return null; // relative to a cwd Codex picks: unknown
+  return (env.PATH ?? '').split(delimiter).some((dir) => {
+    try { accessSync(join(dir, command), constants.X_OK); return true; } catch { return false; }
+  });
+}
+
+/**
+ * EVERY SERVER IN THIS MACHINE'S CODEX CONFIG, AS `codex mcp list --json`
+ * NAMES IT (2026-10-13) — `[{ name, status, reason }]` for the box's MCP
+ * inventory (mcpInventory.mjs). Codex reports no connection state without
+ * starting a server, so a server it would start reads `configured`; what
+ * this daemon can tell cheaply is said instead: `disabled` (Codex's own
+ * `enabled = false`), `needs-auth` (its OAuth status says not logged in),
+ * `failed` with the reason when a stdio command is not found or an env
+ * variable it reads a token or header from is unset. MEASURED on codex-cli
+ * 0.159.2: entries carry `name`, `enabled`, `disabled_reason`, `transport`
+ * (`stdio` with `command`; `streamable_http` with `bearer_token_env_var` and
+ * `env_http_headers`) and `auth_status` (`unsupported` for both kinds). A
+ * reason names a command (its basename) or a variable, never a value, a path
+ * or a URL.
+ */
+export function codexServerRows(servers, env = process.env) {
+  const rows = [];
+  for (const s of servers) {
+    if (!s || typeof s.name !== 'string' || !nameOk(s.name)) continue;
+    const t = s.transport && typeof s.transport === 'object' ? s.transport : {};
+    const auth = typeof s.auth_status === 'string' ? s.auth_status : '';
+    let status = 'configured';
+    let reason = null;
+    const unset = [
+      ...(typeof t.bearer_token_env_var === 'string' ? [t.bearer_token_env_var] : []),
+      ...(t.env_http_headers && typeof t.env_http_headers === 'object' ? Object.values(t.env_http_headers).filter((v) => typeof v === 'string') : []),
+    ].filter((name) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) && !env[name]);
+    if (s.enabled === false) {
+      status = 'disabled';
+      reason = typeof s.disabled_reason === 'string' ? s.disabled_reason.slice(0, 200) : null;
+    } else if (typeof t.command === 'string' && commandFound(t.command, env) === false) {
+      status = 'failed';
+      reason = `command ${basename(t.command).slice(0, 60)} not found`;
+    } else if (unset.length) {
+      status = 'failed';
+      reason = `env ${[...new Set(unset)].sort().join(', ')} unset`;
+    } else if (['needs_auth', 'not_logged_in', 'notLoggedIn'].includes(auth)) {
+      status = 'needs-auth';
+    } else if (auth === 'failed') {
+      status = 'failed';
+    }
+    rows.push({ name: s.name, status, reason });
+  }
+  return rows;
+}
+
+function codexOfferings(refresh = false) {
   if (!cached || refresh || Date.now() - cachedAt >= TTL) {
     cached = localCodexOfferings();
     cachedAt = Date.now();
   }
+  return cached;
+}
+
+/** This machine's Codex servers for the inventory, or null when the local
+ *  read failed (unknown). Shares the offerings' five-minute cache. */
+export function codexMcpServers({ refresh = false } = {}) {
+  return codexOfferings(refresh).servers ?? null;
+}
+
+/** Existing model evidence only: a brief never probes another CLI or vendor. */
+export function knownCodexModels() { return cached?.models ?? []; }
+
+export function runtimeOfferings(repoRoot, baseRef, { refresh = false } = {}) {
+  codexOfferings(refresh);
   const out = { rtm: {}, rtc: {}, rts: {}, rtp: {} };
   if (cached.models) out.rtm.codex = cached.models;
   if (cached.capabilities) out.rtc.codex = cached.capabilities;

package/bin/lib/shipMerge.mjs

@@ -26,12 +26,14 @@ export function mergeOutward({
   repoRoot,
   tmpDir,
   baseRef,
+  baseTip,
   workingTree,
   warn,
   // NETWORK calls only (push, fetch) — timed and non-interactive, so a
   // stale credential or a half-open connection cannot freeze the ship
   // path's writer lock. Injectable for tests; defaults to the real one.
   gitNet = gitNetDefault,
+  retryRace = true,
 }) {
   const dropTmp = () => {
     try {
@@ -56,6 +58,7 @@ export function mergeOutward({
     const base = baseBranchName(baseRef());
     const merged = String(git(['rev-parse', 'HEAD'], tmpDir)).trim();
     const before = String(git(['rev-parse', `refs/heads/${base}`], repoRoot)).trim();
+    if (baseTip && before !== baseTip) throw new Error(`base moved to ${before}, but expected ${baseTip}`);
     let current = null;
     try { current = String(git(['symbolic-ref', '--quiet', '--short', 'HEAD'], repoRoot)).trim(); } catch { /* detached */ }
     if (current === base) {
@@ -76,7 +79,7 @@ export function mergeOutward({
   };
   const attempt = () => {
     dropTmp();
-    git(['worktree', 'add', '--detach', tmpDir, baseRef()], repoRoot);
+    git(['worktree', 'add', '--detach', tmpDir, baseTip ?? baseRef()], repoRoot);
     gitMerge(
       ['merge', '--no-ff', tip, '-m', `ship(${label}): ${count} commit${count === 1 ? '' : 's'}`],
       tmpDir
@@ -110,7 +113,7 @@ export function mergeOutward({
        * re-pushing a stale merge. The TIP is untouched, so the receipts still
        * name exactly the same commits.
        */
-      if (!isRaceRejection(e)) throw e;
+      if (!retryRace || !isRaceRejection(e)) throw e;
       warn?.('ship: base moved under us — refetching and merging again');
       try {
         gitNet(['fetch', 'origin', '--quiet'], repoRoot, 60_000);

package/bin/lib/startProject.mjs

@@ -188,8 +188,8 @@ export async function resolveStartProject({ dirGiven }) {
       }
       // An answered question is consent: adopt it, and BIND it to this repo so
       // the next start needs no prompt. Repointing is legitimate and said aloud.
-      if (repoRoot && picked.repoRoot && picked.repoRoot !== repoRoot) {
-        console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
+      if (repoRoot && picked.repoRoot && !creds.isStoredRepo(picked, repoRoot)) {
+        console.log(`note: adding ${repoRoot} to ${creds.projectLabel(picked)}. Run ${terminalCommand('login')} here to register its repository in project settings.`);
       }
       adoptStoredCredential(picked);
       // BOUND ONLY ONCE THE START HAS THE LOCK. Written here, the answer moved
@@ -266,10 +266,10 @@ export async function resolveStartProject({ dirGiven }) {
   }
 
   if (process.argv.includes('--json-events') && dirGiven && CREDENTIAL?.entry) {
-    const { detectRepoRoot, listStoredProjects, boundElsewhere } = await import('./credentials.mjs');
+    const { detectRepoRoot, listStoredProjects, boundElsewhere, isStoredRepo } = await import('./credentials.mjs');
     const repo = detectRepoRoot();
     const entry = CREDENTIAL.entry;
-    if (!repo || entry.repoRoot !== repo || boundElsewhere(listStoredProjects(), repo, entry.projectId).length) {
+    if (!repo || !isStoredRepo(entry, repo) || boundElsewhere(listStoredProjects(), repo, entry.projectId).length) {
       console.error('error: this project is not connected to this repository. Run `flowviant login` for the selected folder.');
       process.exit(1);
     }