flowviant 0.117.0 → 0.124.1

package/bin/lib/planDependencies.mjs

@@ -0,0 +1,70 @@
+/** The planner declares prerequisites; the daemon enforces them without reading
+ * human prose. Declared collisions use the same compatible groups; evidence stays on the wire. */
+export function groupDependencies(agents, dependencies, collisions) {
+  if (dependencies === undefined && collisions === undefined) return agents;
+  if (dependencies === undefined) dependencies = [];
+  if (collisions === undefined) collisions = [];
+  if (!Array.isArray(collisions) || collisions.length > 1200) return null;
+  if (!Array.isArray(dependencies) || dependencies.length > 1200) return null;
+  if (!dependencies.length && !collisions.length) return agents;
+  const owner = new Map();
+  for (const [i, group] of agents.entries()) {
+    for (const id of group.taskIds) {
+      if (owner.has(id)) return null;
+      owner.set(id, i);
+    }
+  }
+  const parents = agents.map((_, i) => i);
+  const root = (i) => {
+    while (parents[i] !== i) i = parents[i];
+    return i;
+  };
+  const needs = new Map();
+  for (const edge of dependencies) {
+    if (!edge || !owner.has(edge.taskId) || !Array.isArray(edge.requires) || edge.requires.length > 60) return null;
+    for (const id of edge.requires) {
+      if (!owner.has(id) || id === edge.taskId) return null;
+      const a = root(owner.get(edge.taskId));
+      const b = root(owner.get(id));
+      parents[Math.max(a, b)] = Math.min(a, b);
+      if (!needs.has(edge.taskId)) needs.set(edge.taskId, new Set());
+      needs.get(edge.taskId).add(id);
+    }
+  }
+  for (const collision of collisions) {
+    if (!collision || !Array.isArray(collision.taskIds) || new Set(collision.taskIds).size < 2 || collision.taskIds.length > 60) return null;
+    for (const id of collision.taskIds) {
+      if (!owner.has(id)) return null;
+      const a = root(owner.get(collision.taskIds[0]));
+      const b = root(owner.get(id));
+      parents[Math.max(a, b)] = Math.min(a, b);
+    }
+  }
+  const groups = new Map();
+  for (const [i, group] of agents.entries()) {
+    const key = root(i);
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(group);
+  }
+  const result = [];
+  for (const members of groups.values()) {
+    const attached = [...new Set(members.map((g) => g.intoAgentId).filter(Boolean))];
+    if (attached.length > 1) return null;
+    const pending = members.flatMap((g) => g.taskIds);
+    if (pending.length > 60) return null;
+    const taskIds = [];
+    // Stable topological order: unrelated cards keep their proposed order.
+    while (pending.length) {
+      const at = pending.findIndex((id) => [...(needs.get(id) ?? [])].every((need) => taskIds.includes(need)));
+      if (at < 0) return null; // a cycle cannot become a runnable proposal
+      taskIds.push(...pending.splice(at, 1));
+    }
+    const budget = members.reduce((sum, g) => sum + (g.pointsBudget ?? 0), 0);
+    result.push({ ...members[0], taskIds,
+      ...(members.some(g => g.rationale) ? { rationale: members.map(g => g.rationale).filter(Boolean).join('\n').slice(0, 1000) } : {}),
+      ...(budget ? { pointsBudget: Math.min(budget, 100_000) } : {}),
+      ...(attached.length ? { intoAgentId: attached[0] } : {}),
+    });
+  }
+  return result;
+}

package/bin/lib/postureTools.mjs

@@ -0,0 +1,85 @@
+/** Per-turn readout of mounted tools and remaining permission boundaries.
+ * Kind selects the delivery contract; CLI/configuration and the filesystem
+ * fence determine supporting capabilities. Keep these claims beside the
+ * actual builders and the spawned-lane tests in artifactProjectMcp.test.mjs.
+ */
+
+/** What the machine's own MCP servers are, per CLI. */
+const MACHINE = {
+  claude: 'the MCP servers and claude.ai connectors this machine’s Claude Code has (its user and local servers)',
+  codex: 'the MCP servers in this machine’s Codex config',
+};
+
+/** Per posture and CLI: what the card has and what it lacks. */
+const POSTURES = {
+  research: {
+    claude: {
+      has: 'the repository’s files (never .env files), the project’s knowledge library, web search and web fetch, and writing under .flowviant/artifacts/ and the granted scratch directory',
+      lacks: 'no measured native image-generation tool, no delegation, guarded read commands only (no helper scripts or browsers), and no plugins from this machine’s Claude Code (nor the MCP servers a plugin brings)',
+    },
+    codex: {
+      has: 'a sandboxed shell over an isolated copy of the repository (no .env, credential or git files, and no network from the shell), web search, and writing under .flowviant/artifacts/ and the granted scratch directory',
+      lacks: 'no host files outside that copy except native generated images; native image generation depends on this CLI and account',
+    },
+  },
+  design: {
+    claude: {
+      has: 'the repository’s files (never .env files), the project’s knowledge library, guarded read commands, web search and web fetch, and writing under .flowviant/artifacts/ and the granted scratch directory',
+      lacks: 'no measured native image-generation tool, no delegation, no helper scripts or browsers, and no plugins from this machine’s Claude Code (nor the MCP servers a plugin brings)',
+    },
+    codex: {
+      has: 'a sandboxed shell that reads the repository and writes only under .flowviant/artifacts/, with no shell network, scratch writes, and native image generation when this CLI and account expose it',
+      lacks: 'no native web on this broad-read fence (host credentials are readable); use a configured project web MCP server when available',
+    },
+  },
+  image: {
+    codex: {
+      has: 'a sandboxed shell that reads the repository and writes only under .flowviant/artifacts/, with no shell network, scratch writes, and native image generation when this CLI and account expose it',
+      lacks: 'no web',
+    },
+  },
+};
+
+/** Configuration supplies tools; a skill supplies instructions, not a tool. */
+const SUPPORTING_CAPABILITIES = `The kind defines the delivered product, not which supporting capabilities
+may be used. Use available tools needed for the person's request, including
+native image generation for requested textures or illustrations. A listed skill
+is not proof that its tool is installed, mounted or entitled on this account.
+Do not re-file the kind or require a separate image card just to use a tool.
+If a needed tool is absent or fails, relay the measured limitation and ask for
+the missing configuration or a decision. A separately billed CLI/API fallback
+requires the person's explicit choice first; never default to OPENAI_API_KEY.
+Use personal connectors only for the requested work; sending messages or other
+external writes requires explicit authorization. Never open the person's browser
+or desktop; headless inspection must stay within the granted filesystem fence.
+Delegation is disabled by policy on fenced turns; tool names may still be listed. Complete the work in this turn.`;
+
+const list = (names) => names.join(', ');
+
+/**
+ * The note for a turn, or '' when its posture withholds nothing to say.
+ * `mounted` is the names of the base `.mcp.json` servers this turn mounted;
+ * `machine` whether the machine's own servers were mounted beside them (a
+ * Claude turn whose `.mcp.json` walk could not be bounded mounts the base copy
+ * alone); `unmounted` is `[{ name, reason, source }]` for the servers it
+ * could not mount — `source` 'project' (the base `.mcp.json`) or 'machine'.
+ */
+export function postureToolsNote({ posture, runtime, mounted = [], machine = true, unmounted = [] }) {
+  const row = POSTURES[posture]?.[runtime];
+  if (!row) return posture === 'build' ? `TOOLS ON THIS CARD. Use the tools actually exposed by this CLI and its configuration. ${SUPPORTING_CAPABILITIES.replace('Delegation is disabled by policy on fenced turns; tool names may still be listed. Complete the work in this turn.', 'Delegate only when the person explicitly requests it.')} ` : '';
+  const fromProject = unmounted.filter((u) => u.source !== 'machine');
+  const fromMachine = unmounted.filter((u) => u.source === 'machine');
+  const project = mounted.length
+    ? `The project’s MCP servers from the base branch’s .mcp.json are mounted: ${list(mounted)}.`
+    : fromProject.length
+      ? 'None of the project’s MCP servers is mounted on this machine.'
+      : 'The base branch’s .mcp.json lists no MCP server.';
+  const own = machine
+    ? ` So are ${MACHINE[runtime]}.`
+    : ` ${MACHINE[runtime][0].toUpperCase()}${MACHINE[runtime].slice(1)} are not mounted on this turn.`;
+  const missing = (rows, where) => (rows.length ? ` ${where}, but not mounted here: ${list(rows.map(({ name, reason }) => `${name} (${reason})`))}.` : '');
+  return `TOOLS ON THIS CARD. You have ${row.has}. You have ${row.lacks}. ${project}${own}${missing(fromProject, 'Listed in the base branch’s .mcp.json')}${missing(fromMachine, `In ${MACHINE[runtime]}`)} A server added to .mcp.json only in this worktree is not mounted; the base branch’s file is the one that counts.
+There is no Flowviant setting that adds a tool, so never invent one. A missing
+server can be configured in the base branch's .mcp.json or the machine's CLI.
+${SUPPORTING_CAPABILITIES}`;
+}

package/bin/lib/prWorkflow.mjs

@@ -51,6 +51,9 @@
  * without GitHub; nothing in the daemon passes them except the fetch.
  */
 
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { git, stripUrlUserinfo } from './git.mjs';
 import { scrub } from './uplinkScrub.mjs';
@@ -232,3 +235,15 @@ export async function mergeAndVerifyTip(head, { cwd, tip, baseRef, repoRoot, fet
   const landed = await tipReachedBase({ tip, baseRef, repoRoot, fetchOrigin, sleep, gitImpl });
   return landed ? { ok: true } : { notOnBase: true };
 }
+
+/** Cross-links are written only to verified PR URLs, before any PR lands. */
+export function linkRepositoryPrs(url, { cwd, cards, order, repositories, states, gh = runGh }) {
+  if (!PR_URL_RE.test(url)) throw new Error('GitHub did not return a verified pull request URL.');
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-pr-'));
+  try {
+    const file = join(dir, 'body.md');
+    const body = `Flowviant cards: ${cards.map((c) => c.url ? `[${c.id}](${c.url})` : c.id).join(', ')}\n\nMerge order:\n${order.map((id, i) => `${i + 1}. ${repositories.find((r) => r.id === id)?.name ?? id}${states[id]?.prUrl ? ` — ${states[id].prUrl}` : ''}`).join('\n')}\n\n${cards.map((c) => c.mergeOrderReason).filter(Boolean).join('\n')}\n`;
+    writeFileSync(file, body, { mode: 0o600 });
+    gh(['pr', 'edit', url, '--body-file', file], { cwd, timeout: 60_000 });
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+}

package/bin/lib/projectLanded.mjs

@@ -0,0 +1,16 @@
+/** Each repository observes its own base, including PRs merged outside this daemon. */
+import { createLandedObserver } from './landed.mjs';
+import { gitNetAsync } from './git.mjs';
+export function createProjectLandedObserver({ repoRoot, baseRef, repositories }) {
+  const legacy = createLandedObserver({ repoRoot, baseRef });
+  const observers = new Map();
+  return { observe: async () => {
+    if (!repositories?.multiple()) return legacy.observe();
+    for (const repo of repositories.list().filter((r) => r.repoRoot && r.baseRef)) {
+      const key = `${repo.id}:${repo.repoRoot}`;
+      if (!observers.has(key)) observers.set(key, createLandedObserver({ repoRoot: repo.repoRoot, baseRef: () => repositories.list().find((r) => r.id === repo.id)?.baseRef, repo: repo.id }));
+      try { await gitNetAsync(['fetch', 'origin', '--quiet'], repo.repoRoot); } catch { /* local-only or offline */ }
+      await observers.get(key).observe();
+    }
+  } };
+}

package/bin/lib/projectRepositories.mjs

@@ -0,0 +1,60 @@
+/** The project's catalog joined to this machine's credential bindings. */
+import { existsSync, realpathSync } from 'node:fs';
+import { printableLine } from './printable.mjs';
+import { listStoredProjects } from './credentials.mjs';
+import { checkoutIdentity } from './checkoutIdentity.mjs';
+import { detectBaseRef, gitOrNull, usableBaseRef, baseBranchName } from './git.mjs';
+
+export function storedProject(token) {
+  return listStoredProjects().find((entry) => entry.fleetToken === token) ?? null;
+}
+
+function address(value) {
+  let remote = String(value ?? '');
+  try {
+    const url = new URL(remote);
+    if (url.hostname.toLowerCase() === 'github.com') remote = url.pathname.replace(/^\//, '');
+  } catch { /* full name or scp remote */ }
+  remote = remote.replace(/^(?:git@)?github\.com:/i, '').replace(/\.git\/?$/i, '');
+  return /^[\w.-]+\/[\w.-]+$/.test(remote) ? remote.toLowerCase() : remote;
+}
+
+export function createProjectRepositories({ entry, repoRoot, getEntry = () => entry }) {
+  let catalog = null;
+  const learn = (rows) => {
+    if (!Array.isArray(rows)) return;
+    if (!rows.length || rows.length > 64 || rows.some((r) => !r || typeof r.id !== 'string' || typeof r.name !== 'string') ||
+        rows.filter((r) => r.isPrimary).length !== 1)
+      throw new Error('The project repository catalog is invalid.');
+    catalog = rows;
+  };
+  const list = () => {
+    const bindings = Object.entries(getEntry()?.repositories ?? {});
+    return (catalog ?? []).map((repo) => {
+      // Match remotes as well as names: a rename must not strand a binding,
+      // and reusing a short name must never select a different git repository.
+      const matches = bindings.filter(([name, root]) => {
+        if (!existsSync(root)) return false;
+        return repo.remote ? address(checkoutIdentity(root).remote) === address(repo.remote) : name === repo.name;
+      });
+      const root = matches.find(([name]) => name === repo.name)?.[1] ?? matches[0]?.[1] ??
+        (catalog.length === 1 && bindings.length === 0 ? repoRoot : null);
+      const checkout = root && gitOrNull(['rev-parse', '--show-toplevel'], root);
+      const available = checkout && realpathSync(checkout) === realpathSync(root);
+      return { ...repo, repoRoot: available ? root : null,
+        baseRef: available ? (repo.baseBranch ? usableBaseRef(root, `origin/${baseBranchName(repo.baseBranch)}`) : detectBaseRef(root)) : null };
+    });
+  };
+  const targets = (job) => {
+    const rows = list();
+    const ids = job.repos ?? job.task?.repos;
+    return Array.isArray(ids) && ids.length ? [...new Set(ids)] : rows.filter((r) => r.isPrimary).map((r) => r.id);
+  };
+  const missing = (job) => {
+    if (!catalog) return null; // an older server, not a measurement of absence
+    const rows = list();
+    const absent = targets(job).filter((id) => !rows.find((r) => r.id === id)?.repoRoot);
+    return absent.length ? printableLine(`Repositories not checked out on this machine: ${absent.map((id) => rows.find((r) => r.id === id)?.name ?? id).join(', ')}. Run flowviant login in each checkout to connect it.`, 4000) : null;
+  };
+  return { learn, list, targets, missing, multiple: () => (catalog?.length ?? 0) > 1 };
+}

package/bin/lib/projectToolRuntimes.mjs

@@ -15,9 +15,10 @@
  * projectTools.mjs. projectTools.test.mjs pins every transport word to here.
  */
 
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { codexHome } from './codexHome.mjs';
+import { parseCodexToml, TomlRaw } from './codexPersonal.mjs';
 
 export const toml = (value) => JSON.stringify(String(value));
 
@@ -182,9 +183,14 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
   try { if (!lstatSync(dest).isDirectory()) rmSync(dest, { force: true }); } catch { /* absent */ }
   mkdirSync(dest, { recursive: true, mode: 0o700 });
   chmodSync(dest, 0o700);
-  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml') : [];
+  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml' && name !== 'generated_images') : [];
   for (const name of personal) linkPersonalEntry(join(source, name), join(dest, name));
-  const linked = new Set(personal);
+  // Native supporting images belong to this agent, not the person's shared
+  // image directory. Repair homes created before this distinction.
+  const generated = join(dest, 'generated_images');
+  try { if (lstatSync(generated).isSymbolicLink()) rmSync(generated); } catch { /* absent */ }
+  mkdirSync(generated, { recursive: true, mode: 0o700 });
+  const linked = new Set([...personal, 'generated_images']);
   for (const name of readdirSync(dest)) {
     if (linked.has(name) || name === 'config.toml') continue;
     // Only a LINK is ours to drop: a real entry under a name the person has
@@ -205,6 +211,212 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
   return { path: dest, personalDeveloperInstructions };
 }
 
+/** The environment names a fenced Codex turn's MCP header values ride under,
+ *  one per header (`codexFencedMount`). */
+export const MCP_HEADER_ENV_PREFIX = 'FLOWVIANT_MCP_HEADER_';
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SERVER_NAME = /^[A-Za-z0-9_-]{1,80}$/;
+const expands = (value) => /\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(String(value));
+/**
+ * Names this machine's Codex, or the shell and tools under it, read for
+ * themselves. A server's env value rides in the CLI's own environment
+ * (`env_vars` forwards it), so a name the machine does not already set to that
+ * value would change how the CLI itself runs — a proxy, a CA bundle, a
+ * provider key. Such a server is left unmounted, in words.
+ */
+const CLI_ENV =
+  /^(PATH|HOME|SHELL|USER|LOGNAME|PWD|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|DISPLAY|WAYLAND_DISPLAY|BROWSER|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|RUST_LOG|RUST_BACKTRACE|HTTPS?_PROXY|ALL_PROXY|NO_PROXY|https?_proxy|all_proxy|no_proxy)$|^(LC|XDG|LD|DYLD|OPENAI|CODEX|AZURE_OPENAI|FLOWVIANT)_/;
+
+/** This machine's own Codex servers: its config.toml's `[mcp_servers.*]`,
+ *  read the way codexPersonal.mjs reads the login (bounded; a file that does
+ *  not parse carries nothing). */
+function machineCodexServers(machineEnv) {
+  try {
+    const path = join(resolve(codexHome(machineEnv)), 'config.toml');
+    const st = statSync(path);
+    if (!st.isFile() || st.size > 1024 * 1024) return [];
+    const servers = parseCodexToml(readFileSync(path, 'utf8'))?.mcp_servers;
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return [];
+    return Object.entries(servers).filter(([, v]) => v && typeof v === 'object' && !Array.isArray(v));
+  } catch {
+    return [];
+  }
+}
+const tomlScalar = (v) => (v instanceof TomlRaw ? v.text : typeof v === 'number' && Number.isFinite(v) ? String(v) : null);
+const words = (v) => (Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : null);
+const table = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+
+/**
+ * THE MCP SERVERS ON A FENCED CODEX TURN — the project's and, since 2026-10-11,
+ * the machine's own (the owner: "the server that is running flowviant's claude
+ * HAS these MCPs yet the agents are not using them"). A Codex build reads both
+ * from the agent's config.toml (`isolatedCodexHome`: the person's own tables
+ * kept, the repo's beside them). Every fenced posture — write-up, mockup,
+ * 3D model, deck, image — passes `--ignore-user-config`, which drops that
+ * file, and a `-p` profile layered beside the flag was measured to load no
+ * server either (codex-cli 0.159.2, artifactProjectMcp.test.mjs). So these
+ * turns take the servers as `-c` pairs, the way codexPersonal.mjs carries a
+ * login back, under the same rule: A LITERAL SECRET NEVER RIDES ARGV.
+ *
+ *  · A stdio server's command and arguments ride as written: they are the
+ *    server process's own command line once Codex starts it, so `-c` adds no
+ *    reader. A project server whose command or arguments expand a `${VAR}`
+ *    is still left unmounted (the 2026-10-10 audit took expanded values off
+ *    argv, and this keeps that line).
+ *  · Every env value rides in the turn's ENVIRONMENT under its own name,
+ *    forwarded by Codex's `env_vars` — except a project value with no `${VAR}`,
+ *    which is text of the reviewed file and rides as written. Refused (the
+ *    server is left unmounted, with the reason) when the name is the
+ *    daemon's own (`FLOWVIANT_*`, `CODEX_HOME`), when this machine already
+ *    sets it to something else, or when it is one the CLI reads itself
+ *    (`CLI_ENV`) and the machine does not set it.
+ *  · Every header value rides in the environment, named by
+ *    `env_http_headers`. A machine server's own `env_http_headers`,
+ *    `bearer_token_env_var` and `env_vars` are names, and ride as written.
+ *  · A URL that expands a `${VAR}`, or carries a query, fragment or
+ *    credentials, has no indirection in Codex's config: left unmounted.
+ *  · A machine server keeps its own `cwd`, timeouts and tool lists; it is
+ *    skipped where the person turned it off (`enabled = false`), and a
+ *    project server of the same name replaces it, as on the build.
+ *  · Each mounted server's tools are approved by name: an unannotated tool
+ *    under a fenced posture failed "MCP tool call requires approval, but
+ *    approval policy is never" (measured, 0.159.2) — never a blanket
+ *    approval policy.
+ *
+ * `usable` is the base snapshot's ready entries; `expand` reads a value the
+ * way projectTools.mjs does; `machineEnv` is the caller's own (what the child
+ * would inherit). Returns `{ args, env, mounted, machine, unmounted }`:
+ * `mounted` the project servers, `machine` the machine's own, and
+ * `unmounted` `[{ name, reason, source: 'project' | 'machine' }]`.
+ */
+function codexFencedMount(usable, expand, machineEnv) {
+  const args = [];
+  const childEnv = {};
+  const mounted = [];
+  const machine = [];
+  const unmounted = [];
+  let header = 0;
+  /** A refusal sentence, or null with the value staged in `extra`. */
+  const forward = (key, value, extra) => {
+    if (key.startsWith('FLOWVIANT_') || key === 'CODEX_HOME') return `its env ${key} is a name this daemon keeps for itself`;
+    const has = machineEnv[key];
+    if (has !== undefined) return has === value ? null : `its env ${key} would replace this machine's own ${key}, which a fenced Codex turn cannot do`;
+    if (CLI_ENV.test(key)) return `its env ${key} is one this machine's Codex reads itself, which a fenced Codex turn cannot set`;
+    const staged = childEnv[key] ?? extra[key];
+    if (staged !== undefined && staged !== value) return `its env ${key} would replace another server's ${key}`;
+    extra[key] = value;
+    return null;
+  };
+  const headerEnv = (headers, extra) =>
+    Object.entries(headers).map(([key, value]) => {
+      const envName = `${MCP_HEADER_ENV_PREFIX}${header++}`;
+      extra[envName] = value;
+      return `${toml(key)}=${toml(envName)}`;
+    });
+  const accept = (name, pairs, extra, list) => {
+    args.push(...pairs, '-c', `mcp_servers.${name}.default_tools_approval_mode="approve"`);
+    Object.assign(childEnv, extra);
+    list.push(name);
+  };
+
+  for (const { name, config } of usable) {
+    const pairs = [];
+    const extra = {};
+    let refused = null;
+    if (typeof config.command === 'string') {
+      const rawArgs = Array.isArray(config.args) ? config.args : [];
+      if (expands(config.command) || rawArgs.some(expands)) {
+        refused = 'its command or arguments name a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(String(config.command))}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map((v) => toml(String(v))).join(',')}]`);
+        const forwarded = [];
+        for (const [key, value] of Object.entries(config.env ?? {})) {
+          if (!ENV_NAME.test(key)) continue;
+          if (!expands(value)) {
+            pairs.push('-c', `mcp_servers.${name}.env.${key}=${toml(String(value))}`);
+            continue;
+          }
+          refused = forward(key, expand(value), extra);
+          if (refused) break;
+          forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+      }
+    } else if (typeof config.url === 'string') {
+      if (expands(config.url)) {
+        refused = 'its URL names a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(String(config.url))}`);
+        const named = headerEnv(Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v)])), extra);
+        if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+      }
+    } else continue;
+    if (refused) unmounted.push({ name, reason: refused, source: 'project' });
+    else accept(name, pairs, extra, mounted);
+  }
+
+  const projectNames = new Set(usable.map((t) => t.name));
+  for (const [name, server] of machineCodexServers(machineEnv)) {
+    if (projectNames.has(name) || name === 'flowviant' || server.enabled === false) continue;
+    if (typeof server.command !== 'string' && typeof server.url !== 'string') continue;
+    const pairs = [];
+    const extra = {};
+    let refused = SERVER_NAME.test(name) ? null : 'its name cannot be spelled as a command-line setting';
+    if (!refused && typeof server.command === 'string') {
+      const rawArgs = server.args === undefined ? [] : words(server.args);
+      if (!rawArgs) refused = 'its args are not a list of words';
+      else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(server.command)}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map(toml).join(',')}]`);
+        const forwarded = [...(words(server.env_vars) ?? []).filter((k) => ENV_NAME.test(k))];
+        for (const [key, value] of Object.entries(table(server.env))) {
+          if (!ENV_NAME.test(key) || typeof value !== 'string') {
+            refused = `its env ${String(key).slice(0, 40)} is not a name and text`;
+            break;
+          }
+          refused = forward(key, value, extra);
+          if (refused) break;
+          if (!forwarded.includes(key)) forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+        if (typeof server.cwd === 'string') pairs.push('-c', `mcp_servers.${name}.cwd=${toml(server.cwd)}`);
+      }
+    } else if (!refused) {
+      let url = null;
+      try { url = new URL(server.url); } catch { /* refused below */ }
+      if (!url || url.search || url.hash || url.username || url.password) {
+        refused = 'its URL carries a query, fragment or credentials, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(server.url)}`);
+        if (typeof server.bearer_token_env_var === 'string' && ENV_NAME.test(server.bearer_token_env_var))
+          pairs.push('-c', `mcp_servers.${name}.bearer_token_env_var=${toml(server.bearer_token_env_var)}`);
+        const literal = table(server.http_headers);
+        const byName = table(server.env_http_headers);
+        if (Object.values(literal).some((v) => typeof v !== 'string') || Object.values(byName).some((v) => typeof v !== 'string' || !ENV_NAME.test(v))) {
+          refused = 'its headers are not text';
+        } else {
+          const named = [...headerEnv(literal, extra), ...Object.entries(byName).map(([key, envName]) => `${toml(key)}=${toml(envName)}`)];
+          if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+        }
+      }
+    }
+    if (!refused) {
+      for (const key of ['startup_timeout_sec', 'startup_timeout_ms', 'tool_timeout_sec']) {
+        const v = tomlScalar(server[key]);
+        if (v != null && /^[0-9_.]+$/.test(v)) pairs.push('-c', `mcp_servers.${name}.${key}=${v}`);
+      }
+      for (const key of ['enabled_tools', 'disabled_tools']) {
+        const list = words(server[key]);
+        if (list) pairs.push('-c', `mcp_servers.${name}.${key}=[${list.map(toml).join(',')}]`);
+      }
+    }
+    if (refused) unmounted.push({ name, reason: refused, source: 'machine' });
+    else accept(name, pairs, extra, machine);
+  }
+  return { args, env: childEnv, mounted, machine, unmounted };
+}
+
 /** Claude takes the base branch's skills as a plugin written for this turn. */
 function reviewedClaudePlugin(dir, snapshot) {
   if (!snapshot.skillFiles.length) return null;
@@ -245,6 +457,8 @@ const TOOL_RUNTIMES = {
       const isolated = isolatedCodexHome(turn?.codexHome ?? join(dir, 'codex-home'), env, worktree, turn?.mcpServers);
       return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions };
     },
+    // A fenced posture ignores that home's config.toml (2026-10-10).
+    fencedMount: codexFencedMount,
   },
   antigravity: { mcp: false, skills: false },
 };
@@ -253,6 +467,16 @@ const TOOL_RUNTIMES = {
 const takesNothing = { mcp: false, skills: false };
 const rowFor = (runner) => (Object.hasOwn(TOOL_RUNTIMES, runner) ? TOOL_RUNTIMES[runner] : takesNothing);
 
+/** The servers as a fenced posture takes them where it ignores the runner's
+ *  own file — Codex's `-c` pairs and environment (`codexFencedMount`) — or
+ *  null for a runner whose fenced turns read the same file as its build
+ *  (Claude's strict mcp.json) or that takes none. `usable` is the base
+ *  snapshot's ready entries; `expand(value)` reads a `${VAR}`. */
+export function fencedMountFor(runner, usable, expand, machineEnv = process.env) {
+  const mount = rowFor(runner).fencedMount;
+  return mount ? mount(usable, expand, machineEnv) : null;
+}
+
 /** Pure mapping used before a future tool-attach gesture is offered. */
 export function runnerToolCapabilities(runner) {
   const { mcp, skills } = rowFor(runner);

package/bin/lib/projectTools.mjs

@@ -1,10 +1,10 @@
 /** Repo-owned tool configuration, read from the base ref for every agent turn. */
-import { accessSync, constants, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { delimiter, isAbsolute, join } from 'node:path';
+import { accessSync, constants, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { git, gitRaw, splitNul } from './git.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
-import { mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
+import { fencedMountFor, mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
 
 const MAX_TOOLS = 40;
 const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
@@ -124,6 +124,7 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
 
 const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
 
+
 /**
  * Temporary per-turn files are removed after the last retry. No personal CLI config is written.
  *
@@ -135,12 +136,19 @@ const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]
  *
  * NO EXPANDED VALUE RIDES ARGV (2026-10-10, the audit): Claude's servers go
  * to this turn's 0600 mcp.json, Codex's into the isolated home's config.toml
- * (projectToolRuntimes.mjs) — never `-c` pairs on the command line.
+ * (projectToolRuntimes.mjs) — never `-c` pairs on the command line. A fenced
+ * Codex turn, which ignores that file, takes `fencedMount` instead: the
+ * repo's own words as `-c` pairs and every expanded value in its environment.
  */
-export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
+export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null, turnServers = {} } = {}) {
   const env = expansionEnv(callerEnv);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
+  // What the base lists and this turn cannot mount, and why — the turn is told
+  // (postureTools.mjs), so a missing server is a named fact, never a guess.
+  const mcpUnmounted = snapshot.tools
+    .filter((t) => !usable.includes(t))
+    .map((t) => ({ name: t.name, reason: String(mcpRefusal(runner, t.config) ?? t.reason ?? 'not mounted').slice(0, 200) }));
   const mcpServers = {};
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
@@ -154,6 +162,7 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
       mcpServers[name] = { type: config.type ?? 'http', url, ...(Object.keys(headers).length ? { headers } : {}) };
     }
   }
+  Object.assign(mcpServers, turnServers); // daemon-owned names cannot be replaced by project config
   const mcpPath = join(dir, 'mcp.json');
   writeFileSync(mcpPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
   const pointers = [];
@@ -177,6 +186,12 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   const { pluginDir, codexHome, personalDeveloperInstructions } = prepared;
   return {
     mcpPath,
+    /** The names of the servers mounted, as Claude's allow rules need them. */
+    mcpServers: Object.keys(mcpServers),
+    mcpUnmounted,
+    /** The mount a fenced turn takes where the runner's file is ignored
+     *  (`fencedMountFor`, projectToolRuntimes.mjs); null where it has none. */
+    fencedMount: fencedMountFor(runner, usable, (value) => expand(value, env), callerEnv),
     instructions,
     pluginDir,
     codexHome,
@@ -197,3 +212,46 @@ export function toolReadout(snapshot, runner) {
   }));
   return [...mcp, ...instructions].slice(0, MAX_REPORT_TOOLS);
 }
+
+const MCP_JSON_MAX_BYTES = 1024 * 1024;
+const MCP_JSON_MAX_NAMES = 500;
+/**
+ * EVERY SERVER NAMED IN A `.mcp.json` FROM `dir` UP TO `/` (2026-10-11). An
+ * agent turn that mounts the machine's MCP servers is not strict, and Claude
+ * Code then reads `.mcp.json` in its cwd and every parent wherever a settings
+ * scope approves one (measured, 2.1.290). The base branch's copy is the
+ * project's only `.mcp.json` input to an agent, so each of these names is
+ * disabled for the turn (claudePosture.mjs `withMachineMcp`): the agent's edit
+ * of its worktree's file mounts only after review lands it on base. A server
+ * the machine should have everywhere belongs in its CLI's user scope.
+ *
+ * NULL when the answer cannot be bounded — a `.mcp.json` over 1 MiB, or more
+ * than 500 names — and the lane then mounts strictly (the base copy alone)
+ * rather than leave one discovered. A file that does not parse names nothing:
+ * the CLI cannot read it either.
+ */
+export function mcpJsonServerNamesAbove(dir) {
+  const names = new Set();
+  let at = resolve(dir);
+  for (;;) {
+    const file = join(at, '.mcp.json');
+    let raw = null;
+    try {
+      const st = statSync(file);
+      if (st.isFile()) {
+        if (st.size > MCP_JSON_MAX_BYTES) return null;
+        raw = readFileSync(file, 'utf8');
+      }
+    } catch { /* none here */ }
+    if (raw != null) {
+      try {
+        const servers = JSON.parse(raw)?.mcpServers;
+        if (servers && typeof servers === 'object' && !Array.isArray(servers)) for (const name of Object.keys(servers)) names.add(name);
+      } catch { /* the CLI cannot parse it either */ }
+    }
+    if (names.size > MCP_JSON_MAX_NAMES) return null;
+    const up = dirname(at);
+    if (up === at) return [...names];
+    at = up;
+  }
+}