flowviant 0.125.2 → 0.125.4

package/README.md

@@ -223,5 +223,8 @@ this package version, builds, attests and attaches the binaries and manifest.
 R2 publication remains opt-in through `PUBLISH_R2` and the `r2` environment.
 For a manual upload run `sh cli/scripts/upload-binaries.sh` from the root; it
 checks all four binaries against the manifest and publishes `latest.json` last.
-`(cd cli && npm publish)` retains the prepublish parity gate and npm shrinkwrap.
+`(cd cli && npm exec --yes --package=npm@11.17.0 -- npm publish)` retains
+the prepublish parity gate and includes the npm shrinkwrap. The publisher is
+pinned because [npm 12 removed shrinkwrap support](https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-lock-json.md#npm-shrinkwrapjson)
+and omits it from tarballs; npm 12 consumers also ignore that lockfile.
 No sibling repository or separate app deploy key is required.

package/bin/lib/hooks/orchestrator.mjs

@@ -1,22 +1,28 @@
 /** Native gate; a full pool refuses only this spawn, preserving the turn. */
 import { fileURLToPath } from 'node:url';
 import { callOrchestrator } from '../orchestratorClient.mjs';
+import { OrchestratorInputTooLarge, readOrchestratorInput } from '../orchestratorInput.mjs';
+import { runningCompiledBinary } from '../launchCommand.mjs';
 
 export async function main() {
   try {
-    let raw = ''; for await (const chunk of process.stdin) { raw += chunk; if (Buffer.byteLength(raw) > 64 * 1024) throw new Error('Hook input is too large.'); }
-    const event = JSON.parse(raw);
+    const event = await readOrchestratorInput(process.stdin);
     const result = await callOrchestrator('hook', event);
     const output = result.deny ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: result.deny } }
       : result.updatedInput || result.context ? { hookSpecificOutput: { hookEventName: event.hook_event_name,
         ...(result.updatedInput ? { permissionDecision: 'allow', updatedInput: result.updatedInput } : {}),
         ...(result.context ? { additionalContext: result.context } : {}) } } : {};
-    process.stdout.write(`${JSON.stringify(output)}\n`);
-  } catch {
+    // __hook exits as soon as main returns. A large rewritten child prompt
+    // must reach the pipe before that exit, not stop partway through JSON.
+    await new Promise((resolve, reject) => process.stdout.write(`${JSON.stringify(output)}\n`, error => error ? reject(error) : resolve()));
+  } catch (error) {
     // Both CLIs interpret exit 2 as a tool refusal. A failed capability must
     // never let a native spawn escape the shared admission pool.
-    process.stderr.write('The run’s orchestration gate is unavailable. Keep the work in the orchestrator until it reconnects.\n');
+    process.stderr.write(error instanceof OrchestratorInputTooLarge ? `${error.message}\n`
+      : 'The run’s orchestration gate is unavailable. Keep the work in the orchestrator until it reconnects.\n');
     process.exitCode = 2;
   }
 }
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main();
+// Bun bundles this module at the virtual entrypoint too. Only cli.mjs may
+// dispatch it there; otherwise importing it consumes stdin before dispatch.
+if (!runningCompiledBinary() && process.argv[1] === fileURLToPath(import.meta.url)) await main();

package/bin/lib/orchestrator.mjs

@@ -10,6 +10,7 @@ import { DAEMON_INSTANCE, FLEET_URL } from './config.mjs';
 import { runningCompiledBinary } from './launchCommand.mjs';
 import { scrubNativeText } from './runtimeEvents.mjs';
 import { scrub, learnExtraSecrets, forgetExtraSecrets } from './uplinkScrub.mjs';
+import { OrchestratorInputTooLarge, readOrchestratorInput } from './orchestratorInput.mjs';
 
 const WAIT = 'Waiting for a free slot on the machine';
 // Codex 0.160 V2 serializes the namespace without punctuation in hook
@@ -224,11 +225,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   const server = createServer(async (req, res) => {
     if (closed || req.method !== 'POST' || req.url !== '/' || !sameSecret(req.headers.authorization, `Bearer ${capability}`)) { res.writeHead(403).end(); return; }
     try {
-      let raw = ''; for await (const chunk of req) { raw += chunk; if (Buffer.byteLength(raw) > 64 * 1024) throw new Error('Orchestration input is too large.'); }
-      const { action, args } = JSON.parse(raw);
+      const { action, args } = await readOrchestratorInput(req);
       const result = await handle(action, args ?? {});
       res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }).end(JSON.stringify(result));
-    } catch (error) { res.writeHead(409, { 'Content-Type': 'application/json' }).end(JSON.stringify({ error: text(error.message, 300) })); }
+    } catch (error) { res.writeHead(error instanceof OrchestratorInputTooLarge ? 413 : 409,
+      { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }).end(JSON.stringify({
+        error: text(error.message, 300), ...(error instanceof OrchestratorInputTooLarge ? { code: error.code } : {}),
+      })); }
   });
   server.requestTimeout = 5_000;
   await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });

package/bin/lib/orchestratorClient.mjs

@@ -1,12 +1,16 @@
 import { createInterface } from 'node:readline';
 import { ORCHESTRATOR_TOOLS } from './orchestratorProtocol.mjs';
+import { ORCHESTRATOR_REQUEST_BYTES, ORCHESTRATOR_INPUT_TOO_LARGE, OrchestratorInputTooLarge } from './orchestratorInput.mjs';
 
 export async function callOrchestrator(action, args) {
   const url = new URL(process.env.FLOWVIANT_ORCHESTRATOR_URL);
   if (url.hostname !== '127.0.0.1' || url.protocol !== 'http:') throw new Error('No held run is available.');
+  const body = JSON.stringify({ action, args });
+  if (Buffer.byteLength(body) > ORCHESTRATOR_REQUEST_BYTES) throw new OrchestratorInputTooLarge();
   const response = await fetch(url, { method: 'POST', headers: { Authorization: `Bearer ${process.env.FLOWVIANT_ORCHESTRATOR_CAPABILITY}`, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ action, args }), signal: AbortSignal.timeout(15_000) });
+    body, signal: AbortSignal.timeout(15_000) });
   const result = await response.json();
+  if (result.code === ORCHESTRATOR_INPUT_TOO_LARGE) throw new OrchestratorInputTooLarge();
   if (!response.ok) throw new Error(result.error ?? 'This run is no longer held.');
   return result;
 }

package/bin/lib/orchestratorInput.mjs

@@ -0,0 +1,47 @@
+// A whole-event memory guard, aligned with the authenticated API's 24 MiB
+// request budget. It is not an allowance on a prompt or tool-result field.
+export const ORCHESTRATOR_REQUEST_BYTES = 24 * 1024 * 1024;
+export const ORCHESTRATOR_INPUT_TOO_LARGE = 'ORCHESTRATOR_INPUT_TOO_LARGE';
+
+export class OrchestratorInputTooLarge extends Error {
+  constructor() {
+    super('The orchestration hook request exceeds the 24 MiB transport limit.');
+    this.code = ORCHESTRATOR_INPUT_TOO_LARGE;
+  }
+}
+
+/** Read bounded raw bytes before decoding: pipe/HTTP chunks can split UTF-8.
+ * On refusal, drain without buffering so HTTP can still return its reason. */
+export function readOrchestratorInput(stream) {
+  return new Promise((resolve, reject) => {
+    let chunks = [], bytes = 0;
+    const cleanup = () => {
+      stream.off('data', data); stream.off('end', end);
+      stream.off('error', fail); stream.off('close', closed);
+    };
+    const fail = error => {
+      cleanup(); chunks = [];
+      // The producer can abort after seeing the refusal. That late stream
+      // error must not crash the controller while the remainder is drained.
+      const ignore = () => {};
+      stream.on('error', ignore);
+      stream.once('close', () => stream.off('error', ignore));
+      stream.resume(); reject(error);
+    };
+    const closed = () => fail(new Error('The orchestration input closed before completion.'));
+    const data = chunk => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buffer.length;
+      if (bytes > ORCHESTRATOR_REQUEST_BYTES) { fail(new OrchestratorInputTooLarge()); return; }
+      chunks.push(buffer);
+    };
+    const end = () => {
+      cleanup();
+      try { resolve(JSON.parse(Buffer.concat(chunks, bytes).toString('utf8'))); }
+      catch (error) { reject(error); }
+      chunks = [];
+    };
+    stream.on('data', data); stream.once('end', end);
+    stream.once('error', fail); stream.once('close', closed);
+  });
+}

package/bin/lib/postureTools.mjs

@@ -45,6 +45,10 @@ const SUPPORTING_CAPABILITIES = `The kind defines the delivered product, not whi
 may be used. Use available tools needed for the person's request, including
 native image generation for requested textures or illustrations. A listed skill
 is not proof that its tool is installed, mounted or entitled on this account.
+Configuration and mount names do not prove a live MCP connection. Verify access
+with a non-mutating tool before claiming it works. If a call fails, relay its
+actual startup, approval or connection error and a concrete corrective step;
+an empty instance list means no connected instances, not missing tools.
 Do not re-file the kind or require a separate image card just to use a tool.
 If a needed tool is absent or fails, relay the measured limitation and ask for
 the missing configuration or a decision. A separately billed CLI/API fallback

package/bin/lib/projectTools.mjs

@@ -1,6 +1,6 @@
 /** Repo-owned tool configuration, read from the base ref for every agent turn. */
 import { accessSync, constants, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
+import { delimiter, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { git, gitRaw, splitNul } from './git.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
@@ -36,6 +36,19 @@ function onPath(command, env) {
   });
 }
 
+const relativeCommand = (command) => !isAbsolute(command) && command.includes('/');
+
+/** Repo launchers are not PATH commands. Measure the reviewed tree's mode,
+ * never an uncommitted executable in the checkout used to read that tree. */
+function reviewedExecutable(root, commit, command) {
+  const path = relative(resolve(root), resolve(root, command));
+  if (!path || path === '..' || path.startsWith('../') || isAbsolute(path)) return false;
+  try {
+    return splitNul(gitRaw(['ls-tree', '-z', commit, '--', path], root, SHOW))
+      .some((entry) => entry.startsWith('100755 blob ') && entry.slice(entry.indexOf('\t') + 1) === path);
+  } catch { return false; }
+}
+
 function referenced(value) {
   return [...String(value).matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
 }
@@ -101,9 +114,14 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
       for (const key of referenced(value)) vars.add(key);
     }
     const missing = [...vars].filter((key) => !env[key]).sort();
-    const commandMissing = typeof config.command === 'string' && !onPath(expand(config.command, env), env);
+    const command = typeof config.command === 'string' ? expand(config.command, env) : null;
+    const repoCommand = command != null && relativeCommand(command);
+    const commandMissing = command != null && !(repoCommand ? reviewedExecutable(root, commit, command) : onPath(command, env));
     const unsupported = typeof config.command !== 'string' && typeof config.url !== 'string';
-    const reason = missing.length ? `env ${missing.join(', ')} unset` : commandMissing ? `command ${config.command} not on PATH` : unsupported ? 'MCP configuration unsupported' : null;
+    const reason = missing.length ? `env ${missing.join(', ')} unset` : commandMissing
+      ? repoCommand ? `command ${config.command} is not an executable file in the base branch; commit the launcher with executable permission on base`
+        : `command ${config.command} not on PATH`
+      : unsupported ? 'MCP configuration unsupported' : null;
     return { name, config, state: reason ? 'missing' : 'ready', reason };
   });
   // Nested instructions are normally discovered when a CLI enters that path.
@@ -119,7 +137,7 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
     if (instructionBytes > MAX_INSTRUCTION_BYTES) throw new Error('Base branch agent instructions exceed the turn limit');
     instructions.push({ path, body });
   }
-  return { tools, skills, skillFiles, instructions };
+  return { tools, skills, skillFiles, instructions, root: resolve(root) };
 }
 
 const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
@@ -144,6 +162,11 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   const env = expansionEnv(callerEnv);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
+  // The CLI may read its config from a temporary directory, and Codex research
+  // changes cwd to an isolated copy. Keep repository launchers rooted at the
+  // agent worktree, not either of those directories or the daemon's checkout.
+  const launchRoot = worktree ?? snapshot.root;
+  const launchCommand = (command) => launchRoot && relativeCommand(command) ? resolve(launchRoot, command) : command;
   // What the base lists and this turn cannot mount, and why — the turn is told
   // (postureTools.mjs), so a missing server is a named fact, never a guess.
   const mcpUnmounted = snapshot.tools
@@ -152,7 +175,7 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   const mcpServers = {};
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
-      const command = expand(config.command, env);
+      const command = launchCommand(expand(config.command, env));
       const args = Array.isArray(config.args) ? config.args.map((v) => expand(v, env)) : [];
       const vars = Object.fromEntries(Object.entries(config.env ?? {}).map(([k, v]) => [k, expand(v, env)]));
       mcpServers[name] = { command, args, env: vars };
@@ -191,7 +214,10 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
     mcpUnmounted,
     /** The mount a fenced turn takes where the runner's file is ignored
      *  (`fencedMountFor`, projectToolRuntimes.mjs); null where it has none. */
-    fencedMount: fencedMountFor(runner, usable, (value) => expand(value, env), callerEnv),
+    fencedMount: fencedMountFor(runner, usable.map((entry) => ({ ...entry, config: {
+      ...entry.config,
+      ...(typeof entry.config.command === 'string' ? { command: launchCommand(entry.config.command) } : {}),
+    } })), (value) => expand(value, env), callerEnv),
     instructions,
     pluginDir,
     codexHome,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.2",
+  "version": "0.125.4",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {