flowviant 0.125.20 → 0.125.22

package/README.md

@@ -188,7 +188,17 @@ From **0.86.0**, a project whose owner turns on **Publish agent branches** has e
 
 You run your dev server yourself, in the session's own worktree, exactly as you would in any terminal. The daemon NOTICES the listening port; ask for a share in the app and it puts a [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) quick tunnel in front of it (auto-fetched if missing, pinned and checksummed), behind the daemon's own gate. Viewers reach the share through Flowviant's relay at `<name>.flowviant.dev`, never the tunnel's own address, and the gate admits only the share's password or a short-lived grant signed with the share's key. Flowviant stores that key and the password with the share, and its relay mints grants for signed-in project members — or for anyone with the link, if the share's owner opens it to everyone. Since 0.72.0 the gate also lets the Workbench embed the share in a frame: it rewrites the response's frame policy to permit exactly the app's origin, and a framed sign-in gets a partitioned cookie so it works where third-party cookies are blocked.
 
-The daemon never executes anything the repository declares. An earlier version read a `.flowviant/preview.json` from the branch and spawned the command it named — that start path was removed in 0.53.0 and is not coming back; see the header of `bin/lib/preview.mjs` for exactly what it did, so nobody rebuilds it.
+Sharing never starts a repository command. An earlier version read a `.flowviant/preview.json` from the branch and spawned the command it named — that sharing start path was removed in 0.53.0; see the header of `bin/lib/preview.mjs`.
+
+## Local UI self-review in code agents
+
+During a code build, the same agent can run a bounded local Chromium review before delivery. Its turn supplies the exact helper command and JSON-plan format. The agent chooses the repository-supported preview argv and dedicated port, names its script/configuration basis, and describes disposable fixtures. The runner starts that command inside the worktree with an isolated home and no inherited SDK credentials, measures its listener and process group, then checks HTTP readiness. It does not install a browser or dependencies, share a preview, or open a public tunnel.
+
+Each plan contains local routes and ordered CSS-selector actions (`click`, `fill`, `submit`, `waitFor`, `assertText`, `assertUrl`). Chromium uses fresh contexts for 1440×900 desktop and 390×844 mobile captures. Click/submit mean DOM activation; assertions establish the resulting state. A preview-only proxy and request fence block other destinations, popups, downloads, frames, workers and sockets. Apps requiring those capabilities must report the affected checks skipped or use a disposable fixture that works within this boundary. Repository code still executes as the user's UID; the runner is not a sandbox for a malicious backend or a substitute for choosing safe fixtures.
+
+On Claude Code and Codex build turns, `card_ui_review.inspect_screenshot` can supply an exact captured PNG as native image input. The agent must actually inspect the images and report what it saw, or report the runtime's image-input failure. A screenshot or image-input receipt alone never counts as a visual verdict. Other build CLIs can use their existing image tools if available and must name unavailable capabilities honestly.
+
+The agent can fix in-scope findings and rerun up to three attempts per turn, each capped at two minutes including startup. Every attempt stops its owned browser and preview, including on cancellation; teardown also tracks their process groups. Reports and screenshots use `.flowviant/artifacts/`, and the existing delivery Verification retains routes, viewports, actions/outcomes, scrubbed diagnostics and source identity. Tracked/nonignored file bytes and HEAD are remeasured at delivery; later changes mark evidence stale. Ignored build/runtime files are outside that source measurement. The project check, fresh read-only pre-review, human approval and merge remain separate.
 
 ## Modes
 

package/bin/cli.mjs

@@ -85,6 +85,19 @@ if (process.argv[2] === '__capture-mcp') {
   process.exit(process.exitCode ?? 0);
 }
 
+if (process.argv[2] === '__reference-mcp') {
+  await (await import('./lib/publicReferenceTool.mjs')).referenceToolMain();
+  // A screenshot can exceed the pipe buffer. EOF on the client's input must
+  // not truncate a completed result while stdout is still draining.
+  await new Promise(resolve => process.stdout.write('', resolve));
+  process.exit(process.exitCode ?? 0);
+}
+
+if (['__ui-review', '__ui-review-mcp'].includes(process.argv[2])) {
+  await (await import('./lib/uiReview.mjs')).uiReviewMain(process.argv[2] === '__ui-review-mcp');
+  process.exit(process.exitCode ?? 0);
+}
+
 if (process.argv[2] === '__orchestrator-mcp') {
   await (await import('./lib/orchestratorClient.mjs')).orchestratorMcpMain();
   process.exit(process.exitCode ?? 0);

package/bin/lib/agentCards.mjs

@@ -70,6 +70,24 @@ export function stashCard(path, taskId, spec) {
   }
 }
 
+/**
+ * WHAT THE AGENT SAID IT DID NOT DELIVER on a card (2026-10-25, turnGaps.mjs),
+ * kept beside the spec so the pre-review can read the request, the diff and
+ * the agent's own account of what is missing together. Same append rule; the
+ * reader keeps the last declaration per card.
+ */
+export function stashGaps(path, taskId, gaps) {
+  if (!path || !Array.isArray(gaps)) return false;
+  const id = String(taskId ?? '').trim();
+  if (!id) return false;
+  try {
+    appendFileSync(path, JSON.stringify({ taskId: id.slice(0, 64), gaps }) + '\n');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * What this box holds, newest spec per card, in the order the cards were worked.
  *
@@ -89,6 +107,7 @@ export function readStash(path) {
    *  order stays the order the cards were first handed out — which is the order
    *  the branch was built in, and the order a reviewer reads them in. */
   const byId = new Map();
+  const gapsById = new Map();
   for (const line of raw.split('\n')) {
     if (!line.trim()) continue;
     let v;
@@ -99,10 +118,14 @@ export function readStash(path) {
     }
     if (!v || typeof v !== 'object') continue;
     const taskId = typeof v.taskId === 'string' ? v.taskId.trim() : '';
+    if (taskId && Array.isArray(v.gaps)) {
+      gapsById.set(taskId, v.gaps);
+      continue;
+    }
     const prompt = typeof v.prompt === 'string' ? v.prompt : '';
     if (!taskId || !prompt.trim()) continue;
     byId.set(taskId, prompt);
   }
-  const all = [...byId].map(([taskId, prompt]) => ({ taskId, prompt }));
+  const all = [...byId].map(([taskId, prompt]) => ({ taskId, prompt, ...(gapsById.has(taskId) ? { gaps: gapsById.get(taskId) } : {}) }));
   return all;
 }

package/bin/lib/agentPlan.mjs

@@ -35,6 +35,7 @@ import { AGENT_TASK_KINDS } from './agentTaskKinds.mjs';
 import { blockedAnswer } from './agentAsk.mjs';
 import { isResearchUse } from './researchUse.mjs';
 import { candidateObjects } from './modelJson.mjs';
+import { parseGaps } from './turnGaps.mjs';
 
 /** The biggest a single proposal may be. Bounds on a machine, not a policy:
  *  the server caps these again at its own boundary. */
@@ -272,6 +273,8 @@ export function parseTurnResult(text, scrub = envScrub) {
         ...(typeof v.automation === 'string' && v.automation.trim()
           ? { automation: scrub(v.automation.trim()) } : {}),
         ...(parseTestFindings(v.testFindings, scrub) ? { testFindings: parseTestFindings(v.testFindings, scrub) } : {}),
+        // What it says it did not deliver (turnGaps.mjs): absent is unknown.
+        ...(parseGaps(v.gaps, scrub) ? { gaps: parseGaps(v.gaps, scrub) } : {}),
         ...progressOf(v, scrub),
         raised: Array.isArray(v.raised)
           ? v.raised

package/bin/lib/agentQueueContext.mjs

@@ -14,6 +14,9 @@ an order alone is not a declared dependency. requirements.status=missing is
 unavailable, never an empty brief. Discussions carry their existing omission
 counts and may be unavailable; do not treat a shortened discussion as full
 requirements. The brief and criteria marked full are supplied without clipping.
+sourceChats are the person's exact words in the New task chat these cards were
+planned in, up to each card's landing; a brief is the planner's paraphrase of
+them, and links, references and file lists there are part of the request.
 Human messages are exact recorded words across this agent, with the preceding
 question when present. taskId on a message is where it was recorded, not an
 implicit scope restriction. target.kind=agent explicitly addresses the whole
@@ -32,7 +35,9 @@ relying on an excluded decision; do not recover it from older native memory.
 Latest outcomes and progress are reported summaries, not complete specifications,
 proof that checks passed, human acceptance or evidence that bytes exist locally.
 Stored outputs name exact ids/turns/hashes, not a successful local read. Retained
-result selections preserve their exact scope. Use the active turn's measured
+result selections preserve their exact scope. localInputs lists the retained
+paths that exist in this worktree this turn; any other retained path named in
+the snapshot does not. Use the active turn's measured
 input manifest and prerequisite receipts before relying on files; never replace
 or regenerate missing selected inputs or assume queue knowledge discovers them.
 Only execute the active turn's assigned work. Upcoming cards are context, not
@@ -44,6 +49,20 @@ only relevant prior findings/decisions/input identities, not the entire queue.
 ${fence('AGENT QUEUE SNAPSHOT', context)}`;
 }
 
+/** THE CARD'S SOURCE CHAT, as words the pre-review reads beside its spec
+ * (2026-10-25): the stash is per card and the snapshot is gone by review
+ * entry, so the person's request is kept with the spec it shaped. Empty when
+ * the card landed from no chat (or the server sent no source chats). */
+export function sourceChatText(context, taskId) {
+  const chats = (context?.sourceChats?.chats ?? []).filter((c) => Array.isArray(c.taskIds) && c.taskIds.includes(taskId));
+  if (!chats.length) return '';
+  const said = chats.flatMap((c) => [
+    ...(c.messages ?? []).map((m) => `${m.answering ? `(answering: ${m.answering})\n` : ''}${m.body}`),
+    ...(c.omitted ? [`(${c.omitted} more message${c.omitted === 1 ? '' : 's'} omitted)`] : []),
+  ]);
+  return `\n\nTHE PERSON'S OWN WORDS (the New task chat this card was planned in; the brief above paraphrases them):\n${said.join('\n\n')}`;
+}
+
 /** The gate supplies active identity/fences, not upcoming work to a child.
  * Relevant findings still travel with the root's focused assignment. */
 export function agentChildScope(job) {

package/bin/lib/artifactContracts.mjs

@@ -82,6 +82,49 @@ is missing, so you lead:
   outside decision — stop and name exactly that dependency; a skip never
   supplies it.`;
 
+/**
+ * THE WHOLE REQUEST, NOT ONLY THE BRIEF (2026-10-25) — every agent contract
+ * closes on it, before HELP_THEM_DECIDE.
+ *
+ * Eighteen merged runs were audited and most delivered part of what was asked
+ * while every check passed: a Codex planner could not open a Claude Design
+ * file and wrote "use only the described controls as scope" into the brief;
+ * the Claude agent, which could open it, never tried; an agent recast the
+ * design states between its cards as "decisions"; another satisfied "measure
+ * the waits" with a timer it wrote. The brief is a paraphrase, the person's
+ * words now ride the queue snapshot (`sourceChats`), a reference the agent
+ * can open is the agent's to open, and the delivery says what is missing
+ * (`gaps`, turnGaps.mjs) instead of leaving the person to find it.
+ */
+export const WHOLE_REQUEST = `THE WHOLE REQUEST, NOT ONLY THE BRIEF:
+- A brief is a planner's paraphrase. When the queue snapshot carries
+  "sourceChats", those are the person's exact words from the chat this card
+  was planned in: read them before you start. Links, design references, file
+  lists and pasted text there are part of the request.
+- A REFERENCE YOU CAN OPEN, YOU OPEN. Read every design or reference that the
+  brief, the source chat, the card's discussion or the person's messages link
+  to before you build against it. A claude.ai/design link is read with a
+  DesignSync tool where your CLI offers one: load it (ToolSearch
+  "select:DesignSync"), then get_file the named file and its imports,
+  read-only, never its write methods. A brief that says a reference "could not be opened", "is
+  unavailable" or "use only X as scope" describes the planner's access, not
+  yours: try it yourself. If you still cannot read it, name it in "gaps" and
+  build nothing that depends on guessing what it contains.
+- COVER THE REQUEST, THEN SAY WHAT IS MISSING. Before you deliver, walk the
+  request: the source chat's words, every frame, state and rule a reference
+  you read shows or states, the brief and each "done when". Add "gaps" to the
+  delivered JSON object, one entry per item this card was meant to deliver
+  that you did not build ("not built"), built in part ("partly") or did not
+  check against the real thing ("unverified"), and per part of the request
+  that NO card in this run owns ("unowned"), so the person can file it:
+    "gaps": [{ "item": "what is missing", "status": "not built | partly | unverified | unowned", "why": "one sentence" }]
+  "gaps": [] says you walked the request and nothing is missing. Never recast
+  a gap as a decision: a choice you made in place of the request is a gap
+  ("partly") with its reason.
+- A "reproduce", "measure" or "verify" step is done only against the real
+  thing. A mock, timer or fixture you wrote yourself does not satisfy it:
+  list it as "unverified".`;
+
 /**
  * Rule 3, rule 4 and the final JSON a file-handing contract ends with.
  * `ask` is rule 4's body after its number (the decision only a person can
@@ -119,6 +162,8 @@ or, if you are stopping to ask:
 "progress" is REQUIRED on both shapes and REPLACES the previous one whole —
 past tense, plain sentences, no card ids.
 
+${WHOLE_REQUEST}
+
 ${HELP_THEM_DECIDE}`;
 
 /**
@@ -158,7 +203,54 @@ export const LOOK_HEADLESS = `${NO_WINDOW} To look at your page, screenshot it
  * so it posts to `parent` with `'*'`; the app accepts only its own frame's
  * messages. A page with no handshake (every 0.105.0 bundle) is still viewed;
  * it is just never offered a Download .glb.
+ *
+ * THE MANIFEST AND THE POSTER (2026-10-25, the owner's `Output Viewer Frame`;
+ * decision record `2026-10-25-flowviant-draws-standard-outputs`). Flowviant
+ * draws the exported GLB in its own viewer, and every control over it, so the
+ * page becomes a full-bleed canvas and its folder gains `view.json`, the
+ * manifest the web reads when present (packages/shared/src/modelViewer.ts —
+ * its literal here is `MODEL_VIEW_MANIFEST`, held to that schema by
+ * agentTaskKinds.test.mjs). It uploads on the general rule — an allowlisted
+ * type the turn changed is prepared and sent (intermediateArtifacts.mjs) — so
+ * only these words had been keeping it out. It proves no delivery: the page
+ * and its measured export still do.
+ *
+ * THE POSTER IS THE DAEMON'S RENDER OF THE PAGE (0.125.21). These words first
+ * asked the agent to screenshot its own `poster.png`, the still a list or a
+ * nested kit shows without loading a GLB; but a Claude model card cannot run
+ * Chrome under its fenced shell, and the daemon already renders every HTML
+ * artifact it uploads (artifactPreview.mjs `renderDesignPreview`), which the
+ * server stores as that artifact's preview. So the page's default view IS the
+ * poster, and the contract asks for that view instead: the whole model,
+ * full-bleed, nothing over it, standing within the render's few seconds.
+ * "poster" stays optional in the shape: a poster.png an agent already has
+ * still ships on the same general rule.
  */
+export const MODEL_VIEW_MANIFEST = `{
+  "kind": "map",
+  "title": "Street and metro map",
+  "entry": "street-metro-map/index.glb",
+  "poster": "street-metro-map/poster.png",
+  "view": {
+    "units": { "metre": 1, "unit": "m" },
+    "upAxis": "Y",
+    "front": "+Z",
+    "defaultView": "overview",
+    "views": [
+      { "id": "overview", "label": "Overview", "group": "overview", "direction": "iso" },
+      { "id": "plan", "label": "Plan", "group": "overview", "direction": "top" },
+      { "id": "konbini", "label": "Konbini", "group": "spot", "area": "Shops", "direction": "front", "part": "konbini" },
+      { "id": "north-platform", "label": "North platform", "group": "spot", "area": "Station",
+        "camera": { "position": [42, 6, -18], "target": [42, 1, -4] } }
+    ],
+    "layers": [
+      { "id": "konbini", "label": "Konbini", "part": "konbini" },
+      { "id": "station-platforms", "label": "Station platforms", "part": "station-platforms" }
+    ]
+  },
+  "parts": ["konbini", "station-platforms"]
+}`;
+
 export const SYSTEM_AGENT_MODEL = `You are the human's own Claude, working one 3D MODEL card in a git worktree of
 their repository. Nobody is watching this run. You have the repo and the tools
 TOOLS ON THIS CARD names below — no board, no chat.
@@ -177,8 +269,9 @@ WHAT TO DO:
 
 2. Write ONE viewer, .flowviant/artifacts/<kebab-name>/index.html — a short
    kebab-case name for what it is (for example
-   .flowviant/artifacts/reading-chair/index.html). Keep the viewer self-contained;
-   do not add scripts or notes in its folder. Flowviant materializes index.glb
+   .flowviant/artifacts/reading-chair/index.html). Keep the viewer self-contained:
+   beside it, its folder holds only the view.json below (and a poster.png, if
+   you already have one), never scripts or notes. Flowviant materializes index.glb
    beside this exact page before completing the card, through the handler below.
    Keep original generated texture PNGs elsewhere under .flowviant/artifacts/;
    preserve their bytes and material mapping. The page BUILDS
@@ -186,6 +279,9 @@ WHAT TO DO:
    - three.js as ES modules from cdn.jsdelivr.net/npm, through an import map
      for "three" and "three/addons/"; orbit controls, lights and a neutral
      ground. Nothing else loads from the network, and nothing can be sent.
+   - the page is the scene and nothing else: a full-bleed canvas, with no
+     title, panel, legend, button or text over the model. Flowviant draws
+     every control.
    - the model is ONE THREE.Group named for what it is, built from three.js
      geometry (lathe, extrude, tube, box and the rest, one mesh per part),
      with MeshStandardMaterial only. Colour, roughness and metalness are
@@ -228,6 +324,40 @@ WHAT TO DO:
 
    ${LOOK_HEADLESS}
 
+   THE PAGE'S DEFAULT VIEW IS THE POSTER FLOWVIANT SHOWS. Flowviant renders
+   this page itself when it uploads it, and that still is the model's picture
+   wherever the model is listed. So the page opens on the default view below:
+   the whole model, fitted full-bleed to the frame, with nothing over it — no
+   loading text, label or overlay — standing within a few seconds of load.
+   Take no poster yourself; a poster.png you already have may sit in the
+   folder, named in "poster" below.
+
+   Then write <kebab-name>/view.json — how Flowviant's viewer frames the
+   model, exactly in this shape (a map's, with every field):
+
+${MODEL_VIEW_MANIFEST.replace(/^/gm, '     ')}
+
+   "kind" is "model" for one object, "map" for a scene that places several
+   kits. "entry" is a path under .flowviant/artifacts/: this folder's
+   index.glb. "poster" is optional: name this folder's poster.png only when
+   the folder holds one; otherwise leave the field out. Declare "units"
+   once, as the size of the scene's unit in metres —
+   { "stud": 0.28, "unit": "m" } for a scene built in studs — and never
+   write units or any other text into the scene; Flowviant draws the scale
+   bar. "upAxis" is "Y" (three.js is Y-up); "front" is the side the model
+   faces: "+X", "-X", "+Z" or "-Z". "views": up to three "overview" views,
+   "defaultView" naming one; a map adds named "spot" views, each grouped
+   under its "area". A view looks from a "direction" ("iso", "top",
+   "front", "side" or "back") fitted to the whole scene or to one "part", or
+   from a "camera" position and target in scene units. "layers", for a map:
+   one per kit, its "part" the kit's scene node name exactly. "parts": every
+   node you name in code (.name, which GLTFExporter keeps); each "part"
+   above is one of them, spelled the same. A single model has no spots and
+   no layers: Flowviant gives it Display and Turntable. A label or area is a
+   few words, 40 characters at most; at most 40 views, 60 layers and 200
+   parts — a manifest past any limit is not read. The page's opening view
+   is the one "defaultView" names, so the poster and the viewer agree.
+
 ${ARTIFACT_CONTRACT_TAIL({
   ask: `If you cannot model it without a DECISION only a person can make — which of
    two directions, what size or style, which asset it stands beside — STOP AND

package/bin/lib/artifactIteration.mjs

@@ -1,4 +1,5 @@
 /** Explicit iteration relationships, plus measured local deletions. No model runs here. */
+import { REFERENCE_CAPTURE_FILE } from './referenceCaptureProtocol.mjs';
 import { constants, openSync, closeSync, fstatSync, readFileSync, lstatSync, unlinkSync, realpathSync, writeFileSync, renameSync, rmSync } from 'node:fs';
 import { join, dirname, resolve, sep } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -117,7 +118,7 @@ export function seenArtifacts(record, stored, present, bornAt = null) {
   let seen = record;
   if (!seen) {
     const since = Number.isFinite(bornAt)
-      ? stored.filter((a) => storedAt(a) >= bornAt).map((a) => a.name) : [];
+      ? stored.filter((a) => storedAt(a) >= bornAt && !REFERENCE_CAPTURE_FILE.test(a.name)).map((a) => a.name) : [];
     seen = since.some((n) => present.has(n)) ? new Set(since) : new Set();
   }
   return new Set([...seen, ...present].filter((n) => names.has(n) || present.has(n)));

package/bin/lib/artifactReporter.mjs

@@ -297,7 +297,7 @@ export function createArtifactReporter({
 
   /** Upload what this turn changed in `placeDir`. Resolves to the number of
    *  bodies SENT this call (delivered or held), for the tests and the log. */
-  const report = async ({ placeDir, before, sessionId, agentId, turnId, idle = false, requireStored = false, includeNames = null, requiredOutputs = null }) => {
+  const report = async ({ placeDir, before, sessionId, agentId, turnId, idle = false, requireStored = false, includeNames = null, requiredOutputs = null, referenceCapture = false }) => {
     if (!placeDir || (!sessionId && !agentId)) return 0;
     const changes = iterationChanges(placeDir, before);
     const protectedNames = imageRevisionProtection(before?.stored, before?.imageRevision);
@@ -347,7 +347,7 @@ export function createArtifactReporter({
       failures.push(`Required intermediate output ${name} is missing, unsafe or excluded from reporting; its handoff is unfinished.`);
     let n = 0;
     for (const entry of changed) {
-      const body = buildUpload(entry, { sessionId, agentId, turnId }, scrub, secretIn);
+      const body = buildUpload(entry, { sessionId, agentId, turnId, ...(referenceCapture ? { referenceCapture: true } : {}) }, scrub, secretIn);
       if (required.has(entry.name) && (!body?.bytes || body.withheld || body.fields.sha256 !== required.get(entry.name))) {
         failures.push(`Required intermediate output ${entry.name} is unreadable, withheld or changed since preparation. Restore its exact producer bytes and retry.`);
         continue;

package/bin/lib/artifacts.mjs

@@ -74,6 +74,7 @@
  * that cannot show an artifact must not have the CLI told it will.
  */
 
+import { REFERENCE_CAPTURE_MANIFEST, REFERENCE_CAPTURE_FILE } from './referenceCaptureProtocol.mjs';
 import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
@@ -305,7 +306,7 @@ export const artifactStoredName = (name) => name.split('/').map(safeArtifactName
  * re-sent exactly as it was first built (scrubbed once, never re-read from a
  * disk the agent may have changed since).
  */
-export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s, secretIn = () => null) {
+export function buildArtifactUpload(entry, { sessionId, agentId, turnId, referenceCapture = false }, scrub = (s) => s, secretIn = () => null) {
   const type = artifactTypeFor(entry.name);
   const fields = {
     ...(sessionId ? { sessionId } : { agentId }),
@@ -313,6 +314,9 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
     name: artifactStoredName(entry.name),
     bytes: String(entry.size),
   };
+  // Reserved evidence names are writable only by the measured browser
+  // consumer. Model-authored JSON cannot become a page-access measurement.
+  if (REFERENCE_CAPTURE_FILE.test(entry.name) && !referenceCapture) return { withheld: 'measured-reference-capture-only', fields };
   if (!type) return { fields, bytes: null }; // reported by name only
   const maxBytes = artifactMaxBytesFor(entry.name);
   if (entry.size > maxBytes) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
@@ -328,7 +332,10 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
     const secret = secretIn(bytes);
     if (secret) return { withheld: secret, fields };
   } else {
+    const original = bytes;
     bytes = Buffer.from(String(scrub(bytes.toString('utf8'))), 'utf8');
+    if (REFERENCE_CAPTURE_MANIFEST.test(entry.name) && !bytes.equals(original))
+      return { withheld: 'reference-capture-redaction', fields };
     // A redaction marker can be longer than the value it replaced.
     if (bytes.byteLength > maxBytes) {
       return { fields: { ...fields, bytes: String(bytes.byteLength), tooLarge: '1' }, bytes: null };

package/bin/lib/claudeStream.mjs

@@ -198,6 +198,7 @@ export function handleStreamLine(line, options) {
     for (const b of ev.message.content) {
       if (b.type === 'tool_result') onToolEvent?.(null, {}, {
         id: b.tool_use_id, result: true, isError: b.is_error === true,
+        toolSuccess: b.is_error !== true,
         ...(agentId ? { agentId } : {}),
         output: typeof b.content === 'string' ? b.content : Array.isArray(b.content) ? b.content.slice(0, 8).filter(x => x?.type === 'text' && typeof x.text === 'string').map(x => x.text).join('\n') : '',
         detail: typeof b.content === 'string' ? b.content : Array.isArray(b.content) ? b.content.filter(x => x?.type === 'text' && typeof x.text === 'string').map(x => x.text).join('\n') : '',
@@ -232,6 +233,12 @@ export function handleStreamLine(line, options) {
     // alias, and this is the CLI naming what it chose. See turnModel.mjs.
     const resolved = turnModelOf(ev.model);
     if (resolved) onModel?.(resolved);
+    if (Array.isArray(ev.tools)) for (const tool of ['WebSearch', 'WebFetch']) {
+      onToolEvent?.('WebsiteAccess', { method: 'capability', tool }, {
+        id: `website-capability:${tool}`, result: true,
+        website: { access: 'unknown', availability: ev.tools.includes(tool) ? 'advertised' : 'unknown' },
+      });
+    }
     if (Array.isArray(ev.skills) || typeof ev.session_id === 'string' || Array.isArray(ev.mcp_servers)) {
       onInit?.({
         skills: Array.isArray(ev.skills) ? ev.skills.map(String) : undefined,

package/bin/lib/codexFencedMount.mjs

@@ -109,7 +109,7 @@ const table = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
  * config.toml could not be read), and
  * `unmounted` `[{ name, reason, source: 'project' | 'machine', partial? }]`.
  */
-export function codexFencedMount(usable, expand, machineEnv, turnServers = {}) {
+export function codexFencedMount(usable, expand, machineEnv, turnServers = {}, { includeMachine = true } = {}) {
   const args = [];
   const childEnv = {};
   const mounted = [];
@@ -192,7 +192,7 @@ export function codexFencedMount(usable, expand, machineEnv, turnServers = {}) {
   }
 
   const projectNames = new Set([...usable.map((t) => t.name), ...ownNames]);
-  const personal = machineCodexServers(machineEnv);
+  const personal = includeMachine ? machineCodexServers(machineEnv) : [];
   for (const [name, server] of personal ?? []) {
     if (projectNames.has(name) || server.enabled === false) continue;
     if (typeof server.command !== 'string' && typeof server.url !== 'string') continue;

package/bin/lib/codexSubagents.mjs

@@ -11,6 +11,7 @@ import { CODEX_CHILD_THREAD_RE } from './conversationIds.mjs';
 import { followJsonl } from './jsonlTail.mjs';
 import { codexCollabUpdates, codexSpawnResult, statusOf } from './codexSubagentEvents.mjs';
 import { NATIVE_AGENT_TOOLS } from './nativeAgentTools.mjs';
+import { isSealedMessage } from './orchestratorNative.mjs';
 import { SUBAGENT_CAP } from './subagentBounds.mjs';
 
 const CODEX = NATIVE_AGENT_TOOLS.codex;
@@ -84,7 +85,7 @@ export function createCodexSubagentReader({ since = Date.now(), env = process.en
       if (!COLLAB_CALLS.includes(name)) return;
       let args;
       try { args = JSON.parse(p.arguments); } catch { return; }
-      calls.set(p.call_id, { name, args });
+      calls.set(p.call_id, { name, args, namespace: p.namespace });
       if (calls.size > 128) calls.delete(calls.keys().next().value);
       const id = targetId(args.target ?? args.id);
       if (id && name !== 'spawn_agent') {
@@ -122,7 +123,10 @@ export function createCodexSubagentReader({ since = Date.now(), env = process.en
       const title = args.task_name ?? args.description ?? output.agent_nickname ?? '';
       if (args.task_name) rememberTarget(args.task_name, id);
       if (typeof path === 'string') rememberTarget(path, id);
-      report({ id, kind: args.agent_type ?? '', title, brief: args.message ?? '', status: 'running', now: '' });
+      // A V2 message is ciphertext (orchestratorNative.mjs `isSealedMessage`):
+      // its words are unknown, so the child carries no brief rather than that.
+      const sealed = isSealedMessage(call.namespace ? `${call.namespace}.${call.name}` : call.name, args.message);
+      report({ id, kind: args.agent_type ?? '', title, ...(sealed ? {} : { brief: args.message ?? '' }), status: 'running', now: '' });
       return;
     }
     if (owner !== root && ev.type === 'response_item' && p.type === 'custom_tool_call') {

package/bin/lib/knowledgeFetch.mjs

@@ -21,17 +21,22 @@ export function knowledgeFetcher({ fleetUrl, token, userAgent, maxBytes = KNOWLE
   // A kept library item (0.97.0) is its sibling, `GET /fleet/library/:id` —
   // the same credential, the same shape, the same caps.
   const libraryBase = fleetEndpoint('library', fleetUrl);
-  return async (id, { library = false, preview = false, fileIndex = null } = {}) => {
+  // THE CAP IS THE FILE'S (2026-10-25): the sync holds a kept model under
+  // models/ or designs/ to 32 MiB (`knowledgeMaxFor`) and hands that cap here;
+  // this default alone turned every 20–32 MiB GLB into the over-cap sentinel,
+  // a failed hash on every poll, so a map the Library kept never reached an
+  // agent.
+  return async (id, { library = false, preview = false, fileIndex = null, maxBytes: cap = maxBytes } = {}) => {
     const suffix = preview ? '/preview' : Number.isSafeInteger(fileIndex) && fileIndex >= 0 ? `/file/${fileIndex}` : '';
     const res = await fetch(`${library ? libraryBase : base}/${encodeURIComponent(id)}${suffix}`, {
       headers: { Authorization: `Bearer ${token}`, 'User-Agent': userAgent },
       signal: AbortSignal.timeout(60_000),
     });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    if (Number(res.headers.get('content-length') ?? '0') > maxBytes) {
+    if (Number(res.headers.get('content-length') ?? '0') > cap) {
       // Returned rather than thrown: over the cap is a REFUSAL, permanent for
       // this rev, not a failure the backoff should keep retrying.
-      return Buffer.alloc(maxBytes + 1);
+      return Buffer.alloc(cap + 1);
     }
     return Buffer.from(await res.arrayBuffer());
   };

package/bin/lib/knowledgeFiles.mjs

@@ -217,7 +217,7 @@ export async function syncKnowledge({ checkoutDir, manifest, fetchFile, maxBytes
       sha256: f.sha256,
       bytes: f.bytes,
       maxBytes: knowledgeMaxFor(f.name, maxBytes),
-      fetch: () => fetchFile(f.id),
+      fetch: () => fetchFile(f.id, { maxBytes: knowledgeMaxFor(f.name, maxBytes) }),
     });
     // Stale or failed clears `ok` and is retried (a stale file is better than
     // a missing one until the retry lands); a refusal is listed as one.
@@ -299,7 +299,7 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
       sha256: it.sha256,
       bytes: it.bytes,
       maxBytes: itemMax,
-      fetch: () => fetchFile(it.id, { library: true }),
+      fetch: () => fetchFile(it.id, { library: true, maxBytes: itemMax }),
       beforeWrite: () => ensureLibraryParents(dir, it.path),
     });
     if (recordSyncState(result, entryState, it.path) === 'refused') {
@@ -317,7 +317,7 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
         sha256: it.preview.sha256,
         maxBytes: 2 * 1024 * 1024,
         oversizeFails: true,
-        fetch: () => fetchFile(it.id, { library: true, preview: true }),
+        fetch: () => fetchFile(it.id, { library: true, preview: true, maxBytes: 2 * 1024 * 1024 }),
         beforeWrite: () => ensureLibraryParents(dir, it.previewPath),
       });
       recordSyncState(result, previewState, it.previewPath);
@@ -335,7 +335,7 @@ async function syncLibrary({ dir, items, fetchFile, maxBytes, keep, result }) {
         sha256: String(f.sha256),
         bytes: f.bytes,
         maxBytes: knowledgeMaxFor(f.path, maxBytes),
-        fetch: () => fetchFile(it.id, { library: true, fileIndex: f.index }),
+        fetch: () => fetchFile(it.id, { library: true, fileIndex: f.index, maxBytes: knowledgeMaxFor(f.path, maxBytes) }),
         beforeWrite: () => ensureLibraryParents(dir, f.path),
       });
       if (recordSyncState(result, fileState, f.path) === 'refused') wanted[sub].delete(rel);