flowviant 0.125.29 → 0.125.31

package/bin/lib/fleet.mjs

@@ -276,6 +276,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     retirePreviews,
     shutdownPreviews,
     retireWorkSessions,
+    reconcileEnvironments,
     reportWorktrees,
     reconcileIdleArtifacts,
     reconcileLocalCleanup,
@@ -597,6 +598,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // winner is working in — absence would mean "somebody else won" instead of
     // "the tab closed".
     retireWorkSessions(roster.activeWorkSessions, roster.sessionsHeldElsewhere);
+    reconcileEnvironments();
     // Diffs somebody has open and is waiting on. Project-scoped rather than
     // per-session: `git show` runs from the repo ROOT, which can see a closed
     // tab's branch and a shipped commit on main alike.

package/bin/lib/linuxDesktopBridge.mjs

@@ -0,0 +1,62 @@
+/** Linux host helper: parent EOF owns the lifetime of its whole process group. */
+import { createInterface } from 'node:readline';
+import { openBridgePage } from './reviewBridge.mjs';
+import { openDesktopPage } from './reviewDesktop.mjs';
+import { heldToolArgv } from './heldTool.mjs';
+import { killGroup } from './processGroup.mjs';
+import { procStat } from './procStat.mjs';
+import { reviewDiagnostic } from './uiReviewBrowser.mjs';
+
+export function openLinuxDesktop({ command, cwd, env, timeoutMs, signal, onChild, onFrame, onChange }) {
+  return openBridgePage({ command: [process.execPath, ...heldToolArgv('__linux-desktop-bridge')], cwd, env, worktree: cwd,
+    configuration: { command, cwd, timeoutMs }, timeoutMs, signal, onChild, onFrame, onChange });
+}
+
+export async function linuxDesktopBridgeMain() {
+  // Never group-kill a caller's terminal if somebody manually invokes this
+  // private verb. The parent starts the helper detached as its group leader.
+  if (process.platform !== 'linux' || procStat(process.pid)?.pgrp !== process.pid) throw new Error('The desktop helper needs its own Linux process group.');
+  const controller = new AbortController();
+  let page, configuration, epoch = 0, closing = false;
+  const send = value => { if (!closing) process.stdout.write(JSON.stringify({ jsonrpc: '2.0', ...value }) + '\n'); };
+  const shutdown = () => {
+    if (closing) return;
+    closing = true; controller.abort(); page?.close();
+    // All native descendants inherit this group; this also reaps descendants
+    // of an app launcher after a killed daemon closes the private stdin pipe.
+    setTimeout(() => killGroup(process.pid), 50);
+  };
+  process.stdin.once('end', shutdown); process.stdin.once('error', shutdown);
+  process.stdout.once('error', shutdown);
+  process.once('SIGTERM', shutdown); process.once('SIGINT', shutdown);
+  let bytes = 0;
+  try {
+    for await (const line of createInterface({ input: process.stdin })) {
+      if (closing) break;
+      let request;
+      try {
+        bytes = Buffer.byteLength(line); if (bytes > 128 * 1024) throw new Error('Desktop helper request exceeds its byte bound.');
+        request = JSON.parse(line);
+        const { id, method, params } = request;
+        let result = {};
+        if (method === 'initialize') {
+          configuration = params.configuration;
+          if (params.protocol !== 1 || !configuration || !Array.isArray(configuration.command) || configuration.cwd !== params.worktree) throw new Error('Invalid scoped desktop initialization.');
+          result = { protocol: 1, isolation: 'owned-session', privateHandoff: true };
+        } else if (method === 'open' && configuration && !page) {
+          page = await openDesktopPage({ ...configuration, env: process.env, signal: controller.signal, detachedChildren: false,
+            onFrame: frame => send({ method: 'frame', params: { ...frame, epoch } }),
+            onChange: patch => send({ method: patch.ended ? 'ended' : 'failure', params: { epoch, message: patch.error } }) });
+        } else if (method === 'snapshot' && page) result = { ...await page.snapshot(), width: 1440, height: 900, epoch };
+        else if (method === 'act' && page) await page.act(params.input);
+        else if (method === 'privacy' && page) { await page.setPrivate(params.private); epoch = params.epoch; result = { epoch, drained: true }; }
+        else throw new Error('Unsupported desktop helper operation.');
+        send({ id, result });
+      } catch (error) { send({ id: request?.id, error: { message: reviewDiagnostic(error.message) } }); }
+    }
+  } finally {
+    shutdown();
+    // Do not return to cli.mjs's process.exit before the group cleanup runs.
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+}

package/bin/lib/managedBrowser.mjs

@@ -70,7 +70,7 @@ export async function createManagedBrowser({ wt, turnId, signal, onChild, openPa
   let lastRxAt = 0;
   let captures = 0;
   let observationEpoch = 0, pageEpoch = 0;
-  let pageOrigin = null, pageMeasured = null, statusPending = false, statusRetry = null;
+  let pageOrigin = null, pageMeasured = null, pageScope = null, statusPending = false, statusRetry = null;
   let handoff = null, handoffResult = null;
   let transportStarted = false;
   const controller = new AbortController();
@@ -88,7 +88,7 @@ export async function createManagedBrowser({ wt, turnId, signal, onChild, openPa
   };
   const change = patch => { status = { ...status, ...patch }; statusPending = true; flushStatus(); };
   const frame = message => { if (closed || stopped) return; lastFrame = message; flushStatus(); if (!statusPending) send(message); };
-  const release = () => { pageEpoch++; observationEpoch++; page?.close(); page = null; pageOrigin = null; pageMeasured = null; lastFrame = null; };
+  const release = () => { pageEpoch++; observationEpoch++; page?.close(); page = null; pageOrigin = null; pageMeasured = null; pageScope = null; lastFrame = null; };
   const endHandoff = reason => {
     if (!handoff) return;
     const active = handoff; handoff = null; clearTimeout(active.timer);
@@ -122,12 +122,15 @@ export async function createManagedBrowser({ wt, turnId, signal, onChild, openPa
     }
     return { content: [text({ page: shot.observation, diagnostics: shot.diagnostics, path: status.path, pendingOrigins: status.pendingOrigins, networkError: status.networkError, ...(artifact ? { artifact } : {}) }), { type: 'image', data: shot.data, mimeType: 'image/jpeg' }] };
   };
-  const call = async (name, input) => {
+  const requireModelControl = () => {
     if (closed || signal?.aborted) throw new Error('This browser turn has ended.');
     if (stopped) throw new Error('A person stopped the browser for this turn.');
     if (status.handoff && name !== 'handoff') throw new Error('The browser is waiting for a person. Continue other work or finish this invocation; the daemon will resume after the handoff.');
     if (status.mode === 'user') throw new Error('A person has control of the shared browser. Continue other work and retry after they return control.');
     if (busy) throw new Error('A browser action is already running.');
+  };
+  const call = async (name, input, scope = wt) => {
+    requireModelControl();
     busy = true;
     let openingNew = false;
     try {
@@ -141,22 +144,22 @@ export async function createManagedBrowser({ wt, turnId, signal, onChild, openPa
         const path = browserPath(input.path ?? '/');
         if (typeof input.fixture !== 'string' || input.fixture.trim().length < 12 || input.fixture.length > 2000) throw new Error('Describe the disposable test fixtures before opening the browser.');
         if (input.hostname != null && input.hostname !== 'localhost') throw new Error('The optional preview hostname must be localhost.');
-        const measured = measuredOrigin(wt, input.port, undefined, input.scheme);
+        const measured = measuredOrigin(scope, input.port, undefined, input.scheme);
         const upstreamUrl = new URL(measured);
         const connectHost = upstreamUrl.hostname === '[::1]' ? '::1' : upstreamUrl.hostname;
         if (input.hostname === 'localhost') upstreamUrl.hostname = 'localhost';
         const upstream = upstreamUrl.origin;
         if (!transportStarted) { transportStarted = true; openSocket(); }
-        if (!page || status.state !== 'live' || pageOrigin !== upstream || pageMeasured !== measured) {
+        if (!page || status.state !== 'live' || pageOrigin !== upstream || pageMeasured !== measured || pageScope !== scope) {
           openingNew = true;
-          release(); change({ state: 'starting', error: undefined, networkError: undefined, pendingOrigins: [], path });
+          release(); change({ state: 'starting', surface: 'browser', target: undefined, error: undefined, networkError: undefined, pendingOrigins: [], path });
           const opening = pageEpoch;
           page = await openPage({ origin: upstream, connectHost: input.hostname === 'localhost' ? connectHost : undefined, signal: controller.signal, stillOwned: () => {
-            try { return measuredOrigin(wt, input.port, undefined, input.scheme) === measured; } catch { return false; }
+            try { return measuredOrigin(scope, input.port, undefined, input.scheme) === measured; } catch { return false; }
           }, onFrame: message => { if (opening === pageEpoch) frame(message); },
             onChange: patch => { if (opening === pageEpoch && !closed && !stopped) change(patch.error ? { ...patch, state: 'error' } : patch); }, onChild });
           if (opening !== pageEpoch || closed || stopped) { page.close(); page = null; throw new Error('The browser turn has ended.'); }
-          pageOrigin = upstream; pageMeasured = measured;
+          pageOrigin = upstream; pageMeasured = measured; pageScope = scope;
         }
         await page.act({ type: 'navigate', path });
         change({ state: 'live' });
@@ -172,6 +175,39 @@ export async function createManagedBrowser({ wt, turnId, signal, onChild, openPa
       throw error;
     } finally { busy = false; }
   };
+  /** Runtime adapters share this transport, ownership and private handoff.
+   * The factory is daemon-owned; no raw desktop/debugging API crosses the relay. */
+  const openSurface = async ({ key, target, surface, open }) => {
+    requireModelControl();
+    if (!['desktop', 'engine'].includes(surface) || typeof key !== 'string' || key.length > 300 || !/^[A-Za-z0-9_-]{1,60}$/.test(target)) throw new Error('Invalid runtime surface.');
+    busy = true;
+    try {
+      if (!transportStarted) { transportStarted = true; openSocket(); }
+      if (!page || status.state !== 'live' || pageOrigin !== key) {
+        release(); change({ state: 'starting', surface, target, path: '/', error: undefined, networkError: undefined, pendingOrigins: [] });
+        const opening = pageEpoch;
+        const opened = await open({ signal: controller.signal, onChild,
+          onFrame: message => { if (opening === pageEpoch) frame(message); },
+          onChange: patch => {
+            if (opening !== pageEpoch || closed || stopped) return;
+            if (patch.ended) {
+              release(); change({ state: 'ended', mode: 'agent', private: false, handoff: undefined, error: undefined }); endHandoff('returned');
+            } else if (patch.error) change({ state: 'error', error: reviewDiagnostic(patch.error) });
+          } });
+        if (opening !== pageEpoch || closed || stopped) { opened.close(); throw new Error('The interactive turn has ended.'); }
+        page = opened; pageOrigin = key;
+        if (status.mode === 'user') beginHandoff();
+        if (status.private) await page.setPrivate(true);
+      }
+      change({ state: 'live' });
+      return await observe();
+    } catch (error) {
+      // Taking control while startup is finishing fences this model result;
+      // the newly opened app still belongs to the person holding the frame.
+      if (status.mode !== 'user') { release(); if (!closed && !stopped) change({ state: 'error', error: reviewDiagnostic(error.message) }); }
+      throw error;
+    } finally { busy = false; }
+  };
   const control = async msg => {
     if (msg.type !== 'control' || closed) return;
     if (msg.action === 'refresh') { if (msg.protocol === 2) status.protocol = 2; change({}); if (lastFrame) send(lastFrame); return; }
@@ -254,19 +290,23 @@ export async function createManagedBrowser({ wt, turnId, signal, onChild, openPa
         res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify(result));
       } catch (error) { res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ isError: true, content: [text(reviewDiagnostic(error.message))] })); }
     } });
-  learnExtraSecrets([held.capability]);
+  const secretKey = `browser:${held.capability.slice(0, 12)}`;
+  learnExtraSecrets(secretKey, [{ name: 'FLOWVIANT_BROWSER_CAPABILITY', value: held.capability }]);
   const close = async () => {
     if (closed) return;
     closed = true; signal?.removeEventListener('abort', abort);
     clearTimeout(reconnect); clearInterval(ping); clearTimeout(statusRetry); statusRetry = null; endHandoff('closed');
     controller.abort(); release(); change({ state: 'ended', mode: 'agent' });
     ws?.close(1000); held.server.close(); held.server.closeAllConnections();
-    forgetExtraSecrets([held.capability]);
+    forgetExtraSecrets(secretKey);
   };
   const abort = () => { void close(); };
   signal?.addEventListener('abort', abort, { once: true });
   if (signal?.aborted) await close();
   return { env: held.env, config: { command: process.execPath, args: held.args, env: held.env }, close,
+    open: (input, scope = wt) => call('open', input, scope), act: input => call('act', input), handoff: input => call('handoff', input), openSurface,
+    assertControl: requireModelControl,
+    stopSurface() { requireModelControl(); release(); change({ state: 'ended', mode: 'agent', private: false, handoff: undefined }); },
     async waitForHandoff() {
       for (;;) {
         const result = handoff ? await handoff.promise : handoffResult;

package/bin/lib/mergeBatch.mjs

@@ -65,7 +65,7 @@ export async function integrateMergeBatch({ spec, progress = {}, previousError,
   await report(states);
   for (const r of rows) {
     const stamp = resolve(r.wt, git(['rev-parse', '--git-path', 'flowviant-batch-setup'], r.wt));
-    if (!existsSync(stamp)) { await setup(r.repoRoot, r.wt); writeFileSync(stamp, 'ready'); }
+    if (!existsSync(stamp)) { await setup(r.repoRoot, r.wt, { baseRef: r.baseRef }); writeFileSync(stamp, 'ready'); }
   }
   const worktrees = rows.map((r) => ({ wt: r.wt, branch: r.branch, repoRoot: r.repoRoot }));
   if (spec.prMode && pr.ghReady()) throw new Error('This project merges through pull requests. GitHub CLI is not installed or signed in on this machine.');

package/bin/lib/nativeAgentTools.mjs

@@ -77,13 +77,20 @@ export const isClaudeStopTool = name => NATIVE_AGENT_TOOLS.claude.stop.includes(
 /** Both runtime hook spellings for the capture server. */
 export const captureToolName = name => String(name ?? '').match(/^(?:mcp__flowviant__|mcp[./]flowviant[./]|flowviant[./])([a-z_]+)$/)?.[1] ?? null;
 
+/** The card_orchestrator tools that start or continue a subagent on another
+ * CLI (2026-11-06, E7; orchestratorProtocol.mjs `CROSS_CLI_TOOLS`), and their
+ * bare name off either CLI's spelling of an MCP tool, or null. */
+export const CROSS_CLI_START_TOOLS = Object.freeze(['start_cli_agent', 'followup_cli_agent', 'stop_cli_agent']);
+export const crossCliToolName = name => String(name ?? '').match(/^(?:mcp__card_orchestrator__|mcp[./]card_orchestrator[./]|card_orchestrator[./])(start_cli_agent|followup_cli_agent|cli_agent_result|stop_cli_agent)$/)?.[1] ?? null;
+
 /** What the hook refuses while the controller is unreachable: every spawn and
- * follow-up the controller gates, and on a run whose children only read
- * (`children` 'read', a research card) a child's write or shell, which only
- * the controller can fence read-only. */
-export const GATED_TOOLS = Object.freeze([...SPAWN, ...FOLLOWUP]);
+ * follow-up the controller gates, a start or follow-up of a subagent on
+ * another CLI, and on a run whose children only read (`children` 'read', a
+ * research card) a child's write or shell, which only the controller can
+ * fence read-only. */
+export const GATED_TOOLS = Object.freeze([...SPAWN, ...FOLLOWUP, ...CROSS_CLI_START_TOOLS]);
 export const gatedSpawnEvent = (event, children = 'edit', readOnlyRun = false) => event?.hook_event_name === 'PreToolUse' &&
-  (GATED_TOOLS.includes(nativeName(event.tool_name)) ||
+  (GATED_TOOLS.includes(nativeName(event.tool_name)) || CROSS_CLI_START_TOOLS.includes(crossCliToolName(event.tool_name)) ||
     (readOnlyRun && (isChildWriteTool(event.tool_name) || Boolean(captureToolName(event.tool_name)) || /^(?:mcp__|mcp[./])/.test(String(event.tool_name)))) ||
     (children === 'read' && Boolean(event.agent_id) && (isChildWriteTool(event.tool_name) || isShellTool(event.tool_name))));
 

package/bin/lib/noWindowEnv.mjs

@@ -67,8 +67,10 @@ export function withoutWindows(env, browserHome = null) {
 /**
  * EVERY CLI CHILD THE DAEMON SPAWNS UNATTENDED, ONE RULE (2026-10-10, the
  * audit): no machine credential (machineEnv.mjs), and no way to a window
- * unless a person at the keyboard asked for one (`display: true`, a Terminal
- * tab's alone). It was composed by hand twice — a turn's `cliEnv`
+ * unless a person at the keyboard asked for one (a Terminal tab), or the
+ * runtime-review daemon leaf supplied its own private X display/authority.
+ * `display: true` is never used to inherit a personal display on a code-agent
+ * CLI. It was composed by hand twice — a turn's `cliEnv`
  * (runTurn.mjs) and the project check's `checkEnv` (workAgentCheck.mjs) — and
  * skipped outright by the two spawns the daemon makes for its own purposes:
  * the startup skills probe (runtimeCapabilities.mjs), whose `claude` started

package/bin/lib/orchestrator.mjs

@@ -11,9 +11,11 @@ import { scrub, learnExtraSecrets, forgetExtraSecrets } from './uplinkScrub.mjs'
 import { OrchestratorInputTooLarge, readOrchestratorInput } from './orchestratorInput.mjs';
 import { SAFE_POINT_AFTER_EDIT as AFTER_EDIT } from './orchestratorProtocol.mjs';
 import { MACHINE_MESSAGE_ROUTE_STATES, MESSAGE_ROUTE_FIELD_MAX, OPEN_MESSAGE_ROUTE_STATES, ORCHESTRATOR_SERVER } from './orchestratorProtocol.mjs';
-import { captureToolName, isChildWriteTool, isClaudeStopTool, isDiscoveryTool, isFollowupTool, isPersonQuestionTool, isShellTool, isSpawnTool } from './nativeAgentTools.mjs';
+import { captureToolName, crossCliToolName, isChildWriteTool, isClaudeStopTool, isDiscoveryTool, isFollowupTool, isPersonQuestionTool, isShellTool, isSpawnTool } from './nativeAgentTools.mjs';
 import { childBrain, childChoice, followupTarget, readOnlyShell, readSpawn, spawnReceipt, withChildContract } from './orchestratorNative.mjs';
 import { SETTLED_SUBAGENT_STATUSES, SUBAGENT_CAP, SUBAGENT_FIELD_CAPS } from './subagentBounds.mjs';
+import { readOnlyLookup, splitHold } from './splitGate.mjs';
+import { createCrossCliChildren, CROSS_CLI_ACTIONS, CROSS_CLI_RESULT_WAIT_MAX_S } from './crossCliChild.mjs';
 
 const WAIT = 'Waiting for a free slot on the machine';
 // A research card's children read inside its fence; the orchestrator alone writes and delivers.
@@ -35,7 +37,7 @@ const text = (s, n) => scrubNativeText(s, n, scrub);
  * on Codex, only for a model in `catalog`, the measured spawnable models.
  */
 export async function createOrchestrator({ turnId, runtime, trace, admit, request = fleetRequest, notify = () => false, taken = () => {},
-  interval = 500, hold = 60_000, clock = Date.now, scrubText = text, children = {}, readOnlyRun = null, signal, rootTools = null, assignmentContext = () => '' } = {}) {
+  interval = 500, hold = 60_000, clock = Date.now, scrubText = text, children = {}, readOnlyRun = null, signal, rootTools = null, assignmentContext = () => '', crossCli = null, listen = listenHeldTool } = {}) {
   // Consults belong to a held attempt, never to a card turn. This capability
   // is entirely local; it cannot report routes or borrow an agent principal.
   if (readOnlyRun && (!['plan', 'capture'].includes(readOnlyRun.scope) || !filled(readOnlyRun.id) ||
@@ -73,11 +75,16 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   const emit = update => {
     const id = resolve(update.id), prior = records.get(id) ?? { id };
     const reading = { ...prior, ...update, id };
+    // A nested child's parent is named natively; the trace knows its record.
+    if (typeof update.parent === 'string' && update.parent !== 'lead') reading.parent = resolve(update.parent);
     if (reading.namedKind) reading.kind = reading.namedKind;
     if (reading.namedTitle) reading.title = reading.namedTitle;
     records.set(id, reading); trace.agent(reading); return reading;
   };
   const release = id => { const a = records.get(resolve(id)); a?.release?.(); if (a) a.release = null; };
+  // Subagents on another CLI (crossCliChild.mjs): a code card's lead only.
+  const others = crossCli && !readOnlyRun ? createCrossCliChildren({ lead: runtime, ...crossCli, access, card, split: children.split ?? null,
+    emit, count: () => records.size, admit, announce: m => announce(m), interval }) : null;
   // A wake the root CLI did not take (stdin closed; Codex always) waits for
   // the root's next tool hook, where both CLIs read additionalContext.
   const announce = message => {
@@ -152,6 +159,9 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     const spawn = readSpawn(event);
     if (!spawn) return { deny: 'Give this native spawn a text prompt or message so the run can gate it.' };
     const { callId, brief } = spawn;
+    // A child that may edit files waits for the person's yes (splitGate.mjs).
+    const held = splitHold(children.split ?? null, event, spawn, { runtime, access });
+    if (held) return { deny: held };
     // Above the card's model or effort is refused before any record or slot.
     const chosen = childBrain(event, spawn, card);
     if (chosen.deny) return { deny: chosen.deny };
@@ -166,6 +176,8 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     if (!slot(id)) { a.denied = resumed ? 'resume' : 'spawn'; return { deny: `${WAIT}. Agent id: ${id}. Keep working yourself; you will be told when this spawn can be retried. Do not wait for a child that has not started.` }; }
     // Claude's SendMessage addresses a child by its Agent `name`, Codex V2 by its task name.
     for (const name of spawn.names) if (filled(name) && name.length <= 160) aliases.set(name, id);
+    // Admitted unasked as a read-only lookup: its file writes are refused below.
+    if (readOnlyLookup(children.split ?? null, event, spawn, access)) a.readOnly = true;
     start(a, a.title);
     // A cheaper model or lower effort than the card's is relayed on the child's
     // stream, and the parent is asked to say why in its own update.
@@ -303,11 +315,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
         if (!records.has(id)) return { deny: sealedRun ? `That names no agent in this run.${childContract()}` : 'Use the agent record id in your prompt.' };
         bind(child, id);
       }
+      if (child && crossCliToolName(ev.tool_name)) return { deny: 'Only the card’s lead starts or continues a subagent on another CLI. Return your work to it.' };
       // A sealed child that missed (or never got) its start's words reads
       // them here, whole: an earlier run's follow-up, or a CLI without the hook.
       if (child && !records.has(resolve(child)) && !isDiscoveryTool(ev.tool_name))
         return { deny: sealedRun ? `Register with your orchestrator before working.${childContract()}` : 'Before working, call card_orchestrator.register_agent with the agent record id in your prompt. Tool discovery is allowed.' };
       if ((child && access === 'read' || readOnlyRun) && isChildWriteTool(ev.tool_name)) return { deny: readOnlyRun ? 'This attempt only reads: no file writes.' : READ_ONLY_REFUSAL };
+      if (child && records.get(resolve(child))?.readOnly && isChildWriteTool(ev.tool_name)) return { deny: 'You started as a read-only lookup: no file writes. Return your findings to the orchestrator.' };
       if (rootTools && captureToolName(ev.tool_name)) {
         if (child || !rootSession || ev.session_id !== rootSession) return { deny: 'Only the top-level capture coordinator may call capture tools. Return findings to it.' };
         return rootTools.authorize(ev);
@@ -340,6 +354,7 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
       return held.length ? { ...result, context: [result.context, ...held].filter(Boolean).join('\n\n') } : result;
     }
     if (action === 'route_message') return route(args);
+    if (CROSS_CLI_ACTIONS.includes(action)) { if (!others) throw new Error('This run cannot start a subagent on another CLI.'); return others.handle(action, args); }
     const id = named(args.agentId);
     // A person’s answer starts a new CLI turn. The parent carries the earlier
     // question and native identity in its own conversation; relay that known
@@ -396,13 +411,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   };
   let listener;
   try {
-    listener = await listenHeldTool({ envPrefix: 'FLOWVIANT_ORCHESTRATOR', verb: '__orchestrator-mcp', requestTimeoutMs: 5_000,
+    listener = await listen({ envPrefix: 'FLOWVIANT_ORCHESTRATOR', verb: '__orchestrator-mcp', requestTimeoutMs: others ? (CROSS_CLI_RESULT_WAIT_MAX_S + 30) * 1000 : 5_000,
       capability, isClosed: ended, respond });
   } catch (error) { forgetExtraSecrets(secretKey); throw error; }
   const { server, env: heldEnv, args: argv } = listener;
   // The hook reads it to refuse a research child's write while this is down.
   const env = { ...heldEnv, FLOWVIANT_ORCHESTRATOR_CHILDREN: access,
-    ...(readOnlyRun ? { FLOWVIANT_ORCHESTRATOR_READ_ONLY: '1' } : {}) };
+    ...(readOnlyRun ? { FLOWVIANT_ORCHESTRATOR_READ_ONLY: '1' } : {}), ...(others?.offered().length ? { FLOWVIANT_ORCHESTRATOR_CROSS_CLI: others.offered().join(',') } : {}) };
   const timer = setInterval(() => {
     if (ended() || polling) return;
     polling = true;
@@ -426,7 +441,9 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     } finally { polling = false; }
   }, interval);
   timer.unref?.();
-  return { env, config: { command: process.execPath, args: argv, env }, handle,
+  // Codex's own MCP tool timeout sits above a result call's longest wait.
+  return { env, config: { command: process.execPath, args: argv, env, ...(others ? { toolTimeoutSec: CROSS_CLI_RESULT_WAIT_MAX_S + 30 } : {}) }, handle,
+    crossCli: () => others?.offered() ?? [],
     root(id) { if (typeof id === 'string') rootSession = id; },
     resolve,
     spawnResult(result) {
@@ -460,10 +477,10 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     async close(stopped = false) {
       if (closed) return;
       closed = true; clearInterval(timer);
-      rootTools?.close();
+      rootTools?.close(); others?.close();
       // Only an escalated question waits for the person; any other asked child ended with the run.
       for (const a of records.values()) { release(a.id); const q = questions.get(a.id);
-        if (!terminal(a.status) && !(a.status === 'asked' && !readOnlyRun && !stopped && q?.escalated && !q.answer)) emit({ id: a.id, status: 'stopped', now: stopped ? 'Stopped with the run' : 'Run ended' }); }
+        if (!terminal(a.status) && !(!stopped && others?.asking(a.id)) && !(a.status === 'asked' && !readOnlyRun && !stopped && q?.escalated && !q.answer)) emit({ id: a.id, status: 'stopped', now: stopped ? 'Stopped with the run' : 'Run ended' }); }
       server.close(); server.closeAllConnections();
       forgetExtraSecrets(secretKey);
     },

package/bin/lib/orchestratorClient.mjs

@@ -1,4 +1,4 @@
-import { ORCHESTRATOR_TOOLS } from './orchestratorProtocol.mjs';
+import { CROSS_CLI_TOOLS, ORCHESTRATOR_TOOLS } from './orchestratorProtocol.mjs';
 import { ORCHESTRATOR_REQUEST_BYTES, ORCHESTRATOR_INPUT_TOO_LARGE, OrchestratorInputTooLarge } from './orchestratorInput.mjs';
 import { serveMcpStdio } from './mcpStdio.mjs';
 
@@ -25,6 +25,12 @@ export async function callOrchestrator(action, args, timeoutMs = ORCHESTRATOR_CL
   return result;
 }
 
+/** A result call waits up to its own waitSeconds (crossCliChild.mjs), past the usual bound. */
+export const callTimeoutFor = (action, args) => action === 'cli_agent_result'
+  ? (Math.min(Math.max(Number(args?.waitSeconds) || 60, 0), 300) + 15) * 1000 : ORCHESTRATOR_CLIENT_TIMEOUT_MS;
+
 export function orchestratorMcpMain() {
-  return serveMcpStdio({ serverInfo: { name: 'card-orchestrator', version: '2' }, tools: ORCHESTRATOR_TOOLS, call: callOrchestrator });
+  // Includes stop_cli_agent; all four child actions relay through this capability.
+  const tools = process.env.FLOWVIANT_ORCHESTRATOR_CROSS_CLI ? [...ORCHESTRATOR_TOOLS, ...CROSS_CLI_TOOLS] : ORCHESTRATOR_TOOLS;
+  return serveMcpStdio({ serverInfo: { name: 'card-orchestrator', version: '2' }, tools, call: (action, args) => callOrchestrator(action, args, callTimeoutFor(action, args)) });
 }

package/bin/lib/orchestratorPrompt.mjs

@@ -1,5 +1,6 @@
 import { TESTS_SCOPE } from './testFindingsContract.mjs';
 import { SAFE_POINT_AFTER_EDIT } from './orchestratorProtocol.mjs';
+import { splitContract } from './splitGate.mjs';
 
 /**
  * THE POSTURES A MARKED CARD IS ORCHESTRATED IN, and what their children may
@@ -49,7 +50,10 @@ const CHILD_SPELLING = {
 const atCard = (model, effort) =>
   `This card runs on ${model ? model : 'its CLI’s default model'} at ${effort ? `${effort} effort` : 'its CLI’s default effort'}.`;
 
-const childBrain = ({ runtime, model, effort }) => `CHILD MODEL AND EFFORT. ${atCard(model, effort)} By default every child runs at the card's model and effort${model || effort ? '; the gate names them when your spawn names neither, so a child never falls back to the CLI\'s own global default' : ', which it inherits from this run when your spawn names neither'}. For a simple, well-bounded child — a search, a sweep of file reads, a mechanical edit — you may choose a cheaper model or a lower effort. Keep the card's model and effort for hard or judgment-heavy work. Never choose a model or effort above the card's, and only models of this card's own CLI; the gate refuses an effort above the card's. ${CHILD_SPELLING[runtime] ?? ''} When you choose anything other than the card's model or effort for a child, name the choice and why in your update.`.replace('  ', ' ');
+/** Another CLI's children (E7, crossCliChild.mjs), where the controller offers them. */
+const CROSS_CLI_SPELLING = 'start_cli_agent starts a child on another CLI, at a model and effort of that CLI no higher than the card\'s effort; use it only for a batch the person put on that CLI';
+
+const childBrain = ({ runtime, model, effort, crossCli = [] }) => `CHILD MODEL AND EFFORT. ${atCard(model, effort)} By default every child runs at the card's model and effort${model || effort ? '; the gate names them when your spawn names neither, so a child never falls back to the CLI\'s own global default' : ', which it inherits from this run when your spawn names neither'}. For a simple, well-bounded child — a search, a sweep of file reads, a mechanical edit — you may choose a cheaper model or a lower effort. Keep the card's model and effort for hard or judgment-heavy work. Never choose a model or effort above the card's, and only models of this card's own CLI${crossCli.length ? ` for a native child (${CROSS_CLI_SPELLING})` : ''}; the gate refuses an effort above the card's. ${CHILD_SPELLING[runtime] ?? ''} When you choose anything other than the card's model or effort for a child, name the choice and why in your update.`.replace('  ', ' ');
 
 /** Investigators do not propose separate plans. Only this coordinator sees
  * and reconciles the complete selection before the existing JSON validator. */
@@ -126,15 +130,19 @@ ${childBrain(brain).replaceAll('card', 'capture turn')}`;
  * rules, the card's own model and effort, then the gate, routing and child
  * prompt rules every orchestrated card shares.
  */
-export function orchestratorContract({ posture = 'build', taskType = null, runtime = 'claude', model = null, effort = null } = {}) {
+export function orchestratorContract({ posture = 'build', taskType = null, runtime = 'claude', model = null, effort = null, split = null, crossCli = [] } = {}) {
   const reads = ORCHESTRATED_POSTURES[posture] === 'read';
+  // The person's yes before children edit files (splitGate.mjs): a research
+  // card's children only read, so nothing there waits or is proposed.
+  const asks = reads ? '' : splitContract(split, { runtime, model, effort, crossCli });
   return `CARD ORCHESTRATOR — this applies to this card's one CLI and worktree.
 You are the model the person chose and remain responsible for the card and its final JSON.
 When an agent queue snapshot is supplied, use it across resumed and fresh turns. Execute only the active card. A person's instruction keeps its stated scope across later cards; its recorded card is provenance, not an implicit target. Give each child a focused assignment with relevant prior findings, decisions and exact prerequisite references. Upcoming work never expands a child's assignment or the active card's product/write contract.
-${SPLIT}${reads ? '' : `\n${SHARED_FIRST}`}${taskType === 'tests' ? `\n${TESTS_SCOPE} Give every child this Tests scope explicitly.` : ''}${reads ? `\n${RESEARCH}` : ''}
-${childBrain({ runtime, model, effort })}
+${SPLIT}${reads ? '' : `\n${SHARED_FIRST}`}${asks ? `\n${asks}` : ''}${taskType === 'tests' ? `\n${TESTS_SCOPE} Give every child this Tests scope explicitly.` : ''}${reads ? `\n${RESEARCH}` : ''}
+${childBrain({ runtime, model, effort, crossCli })}
+${crossCli.length ? 'SUBAGENTS ON ANOTHER CLI. Use start_cli_agent for another CLI, cli_agent_result to read it, followup_cli_agent to continue by its agentId or key even in a later turn, and stop_cli_agent to interrupt just that child. A lost native session refuses in words. An asking result carries a question and options: answer with followup_cli_agent from known facts, or end your own turn through the existing person-question path. Never route a child question directly to the person. Research children only read and return findings; they never edit files.' : ''}
 
-The daemon gates every native spawn against this project's Turns at once pool, shared with its other turns. Claude children run in the background so you remain available for messages and their questions; Codex spawns are already asynchronous. A refused spawn with a waiting id has not started. Keep working yourself; do not wait for it. When notified of a free slot, retry its native spawn (the same or a reworded prompt) or its native follow-up; the slot is held for about a minute, then offered again later. Never bypass this gate with another CLI process. The orchestrator itself also holds a slot. If no slot becomes available, finish the work yourself.
+The daemon gates every native spawn against this project's Turns at once pool, shared with its other turns. Claude children run in the background so you remain available for messages and their questions; Codex spawns are already asynchronous. A refused spawn with a waiting id has not started. Keep working yourself; do not wait for it. When notified of a free slot, retry its native spawn (the same or a reworded prompt) or its native follow-up; the slot is held for about a minute, then offered again later. Never bypass this gate with another CLI process${crossCli.length ? '; start_cli_agent is not one: its child takes a slot from this same pool and waits while none is free' : ''}. The orchestrator itself also holds a slot. If no slot becomes available, finish the work yourself.
 On Claude you may end your turn while native children run: Claude keeps this process alive and wakes you on each child's completion and on the person's notes. Follow-ups and answers to a Claude child go through SendMessage to its agent id. Write the card's final JSON only after every child has finished or been stopped; your last answer is the card's answer.
 
 The card_orchestrator MCP tools report routing and child questions. A live person’s note has a Message id. Report each note using route_message:

package/bin/lib/orchestratorProtocol.mjs

@@ -34,4 +34,22 @@ export const ORCHESTRATOR_TOOLS = [
   { name: 'answer_agent', description: 'Answer a child question from known facts, or mark it for escalation to the person. An escalation returns the attribution to put on the existing blocked question card.',
     inputSchema: { type: 'object', properties: { agentId: { type: 'string' }, answer: { type: 'string' }, escalate: { type: 'boolean' },
       question: { type: 'string' }, nativeAgentId: { type: 'string' }, kind: { type: 'string' }, title: { type: 'string' } }, required: ['agentId'], additionalProperties: false } },
+
+];
+
+/** SUBAGENTS ON ANOTHER CLI (2026-11-06, D21, E7; crossCliChild.mjs): listed
+ *  only on a run that may start one (`FLOWVIANT_ORCHESTRATOR_CROSS_CLI`, the
+ *  CLIs offered). The daemon starts and fences the child itself. */
+export const CROSS_CLI_TOOLS = [
+  { name: 'start_cli_agent', description: 'Start a subagent on another CLI than yours (claude or codex) in this card\'s worktree, for a part of the card the person approved for that CLI. Returns its agentId at once; it works in the background. Read its outcome with cli_agent_result. The daemon fences it with the card\'s posture for that CLI; it cannot start subagents of its own.',
+    inputSchema: { type: 'object', properties: { cli: { enum: ['claude', 'codex'] }, title: { type: 'string' }, kind: { type: 'string', description: 'Backend, UI, Tests or the area of work.' },
+      brief: { type: 'string', description: 'The whole assignment: the part, the files it owns, the shared code it must not change, and what to return.' },
+      model: { type: 'string', description: 'A model of that CLI; leave it out for the person\'s batch choice or the default.' }, effort: { type: 'string' } },
+    required: ['cli', 'title', 'kind', 'brief'], additionalProperties: false } },
+  { name: 'followup_cli_agent', description: 'Send a finished subagent on another CLI a follow-up in its own conversation. Use the same agentId or stable key across turns. Refused while it is still working; a missing native session refuses in words. Returns at once; read it with cli_agent_result.',
+    inputSchema: { type: 'object', properties: { agentId: { type: 'string' }, message: { type: 'string' } }, required: ['agentId', 'message'], additionalProperties: false } },
+  { name: 'cli_agent_result', description: 'Wait up to waitSeconds (at most 300) for a subagent on another CLI, then return its status (waiting, running, done, asking, stopped or limited), the model and effort its own session names, its final message as result, the files it changed and the CLI\'s own words on a failure or plan limit.',
+    inputSchema: { type: 'object', properties: { agentId: { type: 'string' }, waitSeconds: { type: 'number', minimum: 0, maximum: 300 } }, required: ['agentId'], additionalProperties: false } },
+  { name: 'stop_cli_agent', description: 'Interrupt only this child, then kill its process group after the grace period if needed. Records stopped and releases its slot. Its files and conversation remain.',
+    inputSchema: { type: 'object', properties: { agentId: { type: 'string' } }, required: ['agentId'], additionalProperties: false } },
 ];

package/bin/lib/outsideCli.mjs

@@ -0,0 +1,124 @@
+/**
+ * A LEAD THAT SHELLS OUT TO ANOTHER CLI IS SHOWN, TAGGED "OUTSIDE" (D23,
+ * 2026-11-06, S4.6). `codex exec …` or `claude -p …` from a card's shell is
+ * a second model working on the card, and the person sitting at the keyboard
+ * would see it start. It is not one of the CLI's own subagents: it is never
+ * blocked, never counted toward the 32 and never given a subagent record.
+ * Each one is an `outside` row on the turn's trace (trace.mjs `outside`).
+ *
+ * THE MATCHER IS SMALL AND CONSERVATIVE ON PURPOSE. It reads only the first
+ * command of the line, after leading `cd … &&` steps, environment
+ * assignments and an `env`, inside one `bash -lc '…'` wrapper (Codex's exec
+ * spelling): its first word is `codex` with `exec`/`e`, `claude` with
+ * `-p`/`--print`, or `gemini`, directly or through `npx`/`bunx`/`pnpm dlx`/
+ * `npm exec` of that CLI's package. A pipeline, a loop or a script that
+ * starts one is not recognized: an unmatched line is an ordinary command,
+ * which the lead's stream relays as it always did. The asked model is what
+ * the command names (`--model`/`-m`); what ran is that CLI's business.
+ */
+
+const PACKAGES = Object.freeze({
+  '@openai/codex': 'codex',
+  '@anthropic-ai/claude-code': 'claude',
+  '@google/gemini-cli': 'gemini',
+});
+const RUNNERS = new Set(['npx', 'bunx']);
+const MODEL_RE = /^[A-Za-z0-9._:\-/]{1,80}$/;
+
+/** Shell words, with quotes honored and no expansion. */
+function words(line) {
+  const out = [];
+  let word = '', quote = null, any = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else if (ch === '\\' && quote === '"' && i + 1 < line.length) word += line[++i];
+      else word += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; any = true; continue; }
+    if (ch === '\\' && i + 1 < line.length) { word += line[++i]; any = true; continue; }
+    if (/\s/.test(ch)) { if (word || any) out.push(word); word = ''; any = false; continue; }
+    word += ch;
+  }
+  if (word || any) out.push(word);
+  return out;
+}
+
+/** The first command of a line, past `cd … &&`/`;` steps, as words. */
+function firstCommand(line) {
+  let text = String(line ?? '').trim();
+  const wrapped = text.match(/^(?:\S*\/)?(?:bash|sh|zsh)\s+-l?c\s+(['"])([\s\S]*)\1$/);
+  if (wrapped) text = wrapped[2].trim();
+  for (const step of text.split(/\s*(?:&&|;)\s*/)) {
+    const w = words(step);
+    if (!w.length || w[0] === 'cd' || w[0] === 'pushd') continue;
+    let i = 0;
+    if (w[i] === 'env') i++;
+    while (i < w.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(w[i])) i++;
+    return w.slice(i);
+  }
+  return [];
+}
+
+const base = word => String(word ?? '').split('/').at(-1);
+
+/** `{ cli, model? }` when the command starts another CLI, else null. */
+export function matchOutsideCli(command) {
+  let w = firstCommand(Array.isArray(command) ? command.join(' ') : command);
+  // A package runner names the CLI by its package.
+  const runner = base(w[0]);
+  const dlx = (runner === 'pnpm' && w[1] === 'dlx') || (runner === 'npm' && w[1] === 'exec');
+  let cli = null;
+  if (RUNNERS.has(runner) || dlx) {
+    let i = dlx ? 2 : 1;
+    while (i < w.length && w[i].startsWith('-')) i++;
+    cli = PACKAGES[String(w[i] ?? '').replace(/(?<=.)@[^/]*$/, '')] ?? null;
+    if (!cli) return null;
+    w = [cli, ...w.slice(i + 1).filter(x => x !== '--')];
+  } else cli = ['codex', 'claude', 'gemini'].includes(base(w[0])) ? base(w[0]) : null;
+  if (!cli) return null;
+  const args = w.slice(1);
+  if (cli === 'codex' && !['exec', 'e'].includes(args[0])) return null;
+  if (cli === 'claude' && !args.some(a => a === '-p' || a === '--print')) return null;
+  let model = null;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === '--model' || a === '-m') model = args[i + 1] ?? null;
+    else if (a.startsWith('--model=')) model = a.slice(8);
+  }
+  return { cli, ...(model && MODEL_RE.test(model) ? { model } : {}) };
+}
+
+/**
+ * The lead's tool events, watched for Outside rows. `observe` takes the
+ * same (name, input, meta) the lane's tool sink does: a shell call opens a
+ * row by its call id, its result settles it. A background shell's result is
+ * only its launch, so its row keeps no status it cannot know.
+ */
+export function createOutsideRuns(trace) {
+  const open = new Map();
+  return {
+    observe(name, input, meta) {
+      if (!meta?.id) return;
+      if (meta.result) {
+        if (!open.has(meta.id)) return;
+        const background = open.get(meta.id);
+        open.delete(meta.id);
+        if (background) return;
+        const failed = meta.isError === true || (Number.isInteger(meta.exitCode) && meta.exitCode !== 0);
+        trace.outside(meta.id, { status: failed ? 'failed' : 'done' });
+        return;
+      }
+      if (name !== 'Bash' || typeof input?.command !== 'string' && !Array.isArray(input?.command)) return;
+      const match = matchOutsideCli(input.command);
+      if (!match) return;
+      const background = input.run_in_background === true;
+      open.set(meta.id, background);
+      if (open.size > 64) open.delete(open.keys().next().value);
+      trace.outside(meta.id, { ...match, command: Array.isArray(input.command) ? input.command.join(' ') : input.command,
+        ...(background ? {} : { status: 'running' }) });
+    },
+  };
+}