flowviant 0.125.3 → 0.125.5

package/bin/lib/claudePersonal.mjs

@@ -46,9 +46,9 @@
  * swept on the next write.
  */
 import { randomBytes } from 'node:crypto';
-import { chmodSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { MACHINE_CREDENTIAL_ENV } from './machineEnv.mjs';
 import { WINDOW_ENV_REMOVED, withoutWindows } from './noWindowEnv.mjs';
 
@@ -141,6 +141,56 @@ export function personalClaudeSettings(env = process.env) {
   return out;
 }
 
+/** Far past any real CLI config — `.claude.json` also holds every project's
+ *  history; a bigger one is not read. */
+const CLI_CONFIG_MAX_BYTES = 32 * 1024 * 1024;
+const isRecord = (v) => v != null && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * THE MACHINE'S OWN MCP SERVERS THAT A CARD TURN'S SETTINGS SOURCES NEVER
+ * REACH (2026-10-17). The 2026-10-11 ruling mounts "the user and local
+ * servers" on every card turn, and neither arrived where the person keeps
+ * them. MEASURED on Claude Code 2.1.302, a scratch CLAUDE_CONFIG_DIR whose
+ * `.claude.json` held one user and one local server:
+ *  · `--setting-sources ''` (every fenced posture: write-up, mockup, 3D model,
+ *    deck) loaded NEITHER — a research card on the owner's box saw the
+ *    claude.ai connectors and no Roblox_Studio, a user-scope server;
+ *  · `--setting-sources user` (a code card) loaded the user server only;
+ *  · a local server is keyed on the git root it was added from (`claude mcp
+ *    add`'s default scope), which is the person's checkout — never the
+ *    agent's worktree, so no card turn could see one even with every source.
+ * So the lane names what is missing and the adapter hands it over through a
+ * private `--mcp-config` file (runtimeClaude.mjs): `user` when the turn's
+ * sources drop the user scope, and the checkout's local servers always. A
+ * local name shadows a user one, the CLI's own precedence; an `--mcp-config`
+ * server beat a user server of the same name (measured), so a code card keeps
+ * that order too. `{}` when the file is absent, unreadable or not an object.
+ */
+export function machineMcpServers({ user = false, checkout = null, env = process.env } = {}) {
+  const path = env.CLAUDE_CONFIG_DIR ? join(env.CLAUDE_CONFIG_DIR, '.claude.json') : join(env.HOME || homedir(), '.claude.json');
+  let raw;
+  try {
+    if (statSync(path).size > CLI_CONFIG_MAX_BYTES) return {};
+    raw = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return {};
+  }
+  if (!isRecord(raw)) return {};
+  const out = {};
+  const take = (servers) => {
+    if (!isRecord(servers)) return;
+    for (const [name, config] of Object.entries(servers)) if (name !== '__proto__' && isRecord(config)) out[name] = config;
+  };
+  if (user) take(raw.mcpServers);
+  if (typeof checkout === 'string' && checkout && isRecord(raw.projects)) {
+    const keys = [resolve(checkout)];
+    try { keys.push(realpathSync(checkout)); } catch { /* the resolved path alone */ }
+    const key = keys.find((k) => Object.hasOwn(raw.projects, k));
+    if (key) take(raw.projects[key]?.mcpServers);
+  }
+  return out;
+}
+
 /** Where a fenced turn's settings file lives — the daemon's own state
  *  directory, private to this user. */
 export const turnSettingsDir = () => join(homedir(), '.flowviant', 'run');
@@ -182,11 +232,12 @@ export function writeTurnSettings(settings, { dir = turnSettingsDir() } = {}) {
   }
 }
 
-/** Remove the settings file a turn's argv names, when it is one of ours. */
+/** Remove the settings file a turn's argv names, when it is one of ours — and
+ *  the machine-MCP file (`machineMcpServers`), written the same way. */
 export function releaseTurnSettings(args, { dir = turnSettingsDir() } = {}) {
   if (!Array.isArray(args)) return;
   args.forEach((a, i) => {
-    if (i === 0 || args[i - 1] !== '--settings' || typeof a !== 'string') return;
+    if (i === 0 || !['--settings', '--mcp-config'].includes(args[i - 1]) || typeof a !== 'string') return;
     if (dirname(a) !== dir || !TURN_SETTINGS_FILE.test(basename(a))) return;
     rmSync(a, { force: true });
   });

package/bin/lib/postureTools.mjs

@@ -45,6 +45,10 @@ const SUPPORTING_CAPABILITIES = `The kind defines the delivered product, not whi
 may be used. Use available tools needed for the person's request, including
 native image generation for requested textures or illustrations. A listed skill
 is not proof that its tool is installed, mounted or entitled on this account.
+Configuration and mount names do not prove a live MCP connection. Verify access
+with a non-mutating tool before claiming it works. If a call fails, relay its
+actual startup, approval or connection error and a concrete corrective step;
+an empty instance list means no connected instances, not missing tools.
 Do not re-file the kind or require a separate image card just to use a tool.
 If a needed tool is absent or fails, relay the measured limitation and ask for
 the missing configuration or a decision. A separately billed CLI/API fallback

package/bin/lib/projectTools.mjs

@@ -1,6 +1,6 @@
 /** Repo-owned tool configuration, read from the base ref for every agent turn. */
 import { accessSync, constants, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
+import { delimiter, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { git, gitRaw, splitNul } from './git.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
@@ -36,6 +36,19 @@ function onPath(command, env) {
   });
 }
 
+const relativeCommand = (command) => !isAbsolute(command) && command.includes('/');
+
+/** Repo launchers are not PATH commands. Measure the reviewed tree's mode,
+ * never an uncommitted executable in the checkout used to read that tree. */
+function reviewedExecutable(root, commit, command) {
+  const path = relative(resolve(root), resolve(root, command));
+  if (!path || path === '..' || path.startsWith('../') || isAbsolute(path)) return false;
+  try {
+    return splitNul(gitRaw(['ls-tree', '-z', commit, '--', path], root, SHOW))
+      .some((entry) => entry.startsWith('100755 blob ') && entry.slice(entry.indexOf('\t') + 1) === path);
+  } catch { return false; }
+}
+
 function referenced(value) {
   return [...String(value).matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
 }
@@ -101,9 +114,14 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
       for (const key of referenced(value)) vars.add(key);
     }
     const missing = [...vars].filter((key) => !env[key]).sort();
-    const commandMissing = typeof config.command === 'string' && !onPath(expand(config.command, env), env);
+    const command = typeof config.command === 'string' ? expand(config.command, env) : null;
+    const repoCommand = command != null && relativeCommand(command);
+    const commandMissing = command != null && !(repoCommand ? reviewedExecutable(root, commit, command) : onPath(command, env));
     const unsupported = typeof config.command !== 'string' && typeof config.url !== 'string';
-    const reason = missing.length ? `env ${missing.join(', ')} unset` : commandMissing ? `command ${config.command} not on PATH` : unsupported ? 'MCP configuration unsupported' : null;
+    const reason = missing.length ? `env ${missing.join(', ')} unset` : commandMissing
+      ? repoCommand ? `command ${config.command} is not an executable file in the base branch; commit the launcher with executable permission on base`
+        : `command ${config.command} not on PATH`
+      : unsupported ? 'MCP configuration unsupported' : null;
     return { name, config, state: reason ? 'missing' : 'ready', reason };
   });
   // Nested instructions are normally discovered when a CLI enters that path.
@@ -119,7 +137,7 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
     if (instructionBytes > MAX_INSTRUCTION_BYTES) throw new Error('Base branch agent instructions exceed the turn limit');
     instructions.push({ path, body });
   }
-  return { tools, skills, skillFiles, instructions };
+  return { tools, skills, skillFiles, instructions, root: resolve(root) };
 }
 
 const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
@@ -144,6 +162,11 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   const env = expansionEnv(callerEnv);
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
+  // The CLI may read its config from a temporary directory, and Codex research
+  // changes cwd to an isolated copy. Keep repository launchers rooted at the
+  // agent worktree, not either of those directories or the daemon's checkout.
+  const launchRoot = worktree ?? snapshot.root;
+  const launchCommand = (command) => launchRoot && relativeCommand(command) ? resolve(launchRoot, command) : command;
   // What the base lists and this turn cannot mount, and why — the turn is told
   // (postureTools.mjs), so a missing server is a named fact, never a guess.
   const mcpUnmounted = snapshot.tools
@@ -152,7 +175,7 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   const mcpServers = {};
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
-      const command = expand(config.command, env);
+      const command = launchCommand(expand(config.command, env));
       const args = Array.isArray(config.args) ? config.args.map((v) => expand(v, env)) : [];
       const vars = Object.fromEntries(Object.entries(config.env ?? {}).map(([k, v]) => [k, expand(v, env)]));
       mcpServers[name] = { command, args, env: vars };
@@ -191,7 +214,10 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
     mcpUnmounted,
     /** The mount a fenced turn takes where the runner's file is ignored
      *  (`fencedMountFor`, projectToolRuntimes.mjs); null where it has none. */
-    fencedMount: fencedMountFor(runner, usable, (value) => expand(value, env), callerEnv),
+    fencedMount: fencedMountFor(runner, usable.map((entry) => ({ ...entry, config: {
+      ...entry.config,
+      ...(typeof entry.config.command === 'string' ? { command: launchCommand(entry.config.command) } : {}),
+    } })), (value) => expand(value, env), callerEnv),
     instructions,
     pluginDir,
     codexHome,

package/bin/lib/runTurn.mjs

@@ -234,6 +234,10 @@ function runPlainTurn(opts) {
       // server names an agent lane disables beside them, on a profile that
       // mounts project servers — never on one that does not.
       machineMcp: turnProfile.projectMcp ? opts.machineMcp : undefined,
+      // …beside them, the names the base copy mounts and the person's checkout,
+      // whose local servers no card turn's cwd reaches (2026-10-17).
+      baseMcp: turnProfile.projectMcp ? (opts.projectMcpServers ?? []) : [],
+      mcpCheckout: turnProfile.projectMcp ? opts.mcpCheckout : undefined,
       // Handed to the adapter rather than appended here, because WHERE these go
       // is a property of the CLI: Codex reads its prompt as a trailing
       // positional, so a flag after it is a flag in the wrong place.

package/bin/lib/runtimeClaude.mjs

@@ -14,7 +14,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
-import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings } from './claudePersonal.mjs';
+import { NO_SETTING_SOURCES, machineMcpServers, personalClaudeSettings, releaseTurnSettings, withPersonalSettings, writeTurnSettings } from './claudePersonal.mjs';
 import { withMachineMcp } from './claudePosture.mjs';
 import { orchestratorHooks } from './orchestratorHooks.mjs';
 
@@ -102,7 +102,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, streamInput = false, orchestration = false }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -221,8 +221,24 @@ export const CLAUDE_RUNTIME = {
     // kept is written to a private file, never onto argv (claudePersonal.mjs)
     // — so this is the LAST thing built: nothing after it may throw and
     // leave the file with no turn to release it.
+    //
+    // …AND THE MACHINE'S SERVERS NO SOURCE OF THIS TURN READS (2026-10-17,
+    // claudePersonal.mjs `machineMcpServers`): the user scope a fenced turn's
+    // empty source list drops, and the checkout's local scope every card turn
+    // missed. In a private file too — a server's env and headers are secrets —
+    // minus every name the base copy mounts, which speaks for the project.
+    const own = machine ? machineMcpServers({ user: fenced, checkout: mcpCheckout }) : {};
+    for (const name of baseMcp) delete own[name];
+    const ownArgs = Object.keys(own).length ? ['--mcp-config', writeTurnSettings({ mcpServers: own })] : [];
     const postured = machine ? withMachineMcp(perm, machineMcp) : perm;
-    a.push(...(fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured));
+    let tail;
+    try {
+      tail = fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured;
+    } catch (error) {
+      releaseTurnSettings(ownArgs);
+      throw error;
+    }
+    a.push(...ownArgs, ...tail);
     return a;
   },
   /** What `args` wrote for a turn — the fenced posture's settings file —

package/bin/lib/workAgentTurnExecution.mjs

@@ -592,7 +592,7 @@ export function createAgentTurnExecution({
           ? {
               mcpArgs: [...(claudeDisabled ? [] : ['--strict-mcp-config']), '--mcp-config', projectTools.mcpPath],
               projectMcpServers: projectTools.mcpServers,
-              ...(claudeDisabled ? { machineMcp: claudeDisabled } : {}),
+              ...(claudeDisabled ? { machineMcp: claudeDisabled, mcpCheckout: source?.repoRoot ?? repoRoot } : {}),
             }
           : fencedMount ? { mcpArgs: fencedMount.args } : {}),
         knowledgeDir: knowledgeDirFor(repoRoot),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.3",
+  "version": "0.125.5",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {