flowviant 0.125.4 → 0.125.5

package/bin/lib/claudePersonal.mjs

@@ -46,9 +46,9 @@
  * swept on the next write.
  */
 import { randomBytes } from 'node:crypto';
-import { chmodSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { MACHINE_CREDENTIAL_ENV } from './machineEnv.mjs';
 import { WINDOW_ENV_REMOVED, withoutWindows } from './noWindowEnv.mjs';
 
@@ -141,6 +141,56 @@ export function personalClaudeSettings(env = process.env) {
   return out;
 }
 
+/** Far past any real CLI config — `.claude.json` also holds every project's
+ *  history; a bigger one is not read. */
+const CLI_CONFIG_MAX_BYTES = 32 * 1024 * 1024;
+const isRecord = (v) => v != null && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * THE MACHINE'S OWN MCP SERVERS THAT A CARD TURN'S SETTINGS SOURCES NEVER
+ * REACH (2026-10-17). The 2026-10-11 ruling mounts "the user and local
+ * servers" on every card turn, and neither arrived where the person keeps
+ * them. MEASURED on Claude Code 2.1.302, a scratch CLAUDE_CONFIG_DIR whose
+ * `.claude.json` held one user and one local server:
+ *  · `--setting-sources ''` (every fenced posture: write-up, mockup, 3D model,
+ *    deck) loaded NEITHER — a research card on the owner's box saw the
+ *    claude.ai connectors and no Roblox_Studio, a user-scope server;
+ *  · `--setting-sources user` (a code card) loaded the user server only;
+ *  · a local server is keyed on the git root it was added from (`claude mcp
+ *    add`'s default scope), which is the person's checkout — never the
+ *    agent's worktree, so no card turn could see one even with every source.
+ * So the lane names what is missing and the adapter hands it over through a
+ * private `--mcp-config` file (runtimeClaude.mjs): `user` when the turn's
+ * sources drop the user scope, and the checkout's local servers always. A
+ * local name shadows a user one, the CLI's own precedence; an `--mcp-config`
+ * server beat a user server of the same name (measured), so a code card keeps
+ * that order too. `{}` when the file is absent, unreadable or not an object.
+ */
+export function machineMcpServers({ user = false, checkout = null, env = process.env } = {}) {
+  const path = env.CLAUDE_CONFIG_DIR ? join(env.CLAUDE_CONFIG_DIR, '.claude.json') : join(env.HOME || homedir(), '.claude.json');
+  let raw;
+  try {
+    if (statSync(path).size > CLI_CONFIG_MAX_BYTES) return {};
+    raw = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return {};
+  }
+  if (!isRecord(raw)) return {};
+  const out = {};
+  const take = (servers) => {
+    if (!isRecord(servers)) return;
+    for (const [name, config] of Object.entries(servers)) if (name !== '__proto__' && isRecord(config)) out[name] = config;
+  };
+  if (user) take(raw.mcpServers);
+  if (typeof checkout === 'string' && checkout && isRecord(raw.projects)) {
+    const keys = [resolve(checkout)];
+    try { keys.push(realpathSync(checkout)); } catch { /* the resolved path alone */ }
+    const key = keys.find((k) => Object.hasOwn(raw.projects, k));
+    if (key) take(raw.projects[key]?.mcpServers);
+  }
+  return out;
+}
+
 /** Where a fenced turn's settings file lives — the daemon's own state
  *  directory, private to this user. */
 export const turnSettingsDir = () => join(homedir(), '.flowviant', 'run');
@@ -182,11 +232,12 @@ export function writeTurnSettings(settings, { dir = turnSettingsDir() } = {}) {
   }
 }
 
-/** Remove the settings file a turn's argv names, when it is one of ours. */
+/** Remove the settings file a turn's argv names, when it is one of ours — and
+ *  the machine-MCP file (`machineMcpServers`), written the same way. */
 export function releaseTurnSettings(args, { dir = turnSettingsDir() } = {}) {
   if (!Array.isArray(args)) return;
   args.forEach((a, i) => {
-    if (i === 0 || args[i - 1] !== '--settings' || typeof a !== 'string') return;
+    if (i === 0 || !['--settings', '--mcp-config'].includes(args[i - 1]) || typeof a !== 'string') return;
     if (dirname(a) !== dir || !TURN_SETTINGS_FILE.test(basename(a))) return;
     rmSync(a, { force: true });
   });

package/bin/lib/runTurn.mjs

@@ -234,6 +234,10 @@ function runPlainTurn(opts) {
       // server names an agent lane disables beside them, on a profile that
       // mounts project servers — never on one that does not.
       machineMcp: turnProfile.projectMcp ? opts.machineMcp : undefined,
+      // …beside them, the names the base copy mounts and the person's checkout,
+      // whose local servers no card turn's cwd reaches (2026-10-17).
+      baseMcp: turnProfile.projectMcp ? (opts.projectMcpServers ?? []) : [],
+      mcpCheckout: turnProfile.projectMcp ? opts.mcpCheckout : undefined,
       // Handed to the adapter rather than appended here, because WHERE these go
       // is a property of the CLI: Codex reads its prompt as a trailing
       // positional, so a flag after it is a flag in the wrong place.

package/bin/lib/runtimeClaude.mjs

@@ -14,7 +14,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
-import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings } from './claudePersonal.mjs';
+import { NO_SETTING_SOURCES, machineMcpServers, personalClaudeSettings, releaseTurnSettings, withPersonalSettings, writeTurnSettings } from './claudePersonal.mjs';
 import { withMachineMcp } from './claudePosture.mjs';
 import { orchestratorHooks } from './orchestratorHooks.mjs';
 
@@ -102,7 +102,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, streamInput = false, orchestration = false }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -221,8 +221,24 @@ export const CLAUDE_RUNTIME = {
     // kept is written to a private file, never onto argv (claudePersonal.mjs)
     // — so this is the LAST thing built: nothing after it may throw and
     // leave the file with no turn to release it.
+    //
+    // …AND THE MACHINE'S SERVERS NO SOURCE OF THIS TURN READS (2026-10-17,
+    // claudePersonal.mjs `machineMcpServers`): the user scope a fenced turn's
+    // empty source list drops, and the checkout's local scope every card turn
+    // missed. In a private file too — a server's env and headers are secrets —
+    // minus every name the base copy mounts, which speaks for the project.
+    const own = machine ? machineMcpServers({ user: fenced, checkout: mcpCheckout }) : {};
+    for (const name of baseMcp) delete own[name];
+    const ownArgs = Object.keys(own).length ? ['--mcp-config', writeTurnSettings({ mcpServers: own })] : [];
     const postured = machine ? withMachineMcp(perm, machineMcp) : perm;
-    a.push(...(fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured));
+    let tail;
+    try {
+      tail = fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured;
+    } catch (error) {
+      releaseTurnSettings(ownArgs);
+      throw error;
+    }
+    a.push(...ownArgs, ...tail);
     return a;
   },
   /** What `args` wrote for a turn — the fenced posture's settings file —

package/bin/lib/workAgentTurnExecution.mjs

@@ -592,7 +592,7 @@ export function createAgentTurnExecution({
           ? {
               mcpArgs: [...(claudeDisabled ? [] : ['--strict-mcp-config']), '--mcp-config', projectTools.mcpPath],
               projectMcpServers: projectTools.mcpServers,
-              ...(claudeDisabled ? { machineMcp: claudeDisabled } : {}),
+              ...(claudeDisabled ? { machineMcp: claudeDisabled, mcpCheckout: source?.repoRoot ?? repoRoot } : {}),
             }
           : fencedMount ? { mcpArgs: fencedMount.args } : {}),
         knowledgeDir: knowledgeDirFor(repoRoot),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.4",
+  "version": "0.125.5",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {