flowviant 0.125.5 → 0.125.6

package/bin/lib/projectToolRuntimes.mjs

@@ -15,12 +15,13 @@
  * projectTools.mjs. projectTools.test.mjs pins every transport word to here.
  */
 
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { codexHome } from './codexHome.mjs';
-import { parseCodexToml, TomlRaw } from './codexPersonal.mjs';
+import { bareKey, headerKeys, lineKeys, parseCodexToml, toml, tomlValue } from './codexToml.mjs';
+import { SERVER_NAME, codexFencedMount } from './codexFencedMount.mjs';
 
-export const toml = (value) => JSON.stringify(String(value));
+export { MCP_HEADER_ENV_PREFIX } from './codexFencedMount.mjs';
 
 /**
  * ONE LINK PER PERSONAL ENTRY, MADE OR MENDED IN PLACE (2026-09-29). A home
@@ -44,31 +45,6 @@ function linkPersonalEntry(target, link) {
   }
 }
 
-/** A table header's dotted keys, unquoted — null for one this reader cannot
- *  split, which is then nobody's to strip. */
-function headerKeys(section) {
-  const key = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*(?:\.|$)/y;
-  const keys = [];
-  for (let i = 0; i < section.length; ) {
-    key.lastIndex = i;
-    const m = key.exec(section);
-    if (!m || key.lastIndex === i) return null;
-    try {
-      keys.push(m[1] !== undefined ? JSON.parse(`"${m[1]}"`) : m[2] ?? m[3]);
-    } catch {
-      return null;
-    }
-    i = key.lastIndex;
-  }
-  return keys;
-}
-
-/** The key a `key = …` / `key.sub = …` line defines, unquoted, or null. */
-const lineKey = (line) => {
-  const m = /^\s*(?:"([^"\\]*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*[.=]/.exec(line);
-  return m ? (m[1] ?? m[2] ?? m[3]) : null;
-};
-
 /**
  * THE REPO'S MCP SERVERS, AS THE AGENT'S OWN CONFIG (2026-10-10, the audit).
  * A Codex build turn was handed the base branch's servers as `-c` pairs —
@@ -79,7 +55,7 @@ const lineKey = (line) => {
  * ARGV"). They are written here instead, as tables of the agent's private
  * CODEX_HOME config.toml (0600, in a 0700 home), which a build turn reads and
  * every fenced posture ignores (`--ignore-user-config`) — the same turns the
- * `-c` pairs reached. Written in the shape codexPersonal.mjs's bounded reader
+ * `-c` pairs reached. Written in the shape codexToml.mjs's bounded reader
  * parses, since a fenced turn reads this file for its login.
  *
  * SO THE EXPANDED VALUES NOW SIT ON DISK, AND THAT IS STATED (2026-10-10). The
@@ -92,17 +68,25 @@ const lineKey = (line) => {
  * next turn; a home with no git dir to hold it dies with its turn. NOT DONE:
  * a URL that would carry an expanded secret is written as any other — refusing
  * it ('missing') is an open follow-up from the same audit finding (F660).
+ *
+ * EACH IS APPROVED BY NAME (2026-10-17). These are the daemon's own servers
+ * and the reviewed base copy, and a card turn runs `approval_policy="never"`:
+ * under SAFE's workspace-write every unannotated tool failed "MCP tool call
+ * requires approval, but approval policy is never" (measured, codex-cli
+ * 0.163.0 — route_message among them), as the fenced mount had already found.
+ * The person's own tables keep their own modes.
  */
 function codexServerTables(servers) {
   let out = '';
   for (const [name, server] of Object.entries(servers ?? {})) {
     out += `\n[mcp_servers.${name}]\n`;
+    const approve = 'default_tools_approval_mode = "approve"\n';
     if (typeof server.command === 'string') {
-      out += `command = ${toml(server.command)}\nargs = [${(server.args ?? []).map(toml).join(', ')}]\n`;
+      out += `command = ${toml(server.command)}\nargs = [${(server.args ?? []).map(toml).join(', ')}]\n${approve}`;
       const env = Object.entries(server.env ?? {}).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key));
       if (env.length) out += `[mcp_servers.${name}.env]\n${env.map(([key, value]) => `${key} = ${toml(value)}`).join('\n')}\n`;
     } else {
-      out += `url = ${toml(server.url)}\n`;
+      out += `url = ${toml(server.url)}\n${approve}`;
       const headers = Object.entries(server.headers ?? {});
       if (headers.length) out += `[mcp_servers.${name}.http_headers]\n${headers.map(([key, value]) => `${toml(key)} = ${toml(value)}`).join('\n')}\n`;
     }
@@ -132,32 +116,53 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
   const topLevel = sourceConfig.split(/^\s*\[/m, 1)[0];
   const personalDeveloperInstructions = /^\s*developer_instructions\s*=/m.test(topLevel);
   // The repo's servers replace a personal server of the same name whole —
-  // its `[mcp_servers.<n>…]` tables are dropped below. A personal
-  // `mcp_servers` written inline cannot be told apart line by line, so it
-  // fails closed, as an inline `skills.config` does below.
+  // its `[mcp_servers.<n>…]` tables are dropped below.
+  //
+  // A PERSONAL SERVER WRITTEN OUTSIDE A TABLE (2026-10-17). Dotted keys
+  // (`mcp_servers.roblox.command = …`, at the top or under `[mcp_servers]`)
+  // stand beside an appended table (measured, codex-cli 0.163.0), so they are
+  // kept, and refused only when they name one of these servers: a dotted
+  // definition cannot be dropped whole line by line. The one-line inline
+  // table (`mcp_servers = { … }`) does NOT stand beside one ("failed to load
+  // bootstrap configuration", measured), so it is read and rewritten as one
+  // dotted line per server, without the names these servers replace; one this
+  // reader cannot take alone fails closed, as an inline `skills.config` does
+  // below. Names compare unquoted, however the person quoted them.
   const repoServers = new Set(Object.keys(mcpServers ?? {}));
   const inline = () => new Error('Cannot isolate Codex project MCP servers beside an inline mcp_servers entry in config.toml');
-  if (repoServers.size && /^\s*["']?mcp_servers["']?\s*[.=]/m.test(topLevel)) throw inline();
+  const dotted = (name) => new Error(`Cannot isolate Codex MCP server ${name}: config.toml defines one of that name outside its own table, which cannot be replaced line by line — write it as a [mcp_servers.${name}] table`);
   // The `projects` sections alone grant a checkout permission to supply
   // project settings. Keep every other personal setting, skill and session
   // store.
   const lines = sourceConfig.split('\n');
   let dropping = false;
   let inServers = false;
-  let config = lines.filter((line) => {
+  let top = true;
+  let config = lines.flatMap((line) => {
     const header = /^\s*(?:\[\[([^\]]+)\]\]|\[([^\]]+)\])\s*(?:#.*)?$/.exec(line);
     if (header) {
       const section = header[1] ?? header[2];
       const keys = headerKeys(section);
+      top = false;
       inServers = keys?.length === 1 && keys[0] === 'mcp_servers';
       dropping =
         section === 'projects' ||
         section.startsWith('projects.') ||
         (keys?.[0] === 'mcp_servers' && keys.length > 1 && repoServers.has(keys[1]));
-    } else if (inServers && repoServers.has(lineKey(line))) {
-      throw inline();
+    } else if (repoServers.size && (top || inServers)) {
+      const keys = lineKeys(line);
+      const name = top ? (keys?.[0] === 'mcp_servers' ? keys[1] : undefined) : keys?.[0];
+      if (top && !keys && /^\s*["']?mcp_servers["']?\s*[.=]/.test(line)) throw inline();
+      if (name !== undefined && repoServers.has(name)) throw dotted(name);
+      if (top && keys?.length === 1 && keys[0] === 'mcp_servers') {
+        let servers;
+        try { servers = parseCodexToml(line).mcp_servers; } catch { throw inline(); }
+        return Object.entries(servers)
+          .filter(([key]) => !repoServers.has(key))
+          .map(([key, value]) => `mcp_servers.${bareKey(key)} = ${tomlValue(value)}`);
+      }
     }
-    return !dropping;
+    return dropping ? [] : [line];
   }).join('\n');
   if (worktree) {
     // Codex discovers these even in an untrusted project. Disable exactly the
@@ -176,6 +181,8 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
     for (const skill of worktreeSkills) config += `\n[[skills.config]]\npath = ${toml(skill)}\nenabled = false\n`;
   }
   config += codexServerTables(mcpServers);
+  const approvals = personalApprovals(sourceConfig, repoServers);
+  const machineServers = personalServerNames(sourceConfig, repoServers);
 
   // The home itself, only once the config is decided: a refused turn touches
   // nothing here. A home that is not a real directory is not ours to write
@@ -208,213 +215,51 @@ function isolatedCodexHome(dest, env, worktree, mcpServers = {}) {
   } finally {
     rmSync(staged, { force: true });
   }
-  return { path: dest, personalDeveloperInstructions };
+  return { path: dest, personalDeveloperInstructions, approvals, machineServers };
 }
 
-/** The environment names a fenced Codex turn's MCP header values ride under,
- *  one per header (`codexFencedMount`). */
-export const MCP_HEADER_ENV_PREFIX = 'FLOWVIANT_MCP_HEADER_';
-const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const SERVER_NAME = /^[A-Za-z0-9_-]{1,80}$/;
-const expands = (value) => /\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(String(value));
 /**
- * Names this machine's Codex, or the shell and tools under it, read for
- * themselves. A server's env value rides in the CLI's own environment
- * (`env_vars` forwards it), so a name the machine does not already set to that
- * value would change how the CLI itself runs — a proxy, a CA bundle, a
- * provider key. Such a server is left unmounted, in words.
+ * THE PERSON'S OWN SERVERS, APPROVED WHERE THEY SET NO MODE (2026-10-17, the
+ * review). A card turn runs `approval_policy="never"`, and under SAFE's
+ * workspace-write a machine server's unannotated tool failed "MCP tool call
+ * requires approval, but approval policy is never" (measured, codex-cli
+ * 0.163.0) while the same card on Claude reaches it through the allow hook
+ * (hooks/mcpAllow.mjs) and a fenced Codex card through its own mount — the
+ * owner: board agents use the machine's MCP servers, fenced cards included.
+ * As `-c` pairs, not lines of the kept file: a server written as an inline
+ * table takes no key after it, and a `-c` pair reaches it however it is
+ * written (measured). A mode the person set is theirs and stays; a file this
+ * reader cannot parse approves nothing.
  */
-const CLI_ENV =
-  /^(PATH|HOME|SHELL|USER|LOGNAME|PWD|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|DISPLAY|WAYLAND_DISPLAY|BROWSER|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|RUST_LOG|RUST_BACKTRACE|HTTPS?_PROXY|ALL_PROXY|NO_PROXY|https?_proxy|all_proxy|no_proxy)$|^(LC|XDG|LD|DYLD|OPENAI|CODEX|AZURE_OPENAI|FLOWVIANT)_/;
-
-/** This machine's own Codex servers: its config.toml's `[mcp_servers.*]`,
- *  read the way codexPersonal.mjs reads the login (bounded; a file that does
- *  not parse carries nothing). */
-function machineCodexServers(machineEnv) {
-  try {
-    const path = join(resolve(codexHome(machineEnv)), 'config.toml');
-    const st = statSync(path);
-    if (!st.isFile() || st.size > 1024 * 1024) return [];
-    const servers = parseCodexToml(readFileSync(path, 'utf8'))?.mcp_servers;
-    if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return [];
-    return Object.entries(servers).filter(([, v]) => v && typeof v === 'object' && !Array.isArray(v));
-  } catch {
-    return [];
-  }
+function personalApprovals(sourceConfig, repoServers) {
+  let servers;
+  try { servers = parseCodexToml(sourceConfig)?.mcp_servers; } catch { return []; }
+  if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return [];
+  return Object.entries(servers)
+    .filter(([name, v]) => !repoServers.has(name) && SERVER_NAME.test(name) && v && typeof v === 'object' && !Array.isArray(v)
+      && (typeof v.command === 'string' || typeof v.url === 'string') && v.default_tools_approval_mode === undefined)
+    .flatMap(([name]) => ['-c', `mcp_servers.${name}.default_tools_approval_mode="approve"`]);
 }
-const tomlScalar = (v) => (v instanceof TomlRaw ? v.text : typeof v === 'number' && Number.isFinite(v) ? String(v) : null);
-const words = (v) => (Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : null);
-const table = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
 
 /**
- * THE MCP SERVERS ON A FENCED CODEX TURN — the project's and, since 2026-10-11,
- * the machine's own (the owner: "the server that is running flowviant's claude
- * HAS these MCPs yet the agents are not using them"). A Codex build reads both
- * from the agent's config.toml (`isolatedCodexHome`: the person's own tables
- * kept, the repo's beside them). Every fenced posture — write-up, mockup,
- * 3D model, deck, image — passes `--ignore-user-config`, which drops that
- * file, and a `-p` profile layered beside the flag was measured to load no
- * server either (codex-cli 0.159.2, artifactProjectMcp.test.mjs). So these
- * turns take the servers as `-c` pairs, the way codexPersonal.mjs carries a
- * login back, under the same rule: A LITERAL SECRET NEVER RIDES ARGV.
- *
- *  · A stdio server's command and arguments ride as written: they are the
- *    server process's own command line once Codex starts it, so `-c` adds no
- *    reader. A project server whose command or arguments expand a `${VAR}`
- *    is still left unmounted (the 2026-10-10 audit took expanded values off
- *    argv, and this keeps that line).
- *  · Every env value rides in the turn's ENVIRONMENT under its own name,
- *    forwarded by Codex's `env_vars` — except a project value with no `${VAR}`,
- *    which is text of the reviewed file and rides as written. Refused (the
- *    server is left unmounted, with the reason) when the name is the
- *    daemon's own (`FLOWVIANT_*`, `CODEX_HOME`), when this machine already
- *    sets it to something else, or when it is one the CLI reads itself
- *    (`CLI_ENV`) and the machine does not set it.
- *  · Every header value rides in the environment, named by
- *    `env_http_headers`. A machine server's own `env_http_headers`,
- *    `bearer_token_env_var` and `env_vars` are names, and ride as written.
- *  · A URL that expands a `${VAR}`, or carries a query, fragment or
- *    credentials, has no indirection in Codex's config: left unmounted.
- *  · A machine server keeps its own `cwd`, timeouts and tool lists; it is
- *    skipped where the person turned it off (`enabled = false`), and a
- *    project server of the same name replaces it, as on the build.
- *  · Each mounted server's tools are approved by name: an unannotated tool
- *    under a fenced posture failed "MCP tool call requires approval, but
- *    approval policy is never" (measured, 0.159.2) — never a blanket
- *    approval policy.
- *
- * `usable` is the base snapshot's ready entries; `expand` reads a value the
- * way projectTools.mjs does; `machineEnv` is the caller's own (what the child
- * would inherit). Returns `{ args, env, mounted, machine, unmounted }`:
- * `mounted` the project servers, `machine` the machine's own, and
- * `unmounted` `[{ name, reason, source: 'project' | 'machine' }]`.
+ * …AND THEIR NAMES, AS A BUILD CARD IS TOLD THEM (2026-10-18). The kept
+ * config.toml mounts every server the person configured beside the repo's —
+ * a URL with a query, a mode set to ask and every other one the fenced
+ * mount refuses — so a code card is told these, in file order, and not the
+ * fenced mount's list (2026-10-17: a card is told the machine's servers by
+ * name). `[]` with no config, NULL for one this reader cannot parse: unknown,
+ * never "none".
  */
-function codexFencedMount(usable, expand, machineEnv) {
-  const args = [];
-  const childEnv = {};
-  const mounted = [];
-  const machine = [];
-  const unmounted = [];
-  let header = 0;
-  /** A refusal sentence, or null with the value staged in `extra`. */
-  const forward = (key, value, extra) => {
-    if (key.startsWith('FLOWVIANT_') || key === 'CODEX_HOME') return `its env ${key} is a name this daemon keeps for itself`;
-    const has = machineEnv[key];
-    if (has !== undefined) return has === value ? null : `its env ${key} would replace this machine's own ${key}, which a fenced Codex turn cannot do`;
-    if (CLI_ENV.test(key)) return `its env ${key} is one this machine's Codex reads itself, which a fenced Codex turn cannot set`;
-    const staged = childEnv[key] ?? extra[key];
-    if (staged !== undefined && staged !== value) return `its env ${key} would replace another server's ${key}`;
-    extra[key] = value;
-    return null;
-  };
-  const headerEnv = (headers, extra) =>
-    Object.entries(headers).map(([key, value]) => {
-      const envName = `${MCP_HEADER_ENV_PREFIX}${header++}`;
-      extra[envName] = value;
-      return `${toml(key)}=${toml(envName)}`;
-    });
-  const accept = (name, pairs, extra, list) => {
-    args.push(...pairs, '-c', `mcp_servers.${name}.default_tools_approval_mode="approve"`);
-    Object.assign(childEnv, extra);
-    list.push(name);
-  };
-
-  for (const { name, config } of usable) {
-    const pairs = [];
-    const extra = {};
-    let refused = null;
-    if (typeof config.command === 'string') {
-      const rawArgs = Array.isArray(config.args) ? config.args : [];
-      if (expands(config.command) || rawArgs.some(expands)) {
-        refused = 'its command or arguments name a ${VAR}, which a fenced Codex turn would put on the command line';
-      } else {
-        pairs.push('-c', `mcp_servers.${name}.command=${toml(String(config.command))}`);
-        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map((v) => toml(String(v))).join(',')}]`);
-        const forwarded = [];
-        for (const [key, value] of Object.entries(config.env ?? {})) {
-          if (!ENV_NAME.test(key)) continue;
-          if (!expands(value)) {
-            pairs.push('-c', `mcp_servers.${name}.env.${key}=${toml(String(value))}`);
-            continue;
-          }
-          refused = forward(key, expand(value), extra);
-          if (refused) break;
-          forwarded.push(key);
-        }
-        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
-      }
-    } else if (typeof config.url === 'string') {
-      if (expands(config.url)) {
-        refused = 'its URL names a ${VAR}, which a fenced Codex turn would put on the command line';
-      } else {
-        pairs.push('-c', `mcp_servers.${name}.url=${toml(String(config.url))}`);
-        const named = headerEnv(Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v)])), extra);
-        if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
-      }
-    } else continue;
-    if (refused) unmounted.push({ name, reason: refused, source: 'project' });
-    else accept(name, pairs, extra, mounted);
-  }
-
-  const projectNames = new Set(usable.map((t) => t.name));
-  for (const [name, server] of machineCodexServers(machineEnv)) {
-    if (projectNames.has(name) || name === 'flowviant' || server.enabled === false) continue;
-    if (typeof server.command !== 'string' && typeof server.url !== 'string') continue;
-    const pairs = [];
-    const extra = {};
-    let refused = SERVER_NAME.test(name) ? null : 'its name cannot be spelled as a command-line setting';
-    if (!refused && typeof server.command === 'string') {
-      const rawArgs = server.args === undefined ? [] : words(server.args);
-      if (!rawArgs) refused = 'its args are not a list of words';
-      else {
-        pairs.push('-c', `mcp_servers.${name}.command=${toml(server.command)}`);
-        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map(toml).join(',')}]`);
-        const forwarded = [...(words(server.env_vars) ?? []).filter((k) => ENV_NAME.test(k))];
-        for (const [key, value] of Object.entries(table(server.env))) {
-          if (!ENV_NAME.test(key) || typeof value !== 'string') {
-            refused = `its env ${String(key).slice(0, 40)} is not a name and text`;
-            break;
-          }
-          refused = forward(key, value, extra);
-          if (refused) break;
-          if (!forwarded.includes(key)) forwarded.push(key);
-        }
-        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
-        if (typeof server.cwd === 'string') pairs.push('-c', `mcp_servers.${name}.cwd=${toml(server.cwd)}`);
-      }
-    } else if (!refused) {
-      let url = null;
-      try { url = new URL(server.url); } catch { /* refused below */ }
-      if (!url || url.search || url.hash || url.username || url.password) {
-        refused = 'its URL carries a query, fragment or credentials, which a fenced Codex turn would put on the command line';
-      } else {
-        pairs.push('-c', `mcp_servers.${name}.url=${toml(server.url)}`);
-        if (typeof server.bearer_token_env_var === 'string' && ENV_NAME.test(server.bearer_token_env_var))
-          pairs.push('-c', `mcp_servers.${name}.bearer_token_env_var=${toml(server.bearer_token_env_var)}`);
-        const literal = table(server.http_headers);
-        const byName = table(server.env_http_headers);
-        if (Object.values(literal).some((v) => typeof v !== 'string') || Object.values(byName).some((v) => typeof v !== 'string' || !ENV_NAME.test(v))) {
-          refused = 'its headers are not text';
-        } else {
-          const named = [...headerEnv(literal, extra), ...Object.entries(byName).map(([key, envName]) => `${toml(key)}=${toml(envName)}`)];
-          if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
-        }
-      }
-    }
-    if (!refused) {
-      for (const key of ['startup_timeout_sec', 'startup_timeout_ms', 'tool_timeout_sec']) {
-        const v = tomlScalar(server[key]);
-        if (v != null && /^[0-9_.]+$/.test(v)) pairs.push('-c', `mcp_servers.${name}.${key}=${v}`);
-      }
-      for (const key of ['enabled_tools', 'disabled_tools']) {
-        const list = words(server[key]);
-        if (list) pairs.push('-c', `mcp_servers.${name}.${key}=[${list.map(toml).join(',')}]`);
-      }
-    }
-    if (refused) unmounted.push({ name, reason: refused, source: 'machine' });
-    else accept(name, pairs, extra, machine);
-  }
-  return { args, env: childEnv, mounted, machine, unmounted };
+function personalServerNames(sourceConfig, repoServers) {
+  if (sourceConfig === '') return [];
+  let servers;
+  try { servers = parseCodexToml(sourceConfig)?.mcp_servers; } catch { return null; }
+  if (servers === undefined) return [];
+  if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return null;
+  return Object.entries(servers)
+    .filter(([name, v]) => !repoServers.has(name) && v && typeof v === 'object' && !Array.isArray(v)
+      && (typeof v.command === 'string' || typeof v.url === 'string') && v.enabled !== false)
+    .map(([name]) => name);
 }
 
 /** Claude takes the base branch's skills as a plugin written for this turn. */
@@ -437,7 +282,8 @@ function reviewedClaudePlugin(dir, snapshot) {
  * turn)` returns the runner-specific part of prepareAgentTools' result — under
  * `dir`, which dies with the turn, except what `turn.codexHome` names a
  * lasting place for. `turn.mcpServers` is the base branch's servers this
- * runtime takes, expanded.
+ * runtime takes, expanded; `turn.fenced` a posture that reads no config file
+ * of the runner's own.
  */
 const TOOL_RUNTIMES = {
   claude: {
@@ -452,10 +298,11 @@ const TOOL_RUNTIMES = {
     refuseMcp: (config) => (config.type === 'sse' ? 'Codex cannot take SSE MCP' : null),
     // The agent's own lasting home when the caller has one (2026-09-29: its
     // threads are indexed under it — see isolatedCodexHome), else one that
-    // dies with the turn, as every home did before.
+    // dies with the turn, as every home did before. A fenced turn ignores the
+    // home's config.toml, so no server is written into it (2026-10-17).
     prepare: (dir, _snapshot, env, worktree, turn) => {
-      const isolated = isolatedCodexHome(turn?.codexHome ?? join(dir, 'codex-home'), env, worktree, turn?.mcpServers);
-      return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions };
+      const isolated = isolatedCodexHome(turn?.codexHome ?? join(dir, 'codex-home'), env, worktree, turn?.fenced ? {} : turn?.mcpServers);
+      return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions, codexApprovals: turn?.fenced ? [] : isolated.approvals, codexMachineServers: turn?.fenced ? null : isolated.machineServers };
     },
     // A fenced posture ignores that home's config.toml (2026-10-10).
     fencedMount: codexFencedMount,
@@ -472,9 +319,9 @@ const rowFor = (runner) => (Object.hasOwn(TOOL_RUNTIMES, runner) ? TOOL_RUNTIMES
  *  null for a runner whose fenced turns read the same file as its build
  *  (Claude's strict mcp.json) or that takes none. `usable` is the base
  *  snapshot's ready entries; `expand(value)` reads a `${VAR}`. */
-export function fencedMountFor(runner, usable, expand, machineEnv = process.env) {
+export function fencedMountFor(runner, usable, expand, machineEnv = process.env, turnServers = {}) {
   const mount = rowFor(runner).fencedMount;
-  return mount ? mount(usable, expand, machineEnv) : null;
+  return mount ? mount(usable, expand, machineEnv, turnServers) : null;
 }
 
 /** Pure mapping used before a future tool-attach gesture is offered. */
@@ -501,5 +348,5 @@ export function skillsRefusal(runner) {
 /** The runner-specific files a turn needs, written under `dir` — or, for the
  *  `codexHome` it names, where the caller keeps it between turns. */
 export function prepareForRunner(runner, dir, snapshot, env, worktree, turn = {}) {
-  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, turn) ?? {}) };
+  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, codexApprovals: [], codexMachineServers: null, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, turn) ?? {}) };
 }

package/bin/lib/projectTools.mjs

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { git, gitRaw, splitNul } from './git.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
 import { fencedMountFor, mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
+import { mcpCommandNotOnPathReason, mcpEnvUnsetReason, mcpLauncherNotExecutableReason } from './mcpReasons.mjs';
 
 const MAX_TOOLS = 40;
 const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
@@ -39,14 +40,41 @@ function onPath(command, env) {
 const relativeCommand = (command) => !isAbsolute(command) && command.includes('/');
 
 /** Repo launchers are not PATH commands. Measure the reviewed tree's mode,
- * never an uncommitted executable in the checkout used to read that tree. */
-function reviewedExecutable(root, commit, command) {
+ * never an uncommitted executable in the checkout used to read that tree —
+ * `{ path, blob }` for an executable file there, else null. */
+function reviewedLauncher(root, commit, command) {
   const path = relative(resolve(root), resolve(root, command));
-  if (!path || path === '..' || path.startsWith('../') || isAbsolute(path)) return false;
+  if (!path || path === '..' || path.startsWith('../') || isAbsolute(path)) return null;
   try {
-    return splitNul(gitRaw(['ls-tree', '-z', commit, '--', path], root, SHOW))
-      .some((entry) => entry.startsWith('100755 blob ') && entry.slice(entry.indexOf('\t') + 1) === path);
-  } catch { return false; }
+    for (const entry of splitNul(gitRaw(['ls-tree', '-z', commit, '--', path], root, SHOW))) {
+      const m = /^100755 blob ([0-9a-f]+)\t/.exec(entry);
+      if (m && entry.slice(entry.indexOf('\t') + 1) === path) return { path, blob: m[1] };
+    }
+  } catch { /* not in the reviewed tree */ }
+  return null;
+}
+
+/**
+ * …AND THE FILE A TURN RUNS IS THAT FILE (2026-10-17). The launcher is run
+ * from the agent's worktree, where a branch cut before it landed has none
+ * and the agent may have edited it — and an MCP server runs outside every
+ * fence of the turn (a Codex stdio server is not sandboxed). So the
+ * worktree's copy must be the reviewed blob, byte for byte (`hash-object
+ * --no-filters`, which runs no filter the worktree configures), or the server
+ * is not mounted, in words. Checked here rather than copied out of the tree,
+ * so a launcher still finds what it names beside itself. What the launcher
+ * then runs is its own business, as a PATH command's is.
+ */
+function launcherRefusal(snapshot, launchRoot, { config, launcher }) {
+  const file = resolve(launchRoot, launcher.path);
+  const named = `the launcher ${config.command}`;
+  try {
+    if (!statSync(file).isFile()) return `${named} is not in this worktree`;
+  } catch { return `${named} is not in this worktree`; }
+  try { accessSync(file, constants.X_OK); } catch { return `${named} is not executable in this worktree`; }
+  let blob = null;
+  try { blob = git(['hash-object', '--no-filters', '--', file], snapshot.root, { stdio: ['ignore', 'pipe', 'ignore'] }); } catch { /* unread */ }
+  return blob === launcher.blob ? null : `${named} in this worktree differs from the reviewed base copy`;
 }
 
 function referenced(value) {
@@ -116,13 +144,14 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
     const missing = [...vars].filter((key) => !env[key]).sort();
     const command = typeof config.command === 'string' ? expand(config.command, env) : null;
     const repoCommand = command != null && relativeCommand(command);
-    const commandMissing = command != null && !(repoCommand ? reviewedExecutable(root, commit, command) : onPath(command, env));
+    const launcher = repoCommand ? reviewedLauncher(root, commit, command) : null;
+    const commandMissing = command != null && !(repoCommand ? launcher : onPath(command, env));
     const unsupported = typeof config.command !== 'string' && typeof config.url !== 'string';
-    const reason = missing.length ? `env ${missing.join(', ')} unset` : commandMissing
-      ? repoCommand ? `command ${config.command} is not an executable file in the base branch; commit the launcher with executable permission on base`
-        : `command ${config.command} not on PATH`
+    const reason = missing.length ? mcpEnvUnsetReason(missing) : commandMissing
+      ? repoCommand ? mcpLauncherNotExecutableReason(config.command)
+        : mcpCommandNotOnPathReason(config.command)
       : unsupported ? 'MCP configuration unsupported' : null;
-    return { name, config, state: reason ? 'missing' : 'ready', reason };
+    return { name, config, state: reason ? 'missing' : 'ready', reason, ...(launcher ? { launcher } : {}) };
   });
   // Nested instructions are normally discovered when a CLI enters that path.
   // Their worktree copies must not regain authority through that discovery.
@@ -156,22 +185,26 @@ const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]
  * to this turn's 0600 mcp.json, Codex's into the isolated home's config.toml
  * (projectToolRuntimes.mjs) — never `-c` pairs on the command line. A fenced
  * Codex turn, which ignores that file, takes `fencedMount` instead: the
- * repo's own words as `-c` pairs and every expanded value in its environment.
+ * repo's own words as `-c` pairs and every expanded value in its environment
+ * — and `fenced` (the card's posture is not the build) keeps the servers out
+ * of the file it ignores (2026-10-17).
  */
-export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null, turnServers = {} } = {}) {
+export function prepareAgentTools(snapshot, runner, callerEnv = process.env, worktree = null, { codexHome: keptCodexHome = null, turnServers = {}, fenced = false } = {}) {
   const env = expansionEnv(callerEnv);
-  const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
-  const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
   // The CLI may read its config from a temporary directory, and Codex research
   // changes cwd to an isolated copy. Keep repository launchers rooted at the
   // agent worktree, not either of those directories or the daemon's checkout.
   const launchRoot = worktree ?? snapshot.root;
   const launchCommand = (command) => launchRoot && relativeCommand(command) ? resolve(launchRoot, command) : command;
+  const refusals = new Map(snapshot.tools.map((t) => [t, t.state !== 'ready' ? null
+    : mcpRefusal(runner, t.config) ?? (t.launcher && launchRoot ? launcherRefusal(snapshot, launchRoot, t) : null)]));
+  const usable = snapshot.tools.filter((t) => t.state === 'ready' && refusals.get(t) == null);
   // What the base lists and this turn cannot mount, and why — the turn is told
   // (postureTools.mjs), so a missing server is a named fact, never a guess.
   const mcpUnmounted = snapshot.tools
     .filter((t) => !usable.includes(t))
-    .map((t) => ({ name: t.name, reason: String(mcpRefusal(runner, t.config) ?? t.reason ?? 'not mounted').slice(0, 200) }));
+    .map((t) => ({ name: t.name, reason: String(refusals.get(t) ?? mcpRefusal(runner, t.config) ?? t.reason ?? 'not mounted').slice(0, 200) }));
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const mcpServers = {};
   for (const { name, config } of usable) {
     if (typeof config.command === 'string') {
@@ -201,12 +234,12 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
   ].filter(Boolean).join('\n\n');
   let prepared;
   try {
-    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome, mcpServers });
+    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome, mcpServers, fenced });
   } catch (error) {
     rmSync(dir, { recursive: true, force: true });
     throw error;
   }
-  const { pluginDir, codexHome, personalDeveloperInstructions } = prepared;
+  const { pluginDir, codexHome, personalDeveloperInstructions, codexApprovals, codexMachineServers } = prepared;
   return {
     mcpPath,
     /** The names of the servers mounted, as Claude's allow rules need them. */
@@ -217,11 +250,18 @@ export function prepareAgentTools(snapshot, runner, callerEnv = process.env, wor
     fencedMount: fencedMountFor(runner, usable.map((entry) => ({ ...entry, config: {
       ...entry.config,
       ...(typeof entry.config.command === 'string' ? { command: launchCommand(entry.config.command) } : {}),
-    } })), (value) => expand(value, env), callerEnv),
+    } })), (value) => expand(value, env), callerEnv, turnServers),
     instructions,
     pluginDir,
     codexHome,
     personalDeveloperInstructions,
+    /** `-c` pairs approving the person's own Codex servers that set no mode,
+     *  for a build card (projectToolRuntimes.mjs `personalApprovals`). */
+    codexApprovals,
+    /** The person's own Codex servers a build card's kept config.toml mounts,
+     *  by name (projectToolRuntimes.mjs `personalServerNames`); null when
+     *  unread, and on every other turn. */
+    codexMachineServers,
     cleanup: () => rmSync(dir, { recursive: true, force: true }),
   };
 }

package/bin/lib/repositoryDelivery.mjs

@@ -1,10 +1,12 @@
 /** Delivery order is the agent's decision, checked against Git's evidence. */
 import { parseTurnResult } from './agentPlan.mjs';
-import { git, gitOrNull } from './git.mjs';
+import { git, gitOrNull, isAncestor } from './git.mjs';
 import { taskIdsFromMessage, commitRecord } from './worktreeDiff.mjs';
 import { FLEET_URL, DAEMON_INSTANCE } from './config.mjs';
 import { fleetRequest } from './fleetPost.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { mergeOrderCorrection } from './repositoryPrompts.mjs';
+import { completeMergeOrder } from './mergeOrder.mjs';
 
 export function measuredCardRepos(rows, taskId, receipts = []) {
   return rows.filter((r) => {
@@ -17,7 +19,7 @@ export function deliveryOrder(value, ids, catalog) {
   const names = new Map(catalog.flatMap((r) => [[r.id, r.id], [r.name, r.id]]));
   const order = Array.isArray(value?.mergeOrder) ? value.mergeOrder.map((id) => names.get(id) ?? id) : ids.length <= 1 ? ids : [];
   const reason = typeof value?.mergeOrderReason === 'string' ? value.mergeOrderReason.trim().replace(/\s+/g, ' ').slice(0, 1000) : '';
-  if (order.length !== ids.length || new Set(order).size !== order.length || order.some((id) => !ids.includes(id)) || (ids.length > 1 && !reason)) return null;
+  if (!completeMergeOrder(order, ids, reason)) return null;
   return { changedRepos: ids, mergeOrder: order, ...(reason ? { mergeOrderReason: reason } : {}) };
 }
 
@@ -52,13 +54,13 @@ export async function finishRepositoryDelivery({ job, run, out, answer, resume,
       return out;
     }
     if (attempt === 3) throw new Error('The delivery still has no valid mergeOrder and mergeOrderReason for every repository with commits. The card has not entered Review.');
-    out = await resume(`Your delivery needs correction before Review. Git measured commits for these repositories (data): ${JSON.stringify(rows.filter((r) => ids.includes(r.id)).map((r) => ({ id: r.id, name: r.name })))}. Return your final delivered JSON again with mergeOrder: [every changed repository short name exactly once, in landing order] and mergeOrderReason: one line explaining that order. Keep summary and progress. Do not ask the person to choose the order.`);
+    out = await resume(mergeOrderCorrection(rows.filter((r) => ids.includes(r.id)).map((r) => ({ id: r.id, name: r.name }))));
   }
 }
 
 export function allResolutionsCommitted(rows) {
   return rows.length > 0 && rows.every((r) => !gitOrNull(['rev-parse', '--verify', 'MERGE_HEAD'], r.wt)
-    && (() => { try { git(['merge-base', '--is-ancestor', r.baseRef, 'HEAD'], r.wt); return true; } catch { return false; } })()
+    && isAncestor(r.baseRef, 'HEAD', r.wt)
     && !git(['diff', '--name-only', '--diff-filter=U'], r.wt).trim()
     && !git(['status', '--porcelain', '--untracked-files=no'], r.wt).trim());
 }