flowviant 0.125.5 → 0.125.7

package/bin/lib/runTurn.mjs

@@ -16,7 +16,6 @@ import { spawn } from 'node:child_process';
 import { runtimeById } from './runtimes.mjs';
 import { openBrowserHome, unattendedEnv } from './noWindowEnv.mjs';
 import { resolveTurnProfile } from './turnProfile.mjs';
-import { claudePermFor } from './claudePosture.mjs';
 import { handleStreamLine } from './claudeStream.mjs';
 import { never, workLanesStopped } from './standDownGate.mjs';
 import { learnCodexLimits, recordClaudeRateLimit } from './runtimeLimits.mjs';
@@ -25,11 +24,8 @@ import { codexTurnModel } from './turnModel.mjs';
 import { printableText } from './printable.mjs';
 import { startTurnDiagnostics } from './turnDiagnostics.mjs';
 import { createClaudeInput } from './claudeInput.mjs';
-import { createClaudeSubagents } from './claudeSubagents.mjs';
-import { createCodexSubagentReader } from './codexSubagents.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
-import { createClaudeSubagentProgress } from './claudeSubagentProgress.mjs';
-import { codexSpawnResult } from './codexSubagentEvents.mjs';
+import { createTurnSubagents } from './turnSubagents.mjs';
 
 /** How long a Codex turn's answer may wait on its rollout's model line. */
 const CODEX_MODEL_READ_MS = 1_500;
@@ -71,6 +67,10 @@ export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
 // the console (a legible stream of `read …`, `grep …`, `+ node …`), assistant
 // text is folded into the returned string for sentinel detection, and each
 // activity is handed to `onActivity` so the caller can forward progress.
+/** Linux's per-argument ceiling (`MAX_ARG_STRLEN`, 32 pages): one argv
+ *  string past it is refused at launch with E2BIG. */
+const MAX_ARG_BYTES = 128 * 1024;
+
 export function runTurn(opts) {
   // A Codex write-up runs over an isolated copy of its worktree
   // (codexResearch.mjs). After the teardown it copies nothing either: the
@@ -172,17 +172,22 @@ function runPlainTurn(opts) {
     // than sloppy. `profile` is the NAME of the posture — a promise about what
     // must be impossible during the turn — and every runtime expresses it in its
     // own vocabulary: Claude as an `--allowedTools` verb list, Codex as a kernel
-    // sandbox mode plus feature toggles. `perm` is Claude's expression, looked
-    // up by the SAME name (`claudePermFor`), so the two cannot disagree about
-    // which posture a turn is running under. There is no precedence chain left
-    // to get wrong: the caller named one profile (turnProfile.mjs).
+    // sandbox mode plus feature toggles. `perm` is the runtime's own expression
+    // of the profile, asked of its row by the SAME name (`rt.perm`; Claude's is
+    // `claudePermFor`), so the two cannot disagree about which posture a turn
+    // is running under; a runtime that expresses postures another way has no
+    // hook. There is no precedence chain left to get wrong: the caller named
+    // one profile (turnProfile.mjs).
     const stdinText = rt.stdin?.({ prompt, system, profile: turnProfile.adapterProfile }) ?? null;
     const args = rt.args({
       cardTurn: opts.cardTurn === true,
       orchestration: opts.orchestration === true,
-      codexVersion: measuredRuntimeVersion('codex')?.version,
+      // The lane's own measurement when it decided to orchestrate, so the
+      // hooks and the controller cannot disagree (workAgentTurnExecution.mjs).
+      codexVersion: opts.codexVersion ?? measuredRuntimeVersion('codex')?.version,
+      claudeVersion: opts.claudeVersion ?? measuredRuntimeVersion('claude')?.version ?? null,
 
-      streamInput: stdinText !== null || (rt.id === 'claude' && Boolean(opts.liveMessages)),
+      streamInput: stdinText !== null || (rt.liveInput === true && Boolean(opts.liveMessages)),
       writableDirs: opts.writableDirs,
       personal,
       researchIsolation: opts.researchIsolation,
@@ -229,7 +234,7 @@ function runPlainTurn(opts) {
       // base `.mcp.json` servers the caller mounted, each allowed by name on a
       // profile that mounts them (`projectMcp`, turnProfile.mjs) — never on
       // one that does not, whatever a caller passes.
-      perm: claudePermFor(turnProfile.name, knowledgeDir, vaultDir, turnProfile.projectMcp ? (opts.projectMcpServers ?? []) : []),
+      perm: typeof rt.perm === 'function' ? rt.perm(turnProfile.name, knowledgeDir, vaultDir, turnProfile.projectMcp ? (opts.projectMcpServers ?? []) : []) : [],
       // …AND THE MACHINE'S OWN MCP SERVERS (2026-10-11): the `.mcp.json`
       // server names an agent lane disables beside them, on a profile that
       // mounts project servers — never on one that does not.
@@ -299,12 +304,18 @@ function runPlainTurn(opts) {
         display: display === true,
         browserHome: browser?.dir,
       });
+      // Claude Code 2.1.302 stops background agents 10 minutes after the
+      // parent goes idle with stdin closed, with no final parent turn
+      // (measured; its background shells are outside that ceiling). An
+      // orchestrated card waits for its children instead: the lane's
+      // Interrupt and the turn's expiry bound it.
+      if (rt.id === 'claude' && opts.orchestration === true) childEnv.CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS = '0';
       finishDiagnostics = startTurnDiagnostics({ runtime, bin: rt.bin, env: childEnv,
         cwd, args, stdinBytes: transport.text === null ? 0 : Buffer.byteLength(transport.text),
         profile: turnProfile.name, planId: opts.diagnosticPlanId });
       child = spawn(rt.bin, args, {
         cwd,
-        stdio: [transport.text !== null || (rt.id === 'claude' && opts.liveMessages) ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+        stdio: [transport.text !== null || (rt.liveInput === true && opts.liveMessages) ? 'pipe' : 'ignore', 'pipe', 'pipe'],
         /**
          * ITS OWN PROCESS GROUP, so what the agent starts stays attributable.
          *
@@ -340,6 +351,20 @@ function runPlainTurn(opts) {
       // own browser home.
       releaseArgs();
       browser?.cleanup();
+      // THE COMMAND LINE'S OWN LIMIT, IN WORDS (2026-10-19). A runtime whose
+      // prompt still rides argv (Antigravity's `-p`) hits the OS's per-argument
+      // ceiling on a long message, and the turn failed as "spawn E2BIG". The
+      // refusal is the system's and stays; only its words are new.
+      // Said only when the message IS the oversized argument: E2BIG also
+      // answers an environment too large for the launch, which is not the
+      // person's message and keeps the system's own words.
+      const carrying = error?.code === 'E2BIG' && typeof prompt === 'string' && prompt
+        ? args.find((a) => typeof a === 'string' && a.includes(prompt))
+        : undefined;
+      const bytes = carrying ? Buffer.byteLength(carrying) : 0;
+      if (bytes > MAX_ARG_BYTES) {
+        throw Object.assign(new Error(`${rt.label} takes its message on the command line, and this one is too long for it (${Math.ceil(bytes / 1024)} KB; the system allows ${MAX_ARG_BYTES / 1024} KB per argument, E2BIG). Send it in shorter parts, or attach the long text as a file.`), { code: 'E2BIG' });
+      }
       throw error;
     }
     if (browser) {
@@ -352,7 +377,7 @@ function runPlainTurn(opts) {
     const spawnedAt = Date.now();
     let out = '';
     let stdinError = null;
-    const input = rt.id === 'claude' && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken }) : null;
+    const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken, onContext: opts.onContext ?? null }) : null;
     const pfx = label ? `${label} ` : '';
     /**
      * THE ONE SINK FOR WHAT A CLI OR A MODEL WROTE (2026-10-10, the audit's
@@ -397,25 +422,11 @@ function runPlainTurn(opts) {
       recordClaudeRateLimit(info);
       onRateLimit?.(info);
     };
-    const agentStates = new Map();
-    const reportSubagent = (update) => {
-      if (!update?.id || (!agentStates.has(update.id) && agentStates.size >= 32)) return;
-      agentStates.set(update.id, update.status ?? agentStates.get(update.id) ?? 'running');
-      opts.onSubagent?.(update);
-    };
-    const subagents = createClaudeSubagents(reportSubagent);
-    const claudeProgress = rt.id === 'claude' && opts.onSubagent ? createClaudeSubagentProgress({
-      cwd, since: spawnedAt, env: { ...process.env, ...(mcpEnv ?? {}) },
-      onLine: line => handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText,
-        answerFromResult: true, subagents }),
-    }) : null;
-    const codexAgents = rt.id === 'codex' && opts.onSubagent ? createCodexSubagentReader({
-      since: spawnedAt, env: { ...process.env, ...(mcpEnv ?? {}) },
-      onSubagent: reportSubagent, onActivity, onToolEvent,
-      onSpawnResult: opts.onSpawnResult,
-    }) : null;
+    // The native children this CLI starts, observed (turnSubagents.mjs).
+    const natives = createTurnSubagents({ runtime: rt.id, cwd, since: spawnedAt, env: { ...process.env, ...(mcpEnv ?? {}) },
+      owned: opts.orchestration === true, onSubagent: opts.onSubagent, onSpawnResult: opts.onSpawnResult, resumeThreadId,
+      sinks: { emit, onActivity, onToolEvent, appendText } });
     let codexThread = rt.id === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;
-    if (codexThread) codexAgents?.thread(codexThread);
     /**
      * THE MODEL THIS SPAWN RAN ON, ONCE (2026-09-29, turnModel.mjs). Claude
      * names it in its init event and again on every reply; the first valid
@@ -439,11 +450,13 @@ function runPlainTurn(opts) {
      */
     const harvest = initHarvestFor(rt, args);
     const onInitAll = (i) => {
-      claudeProgress?.session(i?.sessionId);
+      natives.session(i?.sessionId);
       if (harvest.skills) recordSkills(i?.skills);
       if (harvest.mcp) recordMcpServers(i?.mcpServers, i?.tools);
       onInit?.(i);
     };
+    /** This turn's Claude task list, as the plan card reads it (claudeStream.mjs). */
+    const taskPlan = new Map();
     /** One line of the child's stdout, in whichever dialect it speaks. */
     let cliFailed = false;
     const onLine = (line) => {
@@ -465,23 +478,23 @@ function runPlainTurn(opts) {
         }
       } catch { /* ordinary non-JSON CLI output */ }
       if (!rt.parse)
-        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents });
+        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector, tasks: taskPlan });
       const ev = rt.parse(line, cwd);
       if (!ev) return;
       // The conversation id, when the runtime announces one (codex's
       // thread.started). Purely additive: callers that pass no onThreadId —
       // every dispatch path — see zero behavior change.
       if (ev.threadId) {
-        if (rt.id === 'codex') { codexThread = ev.threadId; codexAgents?.thread(ev.threadId); }
+        if (rt.id === 'codex') { codexThread = ev.threadId; natives.thread(ev.threadId); }
         onThreadId?.(ev.threadId);
       }
       // The runtime's own token count (codex's `turn.completed`) — the same
       // `onUsage` Claude's result event feeds, so a caller charges a turn
       // identically whichever CLI ran it.
-      for (const update of ev.subagents ?? []) codexAgents?.update(update);
-      if (rt.id === 'codex') {
-        try { const item = JSON.parse(line)?.item; const result = codexSpawnResult(item); if (result) opts.onSpawnResult?.(result); } catch { /* non-JSON */ }
-      }
+      for (const update of ev.subagents ?? []) natives.update(update);
+      // A receipt the controller cannot take never ends this line's handling,
+      // as when the lane parsed the line again itself (2026-10-18).
+      if (ev.spawnResult) try { opts.onSpawnResult?.(ev.spawnResult); } catch { /* the controller's own failure */ }
       if (ev.toolEvent) onToolEvent?.(...ev.toolEvent);
       if (ev.usage) onUsage?.(ev.usage);
       // One agent MESSAGE, alone — see parseCodexLine's `answer`. Last call
@@ -529,8 +542,7 @@ function runPlainTurn(opts) {
      */
     const onSpawnError = (e) => {
       input?.close();
-      void codexAgents?.stop();
-      void claudeProgress?.stop();
+      natives.abandon();
       if (opts.liveMessages) void opts.liveMessages.stop();
       finishDiagnostics({ pid: child.pid, spawnError: typeof e.code === 'string' ? e.code : 'SPAWN_ERROR' });
       releaseArgs();
@@ -551,17 +563,8 @@ function runPlainTurn(opts) {
       finishDiagnostics({ code, signal, pid: child.pid, output: out, cliFailed, inputError: stdinError?.code });
       const handBack = async () => {
         if (opts.liveMessages) await opts.liveMessages.stop();
-        // Native transcript reads are readouts too: a stuck filesystem must
-        // not hold the card's answer. Readers stop scheduling before draining.
-        let progressTimer;
-        try {
-          await Promise.race([
-            Promise.all([codexAgents?.stop(), claudeProgress?.stop()]),
-            new Promise(resolve => { progressTimer = setTimeout(resolve, CODEX_MODEL_READ_MS); }),
-          ]);
-        } finally { clearTimeout(progressTimer); }
-        for (const [id, status] of agentStates)
-          if (status === 'running' || status === 'waiting') reportSubagent({ id, status: 'stopped' });
+        await natives.drain(CODEX_MODEL_READ_MS);
+        natives.sweep();
         if (stdinError) {
           if (!workLanesStopped()) rejectTurn(stdinError);
           return;

package/bin/lib/runtimeAntigravity.mjs

@@ -103,7 +103,7 @@ export const ANTIGRAVITY_RUNTIME = {
   bin: 'agy',
   install: 'see antigravity.google/docs/cli',
   login: 'agy',
-  live: false,
+  liveInput: false,
   /** None, because it cannot reach the MCP server at all — see `blocked`. */
   /**
    * WIKI AND CONSULT, BUT NOT BUILD — and the split is the whole point of

package/bin/lib/runtimeCapabilities.mjs

@@ -19,6 +19,8 @@ import { RUNTIMES } from './runtimes.mjs';
 import { unattendedEnv } from './noWindowEnv.mjs';
 import { claudeProjectDir } from './claudeSessions.mjs';
 import { CLAUDE_SESSION_RE } from './conversationIds.mjs';
+import { MAX_MCP_SERVERS, MCP_NAME_MAX, MCP_STATUSES } from './mcpReportBounds.mjs';
+import { killGroup } from './processGroup.mjs';
 
 /**
  * WHAT THE CLI SAID IT CAN BE ASKED FOR BY NAME — the machine's skills.
@@ -105,13 +107,10 @@ export function knownSkills() {
  */
 let mcpServersCache = null;
 
-export const MCP_STATUSES = new Set(['connected', 'failed', 'needs-auth', 'pending']);
-/** The server's own bounds (shared `MAX_MACHINE_MCP_SERVERS` and
- *  `MCP_SERVER_NAME_MAX`); scripts/check-app-parity.mjs holds them equal. */
-export const MAX_MCP_SERVERS = 40;
-export const MCP_NAME_MAX = 60;
+export { MCP_STATUSES, MAX_MCP_SERVERS, MCP_NAME_MAX };
 /** The name charset the server's Codex report parser admits
- *  (runtimeOfferings.ts `name`) — Claude's report has none, and its connector
+ *  (runtimeOfferings.ts `CODEX_REPORT_NAME_RE`, held equal by
+ *  check-app-parity rule 16) — Claude's report has none, and its connector
  *  names carry a space (`claude.ai Gmail`). */
 export const CODEX_MCP_NAME = /^[A-Za-z0-9_.:-]+$/;
 
@@ -169,9 +168,14 @@ export function claudeMcpInventoryOf(list, tools) {
   for (const e of list) {
     if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
     const name = e.name.trim().slice(0, MCP_NAME_MAX).trim();
-    if (!name || name === 'flowviant' || seen.has(name)) continue;
+    const scope = typeof e.scope === 'string' ? e.scope : typeof e.source === 'string' ? e.source : null;
+    // The daemon's own `flowviant` rides `--mcp-config`, reported `dynamic`.
+    // One in the person's own config is theirs (2026-10-17, the owner) and is
+    // listed, so a revoked token there reads failed (2026-10-19). An
+    // unscoped report cannot say which, and stays hidden.
+    if (!name || name === 'flowviant' && (scope === 'dynamic' || scope == null) || seen.has(name)) continue;
     const status = MCP_STATUSES.has(e.status) ? e.status : 'other';
-    seen.set(name, { name, status, scope: typeof e.scope === 'string' ? e.scope : typeof e.source === 'string' ? e.source : null, prefix: mcpToolPrefix(e.name.trim()), tools: status === 'connected' ? [] : null });
+    seen.set(name, { name, status, scope, prefix: mcpToolPrefix(e.name.trim()), tools: status === 'connected' ? [] : null });
   }
   // The longest prefix wins, so `a_b` never claims `a`'s tools or the reverse.
   const byPrefix = [...seen.values()].sort((a, b) => b.prefix.length - a.prefix.length);
@@ -470,16 +474,7 @@ function runInitProbe(cwd, extraArgs, spawnChild, done = () => {}) {
     settled = true;
     clearTimeout(timer);
     // The whole group: what the CLI started goes with it.
-    try {
-      if (child.pid) process.kill(-child.pid, 'SIGKILL');
-      else child.kill('SIGKILL');
-    } catch {
-      try {
-        child.kill('SIGKILL');
-      } catch {
-        /* already gone */
-      }
-    }
+    killGroup(child, 'SIGKILL');
     // AFTER the kill, and on a delay: the transcript is the CHILD's file, so
     // deleting it while the child still lives races a recreate.
     removeTranscriptSoon(cwd, sessionId);

package/bin/lib/runtimeClaude.mjs

@@ -14,13 +14,20 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
-import { NO_SETTING_SOURCES, machineMcpServers, personalClaudeSettings, releaseTurnSettings, withPersonalSettings, writeTurnSettings } from './claudePersonal.mjs';
-import { withMachineMcp } from './claudePosture.mjs';
+import { NO_SETTING_SOURCES, personalClaudeSettings, releaseTurnSettings, withPersonalSettings, writeTurnSettings } from './claudePersonal.mjs';
+import { machineMcpServers } from './claudeMachineMcp.mjs';
+import { claudePermFor, withMachineMcp } from './claudePosture.mjs';
+import { withSettings } from './claudeSettingsArg.mjs';
 import { orchestratorHooks } from './orchestratorHooks.mjs';
+import { versionAtLeast } from './versionOrder.mjs';
 
-/** The profiles an agent lane mounts the machine's MCP servers on (2026-10-11):
- *  the ones whose turn profile says `projectMcp` and that Claude declares. */
-const MACHINE_MCP_PROFILES = Object.freeze(['build', 'design', 'research']);
+/** The release the agent lane first measured `--system-prompt-snapshot` on
+ *  (decisions.md, 2026-09-24). */
+export const SYSTEM_PROMPT_SNAPSHOT_MIN = '2.1.281';
+/** `--version` prints "2.1.303 (Claude Code)"; the first word is the version. */
+export function claudeSnapshotFlagKnown(version) {
+  return versionAtLeast(String(version ?? '').trim().split(/\s+/)[0], SYSTEM_PROMPT_SNAPSHOT_MIN);
+}
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -48,10 +55,10 @@ export const CLAUDE_RUNTIME = {
   bin: 'claude',
   install: 'npm i -g @anthropic-ai/claude-code',
   login: 'claude',
-  /** The Agent-SDK live session (persistent, injectable mid-task) is Claude
-   *  only — it is an Anthropic SDK, not a CLI contract. Everything else runs
-   *  the subprocess path. */
-  live: true,
+  /** Takes follow-up messages on stdin mid-turn (claudeInput.mjs,
+   *  workLiveMessages.mjs); a runtime without it gets its follow-ups as the
+   *  next turn, and its delivery is reported taken at spawn. */
+  liveInput: true,
   /**
    * Every profile, because every profile is DEFINED in its vocabulary: the
    * four `--allowedTools` lists in claudePosture.mjs are what "build", "wiki",
@@ -92,17 +99,30 @@ export const CLAUDE_RUNTIME = {
    *     RETIRED_POSTURE_KEYS), so no spelling of it reads as one.
    *   adopt: 'fork' — a terminal conversation is forked into the tab's
    *     worktree (`--resume <id> --fork-session`).
+   *   liveInput (above) — a follow-up reaches the running CLI on stdin
+   *     (2026-10-18, the SOLID pass: the tab, agent and runTurn lanes spelled
+   *     it `rt.id === 'claude'`, and the row's old `live` flag was read by
+   *     nothing).
    */
   tab: 'mcp',
   planTurns: true,
   adopt: 'fork',
   mcp: claudeMcp,
+  /**
+   * THE POSTURE AS CLAUDE'S `--allowedTools` LIST (2026-10-18, the SOLID
+   * pass), looked up by the turn profile's name (claudePosture.mjs
+   * `claudePermFor`). runTurn asks the row for it, so it knows no runtime's
+   * list: a runtime that expresses postures another way — Codex's sandbox
+   * modes, agy's flags — has no hook, and Claude's table needs no stub for a
+   * posture only another CLI runs.
+   */
+  perm: claudePermFor,
   /**
    * Claude takes the operating contract as a real system prompt, which is the
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false }) {
+  args({ writableDirs = [], prompt, system, model, effort, resume, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, vaultDir, agentTools, personalSettings, machineMcp, baseMcp = [], mcpCheckout = null, streamInput = false, orchestration = false, claudeVersion = null }) {
     // THE CARTOGRAPHER'S FENCE NAMES ITS VAULT (2026-10-10): its one write rule
     // is the vault's absolute path (claudePosture.mjs `wikiPermFor`), so a turn
     // with no vault, or one no rule can name, has no list — refused here in
@@ -170,7 +190,6 @@ export const CLAUDE_RUNTIME = {
      * agent renders the CURRENT base snapshot, not the first turn's cache.
      */
     const fenced = profile !== 'build';
-    if (orchestration && !fenced) a.push('--settings', JSON.stringify({ hooks: orchestratorHooks(), disableAllHooks: false }));
     if (fenced) a.push(...NO_SETTING_SOURCES);
     // A FENCED POSTURE NAMES ITS OWN MODE (2026-10-10). Its lists fence only
     // under the CLI's `default` mode, where a tool the list does not name is
@@ -181,22 +200,35 @@ export const CLAUDE_RUNTIME = {
     // states `default` itself, unless its own list names a mode (plan-mode).
     if (fenced && !perm.includes('--permission-mode')) a.push('--permission-mode', 'default');
     else if (agentTools) a.push('--setting-sources', 'user');
-    if (agentTools) {
-      a.push('--system-prompt-snapshot', 'off');
-      if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
-    }
+    // EVERY TURN RENDERS ITS OWN SYSTEM PROMPT (2026-10-19). By default the
+    // CLI records a conversation's first system prompt and resends that record
+    // on every resume "even when a later launch passes different text" —
+    // measured offline on 2.1.303: a resumed turn appended BETA and the model
+    // was sent the first turn's ALPHA. A tab's appended prompt moves between
+    // turns (plan mode on and off, the knowledge and artifact paragraphs), so
+    // a tab switched out of plan mode kept being told to change nothing. An
+    // agent turn always passed this (its current base instructions). A CLI too
+    // old to name the flag refuses it, so an unmeasured version keeps the old
+    // argv.
+    if (agentTools || claudeSnapshotFlagKnown(claudeVersion)) a.push('--system-prompt-snapshot', 'off');
+    if (agentTools?.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     // WHICH MCP SERVERS A TURN MOUNTS. An agent's code, write-up and
     // mockup/3D-model/deck turns (2026-10-11, the owner) mount this machine's
     // own — its user and local servers and the account's claude.ai connectors —
     // beside the base branch's `.mcp.json` copy the caller passes, so they are
     // not strict; `machineMcp` names every `.mcp.json` server from the
     // worktree up, which `withMachineMcp` disables so a worktree edit never
-    // mounts before review (claudePosture.mjs). Every other fenced posture —
-    // consult, wiki, and a design/research turn no lane mounted for — stays
-    // strict: it never discovers a .mcp.json, nor loads the machine's servers.
+    // mounts before review (claudePosture.mjs). Every fenced posture but plan
+    // stays strict unless the lane mounted the machine's servers — consult,
+    // wiki, and a design/research turn no lane mounted for: it never discovers
+    // a .mcp.json, nor loads the machine's servers. Keyed on the rule, not a
+    // list of names, so a posture added later is strict unless it mounts.
     // The plan profile keeps its own principal.
-    const machine = Array.isArray(machineMcp) && MACHINE_MCP_PROFILES.includes(profile);
-    if (['consult', 'wiki', 'design', 'research'].includes(profile) && !machine && !mcp.includes('--strict-mcp-config')) a.push('--strict-mcp-config');
+    //
+    // runTurn hands machineMcp only on a profile whose turn profile says
+    // projectMcp (runTurn.mjs), the one rule.
+    const machine = Array.isArray(machineMcp);
+    if (fenced && profile !== 'plan' && !machine && !mcp.includes('--strict-mcp-config')) a.push('--strict-mcp-config');
     a.push(...mcp, ...resultSchemaArgs);
     a.push('--model', model || MODEL);
     if (effort) a.push('--effort', effort);
@@ -223,14 +255,26 @@ export const CLAUDE_RUNTIME = {
     // leave the file with no turn to release it.
     //
     // …AND THE MACHINE'S SERVERS NO SOURCE OF THIS TURN READS (2026-10-17,
-    // claudePersonal.mjs `machineMcpServers`): the user scope a fenced turn's
+    // claudeMachineMcp.mjs `machineMcpServers`): the user scope a fenced turn's
     // empty source list drops, and the checkout's local scope every card turn
     // missed. In a private file too — a server's env and headers are secrets —
     // minus every name the base copy mounts, which speaks for the project.
-    const own = machine ? machineMcpServers({ user: fenced, checkout: mcpCheckout }) : {};
+    const own = (machine ? machineMcpServers({ user: fenced, checkout: mcpCheckout }) : null) ?? {};
     for (const name of baseMcp) delete own[name];
-    const ownArgs = Object.keys(own).length ? ['--mcp-config', writeTurnSettings({ mcpServers: own })] : [];
-    const postured = machine ? withMachineMcp(perm, machineMcp) : perm;
+    // A file that cannot be written costs the card these servers, never the
+    // card itself: the turn runs with what its own sources load, and says so.
+    let ownArgs = [];
+    if (Object.keys(own).length) {
+      try {
+        ownArgs = ['--mcp-config', writeTurnSettings({ mcpServers: own })];
+      } catch (error) {
+        console.warn(`[agent] this machine's MCP servers are not mounted on this turn: ${error.message}`);
+      }
+    }
+    const mounted = machine ? withMachineMcp(perm, machineMcp) : perm;
+    // The orchestrator's hooks join that same `--settings`: the CLI applies
+    // only the last one it is handed (claudeSettingsArg.mjs `withSettings`).
+    const postured = orchestration && !fenced ? withSettings(mounted, { hooks: orchestratorHooks(), disableAllHooks: false }) : mounted;
     let tail;
     try {
       tail = fenced ? withPersonalSettings(postured, personalSettings ?? personalClaudeSettings()) : postured;

package/bin/lib/runtimeCodex.mjs

@@ -16,7 +16,7 @@ import { ARTIFACT_DIR, FENCE_TMP_DIR } from './artifacts.mjs';
 import { codexPersonalTurn } from './codexPersonal.mjs';
 import { researchFence } from './codexResearch.mjs';
 import { projectReadBoundary, projectReadFence } from './codexProjectRead.mjs';
-import { compareVersions } from './versionOrder.mjs';
+import { versionAtLeast } from './versionOrder.mjs';
 import { codexOrchestratorArgs } from './orchestratorHooks.mjs';
 
 /**
@@ -27,7 +27,11 @@ import { codexOrchestratorArgs } from './orchestratorHooks.mjs';
  * whose one tool carries no annotations (Flowviant's carry none): under the
  * capture chat's read-only argv the call failed "MCP tool call requires
  * approval, but approval policy is never" and never reached the server; under
- * the build posture (workspace-write) the same call ran unasked. With
+ * the build posture (workspace-write) the same call ran unasked — no longer
+ * so on 0.163.0, where a workspace-write card turn refuses it the same way
+ * and only danger-full-access runs it (2026-10-17; a card approves the
+ * person's own servers by name, projectToolRuntimes.mjs `personalApprovals`).
+ * With
  * `mcp_servers.flowviant.default_tools_approval_mode="approve"` beside the
  * read-only argv it ran — and in the same turn a shell write still failed
  * "Read-only file system" and an escalation still failed "approval policy is
@@ -88,8 +92,7 @@ export const NO_SUBAGENTS = Object.freeze(['-c', 'features.multi_agent=false', '
  * and V2. Older/unmeasured binaries have no inheritance evidence here. */
 export const CODEX_SUBAGENTS_MIN = '0.160.0';
 export function codexSubagentsSafe(version) {
-  const order = compareVersions(String(version ?? '').replace(/^codex-cli\s+/, ''), CODEX_SUBAGENTS_MIN);
-  return order === 0 || order === 1;
+  return versionAtLeast(String(version ?? '').replace(/^codex-cli\s+/, ''), CODEX_SUBAGENTS_MIN);
 }
 
 /**
@@ -170,6 +173,9 @@ const codexWikiFence = (vaultDir) => [
 ];
 
 function codexPrompt({ system, prompt, profile = 'build' }) {
+  // A resumed tab whose thread already holds the contract sends none
+  // (codexContract.mjs): the message alone.
+  if (!system) return prompt;
   const readers = profile === 'consult' || profile === 'plan'
     ? '\nUse exec_command with shell="/bin/bash" and login=false for project discovery. Project files, local Git history and the project knowledge directory are readable; host files are outside this turn’s read boundary.'
     : '';
@@ -183,7 +189,7 @@ export const CODEX_RUNTIME = {
   bin: 'codex',
   install: 'npm i -g @openai/codex',
   login: 'codex login',
-  live: false,
+  liveInput: false,
   /**
    * BUILD AND CONSULT. See `args()` below for how consult is expressed — the
    * short version is that Codex keeps the promise at the kernel rather than in
@@ -296,7 +302,7 @@ export const CODEX_RUNTIME = {
       // before it started. `-c sandbox_mode=` means the same on both.
       if (writableDirs.length) a.push('-c', `sandbox_workspace_write.writable_roots=${JSON.stringify(writableDirs)}`);
       a.push('-c', `sandbox_mode="${SAFE ? 'workspace-write' : 'danger-full-access'}"`);
-      if (cardTurn) a.push('-c', 'approval_policy="never"');
+      if (cardTurn) a.push('-c', 'approval_policy="never"', ...(agentTools?.codexApprovals ?? []));
       a.push(...(cardTurn && profile === 'build' && codexSubagentsSafe(codexVersion)
         ? ['-c', 'features.multi_agent=true', '-c', 'features.goals=false']
         : NO_SUBAGENTS));

package/bin/lib/runtimeEvents.mjs

@@ -14,7 +14,7 @@
  * own stream loop and calls `humanizeClaudeTool`/`toolEventOf` from it.
  */
 
-import { codexCollabUpdates } from './codexSubagentEvents.mjs';
+import { codexCollabUpdates, codexSpawnResult } from './codexSubagentEvents.mjs';
 
 /** Truncate for a one-line activity label. */
 const oneLine = (s, n = 140) =>
@@ -312,7 +312,10 @@ function humanizeCodexItem(item = {}, cwd = '') {
  * threadId }` — `text` accumulates the agent's own words, because the wiki
  * lane reads its sentinels (WIKI_DONE / REGROUND_DONE, claude.mjs
  * `sawSentinel`) out of exactly that; `threadId` surfaces once, off the lifecycle event, for callers that
- * need to resume THIS conversation later (runTurn's onThreadId).
+ * need to resume THIS conversation later (runTurn's onThreadId). `spawnResult`
+ * is a native spawn's receipt (codexSubagentEvents.mjs), relayed to the
+ * orchestrator; it rides any event this parser keeps, read off the same parse
+ * (2026-10-18, the SOLID pass: the spawn lane parsed every line a second time).
  */
 export function parseCodexLine(line, cwd) {
   let ev;
@@ -321,6 +324,14 @@ export function parseCodexLine(line, cwd) {
   } catch {
     return null; // not every line is JSON (warnings go to stderr, but be safe)
   }
+  const parsed = codexEventOf(ev, cwd);
+  if (!parsed) return parsed;
+  const spawnResult = codexSpawnResult(ev.item);
+  return spawnResult ? { ...parsed, spawnResult } : parsed;
+}
+
+/** One ThreadEvent, already parsed, in the daemon's vocabulary. */
+function codexEventOf(ev, cwd) {
   if (['item.started', 'item.updated', 'item.completed'].includes(ev.type) &&
       (ev.item?.type ?? ev.item?.item_type) === 'collab_tool_call')
     return { subagents: codexCollabUpdates(ev.item), activity: null, text: '' };

package/bin/lib/runtimeOfferings.mjs

@@ -1,10 +1,12 @@
 /** Local, bounded Codex readouts. No agent turn is started for these reports. */
 import { execFileSync } from 'node:child_process';
 import { accessSync, constants, readFileSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { basename, delimiter, isAbsolute, join } from 'node:path';
 import { readBaseTools } from './projectTools.mjs';
 import { mcpRefusal } from './projectToolRuntimes.mjs';
 import { CODEX_MCP_NAME, normalizeMcpReport } from './runtimeCapabilities.mjs';
+import { mcpCommandNotFoundReason, mcpEnvUnsetReason } from './mcpReasons.mjs';
 import { unattendedEnv } from './noWindowEnv.mjs';
 import { codexHome } from './codexHome.mjs';
 
@@ -15,9 +17,12 @@ let repoCached = null;
 const nameOk = (name) => typeof name === 'string' && /^[A-Za-z0-9_.:-]{1,80}$/.test(name) && name !== 'flowviant';
 // An unattended CLI child like any other (noWindowEnv.mjs, 2026-10-10): `codex
 // mcp list` may start the person's configured servers, and none of them is
-// handed the machine credential or a display.
+// handed the machine credential or a display. From the home directory
+// (2026-10-17): in a trusted checkout — the daemon's own cwd — Codex lists
+// that checkout's `.codex/config.toml` servers as well (measured, 0.163.0),
+// which no card mounts.
 const run = (args, env) => execFileSync('codex', args, {
-  encoding: 'utf8', timeout: 5000, maxBuffer: 128 * 1024,
+  encoding: 'utf8', timeout: 5000, maxBuffer: 128 * 1024, cwd: homedir(),
   stdio: ['ignore', 'pipe', 'ignore'], env: unattendedEnv(env),
 });
 /**
@@ -91,7 +96,9 @@ function commandFound(command, env) {
 export function codexServerRows(servers, env = process.env) {
   const rows = [];
   for (const s of servers) {
-    if (!s || typeof s.name !== 'string' || !nameOk(s.name)) continue;
+    // `mcp list` reads the person's own config; the daemon's `flowviant`
+    // rides `-c` and is never in it, so one of that name is theirs.
+    if (!s || typeof s.name !== 'string' || !(nameOk(s.name) || s.name === 'flowviant')) continue;
     const t = s.transport && typeof s.transport === 'object' ? s.transport : {};
     const auth = typeof s.auth_status === 'string' ? s.auth_status : '';
     let status = 'configured';
@@ -105,10 +112,10 @@ export function codexServerRows(servers, env = process.env) {
       reason = typeof s.disabled_reason === 'string' ? s.disabled_reason.slice(0, 200) : null;
     } else if (typeof t.command === 'string' && commandFound(t.command, env) === false) {
       status = 'failed';
-      reason = `command ${basename(t.command).slice(0, 60)} not found`;
+      reason = mcpCommandNotFoundReason(basename(t.command).slice(0, 60));
     } else if (unset.length) {
       status = 'failed';
-      reason = `env ${[...new Set(unset)].sort().join(', ')} unset`;
+      reason = mcpEnvUnsetReason([...new Set(unset)].sort());
     } else if (['needs_auth', 'not_logged_in', 'notLoggedIn'].includes(auth)) {
       status = 'needs-auth';
     } else if (auth === 'failed') {

package/bin/lib/runtimes.mjs

@@ -131,7 +131,9 @@ export const runtimeLabel = (id) => runtimeById(id)?.label ?? String(id);
  * So the restriction is gone and this is back to "installed, and this module
  * knows how to spawn it" — which is what the registry's `live` flag always
  * described: not which runtimes can run, but which get a session instead of a
- * subprocess.
+ * subprocess. (That flag is gone: since 2026-10-18 the rows carry
+ * `liveInput`, a different fact — whether follow-ups reach the running CLI
+ * on stdin.)
  *
  * LIVE is no longer read here. That is deliberate and load-bearing: this
  * predicate feeds both the roster report AND the claim, and if the two ever

package/bin/lib/startProject.mjs

@@ -208,6 +208,16 @@ export async function resolveStartProject({ dirGiven }) {
           `or connect this repo to its own project with \`${terminalCommand('login')}\`.`
       );
       process.exit(1);
+    } else if (interactive && !CREDENTIAL.choices?.length) {
+      // NOTHING STORED AND A PERSON AT THE TERMINAL IS A FIRST CONNECTION
+      // (2026-10-19). The app's connect command ends in a bare `flowviant`
+      // and the README promises "approve the code in Flowviant → connected",
+      // yet this branch printed "no credential found" and exited 1 — so the
+      // one command every first connection runs failed after a successful
+      // install. Log in here, as the picker's connect row does; headless
+      // still refuses in the words below, because nobody can approve a code.
+      console.log('No project is connected on this machine yet — connecting one now.');
+      await reexecAfterLogin();
     } else {
       console.error(
         'error: no credential found. Easiest:\n' +