flowviant 0.125.5 → 0.125.7

package/bin/lib/claudeSettingsArg.mjs

@@ -0,0 +1,67 @@
+/**
+ * A TURN'S ONE `--settings`, SPLICED AND READ IN ONE PLACE (2026-10-18, the
+ * SOLID pass). Three functions in two modules spliced the flag — the machine's
+ * MCP settings and the orchestrator's hooks (claudePosture.mjs), the person's
+ * kept keys (claudePersonal.mjs) — each repeating find, parse, merge, then
+ * splice or prepend, and the turn diagnostics read it a fourth way. The
+ * 2026-10-17 bug (the orchestrator's hooks on a second `--settings`, never
+ * loaded) is that class: the next thing a turn's settings carry merges here,
+ * into the one flag, and claudeSettingsArg.test.mjs keeps every other module
+ * from finding it for itself.
+ *
+ * THE PERSONAL STEP RUNS LAST. claudePersonal.mjs `withPersonalSettings` turns
+ * the value into the path of a private file (the person's keys never ride
+ * argv), so nothing merges after it: `replaceSettings` reads inline JSON only
+ * and refuses a path in words — merging into that file would put the person's
+ * secrets back on the command line. `settingsAt`, the diagnostics' reader,
+ * reads either.
+ */
+import { readFileSync } from 'node:fs';
+
+/** The turn's `--settings`: where it stands (-1 for none) and what it holds —
+ *  null with no flag, else the inline JSON or the file it names, parsed. May
+ *  throw (a file gone, a value that does not parse); the caller decides. */
+export function settingsAt(args) {
+  const at = args.indexOf('--settings');
+  if (at < 0) return { at, settings: null };
+  const input = args[at + 1];
+  return { at, settings: JSON.parse(input.startsWith('{') ? input : readFileSync(input, 'utf8')) };
+}
+
+/** An inline value, parsed — never a path (see the header). */
+function inline(value) {
+  if (typeof value !== 'string' || !value.startsWith('{')) {
+    throw new Error("this turn's --settings already names a file; nothing merges after the personal settings");
+  }
+  return JSON.parse(value);
+}
+
+/**
+ * `perm` with its one `--settings` replaced by `fn(posture)` — `posture` the
+ * flag's own object, `{}` where there is none — standing where the flag stood,
+ * or before the lists when there was none (`--allowedTools` is variadic).
+ */
+export function replaceSettings(perm, fn) {
+  const at = perm.indexOf('--settings');
+  const value = at < 0 ? fn({}) : fn(inline(perm[at + 1]));
+  return at < 0 ? ['--settings', value, ...perm] : [...perm.slice(0, at), '--settings', value, ...perm.slice(at + 2)];
+}
+
+/**
+ * ONE `--settings` PER TURN (2026-10-17). Claude Code applies only the LAST
+ * `--settings` it is handed (measured, 2.1.302: two flags each holding a
+ * PreToolUse hook ran the second hook alone). The card orchestrator's hooks
+ * rode a flag of their own ahead of the machine-MCP settings (claudePosture.mjs
+ * `withMachineMcp`), so on every code card that mounts the machine's servers
+ * the spawn gate, child registration and checkpoints never loaded
+ * (claudeOrchestratorHooks.test.mjs
+ * re-measures it on the real CLI). `extra` hooks join the posture's per event,
+ * after its own; its other keys win over the posture's.
+ */
+export function withSettings(perm, { hooks: extraHooks = {}, ...extra }) {
+  return replaceSettings(perm, (posture) => {
+    const hooks = { ...(posture.hooks ?? {}) };
+    for (const [event, rows] of Object.entries(extraHooks)) hooks[event] = [...(hooks[event] ?? []), ...rows];
+    return JSON.stringify({ ...posture, ...extra, hooks });
+  });
+}

package/bin/lib/claudeStream.mjs

@@ -79,8 +79,28 @@ export function usageFromResult(ev) {
 // container that reports no spend, which is indistinguishable from an older
 // daemon by design. A callback that is silent when it breaks has to be called
 // directly by something.
+/**
+ * One TaskCreate/TaskUpdate result, applied to a turn's task list (`tasks`, a
+ * Map of id → `{ content, status }` in creation order). True when the list
+ * changed. A task an earlier turn created is not on this turn's list, and an
+ * update to it changes nothing here: its subject was never said.
+ */
+export function taskPlanChanged(tasks, result) {
+  if (!result || typeof result !== 'object') return false;
+  const made = result.task;
+  if (made && typeof made.id === 'string' && typeof made.subject === 'string' && made.subject.trim()) {
+    tasks.set(made.id, { content: made.subject, status: 'pending' });
+    return true;
+  }
+  const to = result.statusChange?.to;
+  if (typeof result.taskId !== 'string' || typeof to !== 'string' || !tasks.has(result.taskId)) return false;
+  if (to === 'deleted') tasks.delete(result.taskId);
+  else tasks.set(result.taskId, { ...tasks.get(result.taskId), status: to });
+  return true;
+}
+
 export function handleStreamLine(line, options) {
-  const { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit, onModel, subagents } = options;
+  const { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit, onModel, subagents, tasks } = options;
   let ev;
   try {
     ev = JSON.parse(line);
@@ -164,6 +184,15 @@ export function handleStreamLine(line, options) {
       }
     }
   } else if (ev.type === 'user' && Array.isArray(ev.message?.content)) {
+    // THE TASK LIST IS THE PLAN NOW (2026-10-19). Claude Code 2.1.303 offers
+    // TaskCreate/TaskUpdate and no TodoWrite (measured: the tools a `-p` turn
+    // is handed), so the plan card — built from TodoWrite — never drew. Each
+    // result says what it did (`tool_use_result`: the created task's id and
+    // subject, or a task's status change), so the turn's own list is kept here
+    // and handed on in TodoWrite's shape, which the card already reads.
+    if (!agentId && tasks && taskPlanChanged(tasks, ev.tool_use_result)) {
+      onToolEvent?.('TodoWrite', { todos: [...tasks.values()] }, { id: 'claude-task-list' });
+    }
     for (const b of ev.message.content) {
       if (b.type === 'tool_result') onToolEvent?.(null, {}, {
         id: b.tool_use_id, result: true, isError: b.is_error === true,

package/bin/lib/claudeSubagentProgress.mjs

@@ -6,11 +6,11 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { claudeProjectDir } from './claudeSessions.mjs';
 import { CLAUDE_SESSION_RE } from './conversationIds.mjs';
+import { followJsonl, newTail } from './jsonlTail.mjs';
 
-const MAX_READ = 4 * 1024 * 1024;
-const LINE_MAX = 256 * 1024;
 export function createClaudeSubagentProgress({ cwd, since = Date.now(), env = process.env, onLine }) {
-  let file, offset = null, rest = Buffer.alloc(0), skip = false, timer;
+  const tail = newTail();
+  let file, timer;
   let chain = Promise.resolve();
   const flush = () => {
     chain = chain.then(async () => {
@@ -18,31 +18,15 @@ export function createClaudeSubagentProgress({ cwd, since = Date.now(), env = pr
       let fh;
       try {
         fh = await open(file, 'r');
-        const { size } = await fh.stat();
-        if (offset === null) { offset = Math.max(0, size - MAX_READ); skip = offset > 0; }
-        if (size < offset) { offset = 0; rest = Buffer.alloc(0); }
-        const end = Math.min(size, offset + MAX_READ);
-        while (offset < end) {
-          const buf = Buffer.alloc(Math.min(LINE_MAX, end - offset));
-          const { bytesRead } = await fh.read(buf, 0, buf.length, offset);
-          if (!bytesRead) break;
-          offset += bytesRead;
-          const data = Buffer.concat([rest, buf.subarray(0, bytesRead)]);
-          let start = 0, nl;
-          while ((nl = data.indexOf(10, start)) >= 0) {
-            const line = data.subarray(start, nl).toString('utf8'); start = nl + 1;
-            if (skip) { skip = false; continue; }
-            try {
-              const ev = JSON.parse(line);
-              if (ev.type !== 'progress' || ev.data?.type !== 'agent_progress' || !ev.parentToolUseID) continue;
-              const at = Date.parse(ev.timestamp ?? '');
-              if (!Number.isFinite(at) || at < since) continue;
-              onLine(line);
-            } catch { /* torn or unknown native row */ }
-          }
-          rest = data.subarray(start);
-          if (rest.length > LINE_MAX) { rest = Buffer.alloc(0); skip = true; }
-        }
+        await followJsonl(fh, tail, line => {
+          try {
+            const ev = JSON.parse(line);
+            if (ev.type !== 'progress' || ev.data?.type !== 'agent_progress' || !ev.parentToolUseID) return;
+            const at = Date.parse(ev.timestamp ?? '');
+            if (!Number.isFinite(at) || at < since) return;
+            onLine(line);
+          } catch { /* torn or unknown native row */ }
+        });
       } catch { /* the transcript can appear after init */ }
       finally { await fh?.close().catch(() => {}); }
     }).catch(() => {});

package/bin/lib/claudeSubagents.mjs

@@ -1,3 +1,5 @@
+import { NATIVE_AGENT_TOOLS } from './nativeAgentTools.mjs';
+
 /** Native tool-use ids are stable for the lifetime of an Agent/Task call. */
 export function createClaudeSubagents(report = () => {}) {
   const calls = new Map();
@@ -29,12 +31,12 @@ export function createClaudeSubagents(report = () => {}) {
       const agentId = identify(ev);
       if (ev.type === 'assistant') {
         for (const b of ev.message?.content ?? []) {
-          if (b.type === 'tool_use' && b.name === 'AskUserQuestion' && agentId) {
+          if (b.type === 'tool_use' && NATIVE_AGENT_TOOLS.claude.ask.includes(b.name) && agentId) {
             questions.set(b.id, agentId);
             if (questions.size > 128) questions.delete(questions.keys().next().value);
             report({ id: agentId, status: 'asked' });
           }
-          if (b.type !== 'tool_use' || !['Agent', 'Task'].includes(b.name) || !b.id) continue;
+          if (b.type !== 'tool_use' || !NATIVE_AGENT_TOOLS.claude.spawn.includes(b.name) || !b.id) continue;
           const input = b.input ?? {};
           const id = aliases.get(input.resume) ?? b.id;
           calls.set(b.id, { id, input });

package/bin/lib/codexContract.mjs

@@ -0,0 +1,52 @@
+/**
+ * A CODEX TAB'S CONTRACT, SENT WHEN IT IS NEWS (2026-10-19).
+ *
+ * Codex has no system prompt for a resumed `exec`: the tab's contract rode at
+ * the head of EVERY turn's message, so each turn added its ~6 KB to the thread
+ * again — measured offline on 0.163, the third turn's request carried it three
+ * times — and a long tab compacted early, on copies of the same instructions.
+ * `developer_instructions` is no way out: a resumed thread keeps the ones it
+ * started with and ignores a changed value (measured the same way), and the
+ * contract does change (the knowledge and artifact paragraphs).
+ *
+ * So a resumed thread is sent the contract only when it is news: a thread this
+ * marker has not seen, a contract whose text changed, or every
+ * `CONTRACT_RESEND_EVERY`th turn — a bound on what a compaction may have
+ * summarised away. A fresh thread is always sent it. The marker sits beside
+ * the tab's thread marker, scoped by session, owner-only, best-effort: an
+ * unreadable one sends the contract, as before.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+
+export const CODEX_CONTRACT_MARKER = 'flowviant-codex-contract';
+export const CONTRACT_RESEND_EVERY = 8;
+
+const digest = (text) => createHash('sha256').update(String(text ?? '')).digest('hex');
+const read = (path) => {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+/** Does the resumed `thread` already hold this `system` text, recently? */
+export function codexContractKnown(path, thread, system) {
+  if (!path || !thread) return false;
+  const m = read(path);
+  return m?.thread === thread && m.hash === digest(system) && Number.isInteger(m.since) && m.since < CONTRACT_RESEND_EVERY;
+}
+
+/** After a turn: what `thread` now holds, and how many turns since it was
+ *  last sent the contract (`sent`: whether this turn carried it). */
+export function recordCodexContract(path, thread, system, sent) {
+  if (!path || !thread) return;
+  const m = sent ? null : read(path);
+  const since = !sent && m?.thread === thread && Number.isInteger(m.since) ? m.since + 1 : 0;
+  try {
+    writeFileSync(path, JSON.stringify({ thread, hash: digest(system), since }), { mode: 0o600 });
+  } catch {
+    /* best-effort: the next turn sends the contract */
+  }
+}

package/bin/lib/codexFencedMount.mjs

@@ -0,0 +1,275 @@
+/**
+ * THE MCP SERVERS ON A FENCED CODEX TURN, AS `-c` PAIRS — the project's and
+ * the machine's own (`codexFencedMount`, below). Split out of
+ * projectToolRuntimes.mjs (2026-10-17), whose table row hands it out as
+ * `fencedMount`; the build's config.toml stays there.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { codexHome } from './codexHome.mjs';
+import { parseCodexToml, TomlRaw, toml, tomlValue } from './codexToml.mjs';
+
+/** The environment names a fenced Codex turn's MCP header values ride under,
+ *  one per header (`codexFencedMount`). */
+export const MCP_HEADER_ENV_PREFIX = 'FLOWVIANT_MCP_HEADER_';
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const SERVER_NAME = /^[A-Za-z0-9_-]{1,80}$/;
+const expands = (value) => /\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(String(value));
+/**
+ * Names this machine's Codex, or the shell and tools under it, read for
+ * themselves. A server's env value rides in the CLI's own environment
+ * (`env_vars` forwards it), so a name the machine does not already set to that
+ * value would change how the CLI itself runs — a proxy, a CA bundle, a
+ * provider key. Such a server is left unmounted, in words.
+ */
+const CLI_ENV =
+  /^(PATH|HOME|SHELL|USER|LOGNAME|PWD|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|DISPLAY|WAYLAND_DISPLAY|BROWSER|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|RUST_LOG|RUST_BACKTRACE|HTTPS?_PROXY|ALL_PROXY|NO_PROXY|https?_proxy|all_proxy|no_proxy)$|^(LC|XDG|LD|DYLD|OPENAI|CODEX|AZURE_OPENAI|FLOWVIANT)_/;
+
+/** This machine's own Codex servers: its config.toml's `[mcp_servers.*]`,
+ *  read the way codexPersonal.mjs reads the login (bounded; a file that does
+ *  not parse carries nothing). `[]` when there is no file, NULL when there is
+ *  one this cannot read (2026-10-17: unknown, never "none"). */
+function machineCodexServers(machineEnv) {
+  let text;
+  try {
+    const path = join(resolve(codexHome(machineEnv)), 'config.toml');
+    const st = statSync(path);
+    if (!st.isFile() || st.size > 1024 * 1024) return null;
+    text = readFileSync(path, 'utf8');
+  } catch (error) {
+    return error?.code === 'ENOENT' ? [] : null;
+  }
+  try {
+    const servers = parseCodexToml(text)?.mcp_servers;
+    if (servers === undefined) return [];
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return null;
+    return Object.entries(servers).filter(([, v]) => v && typeof v === 'object' && !Array.isArray(v));
+  } catch {
+    return null;
+  }
+}
+const APPROVAL_MODES = new Set(['auto', 'prompt', 'writes', 'approve']);
+const tomlScalar = (v) => (v instanceof TomlRaw ? v.text : typeof v === 'number' && Number.isFinite(v) ? String(v) : null);
+const words = (v) => (Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : null);
+const table = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+
+/**
+ * THE MCP SERVERS ON A FENCED CODEX TURN — the project's and, since 2026-10-11,
+ * the machine's own (the owner: "the server that is running flowviant's claude
+ * HAS these MCPs yet the agents are not using them"). A Codex build reads both
+ * from the agent's config.toml (`isolatedCodexHome`: the person's own tables
+ * kept, the repo's beside them). Every fenced posture — write-up, mockup,
+ * 3D model, deck, image — passes `--ignore-user-config`, which drops that
+ * file, and a `-p` profile layered beside the flag was measured to load no
+ * server either (codex-cli 0.159.2, artifactProjectMcp.test.mjs). So these
+ * turns take the servers as `-c` pairs, the way codexPersonal.mjs carries a
+ * login back, under the same rule: A LITERAL SECRET NEVER RIDES ARGV.
+ *
+ *  · A stdio server's command and arguments ride as written: they are the
+ *    server process's own command line once Codex starts it, so `-c` adds no
+ *    reader. A project server whose command or arguments expand a `${VAR}`
+ *    is still left unmounted (the 2026-10-10 audit took expanded values off
+ *    argv, and this keeps that line).
+ *  · Every env value rides in the turn's ENVIRONMENT under its own name,
+ *    forwarded by Codex's `env_vars` — except a project value with no `${VAR}`,
+ *    which is text of the reviewed file and rides as written. Refused (the
+ *    server is left unmounted, with the reason) when the name is the
+ *    daemon's own (`FLOWVIANT_*`, `CODEX_HOME`), when this machine already
+ *    sets it to something else, or when it is one the CLI reads itself
+ *    (`CLI_ENV`) and the machine does not set it.
+ *  · Every header value rides in the environment, named by
+ *    `env_http_headers`. A machine server's own `env_http_headers`,
+ *    `bearer_token_env_var` and `env_vars` are names, and ride as written.
+ *  · A URL that expands a `${VAR}`, or carries a query, fragment or
+ *    credentials, has no indirection in Codex's config: left unmounted.
+ *  · A machine server keeps its own `cwd`, timeouts, tool lists, header
+ *    helper (a command, riding as written, as a stdio command does), OAuth
+ *    scopes, resource and settings — all but `oauth.client_secret`, which
+ *    stays off argv and is said; it is skipped where the person turned it
+ *    off (`enabled = false`), and a project server of the same name replaces
+ *    it, as on the build. The person's own `flowviant` rides too: a card
+ *    mints no Flowviant server of its own (hooks/mcpAllow.mjs, 2026-10-17).
+ *  · Each mounted server's tools are approved by name: an unannotated tool
+ *    under a fenced posture failed "MCP tool call requires approval, but
+ *    approval policy is never" (measured, 0.159.2) — never a blanket
+ *    approval policy. A machine server keeps the person's own modes, its
+ *    default and each tool's (2026-10-17: an unconditional approval
+ *    overrode a person's "prompt"), and is approved only where they set
+ *    none; one that asks before every call is left unmounted, and one with
+ *    tools that ask is mounted and said (`partial`), since nobody can
+ *    approve on this turn (measured, 0.163.0: a tool's mode beats its
+ *    server's, and "auto", "writes" and "prompt" each refuse an unannotated
+ *    tool there).
+ *
+ * `usable` is the base snapshot's ready entries, `turnServers` the card's
+ * own (prepareAgentTools); `expand` reads a value the
+ * way projectTools.mjs does; `machineEnv` is the caller's own (what the child
+ * would inherit). Returns `{ args, env, mounted, machine, unmounted }`:
+ * `mounted` the project servers, `machine` the machine's own (null when its
+ * config.toml could not be read), and
+ * `unmounted` `[{ name, reason, source: 'project' | 'machine', partial? }]`.
+ */
+export function codexFencedMount(usable, expand, machineEnv, turnServers = {}) {
+  const args = [];
+  const childEnv = {};
+  const mounted = [];
+  const machine = [];
+  const unmounted = [];
+  let header = 0;
+  /** A refusal sentence, or null with the value staged in `extra`. */
+  const forward = (key, value, extra) => {
+    if (key.startsWith('FLOWVIANT_') || key === 'CODEX_HOME') return `its env ${key} is a name this daemon keeps for itself`;
+    const has = machineEnv[key];
+    if (has !== undefined) return has === value ? null : `its env ${key} would replace this machine's own ${key}, which a fenced Codex turn cannot do`;
+    if (CLI_ENV.test(key)) return `its env ${key} is one this machine's Codex reads itself, which a fenced Codex turn cannot set`;
+    const staged = childEnv[key] ?? extra[key];
+    if (staged !== undefined && staged !== value) return `its env ${key} would replace another server's ${key}`;
+    extra[key] = value;
+    return null;
+  };
+  const headerEnv = (headers, extra) =>
+    Object.entries(headers).map(([key, value]) => {
+      const envName = `${MCP_HEADER_ENV_PREFIX}${header++}`;
+      extra[envName] = value;
+      return `${toml(key)}=${toml(envName)}`;
+    });
+  const approve = (name) => ['-c', `mcp_servers.${name}.default_tools_approval_mode="approve"`];
+  const accept = (name, pairs, extra, list, approval = approve(name)) => {
+    args.push(...pairs, ...approval);
+    Object.assign(childEnv, extra);
+    list.push(name);
+  };
+
+  // THE CARD'S OWN SERVERS (2026-10-17) — `card_repositories` on a
+  // multi-repository card — which rode only the home's config.toml, ignored
+  // here. The daemon's words; their env by name (the values are the turn's
+  // environment already), and no project or machine server of their name.
+  const owned = Object.entries(turnServers ?? {}).filter(([name, c]) => SERVER_NAME.test(name) && typeof c?.command === 'string');
+  for (const [name, config] of owned) {
+    const keys = Object.keys(config.env ?? {}).filter((k) => ENV_NAME.test(k));
+    const pairs = ['-c', `mcp_servers.${name}.command=${toml(config.command)}`, '-c', `mcp_servers.${name}.args=[${(Array.isArray(config.args) ? config.args : []).map((v) => toml(String(v))).join(',')}]`];
+    if (keys.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${keys.map(toml).join(',')}]`);
+    accept(name, pairs, Object.fromEntries(keys.map((k) => [k, String(config.env[k])])), []);
+  }
+  const ownNames = new Set(owned.map(([name]) => name));
+
+  for (const { name, config } of usable) {
+    if (ownNames.has(name)) continue;
+    const pairs = [];
+    const extra = {};
+    let refused = null;
+    if (typeof config.command === 'string') {
+      const rawArgs = Array.isArray(config.args) ? config.args : [];
+      if (expands(config.command) || rawArgs.some(expands)) {
+        refused = 'its command or arguments name a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(String(config.command))}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map((v) => toml(String(v))).join(',')}]`);
+        const forwarded = [];
+        for (const [key, value] of Object.entries(config.env ?? {})) {
+          if (!ENV_NAME.test(key)) continue;
+          if (!expands(value)) {
+            pairs.push('-c', `mcp_servers.${name}.env.${key}=${toml(String(value))}`);
+            continue;
+          }
+          refused = forward(key, expand(value), extra);
+          if (refused) break;
+          forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+      }
+    } else if (typeof config.url === 'string') {
+      if (expands(config.url)) {
+        refused = 'its URL names a ${VAR}, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(String(config.url))}`);
+        const named = headerEnv(Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v)])), extra);
+        if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+      }
+    } else continue;
+    if (refused) unmounted.push({ name, reason: refused, source: 'project' });
+    else accept(name, pairs, extra, mounted);
+  }
+
+  const projectNames = new Set([...usable.map((t) => t.name), ...ownNames]);
+  const personal = machineCodexServers(machineEnv);
+  for (const [name, server] of personal ?? []) {
+    if (projectNames.has(name) || server.enabled === false) continue;
+    if (typeof server.command !== 'string' && typeof server.url !== 'string') continue;
+    const pairs = [];
+    const extra = {};
+    const partial = [];
+    let refused = SERVER_NAME.test(name) ? null : 'its name cannot be spelled as a command-line setting';
+    if (!refused && typeof server.command === 'string') {
+      const rawArgs = server.args === undefined ? [] : words(server.args);
+      if (!rawArgs) refused = 'its args are not a list of words';
+      else {
+        pairs.push('-c', `mcp_servers.${name}.command=${toml(server.command)}`);
+        pairs.push('-c', `mcp_servers.${name}.args=[${rawArgs.map(toml).join(',')}]`);
+        const forwarded = [...(words(server.env_vars) ?? []).filter((k) => ENV_NAME.test(k))];
+        for (const [key, value] of Object.entries(table(server.env))) {
+          if (!ENV_NAME.test(key) || typeof value !== 'string') {
+            refused = `its env ${String(key).slice(0, 40)} is not a name and text`;
+            break;
+          }
+          refused = forward(key, value, extra);
+          if (refused) break;
+          if (!forwarded.includes(key)) forwarded.push(key);
+        }
+        if (forwarded.length) pairs.push('-c', `mcp_servers.${name}.env_vars=[${forwarded.map(toml).join(',')}]`);
+        if (typeof server.cwd === 'string') pairs.push('-c', `mcp_servers.${name}.cwd=${toml(server.cwd)}`);
+      }
+    } else if (!refused) {
+      let url = null;
+      try { url = new URL(server.url); } catch { /* refused below */ }
+      if (!url || url.search || url.hash || url.username || url.password) {
+        refused = 'its URL carries a query, fragment or credentials, which a fenced Codex turn would put on the command line';
+      } else {
+        pairs.push('-c', `mcp_servers.${name}.url=${toml(server.url)}`);
+        if (typeof server.bearer_token_env_var === 'string' && ENV_NAME.test(server.bearer_token_env_var))
+          pairs.push('-c', `mcp_servers.${name}.bearer_token_env_var=${toml(server.bearer_token_env_var)}`);
+        const literal = table(server.http_headers);
+        const byName = table(server.env_http_headers);
+        if (Object.values(literal).some((v) => typeof v !== 'string') || Object.values(byName).some((v) => typeof v !== 'string' || !ENV_NAME.test(v))) {
+          refused = 'its headers are not text';
+        } else {
+          const named = [...headerEnv(literal, extra), ...Object.entries(byName).map(([key, envName]) => `${toml(key)}=${toml(envName)}`)];
+          if (named.length) pairs.push('-c', `mcp_servers.${name}.env_http_headers={${named.join(',')}}`);
+          if (typeof server.http_headers_helper === 'string') pairs.push('-c', `mcp_servers.${name}.http_headers_helper=${toml(server.http_headers_helper)}`);
+          if (words(server.scopes)) pairs.push('-c', `mcp_servers.${name}.scopes=[${server.scopes.map(toml).join(',')}]`);
+          if (typeof server.oauth_resource === 'string') pairs.push('-c', `mcp_servers.${name}.oauth_resource=${toml(server.oauth_resource)}`);
+          const oauth = Object.entries(table(server.oauth)).filter(([key, v]) => key !== 'client_secret' && (typeof v === 'string' || typeof v === 'boolean' || tomlScalar(v) != null));
+          if (oauth.length) pairs.push('-c', `mcp_servers.${name}.oauth=${tomlValue(Object.fromEntries(oauth))}`);
+          if (Object.hasOwn(table(server.oauth), 'client_secret')) partial.push('its OAuth client secret stays off this turn’s command line, so a sign-in or refresh that needs it fails');
+        }
+      }
+    }
+    // The person's approval modes, as written; approved where they set none.
+    const mode = APPROVAL_MODES.has(server.default_tools_approval_mode) ? server.default_tools_approval_mode : null;
+    const tools = Object.entries(table(server.tools)).filter(([, v]) => APPROVAL_MODES.has(table(v).approval_mode));
+    const approval = ['-c', `mcp_servers.${name}.default_tools_approval_mode=${toml(mode ?? 'approve')}`];
+    if (tools.length) approval.push('-c', `mcp_servers.${name}.tools=${tomlValue(Object.fromEntries(tools.map(([tool, v]) => [tool, { approval_mode: v.approval_mode }])))}`);
+    if (!refused && mode === 'prompt' && !tools.some(([, v]) => v.approval_mode === 'approve')) {
+      refused = 'it asks for approval before every tool call (default_tools_approval_mode = "prompt"), and nobody can approve one on this turn';
+    }
+    const asking = tools.filter(([, v]) => v.approval_mode !== 'approve').map(([tool]) => tool);
+    if (mode && mode !== 'approve') partial.unshift(`its tools ask for approval (default_tools_approval_mode = "${mode}"), and a call that asks fails here, where nobody can approve one`);
+    else if (asking.length) partial.unshift(`its tools ${asking.join(', ')} ask for approval, and a call to one fails here, where nobody can approve one`);
+    if (!refused) {
+      for (const key of ['startup_timeout_sec', 'startup_timeout_ms', 'tool_timeout_sec']) {
+        const v = tomlScalar(server[key]);
+        if (v != null && /^[0-9_.]+$/.test(v)) pairs.push('-c', `mcp_servers.${name}.${key}=${v}`);
+      }
+      for (const key of ['enabled_tools', 'disabled_tools']) {
+        const list = words(server[key]);
+        if (list) pairs.push('-c', `mcp_servers.${name}.${key}=[${list.map(toml).join(',')}]`);
+      }
+    }
+    if (refused) unmounted.push({ name, reason: refused, source: 'machine' });
+    else {
+      accept(name, pairs, extra, machine, approval);
+      if (partial.length) unmounted.push({ name, reason: partial.join('; '), source: 'machine', partial: true });
+    }
+  }
+  return { args, env: childEnv, mounted, machine: personal == null ? null : machine, unmounted };
+}