flowviant 0.125.5 → 0.125.7

package/bin/lib/codexToml.mjs

@@ -0,0 +1,328 @@
+/**
+ * CODEX'S config.toml SYNTAX, IN ONE IMPORT-FREE HOME (2026-10-18, the SOLID
+ * pass): the bounded reader, the value writer and the key quoting every Codex
+ * module writes with. Split out because codexPersonal.mjs (the login carry)
+ * took its string quoter `toml` from projectToolRuntimes.mjs (the runtime
+ * table), which imported codexPersonal.mjs back for the reader, and
+ * codexFencedMount.mjs imported both — a three-module cycle that loaded only
+ * because every use across it sat inside a function. MEASURED on scratch
+ * copies: one top-level `toml(...)` in codexPersonal.mjs made importing
+ * projectToolRuntimes.mjs throw "Cannot access 'toml' before
+ * initialization", so which module a caller imported first decided whether
+ * the daemon started; and the uplink scrubber, which wants only the provider
+ * secrets, loaded the runtime tool table and the fenced mount through it. The
+ * one bare-key quoter had two copies (`bareOr`, `bareKeyOr`); it is `bareKey`.
+ * The string quoter had a third, orchestratorHooks.mjs's `quote` for the
+ * Codex hook rows' `-c` values; it is `toml`.
+ *
+ * A LEAF: no imports. codexPersonal.mjs, codexFencedMount.mjs and
+ * projectToolRuntimes.mjs import it, never each other for it
+ * (codexToml.test.mjs).
+ */
+
+export const toml = (value) => JSON.stringify(String(value));
+
+/** A table header's dotted keys, unquoted — null for one this reader cannot
+ *  split, which is then nobody's to strip. */
+export function headerKeys(section) {
+  const key = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*(?:\.|$)/y;
+  const keys = [];
+  for (let i = 0; i < section.length; ) {
+    key.lastIndex = i;
+    const m = key.exec(section);
+    if (!m || key.lastIndex === i) return null;
+    try {
+      keys.push(m[1] !== undefined ? JSON.parse(`"${m[1]}"`) : m[2] ?? m[3]);
+    } catch {
+      return null;
+    }
+    i = key.lastIndex;
+  }
+  return keys;
+}
+
+/** The dotted keys a `key = …` / `key.sub = …` line defines, unquoted, or
+ *  null for a line that defines none this reader can split. */
+export function lineKeys(line) {
+  const key = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*([.=])/y;
+  const keys = [];
+  for (let i = 0; ; ) {
+    key.lastIndex = i;
+    const m = key.exec(line);
+    if (!m) return null;
+    try {
+      keys.push(m[1] !== undefined ? JSON.parse(`"${m[1]}"`) : m[2] ?? m[3]);
+    } catch {
+      return null;
+    }
+    if (m[4] === '=') return keys;
+    i = key.lastIndex;
+  }
+}
+
+/** Arrays and inline tables nest no deeper than this in a file we read. */
+const MAX_DEPTH = 32;
+
+/** A number, date or time, kept as written so it is carried as written. */
+export class TomlRaw {
+  constructor(text) {
+    this.text = text;
+  }
+}
+export const newTable = () => Object.create(null);
+export const isTable = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && !(v instanceof TomlRaw);
+
+const BARE = /[A-Za-z0-9_-]+/y;
+// First match wins, so the forms that begin like an integer come first.
+const SCALAR =
+  /[+-]?(?:inf|nan)|0x[0-9A-Fa-f](?:_?[0-9A-Fa-f])*|0o[0-7](?:_?[0-7])*|0b[01](?:_?[01])*|\d{4}-\d{2}-\d{2}(?:[Tt ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:[Zz]|[+-]\d{2}:\d{2})?)?|\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?|[+-]?\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?/y;
+
+/**
+ * A BOUNDED TOML READER — the repo carries no TOML library, and the one file
+ * it reads is Codex's own config. Whole documents: tables, arrays of tables
+ * (the daemon's own `[[skills.config]]` in an agent's home), dotted and quoted
+ * keys, the four string forms, arrays, inline tables, booleans, and numbers,
+ * dates and times kept as written. Anything else throws, and the caller
+ * carries nothing — a partial read is never a license to guess.
+ */
+export function parseCodexToml(text) {
+  const src = String(text).replace(/^/, '');
+  const n = src.length;
+  let i = 0;
+  const fail = (why) => {
+    throw new Error(`config.toml: ${why} at offset ${i}`);
+  };
+  const ws = () => {
+    while (i < n && (src[i] === ' ' || src[i] === '\t')) i++;
+  };
+  const comment = () => {
+    if (src[i] === '#') while (i < n && src[i] !== '\n') i++;
+  };
+  const newline = () => {
+    if (src[i] === '\n') return (i += 1), true;
+    if (src[i] === '\r' && src[i + 1] === '\n') return (i += 2), true;
+    return false;
+  };
+  /** Blank lines, comments and whitespace, as between array items. */
+  const gap = () => {
+    for (;;) {
+      ws();
+      comment();
+      if (!newline()) return;
+    }
+  };
+  const endOfLine = () => {
+    ws();
+    comment();
+    if (i < n && !newline()) fail('expected the end of the line');
+  };
+  const hexChar = (len) => {
+    const h = src.slice(i, i + len);
+    if (h.length !== len || !/^[0-9A-Fa-f]+$/.test(h)) fail('bad escape');
+    i += len;
+    const cp = parseInt(h, 16);
+    if (cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff)) fail('bad escape');
+    return String.fromCodePoint(cp);
+  };
+  const escape = () => {
+    const e = src[i + 1];
+    i += 2;
+    switch (e) {
+      case 'b': return '\b';
+      case 't': return '\t';
+      case 'n': return '\n';
+      case 'f': return '\f';
+      case 'r': return '\r';
+      case 'e': return '\x1b';
+      case '"': return '"';
+      case '\\': return '\\';
+      case 'x': return hexChar(2);
+      case 'u': return hexChar(4);
+      case 'U': return hexChar(8);
+      default: return fail('bad escape');
+    }
+  };
+  const basicString = () => {
+    i += 1;
+    let s = '';
+    for (;;) {
+      if (i >= n) fail('unterminated string');
+      const ch = src[i];
+      if (ch === '"') return (i += 1), s;
+      if (ch === '\n' || ch === '\r') fail('newline in a string');
+      if (ch === '\\') s += escape();
+      else (s += ch), (i += 1);
+    }
+  };
+  const literalString = () => {
+    const end = src.indexOf("'", i + 1);
+    if (end < 0) fail('unterminated string');
+    const s = src.slice(i + 1, end);
+    if (/[\r\n]/.test(s)) fail('newline in a string');
+    i = end + 1;
+    return s;
+  };
+  const LINE_END_BACKSLASH = /\\[ \t]*\r?\n/y;
+  const multiline = (quote, escapes) => {
+    i += 3;
+    newline(); // a newline straight after the opening quotes is not content
+    let s = '';
+    for (;;) {
+      if (i >= n) fail('unterminated string');
+      if (src.startsWith(quote.repeat(3), i)) {
+        let q = 3;
+        while (q < 5 && src[i + q] === quote) q++; // up to two belong to the content
+        s += quote.repeat(q - 3);
+        i += q;
+        return s;
+      }
+      if (escapes && src[i] === '\\') {
+        LINE_END_BACKSLASH.lastIndex = i;
+        if (LINE_END_BACKSLASH.test(src)) {
+          i = LINE_END_BACKSLASH.lastIndex;
+          while (i < n && /[ \t\r\n]/.test(src[i])) i++;
+        } else s += escape();
+      } else (s += src[i]), (i += 1);
+    }
+  };
+  const key = () => {
+    const parts = [];
+    for (;;) {
+      ws();
+      if (src[i] === '"') {
+        if (src.startsWith('"""', i)) fail('a multi-line key');
+        parts.push(basicString());
+      } else if (src[i] === "'") {
+        if (src.startsWith("'''", i)) fail('a multi-line key');
+        parts.push(literalString());
+      } else {
+        BARE.lastIndex = i;
+        const m = BARE.exec(src);
+        if (!m) fail('expected a key');
+        parts.push(m[0]);
+        i = BARE.lastIndex;
+      }
+      ws();
+      if (src[i] !== '.') return parts;
+      i += 1;
+    }
+  };
+  const assign = (target, path, v) => {
+    let t = target;
+    for (const k of path.slice(0, -1)) {
+      if (!Object.hasOwn(t, k)) t[k] = newTable();
+      else if (!isTable(t[k])) fail(`"${k}" is not a table`);
+      t = t[k];
+    }
+    const last = path.at(-1);
+    if (Object.hasOwn(t, last)) fail(`"${last}" is defined twice`);
+    t[last] = v;
+  };
+  let depth = 0;
+  const nested = (open) => {
+    if (++depth > MAX_DEPTH) fail('nested too deep');
+    try {
+      return open();
+    } finally {
+      depth -= 1;
+    }
+  };
+  const array = () => {
+    i += 1;
+    const out = [];
+    for (;;) {
+      gap();
+      if (src[i] === ']') return (i += 1), out;
+      out.push(value());
+      gap();
+      if (src[i] === ',') i += 1;
+      else if (src[i] === ']') return (i += 1), out;
+      else fail('expected , or ]');
+    }
+  };
+  const inlineTable = () => {
+    i += 1;
+    const t = newTable();
+    for (;;) {
+      gap();
+      if (src[i] === '}') return (i += 1), t;
+      keyValue(t);
+      gap();
+      if (src[i] === ',') i += 1;
+      else if (src[i] === '}') return (i += 1), t;
+      else fail('expected , or }');
+    }
+  };
+  const word = (w) => src.startsWith(w, i) && !/[A-Za-z0-9_-]/.test(src[i + w.length] ?? '');
+  const value = () => {
+    const ch = src[i];
+    if (ch === '"') return src.startsWith('"""', i) ? multiline('"', true) : basicString();
+    if (ch === "'") return src.startsWith("'''", i) ? multiline("'", false) : literalString();
+    if (ch === '[') return nested(array);
+    if (ch === '{') return nested(inlineTable);
+    if (word('true')) return (i += 4), true;
+    if (word('false')) return (i += 5), false;
+    SCALAR.lastIndex = i;
+    const m = SCALAR.exec(src);
+    if (!m) fail('a value this reader does not know');
+    i = SCALAR.lastIndex;
+    if (/[A-Za-z0-9_.:+-]/.test(src[i] ?? '')) fail('a value this reader does not know');
+    return new TomlRaw(m[0]);
+  };
+  const keyValue = (target) => {
+    const path = key();
+    if (src[i] !== '=') fail('expected =');
+    i += 1;
+    ws();
+    assign(target, path, value());
+  };
+
+  const root = newTable();
+  let current = root;
+  for (;;) {
+    gap();
+    if (i >= n) return root;
+    if (src[i] !== '[') {
+      keyValue(current);
+      endOfLine();
+      continue;
+    }
+    const many = src[i + 1] === '[';
+    i += many ? 2 : 1;
+    const path = key();
+    if (many ? !src.startsWith(']]', i) : src[i] !== ']') fail('an unclosed table header');
+    i += many ? 2 : 1;
+    endOfLine();
+    let t = root;
+    for (const k of path.slice(0, -1)) {
+      if (!Object.hasOwn(t, k)) t[k] = newTable();
+      const v = Array.isArray(t[k]) ? t[k].at(-1) : t[k];
+      if (!isTable(v)) fail(`"${k}" is not a table`);
+      t = v;
+    }
+    const last = path.at(-1);
+    if (many) {
+      if (!Object.hasOwn(t, last)) t[last] = [];
+      if (!Array.isArray(t[last])) fail(`"${last}" is not an array of tables`);
+      current = newTable();
+      t[last].push(current);
+    } else {
+      if (!Object.hasOwn(t, last)) t[last] = newTable();
+      else if (!isTable(t[last])) fail(`"${last}" is not a table`);
+      current = t[last];
+    }
+  }
+}
+
+/** A key as TOML writes it: bare where it can be, else quoted. */
+export const bareKey = (k) => (/^[A-Za-z0-9_-]+$/.test(k) ? k : toml(k));
+
+/** One value as TOML, as a `-c` override's value is parsed. */
+export function tomlValue(v) {
+  if (typeof v === 'string') return toml(v);
+  if (typeof v === 'boolean') return String(v);
+  if (v instanceof TomlRaw) return v.text;
+  if (Array.isArray(v)) return `[${v.map(tomlValue).join(',')}]`;
+  if (isTable(v)) return `{${Object.keys(v).map((k) => `${bareKey(k)}=${tomlValue(v[k])}`).join(',')}}`;
+  throw new Error('not a TOML value');
+}

package/bin/lib/config.mjs

@@ -226,7 +226,28 @@ export const USER_AGENT = `flowviant/${VERSION}`;
  * back. Sent on the poll as `di`; its ABSENCE is what an older daemon looks
  * like, and the server hands preview work to nobody who cannot name themselves.
  */
-export const DAEMON_INSTANCE = randomBytes(12).toString('hex');
+export const DAEMON_INSTANCE = inheritedInstance() ?? randomBytes(12).toString('hex');
+
+/**
+ * …EXCEPT ACROSS ITS OWN SELF-UPDATE (2026-10-19). A self-update re-execs
+ * only when the machine is idle (update.mjs), so the process it replaces
+ * holds nothing in flight — only its tabs' session leases, which no other
+ * daemon may take for 45 seconds. A successor with a new id waited out every
+ * one of them, so each unattended update left every tab unanswered for most
+ * of a minute. The successor named by `FLOWVIANT_REEXEC` takes the id its
+ * predecessor handed it; any other start still regenerates it.
+ */
+function inheritedInstance() {
+  const handed = process.env.FLOWVIANT_DAEMON_INSTANCE;
+  // TAKEN ONCE, THEN GONE FROM THIS PROCESS'S ENV. Every CLI turn spawns with
+  // `{ ...process.env }`, so a variable left here reached any `flowviant`
+  // started inside one — an agent running the daemon from a worktree — and
+  // two live processes would answer to one instance (the trap instance.mjs
+  // names for FLOWVIANT_REEXEC_FROM). `reexec` sets it afresh for its own
+  // successor, so the next update still hands it on.
+  delete process.env.FLOWVIANT_DAEMON_INSTANCE;
+  return process.env.FLOWVIANT_REEXEC === '1' && typeof handed === 'string' && /^[0-9a-f]{24}$/.test(handed) ? handed : null;
+}
 
 /**
  * WHICH BOX, in words a person recognises — and nothing else.

package/bin/lib/conversationIds.mjs

@@ -35,6 +35,16 @@ export const CLAUDE_SESSION_RE = /^[A-Za-z0-9_-]{8,64}$/;
  */
 export const CODEX_THREAD_RE = /^[0-9a-zA-Z][0-9a-zA-Z_-]{7,63}$/;
 
+/**
+ * A Codex native CHILD's thread id as the subagent lane follows it
+ * (codexSubagentEvents.mjs, codexSubagents.mjs). Its measured value,
+ * unchanged when its two copies moved here (2026-10-18). The rollout lookup
+ * it then reaches still guards with CODEX_THREAD_RE (runtimeLimits.mjs
+ * codexRolloutFile). Making the two one shape is a behaviour change for the
+ * owner to rule on.
+ */
+export const CODEX_CHILD_THREAD_RE = /^[a-zA-Z0-9-]{16,64}$/;
+
 /** agy conversation ids are plain UUIDs (the db filename IS the identity —
  *  measured: a renamed copy fails "trajectory not found"). Guarded the same
  *  way as the codex id: it rides in argv as `--conversation <id>`. */

package/bin/lib/fleet.mjs

@@ -38,7 +38,7 @@ import { compareVersions } from './versionOrder.mjs';
 import { emitMachineEvent } from './daemonLogging.mjs';
 import { writeDaemonState } from './daemonState.mjs';
 import { maintenanceTick, readMaintenance } from './maintenance.mjs';
-import { repoRootOrDie, detectBaseRef, baseBranchName, excludeInWorktree, usableBaseRef } from './git.mjs';
+import { repoRootOrDie, detectBaseRef, excludeInWorktree, baseRefFor } from './git.mjs';
 import { c, info, note, ok, warn, fail } from './ui.mjs';
 import { sleep } from './sleep.mjs';
 import { reapOrphanPreviews } from './previewRegistry.mjs';
@@ -576,7 +576,7 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     const servedBaseBranch = Array.isArray(roster.repositories)
       ? repositories.list().find((r) => r.repoRoot === repoRoot)?.baseBranch : roster.baseBranch;
     if (typeof servedBaseBranch === 'string' && servedBaseBranch.trim()) {
-      const want = usableBaseRef(repoRoot, `origin/${baseBranchName(servedBaseBranch.trim())}`);
+      const want = baseRefFor(repoRoot, servedBaseBranch.trim());
       if (want !== baseRef) {
         note(`base   · ${want} ${c.dim('(set for this project)')}`);
         baseRef = want;

package/bin/lib/git.mjs

@@ -333,6 +333,38 @@ export function usableBaseRef(repoRoot, ref) {
   return ref;
 }
 
+/**
+ * The BASE REF a repository lands on: its configured branch when a human set
+ * one (`origin/<branch>`, or the local branch where there is no origin), else
+ * the detected one. One home (2026-10-18, the SOLID pass); was written in
+ * repositoryMerge, mergeBatch, projectRepositories and fleet, so a change to
+ * how a configured base resolves needed four edits that had to agree.
+ */
+export function baseRefFor(repoRoot, baseBranch) {
+  return baseBranch ? usableBaseRef(repoRoot, `origin/${baseBranchName(baseBranch)}`) : detectBaseRef(repoRoot);
+}
+
+/**
+ * Is `a` an ancestor of `b`? A failed probe (an unknown commit included) is
+ * no. One home (2026-10-18, the SOLID pass); was a closure in repositoryMerge,
+ * mergeBatch and repositoryDelivery.
+ */
+export function isAncestor(a, b, cwd) {
+  try { git(['merge-base', '--is-ancestor', a, b], cwd); return true; } catch { return false; }
+}
+
+/**
+ * A repository's base, MEASURED NOW: fetch origin when there is one, then the
+ * base ref and the commit it names. One home (2026-10-18, the SOLID pass);
+ * was a `fetch` closure in repositoryMerge and mergeBatch. `net` is the
+ * caller's (its tests inject one).
+ */
+export function measureBase(repoRoot, baseBranch, net = gitNet) {
+  if (gitOrNull(['remote', 'get-url', 'origin'], repoRoot)) net(['fetch', 'origin', '--quiet'], repoRoot, 60_000);
+  const baseRef = baseRefFor(repoRoot, baseBranch);
+  return { baseRef, baseTip: git(['rev-parse', baseRef], repoRoot) };
+}
+
 /** True when the repository has at least one commit (HEAD resolves). */
 export function hasCommits(repoRoot) {
   try { git(['rev-parse', '--verify', '--quiet', 'HEAD^{commit}'], repoRoot); return true; } catch { return false; }

package/bin/lib/heldTool.mjs

@@ -0,0 +1,49 @@
+/**
+ * A HELD TURN'S LOOPBACK TOOL, DAEMON SIDE (2026-10-18, the SOLID pass): the
+ * run-scoped capability, its one gate, the loopback listen, the env pair and
+ * the argv that starts the tool's child.
+ *
+ * A held turn's CLI never receives the machine token. A card tool it may
+ * call is a server on 127.0.0.1 that answers only a POST to `/` bearing a
+ * capability minted for this one run, and a bare 403 to anything else. That
+ * gate is a security boundary, and it was written out twice, two days apart
+ * (repositoryTool.mjs 2026-10-14, orchestrator.mjs 2026-10-15), with the
+ * listen, the env pair and the self-argv beside it. Each tool keeps its own
+ * body reader, limits, refusals and close order; the child half is
+ * mcpStdio.mjs plus each tool's own client.
+ *
+ * `heldToolArgv` keeps the `import.meta.url` form: launchCommand.mjs's
+ * `selfArgv` reads process.argv[1], which under the suite is the test file.
+ */
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { sameSecret } from './grant.mjs';
+import { runningCompiledBinary } from './launchCommand.mjs';
+
+/** One run's capability: the only credential the tool's child ever holds. */
+export const mintHeldCapability = () => randomBytes(32).toString('hex');
+
+/** The argv that starts this flowviant again as `verb`, under node or the compiled binary. */
+export function heldToolArgv(verb) {
+  return runningCompiledBinary() ? [verb] : [fileURLToPath(new URL('../cli.mjs', import.meta.url)), verb];
+}
+
+/**
+ * Listen on a loopback port for one held tool. `respond(req, res)` answers
+ * only a request that passed the gate; `isClosed()` shuts the gate before the
+ * server stops. Returns the server (the caller closes it, in its own order),
+ * the capability, `<envPrefix>_URL`/`_CAPABILITY`, and the child's argv.
+ */
+export async function listenHeldTool({ envPrefix, verb, requestTimeoutMs, capability = mintHeldCapability(), isClosed, respond }) {
+  const server = createServer(async (req, res) => {
+    if (isClosed() || req.method !== 'POST' || req.url !== '/' || !sameSecret(req.headers.authorization, `Bearer ${capability}`)) {
+      res.writeHead(403).end(); return;
+    }
+    await respond(req, res);
+  });
+  server.requestTimeout = requestTimeoutMs;
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  const env = { [`${envPrefix}_URL`]: `http://127.0.0.1:${server.address().port}/`, [`${envPrefix}_CAPABILITY`]: capability };
+  return { server, capability, env, args: heldToolArgv(verb) };
+}

package/bin/lib/hooks/mcpAllow.mjs

@@ -17,10 +17,17 @@
  * `touch`, an outside Write and WebFetch were refused exactly as without the
  * hook.
  *
- * It decides MCP calls and nothing else: any other tool, and Flowviant's own
- * control plane (`mcp__flowviant`, never mounted on an agent turn), get no
- * decision, and the posture's list decides. A hook that fails gives no
- * decision either, so a broken hook leaves MCP calls refused — closed.
+ * It decides MCP calls and nothing else: any other tool gets no decision, and
+ * the posture's list decides. A hook that fails gives no decision either, so a
+ * broken hook leaves MCP calls refused — closed.
+ *
+ * `mcp__flowviant` IS ONE OF THEM (2026-10-17). Only a card turn carries this
+ * hook, and a card turn mints no Flowviant server of its own, so a server of
+ * that name there is the person's own: since 0.125.5 their user and local
+ * servers ride the card (claudeMachineMcp.mjs `machineMcpServers`), and the
+ * owner keeps a local `flowviant` server on purpose — "its my way of having
+ * the board have a set of tools to manage the flowviant web page and board".
+ * A code card already admitted it under its bypass; a write-up card refused it.
  */
 import { pathToFileURL } from 'node:url';
 
@@ -28,7 +35,6 @@ import { pathToFileURL } from 'node:url';
 export function mcpAllowDecision(payload) {
   const name = payload?.tool_name;
   if (typeof name !== 'string' || !name.startsWith('mcp__')) return null;
-  if (name === 'mcp__flowviant' || name.startsWith('mcp__flowviant__')) return null;
   return {
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',

package/bin/lib/hooks/orchestrator.mjs

@@ -1,26 +1,36 @@
 /** Native gate; a full pool refuses only this spawn, preserving the turn. */
 import { fileURLToPath } from 'node:url';
-import { callOrchestrator } from '../orchestratorClient.mjs';
+import { callOrchestrator, OrchestratorRefusal } from '../orchestratorClient.mjs';
 import { OrchestratorInputTooLarge, readOrchestratorInput } from '../orchestratorInput.mjs';
 import { runningCompiledBinary } from '../launchCommand.mjs';
+import { gatedSpawnEvent } from '../nativeAgentTools.mjs';
+
+// __hook exits as soon as main returns. A large rewritten child prompt must
+// reach the pipe before that exit, not stop partway through JSON.
+const answer = output => new Promise((resolve, reject) => process.stdout.write(`${JSON.stringify(output)}\n`, error => error ? reject(error) : resolve()));
 
 export async function main() {
+  let event = null;
   try {
-    const event = await readOrchestratorInput(process.stdin);
+    event = await readOrchestratorInput(process.stdin);
     const result = await callOrchestrator('hook', event);
-    const output = result.deny ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: result.deny } }
+    // A stop is recorded, never refused or continued (stop_hook_active or not).
+    const output = event.hook_event_name === 'SubagentStop' ? {}
+      : result.deny ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: result.deny } }
       : result.updatedInput || result.context ? { hookSpecificOutput: { hookEventName: event.hook_event_name,
         ...(result.updatedInput ? { permissionDecision: 'allow', updatedInput: result.updatedInput } : {}),
         ...(result.context ? { additionalContext: result.context } : {}) } } : {};
-    // __hook exits as soon as main returns. A large rewritten child prompt
-    // must reach the pipe before that exit, not stop partway through JSON.
-    await new Promise((resolve, reject) => process.stdout.write(`${JSON.stringify(output)}\n`, error => error ? reject(error) : resolve()));
+    await answer(output);
   } catch (error) {
-    // Both CLIs interpret exit 2 as a tool refusal. A failed capability must
-    // never let a native spawn escape the shared admission pool.
-    process.stderr.write(error instanceof OrchestratorInputTooLarge ? `${error.message}\n`
+    process.stderr.write(error instanceof OrchestratorInputTooLarge || error instanceof OrchestratorRefusal ? `${error.message}\n`
       : 'The run’s orchestration gate is unavailable. Keep the work in the orchestrator until it reconnects.\n');
-    process.exitCode = 2;
+    // FAIL CLOSED ONLY WHERE A SPAWN COULD ESCAPE THE SHARED POOL (2026-10-17).
+    // Both CLIs read exit 2 as a refusal; after a tool ran (Codex replaces its
+    // output) or at a stop (the child keeps going) that refusal is false. An
+    // event too large to read is never a spawn: no model writes 24 MiB of input.
+    // The names are the controller's own list (nativeAgentTools.mjs).
+    if (gatedSpawnEvent(event)) { process.exitCode = 2; return; }
+    try { await answer({}); } catch { /* the CLI already stopped reading */ }
   }
 }
 // Bun bundles this module at the virtual entrypoint too. Only cli.mjs may

package/bin/lib/intakeDraft.mjs

@@ -1,7 +1,7 @@
 /** A ticket becomes one card only when the CLI supplied all four fields.
  *  Forgive a JSON fence or a sentence around it, as the plan reader does;
  *  refuse a half-card rather than landing plausible but unactionable work. */
-import { candidateObjects } from './agentPlan.mjs';
+import { candidateObjects } from './modelJson.mjs';
 import { agentTaskTypeOf } from './agentTaskTypes.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 

package/bin/lib/jsonlTail.mjs

@@ -0,0 +1,52 @@
+/**
+ * FOLLOWING A GROWING JSONL FILE, BOUNDED PER POLL (2026-10-18 SOLID pass).
+ *
+ * claudeSubagentProgress.mjs (Claude's agent_progress rows) and
+ * codexSubagents.mjs (each child's rollout) wrote this out by hand with the
+ * same bounds, so a tail-reading fix (truncation, a torn or an oversized
+ * line) would land in one reader and miss the other. A first read starts
+ * within the last `scan` bytes and skips its torn first line. A file that
+ * shrank restarts at 0. One poll reads at most `scan` bytes in `chunk`-sized
+ * reads. Bytes after the last newline carry to the next poll, so a UTF-8
+ * character or a line split across reads survives. A line longer than
+ * `chunk` is discarded through its newline rather than reparsed as a suffix.
+ *
+ * Each line goes to `onLine` as it is read, so the lines before a read that
+ * fails mid-poll are still handled: the offset has already moved past them.
+ * A leaf: it reads through the caller's open handle.
+ */
+
+export const TAIL_SCAN_BYTES = 4 * 1024 * 1024;
+export const TAIL_CHUNK_BYTES = 256 * 1024;
+
+/** A tail that has read nothing yet. */
+export const newTail = () => ({ offset: null, rest: Buffer.alloc(0), skip: false });
+
+export async function followJsonl(fh, tail, onLine, { scan = TAIL_SCAN_BYTES, chunk = TAIL_CHUNK_BYTES } = {}) {
+  const { size } = await fh.stat();
+  if (tail.offset === null) {
+    tail.offset = Math.max(0, size - scan);
+    tail.skip = tail.offset > 0;
+  }
+  if (size < tail.offset) { tail.offset = 0; tail.rest = Buffer.alloc(0); }
+  // Bounded work per poll, including an immediately completed child.
+  const end = Math.min(size, tail.offset + scan);
+  while (tail.offset < end) {
+    const buffer = Buffer.alloc(Math.min(chunk, end - tail.offset));
+    const { bytesRead } = await fh.read(buffer, 0, buffer.length, tail.offset);
+    if (!bytesRead) break;
+    tail.offset += bytesRead;
+    const data = Buffer.concat([tail.rest, buffer.subarray(0, bytesRead)]);
+    let start = 0, nl;
+    while ((nl = data.indexOf(10, start)) >= 0) {
+      const line = data.subarray(start, nl).toString('utf8');
+      start = nl + 1;
+      if (tail.skip) { tail.skip = false; continue; }
+      onLine(line);
+    }
+    // Keep bytes across UTF-8 and partial-line boundaries. Oversized lines
+    // are discarded through their newline rather than reparsed as a suffix.
+    tail.rest = data.subarray(start);
+    if (tail.rest.length > chunk) { tail.rest = Buffer.alloc(0); tail.skip = true; }
+  }
+}

package/bin/lib/mcpInventory.mjs

@@ -57,7 +57,8 @@ function bound(servers) {
   const seen = new Set();
   return servers
     .map((s) => ({ ...s, name: s.name.trim().slice(0, MCP_INVENTORY_NAME_MAX).trim() }))
-    .filter((s) => s.name && s.name !== 'flowviant' && !seen.has(s.name) && seen.add(s.name))
+    // Only the person's own `flowviant` reaches here as theirs (2026-10-19).
+    .filter((s) => s.name && (s.name !== 'flowviant' || s.source === 'personal') && !seen.has(s.name) && seen.add(s.name))
     .sort((a, b) => SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source] || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
     .slice(0, MCP_INVENTORY_MAX_SERVERS)
     .map((s) => {
@@ -91,16 +92,20 @@ export function claudeInventory(harvested, snapshot) {
 
 /**
  * Codex: its own config's servers, then each declaration. A declared server
- * replaces a personal one of the same name on a card's turn
+ * that mounts replaces a personal one of the same name on a card's turn
  * (projectToolRuntimes.mjs `isolatedCodexHome`), so the declaration is the
- * row. Codex names no tools without starting a server, so `tools` is null.
+ * row; one that cannot mount (2026-10-17) leaves the person's server on the
+ * card, and that is the row. Codex names no tools without starting a server,
+ * so `tools` is null.
  */
 export function codexInventory(rows, snapshot) {
   const declared = declaredRows(snapshot, 'codex');
-  const names = new Set(declared.map((d) => d.name));
+  const mounts = new Set(declared.filter((d) => d.state === 'ready').map((d) => d.name));
+  const personal = (rows ?? []).filter((r) => !mounts.has(r.name));
+  const theirs = new Set(personal.map((r) => r.name));
   const servers = [
-    ...declared.map((d) => ({ name: d.name, source: 'project', status: 'declared', reason: d.reason, tools: null })),
-    ...(rows ?? []).filter((r) => !names.has(r.name)).map((r) => ({ name: r.name, source: 'personal', status: r.status, reason: r.reason, tools: null })),
+    ...declared.filter((d) => !theirs.has(d.name)).map((d) => ({ name: d.name, source: 'project', status: 'declared', reason: d.reason, tools: null })),
+    ...personal.map((r) => ({ name: r.name, source: 'personal', status: r.status, reason: r.reason, tools: null })),
   ];
   return { reported: rows != null, servers: bound(servers) };
 }