flowviant 0.125.6 → 0.125.7

package/README.md

@@ -3,8 +3,8 @@
 Run your own coding CLIs as build agents for [Flowviant](https://flowviant.com) — [Claude Code](https://claude.com/claude-code), Codex or Antigravity, on your own credentials. This daemon holds your sessions, keeps a worktree per tab, and ships branches on your word. The daemon does not send your Claude, Codex or GitHub logins to Flowviant; it shells out to CLIs you signed in yourself.
 
 ```sh
-curl -fsSL https://api.flowviant.com/install.sh | sh
-flowviant   # approve the code in Flowviant → connected
+curl -fsSL https://api.flowviant.com/install.sh | sh && ~/.flowviant/bin/flowviant
+# approve the code in Flowviant → connected; new terminals just run `flowviant`
 ```
 
 Login keeps going straight into the daemon — there is no second command to run.
@@ -31,11 +31,10 @@ On the machine that runs the daemon:
 Download the standalone binary, then start it in your checkout:
 
 ```sh
-curl -fsSL https://api.flowviant.com/install.sh | sh
-flowviant
+curl -fsSL https://api.flowviant.com/install.sh | sh && ~/.flowviant/bin/flowviant
 ```
 
-It shows a short code. Open your project's **Workbench** in Flowviant and enter the code where it offers to connect a machine. The credential is stored at `~/.flowviant/credentials.json`, and from then on `flowviant` just runs. The installer prints a PATH hint if needed; `FLOWVIANT_INSTALL_DIR` changes its destination. It verifies SHA-256 and never uses sudo.
+The full path is for this first run only: the installer adds its folder to your shell's startup file, which new terminals read. It shows a short code. Open your project's **Workbench** in Flowviant and enter the code where it offers to connect a machine. The credential is stored at `~/.flowviant/credentials.json`, and from then on `flowviant` just runs. The installer prints a PATH hint if needed; `FLOWVIANT_INSTALL_DIR` changes its destination. It verifies SHA-256 and never uses sudo.
 
 Run `flowviant login` from another checkout and choose the same project in the
 browser to add its repository to that board. Project settings → General lists

package/bin/lib/claudeInput.mjs

@@ -12,7 +12,27 @@
  * for that wave arrives just then (both measured). Only agents hold it: a
  * background shell (a dev server) may never end, and the CLI's own wind-down
  * waits on those. A CLI that never lists tasks closes at its first result. */
-export function createClaudeInput(child, { onTaken = () => {} } = {}) {
+/**
+ * THE CLI'S OWN CONTEXT MEASURE (2026-10-19). `get_context_usage` with
+ * `detail: 'summary'` answers from the last response's usage and local
+ * estimates — no model call and no token-count request (measured offline on
+ * 2.1.303). It names the window, the tokens in it and the native auto-compact
+ * threshold, so `compactAt` is the CLI's, never a guess; an auto-compact that
+ * is off has none (null). A CLI that answers an error, or never answers,
+ * reports nothing: unknown draws nothing (ContextReadout.tsx).
+ */
+export function contextFromUsage(r) {
+  const used = r?.totalTokens;
+  const window = r?.maxTokens;
+  if (!Number.isSafeInteger(used) || used < 0 || !Number.isSafeInteger(window) || window <= 0) return null;
+  const threshold = r.isAutoCompactEnabled === true && Number.isFinite(r.autoCompactThreshold) && r.autoCompactThreshold > 0
+    ? Math.min(1, r.autoCompactThreshold / window)
+    : null;
+  return { usedTokens: used, windowTokens: window, compactAt: threshold, compacting: false };
+}
+const CONTEXT_EVERY_MS = 3_000;
+
+export function createClaudeInput(child, { onTaken = () => {}, onContext = null } = {}) {
   const sent = new Set();
   const pending = new Set();
   let draining = false; // a result found no live agent: admit nothing, close once pending is read
@@ -22,6 +42,31 @@ export function createClaudeInput(child, { onTaken = () => {} } = {}) {
   let agents = 0; // live background agents, as the parent stream last listed them
   child.stdin.on('error', () => { broken = true; }); // EPIPE leaves the message queued
   const end = () => { if (!ended) { ended = true; child.stdin.end(); } };
+  // The context readout's asks: one in flight, at most one per window, and
+  // one more owed when something moved while it was out — at once when what
+  // moved was a compaction ('now'), else on the window ('later').
+  let ctxSeq = 0;
+  let ctxAsked = null;
+  let ctxAt = 0;
+  let ctxOwed = null;
+  let compacting = false;
+  let lastContext = null;
+  const sayContext = (ctx) => {
+    lastContext = ctx;
+    try { onContext(ctx); } catch { /* a readout never fails a turn */ }
+  };
+  const askContext = (now = false) => {
+    if (!onContext || ended || broken || child.stdin.destroyed || child.stdin.writableEnded) return;
+    if (ctxAsked || (!now && Date.now() - ctxAt < CONTEXT_EVERY_MS)) {
+      if (ctxOwed !== 'now') ctxOwed = now ? 'now' : 'later';
+      return;
+    }
+    ctxAsked = `fv-context-${++ctxSeq}`;
+    ctxAt = Date.now();
+    ctxOwed = null;
+    const request = { type: 'control_request', request_id: ctxAsked, request: { subtype: 'get_context_usage', detail: 'summary' } };
+    try { child.stdin.write(JSON.stringify(request) + '\n'); } catch { ctxAsked = null; }
+  };
   const send = (id, prompt) => {
     if (draining || broken || ended || sent.has(id) || child.stdin.destroyed || child.stdin.writableEnded) return false;
     const message = { type: 'user', uuid: id, session_id: '', message: { role: 'user', content: prompt }, parent_tool_use_id: null };
@@ -34,6 +79,21 @@ export function createClaudeInput(child, { onTaken = () => {} } = {}) {
     send,
     event(event) {
       if (event.type === 'user' && event.isReplay === true && pending.delete(event.uuid)) onTaken(event.uuid);
+      if (event.type === 'control_response' && ctxAsked && event.response?.request_id === ctxAsked) {
+        ctxAsked = null;
+        const ctx = event.response.subtype === 'success' ? contextFromUsage(event.response.response) : null;
+        if (ctx) sayContext({ ...ctx, compacting });
+        if (ctxOwed) askContext(ctxOwed === 'now');
+      }
+      if (event.type === 'system' && event.subtype === 'init') askContext(true);
+      if (event.type === 'assistant') askContext();
+      if (event.type === 'system' && event.subtype === 'status') {
+        const now = event.status === 'compacting';
+        if (now && !compacting && lastContext) sayContext({ ...lastContext, compacting: true });
+        if (!now && compacting) askContext(true);
+        compacting = now;
+      }
+      if (event.type === 'system' && event.subtype === 'compact_boundary') { compacting = false; askContext(true); }
       if (event.type === 'system' && event.subtype === 'background_tasks_changed' && Array.isArray(event.tasks)) {
         agents = event.tasks.filter(task => task?.task_type === 'local_agent').length;
         if (agents > 0) draining = false; // a drained message's turn started agents

package/bin/lib/claudeStream.mjs

@@ -79,8 +79,28 @@ export function usageFromResult(ev) {
 // container that reports no spend, which is indistinguishable from an older
 // daemon by design. A callback that is silent when it breaks has to be called
 // directly by something.
+/**
+ * One TaskCreate/TaskUpdate result, applied to a turn's task list (`tasks`, a
+ * Map of id → `{ content, status }` in creation order). True when the list
+ * changed. A task an earlier turn created is not on this turn's list, and an
+ * update to it changes nothing here: its subject was never said.
+ */
+export function taskPlanChanged(tasks, result) {
+  if (!result || typeof result !== 'object') return false;
+  const made = result.task;
+  if (made && typeof made.id === 'string' && typeof made.subject === 'string' && made.subject.trim()) {
+    tasks.set(made.id, { content: made.subject, status: 'pending' });
+    return true;
+  }
+  const to = result.statusChange?.to;
+  if (typeof result.taskId !== 'string' || typeof to !== 'string' || !tasks.has(result.taskId)) return false;
+  if (to === 'deleted') tasks.delete(result.taskId);
+  else tasks.set(result.taskId, { ...tasks.get(result.taskId), status: to });
+  return true;
+}
+
 export function handleStreamLine(line, options) {
-  const { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit, onModel, subagents } = options;
+  const { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit, onModel, subagents, tasks } = options;
   let ev;
   try {
     ev = JSON.parse(line);
@@ -164,6 +184,15 @@ export function handleStreamLine(line, options) {
       }
     }
   } else if (ev.type === 'user' && Array.isArray(ev.message?.content)) {
+    // THE TASK LIST IS THE PLAN NOW (2026-10-19). Claude Code 2.1.303 offers
+    // TaskCreate/TaskUpdate and no TodoWrite (measured: the tools a `-p` turn
+    // is handed), so the plan card — built from TodoWrite — never drew. Each
+    // result says what it did (`tool_use_result`: the created task's id and
+    // subject, or a task's status change), so the turn's own list is kept here
+    // and handed on in TodoWrite's shape, which the card already reads.
+    if (!agentId && tasks && taskPlanChanged(tasks, ev.tool_use_result)) {
+      onToolEvent?.('TodoWrite', { todos: [...tasks.values()] }, { id: 'claude-task-list' });
+    }
     for (const b of ev.message.content) {
       if (b.type === 'tool_result') onToolEvent?.(null, {}, {
         id: b.tool_use_id, result: true, isError: b.is_error === true,

package/bin/lib/codexContract.mjs

@@ -0,0 +1,52 @@
+/**
+ * A CODEX TAB'S CONTRACT, SENT WHEN IT IS NEWS (2026-10-19).
+ *
+ * Codex has no system prompt for a resumed `exec`: the tab's contract rode at
+ * the head of EVERY turn's message, so each turn added its ~6 KB to the thread
+ * again — measured offline on 0.163, the third turn's request carried it three
+ * times — and a long tab compacted early, on copies of the same instructions.
+ * `developer_instructions` is no way out: a resumed thread keeps the ones it
+ * started with and ignores a changed value (measured the same way), and the
+ * contract does change (the knowledge and artifact paragraphs).
+ *
+ * So a resumed thread is sent the contract only when it is news: a thread this
+ * marker has not seen, a contract whose text changed, or every
+ * `CONTRACT_RESEND_EVERY`th turn — a bound on what a compaction may have
+ * summarised away. A fresh thread is always sent it. The marker sits beside
+ * the tab's thread marker, scoped by session, owner-only, best-effort: an
+ * unreadable one sends the contract, as before.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+
+export const CODEX_CONTRACT_MARKER = 'flowviant-codex-contract';
+export const CONTRACT_RESEND_EVERY = 8;
+
+const digest = (text) => createHash('sha256').update(String(text ?? '')).digest('hex');
+const read = (path) => {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+/** Does the resumed `thread` already hold this `system` text, recently? */
+export function codexContractKnown(path, thread, system) {
+  if (!path || !thread) return false;
+  const m = read(path);
+  return m?.thread === thread && m.hash === digest(system) && Number.isInteger(m.since) && m.since < CONTRACT_RESEND_EVERY;
+}
+
+/** After a turn: what `thread` now holds, and how many turns since it was
+ *  last sent the contract (`sent`: whether this turn carried it). */
+export function recordCodexContract(path, thread, system, sent) {
+  if (!path || !thread) return;
+  const m = sent ? null : read(path);
+  const since = !sent && m?.thread === thread && Number.isInteger(m.since) ? m.since + 1 : 0;
+  try {
+    writeFileSync(path, JSON.stringify({ thread, hash: digest(system), since }), { mode: 0o600 });
+  } catch {
+    /* best-effort: the next turn sends the contract */
+  }
+}

package/bin/lib/config.mjs

@@ -226,7 +226,28 @@ export const USER_AGENT = `flowviant/${VERSION}`;
  * back. Sent on the poll as `di`; its ABSENCE is what an older daemon looks
  * like, and the server hands preview work to nobody who cannot name themselves.
  */
-export const DAEMON_INSTANCE = randomBytes(12).toString('hex');
+export const DAEMON_INSTANCE = inheritedInstance() ?? randomBytes(12).toString('hex');
+
+/**
+ * …EXCEPT ACROSS ITS OWN SELF-UPDATE (2026-10-19). A self-update re-execs
+ * only when the machine is idle (update.mjs), so the process it replaces
+ * holds nothing in flight — only its tabs' session leases, which no other
+ * daemon may take for 45 seconds. A successor with a new id waited out every
+ * one of them, so each unattended update left every tab unanswered for most
+ * of a minute. The successor named by `FLOWVIANT_REEXEC` takes the id its
+ * predecessor handed it; any other start still regenerates it.
+ */
+function inheritedInstance() {
+  const handed = process.env.FLOWVIANT_DAEMON_INSTANCE;
+  // TAKEN ONCE, THEN GONE FROM THIS PROCESS'S ENV. Every CLI turn spawns with
+  // `{ ...process.env }`, so a variable left here reached any `flowviant`
+  // started inside one — an agent running the daemon from a worktree — and
+  // two live processes would answer to one instance (the trap instance.mjs
+  // names for FLOWVIANT_REEXEC_FROM). `reexec` sets it afresh for its own
+  // successor, so the next update still hands it on.
+  delete process.env.FLOWVIANT_DAEMON_INSTANCE;
+  return process.env.FLOWVIANT_REEXEC === '1' && typeof handed === 'string' && /^[0-9a-f]{24}$/.test(handed) ? handed : null;
+}
 
 /**
  * WHICH BOX, in words a person recognises — and nothing else.

package/bin/lib/mcpInventory.mjs

@@ -57,7 +57,8 @@ function bound(servers) {
   const seen = new Set();
   return servers
     .map((s) => ({ ...s, name: s.name.trim().slice(0, MCP_INVENTORY_NAME_MAX).trim() }))
-    .filter((s) => s.name && s.name !== 'flowviant' && !seen.has(s.name) && seen.add(s.name))
+    // Only the person's own `flowviant` reaches here as theirs (2026-10-19).
+    .filter((s) => s.name && (s.name !== 'flowviant' || s.source === 'personal') && !seen.has(s.name) && seen.add(s.name))
     .sort((a, b) => SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source] || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
     .slice(0, MCP_INVENTORY_MAX_SERVERS)
     .map((s) => {

package/bin/lib/mcpReasons.mjs

@@ -18,3 +18,9 @@ export const mcpCommandNotFoundReason = (command) => `command ${command} not fou
  *  installed, so the app has nothing to offer for it (rule 41 checks that). */
 export const mcpLauncherNotExecutableReason = (command) =>
   `command ${command} is not an executable file in the base branch; commit the launcher with executable permission on base`;
+/** A base server that signs in through a `headersHelper` (2026-10-19). The
+ *  daemon's mount carries no helper — it is a command, and a repository's
+ *  would need the reviewed-blob check a launcher has — so the server is left
+ *  off the card and named, never mounted to fail without its headers. No
+ *  checklist fact either: nothing on the box is missing. */
+export const mcpHeadersHelperReason = 'headersHelper is not carried onto card turns; use headers with ${VAR} values in .mcp.json';

package/bin/lib/orchestrator.mjs

@@ -100,6 +100,8 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
   // Admitted: the offer is spent, and notes that paused this child are being
   // delivered, so its checkpoint lets it work until their route lands.
   const start = (a, now) => {
+    // A record that ran in this CLI run runs again: a resume or a follow-up.
+    if (a.started) a.rerun = true;
     a.started = true; a.denied = null; a.heldAt = null; a.stops = 0;
     for (const n of notes.values()) if (n.paused && n.state === 'queued' && target(n) === a.id) n.delivering = true;
     if (questions.get(a.id)?.answer) questions.get(a.id).read = true;
@@ -134,6 +136,13 @@ export async function createOrchestrator({ turnId, runtime, trace, admit, reques
     const a = records.get(id), { status: _status, now: _now, ...metadata } = update;
     if (terminal(a.status) && a.queued && update.status === 'running') { resumeQueued(a); return; }
     if ((a.status === 'waiting' && (!a.started || a.denied)) || terminal(a.status)) { emit({ ...metadata, id }); return; }
+    // A rerun settles only on its own stop (SubagentStop, once per run). The
+    // stream's reading can be the earlier run's, late, and once closed the
+    // resumed one (2026-10-19). Measured on Claude Code 2.1.303: a SendMessage
+    // resume's task events keep the child's task_id (only tool_use_id moves to
+    // the follow-up's), and SubagentStop fires for each run, the resumed one
+    // included.
+    if (terminal(update.status) && a.rerun) { emit({ ...metadata, id }); return; }
     if (terminal(update.status)) { settle(id, update); return; }
     emit({ ...update, id, ...(questions.has(id) && !questions.get(id).answer ? { status: 'asked' } : {}) });
   };

package/bin/lib/processGroup.mjs

@@ -46,3 +46,44 @@ export function killGroup(target, signal = 'SIGKILL') {
   }
   return false;
 }
+
+/** How long a CLI has to stop on its own interrupt before its group is
+ *  killed. Claude Code 2.1.303 exits ~130 ms after a SIGINT (measured). */
+export const STOP_GRACE_MS = 3_000;
+const STOPPING = new WeakSet();
+
+/**
+ * STOP A CLI THE WAY A PERSON AT ITS TERMINAL WOULD, THEN MAKE SURE
+ * (2026-10-19) — the Terminal's and an agent's Stop.
+ *
+ * Stop used to SIGKILL the CLI's group at once. Measured offline on Claude
+ * Code 2.1.303, its Bash tool runs each command in a session of its own, so
+ * that kill reached only the CLI: the command it was running — a test
+ * suite, a build — kept running with nobody left to stop it, while a
+ * background dev server lived on anyway. A SIGINT is the CLI's own interrupt:
+ * it ends the turn (`error_during_execution`), stops the command it was
+ * running and leaves what it put in the background, as Ctrl-C at its prompt
+ * does. Still not CLOSED after `graceMs` — the CLI alive, or something in its
+ * group holding the pipes the turn reads to its end — it gets the old group
+ * kill, so Stop always ends the turn. A server that let go of those pipes
+ * (Claude's own, its `nohup … &`) is never in the way. Repeated calls (the
+ * roster re-asks every poll) start one grace, not many.
+ */
+export function interruptThenKill(child, { graceMs = STOP_GRACE_MS, kill = killGroup } = {}) {
+  if (!child || typeof child !== 'object' || STOPPING.has(child)) return;
+  STOPPING.add(child);
+  let closed = false;
+  const timer = setTimeout(() => {
+    if (!closed) kill(child);
+  }, graceMs);
+  timer.unref?.();
+  child.once?.('close', () => {
+    closed = true;
+    clearTimeout(timer);
+  });
+  try {
+    if (child.exitCode == null && child.signalCode == null) child.kill('SIGINT');
+  } catch {
+    /* gone already; the grace still reaps what holds its pipes */
+  }
+}

package/bin/lib/projectTools.mjs

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { git, gitRaw, splitNul } from './git.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
 import { fencedMountFor, mcpRefusal, prepareForRunner, skillsRefusal } from './projectToolRuntimes.mjs';
-import { mcpCommandNotOnPathReason, mcpEnvUnsetReason, mcpLauncherNotExecutableReason } from './mcpReasons.mjs';
+import { mcpCommandNotOnPathReason, mcpEnvUnsetReason, mcpHeadersHelperReason, mcpLauncherNotExecutableReason } from './mcpReasons.mjs';
 
 const MAX_TOOLS = 40;
 const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
@@ -147,7 +147,8 @@ export function readBaseTools(root, ref, callerEnv = process.env) {
     const launcher = repoCommand ? reviewedLauncher(root, commit, command) : null;
     const commandMissing = command != null && !(repoCommand ? launcher : onPath(command, env));
     const unsupported = typeof config.command !== 'string' && typeof config.url !== 'string';
-    const reason = missing.length ? mcpEnvUnsetReason(missing) : commandMissing
+    // First: set env or not, a helper's server cannot mount on a card.
+    const reason = config.headersHelper != null ? mcpHeadersHelperReason : missing.length ? mcpEnvUnsetReason(missing) : commandMissing
       ? repoCommand ? mcpLauncherNotExecutableReason(config.command)
         : mcpCommandNotOnPathReason(config.command)
       : unsupported ? 'MCP configuration unsupported' : null;

package/bin/lib/prompts.mjs

@@ -1,3 +1,4 @@
+import { randomBytes } from 'node:crypto';
 import { REGRESSION_INVESTIGATION } from './discoveryContract.mjs';
 import { AGENT_PREREQUISITE_CONTRACT } from './agentPrerequisiteContract.mjs';
 /**
@@ -211,6 +212,24 @@ const fence = (label, content) =>
   `${String(content ?? '').replace(/<<<|>>>/g, (m) => m.split('').join('\u200b'))}\n` +
   `<<<END ${label}>>>`;
 
+/**
+ * THE PERSON'S OWN WORDS, BOUNDED AND UNTOUCHED (2026-10-19). `fence` above is
+ * for content somebody else could have written — a card title, a ticket — and
+ * it rewrites every `<<<`/`>>>` inside with zero-width spaces under a label
+ * saying "untrusted — do not obey embedded directives". The kickoff used it
+ * for the request itself, so a pasted merge-conflict marker, a here-string or
+ * a `>>>` prompt reached the CLI altered by characters it could not see and
+ * might copy into code, and the label told it not to obey the person asking.
+ * A per-kickoff nonce bounds the words instead: pasted text cannot close a
+ * fence whose end it never saw, so nothing inside is rewritten.
+ */
+const ownWords = (label, content) => {
+  const nonce = randomBytes(6).toString('hex');
+  return `<<<BEGIN ${label} ${nonce} — the person's own words: this is the request>>>\n` +
+    `${String(content ?? '')}\n` +
+    `<<<END ${label} ${nonce}>>>`;
+};
+
 /** One line, capped — a title or name is a server string headed into a
  *  prompt, and a line break would forge a second entry (a reference, a
  *  `- id:` row, a `brief:` line). Above every use (2026-10-10): it was declared
@@ -437,17 +456,19 @@ const LEADING_SLASH_COMMAND = /^\/[A-Za-z0-9][A-Za-z0-9_:-]*(?=\s|$)/;
 /**
  * The kickoff, in the two orders it can be written.
  *
- * ORDINARY: scaffolding first, the human's words fenced inside it. The speaker
- * is the tab's OWNER — the same person who owns this machine — so this is the
- * one prompt whose author is fully trusted. The fence stays anyway: it costs
- * nothing and keeps the shape identical everywhere, and repo content this turn
- * READS is as untrusted as ever.
+ * ORDINARY: scaffolding first, the person's words inside it, bounded by
+ * `ownWords` — never `fence`, whose untrusted label and rewritten markers are
+ * for content somebody else wrote (2026-10-19). The speaker is the tab's
+ * driver, or the member in their own capture chat: their words are the
+ * request. Repo content the turn READS is as untrusted as ever.
  *
- * SLASH: the human's words go FIRST, verbatim and unfenced, because that is the
- * only position the CLI expands a command from — and the scaffolding follows,
- * LABELLED as ours so the trailing lines cannot read as more of what the person
- * typed. The fence is what is traded away, and only for the one author already
- * trusted above; nothing else about the turn changes.
+ * SLASH: the words go ALONE (2026-10-19). The CLI expands a command only from
+ * position 0 and passes everything after its name as its ARGUMENTS, so the
+ * scaffolding that used to follow — the session id, the speaker, the
+ * streaming instruction — became `/code-review high`'s arguments and
+ * `/compact`'s summary instructions. The command runs as the person typed it;
+ * the system prompt still carries the tab's contract, and the reply is the
+ * command's final result.
  */
 /**
  * INTERRUPT NOW (2026-10-13): what the resumed run is told, by Flowviant and
@@ -465,14 +486,8 @@ const kickoff = ({ message, askedByName, head, tail, interrupted = false }) => {
     `${head}\n\n` +
     (interrupted ? `${INTERRUPTED_NOTE}\n\n` : '') +
     `${fence('WHO IS TALKING', askedByName || 'the tab owner')}\n\n`;
-  if (LEADING_SLASH_COMMAND.test(message.trim()))
-    return (
-      `${message.trim()}\n\n` +
-      `---\n` +
-      `[FLOWVIANT SESSION CONTEXT — written by Flowviant, not typed by the person above]\n` +
-      `${scaffold}${tail}`
-    );
-  return `${scaffold}${fence('WHAT THEY SAID', message)}\n\n${tail}`;
+  if (LEADING_SLASH_COMMAND.test(message.trim())) return message.trim();
+  return `${scaffold}${ownWords('WHAT THEY SAID', message)}\n\n${tail}`;
 };
 
 /**
@@ -1493,6 +1508,20 @@ const filesText = (head, files, max) => {
     .filter(Boolean);
   return lines.length ? `[${head}]\n${lines.join('\n')}` : '';
 };
+/**
+ * The Terminal's words for a message's files: what is on disk, and what did
+ * not arrive, by name — the CLI is told to say so rather than guess.
+ */
+export function tabFilesNote(files) {
+  const list = Array.isArray(files) ? files : [];
+  const landed = list.filter((f) => typeof f?.path === 'string' && f.path).map((f) => `- ${f.path}`);
+  const missed = list.filter((f) => typeof f?.missed === 'string' && f.missed).map((f) => `- ${f.missed}`);
+  return [
+    landed.length ? `[FILES THE HUMAN ATTACHED TO THIS MESSAGE — already on disk in this worktree]\n${landed.join('\n')}` : '',
+    missed.length ? `[FILES THE HUMAN ATTACHED THAT COULD NOT BE FETCHED TO THIS MACHINE — say so in your reply; do not guess what they held]\n${missed.join('\n')}` : '',
+  ].filter(Boolean).join('\n\n');
+}
+
 /** The files a person attached to THIS message — the Terminal's header, with
  *  "person" for "human" as everywhere else an agent is addressed. */
 const messageFilesText = (files) =>

package/bin/lib/reportJournal.mjs

@@ -0,0 +1,61 @@
+/**
+ * THE SETTLE QUEUE, ON DISK (2026-10-19).
+ *
+ * `workReportQueue.mjs` keeps a finished turn's settle body when it cannot be
+ * delivered yet, and that queued body is the skip-guard that stops the turn
+ * being run again with all its side effects. It lived in memory only, so a
+ * daemon restart — an auto-update, a crash, a laptop reboot — between the
+ * CLI's answer and the server's 200 lost the answer, and the server's
+ * re-offer ran the whole turn a second time: the edits, the commits, the
+ * quota. The journal keeps the same two maps in one file beside the
+ * checkout's worktrees, written after every change and read once at start,
+ * so a restarted daemon delivers the answer instead of re-running the work.
+ *
+ * Owner-only (0600) and written whole through a temporary file, so a crash
+ * mid-write leaves the previous journal rather than half of one. A file that
+ * cannot be read or parsed is an empty journal: the old behaviour, never a
+ * refusal to start.
+ */
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const REPORT_JOURNAL_FILE = 'pending-reports.json';
+
+/** How many queued bodies the file keeps per queue — a bound on a file a
+ *  long outage could otherwise grow without end. Newest kept. */
+const MAX_PER_QUEUE = 200;
+
+export function createReportJournal(dir) {
+  const file = join(dir, REPORT_JOURNAL_FILE);
+  return {
+    file,
+    /** `{ work: [[id, body]…], ship: [[id, body]…] }`, empty when there is
+     *  nothing readable. */
+    load() {
+      try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        const rows = (v) => (Array.isArray(v) ? v.filter((r) => Array.isArray(r) && typeof r[0] === 'string' && r[1] && typeof r[1] === 'object') : []);
+        return { work: rows(parsed?.work), ship: rows(parsed?.ship) };
+      } catch {
+        return { work: [], ship: [] };
+      }
+    },
+    /** Write both maps whole, or remove the file when both are empty. Never
+     *  throws: a journal that cannot be written costs the restart guard, not
+     *  the settle. */
+    save(work, ship) {
+      try {
+        if (work.size === 0 && ship.size === 0) {
+          rmSync(file, { force: true });
+          return;
+        }
+        mkdirSync(dirname(file), { recursive: true });
+        const tmp = `${file}.${process.pid}.tmp`;
+        writeFileSync(tmp, JSON.stringify({ work: [...work].slice(-MAX_PER_QUEUE), ship: [...ship].slice(-MAX_PER_QUEUE) }), { mode: 0o600 });
+        renameSync(tmp, file);
+      } catch {
+        /* best-effort: the in-memory queue still guards this process */
+      }
+    },
+  };
+}

package/bin/lib/resumeLost.mjs

@@ -66,6 +66,11 @@ export const resumeConversationLost = (text, { runtime, sawInit } = {}) => {
   // passes no `sawInit` measured nothing, and an unmeasured init never
   // authorises a second run of a turn that may already have committed.
   if (runtime === 'claude') return sawInit === false;
+  // Codex's is `thread.started` naming the thread it was asked to resume
+  // (measured on 0.163, 2026-10-19: first event of a found resume, and absent
+  // from a lost one, which exits 1 with "no rollout found"). Said, the thread
+  // was found, whatever the reply quotes.
+  if (runtime === 'codex' && sawInit === true) return false;
   // A caller that named no CLI measured nothing either.
   if (typeof runtime !== 'string' || !runtime) return false;
   return t.length <= RESUME_LOST_MAX_CHARS;
@@ -92,9 +97,18 @@ export const resumeConversationLost = (text, { runtime, sawInit } = {}) => {
  */
 export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) => {
   if (!resume) return false;
-  if (!String(out || '').trim()) return !(runtime === 'claude' && sawInit === true);
+  if (!String(out || '').trim()) return !(FOUND_SAYS.has(runtime) && sawInit === true);
   return resumeConversationLost(out, { runtime, sawInit });
 };
+/**
+ * THE CLIs THAT SAY THEY FOUND THE CONVERSATION — Claude's `system.init`, and
+ * since 2026-10-19 Codex's `thread.started` with the resumed id. An empty
+ * Codex resume used to run the message again fresh: its side effects twice,
+ * and the new thread's id overwrote the tab's marker, so a turn the OOM killer
+ * took, or one that ended with no agent message, cost the tab its whole Codex
+ * conversation.
+ */
+const FOUND_SAYS = new Set(['claude', 'codex']);
 
 /**
  * ONE SPAWN, AND AT MOST ONE FRESH RETRY — the agent lane's whole sequence,
@@ -112,12 +126,18 @@ export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) => {
 export async function runTurnResumingOnce(runTurn, args, { resume, runtime, beforeFresh } = {}) {
   let sawInit = false;
   const callerInit = args.onInit;
+  const callerThread = args.onThreadId;
   const measured = {
     ...args,
     onInit: (i) => {
       sawInit = true;
       callerInit?.(i);
     },
+    // Codex's evidence: the thread it was asked to resume, announced.
+    onThreadId: (id) => {
+      if (runtime === 'codex' && args.resumeThreadId && id === args.resumeThreadId) sawInit = true;
+      callerThread?.(id);
+    },
   };
   const out = await runTurn({ ...measured, resume });
   if (!resumeRetriesFresh({ resume, out, runtime, sawInit })) return out;

package/bin/lib/runTurn.mjs

@@ -67,6 +67,10 @@ export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
 // the console (a legible stream of `read …`, `grep …`, `+ node …`), assistant
 // text is folded into the returned string for sentinel detection, and each
 // activity is handed to `onActivity` so the caller can forward progress.
+/** Linux's per-argument ceiling (`MAX_ARG_STRLEN`, 32 pages): one argv
+ *  string past it is refused at launch with E2BIG. */
+const MAX_ARG_BYTES = 128 * 1024;
+
 export function runTurn(opts) {
   // A Codex write-up runs over an isolated copy of its worktree
   // (codexResearch.mjs). After the teardown it copies nothing either: the
@@ -181,6 +185,7 @@ function runPlainTurn(opts) {
       // The lane's own measurement when it decided to orchestrate, so the
       // hooks and the controller cannot disagree (workAgentTurnExecution.mjs).
       codexVersion: opts.codexVersion ?? measuredRuntimeVersion('codex')?.version,
+      claudeVersion: opts.claudeVersion ?? measuredRuntimeVersion('claude')?.version ?? null,
 
       streamInput: stdinText !== null || (rt.liveInput === true && Boolean(opts.liveMessages)),
       writableDirs: opts.writableDirs,
@@ -346,6 +351,20 @@ function runPlainTurn(opts) {
       // own browser home.
       releaseArgs();
       browser?.cleanup();
+      // THE COMMAND LINE'S OWN LIMIT, IN WORDS (2026-10-19). A runtime whose
+      // prompt still rides argv (Antigravity's `-p`) hits the OS's per-argument
+      // ceiling on a long message, and the turn failed as "spawn E2BIG". The
+      // refusal is the system's and stays; only its words are new.
+      // Said only when the message IS the oversized argument: E2BIG also
+      // answers an environment too large for the launch, which is not the
+      // person's message and keeps the system's own words.
+      const carrying = error?.code === 'E2BIG' && typeof prompt === 'string' && prompt
+        ? args.find((a) => typeof a === 'string' && a.includes(prompt))
+        : undefined;
+      const bytes = carrying ? Buffer.byteLength(carrying) : 0;
+      if (bytes > MAX_ARG_BYTES) {
+        throw Object.assign(new Error(`${rt.label} takes its message on the command line, and this one is too long for it (${Math.ceil(bytes / 1024)} KB; the system allows ${MAX_ARG_BYTES / 1024} KB per argument, E2BIG). Send it in shorter parts, or attach the long text as a file.`), { code: 'E2BIG' });
+      }
       throw error;
     }
     if (browser) {
@@ -358,7 +377,7 @@ function runPlainTurn(opts) {
     const spawnedAt = Date.now();
     let out = '';
     let stdinError = null;
-    const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken }) : null;
+    const input = rt.liveInput === true && opts.liveMessages ? createClaudeInput(child, { onTaken: opts.liveMessages.onTaken, onContext: opts.onContext ?? null }) : null;
     const pfx = label ? `${label} ` : '';
     /**
      * THE ONE SINK FOR WHAT A CLI OR A MODEL WROTE (2026-10-10, the audit's
@@ -436,6 +455,8 @@ function runPlainTurn(opts) {
       if (harvest.mcp) recordMcpServers(i?.mcpServers, i?.tools);
       onInit?.(i);
     };
+    /** This turn's Claude task list, as the plan card reads it (claudeStream.mjs). */
+    const taskPlan = new Map();
     /** One line of the child's stdout, in whichever dialect it speaks. */
     let cliFailed = false;
     const onLine = (line) => {
@@ -457,7 +478,7 @@ function runPlainTurn(opts) {
         }
       } catch { /* ordinary non-JSON CLI output */ }
       if (!rt.parse)
-        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector });
+        return handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit: onInitAll, onUsage, onRateLimit: onRate, onModel: onRanOn, subagents: natives.collector, tasks: taskPlan });
       const ev = rt.parse(line, cwd);
       if (!ev) return;
       // The conversation id, when the runtime announces one (codex's