flowviant 0.36.0 → 0.38.0

package/bin/lib/claude.mjs

@@ -1,7 +1,14 @@
 /**
- * Driving Claude Code: the operating-contract system prompts, the permission
- * posture, and one `claude -p` turn. The hard rule baked into both prompts:
- * there is no interactive user — the only channel to a human is the blocker loop.
+ * Driving a coding CLI: the operating-contract system prompts, the permission
+ * posture, and one headless turn. The hard rule baked into both prompts: there
+ * is no interactive user — the only channel to a human is the blocker loop.
+ *
+ * `runTurn` used to BE `claude -p`, argv and all. The argv, the binary, the way
+ * the MCP server is handed over and the shape of the event stream now come from
+ * the runtime registry (runtimes.mjs), because those four things are exactly
+ * what differs between one CLI and the next. What stays here is everything that
+ * is about FLOWVIANT rather than about a vendor: the contract prompts, the
+ * permission sets, the sentinel protocol, and the turn plumbing.
  */
 
 import { spawn } from 'node:child_process';
@@ -9,6 +16,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { SAFE, MODEL } from './config.mjs';
+import { runtimeById, humanizeClaudeTool } from './runtimes.mjs';
 
 // Multi-task loop (TOKEN / TOKENS modes): drain the whole queue in one session.
 export const SYSTEM_MULTI = `You are a Flowviant build agent running FULLY AUTONOMOUSLY via the "flowviant" MCP
@@ -16,13 +24,13 @@ server. There is NO interactive user and NO terminal to ask in. The ONLY way to
 reach a human is the blocker loop. Never ask the user directly; never wait on stdin.
 
 Operate this loop:
-1. Call claim_next_intent to PICK UP the next task someone @mentioned you on. If it
+1. Call claim_next_task to PICK UP the next task someone @mentioned you on. If it
    returns claimed:false, output exactly ALL_CLEAR on its own line and stop.
 2. Read the brief, and read its "thread" FIRST — that is the task conversation, and the
    newest human message is usually the specific reason you were brought in. If the brief
    has an existing "branch" (a REVISION), \`git checkout <branch>\` to resume your prior
    work and address what the thread asks for. Use get_module_files / search_wiki /
-   list_related_intents for context. Call report_progress as you go.
+   list_related_tasks for context. Call report_progress as you go.
 3. If you hit ANYTHING only a human can decide, call report_blocker with a clear
    question (and options when you can), then call get_blocker_resolution. If it is
    not yet resolved, output exactly BLOCKED:<blockerId> on its own line and STOP.
@@ -48,14 +56,14 @@ server. There is NO interactive user and NO terminal to ask in. The ONLY way to
 reach a human is the blocker loop. Never ask the user directly; never wait on stdin.
 
 Do EXACTLY ONE task this turn:
-1. Call claim_next_intent to PICK UP the task someone @mentioned you on. If it returns
+1. Call claim_next_task to PICK UP the task someone @mentioned you on. If it returns
    claimed:false, output exactly NOTHING on its own line and stop. Do NOT retry.
 2. Read the brief, and read its "thread" FIRST — that is the task conversation, and the
    newest human message is usually the specific reason you were brought in. If the brief
    has an existing "branch" (a REVISION), first \`git fetch && git checkout <branch>\` to
    resume YOUR prior work and address what the thread asks for. Otherwise work from the
    clean base checkout. Use get_module_files / search_wiki /
-   list_related_intents for context. report_progress as you go.
+   list_related_tasks for context. report_progress as you go.
 3. If you hit ANYTHING only a human can decide, call report_blocker (with options when
    you can), then get_blocker_resolution. If unresolved, output exactly
    BLOCKED:<blockerId> on its own line and STOP. Do NOT guess past a real decision.
@@ -97,7 +105,7 @@ export const RESUME =
 // server, or nothing waiting) it falls back to the original free pick.
 export const SINGLE_KICKOFF = (intentId) =>
   intentId
-    ? `Pick up Flowviant task ${intentId} — call claim_next_intent with intentId "${intentId}" — ` +
+    ? `Pick up Flowviant task ${intentId} — call claim_next_task with taskId "${intentId}" — ` +
       'complete exactly that ONE task per your instructions, then stop. If that ' +
       'claim comes back unavailable, claim whatever is next for you instead.'
     : 'Pick up and complete exactly ONE Flowviant task per your instructions, then stop.';
@@ -508,46 +516,32 @@ export function mcpConfigFor(token, mcpUrl) {
   return { dir, path: p };
 }
 
-// Shorten an absolute tool path to a repo-relative one for legible output.
-const shortPath = (p, cwd) => {
-  if (typeof p !== 'string') return '';
-  let s = p;
-  if (cwd && s.startsWith(cwd)) s = s.slice(cwd.length).replace(/^\/+/, '');
-  return s;
-};
+/**
+ * Hand a runtime the flowviant MCP server, however that runtime wants it.
+ *
+ * Returns `{ dir, args, env }`: `dir` is a temp directory to delete after the
+ * turn (null when the runtime needed no file at all), `args` splice into argv,
+ * `env` merges into the child's environment. The shape is identical for every
+ * runtime precisely because the mechanism is not — Claude wants a JSON file
+ * path, Codex wants two `-c` overrides and reads the token out of the
+ * environment. Callers should not have to know which.
+ */
+export function mcpFor(runtimeId, token, mcpUrl) {
+  const rt = runtimeById(runtimeId);
+  if (!rt.mcp) throw new Error(`runtime '${rt.id}' cannot take an MCP server: ${rt.blocked}`);
+  return rt.mcp(token, mcpUrl);
+}
 
 // Turn one Claude tool_use into a compact activity {kind, label}, or null for
 // tools not worth surfacing. `kind:'read'` is what the file counter counts; a
 // Write/Edit of a vault page is the "writing" signal. Used by wiki turns to
 // stream exactly which files Claude is touching (daemon console + app cover).
-export function humanizeToolUse(name, input = {}, cwd = '') {
-  switch (name) {
-    case 'Read':
-      return { kind: 'read', label: `read ${shortPath(input.file_path, cwd)}` };
-    // Vault authoring: Write/Edit of a markdown page is the "writing" signal
-    // (the wiki turn's only legal writes are vault files). Label with the last
-    // two path segments — the vault lives outside cwd, so shortPath can't trim.
-    case 'Write':
-    case 'Edit': {
-      const p = String(input.file_path ?? '');
-      const tail = p.split('/').slice(-2).join('/');
-      return { kind: 'write', label: `${name === 'Write' ? '+ page' : '~ page'} ${tail}` };
-    }
-    case 'Grep':
-      return {
-        kind: 'search',
-        label: `grep ${JSON.stringify(input.pattern ?? '')}${input.path ? ` in ${shortPath(input.path, cwd)}` : ''}`,
-      };
-    case 'Glob':
-      return { kind: 'glob', label: `glob ${input.pattern ?? ''}` };
-    case 'LS':
-      return { kind: 'list', label: `ls ${shortPath(input.path ?? '.', cwd)}` };
-    case 'Bash':
-      return { kind: 'bash', label: `$ ${String(input.command ?? '').replace(/\s+/g, ' ').slice(0, 60)}` };
-    default:
-      return null; // other tools: silent
-  }
-}
+//
+// The body moved to runtimes.mjs, beside Codex's equivalent, because they are
+// the same job for two vendors and keeping them apart is how the two activity
+// vocabularies drift. Re-exported under its original name: a dozen call sites
+// know it, and none of them care where it lives.
+export const humanizeToolUse = humanizeClaudeTool;
 
 // Collapse whitespace + clip so a narration/thinking snippet is one tidy feed line.
 const oneLine = (s, n = 160) => String(s).replace(/\s+/g, ' ').trim().slice(0, n);
@@ -600,24 +594,40 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText }) {
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, model, effort }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, model, effort }) {
   return new Promise((resolve) => {
-    const args = [];
-    if (resume) args.push('--continue');
-    args.push('-p', prompt, '--append-system-prompt', system);
-    // Wiki-vault turns are pure file work — no MCP server at all.
-    if (mcpConfig) args.push('--mcp-config', mcpConfig);
-    // Pin the model — never inherit the user's global default (which may be a
-    // 1M/long-context tier their subscription can't bill autonomous work on).
-    // A per-task override (chosen in the app, validated server-side against a
-    // fixed list before it ever reaches this argv) wins over the machine pin;
-    // absent, the pin stands. Effort has no machine-level pin at all: unset
-    // means Claude Code's own default, which is the honest resting state.
-    args.push('--model', model || MODEL);
-    if (effort) args.push('--effort', effort);
-    if (streamJson) args.push('--output-format', 'stream-json', '--verbose');
+    const rt = runtimeById(runtime);
+    if (!rt.args) {
+      // Reached only if a brief names a runtime this daemon declares but cannot
+      // drive. Fail as a turn with no sentinel — the loop already treats that as
+      // "the protocol did not complete" and retries, rather than inventing a
+      // completion for work that never started.
+      console.error(`\nerror: cannot run '${rt.label}' — ${rt.blocked}`);
+      resolve('');
+      return;
+    }
+    // Pin the model — never inherit the user's global default (which for Claude
+    // may be a 1M/long-context tier their subscription can't bill autonomous
+    // work on). A per-task override (chosen in the app, validated server-side
+    // against a fixed list before it ever reaches this argv) wins over the
+    // machine pin; absent, the pin stands. Effort has no machine-level pin at
+    // all: unset means the CLI's own default, the honest resting state.
+    //
     // readOnly wins over wikiPerm: a consult must never inherit write tools.
-    args.push(...(readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM));
+    const args = rt.args({
+      prompt,
+      system,
+      model,
+      effort,
+      resume,
+      streamJson,
+      perm: readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM,
+      // Handed to the adapter rather than appended here, because WHERE these go
+      // is a property of the CLI: Codex reads its prompt as a trailing
+      // positional, so a flag after it is a flag in the wrong place.
+      // Wiki-vault turns are pure file work and pass neither — no MCP at all.
+      mcp: mcpConfig ? ['--mcp-config', mcpConfig] : (mcpArgs ?? []),
+    });
     // Whatever this machine is signed in with, we use. We do NOT pick.
     //
     // This used to delete ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN to force
@@ -629,26 +639,49 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn
     // deliberately configured.
     //
     // Which credential is correct, and whether an account may be shared, is
-    // between the operator and Anthropic. Flowviant does not detect it and does
-    // not enforce it; it runs Claude the ordinary way and relays what happens.
-    const child = spawn('claude', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    // between the operator and the vendor. Flowviant does not detect it and does
+    // not enforce it; it runs the CLI the ordinary way and relays what happens.
+    const child = spawn(rt.bin, args, {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      // Only ADDS to the environment (the worker token, for runtimes that read
+      // it from there). Never replaces it: the CLI's own credentials live in
+      // this environment, and handing it a curated one signs it out.
+      ...(mcpEnv ? { env: { ...process.env, ...mcpEnv } } : {}),
+    });
     onSpawn?.(child);
     let out = '';
     const pfx = label ? `${label} ` : '';
     const emit = (s) => process.stdout.write(pfx ? s.replace(/\n/g, `\n${pfx}`) : s);
 
-    if (streamJson) {
+    // A runtime with its own parser is ALWAYS line-parsed — for Codex the JSONL
+    // stream is the only output there is, so treating it as raw text would print
+    // event objects at the operator and, worse, hand the sentinel matcher a
+    // string containing every word the model reasoned about.
+    const lineParsed = streamJson || Boolean(rt.parse);
+    if (lineParsed) {
       let buf = '';
       const appendText = (t) => {
         out += t;
       };
+      /** One line of the child's stdout, in whichever dialect it speaks. */
+      const onLine = (line) => {
+        if (!rt.parse) return handleStreamLine(line, { cwd, emit, onActivity, appendText });
+        const ev = rt.parse(line, cwd);
+        if (!ev) return;
+        if (ev.text) appendText(ev.text);
+        if (ev.activity) {
+          emit(`${ev.activity.label}\n`);
+          onActivity?.(ev.activity);
+        }
+      };
       child.stdout.on('data', (d) => {
         buf += d.toString();
         let nl;
         while ((nl = buf.indexOf('\n')) >= 0) {
           const line = buf.slice(0, nl);
           buf = buf.slice(nl + 1);
-          if (line.trim()) handleStreamLine(line, { cwd, emit, onActivity, appendText });
+          if (line.trim()) onLine(line);
         }
       });
       // stderr is not JSON (warnings/errors) — pass through and keep for sentinels.
@@ -659,14 +692,14 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn
       });
       child.on('error', (e) => {
         if (e.code === 'ENOENT') {
-          console.error("\nerror: 'claude' CLI not found on PATH. Install Claude Code first.");
+          console.error(`\nerror: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
           process.exit(1);
         }
         console.error(e);
         resolve(out);
       });
       child.on('close', () => {
-        if (buf.trim()) handleStreamLine(buf, { cwd, emit, onActivity, appendText });
+        if (buf.trim()) onLine(buf);
         resolve(out);
       });
       return;
@@ -681,7 +714,7 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, label, onSpawn
     child.stderr.on('data', onChunk);
     child.on('error', (e) => {
       if (e.code === 'ENOENT') {
-        console.error("\nerror: 'claude' CLI not found on PATH. Install Claude Code first.");
+        console.error(`\nerror: '${rt.bin}' CLI not found on PATH. Install ${rt.label} first: ${rt.install}`);
         process.exit(1);
       }
       console.error(e);

package/bin/lib/env.mjs

@@ -213,19 +213,39 @@ export async function loadCachedEnv(projectId) {
 
 // ── Materialization ────────────────────────────────────────────────────────
 
-/** Per-worktree git exclude — untracked AND unstageable. A git worktree's
- *  `.git` is a FILE pointing at its private gitdir; info/exclude there applies
- *  to that worktree only and never touches the user's repo. */
+/**
+ * Add the materialized paths to the exclude file git ACTUALLY READS.
+ *
+ * This used to resolve the worktree's own gitdir (`.git/worktrees/<name>`) and
+ * write `info/exclude` there, on the belief that it "applies to that worktree
+ * only and never touches the user's repo". Git does not read that file: it
+ * resolves `info/exclude` against $GIT_COMMON_DIR — the main `.git` — so in
+ * every linked worktree the daemon creates, the exclusion did nothing at all.
+ * The plaintext secret files stayed visible to `git add -A`, which is what
+ * `checkpointWip` runs before force-pushing a WIP commit to the remote.
+ *
+ * `--git-common-dir` is asked of git rather than derived, because that is the
+ * one answer that cannot drift from what git itself will consult. The file is
+ * local to the clone and never committed.
+ *
+ * This is a CONVENIENCE, not the guarantee. The guarantee is the check-ignore
+ * verification in materializeInto, which refuses to write a secret that git can
+ * still see.
+ */
 function excludeInWorktree(wt, relPaths) {
   try {
-    const dotGit = join(wt, '.git');
-    let gitdir = dotGit;
+    let gitdir;
     try {
-      const content = readFileSync(dotGit, 'utf8');
-      const m = content.match(/^gitdir:\s*(.+)\s*$/m);
-      if (m) gitdir = resolve(wt, m[1].trim());
+      gitdir = resolve(
+        wt,
+        execFileSync('git', ['rev-parse', '--git-common-dir'], {
+          cwd: wt,
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim()
+      );
     } catch {
-      /* .git is a directory (main checkout) — use it directly */
+      return; // not a repo — materializeInto's check-ignore gate will refuse anyway
     }
     const excludePath = join(gitdir, 'info', 'exclude');
     mkdirSync(dirname(excludePath), { recursive: true });
@@ -267,6 +287,27 @@ function isTrackedInGit(wt, relPath) {
   }
 }
 
+/**
+ * Will git hide this path? Asked of git, never inferred.
+ *
+ * This is the gate that makes writing a secret safe, and it is asked AFTER the
+ * exclude file is updated so it reflects the state the agent will actually run
+ * under. It fails CLOSED: any error — not a repo, git missing, a weird
+ * pathspec — reads as "not ignored", so the secret is not written. A wrong
+ * "yes" here puts plaintext on a remote branch; a wrong "no" costs a warning.
+ */
+function isIgnoredInGit(wt, relPath) {
+  try {
+    execFileSync('git', ['check-ignore', '-q', '--', relPath], {
+      cwd: wt,
+      stdio: 'ignore',
+    });
+    return true; // exit 0 = ignored
+  } catch {
+    return false;
+  }
+}
+
 // Per-worktree: the target files we last materialized THIS SESSION.
 const lastFilesByWorktree = new Map();
 // Project-global union of every target file we've ever materialized — PERSISTED
@@ -334,12 +375,25 @@ export function materializeInto(wt) {
     byFile.set(v.targetFile, list);
   }
 
+  // Exclude BEFORE writing, not after. The old order wrote plaintext first and
+  // tried to hide it afterwards, so every failure mode — and the exclude file
+  // being the wrong one, which it was — left a readable secret in a tree that
+  // `checkpointWip` force-pushes.
+  excludeInWorktree(wt, [...byFile.keys()]);
+
   const written = [];
   for (const [file, list] of byFile) {
     if (isTrackedInGit(wt, file)) {
       warn(`env: "${file}" is tracked in git — refusing to write secrets there (gitignore it). Its keys are NOT materialized.`);
       continue;
     }
+    // The load-bearing check. A materialized secret sits in a worktree whose
+    // whole tree gets `git add -A`'d and force-pushed by the WIP checkpoint, so
+    // "git cannot see this file" is a precondition for writing it, not a nicety.
+    if (!isIgnoredInGit(wt, file)) {
+      warn(`env: "${file}" is not gitignored — refusing to write secrets there. Add it to .gitignore. Its keys are NOT materialized.`);
+      continue;
+    }
     try {
       const abs = join(wt, file);
       mkdirSync(dirname(abs), { recursive: true });
@@ -369,7 +423,18 @@ export function materializeInto(wt) {
   }
   for (const f of written) knownTargetFiles.add(f);
   lastFilesByWorktree.set(wt, written);
-  if (written.length) excludeInWorktree(wt, written);
+}
+
+/**
+ * The secret files this daemon has materialized into `wt`.
+ *
+ * Exists so anything that stages the whole tree can subtract them by pathspec.
+ * Belt to the check-ignore braces: `git add -A` obeys .gitignore, so a properly
+ * ignored file is already safe — but "already safe" was the assumption that put
+ * plaintext on a remote branch, and a second, independent mechanism is cheap.
+ */
+export function materializedFiles(wt) {
+  return [...(lastFilesByWorktree.get(wt) ?? [])];
 }
 
 // ── Uplink scrubbing ───────────────────────────────────────────────────────

package/bin/lib/fleet.mjs

@@ -38,12 +38,13 @@ import {
   isValidPrUrl,
   isValidBranch,
   isSafePathSegment,
+  worktreeDiffstat,
 } from './git.mjs';
 import { c, LABEL_COLORS, info, note, ok, warn, fail } from './ui.mjs';
 import { revertPatch, withPatchLock } from './patch.mjs';
 import {
   sleep,
-  mcpConfigFor,
+  mcpFor,
   runTurn,
   sawSentinel,
   blockedId,
@@ -75,6 +76,7 @@ import {
 } from './env.mjs';
 import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 import { machineSnapshot } from './resources.mjs';
+import { detectRuntimes } from './runtimes.mjs';
 
 async function fetchRoster(haveIds) {
   const url = new URL(FLEET_URL);
@@ -84,6 +86,26 @@ async function fetchRoster(haveIds) {
   // machine knows its cores, its RAM and whose Claude quota is being spent.
   // Older servers ignore the param, so sending it is always safe.
   url.searchParams.set('capacity', String(MAX_CONCURRENT));
+  // WHICH CLIs this machine actually has, so the app can stop guessing.
+  //
+  // Until now every surface that listed Gemini or Codex said "not wired up yet"
+  // and meant it literally: nothing had ever looked. That was the honest answer
+  // while it was true, and it stops being honest the moment a second runtime can
+  // run — an app that cannot tell "Codex is not installed" from "we never
+  // checked" will confidently tell you the wrong one.
+  //
+  // A statement about this MACHINE and nothing else: no account, no quota, no
+  // entitlement. Detection is cached after the first poll (one version probe per
+  // CLI), so this costs a query param thereafter. Older servers ignore an
+  // unknown param, so sending it is always safe.
+  try {
+    const drivable = detectRuntimes()
+      .filter((r) => r.dispatchable)
+      .map((r) => r.id);
+    if (drivable.length) url.searchParams.set('runtimes', drivable.join(','));
+  } catch {
+    /* detection is best-effort — a probe must never fail the poll */
+  }
   // Env-sync identity + materialized version (the Settings "env vN" chip).
   try {
     for (const [k, v] of Object.entries(await envQueryParams())) {
@@ -122,11 +144,90 @@ async function fetchRoster(haveIds) {
   return data; // { mcpUrl, leaseTtlSeconds, agents: [{agentId,name,token,reviewGate,hasWork}] }
 }
 
+const RUN_DIFFSTAT_URL = FLEET_URL.replace(/\/agents\/?$/, '/run-diffstat');
+
+/**
+ * Post what a run has changed, every 20s, until the returned stop() is called.
+ *
+ * Daemon-side rather than an MCP tool the agent calls: the agent forgets, each
+ * call costs tokens, and anything the agent reports about itself is downstream
+ * of whatever it is currently reading. The daemon owns the worktree, so it can
+ * just look.
+ *
+ * Posts when the numbers MOVED, and otherwise once every couple of minutes to
+ * say the worktree is still being watched. Both halves are needed. Writing the
+ * same row every 20s would make a wedged turn look busy; never re-writing it
+ * makes a HEALTHY run look dead, because the reader treats a sample it has not
+ * seen refreshed in three minutes as a daemon that stopped — and an agent that
+ * finishes editing and then spends fifteen minutes running the test suite
+ * produces exactly the same silence as one that died. REFRESH_MS sits well
+ * inside that window so an idle-but-live worktree keeps its panel.
+ */
+const DIFFSTAT_REFRESH_MS = 120_000;
+
+function sampleDiffstat(cwd, baseRef, intentId, agentId) {
+  let last = '';
+  let lastSentAt = 0;
+  let alive = true;
+  const post = async () => {
+    if (!alive) return;
+    let stat = null;
+    try {
+      stat = worktreeDiffstat(cwd, baseRef);
+    } catch {
+      return; // a worktree mid-reset is not an error worth reporting
+    }
+    if (!stat) return;
+    const key = JSON.stringify(stat);
+    if (key === last && Date.now() - lastSentAt < DIFFSTAT_REFRESH_MS) return;
+    try {
+      const res = await fetch(RUN_DIFFSTAT_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        // The lane, not just the task: the server matches the run on both, so a
+        // sample can only ever overwrite the diffstat of THIS lane's own run.
+        body: JSON.stringify({ intentId, agentId, diffstat: stat }),
+      });
+      // Only a sample the server ACCEPTED counts as sent. Marking it delivered
+      // before the round-trip meant a dropped request suppressed every retry
+      // for as long as the numbers held still — which is precisely when the
+      // reader is about to expire the panel.
+      if (res.ok) {
+        last = key;
+        lastSentAt = Date.now();
+      }
+    } catch {
+      /* best-effort: `last` is untouched, so the next tick tries again */
+    }
+  };
+  const t = setInterval(() => void post(), 20_000);
+  // Kick once after a beat so a fast task still reports something before it ends.
+  const first = setTimeout(() => void post(), 5_000);
+  return () => {
+    alive = false;
+    clearInterval(t);
+    clearTimeout(first);
+  };
+}
+
 // One roster agent's loop: persistent worktree, one intent per turn, reset to
 // base between tasks (fresh conversation), resume in place while on a blocker.
 async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWork, getNext, getMcpUrl, isAlive, onChild, onTokenSuspect }) {
   let resuming = false;
   let needsReset = true; // reset to base before a FRESH task, not on idle polls
+  // The task this lane is currently holding. `next` only arrives on a FRESH
+  // turn, but a run that comes back from a blocker is still building the same
+  // intent — without remembering it here, the entire post-blocker half of a run
+  // reports no diffstat and the tray blanks mid-build.
+  let heldIntentId = null;
+  // The CLI the task in flight is being built by — held across a resume for
+  // the reason documented at the assignment below.
+  let heldRuntime = 'claude';
   let phase = ''; // '', 'idle', 'blocked' — log each transition once, not per poll
   const enter = (p, fn, msg) => {
     if (phase !== p) {
@@ -153,30 +254,55 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
       materializeInto(cwd); // reset wiped the env files (git clean -fd) — rewrite
       needsReset = false;
     }
-    const { dir, path: mcpConfig } = mcpConfigFor(token, getMcpUrl());
     // The task the server says is next for this lane, read ONCE per turn: the
-    // model and effort below become process flags, so they must describe the
-    // same task the kickoff tells Claude to claim. Re-reading the map mid-turn
-    // could pair one task's flags with another's work.
+    // runtime, model and effort below become process flags, so they must
+    // describe the same task the kickoff tells the agent to claim. Re-reading
+    // the map mid-turn could pair one task's flags with another's work.
     const next = resuming ? null : getNext?.(agentId) || null;
+    if (next?.intentId) heldIntentId = next.intentId;
+    // WHICH CLI builds this one. Chosen in the app by @mentioning it and carried
+    // on the roster hint; absent (older server, or a task captured before there
+    // was a choice) it is Claude, which is what every task ran on until now.
+    //
+    // A resume must keep the runtime it started on — the session, the worktree
+    // and the branch all belong to that CLI, and handing its half-finished work
+    // to a different one mid-task is not a fallback, it is a second author.
+    if (!resuming) heldRuntime = next?.runtime || 'claude';
+    const { dir, args: mcpArgs, env: mcpEnv } = mcpFor(heldRuntime, token, getMcpUrl());
     let out = '';
+    // Report what this run is changing, while it is changing it. The commits
+    // endpoint can only describe work that has already reached the provider, so
+    // without this the app has nothing to say about a task for the whole time it
+    // is being built. Only when we know WHICH task this turn is for — the same
+    // hint that carries its model and effort — because a diffstat attributed to
+    // the wrong run is worse than none. On a resume that is the intent this
+    // lane already holds; the worktree it is about to keep editing is the same
+    // one, so the samples describe the same run.
+    const stopDiffstat = heldIntentId
+      ? sampleDiffstat(cwd, baseRef, heldIntentId, agentId)
+      : null;
     try {
       out = await runTurn({
         prompt: resuming ? SINGLE_RESUME : SINGLE_KICKOFF(next?.intentId),
         resume: resuming,
         system: SYSTEM_SINGLE,
         cwd,
-        mcpConfig,
+        runtime: heldRuntime,
+        mcpArgs,
+        mcpEnv,
         label,
         // Per-task overrides — null/absent means this machine's own defaults
-        // (FLOWVIANT_MODEL, and Claude Code's own effort). A resume keeps the
+        // (FLOWVIANT_MODEL, and the CLI's own effort). A resume keeps the
         // session it already has, so there is nothing to re-pick there.
         model: next?.model || undefined,
         effort: next?.effort || undefined,
         onSpawn: (ch) => onChild?.(ch),
       });
     } finally {
-      rmSync(dir, { recursive: true, force: true });
+      stopDiffstat?.();
+      // `dir` is null for a runtime that needed no file on disk (Codex reads its
+      // token from the environment) — rmSync would throw on undefined.
+      if (dir) rmSync(dir, { recursive: true, force: true });
       onChild?.(null);
     }
     if (!isAlive()) break;
@@ -189,6 +315,7 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
     if (sawSentinel(out, 'NOTHING')) {
       enter('idle', info, 'idle — no work assigned');
       resuming = false;
+      heldIntentId = null; // let go of the task, and of its diffstat
       await sleep(IDLE_SECONDS);
       continue;
     }
@@ -197,6 +324,7 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
       phase = '';
       resuming = false;
       needsReset = true;
+      heldIntentId = null;
       continue;
     }
     // No sentinel — the turn didn't complete the protocol. Almost always the
@@ -209,7 +337,10 @@ async function runFleetWorker({ agentId, label, cwd, baseRef, getToken, getHasWo
     // failure, not completion — retry in place and KEEP the worktree. Resetting
     // here would wipe the blocked task's uncommitted changes. Only a fresh-task
     // turn (not resuming) warrants a clean slate next time.
-    if (!resuming) needsReset = true;
+    if (!resuming) {
+      needsReset = true;
+      heldIntentId = null; // fresh slate next turn — nothing held to sample
+    }
     await sleep(IDLE_SECONDS);
   }
   info(`${label} stopped`);
@@ -1078,6 +1209,14 @@ export async function runFleetDaemon() {
         const startedAt = Date.now();
         let filesRead = 0;
         let phase = 'reading';
+        // Distinct vault pages this turn has written. Counted HERE, from the
+        // stream, because it is the only place that knows mid-turn: the daemon
+        // syncs the vault to the server once, AFTER the turn returns, so a
+        // server-side count of "rows touched since the turn began" is zero for
+        // the entire writing phase — which is exactly how long the bar needs it.
+        // A Set, not a counter: pages get written once and then edited, and
+        // three tool calls on one page are one page.
+        const pagesSeen = new Set();
         const feed = [];
         const frame = (extra) => ({
           mode,
@@ -1085,12 +1224,16 @@ export async function runFleetDaemon() {
           activity: feed[feed.length - 1] ?? '',
           recent: feed.slice(-24),
           filesRead,
+          pagesWritten: pagesSeen.size,
           elapsedSec: Math.round((Date.now() - startedAt) / 1000),
           ...extra,
         });
         const onActivity = (a) => {
           if (a.kind === 'read') filesRead++;
-          if (a.kind === 'write') phase = 'writing';
+          if (a.kind === 'write') {
+            phase = 'writing';
+            pagesSeen.add(a.path || a.label);
+          }
           // Collapse runs of bare "thinking…" so the feed doesn't fill with it.
           if (!(a.label === 'thinking…' && feed[feed.length - 1] === 'thinking…')) {
             feed.push(a.label);
@@ -1430,6 +1573,12 @@ export async function runFleetDaemon() {
           getHasWork: (id) => hasWorkByAgent.get(id) ?? false,
           getNext: (id) => nextByAgent.get(id) ?? null,
           getMcpUrl: () => mcpUrl,
+          // Injected rather than imported: fleet.mjs imports live.mjs, so live
+          // cannot import back. The live worker is the DEFAULT one, and until
+          // this was passed down the whole run-diffstat pipeline was reachable
+          // only under FLOWVIANT_POLL=1 — the app's live-changes panel had no
+          // data source at all for the path everybody actually runs.
+          sampleDiffstat,
           isAlive: () => state.alive,
           onChild: (ch) => {
             state.child = ch;

package/bin/lib/git.mjs

@@ -1,10 +1,11 @@
 /** Git worktree helpers (fleet & static-fleet modes). */
 
 import { execFileSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { resolve, join } from 'node:path';
 import { rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { materializedFiles } from './env.mjs';
 
 export function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
@@ -185,6 +186,14 @@ function gitWithEnv(args, cwd, extraEnv) {
  * world untouched — it cannot tell this happened.
  *
  * Returns the commit sha, or null if there was nothing dirty / no remote.
+ *
+ * This PUSHES, so what it stages is a security boundary, not a detail: the
+ * daemon materializes plaintext env-vault secrets into this same worktree.
+ * They are gitignored (materializeInto refuses to write them otherwise), and
+ * `git add -A` honours .gitignore — but the whole point of the bug this guards
+ * against was an exclusion mechanism that silently did nothing, so the paths
+ * are ALSO subtracted by pathspec here. Two independent mechanisms, because one
+ * of them failing quietly is exactly what put secrets on a remote branch.
  */
 export function checkpointWip(wt, intentId, baseRef) {
   if (!isSafePathSegment(intentId)) return null;
@@ -201,7 +210,11 @@ export function checkpointWip(wt, intentId, baseRef) {
   try {
     const head = git(['rev-parse', 'HEAD'], wt);
     gitWithEnv(['read-tree', head], wt, env);
-    gitWithEnv(['add', '-A'], wt, env);
+    gitWithEnv(
+      ['add', '-A', '--', '.', ...materializedFiles(wt).map((p) => `:(exclude)${p}`)],
+      wt,
+      env
+    );
     const tree = gitWithEnv(['write-tree'], wt, env);
     // Nothing changed since HEAD — no snapshot worth pushing.
     if (tree === git(['rev-parse', `${head}^{tree}`], wt)) return null;
@@ -274,3 +287,107 @@ export function resetWorktree(wt, baseRef) {
     console.error(`  (worktree reset to ${baseRef} failed: ${e.message})`);
   }
 }
+
+/**
+ * What has changed in this worktree since `baseRef` — committed or not.
+ *
+ * The definition matters. `git diff --numstat <base>` (no `..HEAD`) compares the
+ * base against the WORKING TREE, so it covers commits the agent has made, staged
+ * work, and edits it has not committed yet. Anything narrower would go blank at
+ * the exact moments you look: right after a commit, or before the first one.
+ *
+ * Untracked files are added separately — they are invisible to `git diff` and
+ * are usually the most interesting thing an agent has done (a new module, a new
+ * test). Their line counts are read here rather than inferred; a file too large
+ * to be source is reported as a path with no counts instead of being read into
+ * memory.
+ *
+ * PATHS AND COUNTS ONLY. Nothing in here returns file content.
+ *
+ * Both git calls are `-z`, for the reason gitRaw exists: git's line-based output
+ * QUOTES any path that is not plain ASCII, so an accented filename arrives as
+ * "n\303\251w.txt" — a string that is not the path, cannot be stat'd, and reads
+ * as garbage in the tray. `-z` emits paths verbatim.
+ */
+export function worktreeDiffstat(cwd, baseRef, { maxFiles = 200 } = {}) {
+  const files = [];
+  let additions = 0;
+  let deletions = 0;
+
+  const add = (path, added, removed) => {
+    additions += added;
+    deletions += removed;
+    files.push({ path, added, removed });
+  };
+
+  try {
+    // `--numstat -z` frames a normal change as one field, "added\tdeleted\tpath",
+    // but a RENAME as three: "added\tdeleted\t" (empty path), then the old path,
+    // then the new one. An empty path is therefore the rename marker, and the
+    // next two fields belong to it — read line-wise instead, a rename would
+    // report a file literally named "old => new".
+    const fields = splitNul(gitRaw(['diff', '--numstat', '-z', baseRef, '--'], cwd));
+    for (let i = 0; i < fields.length; i++) {
+      const [a, d, ...rest] = fields[i].split('\t');
+      let path = rest.join('\t');
+      if (!path) {
+        path = fields[i + 2] ?? fields[i + 1]; // the post-rename name is what exists now
+        i += 2;
+        if (!path) continue;
+      }
+      // Binary files report '-' for both counts; they changed, but not by lines.
+      add(path, a === '-' ? 0 : Number(a) || 0, d === '-' ? 0 : Number(d) || 0);
+    }
+  } catch {
+    // No base ref yet, or not a repo — nothing to report rather than a crash.
+    return null;
+  }
+
+  try {
+    const untracked = splitNul(
+      gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], cwd)
+    );
+    for (const path of untracked) {
+      let added = 0;
+      // Past the cap this path will not be shown, so do not pay to read it.
+      // This is the one place the totals can undercount, and reaching it takes
+      // an untracked tree bigger than the list itself — a generated directory
+      // .gitignore missed. Statting and reading all of it on a 20s interval
+      // would block the roster poll and every other lane on this daemon.
+      if (files.length < maxFiles) {
+        try {
+          const st = statSync(join(cwd, path));
+          // Regular files ONLY. `git ls-files --others` will happily name a
+          // symlink or a fifo, and readFileSync on a fifo or a character device
+          // BLOCKS — on a 20s interval, on the daemon's single thread, that is
+          // the whole process wedged waiting for a device that may never write.
+          // 2 MB: past that it is a build artifact or a binary, and reading it
+          // to count newlines would be the most expensive thing this daemon does.
+          if (st.isFile() && st.size <= 2_000_000) {
+            const text = readFileSync(join(cwd, path), 'utf8');
+            // A NUL byte means binary. Counting "lines" in a PNG produces a
+            // number that is not wrong so much as meaningless, and it was being
+            // summed into the total shown beside git's real counts.
+            if (text.includes('\0')) throw new Error('binary');
+            // Lines, not segments. A file ending in a newline — i.e. essentially
+            // every source file an agent writes — splits into one more piece
+            // than it has lines, and that +1 was landing in the totals shown
+            // beside git's own counts.
+            added = text ? text.split('\n').length - (text.endsWith('\n') ? 1 : 0) : 0;
+          }
+        } catch {
+          /* vanished between listing and reading — report the path, no counts */
+        }
+      }
+      add(path, added, 0);
+    }
+  } catch {
+    /* untracked listing failed — the tracked half still stands */
+  }
+
+  if (files.length === 0) return null;
+  // Totals stay whole while the LIST is capped: a truncated list must never
+  // quietly shrink the number printed beside it.
+  const truncated = Math.max(0, files.length - maxFiles);
+  return { files: files.slice(0, maxFiles), additions, deletions, truncated };
+}

package/bin/lib/live.mjs

@@ -565,8 +565,10 @@ export async function runLiveTask({
   resumeIntentId,
   onChild,
   onIntent,
+  sampleDiffstat,
+  agentId,
 }) {
-  const claim = await mcpCall(mcpUrl, token, 'claim_next_intent', {}).catch(() => null);
+  const claim = await mcpCall(mcpUrl, token, 'claim_next_task', {}).catch(() => null);
   if (!claim || claim.claimed !== true) return { outcome: 'nothing' };
   const { runId, intentId } = claim;
   const brief = claim.brief ?? {};
@@ -753,15 +755,31 @@ export async function runLiveTask({
   }, CHECKPOINT_MS);
   checkpointTimer.unref?.();
 
+  // Report what this run is changing WHILE it changes it. Started here, beside
+  // the checkpoint timer, because both want the same two facts — a worktree and
+  // the task it belongs to — and both must be torn down on every exit from this
+  // function. Unlike poll mode there is nothing to predict: the claim above
+  // already told us the real intent.
+  const stopDiffstat = sampleDiffstat?.(cwd, baseRef, intentId, agentId) ?? null;
+
   const input = makeInput(seedPrompt(runId, brief, transcript, resumedInPlace));
   const session = query({
     prompt: input.stream(),
     options: {
       cwd,
       env,
-      // Pin the model — never inherit the user's global default (which may be a
-      // 1M/long-context tier their subscription can't bill autonomous work on).
-      model: MODEL,
+      // Per-task first, this machine's default second. The task's own choice
+      // comes off the BRIEF rather than the roster hint, because the claim has
+      // already happened here — this is the task we actually got, not the one
+      // the server guessed we would get.
+      //
+      // Still pinned either way: never inherit the user's global default, which
+      // may be a 1M/long-context tier their subscription cannot bill autonomous
+      // work on.
+      model: brief.agentModel || MODEL,
+      // Omitted entirely when unset — Claude Code's own default is the right
+      // answer, and passing undefined effort is not the same as not passing it.
+      ...(brief.agentEffort ? { effort: brief.agentEffort } : {}),
       permissionMode: SAFE ? 'default' : 'bypassPermissions',
       ...(SAFE ? { allowedTools: SAFE_TOOLS } : {}),
       systemPrompt: { type: 'preset', preset: 'claude_code', append: SYSTEM_LIVE },
@@ -972,6 +990,10 @@ export async function runLiveTask({
     return { outcome: 'error', error: e?.message ?? String(e), title, intentId };
   } finally {
     clearInterval(checkpointTimer);
+    // Same finally as the checkpoint: every path out of this task — done,
+    // parked, rate-limited, thrown — must stop reporting a worktree that is
+    // about to stop being this run's.
+    stopDiffstat?.();
     // Last word on this task's state. If the work landed (branch pushed, PR
     // open, patch applied) the checkpoint has served its purpose and the ref is
     // deleted — otherwise it accumulates one hidden ref per task, forever, on
@@ -1046,6 +1068,11 @@ export async function runLiveWorker({
   onChild,
   onIntent,
   onPreview,
+  /** Start posting this run's worktree diffstat; returns stop(). Injected from
+   *  fleet.mjs (which imports this module, so the dependency cannot go the
+   *  other way). Optional so a caller without it degrades to no panel rather
+   *  than crashing. */
+  sampleDiffstat,
 }) {
   // The intent this worker is holding across iterations. When a task parks on a
   // blocker its worktree keeps uncommitted work; on the resume claim we must NOT
@@ -1198,6 +1225,8 @@ export async function runLiveWorker({
         isAlive,
         resumeIntentId: lastIntentId,
         onChild,
+        sampleDiffstat,
+        agentId,
       });
     } catch (e) {
       enter('error', warn, `${c.yellow('error')} ${c.dim(`— ${e?.message ?? e}`)}`);

package/bin/lib/runtimes.mjs

@@ -0,0 +1,363 @@
+/**
+ * WHICH CLI builds a task, and how you drive it.
+ *
+ * The daemon spoke exactly one runtime for its whole life, and that assumption
+ * is spread thinner than it looks: `claude -p` argv in one place, but also a
+ * `--mcp-config` file, an `--append-system-prompt`, a `stream-json` event schema
+ * and a set of sentinel words the turn loop reads out of stdout. A second CLI is
+ * not a different binary name — it is a different answer to each of those.
+ *
+ * So each runtime declares its own answers here, and everything else in the
+ * daemon asks this module rather than knowing them.
+ *
+ * WHAT A RUNTIME MUST BE ABLE TO DO to build a Flowviant task at all:
+ *   1. run headless from one prompt and exit,
+ *   2. talk to the flowviant MCP server — this is the whole control plane, and a
+ *      runtime that cannot reach it cannot claim work, report a blocker, attach
+ *      a PR or complete, which is to say it cannot participate,
+ *   3. act without asking permission per tool call (there is no terminal here),
+ *   4. emit machine-readable progress, or the thread goes silent for the length
+ *      of a build.
+ * Claude Code and Codex both do all four. Antigravity does 1, 3 and 4 and is
+ * declared below with the exact reason it cannot yet do 2.
+ *
+ * WHAT THIS MODULE DELIBERATELY DOES NOT DO: pick. Which runtime runs a task is
+ * decided in the app, by @mentioning it (CLAUDE.md: the @mention is the only
+ * dispatch), and arrives on the brief. Detection here answers "what does this
+ * machine HAVE" — activity, never capacity, and never a default we invented.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { SAFE, MODEL, USER_AGENT } from './config.mjs';
+
+/** Truncate for a one-line activity label. */
+const oneLine = (s, n = 140) =>
+  String(s ?? '').replace(/\s+/g, ' ').trim().slice(0, n);
+
+const shortPath = (p, cwd) => {
+  const s = String(p ?? '');
+  return cwd && s.startsWith(cwd) ? s.slice(cwd.length).replace(/^\//, '') : s;
+};
+
+// ── Claude Code ────────────────────────────────────────────────────────────
+
+/**
+ * Tool-call → one line of activity. Claude's tool names, unchanged from when
+ * this lived in claude.mjs; `kind` is the daemon's own vocabulary and every
+ * runtime's parser must speak it (`read` is what the wiki file counter counts,
+ * `write` carries `path` so distinct pages can be counted).
+ */
+export function humanizeClaudeTool(name, input = {}, cwd = '') {
+  switch (name) {
+    case 'Read':
+      return { kind: 'read', label: `read ${shortPath(input.file_path, cwd)}` };
+    case 'Write':
+    case 'Edit': {
+      const p = String(input.file_path ?? '');
+      const tail = p.split('/').slice(-2).join('/');
+      return { kind: 'write', path: p, label: `${name === 'Write' ? '+ page' : '~ page'} ${tail}` };
+    }
+    case 'Grep':
+      return {
+        kind: 'search',
+        label: `grep ${JSON.stringify(input.pattern ?? '')}${input.path ? ` in ${shortPath(input.path, cwd)}` : ''}`,
+      };
+    case 'Glob':
+      return { kind: 'glob', label: `glob ${input.pattern ?? ''}` };
+    case 'LS':
+      return { kind: 'list', label: `ls ${shortPath(input.path ?? '.', cwd)}` };
+    case 'Bash':
+      return { kind: 'bash', label: `$ ${oneLine(input.command, 60)}` };
+    default:
+      return null; // other tools: silent
+  }
+}
+
+// ── Codex ──────────────────────────────────────────────────────────────────
+
+/**
+ * Codex item → activity, in the daemon's vocabulary.
+ *
+ * The event names and item types below are not guesses: they were read off the
+ * shipped 0.147 binary (`ThreadStarted`/`TurnCompleted`/`ItemCompleted`, items
+ * `agent_message` / `reasoning` / `command_execution` / `file_change` /
+ * `mcp_tool_call` / `web_search` / `todo_list`). Unknown item types return null
+ * and stay silent rather than printing a raw JSON blob into someone's console.
+ */
+function humanizeCodexItem(item = {}, cwd = '') {
+  switch (item.item_type ?? item.type) {
+    case 'agent_message':
+      return { kind: 'say', label: oneLine(item.text ?? item.message) };
+    case 'reasoning':
+      return { kind: 'think', label: oneLine(item.text) || 'thinking…' };
+    case 'command_execution':
+      return { kind: 'bash', label: `$ ${oneLine(item.command, 60)}` };
+    case 'file_change': {
+      // `changes` is a list of touched paths; the daemon counts distinct files,
+      // so emit one activity per path rather than one for the batch.
+      const first = (item.changes ?? [])[0] ?? {};
+      const p = String(first.path ?? '');
+      const tail = p.split('/').slice(-2).join('/');
+      const verb = first.kind === 'add' ? '+' : first.kind === 'delete' ? '-' : '~';
+      return { kind: 'write', path: p, label: `${verb} ${tail || 'file'}` };
+    }
+    case 'mcp_tool_call':
+      return { kind: 'tool', label: `${item.server ?? 'mcp'}.${item.tool ?? ''}` };
+    case 'web_search':
+      return { kind: 'search', label: `search ${oneLine(item.query, 60)}` };
+    default:
+      return null;
+  }
+}
+
+/**
+ * Codex `--json` emits JSONL of ThreadEvents. Returns `{ activity, text }` —
+ * `text` accumulates the agent's own words, because the turn loop reads its
+ * sentinels (NOTHING / BLOCKED:<id> / DONE) out of exactly that.
+ */
+function parseCodexLine(line, cwd) {
+  let ev;
+  try {
+    ev = JSON.parse(line);
+  } catch {
+    return null; // not every line is JSON (warnings go to stderr, but be safe)
+  }
+  switch (ev.type) {
+    case 'item.completed': {
+      const item = ev.item ?? {};
+      const activity = humanizeCodexItem(item, cwd);
+      // Only the agent's MESSAGES are sentinel-bearing text. Reasoning is not:
+      // a model that muses "I could output NOTHING here" must not end the turn.
+      const text =
+        (item.item_type ?? item.type) === 'agent_message'
+          ? `${item.text ?? item.message ?? ''}\n`
+          : '';
+      return { activity, text };
+    }
+    case 'turn.failed':
+      return {
+        activity: { kind: 'error', label: oneLine(ev.error?.message ?? 'turn failed') },
+        text: '',
+      };
+    default:
+      return null; // thread.started / turn.started / item.started / item.updated
+  }
+}
+
+// ── The registry ───────────────────────────────────────────────────────────
+
+/**
+ * How each runtime is told about the flowviant MCP server.
+ *
+ * This is the part that differs most, and it is worth naming why it matters:
+ * the token handed over here is a WORKER token scoped to one lane, minted fresh
+ * and dropped at the end of the turn. Anything that forces a machine-wide config
+ * file forces one shared token for every lane instead, which is a real downgrade
+ * in blast radius — so a runtime that cannot take per-invocation config does not
+ * get to run, rather than getting to run less safely.
+ *
+ * Claude takes a config file path (`--mcp-config`), so the token lands in a
+ * 0600 temp file the caller deletes. Codex takes dotted `-c` overrides and can
+ * read the bearer token from an ENV VAR (`bearer_token_env_var`), so its token
+ * never touches disk at all — strictly better, and the reason Codex was the
+ * first second-runtime rather than the easiest-looking one.
+ */
+function claudeMcp(token, mcpUrl) {
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
+  const path = join(dir, 'mcp.json');
+  writeFileSync(
+    path,
+    JSON.stringify({
+      mcpServers: {
+        flowviant: {
+          type: 'http',
+          url: mcpUrl,
+          headers: { Authorization: `Bearer ${token}`, 'User-Agent': USER_AGENT },
+        },
+      },
+    }),
+    { mode: 0o600 }
+  );
+  return { dir, args: ['--mcp-config', path], env: {} };
+}
+
+function codexMcp(token, mcpUrl) {
+  return {
+    dir: null, // nothing written — the token rides in the environment
+    args: [
+      '-c',
+      `mcp_servers.flowviant.url="${mcpUrl}"`,
+      '-c',
+      'mcp_servers.flowviant.bearer_token_env_var="FLOWVIANT_MCP_TOKEN"',
+    ],
+    env: { FLOWVIANT_MCP_TOKEN: token },
+  };
+}
+
+export const RUNTIMES = {
+  claude: {
+    id: 'claude',
+    label: 'Claude Code',
+    vendor: 'Anthropic',
+    bin: 'claude',
+    install: 'npm i -g @anthropic-ai/claude-code',
+    login: 'claude',
+    /** The Agent-SDK live session (persistent, injectable mid-task) is Claude
+     *  only — it is an Anthropic SDK, not a CLI contract. Everything else runs
+     *  the subprocess path. */
+    live: true,
+    mcp: claudeMcp,
+    /**
+     * Claude takes the operating contract as a real system prompt, which is the
+     * strongest form of it available anywhere: `--append-system-prompt` sits
+     * above the conversation rather than inside it.
+     */
+    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [] }) {
+      const a = [];
+      if (resume) a.push('--continue');
+      a.push('-p', prompt, '--append-system-prompt', system);
+      a.push(...mcp);
+      a.push('--model', model || MODEL);
+      if (effort) a.push('--effort', effort);
+      if (streamJson) a.push('--output-format', 'stream-json', '--verbose');
+      a.push(...perm);
+      return a;
+    },
+    parse: null, // claude.mjs owns its own stream parser (unchanged)
+  },
+
+  codex: {
+    id: 'codex',
+    label: 'Codex',
+    vendor: 'OpenAI',
+    bin: 'codex',
+    install: 'npm i -g @openai/codex',
+    login: 'codex login',
+    live: false,
+    mcp: codexMcp,
+    /**
+     * Codex has NO system-prompt flag. The contract therefore rides inside the
+     * prompt, fenced and placed first, and this is a genuine weakening worth
+     * stating plainly: a system prompt is a rule, and a prompt preamble is a
+     * strong suggestion the model may drift from over a long turn. It is the
+     * best available; AGENTS.md was the alternative and is worse, because it is
+     * a FILE IN THE WORKTREE — one `git add -A` from being committed into the
+     * user's repository, which is not a risk worth taking for a slightly
+     * stickier instruction.
+     *
+     * `--skip-git-repo-check` is deliberately NOT passed: a task always builds
+     * in a git worktree, and if it somehow is not one, failing loudly beats
+     * silently editing files nobody can diff.
+     *
+     * THE PROMPT IS LAST, and that is load-bearing rather than tidy. Codex takes
+     * it as a trailing POSITIONAL, so every flag — including the two `-c` MCP
+     * overrides, which the caller hands in rather than appending — has to be
+     * placed before it. Appending them after the positional is the kind of argv
+     * that parses today and stops parsing on some future clap upgrade.
+     */
+    args({ prompt, system, model, effort, resume, perm: _perm, mcp = [] }) {
+      const a = ['exec'];
+      if (resume) a.push('resume', '--last');
+      a.push('--json');
+      if (model) a.push('--model', model);
+      // Effort is a config value on Codex rather than a flag.
+      if (effort) a.push('-c', `model_reasoning_effort="${effort}"`);
+      // The daemon's posture, mapped: SAFE keeps writes inside the workspace,
+      // the default lets the agent run its own tests and git commands. Neither
+      // asks a human — there is no human on this end of the pipe.
+      a.push('--sandbox', SAFE ? 'workspace-write' : 'danger-full-access');
+      a.push(...mcp);
+      a.push(`${system}\n\n---\n\n${prompt}`);
+      return a;
+    },
+    parse: parseCodexLine,
+  },
+
+  /**
+   * DECLARED, NOT DRIVABLE — and the reason is specific, not a shrug.
+   *
+   * `agy` has everything else this needs: `-p` for headless, `--output-format
+   * stream-json`, `--model`, `--effort`, `--continue`, and
+   * `--dangerously-skip-permissions`. What it has no per-invocation form of is
+   * the MCP server: config lives at `~/.gemini/config/mcp_config.json`, the
+   * workspace-local `.agents/mcp_config.json` is read-but-ignored (upstream
+   * antigravity-cli#60), and the HOME-level file cannot be made per-lane —
+   * pointing HOME elsewhere would take the cached credentials the headless mode
+   * signs in with along with it.
+   *
+   * So running Antigravity today means one shared MCP token across every lane on
+   * the machine, which is exactly the blast radius the per-lane token exists to
+   * prevent. It is listed so `flowviant doctor` can say "installed, and here is
+   * what is missing" rather than pretending we never looked — the same posture
+   * the app's @ tray takes. When either the workspace config is fixed upstream
+   * or a flag appears, this becomes an `mcp` function and a `parse`, and nothing
+   * else in the daemon changes.
+   */
+  antigravity: {
+    id: 'antigravity',
+    label: 'Antigravity',
+    vendor: 'Google',
+    bin: 'agy',
+    install: 'see antigravity.google/docs/cli',
+    login: 'agy',
+    live: false,
+    mcp: null,
+    args: null,
+    parse: null,
+    blocked: 'no per-invocation MCP config — its server list is machine-wide, so every lane would share one token',
+  },
+};
+
+/** Runtimes this daemon can actually put a task on. */
+export const DISPATCHABLE = Object.values(RUNTIMES).filter((r) => r.mcp && r.args);
+
+export const runtimeById = (id) => RUNTIMES[id] ?? RUNTIMES.claude;
+
+// ── Detection ──────────────────────────────────────────────────────────────
+
+/**
+ * Which of these is on this machine, asked once.
+ *
+ * `--version` rather than `which`: a binary on PATH that cannot execute (a
+ * broken install, a wrong-arch download, a shell alias pointing at nothing) is
+ * not a runtime you can dispatch to, and reporting it as one sends work into a
+ * hole. 5s is generous for a version print and short enough that three missing
+ * CLIs cannot stall a roster poll.
+ *
+ * Reported to the server on the roster poll so the app can stop saying "we have
+ * not looked". It is a statement about THIS MACHINE and nothing else — no
+ * account, no quota, no entitlement. Flowviant relays; it does not enforce.
+ */
+let detectedCache = null;
+export function detectRuntimes({ refresh = false } = {}) {
+  if (detectedCache && !refresh) return detectedCache;
+  detectedCache = Object.values(RUNTIMES).map((rt) => {
+    let version = null;
+    try {
+      version = String(
+        execFileSync(rt.bin, ['--version'], {
+          timeout: 5000,
+          stdio: ['ignore', 'pipe', 'ignore'],
+        })
+      )
+        .trim()
+        .split('\n')[0]
+        .slice(0, 40);
+    } catch {
+      version = null;
+    }
+    return {
+      id: rt.id,
+      installed: version !== null,
+      version,
+      // Installed and drivable are different questions, and conflating them is
+      // how a user ends up @mentioning something that silently never starts.
+      dispatchable: version !== null && Boolean(rt.mcp && rt.args),
+      blocked: rt.blocked ?? null,
+    };
+  });
+  return detectedCache;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowviant",
-  "version": "0.36.0",
-  "description": "Run your own Claude Code as headless build agents for Flowviant — on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
+  "version": "0.38.0",
+  "description": "Run your own coding CLIs as headless build agents for Flowviant \u2014 Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {
     "flowviant": "bin/cli.mjs"