flowviant 0.45.0 → 0.47.0

package/bin/lib/claude.mjs

@@ -233,7 +233,7 @@ function handleStreamLine(line, { cwd, emit, onActivity, appendText }) {
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort, adoptResumeId }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, onActivity, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
     if (!rt.args) {
@@ -277,9 +277,11 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       streamJson,
       profile,
       // Adopting a terminal session (work.mjs): Claude turns it into
-      // `--resume <id> --fork-session`; every other runtime THROWS on it, so a
-      // mis-wired adoption fails as a loud turn error rather than a silent
-      // fresh conversation wearing an adopted session's name.
+      // `--resume <id> --fork-session` (a FORK — the original is untouched);
+      // agy turns it into `--conversation <id>` (a MOVE — agy has no fork, the
+      // tab continues the terminal conversation itself). Codex THROWS on it,
+      // so a mis-wired adoption fails as a loud turn error rather than a
+      // silent fresh conversation wearing an adopted session's name.
       adoptResumeId,
       // Only the wiki profile uses it, but it is passed unconditionally: a
       // runtime that can path-scope its writes needs to know WHERE the vault is,
@@ -296,6 +298,13 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       // positional, so a flag after it is a flag in the wrong place.
       // Wiki-vault turns are pure file work and pass neither — no MCP at all.
       mcp: mcpConfig ? ['--mcp-config', mcpConfig] : (mcpArgs ?? []),
+      // Resuming a SPECIFIC held conversation by its own id (work.mjs, codex
+      // sessions). Runtimes without a by-id resume ignore it and keep their
+      // `resume` behavior unchanged.
+      resumeThreadId,
+      // agy's by-id resume (work.mjs, antigravity sessions): the conversation
+      // id learned from the adopt hint or the cwd registry after a turn.
+      resumeConversationId,
     });
     // Whatever this machine is signed in with, we use. We do NOT pick.
     //
@@ -338,6 +347,10 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
         if (!rt.parse) return handleStreamLine(line, { cwd, emit, onActivity, appendText });
         const ev = rt.parse(line, cwd);
         if (!ev) return;
+        // The conversation id, when the runtime announces one (codex's
+        // thread.started). Purely additive: callers that pass no onThreadId —
+        // every dispatch path — see zero behavior change.
+        if (ev.threadId) onThreadId?.(ev.threadId);
         if (ev.text) appendText(ev.text);
         if (ev.activity) {
           emit(`${ev.activity.label}\n`);

package/bin/lib/fleet.mjs

@@ -94,6 +94,13 @@ async function fetchRoster(haveIds) {
   // machine knows its cores, its RAM and whose Claude quota is being spent.
   // Older servers ignore the param, so sending it is always safe.
   url.searchParams.set('capacity', String(MAX_CONCURRENT));
+  // WHICH DAEMON this machine runs, so the server can gate version-dependent
+  // work — codex Workbench tabs are only created for machines whose daemon can
+  // actually serve them (dv >= 0.46.0). The same source the self-update check
+  // compares against the roster's daemon.latest (config.mjs VERSION, read off
+  // our own package.json). Older servers ignore unknown params, so sending it
+  // unconditionally is always safe.
+  url.searchParams.set('dv', VERSION);
   // WHICH CLIs this machine actually has, so the app can stop guessing.
   //
   // Until now every surface that listed Gemini or Codex said "not wired up yet"

package/bin/lib/localSessions.mjs

@@ -262,5 +262,137 @@ export function scanLocalSessions({ repoRoot, excludeDirs = [] }) {
   } catch {
     /* presence must never throw into the poll loop — report what was gathered */
   }
-  return [...live.slice(0, REPORT_CAP), ...ended];
+  const claude = [...live.slice(0, REPORT_CAP), ...ended];
+  // agy rides in whatever room the cap leaves — Claude sessions first, they
+  // are the ones adoption serves best (fork, never move).
+  const agy = scanAgyConversations({ repoRoot, excludeDirs }).slice(
+    0,
+    Math.max(0, REPORT_CAP - claude.length)
+  );
+  return [...claude, ...agy];
+}
+
+// ── Antigravity (agy) ──────────────────────────────────────────────────────
+//
+// agy's store is nothing like Claude's: one SQLite db per conversation at
+// ~/.gemini/antigravity-cli/conversations/<uuid>.db (global, not cwd-keyed),
+// no per-pid liveness registry that survives contact (the presence/*.lock
+// files sit untouched by real runs — measured), and the only cwd mapping is
+// cache/last_conversations.json: {cwd → the LAST conversation run there}.
+// So the honest agy report is a SUBSET — the last conversation per directory
+// inside this repo — and that is exactly the one `agy --continue` would give
+// the person at that keyboard, i.e. the one worth offering to adopt.
+
+const AGY_DIR = () => join(homedir(), '.gemini', 'antigravity-cli');
+const AGY_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Newest write to the conversation's store — the wal carries recent turns,
+ *  so its mtime (not the db's) is the real "last active" (measured: a resume
+ *  touched db+wal, and never the presence lock). 0 = no such conversation. */
+function agyLastWriteMs(id) {
+  if (!AGY_UUID_RE.test(id)) return 0;
+  let newest = 0;
+  for (const suffix of ['.db', '.db-wal']) {
+    try {
+      const t = statSync(join(AGY_DIR(), 'conversations', `${id}${suffix}`)).mtimeMs;
+      if (t > newest) newest = t;
+    } catch {
+      /* absent half is fine — the db alone still answers */
+    }
+  }
+  return newest;
+}
+
+/** Any agy process on the machine right now? /proc comm scan — cheap at the
+ *  60s cadence, and the only liveness signal agy leaves (locks are inert). */
+function agyProcessAlive() {
+  try {
+    for (const name of readdirSync('/proc')) {
+      if (!/^\d+$/.test(name)) continue;
+      try {
+        if (readFileSync(`/proc/${name}/comm`, 'utf8').trim() === 'agy') return true;
+      } catch {
+        /* raced exit — keep scanning */
+      }
+    }
+  } catch {
+    /* no /proc — call nothing live rather than everything */
+  }
+  return false;
+}
+
+/**
+ * Is this agy conversation being driven RIGHT NOW? agy cannot answer
+ * per-conversation, so this is the conservative composite: an agy process
+ * exists AND this conversation's store was written in the last 10 minutes.
+ * Adoption is a MOVE for agy (no fork exists — measured, "trajectory not
+ * found" on a renamed copy), so refusing a maybe-live conversation for a few
+ * minutes costs a retry; adopting an actually-live one puts two drivers on
+ * one store.
+ */
+const AGY_LIVE_WINDOW_MS = 10 * 60 * 1000;
+export function isAgyConversationLive(id) {
+  try {
+    if (!agyProcessAlive()) return false;
+    const t = agyLastWriteMs(id);
+    return t > 0 && Date.now() - t < AGY_LIVE_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+
+/** The repo's agy conversations, via the cwd registry — see the section
+ *  comment for why this is deliberately a subset. */
+function scanAgyConversations({ repoRoot, excludeDirs = [] }) {
+  const out = [];
+  try {
+    let realRoot;
+    try {
+      realRoot = realpathSync(repoRoot);
+    } catch {
+      return out;
+    }
+    const excludes = [];
+    for (const d of excludeDirs) {
+      if (!d) continue;
+      try {
+        excludes.push(realpathSync(d));
+      } catch {
+        excludes.push(String(d));
+      }
+    }
+    const ours = (p) => inside(p, realRoot) && !excludes.some((e) => inside(p, e));
+    const raw = readFileSync(join(AGY_DIR(), 'cache', 'last_conversations.json'), 'utf8');
+    const map = JSON.parse(raw);
+    if (!map || typeof map !== 'object') return out;
+    const cutoff = Date.now() - SEVEN_DAYS_MS;
+    const processUp = agyProcessAlive();
+    for (const [cwd, id] of Object.entries(map)) {
+      if (typeof id !== 'string' || !AGY_UUID_RE.test(id)) continue;
+      let real;
+      try {
+        real = realpathSync(cwd);
+      } catch {
+        continue; // the directory is gone — nothing to point a tab at
+      }
+      if (!ours(real)) continue;
+      const lastMs = agyLastWriteMs(id);
+      if (!lastMs || lastMs < cutoff) continue;
+      out.push({
+        id,
+        cwd: real,
+        live: processUp && Date.now() - lastMs < AGY_LIVE_WINDOW_MS,
+        lastActiveAt: new Date(lastMs).toISOString(),
+        runtime: 'antigravity',
+      });
+    }
+    out.sort(
+      (a, b) =>
+        (b.lastActiveAt < a.lastActiveAt ? -1 : b.lastActiveAt > a.lastActiveAt ? 1 : 0) ||
+        (a.id < b.id ? -1 : 1)
+    );
+  } catch {
+    /* no agy on this machine, or an unreadable registry — nothing to report */
+  }
+  return out;
 }

package/bin/lib/prompts.mjs

@@ -486,6 +486,41 @@ the way, say so — fixing it is allowed if it's small and obviously wanted.
 
 Write plain Markdown for a person watching a live session.`;
 
+/**
+ * The PLAIN tab — a work session on a runtime that cannot mount MCP
+ * (Antigravity: its server list is machine-wide, measured). No Flowviant
+ * tools means no streaming, no cards, no purpose line — and the product
+ * stays honest anyway: the final answer is delivered by the daemon's own
+ * report, an uncarded session's rail says "no card yet" (a readout, not a
+ * failure), and ship-time reconciliation turns every branch commit into the
+ * ledger's record. What this prompt must NOT do is pretend the tools exist,
+ * or apologize for their absence every turn.
+ */
+export const SYSTEM_WORK_PLAIN = `You are the human's own coding agent, working WITH them in their repository.
+This is a persistent session — a tab they keep open — and it should feel like
+working in a terminal: they talk, you work.
+
+MECHANICS OF THIS TAB:
+
+1. THIS WORKTREE IS THE SESSION. You are on this tab's own branch. Edit freely,
+   commit as coherent units complete — small, honest commits with real
+   messages. Uncommitted state survives between turns; this directory is yours.
+2. YOUR FINAL MESSAGE IS YOUR REPLY. It is delivered into the tab when the turn
+   ends — there is no live streaming from this runtime, so make the final
+   message the complete, self-contained report of what you did and found.
+3. YOU HAVE NO FLOWVIANT TOOLS in this session — no cards, no ledger calls.
+   Don't mention or simulate them. Your commits ARE your record: when this
+   tab's branch ships, every commit is reconciled onto the project ledger.
+4. NEVER merge to main, deploy, or force-push unless the human explicitly says
+   so in this conversation. Branch pushes are fine when asked. Shipping is
+   their word to say, not yours to infer.
+
+POSTURE: terminal, not ticket. Don't ask permission to look at things. Ground
+claims in files you opened. When they ask a question, answer it; when they ask
+for work, do it.
+
+Write plain Markdown for a person reading your reply in a chat tab.`;
+
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
   // The speaker is the tab's OWNER — the same person who owns this machine —
   // so this is the one prompt whose author is fully trusted. The fence stays
@@ -497,6 +532,14 @@ export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName
   `${fence('WHAT THEY SAID', message)}\n\n` +
   `Stream your reply with stream_session_turn as you work.`;
 
+/** The plain tab's kickoff: no session id (there is no tool to pass it to)
+ *  and no streaming instruction — the final message is the reply. */
+export const WORK_TURN_KICKOFF_PLAIN = ({ sessionName, message, askedByName }) =>
+  `Continue the session${sessionName ? ` "${sessionName}"` : ''}.\n\n` +
+  `${fence('WHO IS TALKING', askedByName || 'the tab owner')}\n\n` +
+  `${fence('WHAT THEY SAID', message)}\n\n` +
+  `Reply with your complete report when the work is done.`;
+
 /**
  * A quick edit running ALONGSIDE the task's own agent.
  *

package/bin/lib/runtimes.mjs

@@ -123,9 +123,11 @@ function humanizeCodexItem(item = {}, cwd = '') {
 }
 
 /**
- * Codex `--json` emits JSONL of ThreadEvents. Returns `{ activity, text }` —
- * `text` accumulates the agent's own words, because the turn loop reads its
- * sentinels (NOTHING / BLOCKED:<id> / DONE) out of exactly that.
+ * Codex `--json` emits JSONL of ThreadEvents. Returns `{ activity, text,
+ * threadId }` — `text` accumulates the agent's own words, because the turn
+ * loop reads its sentinels (NOTHING / BLOCKED:<id> / DONE) out of exactly
+ * that; `threadId` surfaces once, off the lifecycle event, for callers that
+ * need to resume THIS conversation later (runTurn's onThreadId).
  */
 function parseCodexLine(line, cwd) {
   let ev;
@@ -135,6 +137,14 @@ function parseCodexLine(line, cwd) {
     return null; // not every line is JSON (warnings go to stderr, but be safe)
   }
   switch (ev.type) {
+    // The conversation's own id, announced before any item (`ThreadStarted` on
+    // the shipped 0.147 binary, like the measured events below). Surfaced so a
+    // SESSION turn can resume this exact thread next time: `resume --last` is
+    // a machine-global guess, and on a box running two tabs — or a tab plus a
+    // dispatch — it resumes someone else's conversation. No activity and no
+    // text: nothing here is the model speaking.
+    case 'thread.started':
+      return { activity: null, text: '', threadId: String(ev.thread_id ?? '') || null };
     case 'item.completed': {
       const item = ev.item ?? {};
       const activity = humanizeCodexItem(item, cwd);
@@ -165,7 +175,7 @@ function parseCodexLine(line, cwd) {
         text: `${ev.message ?? ''}\n`,
       };
     default:
-      return null; // thread.started / turn.started / item.started / item.updated
+      return null; // turn.started / item.started / item.updated
   }
 }
 
@@ -380,14 +390,22 @@ export const RUNTIMES = {
      * placed before it. Appending them after the positional is the kind of argv
      * that parses today and stops parsing on some future clap upgrade.
      */
-    args({ prompt, system, model, effort, resume, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
-      // Adoption resumes a CLAUDE terminal session — its transcript store, its
-      // fork semantics. Reaching here with an adopt id is a wiring mistake
-      // upstream, and it fails loudly on purpose: quietly dropping the flag
-      // would answer that session's held context with a different brain.
-      if (adoptResumeId) throw new Error('adoption is Claude-only — codex cannot resume a Claude terminal session');
+    args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
+      // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
+      // agy moves) — codex has no adoptable store wired yet. Reaching here
+      // with an adopt id is a wiring mistake upstream, and it fails loudly on
+      // purpose: quietly dropping the flag would answer that session's held
+      // context with a different brain.
+      if (adoptResumeId) throw new Error("codex has no adoptable terminal store — an adopt id can't reach this builder");
       const a = ['exec'];
-      if (resume) a.push('resume', '--last');
+      // BY ID when the caller knows WHICH conversation this is — a Workbench
+      // tab's held context, captured off thread.started and stored with its
+      // worktree. `--last` resumes the machine's most recent codex conversation,
+      // which is only safe on the dispatch path (one lane, one turn at a time,
+      // in its own worktree); for a session it is a machine-global guess that
+      // two tabs — or a tab plus a dispatch — would cross-resume.
+      if (resumeThreadId) a.push('resume', resumeThreadId);
+      else if (resume) a.push('resume', '--last');
       a.push('--json');
       if (model) a.push('--model', model);
       // Effort is a config value on Codex rather than a flag.
@@ -624,12 +642,18 @@ export const RUNTIMES = {
      */
     profiles: ['build', 'wiki', 'consult'],
     mcp: null,
-    args({ prompt, system, model, effort, resume, profile = 'build', vaultDir, resultSchemaArgs = [], adoptResumeId }) {
-      // Same loud refusal as Codex: an adopt id names a Claude session, and no
-      // other runtime can resume one — see the claude builder for the contract.
-      if (adoptResumeId) throw new Error('adoption is Claude-only — agy cannot resume a Claude terminal session');
+    args({ prompt, system, model, effort, resume, resumeConversationId, profile = 'build', vaultDir, resultSchemaArgs = [], adoptResumeId }) {
       const a = [];
-      if (resume) a.push('--continue');
+      // WHICH CONVERSATION IS THIS — one decision, answered one way (the same
+      // rule as Claude's --resume/--continue). By id when the caller knows:
+      // `--conversation <id>` resumes globally, any cwd (measured on 1.1.12).
+      // Adoption is the SAME argv because agy has no fork — the id in the db
+      // is the identity (a renamed copy fails "trajectory not found",
+      // measured), so adopting MOVES the conversation: the tab continues the
+      // terminal session itself, appending to its one store. `--continue` is
+      // the cwd-keyed fallback for a session whose id was never learned.
+      if (adoptResumeId || resumeConversationId) a.push('--conversation', adoptResumeId || resumeConversationId);
+      else if (resume) a.push('--continue');
       // No system-prompt flag, same weakening as Codex: the contract rides in
       // the prompt, fenced and first.
       a.push('-p', `${system}\n\n---\n\n${prompt}`);

package/bin/lib/work.mjs

@@ -1,7 +1,8 @@
 /**
  * Work sessions — the Workbench tabs, daemon side.
  *
- * A tab is a held Claude session with BUILD permissions in a PERSISTENT
+ * A tab is a held coding-CLI session (Claude or codex — the server names the
+ * brain per tab, and the pin holds it) with BUILD permissions in a PERSISTENT
  * worktree on its own `session/<id>` branch. Nothing here is detached and
  * nothing is ever reset — uncommitted state between turns IS the session, and
  * blowing it away would be closing the human's editor mid-thought. (Plan
@@ -33,10 +34,16 @@ import { FLEET_URL, FLEET_TOKEN, USER_AGENT, REFRESH_BEFORE_SECONDS } from './co
 import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
-import { SYSTEM_WORK, WORK_TURN_KICKOFF } from './prompts.mjs';
+import {
+  SYSTEM_WORK,
+  WORK_TURN_KICKOFF,
+  SYSTEM_WORK_PLAIN,
+  WORK_TURN_KICKOFF_PLAIN,
+} from './prompts.mjs';
 import { materializeInto, scrub as envScrub } from './env.mjs';
 import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
-import { isTerminalSessionLive } from './localSessions.mjs';
+import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
+import { homedir } from 'node:os';
 
 export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
@@ -338,18 +345,31 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * same reason). If the pinned CLI has left the machine, the turn settles
    * honestly instead of substituting. A retired-and-reattached directory has
    * no marker and no held context either, so re-picking there is correct.
+   *
+   * THE SERVER'S WORD COMES FIRST. A tab is created AS a runtime's tab
+   * (`job.runtime`; null/absent = Claude, which is what every tab ran on until
+   * now), so on the first turn a named runtime IS the pick — never a
+   * preference the machine may override. And a named runtime that DISAGREES
+   * with an existing pin is an identity change mid-life: something upstream
+   * now calls this tab a different brain's, and the only honest move is to
+   * settle the turn and say so ({ mismatch }), because a held context must
+   * never be answered by a different brain.
+   *
    * Returns { id } | { id: null } (nothing installed) | { missing: label } |
-   * { unsupported: label } (pinned to a runtime no session can run on).
+   * { unsupported: label } (a runtime no session can run on) |
+   * { mismatch: { pin, runtime } } (labels, for the caller's sentence).
    *
-   * SESSION-CAPABLE means rt.mcp is truthy, and the gate is not optional:
-   * a session turn hands its per-session token over a real MCP config, so
-   * `pickRuntimeFor('build')` is the WRONG question here — it also says yes
-   * to the MEDIATED build path (Antigravity, mcp: null), and a session pinned
-   * that way threw in mcpFor on every turn, failing the tab with an internal
-   * error instead of a sentence.
+   * SESSION-CAPABLE means rt.mcp is truthy — the session tools ride a real
+   * per-invocation MCP config — OR the runtime runs tabs PLAIN (Antigravity):
+   * no MCP at all, no cards, no streaming; the final answer is delivered by
+   * the daemon's own report and ship-time reconciliation keeps the ledger
+   * whole. `pickRuntimeFor('build')` is still the WRONG question here — it
+   * says yes to the mediated DISPATCH path without saying how a tab would
+   * speak, and a session pinned by it once threw in mcpFor on every turn.
    */
-  const sessionCapable = (rid) => Boolean(RUNTIMES[rid]?.mcp) && canRun(RUNTIMES[rid], 'build');
-  const sessionRuntime = (wt) => {
+  const sessionCapable = (rid) =>
+    (Boolean(RUNTIMES[rid]?.mcp) || rid === 'antigravity') && canRun(RUNTIMES[rid], 'build');
+  const sessionRuntime = (wt, jobRuntime) => {
     const marker = sessionMetaPath(wt, 'flowviant-runtime');
     let pinned = null;
     if (marker && existsSync(marker)) {
@@ -360,6 +380,14 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       }
     }
     if (pinned && RUNTIMES[pinned]) {
+      if (jobRuntime && jobRuntime !== pinned) {
+        return {
+          mismatch: {
+            pin: RUNTIMES[pinned].label || pinned,
+            runtime: RUNTIMES[jobRuntime]?.label || jobRuntime,
+          },
+        };
+      }
       // A pin that names a non-session-capable runtime is settled honestly by
       // the caller, not silently re-picked: re-picking would hand the held
       // context to a different brain, which is the exact substitution the pin
@@ -368,10 +396,33 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       const installed = detectRuntimes().find((r) => r.id === pinned)?.installed;
       return installed ? { id: pinned } : { missing: RUNTIMES[pinned].label || pinned };
     }
-    // The fresh pick, gated the same way — Claude first when it qualifies, for
-    // the reason pickRuntimeFor gives: the prompts were tuned against it.
+    // First turn, and the server named the brain: that IS the pick, gated the
+    // same two ways as a pin — not session-capable and not installed both
+    // settle honestly via the caller's existing paths, never substituted.
+    if (jobRuntime) {
+      if (!sessionCapable(jobRuntime))
+        return { unsupported: RUNTIMES[jobRuntime]?.label || jobRuntime };
+      const installed = detectRuntimes().find((r) => r.id === jobRuntime)?.installed;
+      if (!installed) return { missing: RUNTIMES[jobRuntime]?.label || jobRuntime };
+      if (marker) {
+        try {
+          writeFileSync(marker, jobRuntime);
+        } catch {
+          /* best-effort — an unpinnable session just re-picks next turn */
+        }
+      }
+      return { id: jobRuntime };
+    }
+    // The fresh pick — Claude first when it qualifies, for the reason
+    // pickRuntimeFor gives: the prompts were tuned against it. DELIBERATELY
+    // NARROWER than sessionCapable: a PLAIN tab (Antigravity — no cards, no
+    // streaming) is a degraded mode someone CHOOSES, so it is honored only
+    // when the server names it, never handed out as a default.
     const rows = detectRuntimes();
-    const okFor = (rid) => sessionCapable(rid) && Boolean(rows.find((r) => r.id === rid)?.installed);
+    const okFor = (rid) =>
+      Boolean(RUNTIMES[rid]?.mcp) &&
+      sessionCapable(rid) &&
+      Boolean(rows.find((r) => r.id === rid)?.installed);
     const id = okFor('claude') ? 'claude' : (Object.keys(RUNTIMES).find(okFor) ?? null);
     if (!id) return { id: null };
     if (marker) {
@@ -384,6 +435,51 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     return { id };
   };
 
+  /**
+   * The shape a codex thread id must have before it is written to disk or —
+   * decisive — pushed into argv as `resume <id>`. Conservative on purpose:
+   * alphanumeric plus dash/underscore, never a leading dash (an argv that
+   * parses as a flag), never whitespace. Anything else is dropped and the
+   * session simply runs fresh in its own worktree.
+   */
+  const CODEX_THREAD_RE = /^[0-9a-zA-Z][0-9a-zA-Z_-]{7,63}$/;
+
+  /** agy conversation ids are plain UUIDs (the db filename IS the identity —
+   *  measured: a renamed copy fails "trajectory not found"). Guarded the same
+   *  way as the codex id: it rides in argv as `--conversation <id>`. */
+  const AGY_CONV_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+  /** agy's own cwd registry — {cwd → the conversation that ran there LAST}.
+   *  Read once, right after a fresh agy turn, to learn the id the turn just
+   *  created; from then on the tab's marker is the identity and this registry
+   *  is never consulted again (a dispatch sharing the machine may overwrite
+   *  the cwd's entry between turns). */
+  const agyRegistryLookup = (cwd) => {
+    try {
+      const raw = readFileSync(
+        join(homedir(), '.gemini', 'antigravity-cli', 'cache', 'last_conversations.json'),
+        'utf8'
+      );
+      const map = JSON.parse(raw);
+      if (!map || typeof map !== 'object') return null;
+      // agy keys by the cwd as IT resolved it — try our literal path and its
+      // realpath, so a symlinked home doesn't orphan the lookup.
+      let keys = [cwd];
+      try {
+        keys.push(realpathSync(cwd));
+      } catch {
+        /* the literal alone, then */
+      }
+      for (const k of keys) {
+        const id = map[k];
+        if (typeof id === 'string' && AGY_CONV_RE.test(id)) return id;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  };
+
   /**
    * The spawn lock: the pid of the CLI currently live in this worktree. A
    * restarted daemon must not put a second Claude into a directory the orphan
@@ -509,18 +605,6 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           note(
             `${c.cyan('tab')} ${c.dim(`— ${job.askedByName || 'the owner'} in "${job.sessionName || 'a session'}"`)}`
           );
-          // WHICH BRAIN the roster says this tab speaks (null/absent = Claude,
-          // which is what every tab ran on until now). The phase-2 hook: this
-          // daemon drives Claude tabs only, and a runtime it cannot honor is
-          // settled honestly — never answered by a different brain wearing the
-          // session's name.
-          if (job.runtime && job.runtime !== 'claude') {
-            await settleWorkTurn(job.id, {
-              ok: false,
-              answer: `This machine's daemon serves Claude tabs only for now — runtime '${job.runtime}' isn't supported yet.`,
-            });
-            return;
-          }
           // ── ADOPTION: a tab born from a TERMINAL session ────────────────
           // The server sends `adopt {id, cwd}` only while the session has no
           // sessionRef — no turn has ever spoken from a worktree here — and
@@ -600,7 +684,16 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
               });
               return;
             }
-            if (isTerminalSessionLive(job.adopt.id)) {
+            // Liveness by the SESSION's own runtime: Claude has a real pid
+            // registry; agy only leaves store-write recency + a process check,
+            // and adoption there is a MOVE (no fork exists), so the composite
+            // errs toward refusing — a false "live" costs a retry in minutes,
+            // a false "ended" puts two drivers on one conversation store.
+            const adoptLive =
+              job.runtime === 'antigravity'
+                ? isAgyConversationLive(job.adopt.id)
+                : isTerminalSessionLive(job.adopt.id);
+            if (adoptLive) {
               await settleWorkTurn(job.id, {
                 ok: false,
                 answer:
@@ -632,7 +725,20 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             );
             return;
           }
-          const rt = sessionRuntime(dir.wt);
+          // WHICH BRAIN the roster says this tab speaks (null/absent = Claude,
+          // which is what every tab ran on until now) — honored by
+          // sessionRuntime: on a first turn a named runtime IS the pick, and a
+          // named runtime that disagrees with the pin settles below.
+          const rt = sessionRuntime(dir.wt, job.runtime || null);
+          if (rt.mismatch) {
+            // Something upstream changed this tab's identity mid-life. A held
+            // context must never be answered by a different brain — say so.
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: `this tab is pinned to ${rt.mismatch.pin} but the server says it is a ${rt.mismatch.runtime} tab — reopen a new tab`,
+            });
+            return;
+          }
           if (rt.missing) {
             await settleWorkTurn(job.id, {
               ok: false,
@@ -641,13 +747,14 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             return;
           }
           if (rt.unsupported) {
-            // A pin from before the session-capable gate existed can name a
-            // runtime no tab can run on (Antigravity has no MCP config, and
-            // the session's whole control plane rides one). An honest sentence
-            // beats the mcpFor throw this used to crash into every turn.
+            // A pin from before the session-capable gate existed — or a
+            // first-turn tab the server named for one — can carry a runtime no
+            // tab can run on (Antigravity has no MCP config, and the session's
+            // whole control plane rides one). An honest sentence beats the
+            // mcpFor throw this used to crash into every turn.
             await settleWorkTurn(job.id, {
               ok: false,
-              answer: `this session is pinned to ${rt.unsupported}, which cannot drive a Workbench tab on this machine — open a new tab`,
+              answer: `this session runs on ${rt.unsupported}, which cannot drive a Workbench tab on this machine — open a new tab`,
             });
             return;
           }
@@ -659,41 +766,102 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             });
             return;
           }
-          if (adopting && rt.id !== 'claude') {
-            // The adopt id names a CLAUDE conversation; only claude can fork
-            // it (--resume --fork-session). The runtimes registry backstops
-            // this with a loud throw, but a sentence here beats a stack there.
+          if (adopting && rt.id !== 'claude' && rt.id !== 'antigravity') {
+            // An adopt id names a conversation in ITS OWN CLI's store: claude
+            // forks it (--resume --fork-session), agy moves it
+            // (--conversation). Codex has no adoptable store yet, and its
+            // args builder backstops this with a loud throw — but a sentence
+            // here beats a stack there.
             await settleWorkTurn(job.id, {
               ok: false,
               answer:
-                'adopting a terminal session needs Claude Code on the machine — install it, then try again',
+                'adopting this terminal session needs its own CLI on the machine — install it, then try again',
             });
             return;
           }
-          let mint = await mintWorkToken(job.sessionId);
-          if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
-          if (mint?.gone) {
-            await settleWorkTurn(job.id, {
-              ok: false,
-              answer:
-                'Flowviant no longer offers this session to this machine — the tab may have been closed or moved',
-            });
-            return;
+          // A PLAIN tab (agy) mounts no MCP: no credential to mint, no config
+          // to write. The trade is stated in SYSTEM_WORK_PLAIN — no cards, no
+          // streaming — and the honesty survives on the existing rails: the
+          // answer lands via work-turn-done, the rail says "no card yet", and
+          // ship-time reconciliation books every branch commit.
+          const plainTab = rt.id === 'antigravity';
+          let mint = null;
+          if (!plainTab) {
+            mint = await mintWorkToken(job.sessionId);
+            if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
+            if (mint?.gone) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  'Flowviant no longer offers this session to this machine — the tab may have been closed or moved',
+              });
+              return;
+            }
+            if (!mint?.token) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  'the machine could not mint a session credential from Flowviant — check its connection, then send the message again',
+              });
+              return;
+            }
           }
-          if (!mint?.token) {
-            await settleWorkTurn(job.id, {
-              ok: false,
-              answer:
-                'the machine could not mint a session credential from Flowviant — check its connection, then send the message again',
-            });
-            return;
+          // CODEX RESUMES BY THREAD ID, never by `--last`: `resume --last` is
+          // the MACHINE's most recent codex conversation, and two codex tabs —
+          // or a tab plus a codex dispatch — would cross-resume each other's
+          // context. The id was captured off thread.started (runtimes.mjs) and
+          // persisted below, beside the runtime pin; absent, the turn runs
+          // FRESH in the same worktree — the dirty state is most of the held
+          // context, and a machine-global guess is someone else's conversation.
+          let codexResumeId = null;
+          if (rt.id === 'codex') {
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            if (threadMarker && existsSync(threadMarker)) {
+              try {
+                const v = readFileSync(threadMarker, 'utf8').trim();
+                if (CODEX_THREAD_RE.test(v)) codexResumeId = v;
+              } catch {
+                /* unreadable marker — run fresh */
+              }
+            }
+          }
+          // AGY RESUMES BY CONVERSATION ID, learned once and pinned beside the
+          // runtime marker: an adopted tab knows it from the adopt hint; a new
+          // tab learns it from agy's own cwd registry after its first turn.
+          // The marker beats `--continue` because it is the tab's OWN identity
+          // — the registry maps a cwd to whatever ran there LAST, and a
+          // dispatch sharing the machine could overwrite that between turns.
+          let agyConvId = null;
+          if (rt.id === 'antigravity' && !adopting) {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            if (convMarker && existsSync(convMarker)) {
+              try {
+                const v = readFileSync(convMarker, 'utf8').trim();
+                if (AGY_CONV_RE.test(v)) agyConvId = v;
+              } catch {
+                /* unreadable marker — run fresh */
+              }
+            }
           }
-          // Resume iff a conversation is known to live in THIS directory: the
-          // server's sessionRef is only ever a path some turn actually SPOKE
-          // from (see the settle below), and it must match the directory we
-          // just opened. Anything else starts fresh IN the existing worktree —
-          // never a reset; the dirty state is the session.
-          const resume = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
+          // Resume iff a conversation is known to live in THIS directory. For
+          // Claude that proof is the server's sessionRef — only ever a path
+          // some turn actually SPOKE from (see the settle below), and it must
+          // match the directory we just opened. For codex it is the stored
+          // thread id, which lives IN the directory and is stronger. Anything
+          // else starts fresh IN the existing worktree — never a reset; the
+          // dirty state is the session.
+          // agy layers its two resumes: the pinned conversation id when the
+          // marker exists (deterministic, registry-proof), else the Claude
+          // rule — a tab that has SPOKEN from this directory may `--continue`
+          // it (cwd-keyed; measured safe), so a lost marker degrades to the
+          // weaker resume instead of silently starting over.
+          const spokeHere = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
+          const resume =
+            rt.id === 'codex'
+              ? Boolean(codexResumeId)
+              : rt.id === 'antigravity'
+                ? Boolean(agyConvId) || spokeHere
+                : spokeHere;
           // The dirty carry, on the adopt worktree's FIRST life only: a
           // re-attempted adoption (the directory already exists) carried what
           // it could the first time, and re-applying would double it. A carry
@@ -701,31 +869,50 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           // in the prompt, so the AGENT tells the user what stayed behind.
           let carryNote = '';
           if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt);
-          const mcp = mcpFor(rt.id, mint.token, getMcpUrl());
+          const mcp = plainTab
+            ? { args: [], env: null, dir: null }
+            : mcpFor(rt.id, mint.token, getMcpUrl());
           // Attempts count RUNS: the infra refusals above consumed nothing and
           // settled on their own terms.
           workAttempts.set(job.id, tries + 1);
           let out;
+          let seenThreadId = null; // codex's conversation id, off thread.started
           const spawned = []; // this turn's children, for the teardown registry
           try {
+            const message = carryNote ? `${job.body}\n\n${carryNote}` : job.body;
             const turnArgs = {
-              prompt: WORK_TURN_KICKOFF({
-                sessionId: job.sessionId,
-                sessionName: job.sessionName,
-                message: carryNote ? `${job.body}\n\n${carryNote}` : job.body,
-                askedByName: job.askedByName,
-              }),
+              // A plain tab has no tools to name and no session id to pass —
+              // its kickoff asks for one complete report instead of a stream.
+              prompt: plainTab
+                ? WORK_TURN_KICKOFF_PLAIN({
+                    sessionName: job.sessionName,
+                    message,
+                    askedByName: job.askedByName,
+                  })
+                : WORK_TURN_KICKOFF({
+                    sessionId: job.sessionId,
+                    sessionName: job.sessionName,
+                    message,
+                    askedByName: job.askedByName,
+                  }),
               // The adopt turn resumes the TERMINAL conversation by forking it
               // into this cwd (claude: --resume <id> --fork-session). After it
               // speaks once, the fork lives natively here and turn 2+ is the
               // ordinary --continue resume path, unchanged.
               ...(adopting ? { adoptResumeId: job.adopt.id } : {}),
-              system: SYSTEM_WORK,
+              system: plainTab ? SYSTEM_WORK_PLAIN : SYSTEM_WORK,
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,
               runtime: rt.id,
               label: c.cyan('[tab]'),
+              // Only codex announces one (thread.started); held here so the id
+              // this turn actually SPOKE under is what gets persisted after it
+              // ends. Last write wins on purpose: a failed resume that fell
+              // back to fresh reports the fresh run's id, healing the marker.
+              onThreadId: (id) => {
+                seenThreadId = String(id ?? '').trim() || seenThreadId;
+              },
               onSpawn: (ch) => {
                 if (!ch) return;
                 spawned.push(ch);
@@ -739,15 +926,23 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
                 }
               },
             };
-            out = await runTurn({ ...turnArgs, resume });
+            out = await runTurn({
+              ...turnArgs,
+              resume,
+              resumeThreadId: codexResumeId || undefined,
+              resumeConversationId: agyConvId || undefined,
+            });
             // A resume that produced NOTHING usually means the held
             // conversation is gone (a first turn that crashed before writing
-            // state, a wiped CLI dir). Retry once fresh in the SAME worktree —
-            // never reset — instead of bricking the tab forever. NEVER on an
-            // adopt turn (`resume` is structurally false there, and the guard
-            // says so out loud): a fresh conversation would silently discard
-            // the adoption and answer as a new session wearing its name — the
-            // empty adopt turn settles failed below instead.
+            // state, a wiped CLI dir — or, on codex, a deleted thread). Retry
+            // once fresh in the SAME worktree — never reset — instead of
+            // bricking the tab forever; the retry carries no resumeThreadId,
+            // so codex genuinely starts over rather than re-asking for the
+            // thread that just came back empty. NEVER on an adopt turn
+            // (`resume` is structurally false there, and the guard says so out
+            // loud): a fresh conversation would silently discard the adoption
+            // and answer as a new session wearing its name — the empty adopt
+            // turn settles failed below instead.
             if (!adopting && resume && !(out || '').trim())
               out = await runTurn({ ...turnArgs, resume: false });
           } finally {
@@ -761,6 +956,21 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             }
             if (mcp.dir) rmSync(mcp.dir, { recursive: true, force: true });
           }
+          // Persist the codex thread id AFTER the turn ends, so the next turn
+          // resumes exactly the conversation that just spoke. Shape-guarded
+          // before it ever touches disk — it later rides in argv as
+          // `resume <id>` — and best-effort, like the runtime pin: an
+          // unwritable marker just means the tab runs fresh next turn.
+          if (rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            if (threadMarker) {
+              try {
+                writeFileSync(threadMarker, seenThreadId);
+              } catch {
+                /* best-effort */
+              }
+            }
+          }
           const answer = (out || '').trim();
           // No output at all smells like a dead MCP credential (the lane
           // workers' no-sentinel case) — drop the cached token so the next
@@ -778,6 +988,24 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             warn('adopt turn produced no output — settled as failed');
             return;
           }
+          // Persist the agy conversation id once the turn actually SPOKE — an
+          // adopted tab pins the id it moved in (the adopt hint); a new tab
+          // learns the one its first fresh turn just created, from agy's own
+          // cwd registry. From here on the marker is the tab's identity and
+          // the registry is never trusted again.
+          if (rt.id === 'antigravity' && answer.length > 0) {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            if (convMarker && !existsSync(convMarker)) {
+              const learned = adopting ? job.adopt.id : agyRegistryLookup(dir.wt);
+              if (learned && AGY_CONV_RE.test(learned)) {
+                try {
+                  writeFileSync(convMarker, learned);
+                } catch {
+                  /* best-effort — an unpinned tab resumes via --continue's cwd key */
+                }
+              }
+            }
+          }
           await settleWorkTurn(job.id, {
             ok: answer.length > 0,
             answer:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "Run your own coding CLIs as headless build agents for Flowviant — Claude Code or Codex, on your own credentials. Claims dispatched work, opens PRs, captures review evidence, and routes questions back to you.",
   "type": "module",
   "bin": {