flowviant 0.95.0 → 0.97.0

package/README.md

@@ -54,7 +54,7 @@ Launch with `@latest` so each start pulls the newest published version — a bar
 
 ## Machines on this box
 
-One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not: every `npx flowviant` in that directory has to ask which of them to serve.
+One box can serve several projects — one daemon per repository directory, each connected with its own `flowviant login` run inside that repo. `flowviant machines` lists every project connected on this box with the id and date it was connected, and under each one every computer that has polled it (the app's Home lists the same across your whole account). Two projects bound to one repository are named out loud at the foot of the listing, because that is the one shape that reads as "the same project connected twice" and is not — and a directory serves one project, so `npx flowviant` there refuses to start until one of them goes.
 
 On a terminal the listing is a menu: ↑/↓ over the projects, enter for what you can do about one, esc to leave. Two verbs, each acting on **this box's own connection** and nothing else:
 
@@ -63,7 +63,7 @@ On a terminal the listing is a menu: ↑/↓ over the projects, enter for what y
 
 Stopping or removing a daemon on **another** computer is done in the app (project settings → Machines), where the person pressing it can see what they are changing.
 
-`flowviant login` asks before it binds a second project to a repository that is already connected to one: keep both (every start there asks which to serve), replace (the repo serves the new project and this box is disconnected from the old one), or cancel.
+**A directory serves one project.** `flowviant login` refuses to bind a second project to a repository that is already connected to one, and a store that already holds two projects for one repository refuses to start there — both name the projects and the remedy: delete the project you do not mean in Flowviant (project settings → General → Delete project), or disconnect this box from it with `flowviant machines`, then try again.
 
 ## Sessions
 

package/bin/cli.mjs

@@ -46,7 +46,10 @@
  * a daemon on another computer is invisible from here; since 0.95.0 it says
  * out loud when two projects are bound to one repo, and on a terminal it is a
  * menu (↑/↓, enter) whose verbs disconnect THIS box from a project or forget
- * a credential here — `--remove <id>` / `--forget <id>` for a script.
+ * a credential here — `--remove <id>` / `--forget <id>` for a script. A
+ * DIRECTORY SERVES ONE PROJECT: login refuses to bind a second project to a
+ * repo, and a store that already holds two for one repo refuses to start
+ * until one is deleted in the app or disconnected here.
  *
  * Env:
  *   FLOWVIANT_MACHINE_TOKEN  the machine credential (or use `flowviant login`);
@@ -89,7 +92,8 @@ if (process.argv[2] === 'login') {
   // A login the person CANCELLED at the second-project question saved nothing,
   // so there is no credential for the child to serve — starting it would end
   // in "no credential found" over a choice they just made on purpose.
-  if (noStart || !login?.saved) process.exit(0);
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
+  if (noStart) process.exit(0);
   // Re-exec as a plain `flowviant` rather than falling through. config.mjs reads
   // the credential at IMPORT time — which was before the login we just did — so
   // this process still has an empty FLEET_TOKEN and would exit with "no
@@ -460,7 +464,7 @@ const externalToken =
  *  existed, so this process cannot serve; the child can. */
 async function reexecAfterLogin() {
   const login = await runLogin({ thenStart: false });
-  if (!login?.saved) process.exit(0); // cancelled at the second-project question — nothing to serve
+  if (!login?.saved) process.exit(1); // refused: the directory already serves another project
   const { spawn } = await import('node:child_process');
   const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
   process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
@@ -470,7 +474,9 @@ async function reexecAfterLogin() {
 // the connected date to the COLLIDING rows only — production held two projects
 // both called "BRIF AI", both bound to the same checkout, so this picker
 // offered two identical lines and the only way to answer was to guess. See
-// credentials.mjs for why the suffix is not on every row.
+// credentials.mjs for why the suffix is not on every row. (That exact case is
+// a refusal now rather than a picker — a directory serves one project — but
+// two same-named projects can still meet in the no-match picker.)
 function listLines(entries, { projectRowLabel }) {
   return entries
     .map(
@@ -486,6 +492,20 @@ if (!FLEET_TOKEN) {
     console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
     process.exit(1);
   }
+  // A DIRECTORY SERVES ONE PROJECT (2026-09-23, the owner, verbatim: "a
+  // directory cannot have more than one project on flowviant. if one already
+  // exists, it would warn the user and ask them to delete the project on
+  // flowviant first. because 2 projects shouldnt be able to edit a directory
+  // at the same time."). This used to be a PICKER — two projects bound to one
+  // checkout, choose which this daemon serves — which is a control offering to
+  // do the forbidden thing politely. It is a refusal now, on a TTY and
+  // headless alike, naming both projects and the remedy. `credentialRefusal`
+  // is the same sentence login prints when it declines to bind a second one.
+  if (CREDENTIAL.reason === 'multiple-bound') {
+    const { directoryTakenRefusal } = await import('./lib/credentials.mjs');
+    console.error(directoryTakenRefusal(CREDENTIAL.choices, CREDENTIAL.repoRoot));
+    process.exit(1);
+  }
   if (CREDENTIAL.choices?.length && interactive) {
     const creds = await import('./lib/credentials.mjs');
     const { originSlug } = await import('./lib/git.mjs');
@@ -494,9 +514,7 @@ if (!FLEET_TOKEN) {
     console.log(
       CREDENTIAL.reason === 'outside-repo'
         ? 'flowviant is not inside a git repo, and more than one project is connected here.'
-        : CREDENTIAL.reason === 'multiple-bound'
-          ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
-          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+        : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
     );
 
     const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`;
@@ -505,16 +523,13 @@ if (!FLEET_TOKEN) {
     // this only decides which row the cursor starts on, using the repo's folder
     // name and its github repo-name against the stored project names. A unique
     // match becomes ONE keypress; a wrong guess costs nothing, because the human
-    // still confirms. `multiple-bound` gets no hint — every choice already names
-    // this repo, so nothing distinguishes them.
+    // still confirms. (Two projects bound to THIS repo never reach here: that
+    // is a refusal above, since 2026-09-23.)
     const slug = repoRoot ? originSlug(repoRoot) : null;
-    const likely =
-      CREDENTIAL.reason === 'multiple-bound'
-        ? -1
-        : creds.likelyChoiceIndex(choices, {
-            repoBasename: repoRoot ? basename(repoRoot) : null,
-            repoSlugName: slug ? slug.split('/')[1] : null,
-          });
+    const likely = creds.likelyChoiceIndex(choices, {
+      repoBasename: repoRoot ? basename(repoRoot) : null,
+      repoSlugName: slug ? slug.split('/')[1] : null,
+    });
 
     // Bounded like the confirm below, and for the same reason — but silence
     // means something DIFFERENT here and the difference is load-bearing. There

package/bin/lib/artifacts.mjs

@@ -37,13 +37,27 @@
  * this is somebody's disk and one place checking is one deploy from zero) are
  * reported BY NAME and never read. Over `ARTIFACT_MAX_BYTES` likewise.
  *
- * ── TEXT IS SCRUBBED ──
+ * ── TEXT IS SCRUBBED; A BINARY CARRYING A SECRET IS WITHHELD ──
  *
  * html, md, svg, json, csv and txt pass through `envScrub` before upload — the
  * turn trace's own scrub, for the trace's own reason: a page the agent wrote
  * can quote a value out of the checkout's `.env`, and an artifact is served to
- * a browser. Binary images are not scrubbed (there is no text to match), and
- * the SERVER computes the sha256 of what it stored; the one sent here is for
+ * a browser.
+ *
+ * The binary types CAN carry text, and this header used to say they could
+ * not. A PNG has tEXt chunks, a PDF has streams that are often stored
+ * uncompressed, a docx/pptx/xlsx is a zip whose entries may be STORED rather
+ * than deflated — and a turn that can write a file can write a secret into
+ * any of them. What they cannot be is REWRITTEN: `envScrub` swapping bytes
+ * inside one corrupts it, and a corrupted binary served as the thing the agent
+ * made is worse than none. So each binary is checked against the same scrub
+ * list as exact byte substrings (`secretIn`, env.mjs) before it is uploaded,
+ * and a hit SKIPS the file with a warn line naming it and the variable — never
+ * a redacted copy, never a by-name row the page would draw as a file it merely
+ * could not show. STATED: a value inside a deflated stream is not a substring
+ * of the file, so this catches what is stored plainly and nothing more.
+ *
+ * The SERVER computes the sha256 of what it stored; the one sent here is for
  * the log.
  *
  * ── DELIVERY ──
@@ -91,6 +105,15 @@ export const ARTIFACT_TYPES = {
   json: { mime: 'application/json', text: true },
   csv: { mime: 'text/csv', text: true },
   txt: { mime: 'text/plain', text: true },
+  // DOCUMENTS (0.97.0): a Word file, a deck, a sheet or a PDF — what the
+  // machine's docx/pptx/xlsx/pdf skills write. Binary, so never REWRITTEN (a
+  // scrub inside a zip or a PDF corrupts it) but checked for a known secret's
+  // bytes and withheld on a hit — see the header. Under the same cap. The app
+  // offers the first three as a download and frames the PDF.
+  docx: { mime: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', text: false },
+  pptx: { mime: 'application/vnd.openxmlformats-officedocument.presentationml.presentation', text: false },
+  xlsx: { mime: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', text: false },
+  pdf: { mime: 'application/pdf', text: false },
 };
 
 export function artifactTypeFor(name) {
@@ -182,7 +205,7 @@ function readNoFollow(path, limit) {
  * re-sent exactly as it was first built (scrubbed once, never re-read from a
  * disk the agent may have changed since).
  */
-export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s) {
+export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s, secretIn = () => null) {
   const type = artifactTypeFor(entry.name);
   const fields = {
     ...(sessionId ? { sessionId } : { agentId }),
@@ -199,7 +222,11 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
     return null; // vanished, or a symlink swapped in: nothing to say
   }
   if (!bytes) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
-  if (type.text) {
+  if (!type.text) {
+    // A binary is never rewritten; one carrying a known secret is not sent.
+    const secret = secretIn(bytes);
+    if (secret) return { withheld: secret, fields };
+  } else {
     bytes = Buffer.from(String(scrub(bytes.toString('utf8'))), 'utf8');
     // A redaction marker can be longer than the value it replaced.
     if (bytes.byteLength > ARTIFACT_MAX_BYTES) {
@@ -222,7 +249,7 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
  * finished turn and never awaited by the turn (a slow uplink must not hold the
  * next turn behind a readout); `retryPending` rides the settle retry beat.
  */
-export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetchImpl, log = () => {} }) {
+export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secretIn, fetchImpl, log = () => {} }) {
   const url = String(fleetUrl).replace(/\/agents\/?$/, '/artifact');
   const doFetch = fetchImpl ?? ((...a) => fetch(...a));
   const pending = new Map(); // `${owner}:${name}` -> { body, tries }
@@ -284,8 +311,12 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetc
     const changed = changedArtifacts(before, scanArtifacts(placeDir));
     let n = 0;
     for (const entry of changed) {
-      const body = buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub);
+      const body = buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub, secretIn);
       if (!body) continue;
+      if (body.withheld) {
+        log(`artifact ${entry.name}: not uploaded — it contains the value of ${body.withheld} from this machine's environment`);
+        continue;
+      }
       const key = `${sessionId ?? agentId}:${entry.name}`;
       pending.delete(key); // this copy supersedes a held older one
       await send(key, body, 0);

package/bin/lib/claude.mjs

@@ -12,6 +12,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { SAFE } from './config.mjs';
 import { runtimeById, humanizeClaudeTool, THINK_MARKER } from './runtimes.mjs';
 
@@ -20,6 +21,46 @@ import { runtimeById, humanizeClaudeTool, THINK_MARKER } from './runtimes.mjs';
 // the strings live.
 export * from './prompts.mjs';
 
+/**
+ * THE READ GUARD, ON EVERY CURATED POSTURE (2026-09-23) — see
+ * hooks/readGuard.mjs for what it refuses and the probe that proved it fires.
+ *
+ * A `Bash(git log:*)` allow is a PREFIX: it names the program and says nothing
+ * about the arguments, and `git log --output=<path>` writes any file while
+ * `-c core.fsmonitor=…` / `--ext-diff` run a program. A reviewer landed
+ * `git log -1 --format='tformat:x' --output=pwned.txt` under RESEARCH_PERM with
+ * no denial, and it re-measured the same way here. So every list below that
+ * promises "reads, and nothing else" carries a `PreToolUse` hook through
+ * `--settings`, measured on Claude Code 2.1.281: it fires under
+ * `--allowedTools`, exit 2 blocks the call, and its sentence reaches the model.
+ *
+ * NEVER ON THE BUILD POSTURE: `--dangerously-skip-permissions` is the
+ * operator's own choice for a turn that is meant to write, and a guard there
+ * would be refusing the job. Nor on PLAN_MODE_PERM, which is the CLI's own
+ * posture on the owner's own tab, not a list this file promises anything about.
+ *
+ * The hook runs as `<this node> <readGuard.mjs>` — the daemon's own
+ * `process.execPath`, never a `node` looked up on a PATH the operator may not
+ * have, because a hook that fails to START is a non-blocking error and the
+ * command runs anyway.
+ */
+export const READ_GUARD_PATH = fileURLToPath(new URL('./hooks/readGuard.mjs', import.meta.url));
+const hookQuote = (s) =>
+  process.platform === 'win32' ? `"${s}"` : `'${String(s).replace(/'/g, `'\\''`)}'`;
+export const READ_GUARD_SETTINGS = JSON.stringify({
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: 'Bash',
+        hooks: [{ type: 'command', command: `${hookQuote(process.execPath)} ${hookQuote(READ_GUARD_PATH)}` }],
+      },
+    ],
+  },
+});
+/** Spread FIRST into a curated list: `--allowedTools` is variadic, so the
+ *  `--settings` pair must stand before it or be swallowed as a tool name. */
+const READ_GUARD = ['--settings', READ_GUARD_SETTINGS];
+
 /**
  * PLAN — read the repo, write the plan, never the code.
  *
@@ -37,6 +78,7 @@ export * from './prompts.mjs';
  * touching.
  */
 const PLAN_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'mcp__flowviant',
   'Read',
@@ -81,6 +123,7 @@ const PERM = SAFE
 // after every wiki turn, and the vault has its own git history.
 // (Write/Edit can't be path-scoped here; the worktree reset is the backstop.)
 const WIKI_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'Read',
   'Grep',
@@ -112,6 +155,7 @@ const WIKI_PERM = [
 // "do not change anything" is only an instruction, and instructions are exactly
 // what an injected question competes with.
 const CONSULT_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'Read',
   'Grep',
@@ -126,6 +170,152 @@ const CONSULT_PERM = [
   'Bash(git rev-parse:*)',
 ];
 
+/**
+ * THE TWO NON-CODE POSTURES (0.97.0) — a design card and a research card may
+ * WRITE, and only under `.flowviant/artifacts/`.
+ *
+ * The card's words are steered by anyone who can file a card, so "change
+ * nothing" as prose is only an instruction, and the permission list is the
+ * enforcement. What each carries is the ONE write its contract needs:
+ *
+ *  · `Edit(.flowviant/artifacts/**)` — PROBED on Claude Code 2.1.281 before
+ *    relying on it (2026-09-23): with `--allowedTools 'Read'
+ *    'Edit(.flowviant/artifacts/**)'`, a `-p` turn told to write
+ *    `.flowviant/artifacts/a.html` AND `b.txt` at the root wrote the first and
+ *    was DENIED the second. The Edit rule governs every file-writing tool,
+ *    Write included. Spelled `Write(.flowviant/artifacts/**)` — or `./`- or
+ *    `//abs`-anchored — the same probe was denied BOTH files, so that spelling
+ *    is not a scoped write at all, it is no write. Relative to the turn's cwd,
+ *    which is the agent's own worktree, which is where the artifact scan looks.
+ *    `**` AND NOT `*`, measured the same day: `Edit(.flowviant/artifacts/*)`
+ *    let a Write to `.flowviant/artifacts/sub/b.html` through exactly as `**`
+ *    did, so the single-level spelling is not narrower on this CLI and would
+ *    only read as if it were. The scan keeps top-level files, so the
+ *    contracts say "no subfolders" — the prompt is the only thing that can.
+ *
+ * THEY ARE NOT THE SAME READER, and the difference is the network:
+ *
+ *  · DESIGN draws THIS product, so it reads the repo broadly — Read, Grep,
+ *    Glob and `ls` — and has no web at all (a mockup that went looking on the
+ *    web would be a mockup of somebody else's product). No git readers and no
+ *    cat/head/wc: Read covers every one of them, and each git reader was an
+ *    `--output` away from a write (see READ_GUARD, which it still carries for
+ *    the `ls` it keeps).
+ *  · RESEARCH has the web — WebSearch and WebFetch — and a turn that can both
+ *    read a secret and fetch a URL can send one. So its reading is FENCED to
+ *    what the card is about: `Read(./**)` (the worktree) plus the project's
+ *    knowledge library by its absolute path, `Glob(./**)` for names, NO Grep
+ *    (an unscoped search of the home directory prints matching lines), NO
+ *    Bash at all, and `.env*` DENIED by name. PROBED on 2.1.281, the whole
+ *    list with `--add-dir <knowledge>`: a file in the cwd read; `/etc/hostname`,
+ *    a sibling directory's file and `~/.flowviant/credentials.json` were each
+ *    refused ("Claude requested permissions to read from …, but you haven't
+ *    granted it yet"); `.env` was refused ("File is in a directory that is
+ *    denied by your permission settings"); the knowledge file read. Two
+ *    controls: WITHOUT the `--disallowedTools` pair, `Read(./**)` read `.env`
+ *    — the deny is load-bearing; and a bare `Glob` listed `~/.flowviant`
+ *    while `Glob(./**)` refused it and still listed the cwd and the added
+ *    directory. The knowledge `Read(//…)` rule is belt: `--add-dir` alone
+ *    admitted the file, and the rule keeps the read allowed should the
+ *    adapter ever stop passing that flag.
+ *    AND `Bash` IS DENIED BY NAME, because leaving it off the allow list is
+ *    not "no Bash": measured the same day, with Bash absent from
+ *    `--allowedTools` the CLI still ran `git log -1 --format=%s` and `ls` on
+ *    its own read-only classifier (it did refuse `git log … --output=…`,
+ *    "This command requires approval" — the reviewer's write needed the
+ *    explicit `Bash(git log:*)` prefix the old list carried). With `Bash` in
+ *    `--disallowedTools` the tool was not there at all.
+ *
+ * NO MCP, and no shell that could commit: the agent turn has no MCP anyway
+ * (see SYSTEM_AGENT's header), and a posture that could run `git commit` could
+ * commit the mockup it was told to keep out of git.
+ *
+ * STATED, not closed: research may still read any file in the worktree and
+ * name it in a WebFetch URL — the repository is what a research card is about,
+ * and a turn that could not read it could not answer. Design may read any
+ * file the Read tool reaches and put it in an artifact the server stores;
+ * text artifacts are scrubbed of the machine's known secret values on the way
+ * out (artifacts.mjs), and binary ones are withheld when they carry one.
+ * Design still runs a plain `git log` on the CLI's own read-only classifier
+ * though no git reader is allowed (measured) — the guard is what refuses its
+ * `--output`. And the Agent tool is offered with no allow rule on this CLI:
+ * a research turn with Bash denied launched a subagent to run one, and the
+ * subagent had no Bash either (measured) — the rules are inherited. Whether
+ * the guard's hook sees a subagent's own calls was not measured here.
+ */
+const ARTIFACT_WRITE = 'Edit(.flowviant/artifacts/**)';
+/**
+ * PLAN MODE (0.97.0) — a Workbench tab's `planMode` switch, and Claude Code's
+ * own `--permission-mode plan` INSTEAD OF every list above: the CLI reads,
+ * decides and answers with a plan, and refuses each write itself.
+ *
+ * PROBED on Claude Code 2.1.281 before relying on it (2026-09-23), in a scratch
+ * git repo, `-p … --output-format stream-json --verbose`:
+ *
+ *  · ALONE, asked to "add a subtract(a, b) function to app.js": the init event
+ *    reads `permissionMode: "plan"`, the turn Read the file, ran a read-only
+ *    `find`, wrote its plan to `~/.claude/plans/<slug>.md` (the CLI's own plan
+ *    file, outside the repo), tried `ExitPlanMode` and was told "Error: No such
+ *    tool available: ExitPlanMode. ExitPlanMode is disabled for this session",
+ *    and ended with the plan as its result text. app.js was untouched.
+ *  · BESIDE `--dangerously-skip-permissions`, same ask: the init event reads
+ *    `permissionMode: "bypassPermissions"` — no error, no warning — and the
+ *    edit LANDED. The bypass silently wins. So this list is a REPLACEMENT for
+ *    `perm`, never an addition, and a plan turn can never carry both.
+ *  · WITH `--mcp-config` and `--allowedTools mcp__flowviant`: the server
+ *    connected and its tools were listed, but a call was refused — "Cannot
+ *    call mcp__flowviant__log_work while in plan mode." — and without the
+ *    `--allowedTools` entry, "Claude requested permissions to use
+ *    mcp__flowviant__log_work, but you haven't granted it yet." Plan mode
+ *    admitted the call ONLY when the server annotated the tool
+ *    `readOnlyHint: true`, and none of the session tools (stream_session_turn,
+ *    log_work, file_card …) are read-only or annotated so. So a plan turn runs
+ *    PLAIN — no MCP, the plain tab's contract — rather than mounting a control
+ *    plane whose every call the CLI refuses. See work.mjs.
+ */
+export const PLAN_MODE_PERM = ['--permission-mode', 'plan'];
+export const DESIGN_PERM = [
+  ...READ_GUARD,
+  '--allowedTools',
+  'Read',
+  'Grep',
+  'Glob',
+  'Bash(ls:*)',
+  ARTIFACT_WRITE,
+];
+
+/** A path a permission rule can name: absolute POSIX, and free of the glob and
+ *  rule-syntax characters that would change what the rule means. Anything else
+ *  gets no rule — `--add-dir` still admits the directory (measured). */
+const ruleSafeAbsolute = (p) =>
+  typeof p === 'string' && p.startsWith('/') && !/[*?[\]{}()\\\n]/.test(p) ? p.replace(/\/+$/, '') : null;
+
+/**
+ * RESEARCH, built at spawn — the knowledge library is the one directory
+ * outside the worktree it may read, and only the spawn knows where that is.
+ * `//` is the CLI's own spelling for an absolute path in a rule.
+ */
+export function researchPerm(knowledgeDir) {
+  const kd = ruleSafeAbsolute(knowledgeDir);
+  return [
+    ...READ_GUARD,
+    '--allowedTools',
+    'Read(./**)',
+    ...(kd ? [`Read(/${kd}/**)`] : []),
+    'Glob(./**)',
+    ...(kd ? [`Glob(/${kd}/**)`] : []),
+    'WebSearch',
+    'WebFetch',
+    ARTIFACT_WRITE,
+    '--disallowedTools',
+    'Read(./.env*)',
+    'Read(./**/.env*)',
+    'Bash',
+  ];
+}
+/** The list with no library — what a project that keeps none runs under. */
+export const RESEARCH_PERM = researchPerm(null);
+
 export const sleep = (s) => new Promise((r) => setTimeout(r, s * 1000));
 
 // Sentinels must appear on their OWN line (the prompts require it). Substring
@@ -300,10 +490,17 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
     // ADOPTABLE — so any headless turn we run for our own purposes would leave
     // a phantom untitled session in the `+` menu. The caller that needs to
     // clean up after itself cannot do so without this id.
-    if (Array.isArray(ev.skills) || typeof ev.session_id === 'string') {
+    //
+    // `mcpServers` (0.97.0) is the same kind of fact from the same event: the
+    // MCP servers and claude.ai connectors the CLI mounted, each with its own
+    // status (`needs-auth` above all — a sign-in that has to happen at this
+    // box). Relayed raw; `recordMcpServers` (runtimes.mjs) normalises it and
+    // drops this daemon's own `flowviant` server.
+    if (Array.isArray(ev.skills) || typeof ev.session_id === 'string' || Array.isArray(ev.mcp_servers)) {
       onInit?.({
         skills: Array.isArray(ev.skills) ? ev.skills.map(String) : undefined,
         sessionId: typeof ev.session_id === 'string' ? ev.session_id : undefined,
+        mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : undefined,
       });
     }
   } else if (ev.type === 'result') {
@@ -351,9 +548,32 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onThreadId, wikiPerm, readOnly, planPerm, planMode, posture, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
+    // PLAN MODE IS CLAUDE'S (0.97.0). The other adapters build their argv
+    // from `profile` and never read `perm`, so a codex or agy turn handed
+    // `planMode` would run a BUILD turn wearing the word "plan". The caller
+    // refuses first, in words; this is the belt — fail the turn, never
+    // substitute.
+    if (planMode && rt.id !== 'claude') {
+      console.error(`\nerror: plan mode runs on Claude Code only — not '${rt.label}'`);
+      resolve('');
+      return;
+    }
+    // …AND SO ARE THE TWO NON-CODE POSTURES, for the same reason and in the
+    // same shape. The agent lane asks `canRun` first and settles `nothing` in
+    // words; this is the layer no caller can skip. A codex or agy adapter
+    // handed `posture: 'design'` never reads `perm` — it builds from `profile`
+    // and runs whatever that falls back to, which for codex is its build
+    // branch, `--sandbox danger-full-access`: a research card's words with the
+    // whole machine to act on. Asked against the runtime's own declared profiles,
+    // so the day an adapter learns to express one this opens by itself.
+    if ((posture === 'design' || posture === 'research') && !(rt.profiles ?? []).includes(posture)) {
+      console.error(`\nerror: a ${posture} card runs on Claude Code only — not '${rt.label}'`);
+      resolve('');
+      return;
+    }
     if (!rt.args) {
       // Reached only if a brief names a runtime this daemon declares but cannot
       // drive. Fail as a turn with no sentinel — the loop already treats that as
@@ -385,7 +605,15 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
     // of the two and a planning turn that fell through to 'consult' would lose
     // the control plane it exists to use — it would read the repo, decide what
     // the slices are, and have no way to write any of them down.
-    const profile = planPerm ? 'plan' : readOnly ? 'consult' : wikiPerm ? 'wiki' : 'build';
+    // A DESIGN OR RESEARCH CARD'S POSTURE (0.97.0) is asked before all of
+    // them, by NAME, because it is the narrowest promise here: write only the
+    // artifacts directory. It is set only by the agent lane, from the card's
+    // kind; every other caller passes nothing and gets exactly the branch it
+    // got before this existed.
+    const profile =
+      posture === 'design' || posture === 'research'
+        ? posture
+        : planPerm ? 'plan' : readOnly ? 'consult' : wikiPerm ? 'wiki' : 'build';
     const args = rt.args({
       prompt,
       system,
@@ -418,7 +646,16 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       // prompt as a trailing positional, so a flag after it is in the wrong
       // place.
       resultSchemaArgs,
-      perm: planPerm ? PLAN_PERM : readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM,
+      // PLAN MODE REPLACES THE POSTURE, never joins it: beside
+      // `--dangerously-skip-permissions` the bypass wins silently (measured —
+      // see PLAN_MODE_PERM).
+      perm: planMode
+        ? PLAN_MODE_PERM
+        : profile === 'design'
+          ? DESIGN_PERM
+          : profile === 'research'
+            ? researchPerm(knowledgeDir)
+            : planPerm ? PLAN_PERM : readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM,
       // Handed to the adapter rather than appended here, because WHERE these go
       // is a property of the CLI: Codex reads its prompt as a trailing
       // positional, so a flag after it is a flag in the wrong place.

package/bin/lib/credentials.mjs

@@ -227,6 +227,42 @@ export function boundElsewhere(entries, repoRoot, projectId) {
   return entries.filter((e) => e.projectId !== projectId && samePath(e.repoRoot, repoRoot));
 }
 
+/**
+ * THE REFUSAL, in one place, because two commands print it (2026-09-23).
+ *
+ * The owner, verbatim: "a directory cannot have more than one project on
+ * flowviant. if one already exists, it would warn the user and ask them to
+ * delete the project on flowviant first. because 2 projects shouldnt be able
+ * to edit a directory at the same time." So `flowviant login` refuses to bind
+ * a second project to a repo, and a start in a repo the store already holds
+ * two projects for refuses to serve either — the picker that used to stand
+ * there was a control offering to do the forbidden thing politely.
+ *
+ * It names every project on the directory, the rule, and the remedy in the
+ * owner's own order: delete the project in Flowviant first. The disconnect
+ * this box can do on its own (`flowviant machines`) is named second, for the
+ * case where the project must survive somewhere else — it satisfies the same
+ * rule, because a project this box no longer serves cannot edit the directory
+ * from here.
+ */
+export function directoryTakenRefusal(bound, repoRoot, { incoming } = {}) {
+  // Every project in the sentence is labelled against the WHOLE set, the
+  // incoming one included: a refusal reading "already connected to BRIF AI,
+  // so BRIF AI was not connected" is the puzzle it exists to end.
+  const all = [...bound, ...(incoming ? [incoming] : [])];
+  const names = bound.map((e) => projectRowLabel(e, all));
+  const list = names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}` : names[0];
+  const head = incoming
+    ? `${repoRoot} is already connected to ${list}, so ${projectRowLabel(incoming, all)} was not connected here.`
+    : `${repoRoot} is connected to ${list}.`;
+  return (
+    `${head}\n` +
+    'A directory serves one project — two projects must not edit it at the same time.\n' +
+    'Delete the project you do not mean in Flowviant first (project settings → General → Delete project),\n' +
+    'or disconnect this box from it with `flowviant machines`, then run this again.'
+  );
+}
+
 /** Collapse a name or slug for loose comparison: "My Project", "my-project"
  *  and "myproject" all become "myproject". */
 function normalizeName(s) {
@@ -387,6 +423,9 @@ export function matchStoredProject(ref) {
  * this returns. Shapes:
  *   { entry, source: 'project-flag' | 'repo' | 'only', needsConfirm? }
  *   { choices, reason: 'no-match' | 'multiple-bound' | 'outside-repo', repoRoot }
+ *     (`multiple-bound` is a REFUSAL in cli.mjs since 2026-09-23 — a directory
+ *     serves one project — and never a picker; the shape is kept because it
+ *     names the projects the refusal has to print)
  *   { none: true }
  *   { error }
  *

package/bin/lib/env.mjs

@@ -725,3 +725,20 @@ export function scrub(text) {
   for (const v of values) out = out.split(v.value).join(`[REDACTED:${v.name}]`);
   return out;
 }
+
+/**
+ * The NAME of the first known secret whose value appears in `bytes` as an
+ * exact byte substring, or null. For the payloads `scrub` cannot touch: a
+ * binary artifact (a PNG's text chunk, a PDF's uncompressed stream, a zip's
+ * stored entry) is not text to rewrite — replacing bytes inside one corrupts
+ * it — so the caller WITHHOLDS a hit rather than redacting it. The same list,
+ * already filtered by `worthRedacting`, so the two can never disagree about
+ * what counts as a secret. It sees only what is stored plainly: a value inside
+ * a deflated stream is not a substring of the file, and that is stated where
+ * it is used (artifacts.mjs).
+ */
+export function secretIn(bytes) {
+  if (!Buffer.isBuffer(bytes) || !bytes.length || !values.length) return null;
+  for (const v of values) if (bytes.includes(v.value, 0, 'utf8')) return v.name;
+  return null;
+}