flowviant 0.95.0 → 0.97.0

package/bin/lib/runtimes.mjs

@@ -543,7 +543,12 @@ export const RUNTIMES = {
      * "consult" and "plan" currently mean. That is a statement about where the
      * contract was written, not a claim that only Claude could ever satisfy it.
      */
-    profiles: ['build', 'wiki', 'consult', 'plan'],
+    // `design` and `research` (0.97.0) are Claude's alone: each is an
+    // `--allowedTools` list with a PATH-SCOPED write (claude.mjs), and neither
+    // codex's sandbox modes nor agy's flags were measured to express "write
+    // only this directory". A runtime that does not declare them is refused
+    // such a card before spawn, in words — never handed a build turn instead.
+    profiles: ['build', 'wiki', 'consult', 'plan', 'design', 'research'],
     mcp: claudeMcp,
     /**
      * Claude takes the operating contract as a real system prompt, which is the
@@ -1040,7 +1045,16 @@ export const runtimeById = (id) => RUNTIMES[id] ?? RUNTIMES.claude;
  * the single drivability test, so a machine-wide MCP config disqualified it from
  * two jobs that never open an MCP connection.
  */
-const PROFILE_NEEDS_MCP = { build: true, wiki: false, consult: false, plan: true };
+const PROFILE_NEEDS_MCP = {
+  build: true,
+  wiki: false,
+  consult: false,
+  plan: true,
+  // An agent turn has no MCP at all (SYSTEM_AGENT's header) — everything it
+  // says rides the final JSON — so neither non-code posture needs one.
+  design: false,
+  research: false,
+};
 
 /**
  * A build needs the control plane, but NOT necessarily an MCP config of its own.
@@ -1209,6 +1223,68 @@ export function knownSkills() {
   return skillsCache;
 }
 
+/**
+ * WHICH MCP SERVERS AND CLAUDE.AI CONNECTORS THE CLI MOUNTED, AND HOW EACH
+ * STANDS (2026-09-23, 0.97.0) — learned off the same `system.init` event the
+ * skills are, so it costs nothing and cannot drift from what a turn reaches.
+ *
+ * MEASURED on Claude Code 2.1.281 (`claude -p hi --model haiku --output-format
+ * stream-json --verbose`): the init event carries `mcp_servers: [{ name,
+ * status, source }]` — statuses seen `connected`, `failed`, `needs-auth` and
+ * `pending`; a claude.ai connector arrives named `claude.ai <Name>` with
+ * `source: "claudeai"`, a server a turn mounts with `--mcp-config` with
+ * `source: "dynamic"`. A connector that needs a one-time sign-in AT THIS BOX
+ * reads `needs-auth` here long before a turn fails on it, and the app's
+ * Machines page names it.
+ *
+ * `flowviant` IS EXCLUDED: it is the server THIS daemon mounts on every tab
+ * turn, always present, and not something a person can act on. A status off
+ * the closed list is relayed as `other` rather than dropped — the CLI said
+ * something about the server, and silence would be the daemon deciding it did
+ * not. Bounded (40 entries, names cut at 60) and sorted, the `recordSkills`
+ * discipline: a stable param, so an unchanged report writes nothing.
+ *
+ * ONLY WHAT IS NOT CONNECTED LEAVES THE BOX (2026-09-23). The first cut
+ * relayed every server, connected ones included — so the operator's whole set
+ * of signed-in services (their mail, their brokerage, their calendar) rode the
+ * poll to the server and into every teammate's read of the Machines page,
+ * which renders only the servers that are NOT connected anyway. A connected
+ * connector is good news and good news is not a line; it is also nobody
+ * else's business. So `connected` is dropped HERE, before the cap, and what is
+ * sent is exactly what the page can say something about.
+ *
+ * THREE STATES, the skills split: null = no turn has taught us (the param is
+ * not sent), [] = nothing of the person's own needs anything (every server is
+ * connected, or none is mounted), a list = the ones that do. Last turn wins,
+ * so a connector somebody signs into leaves the list on the next turn's init,
+ * and an all-connected turn sends `[]`, which clears a stale list server-side.
+ */
+let mcpServersCache = null;
+
+export const MCP_STATUSES = new Set(['connected', 'failed', 'needs-auth', 'pending']);
+export const MAX_MCP_SERVERS = 40;
+export const MCP_NAME_MAX = 60;
+
+export function recordMcpServers(list) {
+  if (!Array.isArray(list)) return;
+  const seen = new Map();
+  for (const e of list) {
+    if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
+    const n = e.name.trim().slice(0, MCP_NAME_MAX).trim();
+    if (!n || n === 'flowviant' || seen.has(n)) continue;
+    if (e.status === 'connected') continue; // see the header: never relayed
+    seen.set(n, { n, s: MCP_STATUSES.has(e.status) ? e.status : 'other' });
+  }
+  mcpServersCache = [...seen.values()]
+    .sort((a, b) => (a.n < b.n ? -1 : a.n > b.n ? 1 : 0))
+    .slice(0, MAX_MCP_SERVERS);
+}
+
+/** What to send on the roster poll as `mcp` — null until a turn has taught us. */
+export function knownMcpServers() {
+  return mcpServersCache;
+}
+
 /**
  * LEARN WHAT `/` CAN OFFER, ON A MACHINE NO TURN HAS TAUGHT.
  *
@@ -1338,6 +1414,8 @@ export function parseInitLine(line) {
     // record nothing. Conflating the two would keep the probe scanning a whole
     // turn's output on a CLI that does not report them.
     skills: Array.isArray(ev.skills) ? ev.skills : null,
+    // The CLI's mounted MCP servers (0.97.0) — `recordMcpServers` normalises.
+    mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : null,
     sessionId: typeof ev.session_id === 'string' ? ev.session_id : null,
   };
 }
@@ -1399,6 +1477,7 @@ export function probeSkillsOnce(cwd) {
       const init = parseInitLine(line);
       if (!init) continue;
       if (init.skills) recordSkills(init.skills);
+      if (init.mcpServers) recordMcpServers(init.mcpServers);
       finish(init.sessionId);
       return;
     }

package/bin/lib/work.mjs

@@ -75,7 +75,9 @@ import {
   WORK_TURN_KICKOFF_PLAIN,
   SYSTEM_PLAN,
   AGENT_PLAN_KICKOFF,
-  SYSTEM_AGENT,
+  SYSTEM_AGENT_FOR,
+  agentTaskKindOf,
+  unknownAgentTaskKind,
   SYSTEM_PRECHECK,
   AGENT_TASK_KICKOFF,
   AGENT_TASK_SPEC,
@@ -84,13 +86,14 @@ import {
   withProjectContext,
 } from './prompts.mjs';
 import { knowledgeDirFor, FLOWVIANT_OWN_PATHS } from './knowledge.mjs';
-import { createArtifactReporter, snapshotArtifacts } from './artifacts.mjs';
-import { myPubB64, scrub as envScrub } from './env.mjs';
+import { changedArtifacts, createArtifactReporter, scanArtifacts, snapshotArtifacts } from './artifacts.mjs';
+import { myPubB64, scrub as envScrub, secretIn as envSecretIn } from './env.mjs';
 import {
   detectRuntimes,
   canRun,
   pickRuntimeFor,
   recordSkills,
+  recordMcpServers,
   toolEventOf,
   removeProbeTranscript,
   CLAUDE_TOOL_PROSE_KINDS,
@@ -171,6 +174,22 @@ const WORK_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
  * the machine's own default — a turn that runs — rather than a flag no CLI
  * understands and a tab that fails every message.
  */
+/**
+ * THE ONE SENTENCE A PLAN TURN'S SYSTEM PROMPT GAINS (0.97.0), composed here
+ * rather than in prompts.mjs because it is a MODIFIER on whichever contract
+ * the tab runs, not a contract of its own.
+ *
+ * The enforcement is not this sentence — it is `--permission-mode plan`, under
+ * which the CLI itself refuses every write (claude.mjs, PLAN_MODE_PERM). What
+ * the sentence buys is the ANSWER: the plain contract above it says "edit
+ * freely, commit", and a turn told only that would spend itself discovering
+ * refusals. It also says not to reach for `ExitPlanMode` (measured: disabled
+ * under `-p`, and the probe turn then asked the person to leave plan mode
+ * themselves) — leaving plan mode is the person's switch in the tab.
+ */
+export const PLAN_TURN_SENTENCE =
+  'THIS IS A PLANNING TURN: the person switched this tab to plan mode, so read what you need, decide, and answer with the plan itself as your reply — change nothing (the CLI refuses every write this turn, whatever the mechanics above say about editing, committing or artifacts), and do not try to leave plan mode; they switch it off in the tab when they want the plan carried out.';
+
 function brainFor(job) {
   const out = {};
   const model = typeof job?.model === 'string' ? job.model.trim() : '';
@@ -258,6 +277,9 @@ export function createWorkManager({
     token: FLEET_TOKEN,
     userAgent: USER_AGENT,
     scrub: envScrub,
+    // …and for the binaries it cannot scrub, the same list as a byte check:
+    // a hit is withheld, never uploaded rewritten (artifacts.mjs).
+    secretIn: envSecretIn,
     log: (line) => warn(line),
   });
   /**
@@ -3135,6 +3157,22 @@ export function createWorkManager({
             });
             return;
           }
+          /**
+           * A PLAN TURN (0.97.0): the tab's switch, off the job. CLAUDE ONLY —
+           * `--permission-mode plan` is Claude Code's, and a codex or agy turn
+           * has no way to spell it, so it is refused HERE in words rather than
+           * run as a build turn wearing the word. The server never sends the
+           * key for a non-Claude tab; this is the machine's own half. Never on
+           * a capture chat, which is read-only by its own profile already.
+           */
+          const planTurn = job.planMode === true && job.capture !== true;
+          if (planTurn && rt.id !== 'claude') {
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: `plan mode runs on Claude Code only, and this tab is ${rt.id} — turn plan off in the tab, then send the message again`,
+            });
+            return;
+          }
           // A PLAIN tab (agy) mounts no MCP: no credential to mint, no config
           // to write. The trade is stated in SYSTEM_WORK_PLAIN — no cards, no
           // streaming — and the honesty survives on the existing rails: the
@@ -3279,9 +3317,17 @@ export function createWorkManager({
           const adoptNote = adopting
             ? '[ADOPTED SESSION — this conversation was brought in from a terminal. Begin your reply with a 2-3 sentence recap of where it left off and what state carried over, then answer the message.]'
             : '';
-          const mcp = plainTab
-            ? { args: [], env: null, dir: null }
-            : mcpFor(rt.id, mint.token, getMcpUrl());
+          // A PLAN TURN RUNS PLAIN TOO (0.97.0): measured on 2.1.281, plan mode
+          // refuses every `mcp__flowviant` call ("Cannot call … while in plan
+          // mode") unless the tool is annotated read-only, and none of the
+          // session tools are — so mounting the control plane would hand the
+          // turn a list of tools it can only fail at. The credential is still
+          // minted above: its lease answers (held elsewhere, gone) are about
+          // the SESSION, and a plan turn needs them as much as any other.
+          const mcp =
+            plainTab || planTurn
+              ? { args: [], env: null, dir: null }
+              : mcpFor(rt.id, mint.token, getMcpUrl());
           // The tab's model/effort, if it named any. Spread into turnArgs so
           // BOTH runTurn calls below carry it — the retry is the same turn on
           // the same brain, not a quieter second opinion.
@@ -3428,7 +3474,7 @@ export function createWorkManager({
             const turnArgs = {
               // A plain tab has no tools to name and no session id to pass —
               // its kickoff asks for one complete report instead of a stream.
-              prompt: plainTab
+              prompt: plainTab || planTurn
                 ? WORK_TURN_KICKOFF_PLAIN({
                     sessionName: job.sessionName,
                     message,
@@ -3448,6 +3494,10 @@ export function createWorkManager({
                     askedByName: job.askedByName,
                   }),
               planPerm: captureTab,
+              // `--permission-mode plan` INSTEAD of the build posture — never
+              // beside `--dangerously-skip-permissions`, which silently wins
+              // (claude.mjs, PLAN_MODE_PERM). Present only on a plan turn.
+              ...(planTurn ? { planMode: true } : {}),
               // The adopt turn resumes the TERMINAL conversation by forking it
               // into this cwd (claude: --resume <id> --fork-session). After it
               // speaks once, the fork lives natively here and turn 2+ is the
@@ -3460,12 +3510,18 @@ export function createWorkManager({
               ...(() => {
                 const knowledgeDir = knowledgeDirFor(repoRoot);
                 return {
-                  system: withProjectContext(
-                    plainTab ? SYSTEM_WORK_PLAIN : captureTab ? SYSTEM_CAPTURE : SYSTEM_WORK,
-                    // ARTIFACTS (0.94.0): every tab but the read-only capture
-                    // chat, and only while the server can show one.
-                    { knowledgeDir, artifacts: !captureTab && getArtifactsAccepted() }
-                  ),
+                  // A PLAN TURN (0.97.0) runs the PLAIN contract — it has no
+                  // Flowviant tools, see `mcp` above — with no artifacts
+                  // paragraph (plan mode cannot write one) and the planning
+                  // sentence appended. Every other tab is untouched.
+                  system: planTurn
+                    ? `${withProjectContext(SYSTEM_WORK_PLAIN, { knowledgeDir, artifacts: false })}\n\n${PLAN_TURN_SENTENCE}`
+                    : withProjectContext(
+                        plainTab ? SYSTEM_WORK_PLAIN : captureTab ? SYSTEM_CAPTURE : SYSTEM_WORK,
+                        // ARTIFACTS (0.94.0): every tab but the read-only capture
+                        // chat, and only while the server can show one.
+                        { knowledgeDir, artifacts: !captureTab && getArtifactsAccepted() }
+                      ),
                   // The directory is OUTSIDE a worktree's cwd; Claude Code is
                   // told it may read there (`--add-dir`) rather than left to
                   // refuse a read-only capture turn a path it was just handed.
@@ -3494,6 +3550,9 @@ export function createWorkManager({
               // learned from a turn rather than looked up.
               onInit: (i) => {
                 recordSkills(i.skills);
+                // The CLI's mounted MCP servers and connectors (0.97.0) — the
+                // same free fact off the same event; see recordMcpServers.
+                recordMcpServers(i.mcpServers);
                 // The conversation this turn is actually speaking under. Held
                 // and persisted after the turn ends, so the NEXT one resumes
                 // this exact thread rather than whatever the directory saw
@@ -4868,11 +4927,62 @@ export function createWorkManager({
       const branch = readGit(['symbolic-ref', '--quiet', '--short', 'HEAD']);
 
       const rt = job.runtime || 'claude';
-      if (!canRun(RUNTIMES[rt], 'build')) {
+      /**
+       * WHAT THIS CARD HANDS BACK, AND THE POSTURE THAT FOLLOWS (0.97.0).
+       *
+       * `code` (the default — absent on the job IS code) is the build turn,
+       * byte-for-byte what every agent turn was. `design` and `research` run
+       * their own contract (SYSTEM_AGENT_DESIGN / _RESEARCH) under their own
+       * posture, which can write ONLY `.flowviant/artifacts/` (claude.mjs).
+       *
+       * A RUNTIME THAT CANNOT EXPRESS THE POSTURE IS REFUSED, NOT IMPROVISED.
+       * Codex and antigravity declare neither (runtimes.mjs), and the only
+       * alternative to refusing is running the card as a BUILD turn with
+       * permissions skipped — an agent writing code for an ask that was a
+       * mockup, reporting success. `nothing` puts the agent in Stuck saying so.
+       *
+       * THE JOB'S OWN KIND FIRST (2026-09-23). A `human` turn — a send-back
+       * from the review deck, an answer — usually names NO card: the queue has
+       * emptied, or the card it is about was just re-queued behind it. Read off
+       * `job.task` alone, a send-back on a design agent ran as a BUILD turn
+       * under the code contract with permissions skipped — the one turn in the
+       * owner's loop ("iterate in the review column, the agent opened") that
+       * could edit code on an ask that was a mockup. So the server projects the
+       * kind of the card the turn is ABOUT onto the job itself (`taskKind`,
+       * sent only for design and research; the same `DAEMON_TASK_KIND_MIN`
+       * floor as the card's own key, no new one), and the card's key stays the
+       * fallback for a server that sends only that. Absent on both is code.
+       */
+      /**
+       * A KIND THIS DAEMON DOES NOT KNOW IS REFUSED, NEVER BUILT (2026-09-23).
+       * `agentTaskKindOf` reads anything unrecognised as code — right for a
+       * printed label, wrong here, where code means the build posture with
+       * permissions skipped. A server that learned a fourth kind ahead of
+       * this daemon is exactly the case the version floor cannot cover (the
+       * handout does not re-check it), and the answer is an update, said in
+       * the word the server used. `nothing` puts the agent in Stuck with it.
+       */
+      const strangeKind = unknownAgentTaskKind(job.taskKind ?? job.task?.taskKind);
+      if (strangeKind !== null) {
+        await postAgentTurn({
+          turnId,
+          outcome: 'nothing',
+          answer: `this daemon does not know the card kind '${strangeKind}' — update it`,
+          branch,
+          worktree: wt,
+        });
+        return;
+      }
+      const taskKind = agentTaskKindOf(job.taskKind ?? job.task?.taskKind);
+      const posture = taskKind === 'code' ? 'build' : taskKind;
+      if (!canRun(RUNTIMES[rt], posture)) {
         await postAgentTurn({
           turnId,
           outcome: 'nothing',
-          answer: `this machine cannot run ${rt}`,
+          answer:
+            posture === 'build'
+              ? `this machine cannot run ${rt}`
+              : 'design and research cards run on Claude on this machine',
           branch,
           worktree: wt,
         });
@@ -5003,13 +5113,16 @@ export function createWorkManager({
           // The knowledge paragraph, when this box holds a library — the same
           // composer the tabs use, so an agent and a tab can never be told two
           // different things about the same directory.
-          system: withProjectContext(SYSTEM_AGENT, {
+          system: withProjectContext(SYSTEM_AGENT_FOR(taskKind), {
             knowledgeDir: knowledgeDirFor(repoRoot),
             // ARTIFACTS (0.94.0), while the server can show one — an agent's
             // land on its page, under the facts row.
             artifacts: getArtifactsAccepted(),
           }),
           knowledgeDir: knowledgeDirFor(repoRoot),
+          // Named only for the two non-code kinds; a code turn passes nothing
+          // and keeps the build branch it always had.
+          ...(posture !== 'build' ? { posture } : {}),
           cwd: wt,
           runtime: rt,
           resume,
@@ -5057,6 +5170,16 @@ export function createWorkManager({
           onUsage: (u) => {
             usage = u;
           },
+          // WHAT THE CLI SAYS IT CAN BE ASKED FOR, AND WHICH CONNECTORS NEED A
+          // LOGIN — the same free fact off the same init event the tab lane
+          // records (2026-09-23). Without it a box that only ever runs agents
+          // taught the app its skills and connectors ONCE, from the startup
+          // probe, and never again: a connector signed into at the box kept
+          // reading "needs authorization" for the life of the process.
+          onInit: (i) => {
+            recordSkills(i.skills);
+            recordMcpServers(i.mcpServers);
+          },
           onSpawn: (ch) => {
             child = ch;
             // The AGENT it serves — what the machine snapshot charges this
@@ -5161,6 +5284,60 @@ export function createWorkManager({
         });
         return;
       }
+      /**
+       * A DESIGN OR RESEARCH CARD IS NOT DELIVERED UNTIL ITS ARTIFACT EXISTS
+       * (0.97.0) — measured, never taken on the agent's word.
+       *
+       * Its whole product is one file under `.flowviant/artifacts/`: a `.html`
+       * mockup for design, a `.md` write-up for research. A turn that says
+       * "delivered" without having written one would land the agent in Review
+       * with nothing to look at and a summary describing a page that does not
+       * exist — so it settles `nothing` with the measured sentence, and the
+       * agent lands in Stuck with a true reason instead.
+       *
+       * WHAT COUNTS: on a TASK turn, only what the scan found NEW OR CHANGED
+       * this turn (`changedArtifacts` against the snapshot taken before the
+       * spawn) — a second design card in the same agent must not pass on the
+       * first card's page. On a HUMAN turn (an answer, a send-back) a matching
+       * file already standing in the directory also counts: "keep it as it
+       * is" is a legitimate answer to a question the agent asked after
+       * drawing, and the turn did not have to rewrite the page to deliver it.
+       *
+       * …AND ON A REDO (2026-09-23): a TASK turn re-running a card this agent
+       * already delivered, which is what a send-back's "Needs work" queues —
+       * the human turn in front of it usually rewrote the mockup already, so
+       * the task turn that follows truthfully says "revised last turn" with
+       * nothing new to write, and the task rule sent it to Stuck with a false
+       * sentence. The server marks such a job `redo: true` (a link delivered
+       * before, or carrying a `needs_work` verdict), and then a standing match
+       * counts, as it does for a human turn. No floor: an older server never
+       * sends the key, and absent keeps the stricter task rule.
+       *
+       * Commits are still reported if any exist — the posture prevents them,
+       * and a report never lies by omission about what is on the branch.
+       */
+      if (res.outcome === 'delivered' && taskKind !== 'code') {
+        const want = taskKind === 'design' ? /\.html?$/i : /\.md$/i;
+        const standing = scanArtifacts(wt);
+        const wrote = changedArtifacts(artifactsBefore, standing).some((e) => want.test(e.name));
+        const present =
+          wrote || ((job.kind !== 'task' || job.redo === true) && standing.some((e) => want.test(e.name)));
+        if (!present) {
+          await postAgentTurn({
+            turnId,
+            outcome: 'nothing',
+            answer:
+              taskKind === 'design'
+                ? 'the turn ended without writing a mockup under .flowviant/artifacts/'
+                : 'the turn ended without writing a write-up under .flowviant/artifacts/',
+            ...(commits.length ? { commits } : {}),
+            ...(usage ? { usage } : {}),
+            branch,
+            worktree: wt,
+          });
+          return;
+        }
+      }
       const reply = await postAgentTurn({
         turnId,
         outcome: res.outcome,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.95.0",
+  "version": "0.97.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {