flowviant 0.96.0 → 0.97.0

package/bin/lib/artifacts.mjs

@@ -37,13 +37,27 @@
  * this is somebody's disk and one place checking is one deploy from zero) are
  * reported BY NAME and never read. Over `ARTIFACT_MAX_BYTES` likewise.
  *
- * ── TEXT IS SCRUBBED ──
+ * ── TEXT IS SCRUBBED; A BINARY CARRYING A SECRET IS WITHHELD ──
  *
  * html, md, svg, json, csv and txt pass through `envScrub` before upload — the
  * turn trace's own scrub, for the trace's own reason: a page the agent wrote
  * can quote a value out of the checkout's `.env`, and an artifact is served to
- * a browser. Binary images are not scrubbed (there is no text to match), and
- * the SERVER computes the sha256 of what it stored; the one sent here is for
+ * a browser.
+ *
+ * The binary types CAN carry text, and this header used to say they could
+ * not. A PNG has tEXt chunks, a PDF has streams that are often stored
+ * uncompressed, a docx/pptx/xlsx is a zip whose entries may be STORED rather
+ * than deflated — and a turn that can write a file can write a secret into
+ * any of them. What they cannot be is REWRITTEN: `envScrub` swapping bytes
+ * inside one corrupts it, and a corrupted binary served as the thing the agent
+ * made is worse than none. So each binary is checked against the same scrub
+ * list as exact byte substrings (`secretIn`, env.mjs) before it is uploaded,
+ * and a hit SKIPS the file with a warn line naming it and the variable — never
+ * a redacted copy, never a by-name row the page would draw as a file it merely
+ * could not show. STATED: a value inside a deflated stream is not a substring
+ * of the file, so this catches what is stored plainly and nothing more.
+ *
+ * The SERVER computes the sha256 of what it stored; the one sent here is for
  * the log.
  *
  * ── DELIVERY ──
@@ -91,6 +105,15 @@ export const ARTIFACT_TYPES = {
   json: { mime: 'application/json', text: true },
   csv: { mime: 'text/csv', text: true },
   txt: { mime: 'text/plain', text: true },
+  // DOCUMENTS (0.97.0): a Word file, a deck, a sheet or a PDF — what the
+  // machine's docx/pptx/xlsx/pdf skills write. Binary, so never REWRITTEN (a
+  // scrub inside a zip or a PDF corrupts it) but checked for a known secret's
+  // bytes and withheld on a hit — see the header. Under the same cap. The app
+  // offers the first three as a download and frames the PDF.
+  docx: { mime: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', text: false },
+  pptx: { mime: 'application/vnd.openxmlformats-officedocument.presentationml.presentation', text: false },
+  xlsx: { mime: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', text: false },
+  pdf: { mime: 'application/pdf', text: false },
 };
 
 export function artifactTypeFor(name) {
@@ -182,7 +205,7 @@ function readNoFollow(path, limit) {
  * re-sent exactly as it was first built (scrubbed once, never re-read from a
  * disk the agent may have changed since).
  */
-export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s) {
+export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub = (s) => s, secretIn = () => null) {
   const type = artifactTypeFor(entry.name);
   const fields = {
     ...(sessionId ? { sessionId } : { agentId }),
@@ -199,7 +222,11 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
     return null; // vanished, or a symlink swapped in: nothing to say
   }
   if (!bytes) return { fields: { ...fields, tooLarge: '1' }, bytes: null };
-  if (type.text) {
+  if (!type.text) {
+    // A binary is never rewritten; one carrying a known secret is not sent.
+    const secret = secretIn(bytes);
+    if (secret) return { withheld: secret, fields };
+  } else {
     bytes = Buffer.from(String(scrub(bytes.toString('utf8'))), 'utf8');
     // A redaction marker can be longer than the value it replaced.
     if (bytes.byteLength > ARTIFACT_MAX_BYTES) {
@@ -222,7 +249,7 @@ export function buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub
  * finished turn and never awaited by the turn (a slow uplink must not hold the
  * next turn behind a readout); `retryPending` rides the settle retry beat.
  */
-export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetchImpl, log = () => {} }) {
+export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, secretIn, fetchImpl, log = () => {} }) {
   const url = String(fleetUrl).replace(/\/agents\/?$/, '/artifact');
   const doFetch = fetchImpl ?? ((...a) => fetch(...a));
   const pending = new Map(); // `${owner}:${name}` -> { body, tries }
@@ -284,8 +311,12 @@ export function createArtifactReporter({ fleetUrl, token, userAgent, scrub, fetc
     const changed = changedArtifacts(before, scanArtifacts(placeDir));
     let n = 0;
     for (const entry of changed) {
-      const body = buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub);
+      const body = buildArtifactUpload(entry, { sessionId, agentId, turnId }, scrub, secretIn);
       if (!body) continue;
+      if (body.withheld) {
+        log(`artifact ${entry.name}: not uploaded — it contains the value of ${body.withheld} from this machine's environment`);
+        continue;
+      }
       const key = `${sessionId ?? agentId}:${entry.name}`;
       pending.delete(key); // this copy supersedes a held older one
       await send(key, body, 0);

package/bin/lib/claude.mjs

@@ -12,6 +12,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { SAFE } from './config.mjs';
 import { runtimeById, humanizeClaudeTool, THINK_MARKER } from './runtimes.mjs';
 
@@ -20,6 +21,46 @@ import { runtimeById, humanizeClaudeTool, THINK_MARKER } from './runtimes.mjs';
 // the strings live.
 export * from './prompts.mjs';
 
+/**
+ * THE READ GUARD, ON EVERY CURATED POSTURE (2026-09-23) — see
+ * hooks/readGuard.mjs for what it refuses and the probe that proved it fires.
+ *
+ * A `Bash(git log:*)` allow is a PREFIX: it names the program and says nothing
+ * about the arguments, and `git log --output=<path>` writes any file while
+ * `-c core.fsmonitor=…` / `--ext-diff` run a program. A reviewer landed
+ * `git log -1 --format='tformat:x' --output=pwned.txt` under RESEARCH_PERM with
+ * no denial, and it re-measured the same way here. So every list below that
+ * promises "reads, and nothing else" carries a `PreToolUse` hook through
+ * `--settings`, measured on Claude Code 2.1.281: it fires under
+ * `--allowedTools`, exit 2 blocks the call, and its sentence reaches the model.
+ *
+ * NEVER ON THE BUILD POSTURE: `--dangerously-skip-permissions` is the
+ * operator's own choice for a turn that is meant to write, and a guard there
+ * would be refusing the job. Nor on PLAN_MODE_PERM, which is the CLI's own
+ * posture on the owner's own tab, not a list this file promises anything about.
+ *
+ * The hook runs as `<this node> <readGuard.mjs>` — the daemon's own
+ * `process.execPath`, never a `node` looked up on a PATH the operator may not
+ * have, because a hook that fails to START is a non-blocking error and the
+ * command runs anyway.
+ */
+export const READ_GUARD_PATH = fileURLToPath(new URL('./hooks/readGuard.mjs', import.meta.url));
+const hookQuote = (s) =>
+  process.platform === 'win32' ? `"${s}"` : `'${String(s).replace(/'/g, `'\\''`)}'`;
+export const READ_GUARD_SETTINGS = JSON.stringify({
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: 'Bash',
+        hooks: [{ type: 'command', command: `${hookQuote(process.execPath)} ${hookQuote(READ_GUARD_PATH)}` }],
+      },
+    ],
+  },
+});
+/** Spread FIRST into a curated list: `--allowedTools` is variadic, so the
+ *  `--settings` pair must stand before it or be swallowed as a tool name. */
+const READ_GUARD = ['--settings', READ_GUARD_SETTINGS];
+
 /**
  * PLAN — read the repo, write the plan, never the code.
  *
@@ -37,6 +78,7 @@ export * from './prompts.mjs';
  * touching.
  */
 const PLAN_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'mcp__flowviant',
   'Read',
@@ -81,6 +123,7 @@ const PERM = SAFE
 // after every wiki turn, and the vault has its own git history.
 // (Write/Edit can't be path-scoped here; the worktree reset is the backstop.)
 const WIKI_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'Read',
   'Grep',
@@ -112,6 +155,7 @@ const WIKI_PERM = [
 // "do not change anything" is only an instruction, and instructions are exactly
 // what an injected question competes with.
 const CONSULT_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'Read',
   'Grep',
@@ -126,6 +170,152 @@ const CONSULT_PERM = [
   'Bash(git rev-parse:*)',
 ];
 
+/**
+ * THE TWO NON-CODE POSTURES (0.97.0) — a design card and a research card may
+ * WRITE, and only under `.flowviant/artifacts/`.
+ *
+ * The card's words are steered by anyone who can file a card, so "change
+ * nothing" as prose is only an instruction, and the permission list is the
+ * enforcement. What each carries is the ONE write its contract needs:
+ *
+ *  · `Edit(.flowviant/artifacts/**)` — PROBED on Claude Code 2.1.281 before
+ *    relying on it (2026-09-23): with `--allowedTools 'Read'
+ *    'Edit(.flowviant/artifacts/**)'`, a `-p` turn told to write
+ *    `.flowviant/artifacts/a.html` AND `b.txt` at the root wrote the first and
+ *    was DENIED the second. The Edit rule governs every file-writing tool,
+ *    Write included. Spelled `Write(.flowviant/artifacts/**)` — or `./`- or
+ *    `//abs`-anchored — the same probe was denied BOTH files, so that spelling
+ *    is not a scoped write at all, it is no write. Relative to the turn's cwd,
+ *    which is the agent's own worktree, which is where the artifact scan looks.
+ *    `**` AND NOT `*`, measured the same day: `Edit(.flowviant/artifacts/*)`
+ *    let a Write to `.flowviant/artifacts/sub/b.html` through exactly as `**`
+ *    did, so the single-level spelling is not narrower on this CLI and would
+ *    only read as if it were. The scan keeps top-level files, so the
+ *    contracts say "no subfolders" — the prompt is the only thing that can.
+ *
+ * THEY ARE NOT THE SAME READER, and the difference is the network:
+ *
+ *  · DESIGN draws THIS product, so it reads the repo broadly — Read, Grep,
+ *    Glob and `ls` — and has no web at all (a mockup that went looking on the
+ *    web would be a mockup of somebody else's product). No git readers and no
+ *    cat/head/wc: Read covers every one of them, and each git reader was an
+ *    `--output` away from a write (see READ_GUARD, which it still carries for
+ *    the `ls` it keeps).
+ *  · RESEARCH has the web — WebSearch and WebFetch — and a turn that can both
+ *    read a secret and fetch a URL can send one. So its reading is FENCED to
+ *    what the card is about: `Read(./**)` (the worktree) plus the project's
+ *    knowledge library by its absolute path, `Glob(./**)` for names, NO Grep
+ *    (an unscoped search of the home directory prints matching lines), NO
+ *    Bash at all, and `.env*` DENIED by name. PROBED on 2.1.281, the whole
+ *    list with `--add-dir <knowledge>`: a file in the cwd read; `/etc/hostname`,
+ *    a sibling directory's file and `~/.flowviant/credentials.json` were each
+ *    refused ("Claude requested permissions to read from …, but you haven't
+ *    granted it yet"); `.env` was refused ("File is in a directory that is
+ *    denied by your permission settings"); the knowledge file read. Two
+ *    controls: WITHOUT the `--disallowedTools` pair, `Read(./**)` read `.env`
+ *    — the deny is load-bearing; and a bare `Glob` listed `~/.flowviant`
+ *    while `Glob(./**)` refused it and still listed the cwd and the added
+ *    directory. The knowledge `Read(//…)` rule is belt: `--add-dir` alone
+ *    admitted the file, and the rule keeps the read allowed should the
+ *    adapter ever stop passing that flag.
+ *    AND `Bash` IS DENIED BY NAME, because leaving it off the allow list is
+ *    not "no Bash": measured the same day, with Bash absent from
+ *    `--allowedTools` the CLI still ran `git log -1 --format=%s` and `ls` on
+ *    its own read-only classifier (it did refuse `git log … --output=…`,
+ *    "This command requires approval" — the reviewer's write needed the
+ *    explicit `Bash(git log:*)` prefix the old list carried). With `Bash` in
+ *    `--disallowedTools` the tool was not there at all.
+ *
+ * NO MCP, and no shell that could commit: the agent turn has no MCP anyway
+ * (see SYSTEM_AGENT's header), and a posture that could run `git commit` could
+ * commit the mockup it was told to keep out of git.
+ *
+ * STATED, not closed: research may still read any file in the worktree and
+ * name it in a WebFetch URL — the repository is what a research card is about,
+ * and a turn that could not read it could not answer. Design may read any
+ * file the Read tool reaches and put it in an artifact the server stores;
+ * text artifacts are scrubbed of the machine's known secret values on the way
+ * out (artifacts.mjs), and binary ones are withheld when they carry one.
+ * Design still runs a plain `git log` on the CLI's own read-only classifier
+ * though no git reader is allowed (measured) — the guard is what refuses its
+ * `--output`. And the Agent tool is offered with no allow rule on this CLI:
+ * a research turn with Bash denied launched a subagent to run one, and the
+ * subagent had no Bash either (measured) — the rules are inherited. Whether
+ * the guard's hook sees a subagent's own calls was not measured here.
+ */
+const ARTIFACT_WRITE = 'Edit(.flowviant/artifacts/**)';
+/**
+ * PLAN MODE (0.97.0) — a Workbench tab's `planMode` switch, and Claude Code's
+ * own `--permission-mode plan` INSTEAD OF every list above: the CLI reads,
+ * decides and answers with a plan, and refuses each write itself.
+ *
+ * PROBED on Claude Code 2.1.281 before relying on it (2026-09-23), in a scratch
+ * git repo, `-p … --output-format stream-json --verbose`:
+ *
+ *  · ALONE, asked to "add a subtract(a, b) function to app.js": the init event
+ *    reads `permissionMode: "plan"`, the turn Read the file, ran a read-only
+ *    `find`, wrote its plan to `~/.claude/plans/<slug>.md` (the CLI's own plan
+ *    file, outside the repo), tried `ExitPlanMode` and was told "Error: No such
+ *    tool available: ExitPlanMode. ExitPlanMode is disabled for this session",
+ *    and ended with the plan as its result text. app.js was untouched.
+ *  · BESIDE `--dangerously-skip-permissions`, same ask: the init event reads
+ *    `permissionMode: "bypassPermissions"` — no error, no warning — and the
+ *    edit LANDED. The bypass silently wins. So this list is a REPLACEMENT for
+ *    `perm`, never an addition, and a plan turn can never carry both.
+ *  · WITH `--mcp-config` and `--allowedTools mcp__flowviant`: the server
+ *    connected and its tools were listed, but a call was refused — "Cannot
+ *    call mcp__flowviant__log_work while in plan mode." — and without the
+ *    `--allowedTools` entry, "Claude requested permissions to use
+ *    mcp__flowviant__log_work, but you haven't granted it yet." Plan mode
+ *    admitted the call ONLY when the server annotated the tool
+ *    `readOnlyHint: true`, and none of the session tools (stream_session_turn,
+ *    log_work, file_card …) are read-only or annotated so. So a plan turn runs
+ *    PLAIN — no MCP, the plain tab's contract — rather than mounting a control
+ *    plane whose every call the CLI refuses. See work.mjs.
+ */
+export const PLAN_MODE_PERM = ['--permission-mode', 'plan'];
+export const DESIGN_PERM = [
+  ...READ_GUARD,
+  '--allowedTools',
+  'Read',
+  'Grep',
+  'Glob',
+  'Bash(ls:*)',
+  ARTIFACT_WRITE,
+];
+
+/** A path a permission rule can name: absolute POSIX, and free of the glob and
+ *  rule-syntax characters that would change what the rule means. Anything else
+ *  gets no rule — `--add-dir` still admits the directory (measured). */
+const ruleSafeAbsolute = (p) =>
+  typeof p === 'string' && p.startsWith('/') && !/[*?[\]{}()\\\n]/.test(p) ? p.replace(/\/+$/, '') : null;
+
+/**
+ * RESEARCH, built at spawn — the knowledge library is the one directory
+ * outside the worktree it may read, and only the spawn knows where that is.
+ * `//` is the CLI's own spelling for an absolute path in a rule.
+ */
+export function researchPerm(knowledgeDir) {
+  const kd = ruleSafeAbsolute(knowledgeDir);
+  return [
+    ...READ_GUARD,
+    '--allowedTools',
+    'Read(./**)',
+    ...(kd ? [`Read(/${kd}/**)`] : []),
+    'Glob(./**)',
+    ...(kd ? [`Glob(/${kd}/**)`] : []),
+    'WebSearch',
+    'WebFetch',
+    ARTIFACT_WRITE,
+    '--disallowedTools',
+    'Read(./.env*)',
+    'Read(./**/.env*)',
+    'Bash',
+  ];
+}
+/** The list with no library — what a project that keeps none runs under. */
+export const RESEARCH_PERM = researchPerm(null);
+
 export const sleep = (s) => new Promise((r) => setTimeout(r, s * 1000));
 
 // Sentinels must appear on their OWN line (the prompts require it). Substring
@@ -300,10 +490,17 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
     // ADOPTABLE — so any headless turn we run for our own purposes would leave
     // a phantom untitled session in the `+` menu. The caller that needs to
     // clean up after itself cannot do so without this id.
-    if (Array.isArray(ev.skills) || typeof ev.session_id === 'string') {
+    //
+    // `mcpServers` (0.97.0) is the same kind of fact from the same event: the
+    // MCP servers and claude.ai connectors the CLI mounted, each with its own
+    // status (`needs-auth` above all — a sign-in that has to happen at this
+    // box). Relayed raw; `recordMcpServers` (runtimes.mjs) normalises it and
+    // drops this daemon's own `flowviant` server.
+    if (Array.isArray(ev.skills) || typeof ev.session_id === 'string' || Array.isArray(ev.mcp_servers)) {
       onInit?.({
         skills: Array.isArray(ev.skills) ? ev.skills.map(String) : undefined,
         sessionId: typeof ev.session_id === 'string' ? ev.session_id : undefined,
+        mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : undefined,
       });
     }
   } else if (ev.type === 'result') {
@@ -351,9 +548,32 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onThreadId, wikiPerm, readOnly, planPerm, planMode, posture, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
+    // PLAN MODE IS CLAUDE'S (0.97.0). The other adapters build their argv
+    // from `profile` and never read `perm`, so a codex or agy turn handed
+    // `planMode` would run a BUILD turn wearing the word "plan". The caller
+    // refuses first, in words; this is the belt — fail the turn, never
+    // substitute.
+    if (planMode && rt.id !== 'claude') {
+      console.error(`\nerror: plan mode runs on Claude Code only — not '${rt.label}'`);
+      resolve('');
+      return;
+    }
+    // …AND SO ARE THE TWO NON-CODE POSTURES, for the same reason and in the
+    // same shape. The agent lane asks `canRun` first and settles `nothing` in
+    // words; this is the layer no caller can skip. A codex or agy adapter
+    // handed `posture: 'design'` never reads `perm` — it builds from `profile`
+    // and runs whatever that falls back to, which for codex is its build
+    // branch, `--sandbox danger-full-access`: a research card's words with the
+    // whole machine to act on. Asked against the runtime's own declared profiles,
+    // so the day an adapter learns to express one this opens by itself.
+    if ((posture === 'design' || posture === 'research') && !(rt.profiles ?? []).includes(posture)) {
+      console.error(`\nerror: a ${posture} card runs on Claude Code only — not '${rt.label}'`);
+      resolve('');
+      return;
+    }
     if (!rt.args) {
       // Reached only if a brief names a runtime this daemon declares but cannot
       // drive. Fail as a turn with no sentinel — the loop already treats that as
@@ -385,7 +605,15 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
     // of the two and a planning turn that fell through to 'consult' would lose
     // the control plane it exists to use — it would read the repo, decide what
     // the slices are, and have no way to write any of them down.
-    const profile = planPerm ? 'plan' : readOnly ? 'consult' : wikiPerm ? 'wiki' : 'build';
+    // A DESIGN OR RESEARCH CARD'S POSTURE (0.97.0) is asked before all of
+    // them, by NAME, because it is the narrowest promise here: write only the
+    // artifacts directory. It is set only by the agent lane, from the card's
+    // kind; every other caller passes nothing and gets exactly the branch it
+    // got before this existed.
+    const profile =
+      posture === 'design' || posture === 'research'
+        ? posture
+        : planPerm ? 'plan' : readOnly ? 'consult' : wikiPerm ? 'wiki' : 'build';
     const args = rt.args({
       prompt,
       system,
@@ -418,7 +646,16 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       // prompt as a trailing positional, so a flag after it is in the wrong
       // place.
       resultSchemaArgs,
-      perm: planPerm ? PLAN_PERM : readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM,
+      // PLAN MODE REPLACES THE POSTURE, never joins it: beside
+      // `--dangerously-skip-permissions` the bypass wins silently (measured —
+      // see PLAN_MODE_PERM).
+      perm: planMode
+        ? PLAN_MODE_PERM
+        : profile === 'design'
+          ? DESIGN_PERM
+          : profile === 'research'
+            ? researchPerm(knowledgeDir)
+            : planPerm ? PLAN_PERM : readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM,
       // Handed to the adapter rather than appended here, because WHERE these go
       // is a property of the CLI: Codex reads its prompt as a trailing
       // positional, so a flag after it is a flag in the wrong place.

package/bin/lib/env.mjs

@@ -725,3 +725,20 @@ export function scrub(text) {
   for (const v of values) out = out.split(v.value).join(`[REDACTED:${v.name}]`);
   return out;
 }
+
+/**
+ * The NAME of the first known secret whose value appears in `bytes` as an
+ * exact byte substring, or null. For the payloads `scrub` cannot touch: a
+ * binary artifact (a PNG's text chunk, a PDF's uncompressed stream, a zip's
+ * stored entry) is not text to rewrite — replacing bytes inside one corrupts
+ * it — so the caller WITHHOLDS a hit rather than redacting it. The same list,
+ * already filtered by `worthRedacting`, so the two can never disagree about
+ * what counts as a secret. It sees only what is stored plainly: a value inside
+ * a deflated stream is not a substring of the file, and that is stated where
+ * it is used (artifacts.mjs).
+ */
+export function secretIn(bytes) {
+  if (!Buffer.isBuffer(bytes) || !bytes.length || !values.length) return null;
+  for (const v of values) if (bytes.includes(v.value, 0, 'utf8')) return v.name;
+  return null;
+}

package/bin/lib/fleet.mjs

@@ -73,9 +73,11 @@ import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 import { machineSnapshot } from './resources.mjs';
 import {
   detectRuntimes,
+  knownMcpServers,
   knownSkills,
   pickRuntimeFor,
   probeSkillsOnce,
+  recordMcpServers,
   recordSkills,
   RUNTIMES,
   THINK_MARKER,
@@ -283,6 +285,22 @@ async function fetchRoster(
   } catch {
     /* best-effort — the poll must never fail on a readout */
   }
+  // WHICH MCP SERVERS AND CONNECTORS THE CLI MOUNTED, AND HOW EACH STANDS
+  // (0.97.0) — `[{n, s}]`, learned off the same init event as the skills, this
+  // daemon's own `flowviant` server excluded AND every `connected` one with it:
+  // only what needs something leaves the box (runtimes.mjs, recordMcpServers —
+  // a teammate has no business reading which services the operator signed
+  // into). The same three states: NOT SENT
+  // until a turn (or the one probe) has taught us, `[]` sent as the fact it is.
+  // The app names every server that is not connected — a connector that needs
+  // a sign-in AT THIS BOX above all — under the serving machine's row. A
+  // daemon→server report: an older server ignores the unknown param.
+  try {
+    const mcp = knownMcpServers();
+    if (mcp !== null) url.searchParams.set('mcp', JSON.stringify(mcp));
+  } catch {
+    /* best-effort — the poll must never fail on a readout */
+  }
   // THIS BOX'S IDENTITY — `envpub`, and since 2026-09-21 nothing else.
   //
   // It carried two more params while the secrets vault existed: `envv` (the
@@ -2120,7 +2138,10 @@ export async function runFleetDaemon() {
               // only thing missing was the handler. The wiki turn runs in a
               // detached worktree of THIS repo, so its `.claude/skills` and the
               // machine's personal ones resolve identically to a tab's.
-              onInit: (i) => recordSkills(i.skills),
+              onInit: (i) => {
+                recordSkills(i.skills);
+                recordMcpServers(i.mcpServers);
+              },
               onSpawn: (ch) => {
                 wikiChild = ch;
               },
@@ -2169,7 +2190,10 @@ export async function runFleetDaemon() {
                 streamJson: true,
                 onActivity,
                 // Same free harvest as the sweep above.
-                onInit: (i) => recordSkills(i.skills),
+                onInit: (i) => {
+                  recordSkills(i.skills);
+                  recordMcpServers(i.mcpServers);
+                },
                 onSpawn: (ch) => {
                   wikiChild = ch;
                 },

package/bin/lib/hooks/readGuard.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+/**
+ * THE READ GUARD (2026-09-23, 0.97.0) — a Claude Code `PreToolUse` hook that
+ * refuses a Bash command able to WRITE A FILE OR RUN A PROGRAM, attached to
+ * every curated posture (consult, plan, wiki, design, research) and never to
+ * the build posture, whose `--dangerously-skip-permissions` is the operator's
+ * own choice.
+ *
+ * WHY A HOOK AND NOT A NARROWER LIST. `--allowedTools 'Bash(git log:*)'` is a
+ * PREFIX match: it says which program may start, never what its arguments may
+ * do. And the "read-only" git readers carry arguments that are writes or
+ * executions in disguise — `--output=<path>` (log, show and diff write their
+ * output to any file you name), `--ext-diff` and `--textconv` (run a
+ * configured program), `-c core.fsmonitor=…` / `--config-env` (run one named
+ * inline), `-O<pager>`, `--exec-path`, `--git-dir` / `--work-tree` (point git
+ * at a planted repository whose config does the above). A reviewer proved it:
+ * `git log -1 --format='tformat:x' --output=pwned.txt` landed under
+ * RESEARCH_PERM with `permission_denials: []`. Re-measured here with a
+ * friendlier phrasing — the file was written and nothing refused it. There is
+ * no permission-rule syntax for "this prefix, minus these arguments".
+ *
+ * PROBED on Claude Code 2.1.281 before relying on it, in a scratch git repo,
+ * `-p … --output-format stream-json --verbose --settings '<json>'` with the
+ * curated list beside it: the hook FIRED under `--allowedTools` (the input on
+ * stdin carried `tool_name: "Bash"` and the exact `tool_input.command`), exit 2
+ * BLOCKED the call (the file was not written; the result listed it under
+ * `permission_denials`), and the stderr sentence REACHED THE MODEL, which
+ * quoted it back. So this is a real fence, not a hint.
+ *
+ * WHAT IT REFUSES, after one normalisation: every quote and backslash is
+ * dropped before matching, because the shell splices `--out''put` and
+ * `--out\put` into `--output` and a raw substring test would read neither.
+ * Dropping them can only make a harmless command look worse, never a harmful
+ * one look better — over-refusal is the safe direction for a read-only turn.
+ *
+ *  · shell composition — `>`, `<(`, `|`, `;`, `&`, a backtick, any `$`
+ *    (command substitution, `${…}`, `$'…'` escapes, a variable that expands
+ *    into a flag), a newline. A read-only turn runs ONE plain command; every
+ *    one of these is a second command or a redirect wearing the first one's
+ *    permission.
+ *  · the git arguments above, as substrings (so `--config` covers
+ *    `--config-env`, `--output` covers `--output-directory`), plus a bare `-c`
+ *    token and any token beginning `-O`.
+ *  · an environment assignment — any `GIT_*=` anywhere, and any `NAME=` as the
+ *    command's first word (`GIT_DIR`, `GIT_EXTERNAL_DIFF`, `PAGER`,
+ *    `LESSOPEN` all change what a reader runs).
+ *
+ * FAILS CLOSED: input it cannot parse is refused, because a fence that opens
+ * whenever the CLI changes its hook payload is a fence that opens silently.
+ * The Read, Grep and Glob tools are untouched by it — the matcher is Bash —
+ * so a refused command always has a tool-shaped way to do the reading.
+ *
+ * OUT OF ITS REACH, stated: an operator who sets `disableAllHooks` (or a
+ * managed `allowManagedHooksOnly`) in their own settings turns this off, the
+ * way they could turn off anything on their own box; the prefix list is still
+ * the first fence and this is the second.
+ *
+ * Run by the CLI as `node readGuard.mjs`, the hook JSON on stdin. Imported by
+ * the tests for `readGuardRefusal`, which is the whole decision.
+ */
+
+import { pathToFileURL } from 'node:url';
+
+/** Substrings that turn a git reader into a writer or an executor. */
+const BANNED_FLAGS = ['--output', '--ext-diff', '--textconv', '--exec-path', '--git-dir', '--work-tree', '--config'];
+
+/** Shell composition: each is a second command or a redirect. */
+const SHELL = [
+  ['>', 'a redirect'],
+  ['<(', 'process substitution'],
+  ['|', 'a pipe'],
+  [';', 'a second command'],
+  ['&', 'a second command'],
+  ['`', 'command substitution'],
+  ['$', 'an expansion'],
+  ['\n', 'a second line'],
+  ['\r', 'a second line'],
+];
+
+/**
+ * The reason this command is refused, or null when it may run.
+ * @param {string} command
+ */
+export function readGuardRefusal(command) {
+  if (typeof command !== 'string') return 'the command could not be read';
+  const flat = command.replace(/['"\\]/g, '');
+  for (const [op, what] of SHELL) {
+    if (flat.includes(op)) return `${what} (\`${op === '\n' || op === '\r' ? '\\n' : op}\`)`;
+  }
+  for (const f of BANNED_FLAGS) if (flat.includes(f)) return `\`${f}\``;
+  const words = flat.trim().split(/\s+/).filter(Boolean);
+  for (const w of words) {
+    if (w === '-c') return '`-c` (an inline config)';
+    if (w.startsWith('-O')) return '`-O`';
+    if (/^GIT_[A-Za-z0-9_]*=/.test(w)) return `an environment assignment (\`${w.split('=')[0]}=\`)`;
+  }
+  if (words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0])) {
+    return `an environment assignment (\`${words[0].split('=')[0]}=\`)`;
+  }
+  return null;
+}
+
+/** The sentence the model reads when a call is refused. */
+export const readGuardSentence = (why) =>
+  `flowviant: this turn is read-only, so ${why} is refused here — it can write a file or run a program. ` +
+  'Run one plain read command at a time with no redirects, pipes or expansions, or use the Read, Grep and Glob tools.';
+
+function main() {
+  // A hook that CRASHES is not a hook that refused: Claude Code treats any
+  // exit other than 2 as a non-blocking error and runs the command anyway. So
+  // every way out of this process that is not a verdict is a refusal.
+  process.on('uncaughtException', () => {
+    process.stderr.write(readGuardSentence('a command the guard could not judge'));
+    process.exit(2);
+  });
+  let buf = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (d) => (buf += d));
+  process.stdin.on('end', () => {
+    let payload;
+    try {
+      payload = JSON.parse(buf);
+    } catch {
+      process.stderr.write(readGuardSentence('a command the guard could not read'));
+      process.exit(2);
+    }
+    // The matcher is Bash; anything else reaching here is not ours to judge.
+    if (payload?.tool_name !== 'Bash') process.exit(0);
+    const why = readGuardRefusal(payload?.tool_input?.command);
+    if (why) {
+      process.stderr.write(readGuardSentence(why));
+      process.exit(2);
+    }
+    process.exit(0);
+  });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main();