flowviant 0.96.0 → 0.99.0

package/bin/lib/runtimes.mjs

@@ -342,11 +342,40 @@ function parseCodexLine(line, cwd) {
       const activity = humanizeCodexItem(item, cwd);
       // Only the agent's MESSAGES are sentinel-bearing text. Reasoning is not:
       // a model that muses "I could output NOTHING here" must not end the turn.
-      const text =
-        (item.item_type ?? item.type) === 'agent_message'
-          ? `${item.text ?? item.message ?? ''}\n`
-          : '';
-      return { activity, text };
+      const isMessage = (item.item_type ?? item.type) === 'agent_message';
+      const text = isMessage ? `${item.text ?? item.message ?? ''}\n` : '';
+      // `answer` is the SAME message, surfaced alone: `text` accumulates every
+      // message plus every error and stderr line, so a caller that needs "what
+      // the agent said LAST" (the agent lane's final JSON object) cannot recover
+      // it from `out`. Claude's stream has this for free under
+      // `answerFromResult`; codex needed it said.
+      return { activity, text, ...(isMessage ? { answer: String(item.text ?? item.message ?? '') } : {}) };
+    }
+    // THE TURN'S OWN TOKEN COUNT (2026-09-24). `codex exec --json` closes a
+    // turn with `turn.completed` carrying `usage` — the codex twin of Claude's
+    // `result.usage`, and until now dropped on the floor, so a codex agent
+    // reported no spend at all. Mapped onto the daemon's four counters:
+    // OpenAI's `input_tokens` INCLUDES the cached part, Claude's excludes it,
+    // so the cached share is subtracted out rather than counted twice. Codex
+    // has no cache-creation figure; zero is what it reported, not a guess.
+    // Output already includes reasoning tokens on OpenAI's side.
+    case 'turn.completed': {
+      const u = ev.usage;
+      if (!u || typeof u !== 'object') return null;
+      const n = (v) => (Number.isFinite(Number(v)) && Number(v) > 0 ? Math.floor(Number(v)) : 0);
+      const cached = n(u.cached_input_tokens);
+      return {
+        activity: null,
+        text: '',
+        // `usageFromResult`'s shape (claude.mjs), so every consumer of
+        // `onUsage` reads one vocabulary whichever CLI counted it.
+        usage: {
+          input: Math.max(0, n(u.input_tokens) - cached),
+          output: n(u.output_tokens),
+          cacheCreate: 0,
+          cacheRead: cached,
+        },
+      };
     }
     case 'turn.failed': {
       // An error is prose too, and the sentence that explains a failed turn is
@@ -367,7 +396,12 @@ function parseCodexLine(line, cwd) {
           label: oneLine(ev.error?.message ?? 'turn failed'),
           ...(msg.trim() ? { full: msg } : {}),
         },
-        text: '',
+        // THE FAILURE'S OWN WORDS REACH `text` (2026-09-24), the rule the bare
+        // `error` arm below already keeps. This returned '' — so a codex turn
+        // that failed on a usage limit handed the limit matcher nothing, the
+        // agent landed in Stuck as "produced no output", and every other codex
+        // agent kept spending into the same wall.
+        text: msg.trim() ? `${msg}\n` : '',
       };
     }
     // A bare `error` event — the shape an auth failure arrives in ("401
@@ -543,14 +577,19 @@ export const RUNTIMES = {
      * "consult" and "plan" currently mean. That is a statement about where the
      * contract was written, not a claim that only Claude could ever satisfy it.
      */
-    profiles: ['build', 'wiki', 'consult', 'plan'],
+    // `design` and `research` (0.97.0) are Claude's alone: each is an
+    // `--allowedTools` list with a PATH-SCOPED write (claude.mjs), and neither
+    // codex's sandbox modes nor agy's flags were measured to express "write
+    // only this directory". A runtime that does not declare them is refused
+    // such a card before spawn, in words — never handed a build turn instead.
+    profiles: ['build', 'wiki', 'consult', 'plan', 'design', 'research'],
     mcp: claudeMcp,
     /**
      * Claude takes the operating contract as a real system prompt, which is the
      * strongest form of it available anywhere: `--append-system-prompt` sits
      * above the conversation rather than inside it.
      */
-    args({ prompt, system, model, effort, resume, streamJson, perm, mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir }) {
+    args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools }) {
       const a = [];
       // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
       // are mutually exclusive, never combined.
@@ -577,6 +616,17 @@ export const RUNTIMES = {
       else if (resumeThreadId) a.push('--resume', resumeThreadId);
       else if (resume) a.push('--continue');
       a.push('-p', prompt, '--append-system-prompt', system);
+      if (agentTools) {
+        // Keep personal settings, but never load the agent-editable project's
+        // settings, hooks, skills or CLAUDE.md discovery. A resumed agent must
+        // render the CURRENT base snapshot, not the first turn's prompt cache.
+        a.push('--setting-sources', 'user', '--system-prompt-snapshot', 'off');
+        if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
+      }
+      // These fenced postures have no project MCP, even if Claude discovers a
+      // .mcp.json in the agent's worktree. Build gets its reviewed base config
+      // explicitly from the caller; the plan profile keeps its own principal.
+      if (['consult', 'wiki', 'design', 'research'].includes(profile)) a.push('--strict-mcp-config');
       a.push(...mcp, ...resultSchemaArgs);
       a.push('--model', model || MODEL);
       if (effort) a.push('--effort', effort);
@@ -629,6 +679,11 @@ export const RUNTIMES = {
      * user's repository, which is not a risk worth taking for a slightly
      * stickier instruction.
      *
+     * Agent turns additionally pass reviewed base instructions as a developer
+     * config override when the personal config has no developer instruction;
+     * the prompt always carries them too. Workbench tabs keep their normal
+     * checkout discovery.
+     *
      * `--skip-git-repo-check` is deliberately NOT passed: a task always builds
      * in a git worktree, and if it somehow is not one, failing loudly beats
      * silently editing files nobody can diff.
@@ -639,7 +694,7 @@ export const RUNTIMES = {
      * placed before it. Appending them after the positional is the kind of argv
      * that parses today and stops parsing on some future clap upgrade.
      */
-    args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [], adoptResumeId }) {
+    args({ prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools }) {
       // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
       // agy moves) — codex has no adoptable store wired yet. Reaching here
       // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -656,6 +711,13 @@ export const RUNTIMES = {
       if (resumeThreadId) a.push('resume', resumeThreadId);
       else if (resume) a.push('resume', '--last');
       a.push('--json');
+      if (agentTools) {
+        a.push('-c', 'project_doc_max_bytes=0');
+        // A person's existing developer instructions keep their authority.
+        // The base snapshot is also present in the per-turn prompt preamble.
+        if (!agentTools.personalDeveloperInstructions)
+          a.push('-c', `developer_instructions=${JSON.stringify(agentTools.instructions)}`);
+      }
       if (model) a.push('--model', model);
       // Effort is a config value on Codex rather than a flag.
       if (effort) a.push('-c', `model_reasoning_effort="${effort}"`);
@@ -1040,7 +1102,16 @@ export const runtimeById = (id) => RUNTIMES[id] ?? RUNTIMES.claude;
  * the single drivability test, so a machine-wide MCP config disqualified it from
  * two jobs that never open an MCP connection.
  */
-const PROFILE_NEEDS_MCP = { build: true, wiki: false, consult: false, plan: true };
+const PROFILE_NEEDS_MCP = {
+  build: true,
+  wiki: false,
+  consult: false,
+  plan: true,
+  // An agent turn has no MCP at all (SYSTEM_AGENT's header) — everything it
+  // says rides the final JSON — so neither non-code posture needs one.
+  design: false,
+  research: false,
+};
 
 /**
  * A build needs the control plane, but NOT necessarily an MCP config of its own.
@@ -1209,6 +1280,68 @@ export function knownSkills() {
   return skillsCache;
 }
 
+/**
+ * WHICH MCP SERVERS AND CLAUDE.AI CONNECTORS THE CLI MOUNTED, AND HOW EACH
+ * STANDS (2026-09-23, 0.97.0) — learned off the same `system.init` event the
+ * skills are, so it costs nothing and cannot drift from what a turn reaches.
+ *
+ * MEASURED on Claude Code 2.1.281 (`claude -p hi --model haiku --output-format
+ * stream-json --verbose`): the init event carries `mcp_servers: [{ name,
+ * status, source }]` — statuses seen `connected`, `failed`, `needs-auth` and
+ * `pending`; a claude.ai connector arrives named `claude.ai <Name>` with
+ * `source: "claudeai"`, a server a turn mounts with `--mcp-config` with
+ * `source: "dynamic"`. A connector that needs a one-time sign-in AT THIS BOX
+ * reads `needs-auth` here long before a turn fails on it, and the app's
+ * Machines page names it.
+ *
+ * `flowviant` IS EXCLUDED: it is the server THIS daemon mounts on every tab
+ * turn, always present, and not something a person can act on. A status off
+ * the closed list is relayed as `other` rather than dropped — the CLI said
+ * something about the server, and silence would be the daemon deciding it did
+ * not. Bounded (40 entries, names cut at 60) and sorted, the `recordSkills`
+ * discipline: a stable param, so an unchanged report writes nothing.
+ *
+ * ONLY WHAT IS NOT CONNECTED LEAVES THE BOX (2026-09-23). The first cut
+ * relayed every server, connected ones included — so the operator's whole set
+ * of signed-in services (their mail, their brokerage, their calendar) rode the
+ * poll to the server and into every teammate's read of the Machines page,
+ * which renders only the servers that are NOT connected anyway. A connected
+ * connector is good news and good news is not a line; it is also nobody
+ * else's business. So `connected` is dropped HERE, before the cap, and what is
+ * sent is exactly what the page can say something about.
+ *
+ * THREE STATES, the skills split: null = no turn has taught us (the param is
+ * not sent), [] = nothing of the person's own needs anything (every server is
+ * connected, or none is mounted), a list = the ones that do. Last turn wins,
+ * so a connector somebody signs into leaves the list on the next turn's init,
+ * and an all-connected turn sends `[]`, which clears a stale list server-side.
+ */
+let mcpServersCache = null;
+
+export const MCP_STATUSES = new Set(['connected', 'failed', 'needs-auth', 'pending']);
+export const MAX_MCP_SERVERS = 40;
+export const MCP_NAME_MAX = 60;
+
+export function recordMcpServers(list) {
+  if (!Array.isArray(list)) return;
+  const seen = new Map();
+  for (const e of list) {
+    if (!e || typeof e !== 'object' || typeof e.name !== 'string') continue;
+    const n = e.name.trim().slice(0, MCP_NAME_MAX).trim();
+    if (!n || n === 'flowviant' || seen.has(n)) continue;
+    if (e.status === 'connected') continue; // see the header: never relayed
+    seen.set(n, { n, s: MCP_STATUSES.has(e.status) ? e.status : 'other' });
+  }
+  mcpServersCache = [...seen.values()]
+    .sort((a, b) => (a.n < b.n ? -1 : a.n > b.n ? 1 : 0))
+    .slice(0, MAX_MCP_SERVERS);
+}
+
+/** What to send on the roster poll as `mcp` — null until a turn has taught us. */
+export function knownMcpServers() {
+  return mcpServersCache;
+}
+
 /**
  * LEARN WHAT `/` CAN OFFER, ON A MACHINE NO TURN HAS TAUGHT.
  *
@@ -1338,6 +1471,8 @@ export function parseInitLine(line) {
     // record nothing. Conflating the two would keep the probe scanning a whole
     // turn's output on a CLI that does not report them.
     skills: Array.isArray(ev.skills) ? ev.skills : null,
+    // The CLI's mounted MCP servers (0.97.0) — `recordMcpServers` normalises.
+    mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : null,
     sessionId: typeof ev.session_id === 'string' ? ev.session_id : null,
   };
 }
@@ -1384,9 +1519,14 @@ export function probeSkillsOnce(cwd) {
   timer.unref?.();
   child.on('error', () => finish(null));
   child.on('exit', () => finish(null));
+  // UTF-8 mode on the STREAM, not a per-chunk `.toString()` — a multi-byte
+  // character straddling a chunk boundary decodes to mojibake (or a stray
+  // replacement byte) when each chunk is decoded on its own; the stream's
+  // own decoder holds the partial sequence over to the next chunk instead.
+  child.stdout.setEncoding('utf8');
   child.stdout.on('data', (d) => {
     if (settled) return;
-    buf += d.toString();
+    buf += d;
     let nl;
     while (!settled && (nl = buf.indexOf('\n')) >= 0) {
       const line = buf.slice(0, nl);
@@ -1399,6 +1539,7 @@ export function probeSkillsOnce(cwd) {
       const init = parseInitLine(line);
       if (!init) continue;
       if (init.skills) recordSkills(init.skills);
+      if (init.mcpServers) recordMcpServers(init.mcpServers);
       finish(init.sessionId);
       return;
     }

package/bin/lib/shipMerge.mjs

@@ -1,4 +1,4 @@
-import { baseBranchName } from './git.mjs';
+import { baseBranchName, gitNet as gitNetDefault } from './git.mjs';
 
 /**
  * CARRY A SHIPPED TIP OUT ONTO BASE AND PUSH IT.
@@ -28,6 +28,10 @@ export function mergeOutward({
   baseRef,
   workingTree,
   warn,
+  // NETWORK calls only (push, fetch) — timed and non-interactive, so a
+  // stale credential or a half-open connection cannot freeze the ship
+  // path's writer lock. Injectable for tests; defaults to the real one.
+  gitNet = gitNetDefault,
 }) {
   const dropTmp = () => {
     try {
@@ -43,7 +47,7 @@ export function mergeOutward({
       ['merge', '--no-ff', tip, '-m', `ship(${label}): ${count} commit${count === 1 ? '' : 's'}`],
       tmpDir
     );
-    git(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmpDir);
+    gitNet(['push', 'origin', `HEAD:${baseBranchName(baseRef())}`], tmpDir, 120_000);
   };
   try {
     try {
@@ -74,7 +78,7 @@ export function mergeOutward({
       if (!isRaceRejection(e)) throw e;
       warn?.('ship: base moved under us — refetching and merging again');
       try {
-        git(['fetch', 'origin', '--quiet'], repoRoot);
+        gitNet(['fetch', 'origin', '--quiet'], repoRoot, 60_000);
       } catch {
         /* offline — the retry fails honestly on the same push */
       }
@@ -102,7 +106,7 @@ export function mergeOutward({
      */
     if (workingTree && branch && branch === baseBranchName(baseRef())) {
       try {
-        git(['fetch', 'origin', '--quiet'], repoRoot);
+        gitNet(['fetch', 'origin', '--quiet'], repoRoot, 60_000);
         git(['merge', '--ff-only', baseRef()], workingTree);
       } catch {
         /* a readout, not the ship — the merge already landed, and the next

package/bin/lib/trace.mjs

@@ -38,10 +38,15 @@
  * second attempt then opened at `seq: 0` against a mark of three hundred, so
  * every batch it sent was trimmed to nothing and the surface showed the
  * ABANDONED attempt's steps with the new one's tail welded on, no seam, no
- * `dropped` to say so. `run` is a nonce per relay: the server rebases an
- * unfamiliar one onto its current mark, so a second attempt appends AFTER the
- * first instead of being deleted by it, and a retry inside one run still trims
- * exactly as before.
+ * `dropped` to say so. `run` is a nonce per relay: EACH RUN KEEPS ITS OWN
+ * HIGH-WATER MARK IN ITS OWN SEQ SPACE (2026-09-24) — an unfamiliar one starts
+ * its own mark at the server's shared `hw` rather than being rebased onto it,
+ * so a second attempt appends AFTER the first instead of being deleted by it,
+ * and a retry inside one run still trims exactly as before. The first cut
+ * rebased an unfamiliar run onto the one shared mark, so a takeover's old box,
+ * still flushing its last seconds, spliced its late steps between the new
+ * run's — a superseded run's late steps are COUNTED against the shared mark
+ * now (the trace is not lost) and never SPLICED between the live run's.
  *
  * SCRUB EVERY STRING. This is the CLI's own stdout — a command echoing an env
  * var, a read of a config file — riding the same uplink the answer does. Prose
@@ -163,8 +168,13 @@ export function makeTraceRelay({ agentId, turnId, post, scrub = (s) => s, run =
         dirty = true;
         return;
       }
-      queue.splice(0, entries.length);
-      base += entries.length;
+      // Remove only what of the batch is STILL at the head: a push during the
+      // await may have shed some of it already (advancing `base`), and
+      // splicing the whole batch length would then drop entries that were
+      // never sent — a gap the buffer had room to avoid.
+      const drop = Math.max(0, seq + entries.length - base);
+      queue.splice(0, drop);
+      base += drop;
     }
   };
 

package/bin/lib/update.mjs

@@ -100,6 +100,11 @@ function reexec(teardown, { viaNpx = false, target = null } = {}) {
     env: {
       ...process.env,
       FLOWVIANT_REEXEC: '1',
+      // WHICH DAEMON THE SUCCESSOR IS REPLACING. Under npx the successor's
+      // parent is `npm exec`, not us, so the instance lock's ppid check read us
+      // as a rival and the new daemon SIGTERMed this proxy. instance.mjs adopts
+      // the lock from this pid when it is really an ancestor of the successor.
+      FLOWVIANT_REEXEC_FROM: String(process.pid),
       // WHAT WE RESTARTED IN ORDER TO BECOME. The successor compares its own
       // VERSION against this: if it came back still short, the update did not
       // take (a registry serving a stale `latest`, an npx cache that refused to