flowviant 0.96.0 → 0.99.0

package/bin/lib/claude.mjs

@@ -12,6 +12,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { SAFE } from './config.mjs';
 import { runtimeById, humanizeClaudeTool, THINK_MARKER } from './runtimes.mjs';
 
@@ -20,10 +21,106 @@ import { runtimeById, humanizeClaudeTool, THINK_MARKER } from './runtimes.mjs';
 // the strings live.
 export * from './prompts.mjs';
 
+/**
+ * THE READ GUARD, ON EVERY CURATED POSTURE (2026-09-23) — see
+ * hooks/readGuard.mjs for what it refuses and the probe that proved it fires.
+ *
+ * A `Bash(git log:*)` allow is a PREFIX: it names the program and says nothing
+ * about the arguments, and `git log --output=<path>` writes any file while
+ * `-c core.fsmonitor=…` / `--ext-diff` run a program. A reviewer landed
+ * `git log -1 --format='tformat:x' --output=pwned.txt` under RESEARCH_PERM with
+ * no denial, and it re-measured the same way here. So every list below that
+ * promises "reads, and nothing else" carries a `PreToolUse` hook through
+ * `--settings`, measured on Claude Code 2.1.281: it fires under
+ * `--allowedTools`, exit 2 blocks the call, and its sentence reaches the model.
+ *
+ * NEVER ON THE BUILD POSTURE: `--dangerously-skip-permissions` is the
+ * operator's own choice for a turn that is meant to write, and a guard there
+ * would be refusing the job. Nor on PLAN_MODE_PERM, which is the CLI's own
+ * posture on the owner's own tab, not a list this file promises anything about.
+ *
+ * The hook runs as `<this node> <readGuard.mjs>` — the daemon's own
+ * `process.execPath`, never a `node` looked up on a PATH the operator may not
+ * have, because a hook that fails to START is a non-blocking error and the
+ * command runs anyway.
+ */
+export const READ_GUARD_PATH = fileURLToPath(new URL('./hooks/readGuard.mjs', import.meta.url));
+const hookQuote = (s) =>
+  process.platform === 'win32' ? `"${s}"` : `'${String(s).replace(/'/g, `'\\''`)}'`;
+export const READ_GUARD_SETTINGS = JSON.stringify({
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: 'Bash',
+        hooks: [{ type: 'command', command: `${hookQuote(process.execPath)} ${hookQuote(READ_GUARD_PATH)}` }],
+      },
+    ],
+  },
+});
+/** Spread FIRST into a curated list: `--allowedTools` is variadic, so the
+ *  `--settings` pair must stand before it or be swallowed as a tool name. */
+const READ_GUARD = ['--settings', READ_GUARD_SETTINGS];
+
+/** A path a permission rule can name: absolute POSIX, and free of the glob and
+ *  rule-syntax characters that would change what the rule means. Anything else
+ *  gets no rule — `--add-dir` still admits the directory (measured). */
+const ruleSafeAbsolute = (p) =>
+  typeof p === 'string' && p.startsWith('/') && !/[*?[\]{}()\\\n]/.test(p) ? p.replace(/\/+$/, '') : null;
+
+/**
+ * THE READ FENCE — the worktree, plus the knowledge library by its absolute
+ * path, and nothing else on the box (2026-09-24, the audit).
+ *
+ * Every curated posture used to allow bare `Read`, `Grep` and `Glob`, and a
+ * bare allow is not "read the repo": measured on Claude Code 2.1.281, bare
+ * `Read` read a file outside the working directory and bare `Grep` searched
+ * one. So a design, consult or capture turn — each steered by words anyone who
+ * can file a card can write — could read `~/.flowviant/credentials.json`, which
+ * holds the MACHINE CREDENTIAL of every project connected on this box, and put
+ * it in an artifact, a plan note or a transcript that leaves the machine. That
+ * is a cross-project leak from a posture this file calls read-only.
+ *
+ * The fence is research's, measured the same day in the design shape:
+ * `Read(./**)` and `Glob(./**)` read the worktree; the knowledge library reads
+ * through `--add-dir` plus its own `//` rule; a file outside both was refused
+ * ("Claude requested permissions to read from …, but you haven't granted it
+ * yet"). GREP CARRIES NO ALLOW RULE AT ALL, on purpose: with none, Grep in the
+ * working directory (and in the added knowledge directory) ran, and Grep of a
+ * path outside them was refused. The Bash readers these postures keep are
+ * path-validated by the CLI on its own (see CONSULT_BASH).
+ */
+function fencedReads(knowledgeDir) {
+  const kd = ruleSafeAbsolute(knowledgeDir);
+  return [
+    'Read(./**)',
+    ...(kd ? [`Read(/${kd}/**)`] : []),
+    'Glob(./**)',
+    ...(kd ? [`Glob(/${kd}/**)`] : []),
+  ];
+}
+
+/** The shell readers CONSULT and PLAN keep. Each one is PATH-VALIDATED by the
+ *  CLI itself — measured on 2.1.281 (2026-09-24): with `Bash(cat:*)`,
+ *  `Bash(head:*)` and `Bash(ls:*)` allowed, `cat`/`ls`/`head` on a file outside
+ *  the working directories were each refused ("Claude Code may only
+ *  concatenate files from the allowed working directories") — so it is the
+ *  Read/Grep/Glob TOOLS, not these, that needed the fence above. */
+const CONSULT_BASH = [
+  'Bash(ls:*)',
+  'Bash(wc:*)',
+  'Bash(head:*)',
+  'Bash(cat:*)',
+  'Bash(git log:*)',
+  'Bash(git show:*)',
+  'Bash(git diff:*)',
+  'Bash(git rev-parse:*)',
+];
+
 /**
  * PLAN — read the repo, write the plan, never the code.
  *
- * The read half is CONSULT_PERM verbatim: this turn's prompt is steered by
+ * The read half is `consultPermFor`'s verbatim (the read fence and the
+ * path-validated shell readers): this turn's prompt is steered by
  * anything a project editor can type, so the same threat applies and the same
  * allowlist answers it. What is added is the control plane and NOTHING else —
  * `mcp__flowviant` is the plan principal's token, whose entire tool set is the
@@ -36,21 +133,15 @@ export * from './prompts.mjs';
  * through an API, and there is no file on this machine it has any business
  * touching.
  */
-const PLAN_PERM = [
-  '--allowedTools',
-  'mcp__flowviant',
-  'Read',
-  'Grep',
-  'Glob',
-  'Bash(ls:*)',
-  'Bash(wc:*)',
-  'Bash(head:*)',
-  'Bash(cat:*)',
-  'Bash(git log:*)',
-  'Bash(git show:*)',
-  'Bash(git diff:*)',
-  'Bash(git rev-parse:*)',
-];
+export function planPermFor(knowledgeDir) {
+  return [
+    ...READ_GUARD,
+    '--allowedTools',
+    'mcp__flowviant',
+    ...fencedReads(knowledgeDir),
+    ...CONSULT_BASH,
+  ];
+}
 
 // Unattended (default) skips prompts so the agent never stalls with no terminal;
 // FLOWVIANT_SAFE=1 restricts to a curated toolset instead.
@@ -81,6 +172,7 @@ const PERM = SAFE
 // after every wiki turn, and the vault has its own git history.
 // (Write/Edit can't be path-scoped here; the worktree reset is the backstop.)
 const WIKI_PERM = [
+  ...READ_GUARD,
   '--allowedTools',
   'Read',
   'Grep',
@@ -111,20 +203,155 @@ const WIKI_PERM = [
 // someone else's machine. The permission list is the enforcement; the prompt's
 // "do not change anything" is only an instruction, and instructions are exactly
 // what an injected question competes with.
-const CONSULT_PERM = [
-  '--allowedTools',
-  'Read',
-  'Grep',
-  'Glob',
-  'Bash(ls:*)',
-  'Bash(wc:*)',
-  'Bash(head:*)',
-  'Bash(cat:*)',
-  'Bash(git log:*)',
-  'Bash(git show:*)',
-  'Bash(git diff:*)',
-  'Bash(git rev-parse:*)',
-];
+export function consultPermFor(knowledgeDir) {
+  return [...READ_GUARD, '--allowedTools', ...fencedReads(knowledgeDir), ...CONSULT_BASH];
+}
+
+/**
+ * THE TWO NON-CODE POSTURES (0.97.0) — a design card and a research card may
+ * WRITE, and only under `.flowviant/artifacts/`.
+ *
+ * The card's words are steered by anyone who can file a card, so "change
+ * nothing" as prose is only an instruction, and the permission list is the
+ * enforcement. What each carries is the ONE write its contract needs:
+ *
+ *  · `Edit(.flowviant/artifacts/**)` — PROBED on Claude Code 2.1.281 before
+ *    relying on it (2026-09-23): with `--allowedTools 'Read'
+ *    'Edit(.flowviant/artifacts/**)'`, a `-p` turn told to write
+ *    `.flowviant/artifacts/a.html` AND `b.txt` at the root wrote the first and
+ *    was DENIED the second. The Edit rule governs every file-writing tool,
+ *    Write included. Spelled `Write(.flowviant/artifacts/**)` — or `./`- or
+ *    `//abs`-anchored — the same probe was denied BOTH files, so that spelling
+ *    is not a scoped write at all, it is no write. Relative to the turn's cwd,
+ *    which is the agent's own worktree, which is where the artifact scan looks.
+ *    `**` AND NOT `*`, measured the same day: `Edit(.flowviant/artifacts/*)`
+ *    let a Write to `.flowviant/artifacts/sub/b.html` through exactly as `**`
+ *    did, so the single-level spelling is not narrower on this CLI and would
+ *    only read as if it were. The scan keeps top-level files, so the
+ *    contracts say "no subfolders" — the prompt is the only thing that can.
+ *
+ * THEY ARE NOT THE SAME READER, and the difference is the network:
+ *
+ *  · DESIGN draws THIS product, so it reads the repo — the worktree and the
+ *    knowledge library through the read fence (`fencedReads`, 2026-09-24:
+ *    it was bare Read/Grep/Glob, which reach the whole box), Grep with no
+ *    allow rule, `ls`, and `.env*` denied by name — and has no web at all (a mockup that went looking on the
+ *    web would be a mockup of somebody else's product). No git readers and no
+ *    cat/head/wc: Read covers every one of them, and each git reader was an
+ *    `--output` away from a write (see READ_GUARD, which it still carries for
+ *    the `ls` it keeps).
+ *  · RESEARCH has the web — WebSearch and WebFetch — and a turn that can both
+ *    read a secret and fetch a URL can send one. So its reading is FENCED to
+ *    what the card is about: `Read(./**)` (the worktree) plus the project's
+ *    knowledge library by its absolute path, `Glob(./**)` for names, NO Grep
+ *    (an unscoped search of the home directory prints matching lines), NO
+ *    Bash at all, and `.env*` DENIED by name. PROBED on 2.1.281, the whole
+ *    list with `--add-dir <knowledge>`: a file in the cwd read; `/etc/hostname`,
+ *    a sibling directory's file and `~/.flowviant/credentials.json` were each
+ *    refused ("Claude requested permissions to read from …, but you haven't
+ *    granted it yet"); `.env` was refused ("File is in a directory that is
+ *    denied by your permission settings"); the knowledge file read. Two
+ *    controls: WITHOUT the `--disallowedTools` pair, `Read(./**)` read `.env`
+ *    — the deny is load-bearing; and a bare `Glob` listed `~/.flowviant`
+ *    while `Glob(./**)` refused it and still listed the cwd and the added
+ *    directory. The knowledge `Read(//…)` rule is belt: `--add-dir` alone
+ *    admitted the file, and the rule keeps the read allowed should the
+ *    adapter ever stop passing that flag.
+ *    AND `Bash` IS DENIED BY NAME, because leaving it off the allow list is
+ *    not "no Bash": measured the same day, with Bash absent from
+ *    `--allowedTools` the CLI still ran `git log -1 --format=%s` and `ls` on
+ *    its own read-only classifier (it did refuse `git log … --output=…`,
+ *    "This command requires approval" — the reviewer's write needed the
+ *    explicit `Bash(git log:*)` prefix the old list carried). With `Bash` in
+ *    `--disallowedTools` the tool was not there at all.
+ *
+ * NO MCP, and no shell that could commit: the agent turn has no MCP anyway
+ * (see SYSTEM_AGENT's header), and a posture that could run `git commit` could
+ * commit the mockup it was told to keep out of git.
+ *
+ * STATED, not closed: research may still read any file in the worktree and
+ * name it in a WebFetch URL — the repository is what a research card is about,
+ * and a turn that could not read it could not answer. Design may read any
+ * file in its worktree and put it in an artifact the server stores; text
+ * artifacts are scrubbed of the machine's known secret values — and of any
+ * Flowviant credential, by shape — on the way out (artifacts.mjs, env.mjs), and
+ * binary ones are withheld when they carry one.
+ * Design still runs a plain `git log` on the CLI's own read-only classifier
+ * though no git reader is allowed (measured) — the guard is what refuses its
+ * `--output`. And the Agent tool is offered with no allow rule on this CLI:
+ * a research turn with Bash denied launched a subagent to run one, and the
+ * subagent had no Bash either (measured) — the rules are inherited. Whether
+ * the guard's hook sees a subagent's own calls was not measured here.
+ */
+const ARTIFACT_WRITE = 'Edit(.flowviant/artifacts/**)';
+/**
+ * PLAN MODE (0.97.0) — a Workbench tab's `planMode` switch, and Claude Code's
+ * own `--permission-mode plan` INSTEAD OF every list above: the CLI reads,
+ * decides and answers with a plan, and refuses each write itself.
+ *
+ * PROBED on Claude Code 2.1.281 before relying on it (2026-09-23), in a scratch
+ * git repo, `-p … --output-format stream-json --verbose`:
+ *
+ *  · ALONE, asked to "add a subtract(a, b) function to app.js": the init event
+ *    reads `permissionMode: "plan"`, the turn Read the file, ran a read-only
+ *    `find`, wrote its plan to `~/.claude/plans/<slug>.md` (the CLI's own plan
+ *    file, outside the repo), tried `ExitPlanMode` and was told "Error: No such
+ *    tool available: ExitPlanMode. ExitPlanMode is disabled for this session",
+ *    and ended with the plan as its result text. app.js was untouched.
+ *  · BESIDE `--dangerously-skip-permissions`, same ask: the init event reads
+ *    `permissionMode: "bypassPermissions"` — no error, no warning — and the
+ *    edit LANDED. The bypass silently wins. So this list is a REPLACEMENT for
+ *    `perm`, never an addition, and a plan turn can never carry both.
+ *  · WITH `--mcp-config` and `--allowedTools mcp__flowviant`: the server
+ *    connected and its tools were listed, but a call was refused — "Cannot
+ *    call mcp__flowviant__log_work while in plan mode." — and without the
+ *    `--allowedTools` entry, "Claude requested permissions to use
+ *    mcp__flowviant__log_work, but you haven't granted it yet." Plan mode
+ *    admitted the call ONLY when the server annotated the tool
+ *    `readOnlyHint: true`, and none of the session tools (stream_session_turn,
+ *    log_work, file_card …) are read-only or annotated so. So a plan turn runs
+ *    PLAIN — no MCP, the plain tab's contract — rather than mounting a control
+ *    plane whose every call the CLI refuses. See work.mjs.
+ */
+export const PLAN_MODE_PERM = ['--permission-mode', 'plan'];
+export function designPermFor(knowledgeDir) {
+  return [
+    ...READ_GUARD,
+    '--allowedTools',
+    ...fencedReads(knowledgeDir),
+    'Bash(ls:*)',
+    ARTIFACT_WRITE,
+    // A mockup is uploaded and runs scripts in a frame that may navigate
+    // itself, so the checkout's own secrets are denied by name too — the same
+    // pair research carries, measured load-bearing there.
+    '--disallowedTools',
+    'Read(./.env*)',
+    'Read(./**/.env*)',
+  ];
+}
+export const DESIGN_PERM = designPermFor(null);
+
+/**
+ * RESEARCH, built at spawn — the knowledge library is the one directory
+ * outside the worktree it may read, and only the spawn knows where that is.
+ * `//` is the CLI's own spelling for an absolute path in a rule.
+ */
+export function researchPerm(knowledgeDir) {
+  return [
+    ...READ_GUARD,
+    '--allowedTools',
+    ...fencedReads(knowledgeDir),
+    'WebSearch',
+    'WebFetch',
+    ARTIFACT_WRITE,
+    '--disallowedTools',
+    'Read(./.env*)',
+    'Read(./**/.env*)',
+    'Bash',
+  ];
+}
+/** The list with no library — what a project that keeps none runs under. */
+export const RESEARCH_PERM = researchPerm(null);
 
 export const sleep = (s) => new Promise((r) => setTimeout(r, s * 1000));
 
@@ -132,10 +359,26 @@ export const sleep = (s) => new Promise((r) => setTimeout(r, s * 1000));
 // matching falsely fired when an agent merely *mentioned* the word in prose
 // (e.g. "I won't fabricate a BLOCKED:<id> line"), trapping the worker in a fake
 // blocked loop. Anchor to a full line instead.
-export const sawSentinel = (out, name) => new RegExp(`^\\s*${name}\\s*$`, 'm').test(out);
+//
+// LINE-SPLIT, NEVER A `^...$` REGEX WITH A `\s*` ON BOTH ENDS (audit
+// 2026-09-24). `new RegExp('^\\s*NAME\\s*$', 'm')` and
+// `/^\s*BLOCKED:(\S+)\s*$/m` are QUADRATIC against a long run of
+// whitespace on one line — the same shape `taskIdsFromMessage` already had
+// to fix, measured ~0.5s at 40KB here — and a CLI's own stdout is exactly
+// the kind of text a stray control sequence or a pasted blob can grow past
+// that. A length cap first, then plain string work, same as there.
+const SENTINEL_MAX_LINE = 2000;
+export const sawSentinel = (out, name) =>
+  String(out ?? '')
+    .split('\n')
+    .some((l) => l.length < SENTINEL_MAX_LINE && l.trim() === name);
 export const blockedId = (out) => {
-  const m = out.match(/^\s*BLOCKED:(\S+)\s*$/m);
-  return m ? m[1] : null;
+  for (const l of String(out ?? '').split('\n')) {
+    if (l.length > SENTINEL_MAX_LINE) continue;
+    const t = l.trim();
+    if (t.startsWith('BLOCKED:') && /^BLOCKED:\S+$/.test(t)) return t.slice(8);
+  }
+  return null;
 };
 
 /**
@@ -300,10 +543,17 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
     // ADOPTABLE — so any headless turn we run for our own purposes would leave
     // a phantom untitled session in the `+` menu. The caller that needs to
     // clean up after itself cannot do so without this id.
-    if (Array.isArray(ev.skills) || typeof ev.session_id === 'string') {
+    //
+    // `mcpServers` (0.97.0) is the same kind of fact from the same event: the
+    // MCP servers and claude.ai connectors the CLI mounted, each with its own
+    // status (`needs-auth` above all — a sign-in that has to happen at this
+    // box). Relayed raw; `recordMcpServers` (runtimes.mjs) normalises it and
+    // drops this daemon's own `flowviant` server.
+    if (Array.isArray(ev.skills) || typeof ev.session_id === 'string' || Array.isArray(ev.mcp_servers)) {
       onInit?.({
         skills: Array.isArray(ev.skills) ? ev.skills.map(String) : undefined,
         sessionId: typeof ev.session_id === 'string' ? ev.session_id : undefined,
+        mcpServers: Array.isArray(ev.mcp_servers) ? ev.mcp_servers : undefined,
       });
     }
   } else if (ev.type === 'result') {
@@ -342,6 +592,27 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
   }
 }
 
+/**
+ * THE ENVIRONMENT A CLI TURN IS SPAWNED WITH — the daemon's own, plus the
+ * turn's MCP token, MINUS the machine credential (2026-09-24, the audit).
+ *
+ * A turn cannot be handed a curated environment the way `childEnv` builds one
+ * for a deploy: the CLI's own sign-in lives in this environment, and stripping
+ * it signs the CLI out. But on a headless box started as
+ * `FLOWVIANT_MACHINE_TOKEN=… npx flowviant` the MACHINE CREDENTIAL lives here
+ * too, and every turn — and every dev server and script a turn starts, which
+ * inherit it — could read it with one `env`. Nothing a CLI or its children do
+ * needs it: the daemon authenticates to the server itself, and a turn that
+ * needs the project's tools gets its own per-turn token through `mcpEnv` or
+ * the MCP config file. So those two names, and only those, are removed.
+ */
+const MACHINE_CREDENTIAL_ENV = ['FLOWVIANT_MACHINE_TOKEN', 'FLOWVIANT_FLEET'];
+export function cliEnv(mcpEnv) {
+  const env = { ...process.env, ...(mcpEnv ?? {}) };
+  for (const k of MACHINE_CREDENTIAL_ENV) delete env[k];
+  return env;
+}
+
 // One Claude Code turn. Output is captured (for sentinel detection) and streamed
 // through, line-prefixed with the worker label so a fleet stays legible.
 //
@@ -351,9 +622,32 @@ export function handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, app
 // returned string for sentinel detection, and each activity is handed to
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
-export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onThreadId, wikiPerm, readOnly, planPerm, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
+export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onThreadId, onAnswer, wikiPerm, readOnly, planPerm, planMode, posture, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId }) {
   return new Promise((resolve) => {
     const rt = runtimeById(runtime);
+    // PLAN MODE IS CLAUDE'S (0.97.0). The other adapters build their argv
+    // from `profile` and never read `perm`, so a codex or agy turn handed
+    // `planMode` would run a BUILD turn wearing the word "plan". The caller
+    // refuses first, in words; this is the belt — fail the turn, never
+    // substitute.
+    if (planMode && rt.id !== 'claude') {
+      console.error(`\nerror: plan mode runs on Claude Code only — not '${rt.label}'`);
+      resolve('');
+      return;
+    }
+    // …AND SO ARE THE TWO NON-CODE POSTURES, for the same reason and in the
+    // same shape. The agent lane asks `canRun` first and settles `nothing` in
+    // words; this is the layer no caller can skip. A codex or agy adapter
+    // handed `posture: 'design'` never reads `perm` — it builds from `profile`
+    // and runs whatever that falls back to, which for codex is its build
+    // branch, `--sandbox danger-full-access`: a research card's words with the
+    // whole machine to act on. Asked against the runtime's own declared profiles,
+    // so the day an adapter learns to express one this opens by itself.
+    if ((posture === 'design' || posture === 'research') && !(rt.profiles ?? []).includes(posture)) {
+      console.error(`\nerror: a ${posture} card runs on Claude Code only — not '${rt.label}'`);
+      resolve('');
+      return;
+    }
     if (!rt.args) {
       // Reached only if a brief names a runtime this daemon declares but cannot
       // drive. Fail as a turn with no sentinel — the loop already treats that as
@@ -385,7 +679,15 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
     // of the two and a planning turn that fell through to 'consult' would lose
     // the control plane it exists to use — it would read the repo, decide what
     // the slices are, and have no way to write any of them down.
-    const profile = planPerm ? 'plan' : readOnly ? 'consult' : wikiPerm ? 'wiki' : 'build';
+    // A DESIGN OR RESEARCH CARD'S POSTURE (0.97.0) is asked before all of
+    // them, by NAME, because it is the narrowest promise here: write only the
+    // artifacts directory. It is set only by the agent lane, from the card's
+    // kind; every other caller passes nothing and gets exactly the branch it
+    // got before this existed.
+    const profile =
+      posture === 'design' || posture === 'research'
+        ? posture
+        : planPerm ? 'plan' : readOnly ? 'consult' : wikiPerm ? 'wiki' : 'build';
     const args = rt.args({
       prompt,
       system,
@@ -394,6 +696,7 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       resume,
       streamJson,
       profile,
+      agentTools,
       // Adopting a terminal session (work.mjs): Claude turns it into
       // `--resume <id> --fork-session` (a FORK — the original is untouched);
       // agy turns it into `--conversation <id>` (a MOVE — agy has no fork, the
@@ -418,12 +721,25 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       // prompt as a trailing positional, so a flag after it is in the wrong
       // place.
       resultSchemaArgs,
-      perm: planPerm ? PLAN_PERM : readOnly ? CONSULT_PERM : wikiPerm ? WIKI_PERM : PERM,
+      // PLAN MODE REPLACES THE POSTURE, never joins it: beside
+      // `--dangerously-skip-permissions` the bypass wins silently (measured —
+      // see PLAN_MODE_PERM).
+      perm: planMode
+        ? PLAN_MODE_PERM
+        : profile === 'design'
+          ? designPermFor(knowledgeDir)
+          : profile === 'research'
+            ? researchPerm(knowledgeDir)
+            : planPerm
+              ? planPermFor(knowledgeDir)
+              : readOnly
+                ? consultPermFor(knowledgeDir)
+                : wikiPerm ? WIKI_PERM : PERM,
       // Handed to the adapter rather than appended here, because WHERE these go
       // is a property of the CLI: Codex reads its prompt as a trailing
       // positional, so a flag after it is a flag in the wrong place.
       // Wiki-vault turns are pure file work and pass neither — no MCP at all.
-      mcp: mcpConfig ? ['--mcp-config', mcpConfig] : (mcpArgs ?? []),
+      mcp: planMode ? ['--strict-mcp-config'] : mcpConfig ? ['--mcp-config', mcpConfig] : (mcpArgs ?? []),
       // Resuming a SPECIFIC held conversation by its own id (work.mjs, codex
       // sessions). Runtimes without a by-id resume ignore it and keep their
       // `resume` behavior unchanged.
@@ -469,8 +785,9 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       detached: true,
       // Only ADDS to the environment (the worker token, for runtimes that read
       // it from there). Never replaces it: the CLI's own credentials live in
-      // this environment, and handing it a curated one signs it out.
-      ...(mcpEnv ? { env: { ...process.env, ...mcpEnv } } : {}),
+      // this environment, and handing it a curated one signs it out. The one
+      // thing it REMOVES is this daemon's machine credential — see `cliEnv`.
+      env: cliEnv(mcpEnv),
     });
     onSpawn?.(child);
     let out = '';
@@ -497,14 +814,28 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
         // thread.started). Purely additive: callers that pass no onThreadId —
         // every dispatch path — see zero behavior change.
         if (ev.threadId) onThreadId?.(ev.threadId);
+        // The runtime's own token count (codex's `turn.completed`) — the same
+        // `onUsage` Claude's result event feeds, so a caller charges a turn
+        // identically whichever CLI ran it.
+        if (ev.usage) onUsage?.(ev.usage);
+        // One agent MESSAGE, alone — see parseCodexLine's `answer`. Last call
+        // wins at the caller, which is what "the final answer" means.
+        if (typeof ev.answer === 'string') onAnswer?.(ev.answer);
         if (ev.text) appendText(ev.text);
         if (ev.activity) {
           emit(`${ev.activity.label}\n`);
           onActivity?.(ev.activity);
         }
       };
+      // DECODED AS A STREAM, never chunk by chunk (2026-09-24, the audit): a
+      // pipe read can end inside a multi-byte character — the em dash models
+      // write constantly — and `d.toString()` per chunk turned each half into
+      // U+FFFD, which JSON.parse accepts and the reply then carried verbatim.
+      // `setEncoding` holds the partial bytes over to the next chunk.
+      child.stdout.setEncoding('utf8');
+      child.stderr.setEncoding('utf8');
       child.stdout.on('data', (d) => {
-        buf += d.toString();
+        buf += d;
         let nl;
         while ((nl = buf.indexOf('\n')) >= 0) {
           const line = buf.slice(0, nl);
@@ -513,8 +844,7 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
         }
       });
       // stderr is not JSON (warnings/errors) — pass through and keep for sentinels.
-      child.stderr.on('data', (d) => {
-        const s = d.toString();
+      child.stderr.on('data', (s) => {
         out += s;
         emit(s);
       });
@@ -543,11 +873,13 @@ export function runTurn({ prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEn
       return;
     }
 
-    const onChunk = (d) => {
-      const s = d.toString();
+    const onChunk = (s) => {
       out += s;
       emit(s);
     };
+    // Stream-decoded for the same reason as the line-parsed path above.
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
     child.stdout.on('data', onChunk);
     child.stderr.on('data', onChunk);
     child.on('error', (e) => {

package/bin/lib/config.mjs

@@ -327,7 +327,30 @@ export let FLEET_TOKEN =
  * A frozen copy read at import would salt a picked project's report with null
  * and report nothing at all, for the whole life of the process.
  */
-export let PROJECT_ID = CREDENTIAL.entry?.projectId ?? null;
+export let PROJECT_ID =
+  CREDENTIAL.entry?.fleetToken && CREDENTIAL.entry.fleetToken === FLEET_TOKEN
+    ? (CREDENTIAL.entry.projectId ?? null)
+    : null;
+
+/**
+ * THE STORE'S PROJECT IS THIS DAEMON'S ONLY WHEN IT IS THIS DAEMON'S TOKEN.
+ * `FLEET_TOKEN` prefers `--fleet` and the environment over the store, and the
+ * id above used to come from the store unconditionally — so a box holding one
+ * unbound project A, started with project B's token in the environment, salted
+ * B's env report with A's id (every variable then read `differs` beside B's
+ * other boxes, the confident wrong answer the salt exists to prevent) and
+ * printed "serves · A". It starts null in that case, and the ROSTER's own word
+ * settles it here on the first poll — the "names no project until the roster
+ * does" the paragraph above always promised and nothing ever did.
+ */
+export function learnProjectId(id) {
+  if (typeof id === 'string' && id) PROJECT_ID = id;
+}
+
+/** Whether the stored resolution describes the token actually in use. */
+export function storedCredentialInUse() {
+  return Boolean(CREDENTIAL.entry?.fleetToken) && CREDENTIAL.entry.fleetToken === FLEET_TOKEN;
+}
 
 /** cli.mjs's picker chose. Must run BEFORE runFleetDaemon — nothing here
  *  re-authenticates a connection already made. */

package/bin/lib/credentials.mjs

@@ -48,6 +48,7 @@ import { execFileSync } from 'node:child_process';
 import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { printable } from './printable.mjs';
 
 const CRED_DIR = join(homedir(), '.flowviant');
 const CRED_FILE = join(CRED_DIR, 'credentials.json');
@@ -133,7 +134,28 @@ export function listStoredProjects() {
 
 /** What a project is CALLED on a terminal: its name, or an id you can grep. */
 export function projectLabel(e) {
-  return e?.name ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
+  return safeName(e?.name) ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
+}
+
+/**
+ * A SERVER-SUPPLIED NAME, SAFE TO PRINT ON A TERMINAL — or null.
+ *
+ * A project's name is whatever an owner typed in the app, and the server's
+ * schema caps its length and nothing else. Printed raw it reaches every
+ * terminal that connects a machine to the project — `login`, the banner, the
+ * picker, `projects`, `machines` — and a name carrying an escape sequence can
+ * rewrite the clipboard (OSC 52 in kitty, WezTerm, Windows Terminal) or hide
+ * lines of the very listing whose job is to say which project is which. The
+ * scrub is `printable()` (C0, DEL, C1 — the server's own `parseBoxName` makes
+ * the same cut for hostnames — plus the bidi/format controls that reorder a
+ * line, added 2026-09-24 rather than re-derived: see printable.mjs), and what
+ * is left is trimmed; nothing left is null, so the caller's id fallback
+ * speaks instead of an empty label.
+ */
+export function safeName(name) {
+  if (typeof name !== 'string') return null;
+  const clean = printable(name).trim();
+  return clean || null;
 }
 
 /**
@@ -316,7 +338,7 @@ export function saveLogin({ fleetToken, projectId, mcpUrl, name, repoRoot }) {
       ...(f.projects[projectId] ?? {}),
       fleetToken,
       mcpUrl: mcpUrl ?? null,
-      ...(name ? { name } : {}),
+      ...(safeName(name) ? { name: safeName(name) } : {}),
       ...(repoRoot ? { repoRoot } : {}),
       savedAt: new Date().toISOString(),
     };
@@ -391,8 +413,9 @@ export function bindStoredRepo(projectId, repoRoot) {
 
 /** The roster names the project on every poll; remember it so the picker and
  *  `flowviant projects` can say a NAME instead of an id. */
-export function setStoredProjectName(projectId, name) {
-  if (!projectId || typeof name !== 'string' || !name) return;
+export function setStoredProjectName(projectId, raw) {
+  const name = safeName(raw);
+  if (!projectId || !name) return;
   const entries = listStoredProjects();
   const e = entries.find((x) => x.projectId === projectId);
   if (!e || e.name === name) return;