flowviant 0.97.0 → 0.99.0

package/bin/lib/processes.mjs

@@ -47,7 +47,13 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync, readdirSync } from 'node:fs';
 import { platform } from 'node:os';
 
-/** A box with more processes than this is not one we walk per sweep. */
+/** Matched rows collected per scan before the walk stops early — a bound on
+ *  the WORK done for one pathological group, never on which part of /proc is
+ *  looked at. It used to cut the pid LIST before filtering, and readdir answers
+ *  in string order, so a busy box kept '1', '10', '100'… and dropped a tab's
+ *  watcher at pid 912345 while `liveGroups` (which has no cap) still called its
+ *  group alive: the tab read "looked, found none" and a Stop on it answered
+ *  not_found. */
 const MAX_PIDS = 4000;
 /** Rows reported per session. A watcher, a dev server and its child is three;
  *  twenty is somebody's compose stack and the extra rows say nothing. */
@@ -113,25 +119,32 @@ function cmdlineOf(pid) {
   }
 }
 
-function scanLinux(pgids) {
+/** Exported with its readers injectable ONLY so the scan-order property can be
+ *  pinned without a box that runs four thousand processes. Nothing in the
+ *  daemon passes `io`. */
+export function scanLinux(pgids, io = {}) {
+  const list = io.list ?? (() => readdirSync('/proc'));
+  const pgrpFor = io.pgrpOf ?? pgrpOf;
+  const cmdFor = io.cmdlineOf ?? cmdlineOf;
+  const rssFor = io.rssBytes ?? rssBytes;
   let pids;
   try {
-    pids = readdirSync('/proc').filter((d) => /^\d+$/.test(d));
+    pids = list().filter((d) => /^\d+$/.test(d));
   } catch {
     return [];
   }
-  if (pids.length > MAX_PIDS) pids = pids.slice(0, MAX_PIDS);
 
   const out = [];
   for (const raw of pids) {
+    if (out.length >= MAX_PIDS) break;
     const pid = Number(raw);
-    const pgrp = pgrpOf(raw);
+    const pgrp = pgrpFor(raw);
     if (pgrp === null || !pgids.has(pgrp)) continue;
     // The CLI itself — its argv is the prompt. See the header.
     if (pid === pgrp) continue;
-    const cmd = cmdlineOf(raw);
+    const cmd = cmdFor(raw);
     if (!cmd) continue;
-    const rss = rssBytes(raw);
+    const rss = rssFor(raw);
     out.push({ pid, pgid: pgrp, cmd, ...(rss != null ? { rss } : {}) });
   }
   return out;

package/bin/lib/projectTools.mjs

@@ -0,0 +1,248 @@
+/** Repo-owned tool configuration, read from the base ref for every agent turn. */
+import { execFileSync } from 'node:child_process';
+import { accessSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
+import { homedir, tmpdir } from 'node:os';
+
+const MAX_TOOLS = 40;
+const MAX_REPORT_TOOLS = 80; // 40 MCP servers plus 40 instruction directories
+const MAX_INSTRUCTION_FILES = 80;
+const MAX_INSTRUCTION_BYTES = 512 * 1024;
+const nameOk = (name) => /^[A-Za-z0-9_-]{1,80}$/.test(name) && name !== 'flowviant';
+const toml = (value) => JSON.stringify(String(value));
+const show = (root, ref, path) => {
+  try {
+    return execFileSync('git', ['show', `${ref}:${path}`], {
+      cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
+    });
+  } catch { return null; }
+};
+const showBytes = (root, ref, path) => {
+  try {
+    return execFileSync('git', ['show', `${ref}:${path}`], {
+      cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
+    });
+  } catch { return null; }
+};
+
+function onPath(command, env) {
+  if (isAbsolute(command)) {
+    try { accessSync(command, constants.X_OK); return true; } catch { return false; }
+  }
+  if (command.includes('/') || command.includes('\\')) return false;
+  return (env.PATH ?? '').split(delimiter).some((dir) => {
+    try { accessSync(join(dir, command), constants.X_OK); return true; } catch { return false; }
+  });
+}
+
+function referenced(value) {
+  return [...String(value).matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
+}
+
+/** Pure mapping used before a future tool-attach gesture is offered. */
+export function runnerToolCapabilities(runner) {
+  return ({ claude: { mcp: true, skills: true }, codex: { mcp: true, skills: true }, antigravity: { mcp: false, skills: false } })[runner]
+    ?? { mcp: false, skills: false };
+}
+
+export function readBaseTools(root, ref, env = process.env) {
+  // Resolve once: a base branch may advance while the turn is being prepared.
+  const commit = execFileSync('git', ['rev-parse', '--verify', ref], {
+    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+  }).trim();
+  const raw = show(root, commit, '.mcp.json');
+  let servers = {};
+  if (raw != null) {
+    try { servers = JSON.parse(raw).mcpServers ?? {}; } catch { servers = {}; }
+  }
+  const entries = Object.entries(servers).filter(([name, value]) => nameOk(name) && value && typeof value === 'object').slice(0, MAX_TOOLS);
+  const skills = [];
+  const skillFiles = [];
+  try {
+    const paths = execFileSync('git', ['ls-tree', '-r', '--name-only', commit, '--', '.claude/skills'], {
+      cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
+    }).split('\n');
+    let bytes = 0;
+    for (const path of paths) {
+      if (!/^\.claude\/skills\/[A-Za-z0-9_-]+\/(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+$/.test(path)) continue;
+      if (skillFiles.length >= 200 || bytes >= 4 * 1024 * 1024) break;
+      const body = showBytes(root, commit, path);
+      if (body == null) continue;
+      bytes += body.length;
+      if (bytes > 4 * 1024 * 1024) break;
+      skillFiles.push({ path, body });
+      if (path.endsWith('/SKILL.md') && path.split('/').length === 4 && skills.length < MAX_TOOLS) skills.push({ path, body: body.toString('utf8') });
+    }
+  } catch { /* no skills at this ref */ }
+  const tools = entries.map(([name, config]) => {
+    const vars = new Set();
+    for (const value of [config.command, config.url, ...(Array.isArray(config.args) ? config.args : []), ...Object.values(config.env ?? {}), ...Object.values(config.headers ?? {})]) {
+      for (const key of referenced(value)) vars.add(key);
+    }
+    const missing = [...vars].filter((key) => !env[key]).sort();
+    const commandMissing = typeof config.command === 'string' && !onPath(expand(config.command, env), env);
+    const unsupported = typeof config.command !== 'string' && typeof config.url !== 'string';
+    const reason = missing.length ? `env ${missing.join(', ')} unset` : commandMissing ? `command ${config.command} not on PATH` : unsupported ? 'MCP configuration unsupported' : null;
+    return { name, config, state: reason ? 'missing' : 'ready', reason };
+  });
+  // Nested instructions are normally discovered when a CLI enters that path.
+  // Their worktree copies must not regain authority through that discovery.
+  const instructions = [];
+  const paths = execFileSync('git', ['ls-tree', '-r', '--name-only', commit], {
+    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024,
+  }).split('\n').filter((path) => /(^|\/)(CLAUDE|AGENTS)\.md$/.test(path));
+  if (paths.length > MAX_INSTRUCTION_FILES) throw new Error('Base branch has too many agent instruction files');
+  let instructionBytes = 0;
+  for (const path of paths) {
+    const body = show(root, commit, path);
+    if (body == null) throw new Error(`Cannot read base instruction ${path}`);
+    instructionBytes += Buffer.byteLength(body);
+    if (instructionBytes > MAX_INSTRUCTION_BYTES) throw new Error('Base branch agent instructions exceed the turn limit');
+    instructions.push({ path, body });
+  }
+  return { tools, skills, skillFiles, instructions };
+}
+
+const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
+
+/** Keep personal Codex files, but do not copy its project trust grants. An
+ * untrusted worktree's .codex/config.toml is ignored by Codex 0.156.1. */
+function isolatedCodexHome(dir, env, worktree) {
+  const source = resolve(env.CODEX_HOME || join(homedir(), '.codex'));
+  const dest = join(dir, 'codex-home');
+  mkdirSync(dest, { mode: 0o700 });
+  if (existsSync(source)) {
+    for (const name of readdirSync(source)) {
+      if (name === 'config.toml') continue;
+      symlinkSync(join(source, name), join(dest, name));
+    }
+  }
+  const configPath = join(source, 'config.toml');
+  const sourceConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
+  const topLevel = sourceConfig.split(/^\s*\[/m, 1)[0];
+  const personalDeveloperInstructions = /^\s*developer_instructions\s*=/m.test(topLevel);
+  // These sections alone grant a checkout permission to supply project
+  // settings. Keep every other personal setting, skill and session store.
+  const lines = sourceConfig.split('\n');
+  let inProject = false;
+  let config = lines.filter((line) => {
+    const header = /^\s*(?:\[\[([^\]]+)\]\]|\[([^\]]+)\])\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      const section = header[1] ?? header[2];
+      inProject = section === 'projects' || section.startsWith('projects.');
+    }
+    return !inProject;
+  }).join('\n');
+  if (worktree) {
+    // Codex discovers these even in an untrusted project. Disable exactly the
+    // worktree skill paths; the person's ~/.codex/skills and config remain.
+    const worktreeSkills = [];
+    for (const sourceDir of ['.agents/skills', '.codex/skills', '.claude/skills']) {
+      const skillsDir = join(worktree, sourceDir);
+      if (!existsSync(skillsDir)) continue;
+      for (const name of readdirSync(skillsDir)) {
+        const skill = join(skillsDir, name, 'SKILL.md');
+        if (existsSync(skill)) worktreeSkills.push(skill);
+      }
+    }
+    if (worktreeSkills.length && /^\s*skills\.config\s*=/m.test(config))
+      throw new Error('Cannot isolate Codex project skills with inline skills.config');
+    for (const skill of worktreeSkills) config += `\n[[skills.config]]\npath = ${toml(skill)}\nenabled = false\n`;
+  }
+  writeFileSync(join(dest, 'config.toml'), config, { mode: 0o600 });
+  return { path: dest, personalDeveloperInstructions };
+}
+
+/** Temporary per-turn files are removed after the last retry. No personal CLI config is written. */
+export function prepareAgentTools(snapshot, runner, env = process.env, worktree = null) {
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
+  const caps = runnerToolCapabilities(runner);
+  const usable = snapshot.tools.filter((t) => t.state === 'ready' && caps.mcp && !(runner === 'codex' && t.config.type === 'sse'));
+  const mcpServers = {};
+  const codexArgs = [];
+  for (const { name, config } of usable) {
+    if (typeof config.command === 'string') {
+      const command = expand(config.command, env);
+      const args = Array.isArray(config.args) ? config.args.map((v) => expand(v, env)) : [];
+      const vars = Object.fromEntries(Object.entries(config.env ?? {}).map(([k, v]) => [k, expand(v, env)]));
+      mcpServers[name] = { command, args, env: vars };
+      codexArgs.push('-c', `mcp_servers.${name}.command=${toml(command)}`);
+      codexArgs.push('-c', `mcp_servers.${name}.args=${JSON.stringify(args)}`);
+      for (const [key, value] of Object.entries(vars)) {
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) codexArgs.push('-c', `mcp_servers.${name}.env.${key}=${toml(value)}`);
+      }
+    } else if (typeof config.url === 'string') {
+      const url = expand(config.url, env);
+      const headers = Object.fromEntries(Object.entries(config.headers ?? {}).map(([k, v]) => [k, expand(v, env)]));
+      mcpServers[name] = { type: config.type ?? 'http', url, ...(Object.keys(headers).length ? { headers } : {}) };
+      codexArgs.push('-c', `mcp_servers.${name}.url=${toml(url)}`);
+      if (Object.keys(headers).length) {
+        const inline = Object.entries(headers).map(([key, value]) => `${toml(key)}=${toml(value)}`).join(',');
+        codexArgs.push('-c', `mcp_servers.${name}.http_headers={${inline}}`);
+      }
+    }
+  }
+  const mcpPath = join(dir, 'mcp.json');
+  writeFileSync(mcpPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
+  const pointers = [];
+  for (const { path, body } of [...snapshot.instructions, ...(caps.skills ? snapshot.skillFiles : [])]) {
+    const dest = join(dir, path);
+    mkdirSync(join(dest, '..'), { recursive: true });
+    writeFileSync(dest, body, { mode: 0o600 });
+    if (!path.startsWith('.claude/skills/') || path.endsWith('/SKILL.md')) pointers.push(`${path}: ${dest}`);
+  }
+  const baseInstructions = snapshot.instructions.map(({ path, body }) => `Base ${path}:\n${body}`).join('\n\n');
+  const instructions = [baseInstructions,
+    pointers.length ? `Base-branch instruction and skill copies (read the relevant nested files and skill files before acting):\n${pointers.join('\n')}` : '',
+  ].filter(Boolean).join('\n\n');
+  const pluginDir = runner === 'claude' && snapshot.skillFiles.length ? join(dir, 'reviewed-plugin') : null;
+  if (pluginDir) {
+    mkdirSync(join(pluginDir, '.claude-plugin'), { recursive: true });
+    writeFileSync(join(pluginDir, '.claude-plugin/plugin.json'), JSON.stringify({ name: 'flowviant-reviewed', version: '1.0.0', description: 'Base-branch agent skills' }), { mode: 0o600 });
+    for (const { path, body } of snapshot.skillFiles) {
+      const dest = join(pluginDir, path.replace(/^\.claude\//, ''));
+      mkdirSync(join(dest, '..'), { recursive: true });
+      writeFileSync(dest, body, { mode: 0o600 });
+    }
+  }
+  let codexHome = null;
+  let personalDeveloperInstructions = false;
+  try {
+    if (runner === 'codex') {
+      const isolated = isolatedCodexHome(dir, env, worktree);
+      codexHome = isolated.path;
+      personalDeveloperInstructions = isolated.personalDeveloperInstructions;
+    }
+  } catch (error) {
+    rmSync(dir, { recursive: true, force: true });
+    throw error;
+  }
+  return {
+    mcpPath,
+    codexArgs,
+    instructions,
+    pluginDir,
+    codexHome,
+    personalDeveloperInstructions,
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+export function toolReadout(snapshot, runner) {
+  const caps = runnerToolCapabilities(runner);
+  const short = (reason) => reason == null ? null : String(reason).slice(0, 200);
+  const mcp = snapshot.tools.map(({ name, config, state, reason }) => {
+    const unsupported = runner === 'codex' && config.type === 'sse';
+    return {
+      name, kind: 'mcp',
+      state: caps.mcp && !unsupported ? state : 'missing',
+      reason: short(!caps.mcp ? runner === 'none' ? 'no installed CLI can take MCP' : `${runner} cannot take MCP`
+        : unsupported ? 'Codex cannot take SSE MCP' : reason),
+    };
+  });
+  const instructions = snapshot.skills.map(({ path }) => ({
+    name: path.split('/')[2], kind: 'instruction', state: caps.skills ? 'ready' : 'missing',
+    reason: short(caps.skills ? null : runner === 'none' ? 'no installed CLI can take instructions' : `${runner} cannot take instructions`),
+  }));
+  return [...mcp, ...instructions].slice(0, MAX_REPORT_TOOLS);
+}

package/bin/lib/prompts.mjs

@@ -492,9 +492,10 @@ const kickoff = ({ message, askedByName, head, tail }) => {
  * A CAPTURE TAB (server: work_session.kind='capture', flagged on the job as
  * `capture: true`) — the board's "New task" conversation. Its whole job is
  * turning what the person says into STAGED cards a human lands; it edits
- * nothing, and the permission profile enforces that (PLAN_PERM: read-only +
- * MCP — the same fence the scratch planner runs behind). This prompt is the
- * QUALITY half; the token scope and the permission list are the safety.
+ * nothing, and the permission profile enforces that (`planPermFor`:
+ * read-only + MCP — the same fence the scratch planner runs behind). This
+ * prompt is the QUALITY half; the token scope and the permission list are
+ * the safety.
  *
  * THE CHAT ASKS IN CHIPS, AND SAYS WHAT IT ASSUMED (2026-09-23, 0.97.0). Rule
  * 5 used to be one sentence — "clarify before staging" — and the owner asked
@@ -600,7 +601,9 @@ MECHANICS OF THIS CHAT:
    something they said.
 10. REFERENCE WHAT THE PROJECT KEPT. When the ask names a kept design or
    write-up ("implement design A"), call list_library and pass its id as
-   \`references\` on the card you stage, so the agent reads it.`;
+   \`references\` on the card you stage, so the agent reads it. When the person's
+   message includes attached library items, pass those ids as \`references\` on
+   the cards you stage from that message.`;
 
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
   kickoff({
@@ -684,11 +687,11 @@ export const REGROUND_KICKOFF = ({ sha, title, files, vaultDir, predictedPages =
  * no code, edits no files and starts nothing: a person reads what it proposes,
  * edits it on the board, and accepting is what spawns anything.
  *
- * It runs READ-ONLY IN THE CHECKOUT under CONSULT_PERM — no Write, no Edit, no
- * mkdir, no rm, and no MCP at all. The proposal comes back as its final
- * message, not through a tool, which is what lets that permission set be this
- * narrow. A planner authors a decision, and there is no file on this machine it
- * has any business touching.
+ * It runs READ-ONLY IN THE CHECKOUT under `consultPermFor` — no Write, no
+ * Edit, no mkdir, no rm, and no MCP at all. The proposal comes back as its
+ * final message, not through a tool, which is what lets that permission set
+ * be this narrow. A planner authors a decision, and there is no file on this
+ * machine it has any business touching.
  *
  * The two facts it is asked to weigh are the only two that are actually
  * knowable here: what the cards SAY, and what each live agent has already
@@ -861,13 +864,15 @@ export const AGENT_PLAN_KICKOFF = ({ tasks, liveAgents, agentCap }) => {
  * a person one reply; a turn that guesses costs them a review, a rejection and
  * a second run — and the guess arrives wearing a confident summary.
  */
-export const SYSTEM_AGENT = `You are the human's own Claude, working one task in a git worktree of their
+export const SYSTEM_AGENT = `You are the human's own coding agent, working one task in a git worktree of their
 repository. Nobody is watching this run. You have the repo and nothing else —
 no project tools, no board, no chat.
 
 WHAT TO DO:
 
-1. Do the card you are given. Read whatever you need first. Follow the
+1. Do the card you are given. Read whatever you need first — including
+   CLAUDE.md and AGENTS.md at the repository root, when either exists: they are
+   the repository's own instructions, whichever CLI you are. Follow the
    repository's own conventions over anything you would do by default.
 
 2. COMMIT YOUR WORK before you finish. Small, real commit messages. Uncommitted

package/bin/lib/resources.mjs

@@ -46,7 +46,7 @@
 
 import { execFileSync } from 'node:child_process';
 import { readFileSync, readdirSync, statfsSync } from 'node:fs';
-import { freemem, loadavg, platform } from 'node:os';
+import { cpus, freemem, loadavg, platform } from 'node:os';
 import { MACHINE } from './config.mjs';
 
 const MiB = 1024 * 1024;
@@ -71,12 +71,38 @@ const readFile = (p) => {
 function memoryUsed() {
   const cur = readFile('/sys/fs/cgroup/memory.current');
   if (cur !== null) {
-    const n = Number(cur);
+    const n = cgroupWorkingSet(Number(cur), readFile);
     if (Number.isFinite(n) && n > 0) return n;
   }
   return Math.max(0, MACHINE.memBytes - freemem());
 }
 
+/**
+ * THE CGROUP'S WORKING SET, NOT ITS CHARGE.
+ *
+ * `memory.current` counts the page cache charged to the cgroup — every file a
+ * worktree add, an npm install or a repo read touched. On a container that has
+ * been up a while it sits just under `memory.max` while almost all of it is
+ * reclaimable, and the kernel reclaims only when something ALLOCATES. A guard
+ * reading the raw charge therefore defers every unattended turn, which spawns
+ * nothing, which allocates nothing, which never reclaims: a permanent refusal
+ * relaying a "low memory" figure that is false. This is the same trap
+ * `memAvailableBytes` rejects `freemem()` for, one layer down.
+ *
+ * So subtract `inactive_file` from `memory.stat`, which is what kubelet and
+ * `docker stats` call the working set. An unreadable or malformed stat leaves
+ * the charge as it was — the conservative direction, and never a guess.
+ */
+function cgroupWorkingSet(current, read) {
+  if (!Number.isFinite(current)) return current;
+  const stat = read('/sys/fs/cgroup/memory.stat');
+  const m = stat && stat.match(/^inactive_file\s+(\d+)$/m);
+  if (!m) return current;
+  const inactive = Number(m[1]);
+  if (!Number.isFinite(inactive) || inactive < 0) return current;
+  return Math.max(0, current - inactive);
+}
+
 /**
  * Resident memory of a process AND everything it spawned.
  *
@@ -176,7 +202,8 @@ export function memAvailableBytes(read = readFile) {
     const max = read('/sys/fs/cgroup/memory.max');
     if (max && max !== 'max') {
       const limit = Number(max);
-      const cur = Number(read('/sys/fs/cgroup/memory.current'));
+      const raw = read('/sys/fs/cgroup/memory.current');
+      const cur = raw === null ? NaN : cgroupWorkingSet(Number(raw), read);
       if (Number.isFinite(limit) && limit > 0 && Number.isFinite(cur)) {
         const room = Math.max(0, limit - cur);
         avail = avail === null ? room : Math.min(avail, room);
@@ -248,6 +275,21 @@ const sizeWord = (n) =>
 const PRESSURE_CACHE_MS = 2_000;
 let lastMeasure = { at: 0, m: null };
 
+/**
+ * THE CORES THE LOAD AVERAGE IS A LOAD ON.
+ *
+ * `/proc/loadavg` is not namespaced: inside a container it reports the whole
+ * HOST. `MACHINE.cores` is clamped to the cgroup's `cpu.max`, which is right
+ * for sizing how many turns this box runs and wrong as the divisor of a host
+ * figure — a `--cpus=2` container on a busy 32-core host read "load 10 on 2
+ * cores" and deferred every unattended turn over load it did not cause. Compare
+ * like with like: a host figure against the host's core count. Exported so the
+ * pairing can be pinned.
+ */
+export function loadCores(hostCores = cpus().length) {
+  return Number.isFinite(hostCores) && hostCores > 0 ? hostCores : MACHINE.cores;
+}
+
 /** What the box says about itself, cached briefly. Exported so a caller can
  *  hold one reading across several verdicts — and so tests can pass their own
  *  instead of depending on the machine they run on. */
@@ -260,7 +302,7 @@ export function measurePressure() {
     // Unix only; Windows reports zeroes, which are sent as null rather than as
     // a very calm-looking 0.00 — the same rule the snapshot keeps.
     load1: loadavg()[0] || null,
-    cores: MACHINE.cores,
+    cores: loadCores(),
   };
   lastMeasure = { at: now, m };
   return m;

package/bin/lib/runtimeOfferings.mjs

@@ -0,0 +1,75 @@
+/** Local, bounded Codex readouts. No agent turn is started for these reports. */
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readBaseTools } from './projectTools.mjs';
+
+const TTL = 5 * 60_000;
+let cachedAt = 0;
+let cached = null;
+let repoCached = null;
+const home = (env) => env.CODEX_HOME || join(homedir(), '.codex');
+const nameOk = (name) => typeof name === 'string' && /^[A-Za-z0-9_.:-]{1,80}$/.test(name) && name !== 'flowviant';
+const run = (args, env) => execFileSync('codex', args, {
+  encoding: 'utf8', timeout: 5000, maxBuffer: 128 * 1024,
+  stdio: ['ignore', 'pipe', 'ignore'], env,
+});
+
+export function localCodexOfferings({ env = process.env, runCodex = run, read = readFileSync, list = readdirSync } = {}) {
+  const result = {};
+  try {
+    const cachePath = join(home(env), 'models_cache.json');
+    if (read === readFileSync && statSync(cachePath).size > 2 * 1024 * 1024) throw Error('model cache too large');
+    const data = JSON.parse(read(cachePath, 'utf8'));
+    if (Array.isArray(data.models)) result.models = data.models
+      .filter((m) => m?.visibility === 'list' && nameOk(m.slug))
+      .slice(0, 60)
+      .map((m) => ({ slug: m.slug, displayName: String(m.display_name || m.slug).slice(0, 100),
+        efforts: Array.isArray(m.supported_reasoning_levels) ? m.supported_reasoning_levels
+          .map((e) => e?.effort).filter((e) => typeof e === 'string' && /^[a-z]{1,20}$/.test(e)).slice(0, 8) : [] }));
+  } catch { /* absent or unreadable is unknown */ }
+  try {
+    const lines = runCodex(['features', 'list'], env).split('\n');
+    result.capabilities = lines.some((line) => /^image_generation\s+\S+\s+true\s*$/.test(line)) ? ['image'] : [];
+  } catch { /* a failed local probe is unknown */ }
+  try {
+    result.skills = list(join(home(env), 'skills'), { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && nameOk(entry.name))
+      .map((entry) => entry.name).slice(0, 80);
+  } catch (error) { if (error?.code === 'ENOENT') result.skills = []; }
+  try {
+    const servers = JSON.parse(runCodex(['mcp', 'list', '--json'], env));
+    if (Array.isArray(servers)) result.mcp = servers
+      // Unknown/unsupported auth is not proof of disconnection. Keep their
+      // names local, just as connected servers stay local.
+      .filter((s) => nameOk(s?.name) && ['needs_auth', 'failed'].includes(s.auth_status))
+      .slice(0, 80)
+      .map((s) => ({ n: s.name, s: s.auth_status === 'needs_auth' ? 'needs-auth' : 'failed' }));
+  } catch { /* no read is unknown */ }
+  return result;
+}
+
+export function runtimeOfferings(repoRoot, baseRef, { refresh = false } = {}) {
+  if (!cached || refresh || Date.now() - cachedAt >= TTL) {
+    cached = localCodexOfferings();
+    cachedAt = Date.now();
+  }
+  const out = { rtm: {}, rtc: {}, rts: {}, rtp: {} };
+  if (cached.models) out.rtm.codex = cached.models;
+  if (cached.capabilities) out.rtc.codex = cached.capabilities;
+  if (cached.skills) out.rts.codex = cached.skills;
+  if (cached.mcp) out.rtp.codex = cached.mcp;
+  // Repo skills and MCP are read from the base commit, like the turn itself.
+  try {
+    if (!repoCached || repoCached.root !== repoRoot || repoCached.ref !== baseRef || refresh || Date.now() - repoCached.at >= TTL) {
+      repoCached = { root: repoRoot, ref: baseRef, at: Date.now(), snapshot: readBaseTools(repoRoot, baseRef) };
+    }
+    const snapshot = repoCached.snapshot;
+    if (out.rts.codex) out.rts.codex = [...new Set([...out.rts.codex, ...snapshot.skills.map((s) => s.path.split('/')[2])])].slice(0, 80);
+    if (out.rtp.codex) out.rtp.codex = [...new Map([...out.rtp.codex, ...snapshot.tools
+      .filter((t) => t.state !== 'ready' || t.config.type === 'sse')
+      .map((t) => ({ n: t.name, s: 'failed' }))].map((server) => [server.n, server])).values()].slice(0, 80);
+  } catch { /* keep local measurements */ }
+  return out;
+}