negotium 0.1.12 → 0.1.13

package/dist/types/packages/core/src/mcp/runtime-spec.d.ts

@@ -22,6 +22,8 @@ export interface RuntimeMcpContext {
     autoContinue?: boolean;
     /** Capability minted by the adapter. Visual tools are absent unless true. */
     visualTools?: boolean;
+    /** Capability minted by the adapter. File-delivery tools are absent unless true. */
+    fileDeliveryTools?: boolean;
     peerBridge?: PeerRuntimeBridgeContext;
 }
 /** The runtime host calls this once it knows which port it actually bound. */

package/dist/types/packages/core/src/platform/mcp-config.d.ts

@@ -80,6 +80,7 @@ export interface RuntimeMcpBuildContext {
     bgBashPort?: number;
     autoContinue?: boolean;
     visualTools?: boolean;
+    fileDeliveryTools?: boolean;
     silent?: boolean;
     peerBridge?: PeerRuntimeBridgeContext;
 }
@@ -168,6 +169,7 @@ export declare function getManagerMcpServers(opts: {
     playwrightCapability?: string;
     autoContinue?: boolean;
     visualTools?: boolean;
+    fileDeliveryTools?: boolean;
 }): Record<string, unknown>;
 /**
  * Forum session: catalog entries with `forum` scope.
@@ -190,6 +192,7 @@ export declare function getForumMcpServers(opts: {
     bgBashPort?: number;
     autoContinue?: boolean;
     visualTools?: boolean;
+    fileDeliveryTools?: boolean;
     depth?: number;
     enabled?: string[] | null;
     extra?: Record<string, unknown>;
@@ -216,6 +219,7 @@ export declare function getCronMcpServers(opts: {
     playwrightPort?: number;
     playwrightCapability?: string;
     visualTools?: boolean;
+    fileDeliveryTools?: boolean;
 }): Record<string, unknown>;
 /**
  * Pick the right MCP server bundle for an agent query. DM/ephemeral sessions

package/dist/types/packages/core/src/prompts/builders.d.ts

@@ -18,6 +18,8 @@ export interface SessionSystemPromptOpts {
     canSpawnSubagents?: boolean;
     /** True only when the current adapter renders Otium visual cards. */
     visualTools?: boolean;
+    /** True only when the current adapter can deliver files to its chat. */
+    fileDeliveryTools?: boolean;
 }
 export declare function buildTopicSystemPrompt(opts: SessionSystemPromptOpts): string;
 export declare function buildChannelSystemPrompt(opts: SessionSystemPromptOpts): string;

package/dist/types/packages/core/src/types/api.d.ts

@@ -192,6 +192,8 @@ export interface MessageDto {
     authorAvatarUrl?: string | null;
     text: string;
     attachments?: AttachmentDto[];
+    /** Internal hint: an external channel may claim and acknowledge attachment delivery. */
+    deliveryAckRequested?: boolean;
     queryId?: string;
     agentType?: AgentKind;
     model?: string;

package/dist/types/packages/core/src/types.d.ts

@@ -178,6 +178,8 @@ export interface AgentQueryOptions {
     autoContinue?: boolean;
     /** Expose Otium-only visual panel tools for this turn. Default-deny. */
     visualTools?: boolean;
+    /** Expose adapter-backed file-delivery tools for this turn. Default-deny. */
+    fileDeliveryTools?: boolean;
     abortController?: AbortController;
     model?: string;
     /** Provider-side hard budget when the selected SDK supports one. */

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.1.12";
+export declare const NEGOTIUM_VERSION = "0.1.13";

package/dist/vault.js.map

@@ -5,7 +5,7 @@
     "import { chmodSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { DATA_DIR, VAULT_MASTER_KEY } from \"#platform/config\";\nimport { Database } from \"#storage/sqlite\";\nimport { decryptVaultValue, encryptVaultValue } from \"#storage/vault-crypto\";\n\nexport type VaultDatabase = Pick<InstanceType<typeof Database>, \"exec\" | \"prepare\">;\n\nexport interface VaultStorageOptions {\n  database?: VaultDatabase;\n  dataDir?: string;\n  masterKey?: string;\n}\n\nlet vaultDb: VaultDatabase | undefined;\nlet vaultMasterKey = VAULT_MASTER_KEY;\n\nfunction initializeVaultDatabase(database: VaultDatabase): void {\n  database.exec(\"PRAGMA journal_mode = WAL\");\n  database.exec(\"PRAGMA busy_timeout = 5000\");\n  database.exec(`\n  CREATE TABLE IF NOT EXISTS vault (\n    user_id     TEXT    NOT NULL,\n    key         TEXT    NOT NULL,\n    value       TEXT    NOT NULL,\n    description TEXT    NOT NULL DEFAULT '',\n    PRIMARY KEY (user_id, key)\n  )\n  `);\n\n  // Migrate legacy schema where user_id was INTEGER (Telegram numeric ids only).\n  // The Otium API authenticates with string user ids (\"otium-user-…\"), so user_id\n  // is now TEXT for every channel. Rebuild + CAST existing rows so old Telegram\n  // secrets survive; idempotent (no-op once user_id is already TEXT).\n  {\n    const cols = database.prepare(\"PRAGMA table_info(vault)\").all() as {\n      name: string;\n      type: string;\n    }[];\n    const uid = cols.find((c) => c.name === \"user_id\");\n    if (uid && uid.type.toUpperCase() === \"INTEGER\") {\n      database.exec(\"BEGIN\");\n      database.exec(`\n      CREATE TABLE vault_migrated (\n        user_id     TEXT    NOT NULL,\n        key         TEXT    NOT NULL,\n        value       TEXT    NOT NULL,\n        description TEXT    NOT NULL DEFAULT '',\n        PRIMARY KEY (user_id, key)\n      )\n    `);\n      database.exec(\n        \"INSERT INTO vault_migrated SELECT CAST(user_id AS TEXT), key, value, description FROM vault\",\n      );\n      database.exec(\"DROP TABLE vault\");\n      database.exec(\"ALTER TABLE vault_migrated RENAME TO vault\");\n      database.exec(\"COMMIT\");\n    }\n  }\n}\n\nfunction openVaultDatabase(dataDir: string): VaultDatabase {\n  const path = join(dataDir, \"vault.db\");\n  mkdirSync(dataDir, { recursive: true });\n  const database = new Database(path, { create: true });\n  // Defense in depth: the database and its sidecars are owner-only, while each\n  // value is also encrypted independently by vault-crypto.\n  chmodSync(path, 0o600);\n  initializeVaultDatabase(database);\n  return database;\n}\n\nfunction activeVaultDatabase(): VaultDatabase {\n  if (!vaultDb) vaultDb = openVaultDatabase(DATA_DIR);\n  return vaultDb;\n}\n\n/** Configure process-wide vault storage during embedding-host bootstrap. */\nexport function configureVaultStorage(options: VaultStorageOptions): () => void {\n  if (options.database && options.dataDir) {\n    throw new Error(\"configureVaultStorage accepts either database or dataDir, not both\");\n  }\n  const previousDb = vaultDb;\n  const previousMasterKey = vaultMasterKey;\n  const configuredDb = options.database ?? openVaultDatabase(options.dataDir ?? DATA_DIR);\n  if (options.database) initializeVaultDatabase(configuredDb);\n  vaultDb = configuredDb;\n  vaultMasterKey = options.masterKey ?? VAULT_MASTER_KEY;\n  let disposed = false;\n  return () => {\n    if (disposed) return;\n    disposed = true;\n    if (!options.database && \"close\" in configuredDb) {\n      (configuredDb as VaultDatabase & { close(): void }).close();\n    }\n    vaultDb = previousDb;\n    vaultMasterKey = previousMasterKey;\n  };\n}\n\nexport interface VaultEntry {\n  key: string;\n  description: string;\n}\n\nexport interface VaultEntryWithValue extends VaultEntry {\n  value: string;\n}\n\nexport const VAULT_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;\nexport const VAULT_VALUE_MIN_BYTES = 4;\nexport const VAULT_VALUE_MAX_BYTES = 64 * 1024;\nexport const VAULT_DESCRIPTION_MAX_LENGTH = 500;\n\nexport function normalizeVaultKey(key: string): string {\n  return key.trim().toUpperCase();\n}\n\nexport function validateVaultKey(key: string): boolean {\n  return VAULT_KEY_PATTERN.test(normalizeVaultKey(key));\n}\n\nfunction decryptRow(userId: string, key: string, storedValue: string): string {\n  const database = activeVaultDatabase();\n  const decoded = decryptVaultValue(userId, key, storedValue, vaultMasterKey);\n  if (decoded.legacyPlaintext) {\n    database\n      .prepare(\"UPDATE vault SET value = ? WHERE user_id = ? AND key = ? AND value = ?\")\n      .run(encryptVaultValue(userId, key, decoded.value, vaultMasterKey), userId, key, storedValue);\n  }\n  return decoded.value;\n}\n\nexport function vaultListWithValues(userId: string): VaultEntryWithValue[] {\n  const rows = activeVaultDatabase()\n    .prepare(\"SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key\")\n    .all(userId) as VaultEntryWithValue[];\n  return rows.map((row) => ({\n    key: row.key,\n    description: row.description,\n    value: decryptRow(userId, row.key, row.value),\n  }));\n}\n\nexport function vaultSet(userId: string, key: string, value: string, description = \"\"): void {\n  const normalizedKey = normalizeVaultKey(key);\n  activeVaultDatabase()\n    .prepare(\n      `INSERT INTO vault (user_id, key, value, description) VALUES (?, ?, ?, ?)\n       ON CONFLICT (user_id, key) DO UPDATE\n         SET value = excluded.value, description = excluded.description`,\n    )\n    .run(\n      userId,\n      normalizedKey,\n      encryptVaultValue(userId, normalizedKey, value, vaultMasterKey),\n      description,\n    );\n}\n\nexport function vaultHasKey(userId: string, key: string): boolean {\n  const row = activeVaultDatabase()\n    .prepare(\"SELECT 1 FROM vault WHERE user_id = ? AND key = ?\")\n    .get(userId, normalizeVaultKey(key));\n  return row != null;\n}\n\nexport function vaultDel(userId: string, key: string): boolean {\n  const result = activeVaultDatabase()\n    .prepare(\"DELETE FROM vault WHERE user_id = ? AND key = ?\")\n    .run(userId, normalizeVaultKey(key)) as { changes: number };\n  return result.changes > 0;\n}\n\nexport function vaultDeleteAllForUser(userId: string): number {\n  const result = activeVaultDatabase()\n    .prepare(\"DELETE FROM vault WHERE user_id = ?\")\n    .run(userId) as {\n    changes: number;\n  };\n  return result.changes;\n}\n\nexport function vaultList(userId: string): VaultEntry[] {\n  return activeVaultDatabase()\n    .prepare(\"SELECT key, description FROM vault WHERE user_id = ? ORDER BY key\")\n    .all(userId) as VaultEntry[];\n}\n\nexport function vaultGetValue(userId: string, key: string): string | undefined {\n  const normalizedKey = normalizeVaultKey(key);\n  const row = activeVaultDatabase()\n    .prepare(\"SELECT key, value FROM vault WHERE user_id = ? AND key = ?\")\n    .get(userId, normalizedKey) as { key: string; value: string } | undefined;\n  return row ? decryptRow(userId, row.key, row.value) : undefined;\n}\n\nexport interface VaultSubstitutionResult {\n  text: string;\n  usedKeys: string[];\n}\n\n/** Replace {{KEY}} placeholders and report which credentials were consumed. */\nexport function vaultSubstituteDetailed(userId: string, text: string): VaultSubstitutionResult {\n  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));\n  const usedKeys = new Set<string>();\n  const substituted = text.replace(/\\{\\{([^}]+)\\}\\}/g, (match, rawKey: string) => {\n    const key = normalizeVaultKey(rawKey);\n    const value = entries.get(key);\n    if (value === undefined) return match;\n    usedKeys.add(key);\n    return value;\n  });\n  return { text: substituted, usedKeys: [...usedKeys] };\n}\n\n/** Detect real {{KEY}} references without decrypting any Vault values. */\nexport function valueReferencesVaultKey(userId: string, value: unknown): boolean {\n  const keys = new Set(vaultList(userId).map((entry) => entry.key));\n  const visit = (candidate: unknown): boolean => {\n    if (typeof candidate === \"string\") {\n      for (const match of candidate.matchAll(/\\{\\{([^}]+)\\}\\}/g)) {\n        if (keys.has(normalizeVaultKey(match[1] ?? \"\"))) return true;\n      }\n      return false;\n    }\n    if (Array.isArray(candidate)) return candidate.some(visit);\n    if (candidate && typeof candidate === \"object\") {\n      return Object.values(candidate as Record<string, unknown>).some(visit);\n    }\n    return false;\n  };\n  return visit(value);\n}\n\nfunction encodedSecretForms(value: string): string[] {\n  const forms = new Set<string>([\n    value,\n    encodeURIComponent(value),\n    Buffer.from(value, \"utf8\").toString(\"base64\"),\n    Buffer.from(value, \"utf8\").toString(\"base64url\"),\n    Buffer.from(value, \"utf8\").toString(\"hex\"),\n  ]);\n  forms.delete(\"\");\n  return [...forms].sort((a, b) => b.length - a.length);\n}\n\n/** Scrub raw and common encoded forms before tool output reaches a model. */\nexport function redactVaultSecrets(userId: string, text: string): string {\n  const candidates = vaultListWithValues(userId)\n    .flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key })))\n    .sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));\n  if (candidates.length === 0) return text;\n  const candidatesByFirstCharacter = new Map<string, typeof candidates>();\n  for (const candidate of candidates) {\n    const first = candidate.form[0];\n    if (!first) continue;\n    const bucket = candidatesByFirstCharacter.get(first) ?? [];\n    bucket.push(candidate);\n    candidatesByFirstCharacter.set(first, bucket);\n  }\n\n  let redacted = \"\";\n  let offset = 0;\n  while (offset < text.length) {\n    const match = candidatesByFirstCharacter\n      .get(text[offset] ?? \"\")\n      ?.find((candidate) => text.startsWith(candidate.form, offset));\n    if (!match) {\n      redacted += text[offset];\n      offset += 1;\n      continue;\n    }\n    redacted += `[REDACTED:${match.key}]`;\n    offset += match.form.length;\n  }\n  return redacted;\n}\n",
     "import { randomBytes } from \"node:crypto\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { logger } from \"#platform/logger\";\nimport { type AgentKind, isAgentKind } from \"#types\";\n\nexport function envText(envKey: string): string | undefined {\n  const value = process.env[envKey]?.trim();\n  return value ? value : undefined;\n}\n\nfunction resolveAgentEnv(envKey: string, fallback: AgentKind, legacyEnvKey?: string): AgentKind {\n  const value = envText(envKey) ?? (legacyEnvKey ? envText(legacyEnvKey) : undefined);\n  return isAgentKind(value) ? value : fallback;\n}\n\nconst HOME = homedir();\n\n// new URL(\"../..\", import.meta.url) causes webpack to treat \"../..\" as a module import.\n// Split into fileURLToPath → dirname → resolve to avoid that.\nfunction resolveProjectRoot(): string {\n  const moduleDir = dirname(fileURLToPath(import.meta.url));\n  const packagedRuntime = resolve(moduleDir, \"runtime\");\n  if (existsSync(resolve(packagedRuntime, \"src\"))) return packagedRuntime;\n  return resolve(moduleDir, \"../..\");\n}\n\nexport const PROJECT_ROOT = resolveProjectRoot();\n\n/** Resolve a dependency executable from either a package-local or hoisted install. */\nfunction resolveDependencyBin(name: string): string {\n  let dir = PROJECT_ROOT;\n  while (true) {\n    const candidate = resolve(dir, \"node_modules\", \".bin\", name);\n    if (existsSync(candidate)) return candidate;\n    const parent = dirname(dir);\n    if (parent === dir) return candidate;\n    dir = parent;\n  }\n}\n\n// Each machine is one negotium node; all node state lives in one dotdir.\n// NEGOTIUM_STATE_DIR overrides (useful for tests and multi-node-on-one-box).\nconst STATE_DIR_ENV = envText(\"NEGOTIUM_STATE_DIR\");\nexport const STATE_DIR = STATE_DIR_ENV ? resolve(STATE_DIR_ENV) : resolve(HOME, \".negotium\");\n\nfunction resolveLocalStateDir(envKey: string, stateName: string): string {\n  const envValue = envText(envKey);\n  if (envValue) return resolve(envValue);\n  return resolve(STATE_DIR, stateName);\n}\n\nfunction parsePortEnv(envValue: string | undefined, fallback: number): number {\n  if (!envValue) return fallback;\n  const port = Number.parseInt(envValue, 10);\n  return Number.isInteger(port) && port > 0 ? port : fallback;\n}\n\nexport const WORKSPACE_DIR = resolveLocalStateDir(\"NEGOTIUM_WORKSPACE_DIR\", \"workspace\");\nexport const TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, \"topics\");\nexport const SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, \"wiki\");\nexport const CONTEXTS_DIR = resolve(WORKSPACE_DIR, \"contexts\");\nexport const BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, \"browser-profiles\");\nexport const DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, \"dm\");\nexport const SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, \"sessions\");\nexport const CLAUDE_EXECUTABLE = resolve(HOME, \".local/bin/claude\");\n\n// Browser automation uses the authenticated local Patchright HTTP wrapper.\nexport function resolveBrowserMcpBin(envValue?: string): string {\n  const override = envValue?.trim();\n  if (override) {\n    if (!/(^|\\/)(mcp-patchright|mcp-patchright-http\\.mjs)$/.test(override)) {\n      throw new Error(\n        \"NEGOTIUM_BROWSER_MCP_BIN must point to the authenticated mcp-patchright wrapper.\",\n      );\n    }\n    return override;\n  }\n  return PATCHRIGHT_MCP_BIN;\n}\n\nexport const PATCHRIGHT_MCP_BIN = resolve(PROJECT_ROOT, \"scripts/mcp-patchright-http.mjs\");\nexport const PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText(\"NEGOTIUM_BROWSER_MCP_BIN\"));\n\n// --- Browser egress proxy ---\n//\n// On a datacenter host (AWS) the browser's egress IP is a known cloud range,\n// so anti-bot services (Cloudflare, DataDome, reCAPTCHA) challenge or block it\n// far more than a residential IP would. Routing the automation browser through\n// a residential/ISP proxy moves the egress IP out of the datacenter range.\n//\n// Operators set BROWSER_PROXY_URL, e.g. http://user:pass@proxy.host:8080 or\n// socks5://proxy.host:1080. Credentials in the URL are split out because\n// Playwright takes them as separate fields. BROWSER_PROXY_BYPASS is an optional\n// comma-separated no-proxy list (e.g. \"localhost,127.0.0.1,*.internal\").\n//\n// NOTE: Chromium does not support authentication for SOCKS proxies — put\n// credentials only on http/https proxy URLs.\nexport type BrowserProxyConfig = {\n  server: string;\n  username?: string;\n  password?: string;\n  bypass?: string;\n};\n\nexport function resolveBrowserProxy(): BrowserProxyConfig | null {\n  const raw = envText(\"BROWSER_PROXY_URL\");\n  if (!raw) return null;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    logger.warn({ raw }, \"Ignoring malformed BROWSER_PROXY_URL\");\n    return null;\n  }\n  // Playwright wants the server without embedded credentials.\n  const server = `${url.protocol}//${url.host}`;\n  const proxy: BrowserProxyConfig = { server };\n  if (url.username) proxy.username = decodeURIComponent(url.username);\n  if (url.password) proxy.password = decodeURIComponent(url.password);\n  const bypass = envText(\"BROWSER_PROXY_BYPASS\");\n  if (bypass) proxy.bypass = bypass;\n  return proxy;\n}\n\n// --- Node/tsx runtime for the `codex` agent's MCP servers ---\n//\n// codex 0.135's rmcp stdio MCP client cannot reliably complete the initialize\n// handshake with servers spawned via `bun` (the JSON-RPC initialize is\n// dropped/raced and no tools ever reach the model). Pure-node servers connect\n// reliably, so codex turns launch the SAME .ts servers via node + tsx instead\n// of `bun run`. claude/maestro keep using `bun run` (fast, native, unaffected).\n//\n// tsx transpiles .ts on the fly and resolves the `@/*` tsconfig path aliases,\n// but only when it can find the tsconfig — and MCP servers run with cwd set to\n// the user's workspace dir, not PROJECT_ROOT — so we pass TSX_TSCONFIG_PATH\n// explicitly via env. Requires package.json `\"type\": \"module\"` so the servers'\n// top-level `await` loads as ESM under node.\nexport const TSX_BIN = resolveDependencyBin(\"tsx\");\nexport const TSCONFIG_PATH = resolve(PROJECT_ROOT, \"tsconfig.json\");\n\nexport const SESSION_COMM_SERVER = resolve(PROJECT_ROOT, \"src/mcp/session-comm/server.ts\");\n\nexport const TASK_SERVER = resolve(PROJECT_ROOT, \"src/mcp/task-server.ts\");\nexport const CANONICAL_MCP_PROXY_SERVER = resolve(\n  PROJECT_ROOT,\n  \"src/mcp/canonical-proxy-server.ts\",\n);\n\nexport const WIKI_SERVER = resolve(PROJECT_ROOT, \"src/mcp/wiki-server.ts\");\n\nexport const PADDLEOCR_SERVER = resolve(PROJECT_ROOT, \"src/mcp/paddleocr-server.ts\");\n\nexport const TOKEN_STATS_SERVER = resolve(PROJECT_ROOT, \"src/mcp/token-stats-server.ts\");\n\nexport const SYSTEM_HEALTH_SERVER = resolve(PROJECT_ROOT, \"src/mcp/system-health-server.ts\");\n\nexport const AGENT_HEALTH_SERVER = resolve(PROJECT_ROOT, \"src/mcp/agent-health-server.ts\");\n\nexport const BACKGROUND_BASH_SERVER = resolve(PROJECT_ROOT, \"src/mcp/background-bash-server.ts\");\n\nexport const VAULT_SERVER = resolve(PROJECT_ROOT, \"src/mcp/vault-server.ts\");\n\nexport const BG_BASH_BASE_PORT = parsePortEnv(process.env.BG_BASH_BASE_PORT, 9700);\nexport const BG_BASH_MAX_PORT = parsePortEnv(process.env.BG_BASH_MAX_PORT, 9799);\n\nfunction safeWorkspaceSegment(value: string, fallback: string): string {\n  const cleaned = value\n    .trim()\n    .replace(/[^A-Za-z0-9._-]/g, \"_\")\n    .replace(/^_+|_+$/g, \"\")\n    .slice(0, 160);\n  return cleaned || fallback;\n}\n\n/** Resolve the shared filesystem workspace for an API topic. */\nexport function resolveTopicWorkspaceDir(topicId: string): string {\n  return join(TOPIC_WORKSPACE_DIR, safeWorkspaceSegment(topicId, \"topic\"));\n}\n\nexport function isProductionEnv(): boolean {\n  return process.env.NODE_ENV === \"production\";\n}\n\nfunction loadOrCreateLocalSecret(\n  envKey: string,\n  filename: string,\n  options: { persistEnvValue?: boolean } = {},\n): string {\n  const envValue = envText(envKey);\n  const secretFile = resolve(STATE_DIR, filename);\n  mkdirSync(dirname(secretFile), { recursive: true });\n  if (envValue) {\n    if (options.persistEnvValue) {\n      writeFileSync(secretFile, `${envValue}\\n`, { mode: 0o600 });\n      chmodSync(secretFile, 0o600);\n    }\n    return envValue;\n  }\n\n  if (existsSync(secretFile)) {\n    const stored = readFileSync(secretFile, \"utf-8\").trim();\n    if (stored) {\n      chmodSync(secretFile, 0o600);\n      return stored;\n    }\n  }\n\n  const secret = randomBytes(32).toString(\"base64url\");\n  try {\n    writeFileSync(secretFile, `${secret}\\n`, { mode: 0o600, flag: \"wx\" });\n    return secret;\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n    const stored = readFileSync(secretFile, \"utf-8\").trim();\n    if (!stored) throw new Error(`Secret file exists but is empty: ${secretFile}`);\n    chmodSync(secretFile, 0o600);\n    return stored;\n  }\n}\n\nexport const RUNTIME_MCP_SECRET = loadOrCreateLocalSecret(\n  \"RUNTIME_MCP_SECRET\",\n  \"runtime-mcp-secret\",\n);\n/** Local bearer token for the loopback node-control API. */\nexport const NODE_CONTROL_TOKEN = loadOrCreateLocalSecret(\n  \"NEGOTIUM_CONTROL_TOKEN\",\n  \"node-control-token\",\n);\nexport const VAULT_MASTER_KEY = loadOrCreateLocalSecret(\n  \"NEGOTIUM_VAULT_MASTER_KEY\",\n  \"vault-master-key\",\n  { persistEnvValue: true },\n);\n// Agent/tool subprocesses inherit process.env. Keep the loaded key in this\n// process only so `env`/`ps` inside an agent workspace cannot reveal it.\ndelete process.env.NEGOTIUM_VAULT_MASTER_KEY;\n\n/** The node's single open port: runtime MCP endpoint + node API. */\nexport const NEGOTIUM_PORT = parseInt(process.env.NEGOTIUM_PORT || \"7777\", 10);\nexport const hostname = process.env.HOSTNAME || \"127.0.0.1\";\n\n// Persistent state (survives restarts, long-lived)\nexport const DATA_DIR = resolveLocalStateDir(\"NEGOTIUM_DATA_DIR\", \"data\");\nexport const LOG_DIR = resolveLocalStateDir(\"NEGOTIUM_LOG_DIR\", \"logs\");\n// SESSIONS_DB_PATH env override lets tests point the DB singleton at a temp file.\nexport const SESSIONS_DB = process.env.SESSIONS_DB_PATH\n  ? resolve(process.env.SESSIONS_DB_PATH)\n  : resolve(DATA_DIR, \"sessions.db\");\nexport const DEBUG_FILE = resolve(DATA_DIR, \"debug-users.json\");\nexport const USERS_LOG_DIR = resolve(DATA_DIR, \"users\");\n\n// Runtime IPC queues (transient, safe to clear on restart)\nexport const RUN_DIR = resolveLocalStateDir(\"NEGOTIUM_RUN_DIR\", \"run\");\nexport const PROGRESS_DIR = resolve(RUN_DIR, \"progress\");\nexport const DM_CMD_DIR = resolve(RUN_DIR, \"dm-commands\");\nexport const DM_RESP_DIR = resolve(RUN_DIR, \"dm-responses\");\nexport const SESSION_INBOX_DIR = resolve(RUN_DIR, \"session-inbox\");\nexport const SESSION_ASKS_DIR = resolve(RUN_DIR, \"session-asks\");\nexport const PLAYWRIGHT_BASE_PORT = parsePortEnv(process.env.PLAYWRIGHT_BASE_PORT, 9100);\nexport const PLAYWRIGHT_MAX_PORT = parsePortEnv(process.env.PLAYWRIGHT_MAX_PORT, 9499);\nexport const PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, \"playwright-ports\");\nmkdirSync(STATE_DIR, { recursive: true });\nmkdirSync(DATA_DIR, { recursive: true });\nmkdirSync(LOG_DIR, { recursive: true });\nmkdirSync(PROGRESS_DIR, { recursive: true });\nmkdirSync(DM_CMD_DIR, { recursive: true });\nmkdirSync(DM_RESP_DIR, { recursive: true });\nmkdirSync(SESSION_INBOX_DIR, { recursive: true });\nmkdirSync(SESSION_ASKS_DIR, { recursive: true });\nmkdirSync(PLAYWRIGHT_PORTS_DIR, { recursive: true });\nmkdirSync(WORKSPACE_DIR, { recursive: true });\nmkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });\nmkdirSync(SHARED_WIKI_DIR, { recursive: true });\nmkdirSync(CONTEXTS_DIR, { recursive: true });\nmkdirSync(BROWSER_PROFILES_DIR, { recursive: true });\nmkdirSync(DM_WORKSPACE_DIR, { recursive: true });\nmkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });\n\n/** Stale threshold for active-query state files (crash recovery) */\nexport const ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000; // 10 minutes\n\nexport const AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, \"src/prompts/agents\");\nexport const RESOURCES_DIR = resolve(PROJECT_ROOT, \"src/resources\");\n\n/** Returns process.env without CLAUDECODE, to prevent nested claude-code detection in subprocesses. */\nexport function getCleanEnv(): NodeJS.ProcessEnv {\n  const env = { ...process.env };\n  delete env.CLAUDECODE;\n  return env;\n}\n\nexport const FILE_EXTENSIONS_REGEX =\n  /(?:\\/[^\\s\"'<>|*?[\\]]+\\.(?:png|jpg|jpeg|gif|webp|svg|pdf|csv|xlsx|xls|json|txt|md|html|zip|py|js|ts|tsx|jsx|css|xml|yaml|yml|docx|pptx))/gi;\n\nexport const FILE_TAG_REGEX = /\\[FILE:(\\/[^\\]]+)\\]/gi;\n\n// Canonical Claude model IDs — update here when Anthropic releases new versions\nexport const MODEL_SONNET = \"claude-sonnet-5\";\nexport const MODEL_OPUS = \"claude-opus-4-8\";\nexport const MODEL_HAIKU = \"claude-haiku-4-5-20251001\";\nexport const MODEL_FABLE = \"claude-fable-5\"; // Mythos-class, announced 2026-06-09\n\n// DeepSeek V4 (released 2026-04-24). API is OpenAI-compatible at\n// https://api.deepseek.com/v1/chat/completions; thinking mode is enabled via\n// `extra_body.thinking.type` + `reasoning_effort`. Legacy `deepseek-chat` /\n// `deepseek-reasoner` are deprecated 2026-07-24.\nexport const MODEL_DEEPSEEK_V4_PRO = \"deepseek-v4-pro\";\nexport const MODEL_DEEPSEEK_V4_FLASH = \"deepseek-v4-flash\";\n\n// Agent + model defaults split by session role. FALLBACK_* is the shared base;\n// SESSION_* overrides topic + ephemeral; GATEWAY_* overrides dm + manager.\n// DEFAULT_* is accepted as a legacy alias during the env migration window.\nexport const FALLBACK_AGENT: AgentKind = resolveAgentEnv(\n  \"FALLBACK_AGENT\",\n  \"maestro\",\n  \"DEFAULT_AGENT\",\n);\nexport const SESSION_AGENT: AgentKind = resolveAgentEnv(\"SESSION_AGENT\", FALLBACK_AGENT);\nexport const GATEWAY_AGENT: AgentKind = resolveAgentEnv(\"GATEWAY_AGENT\", FALLBACK_AGENT);\n\nexport const FALLBACK_MODEL = envText(\"FALLBACK_MODEL\") ?? envText(\"DEFAULT_MODEL\");\n\nfunction resolveModelEnv(envKey: string, agentConst: AgentKind): string | undefined {\n  return envText(envKey) ?? (agentConst === FALLBACK_AGENT ? FALLBACK_MODEL : undefined);\n}\n\nexport const SESSION_MODEL = resolveModelEnv(\"SESSION_MODEL\", SESSION_AGENT);\nexport const GATEWAY_MODEL = resolveModelEnv(\"GATEWAY_MODEL\", GATEWAY_AGENT);\n\n/** Resolve the effective display/default model for a topic (session context).\n *  Applies the session model override only when that role owns the agent;\n *  otherwise each registry's native default stays authoritative. */\nexport function resolveDefaultModel(agent: string, registryDefaultModel: string): string {\n  return agent === SESSION_AGENT && SESSION_MODEL ? SESSION_MODEL : registryDefaultModel;\n}\n\n// ── External tool binaries + media pipeline env ───────────────────\n// (src/media/* 에서 사용. 미설정 시 fallback 의미는 기존 그대로:\n//  FFMPEG_BIN은 text-extractor에서 필수(undefined면 spawn 시점 실패),\n//  video.ts에서는 PATH의 ffmpeg/ffprobe로 fallback.)\nexport const FFMPEG_BIN = envText(\"FFMPEG_BIN\");\nexport const FFPROBE_BIN = envText(\"FFPROBE_BIN\");\nexport const PYTHON_BIN = envText(\"PYTHON_BIN\") ?? \"python3\";\nexport const FASTER_WHISPER_WRAPPER =\n  envText(\"FASTER_WHISPER_WRAPPER\") ?? resolve(PROJECT_ROOT, \"scripts/faster-whisper-wrapper.py\");\nexport const WHISPER_MODEL = envText(\"WHISPER_MODEL_FILE\") ?? \"turbo\";\nexport const TESSERACT_BIN = envText(\"TESSERACT_BIN\") ?? \"tesseract\";\nexport const PDFTOTEXT_BIN = envText(\"PDFTOTEXT_BIN\") ?? \"pdftotext\";\n\n// Max tell_session relay depth from origin user. ask_session forks reset to\n// depth=0, so this only caps tell_session chains. Override via MAX_TELL_DEPTH\n// (positive int); defaults to 20 when unset or invalid.\nconst _envMaxTellDepth = Number.parseInt(process.env.MAX_TELL_DEPTH ?? \"\", 10);\nexport const MAX_TELL_DEPTH =\n  Number.isInteger(_envMaxTellDepth) && _envMaxTellDepth > 0 ? _envMaxTellDepth : 20;\n\n/** Codex CLI auth file. 호출 시점에 env를 읽는다 — 테스트가 런타임에\n *  NEGOTIUM_CODEX_AUTH_FILE을 바꾸므로 모듈 로드 상수로 만들면 안 된다. */\nexport function codexAuthFilePath(): string {\n  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), \".codex\", \"auth.json\");\n}\n\n// System defaults moved to per-agent registries\n// (`src/agents/{claude,codex}-registry.ts`). Read via\n// `getRegistry(agent).defaultModel` / `.defaultEffort`.\n\n// MCP server builders -> src/platform/mcp-config.ts\n",
     "import pino from \"pino\";\n\n/**\n * Always write logs to stderr (fd 2), never stdout.\n *\n * MCP servers under `src/mcp/**` run as stdio subprocesses where stdout is the\n * JSON-RPC transport channel. A single log line on stdout corrupts the next\n * message and the MCP client closes the transport (\"Transport closed\"). The\n * main bot process is also fine with stderr — pm2 captures both streams.\n *\n * In dev mode pino spawns a `pino-pretty` worker that owns its own sink, so we\n * pass `destination: 2` through transport.options. In prod (no transport) the\n * second arg to `pino()` sets the destination directly.\n */\nexport const logger = pino(\n  {\n    level: process.env.LOG_LEVEL || \"info\",\n    transport:\n      process.env.NODE_ENV === \"development\"\n        ? {\n            target: \"pino-pretty\",\n            options: {\n              colorize: true,\n              translateTime: \"SYS:yyyy-mm-dd HH:MM:ss\",\n              destination: 2,\n            },\n          }\n        : undefined,\n  },\n  pino.destination(2),\n);\n",
-    "/**\n * Common context carried through the attachment/prompt-build pipeline.\n * Used by buildPromptFromMessage and related helpers.\n */\nexport interface SessionContext {\n  userId: number;\n  topicName?: string;\n  userDir?: string;\n  sessionType?: \"dm\" | \"forum\" | \"ephemeral\" | \"manager\" | \"cron\";\n}\n\nexport interface TokenUsage {\n  /** Aggregate billable input across every model call made during this turn. */\n  inputTokens: number;\n  outputTokens: number;\n  cacheCreationInputTokens?: number;\n  cacheReadInputTokens?: number;\n  /** Provider-reported query cost when available. */\n  costUsd?: number;\n  /** Tokens occupied by the latest model call, not aggregate turn spend. */\n  contextTokens?: number;\n  /** Provider-reported context window for the latest model call. */\n  contextWindow?: number;\n}\n\n/** Agent identifier — one of the supported AI provider backends. */\nexport type AgentKind = \"maestro\" | \"claude\" | \"codex\";\n\nexport const SUPPORTED_AGENTS: readonly AgentKind[] = [\"maestro\", \"claude\", \"codex\"] as const;\n\nexport function isAgentKind(value: unknown): value is AgentKind {\n  return typeof value === \"string\" && (SUPPORTED_AGENTS as readonly string[]).includes(value);\n}\n\n/**\n * Per-agent supported reasoning efforts. Single source of truth for both the\n * `EffortLevel` type and each registry's `validEfforts` runtime list — the\n * registries import these directly so adding a value in one place\n * propagates to validation, footer rendering, and zod enums.\n *\n * Claude SDK rejects 'minimal'; Codex SDK rejects 'max'. The two sets\n * intersect on low/medium/high/xhigh. Maestro (TS port) currently piggybacks\n * on the Anthropic provider, so its efforts mirror the Claude set; this can\n * narrow per-provider once Phase 5 lands.\n *\n * 'minimal' removed from codex: Codex API rejects it when default tools\n * (image_gen, web_search) are active, making agent sessions unusable.\n */\nexport const CLAUDE_EFFORT_VALUES = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\nexport const CODEX_EFFORT_VALUES = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\nexport const MAESTRO_EFFORT_VALUES = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\n\nexport type EffortLevel =\n  | (typeof CLAUDE_EFFORT_VALUES)[number]\n  | (typeof CODEX_EFFORT_VALUES)[number]\n  | (typeof MAESTRO_EFFORT_VALUES)[number];\n\n/**\n * Runtime iteration list (used by zod enums and any callers that need to\n * loop over every accepted value). Manually ordered for readability; the\n * `satisfies` check fails the build if an entry here isn't covered by the\n * per-agent unions above.\n */\nexport const EFFORT_VALUES = [\n  \"low\",\n  \"medium\",\n  \"high\",\n  \"xhigh\",\n  \"max\",\n] as const satisfies readonly EffortLevel[];\n\n/**\n * Normalized events yielded by any agent provider (claudeProvider, codexProvider).\n * The handler/event-processor consumes these without caring which backend produced them.\n *\n * `user_message` is the lone \"into-the-log\" variant — no provider yields it.\n * The query handler writes it directly to the conversation log right before\n * `runAgent()` starts, so cross-agent rollout reconstruction can pair every\n * assistant turn with the user prompt that triggered it. Consumers that only\n * react to provider output (e.g. processAgentEvent) can safely ignore it.\n */\n/**\n * Wire-safe projection of one task, carried by the `tasks` UnifiedEvent.\n *\n * This is also the on-disk shape of Otium's shared task store, so claude,\n * codex, and maestro render the same live panel from the same source of truth.\n */\nexport interface TaskSnapshot {\n  id: string;\n  subject: string;\n  status: \"pending\" | \"in_progress\" | \"completed\";\n  /** Task ids this one is blocked by; omitted when empty. */\n  blockedBy?: string[];\n  /** Present-continuous label for spinners, when set. */\n  activeForm?: string;\n  /** Owner / agent name for multi-agent runs, when set. */\n  owner?: string;\n}\n\nexport type UnifiedEvent =\n  | { type: \"user_message\"; content: string }\n  | { type: \"session\"; sessionId: string }\n  | {\n      type: \"tool_use\";\n      name: string;\n      input: Record<string, unknown>;\n      /** Provider-assigned id so the client can match tool_use→tool_result pairs. */\n      toolUseId?: string;\n    }\n  | { type: \"tool_progress\"; toolName: string; elapsed: number }\n  | { type: \"tool_use_summary\"; summary: string }\n  // Provider reasoning/thinking summary text (Codex `reasoning` items; Claude\n  // extended-thinking). Surfaced so background runs (cron/archiver) show the\n  // agent's thought process, not just tool calls.\n  | { type: \"reasoning\"; content: string }\n  // Full task-list snapshot (replace, not delta) from Otium's shared task\n  // store. Provider-native task/todo stores are not authoritative.\n  | { type: \"tasks\"; tasks: TaskSnapshot[] }\n  | {\n      type: \"tool_result\";\n      toolUseId: string;\n      content: string;\n      metadata?: {\n        truncatedForModel: boolean;\n        originalBytes: number;\n        returnedBytes: number;\n        omittedBytes?: number;\n        outputPath?: string;\n      };\n    }\n  | { type: \"text_delta\"; content: string }\n  | { type: \"text\"; content: string }\n  | { type: \"result\"; content: string; stopReason: string; usage?: TokenUsage }\n  | { type: \"file\"; path: string; source: string; origin: \"tag\" | \"extension\" }\n  | {\n      type: \"error\";\n      content: string;\n      usage?: TokenUsage;\n      code?: \"budget_exceeded\";\n    }\n  | { type: \"status\"; content: string };\n\nexport interface AgentInputAttachment {\n  id: string;\n  type: \"image\" | \"file\" | \"audio\";\n  filename: string;\n  mimeType: string;\n  sizeBytes: number;\n  path: string;\n}\n\n/** Worker-side runtime tools proxy user-facing state back to the canonical\n * hub topic identified here. */\nexport interface PeerRuntimeBridgeContext {\n  hubCellId: string;\n  hostTopicId: string;\n  hostQueryId: string;\n  canSpawnSubagents: boolean;\n}\n\nexport interface AgentQueryOptions {\n  agent: AgentKind;\n  prompt: string;\n  attachments?: AgentInputAttachment[];\n  sessionId?: string | null;\n  cwd: string;\n  systemPrompt: string;\n  userId?: string;\n  session?: string;\n  playwrightPort?: number;\n  playwrightCapability?: string;\n  bgBashPort?: number;\n  sessionType?: \"dm\" | \"forum\" | \"ephemeral\" | \"manager\" | \"cron\";\n  /** API topic id (REST/WS world). Carries per-query topic context for MCP servers. */\n  topicId?: string;\n  /** API query id for the currently running turn. Used by runtime MCP tools. */\n  queryId?: string;\n  /** Optional wiki-memory topic id. Derived topics use their root origin here\n   *  while other per-topic MCP servers keep `topicId` bound to the live room. */\n  wikiTopicId?: string;\n  /** Whether self-config MCP may enqueue an automatic continue turn after set_* changes. */\n  autoContinue?: boolean;\n  /** Expose Otium-only visual panel tools for this turn. Default-deny. */\n  visualTools?: boolean;\n  abortController?: AbortController;\n  model?: string;\n  /** Provider-side hard budget when the selected SDK supports one. */\n  maxBudgetUsd?: number;\n  depth?: number;\n  agents?: Record<\n    string,\n    {\n      description: string;\n      prompt: string;\n      model?: string;\n      tools?: string[];\n      maxTurns?: number;\n      effort?: EffortLevel | number;\n    }\n  >;\n  effort?: EffortLevel;\n  /**\n   * Per-API-call `max_tokens` ceiling on the assistant's output. Wired\n   * through to the underlying provider request body for every agent\n   * (claude/codex/maestro). Omit to inherit each provider SDK's per-model\n   * default — for maestro that's the v0.1.21+ `getNativeMaxOutputTokens`\n   * catalog (deepseek-pro=64K, deepseek-flash=32K).\n   *\n   * Pass an explicit number when a specific topic / surface needs a tighter\n   * latency cap or a higher ceiling for long-form generation (legal\n   * report writing, multi-K Write/Edit file bodies). Pre-0.1.21 maestro\n   * builds silently clamped at 4096 and truncated outputs mid-string;\n   * setting this field is now the supported way to lift that ceiling.\n   */\n  maxTokens?: number;\n  /**\n   * v0.1.22+: Claude-Code-style deferred tool catalog + `ToolSearch` built-in.\n   *\n   * Wired straight through to `maestro-agent-sdk`'s\n   * `AgentQueryOptions.enableToolSearch`. When `true`, the maestro provider\n   * registers every MCP tool as deferred — schemas stay off the wire until\n   * the model promotes them via `ToolSearch(\"select:Name1,Name2\")` or\n   * `ToolSearch(\"keyword\")`. Active set persists across resume.\n   *\n   * Otium's maestro provider supplies `true` when the caller leaves this\n   * option unset, because most forum turns carry enough MCP surface for the\n   * reminder-token savings to outweigh the first-use `ToolSearch` round-trip.\n   * Callers can still pass `false` per call when a narrow surface or\n   * latency-sensitive workflow is better served by eager MCP schemas.\n   *\n   * No-op for claude / codex agents — they have their own deferred-tool\n   * machinery owned by their respective SDKs.\n   */\n  enableToolSearch?: boolean;\n  /**\n   * Claude-Code-compatible exact tool denylist. Maestro v0.1.42+ hides these\n   * tools from provider schemas / ToolSearch and blocks dispatch if a stale\n   * call still arrives. Claude maps this to its SDK option. Codex does not\n   * support this name-based list; its provider-native multi-agent tool family\n   * is disabled separately through the Codex feature config.\n   */\n  disallowedTools?: readonly string[];\n  mcpEnabled?: string[] | null;\n  peerBridge?: PeerRuntimeBridgeContext;\n  mcpExtra?: Record<string, unknown>;\n  /**\n   * true for silent fork runs generating ask_session replies — restricts session-comm\n   * outbound tools (ask/tell/abort) so the forked session can only produce text\n   */\n  silent?: boolean;\n}\n\n/** State file written to data/users/{userId}/active-queries/{topic}.json while a query is running. */\nexport interface QueryState {\n  task?: string; // first 100 chars of prompt, newlines normalized\n  since: string; // ISO timestamp\n}\n",
+    "/**\n * Common context carried through the attachment/prompt-build pipeline.\n * Used by buildPromptFromMessage and related helpers.\n */\nexport interface SessionContext {\n  userId: number;\n  topicName?: string;\n  userDir?: string;\n  sessionType?: \"dm\" | \"forum\" | \"ephemeral\" | \"manager\" | \"cron\";\n}\n\nexport interface TokenUsage {\n  /** Aggregate billable input across every model call made during this turn. */\n  inputTokens: number;\n  outputTokens: number;\n  cacheCreationInputTokens?: number;\n  cacheReadInputTokens?: number;\n  /** Provider-reported query cost when available. */\n  costUsd?: number;\n  /** Tokens occupied by the latest model call, not aggregate turn spend. */\n  contextTokens?: number;\n  /** Provider-reported context window for the latest model call. */\n  contextWindow?: number;\n}\n\n/** Agent identifier — one of the supported AI provider backends. */\nexport type AgentKind = \"maestro\" | \"claude\" | \"codex\";\n\nexport const SUPPORTED_AGENTS: readonly AgentKind[] = [\"maestro\", \"claude\", \"codex\"] as const;\n\nexport function isAgentKind(value: unknown): value is AgentKind {\n  return typeof value === \"string\" && (SUPPORTED_AGENTS as readonly string[]).includes(value);\n}\n\n/**\n * Per-agent supported reasoning efforts. Single source of truth for both the\n * `EffortLevel` type and each registry's `validEfforts` runtime list — the\n * registries import these directly so adding a value in one place\n * propagates to validation, footer rendering, and zod enums.\n *\n * Claude SDK rejects 'minimal'; Codex SDK rejects 'max'. The two sets\n * intersect on low/medium/high/xhigh. Maestro (TS port) currently piggybacks\n * on the Anthropic provider, so its efforts mirror the Claude set; this can\n * narrow per-provider once Phase 5 lands.\n *\n * 'minimal' removed from codex: Codex API rejects it when default tools\n * (image_gen, web_search) are active, making agent sessions unusable.\n */\nexport const CLAUDE_EFFORT_VALUES = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\nexport const CODEX_EFFORT_VALUES = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\nexport const MAESTRO_EFFORT_VALUES = [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"] as const;\n\nexport type EffortLevel =\n  | (typeof CLAUDE_EFFORT_VALUES)[number]\n  | (typeof CODEX_EFFORT_VALUES)[number]\n  | (typeof MAESTRO_EFFORT_VALUES)[number];\n\n/**\n * Runtime iteration list (used by zod enums and any callers that need to\n * loop over every accepted value). Manually ordered for readability; the\n * `satisfies` check fails the build if an entry here isn't covered by the\n * per-agent unions above.\n */\nexport const EFFORT_VALUES = [\n  \"low\",\n  \"medium\",\n  \"high\",\n  \"xhigh\",\n  \"max\",\n] as const satisfies readonly EffortLevel[];\n\n/**\n * Normalized events yielded by any agent provider (claudeProvider, codexProvider).\n * The handler/event-processor consumes these without caring which backend produced them.\n *\n * `user_message` is the lone \"into-the-log\" variant — no provider yields it.\n * The query handler writes it directly to the conversation log right before\n * `runAgent()` starts, so cross-agent rollout reconstruction can pair every\n * assistant turn with the user prompt that triggered it. Consumers that only\n * react to provider output (e.g. processAgentEvent) can safely ignore it.\n */\n/**\n * Wire-safe projection of one task, carried by the `tasks` UnifiedEvent.\n *\n * This is also the on-disk shape of Otium's shared task store, so claude,\n * codex, and maestro render the same live panel from the same source of truth.\n */\nexport interface TaskSnapshot {\n  id: string;\n  subject: string;\n  status: \"pending\" | \"in_progress\" | \"completed\";\n  /** Task ids this one is blocked by; omitted when empty. */\n  blockedBy?: string[];\n  /** Present-continuous label for spinners, when set. */\n  activeForm?: string;\n  /** Owner / agent name for multi-agent runs, when set. */\n  owner?: string;\n}\n\nexport type UnifiedEvent =\n  | { type: \"user_message\"; content: string }\n  | { type: \"session\"; sessionId: string }\n  | {\n      type: \"tool_use\";\n      name: string;\n      input: Record<string, unknown>;\n      /** Provider-assigned id so the client can match tool_use→tool_result pairs. */\n      toolUseId?: string;\n    }\n  | { type: \"tool_progress\"; toolName: string; elapsed: number }\n  | { type: \"tool_use_summary\"; summary: string }\n  // Provider reasoning/thinking summary text (Codex `reasoning` items; Claude\n  // extended-thinking). Surfaced so background runs (cron/archiver) show the\n  // agent's thought process, not just tool calls.\n  | { type: \"reasoning\"; content: string }\n  // Full task-list snapshot (replace, not delta) from Otium's shared task\n  // store. Provider-native task/todo stores are not authoritative.\n  | { type: \"tasks\"; tasks: TaskSnapshot[] }\n  | {\n      type: \"tool_result\";\n      toolUseId: string;\n      content: string;\n      metadata?: {\n        truncatedForModel: boolean;\n        originalBytes: number;\n        returnedBytes: number;\n        omittedBytes?: number;\n        outputPath?: string;\n      };\n    }\n  | { type: \"text_delta\"; content: string }\n  | { type: \"text\"; content: string }\n  | { type: \"result\"; content: string; stopReason: string; usage?: TokenUsage }\n  | { type: \"file\"; path: string; source: string; origin: \"tag\" | \"extension\" }\n  | {\n      type: \"error\";\n      content: string;\n      usage?: TokenUsage;\n      code?: \"budget_exceeded\";\n    }\n  | { type: \"status\"; content: string };\n\nexport interface AgentInputAttachment {\n  id: string;\n  type: \"image\" | \"file\" | \"audio\";\n  filename: string;\n  mimeType: string;\n  sizeBytes: number;\n  path: string;\n}\n\n/** Worker-side runtime tools proxy user-facing state back to the canonical\n * hub topic identified here. */\nexport interface PeerRuntimeBridgeContext {\n  hubCellId: string;\n  hostTopicId: string;\n  hostQueryId: string;\n  canSpawnSubagents: boolean;\n}\n\nexport interface AgentQueryOptions {\n  agent: AgentKind;\n  prompt: string;\n  attachments?: AgentInputAttachment[];\n  sessionId?: string | null;\n  cwd: string;\n  systemPrompt: string;\n  userId?: string;\n  session?: string;\n  playwrightPort?: number;\n  playwrightCapability?: string;\n  bgBashPort?: number;\n  sessionType?: \"dm\" | \"forum\" | \"ephemeral\" | \"manager\" | \"cron\";\n  /** API topic id (REST/WS world). Carries per-query topic context for MCP servers. */\n  topicId?: string;\n  /** API query id for the currently running turn. Used by runtime MCP tools. */\n  queryId?: string;\n  /** Optional wiki-memory topic id. Derived topics use their root origin here\n   *  while other per-topic MCP servers keep `topicId` bound to the live room. */\n  wikiTopicId?: string;\n  /** Whether self-config MCP may enqueue an automatic continue turn after set_* changes. */\n  autoContinue?: boolean;\n  /** Expose Otium-only visual panel tools for this turn. Default-deny. */\n  visualTools?: boolean;\n  /** Expose adapter-backed file-delivery tools for this turn. Default-deny. */\n  fileDeliveryTools?: boolean;\n  abortController?: AbortController;\n  model?: string;\n  /** Provider-side hard budget when the selected SDK supports one. */\n  maxBudgetUsd?: number;\n  depth?: number;\n  agents?: Record<\n    string,\n    {\n      description: string;\n      prompt: string;\n      model?: string;\n      tools?: string[];\n      maxTurns?: number;\n      effort?: EffortLevel | number;\n    }\n  >;\n  effort?: EffortLevel;\n  /**\n   * Per-API-call `max_tokens` ceiling on the assistant's output. Wired\n   * through to the underlying provider request body for every agent\n   * (claude/codex/maestro). Omit to inherit each provider SDK's per-model\n   * default — for maestro that's the v0.1.21+ `getNativeMaxOutputTokens`\n   * catalog (deepseek-pro=64K, deepseek-flash=32K).\n   *\n   * Pass an explicit number when a specific topic / surface needs a tighter\n   * latency cap or a higher ceiling for long-form generation (legal\n   * report writing, multi-K Write/Edit file bodies). Pre-0.1.21 maestro\n   * builds silently clamped at 4096 and truncated outputs mid-string;\n   * setting this field is now the supported way to lift that ceiling.\n   */\n  maxTokens?: number;\n  /**\n   * v0.1.22+: Claude-Code-style deferred tool catalog + `ToolSearch` built-in.\n   *\n   * Wired straight through to `maestro-agent-sdk`'s\n   * `AgentQueryOptions.enableToolSearch`. When `true`, the maestro provider\n   * registers every MCP tool as deferred — schemas stay off the wire until\n   * the model promotes them via `ToolSearch(\"select:Name1,Name2\")` or\n   * `ToolSearch(\"keyword\")`. Active set persists across resume.\n   *\n   * Otium's maestro provider supplies `true` when the caller leaves this\n   * option unset, because most forum turns carry enough MCP surface for the\n   * reminder-token savings to outweigh the first-use `ToolSearch` round-trip.\n   * Callers can still pass `false` per call when a narrow surface or\n   * latency-sensitive workflow is better served by eager MCP schemas.\n   *\n   * No-op for claude / codex agents — they have their own deferred-tool\n   * machinery owned by their respective SDKs.\n   */\n  enableToolSearch?: boolean;\n  /**\n   * Claude-Code-compatible exact tool denylist. Maestro v0.1.42+ hides these\n   * tools from provider schemas / ToolSearch and blocks dispatch if a stale\n   * call still arrives. Claude maps this to its SDK option. Codex does not\n   * support this name-based list; its provider-native multi-agent tool family\n   * is disabled separately through the Codex feature config.\n   */\n  disallowedTools?: readonly string[];\n  mcpEnabled?: string[] | null;\n  peerBridge?: PeerRuntimeBridgeContext;\n  mcpExtra?: Record<string, unknown>;\n  /**\n   * true for silent fork runs generating ask_session replies — restricts session-comm\n   * outbound tools (ask/tell/abort) so the forked session can only produce text\n   */\n  silent?: boolean;\n}\n\n/** State file written to data/users/{userId}/active-queries/{topic}.json while a query is running. */\nexport interface QueryState {\n  task?: string; // first 100 chars of prompt, newlines normalized\n  since: string; // ISO timestamp\n}\n",
     "// Runtime-adaptive SQLite façade.\n//\n// Why this exists: Otium normally runs on bun and uses `bun:sqlite` (native,\n// fast, zero-build). But the `codex` agent's MCP servers must run on pure node\n// — codex 0.135's rmcp stdio client can't handshake with bun-spawned servers\n// (see serverLaunch in platform/mcp-config.ts). `bun:sqlite` doesn't exist\n// under node, so any MCP server that touches the DB would crash on import.\n//\n// This module picks the backend at runtime and re-exports it as `Database`:\n//   - under bun  → the real `bun:sqlite` Database (unchanged behavior)\n//   - under node → a thin shim over node:sqlite's DatabaseSync exposing the\n//     exact subset Otium uses: new Database(path, {readonly?,create?}),\n//     .query()/.prepare() → statement, .exec(), .run(), .transaction(fn),\n//     .close(); statements support positional `?` params via .run()/.get()/\n//     .all(). (No named-object params / .values()/.iterate()/.as() are used in\n//     this codebase, so the shim intentionally omits them.)\n//\n// The TYPE of the exported `Database` is bun:sqlite's own class type (imported\n// type-only, so it's erased at runtime and never resolved under node). That\n// keeps every existing call site — including generic `.query<Row, Params>()`\n// usages — type-checking exactly as before with zero changes.\n//\n// The bun branch uses a dynamic import so node never resolves the `bun:sqlite`\n// specifier (dead code under node), and the node branch's `node:sqlite` import\n// never runs under bun.\n\nimport type { Database as BunDatabase } from \"bun:sqlite\";\n\n// `mock.module()` can replace the Bun global while a test graph is being\n// evaluated. The runtime version flag is stable and is also the documented\n// cross-runtime discriminator.\nconst isBun = typeof process.versions.bun === \"string\";\n\ntype DatabaseCtor = typeof BunDatabase;\n\nlet Database: DatabaseCtor;\n\nif (isBun) {\n  ({ Database } = await import(\"bun:sqlite\"));\n} else {\n  // node:sqlite has no type declarations under our tsconfig (`types: bun-types`\n  // only), and `bun-types` doesn't ship them — so type the dynamic import\n  // locally and use a `string` specifier to keep tsc from trying to resolve it.\n  type NodeStatement = {\n    run(...params: unknown[]): unknown;\n    get(...params: unknown[]): unknown;\n    all(...params: unknown[]): unknown[];\n  };\n  type NodeDatabaseSync = {\n    prepare(sql: string): NodeStatement;\n    exec(sql: string): void;\n    close(): void;\n  };\n  type NodeSqliteModule = {\n    DatabaseSync: new (path: string, options?: { readOnly?: boolean }) => NodeDatabaseSync;\n  };\n  // Keep Bun's resolver from eagerly resolving the Node-only builtin even\n  // though this branch is dead there (notably under `bun test` + mock.module).\n  const nodeSqliteSpecifier = [\"node\", \"sqlite\"].join(\":\");\n  const { DatabaseSync } = (await import(nodeSqliteSpecifier)) as NodeSqliteModule;\n\n  type DbOptions = { readonly?: boolean; create?: boolean };\n\n  class NodeDatabase {\n    #db: NodeDatabaseSync;\n\n    constructor(path: string, options: DbOptions = {}) {\n      // node:sqlite opens read-write and creates-if-missing by default, which\n      // matches bun's `{create:true}`. For readonly we must not create.\n      this.#db = options.readonly\n        ? new DatabaseSync(path, { readOnly: true })\n        : new DatabaseSync(path);\n    }\n\n    query(sql: string) {\n      return this.#db.prepare(sql);\n    }\n\n    prepare(sql: string) {\n      return this.#db.prepare(sql);\n    }\n\n    exec(sql: string): void {\n      this.#db.exec(sql);\n    }\n\n    run(sql: string, ...params: unknown[]) {\n      return this.#db.prepare(sql).run(...params);\n    }\n\n    transaction<Args extends unknown[], R>(fn: (...args: Args) => R): (...args: Args) => R {\n      // bun's db.transaction(fn) returns a function that runs fn inside a\n      // transaction when called. node:sqlite has no helper, so emulate with\n      // BEGIN/COMMIT/ROLLBACK. It also exposes deferred/immediate/exclusive\n      // variants; mirror those so Node-launched MCP servers can share call\n      // sites with Bun.\n      const run =\n        (begin: \"BEGIN\" | \"BEGIN DEFERRED\" | \"BEGIN IMMEDIATE\" | \"BEGIN EXCLUSIVE\") =>\n        (...args: Args): R => {\n          this.#db.exec(begin);\n          try {\n            const result = fn(...args);\n            this.#db.exec(\"COMMIT\");\n            return result;\n          } catch (err) {\n            this.#db.exec(\"ROLLBACK\");\n            throw err;\n          }\n        };\n      const tx = run(\"BEGIN\") as ((...args: Args) => R) & {\n        deferred: (...args: Args) => R;\n        immediate: (...args: Args) => R;\n        exclusive: (...args: Args) => R;\n      };\n      tx.deferred = run(\"BEGIN DEFERRED\");\n      tx.immediate = run(\"BEGIN IMMEDIATE\");\n      tx.exclusive = run(\"BEGIN EXCLUSIVE\");\n      return tx;\n    }\n\n    close(): void {\n      this.#db.close();\n    }\n  }\n\n  Database = NodeDatabase as unknown as DatabaseCtor;\n}\n\nexport { Database };\n",
     "import { createCipheriv, createDecipheriv, createHash, randomBytes } from \"node:crypto\";\nimport { VAULT_MASTER_KEY } from \"#platform/config\";\n\nconst ENVELOPE_PREFIX = \"otium-vault:v1:\";\nconst IV_BYTES = 12;\nconst KEY_BYTES = 32;\n\nfunction encryptionKey(masterKey = VAULT_MASTER_KEY): Buffer {\n  return createHash(\"sha256\")\n    .update(\"otium-vault-value-v1\\0\", \"utf8\")\n    .update(masterKey, \"utf8\")\n    .digest()\n    .subarray(0, KEY_BYTES);\n}\n\nfunction aad(userId: string, key: string): Buffer {\n  return Buffer.from(`${userId}\\0${key.toUpperCase()}`, \"utf8\");\n}\n\nexport function isEncryptedVaultValue(value: string): boolean {\n  return value.startsWith(ENVELOPE_PREFIX);\n}\n\n/** Encrypt one vault row. The user/key binding prevents ciphertext row swapping. */\nexport function encryptVaultValue(\n  userId: string,\n  key: string,\n  value: string,\n  masterKey = VAULT_MASTER_KEY,\n): string {\n  const iv = randomBytes(IV_BYTES);\n  const cipher = createCipheriv(\"aes-256-gcm\", encryptionKey(masterKey), iv);\n  cipher.setAAD(aad(userId, key));\n  const ciphertext = Buffer.concat([cipher.update(value, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `${ENVELOPE_PREFIX}${iv.toString(\"base64url\")}.${ciphertext.toString(\"base64url\")}.${tag.toString(\"base64url\")}`;\n}\n\n/**\n * Decrypt a stored value. Plaintext rows are accepted for rolling upgrades and\n * are re-encrypted by the storage layer immediately after a successful read.\n */\nexport function decryptVaultValue(\n  userId: string,\n  key: string,\n  storedValue: string,\n  masterKey = VAULT_MASTER_KEY,\n): { value: string; legacyPlaintext: boolean } {\n  if (!isEncryptedVaultValue(storedValue)) {\n    return { value: storedValue, legacyPlaintext: true };\n  }\n\n  const encoded = storedValue.slice(ENVELOPE_PREFIX.length);\n  const [ivPart, ciphertextPart, tagPart, ...extra] = encoded.split(\".\");\n  if (!ivPart || ciphertextPart === undefined || !tagPart || extra.length > 0) {\n    throw new Error(\"Invalid encrypted vault value\");\n  }\n\n  const iv = Buffer.from(ivPart, \"base64url\");\n  const ciphertext = Buffer.from(ciphertextPart, \"base64url\");\n  const tag = Buffer.from(tagPart, \"base64url\");\n  if (iv.length !== IV_BYTES || tag.length !== 16) {\n    throw new Error(\"Invalid encrypted vault value\");\n  }\n\n  const decipher = createDecipheriv(\"aes-256-gcm\", encryptionKey(masterKey), iv);\n  decipher.setAAD(aad(userId, key));\n  decipher.setAuthTag(tag);\n  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n  return { value: plaintext.toString(\"utf8\"), legacyPlaintext: false };\n}\n"
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",