negotium 0.1.17 → 0.1.18

package/dist/agent-helpers.js

@@ -0,0 +1,1764 @@
+// @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __toESM = (mod, isNodeMode, target) => {
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: () => mod[key],
+        enumerable: true
+      });
+  return to;
+};
+var __require = import.meta.require;
+
+// ../../packages/core/src/agents/auth-check.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2, platform } from "os";
+import { join as join2 } from "path";
+
+// ../../packages/core/src/platform/config.ts
+import { randomBytes } from "crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+
+// ../../packages/core/src/platform/config-helpers.ts
+function readEnvText(env, key) {
+  const value = env[key]?.trim();
+  return value || undefined;
+}
+function parseRuntimePort(value, fallback) {
+  if (!value)
+    return fallback;
+  const port = Number.parseInt(value, 10);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : fallback;
+}
+
+// ../../packages/core/src/platform/logger.ts
+import pino from "pino";
+function createStdioLogger(options = {}) {
+  const development = options.development ?? true;
+  return pino({
+    level: options.level ?? process.env.LOG_LEVEL ?? "info",
+    transport: development ? {
+      target: "pino-pretty",
+      options: {
+        colorize: true,
+        translateTime: "SYS:yyyy-mm-dd HH:MM:ss",
+        destination: 2
+      }
+    } : undefined
+  }, pino.destination(2));
+}
+var logger = createStdioLogger();
+
+// ../../packages/core/src/types.ts
+var SUPPORTED_AGENTS = ["maestro", "claude", "codex"];
+function isAgentKind(value) {
+  return typeof value === "string" && SUPPORTED_AGENTS.includes(value);
+}
+var CLAUDE_EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"];
+var CODEX_EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"];
+
+// ../../packages/core/src/platform/config.ts
+function envText(envKey) {
+  return readEnvText(process.env, envKey);
+}
+function resolveAgentEnv(envKey, fallback, legacyEnvKey) {
+  const value = envText(envKey) ?? (legacyEnvKey ? envText(legacyEnvKey) : undefined);
+  return isAgentKind(value) ? value : fallback;
+}
+var HOME = homedir();
+function resolveProjectRoot() {
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const packagedRuntime = resolve(moduleDir, "runtime");
+  if (existsSync(resolve(packagedRuntime, "src")))
+    return packagedRuntime;
+  return resolve(moduleDir, "../..");
+}
+var PROJECT_ROOT = resolveProjectRoot();
+function resolveDependencyBin(name) {
+  let dir = PROJECT_ROOT;
+  while (true) {
+    const candidate = resolve(dir, "node_modules", ".bin", name);
+    if (existsSync(candidate))
+      return candidate;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return candidate;
+    dir = parent;
+  }
+}
+var STATE_DIR_ENV = envText("NEGOTIUM_STATE_DIR");
+var STATE_DIR = STATE_DIR_ENV ? resolve(STATE_DIR_ENV) : resolve(HOME, ".negotium");
+function resolveLocalStateDir(envKey, stateName) {
+  const envValue = envText(envKey);
+  if (envValue)
+    return resolve(envValue);
+  return resolve(STATE_DIR, stateName);
+}
+function parsePortEnv(envValue, fallback) {
+  return parseRuntimePort(envValue, fallback);
+}
+var WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
+var TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
+var SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
+var CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
+var BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
+var DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
+var SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
+var CLAUDE_EXECUTABLE = resolve(HOME, ".local/bin/claude");
+function resolveBrowserMcpBin(envValue) {
+  const override = envValue?.trim();
+  if (override) {
+    if (!/(^|\/)(mcp-patchright|mcp-patchright-http\.mjs)$/.test(override)) {
+      throw new Error("NEGOTIUM_BROWSER_MCP_BIN must point to the authenticated mcp-patchright wrapper.");
+    }
+    return override;
+  }
+  return PATCHRIGHT_MCP_BIN;
+}
+var PATCHRIGHT_MCP_BIN = resolve(PROJECT_ROOT, "scripts/mcp-patchright-http.mjs");
+var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
+var TSX_BIN = resolveDependencyBin("tsx");
+var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");
+var SESSION_COMM_SERVER = resolve(PROJECT_ROOT, "src/mcp/session-comm/server.ts");
+var TASK_SERVER = resolve(PROJECT_ROOT, "src/mcp/task-server.ts");
+var CANONICAL_MCP_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/canonical-proxy-server.ts");
+var WIKI_SERVER = resolve(PROJECT_ROOT, "src/mcp/wiki-server.ts");
+var TOKEN_STATS_SERVER = resolve(PROJECT_ROOT, "src/mcp/token-stats-server.ts");
+var SYSTEM_HEALTH_SERVER = resolve(PROJECT_ROOT, "src/mcp/system-health-server.ts");
+var AGENT_HEALTH_SERVER = resolve(PROJECT_ROOT, "src/mcp/agent-health-server.ts");
+var BACKGROUND_BASH_SERVER = resolve(PROJECT_ROOT, "src/mcp/background-bash-server.ts");
+var VAULT_SERVER = resolve(PROJECT_ROOT, "src/mcp/vault-server.ts");
+var BG_BASH_BASE_PORT = parsePortEnv(process.env.BG_BASH_BASE_PORT, 9700);
+var BG_BASH_MAX_PORT = parsePortEnv(process.env.BG_BASH_MAX_PORT, 9799);
+function loadOrCreateLocalSecret(envKey, filename, options = {}) {
+  const envValue = envText(envKey);
+  const secretFile = resolve(STATE_DIR, filename);
+  mkdirSync(dirname(secretFile), { recursive: true });
+  if (envValue) {
+    if (options.persistEnvValue) {
+      writeFileSync(secretFile, `${envValue}
+`, { mode: 384 });
+      chmodSync(secretFile, 384);
+    }
+    return envValue;
+  }
+  if (existsSync(secretFile)) {
+    const stored = readFileSync(secretFile, "utf-8").trim();
+    if (stored) {
+      chmodSync(secretFile, 384);
+      return stored;
+    }
+  }
+  const secret = randomBytes(32).toString("base64url");
+  try {
+    writeFileSync(secretFile, `${secret}
+`, { mode: 384, flag: "wx" });
+    return secret;
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    const stored = readFileSync(secretFile, "utf-8").trim();
+    if (!stored)
+      throw new Error(`Secret file exists but is empty: ${secretFile}`);
+    chmodSync(secretFile, 384);
+    return stored;
+  }
+}
+var RUNTIME_MCP_SECRET = loadOrCreateLocalSecret("RUNTIME_MCP_SECRET", "runtime-mcp-secret");
+var NODE_CONTROL_TOKEN = loadOrCreateLocalSecret("NEGOTIUM_CONTROL_TOKEN", "node-control-token");
+var VAULT_MASTER_KEY = loadOrCreateLocalSecret("NEGOTIUM_VAULT_MASTER_KEY", "vault-master-key", { persistEnvValue: true });
+delete process.env.NEGOTIUM_VAULT_MASTER_KEY;
+var NEGOTIUM_PORT = parseInt(process.env.NEGOTIUM_PORT || "7777", 10);
+var hostname = process.env.HOSTNAME || "127.0.0.1";
+var DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
+var LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+var SESSIONS_DB = process.env.SESSIONS_DB_PATH ? resolve(process.env.SESSIONS_DB_PATH) : resolve(DATA_DIR, "sessions.db");
+var DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
+var USERS_LOG_DIR = resolve(DATA_DIR, "users");
+var RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "run");
+var PROGRESS_DIR = resolve(RUN_DIR, "progress");
+var DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
+var DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
+var SESSION_INBOX_DIR = resolve(RUN_DIR, "session-inbox");
+var SESSION_ASKS_DIR = resolve(RUN_DIR, "session-asks");
+var PLAYWRIGHT_BASE_PORT = parsePortEnv(process.env.PLAYWRIGHT_BASE_PORT, 9100);
+var PLAYWRIGHT_MAX_PORT = parsePortEnv(process.env.PLAYWRIGHT_MAX_PORT, 9499);
+var PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
+mkdirSync(STATE_DIR, { recursive: true });
+mkdirSync(DATA_DIR, { recursive: true });
+mkdirSync(LOG_DIR, { recursive: true });
+mkdirSync(PROGRESS_DIR, { recursive: true });
+mkdirSync(DM_CMD_DIR, { recursive: true });
+mkdirSync(DM_RESP_DIR, { recursive: true });
+mkdirSync(SESSION_INBOX_DIR, { recursive: true });
+mkdirSync(SESSION_ASKS_DIR, { recursive: true });
+mkdirSync(PLAYWRIGHT_PORTS_DIR, { recursive: true });
+mkdirSync(WORKSPACE_DIR, { recursive: true });
+mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
+mkdirSync(SHARED_WIKI_DIR, { recursive: true });
+mkdirSync(CONTEXTS_DIR, { recursive: true });
+mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
+mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
+mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
+var ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000;
+var AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, "src/prompts/agents");
+var RESOURCES_DIR = resolve(PROJECT_ROOT, "src/resources");
+var MODEL_SONNET = "claude-sonnet-5";
+var MODEL_OPUS = "claude-opus-4-8";
+var MODEL_FABLE = "claude-fable-5";
+var FALLBACK_AGENT = resolveAgentEnv("FALLBACK_AGENT", "maestro", "DEFAULT_AGENT");
+var SESSION_AGENT = resolveAgentEnv("SESSION_AGENT", FALLBACK_AGENT);
+var GATEWAY_AGENT = resolveAgentEnv("GATEWAY_AGENT", FALLBACK_AGENT);
+var FALLBACK_MODEL = envText("FALLBACK_MODEL") ?? envText("DEFAULT_MODEL");
+function resolveModelEnv(envKey, agentConst) {
+  return envText(envKey) ?? (agentConst === FALLBACK_AGENT ? FALLBACK_MODEL : undefined);
+}
+var SESSION_MODEL = resolveModelEnv("SESSION_MODEL", SESSION_AGENT);
+var GATEWAY_MODEL = resolveModelEnv("GATEWAY_MODEL", GATEWAY_AGENT);
+var FFMPEG_BIN = envText("FFMPEG_BIN");
+var FFPROBE_BIN = envText("FFPROBE_BIN");
+var PYTHON_BIN = envText("PYTHON_BIN") ?? "python3";
+var FASTER_WHISPER_WRAPPER = envText("FASTER_WHISPER_WRAPPER") ?? resolve(PROJECT_ROOT, "scripts/faster-whisper-wrapper.py");
+var WHISPER_MODEL = envText("WHISPER_MODEL_FILE") ?? "turbo";
+var TESSERACT_BIN = envText("TESSERACT_BIN") ?? "tesseract";
+var PDFTOTEXT_BIN = envText("PDFTOTEXT_BIN") ?? "pdftotext";
+var _envMaxTellDepth = Number.parseInt(process.env.MAX_TELL_DEPTH ?? "", 10);
+var MAX_TELL_DEPTH = Number.isInteger(_envMaxTellDepth) && _envMaxTellDepth > 0 ? _envMaxTellDepth : 20;
+function codexAuthFilePath() {
+  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), ".codex", "auth.json");
+}
+
+// ../../packages/core/src/agents/auth-check.ts
+var defaultAgentAuthHost = {
+  codexAuthFilePath,
+  exists: existsSync2,
+  environment: process.env,
+  homeDirectory: homedir2,
+  operatingSystem: platform,
+  hasMacOsCredential(service) {
+    try {
+      execFileSync("security", ["find-generic-password", "-s", service], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+function checkAgentAuth(agent, host = defaultAgentAuthHost) {
+  switch (agent) {
+    case "codex": {
+      const path = host.codexAuthFilePath();
+      if (host.exists(path))
+        return { ok: true };
+      return {
+        ok: false,
+        error: `codex is not logged in (auth file missing at ${path}). Run \`codex login\` first`
+      };
+    }
+    case "claude": {
+      if (host.environment.ANTHROPIC_API_KEY)
+        return { ok: true };
+      if (host.operatingSystem() === "darwin") {
+        if (host.hasMacOsCredential("Claude Code-credentials")) {
+          return { ok: true };
+        }
+        return {
+          ok: false,
+          error: "claude is not logged in (no macOS keychain entry 'Claude Code-credentials'). Run `claude` and complete login first"
+        };
+      }
+      const path = join2(host.homeDirectory(), ".claude", ".credentials.json");
+      if (host.exists(path))
+        return { ok: true };
+      return {
+        ok: false,
+        error: `claude is not logged in (credentials missing at ${path}). Run \`claude\` and complete login first`
+      };
+    }
+    case "maestro": {
+      if (host.environment.DEEPSEEK_API_KEY)
+        return { ok: true };
+      return {
+        ok: false,
+        error: "maestro is not authenticated (DEEPSEEK_API_KEY env var not set)"
+      };
+    }
+  }
+}
+// ../../packages/core/src/agents/codex-tree-kill.ts
+import { execFileSync as execFileSync2 } from "child_process";
+
+// ../../packages/core/src/agents/codex-tree-manager.ts
+function createCodexTreeManager(host, options = {}) {
+  const sigkillDelayMs = options.sigkillDelayMs ?? 5000;
+  const treeDepthCap = options.treeDepthCap ?? 16;
+  const processNamePattern = options.processNamePattern ?? /codex/i;
+  const ownedPids = new Set;
+  let spawnChain = Promise.resolve();
+  function collectTree(rootPid, out = new Set, depth = 0) {
+    if (out.has(rootPid))
+      return out;
+    out.add(rootPid);
+    if (depth >= treeDepthCap) {
+      host.logger.warn({ rootPid, depth, cap: treeDepthCap }, "codex-tree-kill: tree depth cap reached, descendants beyond this point not collected");
+      return out;
+    }
+    for (const child of host.getDirectChildren(rootPid)) {
+      collectTree(child, out, depth + 1);
+    }
+    return out;
+  }
+  function snapshotChildren() {
+    const snapshot = new Map;
+    for (const pid of host.getDirectChildren(host.parentPid)) {
+      const name = host.getProcessName(pid);
+      if (!name || !processNamePattern.test(name))
+        continue;
+      snapshot.set(pid, host.getProcessStart(pid));
+    }
+    return snapshot;
+  }
+  function registerOwnedPids(pids) {
+    for (const pid of pids)
+      ownedPids.add(pid);
+  }
+  function unregisterOwnedPids(pids) {
+    for (const pid of pids)
+      ownedPids.delete(pid);
+  }
+  function findNewChildren(baseline) {
+    const novel = [];
+    for (const [pid, start] of snapshotChildren()) {
+      const previousStart = baseline.get(pid);
+      if (previousStart !== undefined && previousStart === start)
+        continue;
+      if (!ownedPids.has(pid))
+        novel.push(pid);
+    }
+    return novel;
+  }
+  async function acquireSpawnLock() {
+    const previous = spawnChain;
+    let release;
+    let released = false;
+    spawnChain = new Promise((resolve2) => {
+      release = () => {
+        if (released)
+          return;
+        released = true;
+        resolve2();
+      };
+    });
+    await previous;
+    return release;
+  }
+  async function withSpawnSerial(fn) {
+    const release = await acquireSpawnLock();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+  function isAlive(pid) {
+    try {
+      host.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  function isSameProcess(pid, start) {
+    return start !== "" && isAlive(pid) && host.getProcessStart(pid) === start;
+  }
+  function signalTrees(rootPids) {
+    if (rootPids.length === 0)
+      return null;
+    const targets = new Map;
+    for (const rootPid of rootPids) {
+      for (const pid of collectTree(rootPid)) {
+        if (!targets.has(pid))
+          targets.set(pid, host.getProcessStart(pid));
+      }
+    }
+    host.logger.warn({ rootPids, totalPids: targets.size }, "codex-tree-kill: SIGTERM process tree");
+    for (const pid of targets.keys()) {
+      try {
+        host.kill(pid, "SIGTERM");
+      } catch {}
+    }
+    return { rootPids, targets };
+  }
+  function hasSurvivors(targets) {
+    for (const [pid, start] of targets) {
+      if (isSameProcess(pid, start))
+        return true;
+    }
+    return false;
+  }
+  function killStragglers(plan) {
+    const aliveTargets = [];
+    let droppedAsPossibleReuse = 0;
+    for (const [pid, start] of plan.targets) {
+      if (isSameProcess(pid, start))
+        aliveTargets.push(pid);
+      else if (isAlive(pid))
+        droppedAsPossibleReuse++;
+    }
+    if (aliveTargets.length === 0)
+      return;
+    const reachable = new Set(aliveTargets);
+    for (const rootPid of plan.rootPids) {
+      const start = plan.targets.get(rootPid);
+      if (start && isSameProcess(rootPid, start)) {
+        for (const pid of collectTree(rootPid))
+          reachable.add(pid);
+      }
+    }
+    const stragglers = [];
+    for (const pid of reachable) {
+      const start = plan.targets.get(pid);
+      if (start && isSameProcess(pid, start))
+        stragglers.push(pid);
+      else if (isAlive(pid))
+        droppedAsPossibleReuse++;
+    }
+    host.logger.warn({
+      aliveRoots: plan.rootPids.filter((pid) => {
+        const start = plan.targets.get(pid);
+        return start ? isSameProcess(pid, start) : false;
+      }),
+      totalStragglers: stragglers.length,
+      droppedAsPossibleReuse
+    }, "codex-tree-kill: SIGKILL fallback after SIGTERM timeout");
+    for (const pid of stragglers) {
+      try {
+        host.kill(pid, "SIGKILL");
+      } catch {}
+    }
+  }
+  function killTrees(rootPids) {
+    const plan = signalTrees(rootPids);
+    if (!plan)
+      return;
+    const timer = setTimeout(() => killStragglers(plan), sigkillDelayMs);
+    timer.unref?.();
+  }
+  async function killOwnedTreesForShutdown(graceMs = 3000) {
+    const roots = new Set(ownedPids);
+    for (const pid of snapshotChildren().keys())
+      roots.add(pid);
+    const plan = signalTrees([...roots]);
+    if (!plan)
+      return;
+    const deadline = Date.now() + Math.max(0, graceMs);
+    while (Date.now() < deadline && hasSurvivors(plan.targets)) {
+      await new Promise((resolve2) => setTimeout(resolve2, Math.min(100, Math.max(1, deadline - Date.now()))));
+    }
+    killStragglers(plan);
+  }
+  return {
+    snapshotChildren,
+    findNewChildren,
+    registerOwnedPids,
+    unregisterOwnedPids,
+    acquireSpawnLock,
+    withSpawnSerial,
+    killTrees,
+    killOwnedTreesForShutdown
+  };
+}
+
+// ../../packages/core/src/agents/codex-tree-kill.ts
+function execText(command, args) {
+  try {
+    return execFileSync2(command, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+var posixHost = {
+  parentPid: process.pid,
+  getDirectChildren(parentPid) {
+    const output = execText("pgrep", ["-P", String(parentPid)]);
+    if (!output)
+      return [];
+    return output.split(`
+`).map(Number).filter((pid) => Number.isFinite(pid) && pid > 0);
+  },
+  getProcessName: (pid) => execText("ps", ["-p", String(pid), "-o", "comm="]),
+  getProcessStart: (pid) => execText("ps", ["-p", String(pid), "-o", "lstart="]),
+  kill: (pid, signal) => process.kill(pid, signal),
+  logger
+};
+var manager = createCodexTreeManager(posixHost);
+var snapshotCodexChildren = manager.snapshotChildren;
+var findNewCodexChildren = manager.findNewChildren;
+var registerOwnedCodexPids = manager.registerOwnedPids;
+var unregisterOwnedCodexPids = manager.unregisterOwnedPids;
+var acquireCodexSpawnLock = manager.acquireSpawnLock;
+var withCodexSpawnSerial = manager.withSpawnSerial;
+var killCodexTrees = manager.killTrees;
+var killOwnedCodexTreesForShutdown = manager.killOwnedTreesForShutdown;
+// ../../packages/core/src/agents/fork.ts
+import { existsSync as existsSync7, unlinkSync as unlinkSync7 } from "fs";
+
+// ../../packages/core/src/agents/claude-registry.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+
+// ../../packages/core/src/agents/rollout/claude.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+
+// ../../packages/core/src/agents/rollout/shared.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
+var trustedWorkspaceRoots = [WORKSPACE_DIR, DM_WORKSPACE_DIR, TOPIC_WORKSPACE_DIR].map((root) => resolve2(root));
+var FIXTURES_DIR = join3(__dirname2, "..", "fixtures");
+function clone(obj) {
+  return structuredClone(obj);
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function assertUuidLike(label, value) {
+  if (!UUID_RE.test(value)) {
+    throw new Error(`rollout: ${label} is not a UUID-shaped string: ${value}`);
+  }
+}
+function assertCwdInWorkspace(cwd) {
+  const abs = resolve2(cwd);
+  const ok = trustedWorkspaceRoots.some((root) => abs === root || abs.startsWith(`${root}/`));
+  if (!ok) {
+    throw new Error(`rollout: cwd outside trusted workspace roots: ${cwd} (resolved=${abs})`);
+  }
+}
+function ensureCwdExists(cwd) {
+  assertCwdInWorkspace(cwd);
+  try {
+    mkdirSync2(cwd, { recursive: true });
+  } catch (err) {
+    logger.warn({ err, cwd }, "rollout: ensureCwdExists failed \u2014 caller should pre-create cwd");
+  }
+}
+function truncate(text, n) {
+  const cps = Array.from(text);
+  return cps.length > n ? `${cps.slice(0, n).join("")}\u2026` : text;
+}
+function extractChatPairs(entries, opts = { includeToolAnnotations: true }) {
+  const pairs = [];
+  let pendingUser = null;
+  let pendingAssistantParts = [];
+  let toolBuffer = [];
+  const flushAssistant = () => {
+    if (pendingUser === null)
+      return;
+    const tools = opts.includeToolAnnotations && toolBuffer.length > 0 ? `
+
+${toolBuffer.join(`
+`)}` : "";
+    const assistantText = pendingAssistantParts.join("").trim() + tools;
+    if (assistantText.trim()) {
+      pairs.push({ userText: pendingUser, assistantText });
+    }
+    pendingUser = null;
+    pendingAssistantParts = [];
+    toolBuffer = [];
+  };
+  for (const entry of entries) {
+    const ev = entry.event;
+    switch (ev.type) {
+      case "user_message": {
+        flushAssistant();
+        pendingUser = ev.content;
+        break;
+      }
+      case "session":
+        if (pendingAssistantParts.length > 0 || toolBuffer.length > 0) {
+          flushAssistant();
+        }
+        break;
+      case "text": {
+        if (pendingUser === null) {
+          pendingUser = "(continued)";
+        }
+        pendingAssistantParts.push(ev.content);
+        break;
+      }
+      case "result": {
+        if (pendingUser === null) {
+          pendingUser = "(continued)";
+        }
+        pendingAssistantParts = [ev.content];
+        flushAssistant();
+        break;
+      }
+      case "text_delta":
+        break;
+      case "tool_use": {
+        const u = ev;
+        toolBuffer.push(`<!-- Tool: ${u.name} ${truncate(JSON.stringify(u.input), 200)} -->`);
+        break;
+      }
+      case "tool_result": {
+        const u = ev;
+        toolBuffer.push(`<!-- Tool result: ${truncate(u.content, 200)} -->`);
+        break;
+      }
+      case "error": {
+        const u = ev;
+        toolBuffer.push(`[Error: ${truncate(u.content, 200)}]`);
+        break;
+      }
+      case "tool_progress":
+      case "tool_use_summary":
+      case "file":
+      case "status":
+        break;
+    }
+  }
+  flushAssistant();
+  return pairs;
+}
+
+// ../../packages/core/src/platform/jsonl.ts
+import {
+  appendFileSync,
+  closeSync,
+  fsyncSync,
+  mkdirSync as mkdirSync3,
+  openSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  statSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3 } from "path";
+
+// ../../packages/core/src/platform/file-utils.ts
+import { unlinkSync } from "fs";
+function createSafeUnlink(host) {
+  return (path, warnLabel) => {
+    try {
+      host.unlink(path);
+    } catch (e) {
+      if (e?.code === "ENOENT")
+        return;
+      if (warnLabel)
+        host.warn({ err: e, path }, warnLabel);
+    }
+  };
+}
+var defaultSafeUnlink = createSafeUnlink({
+  unlink: unlinkSync,
+  warn: (context, message) => logger.warn(context, message)
+});
+
+// ../../packages/core/src/platform/jsonl.ts
+function parseJsonlText(raw) {
+  return raw.trim().split(`
+`).filter(Boolean).map((line) => JSON.parse(line));
+}
+var LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function writeJsonlFile(filePath, entries) {
+  const dir = dirname3(filePath);
+  mkdirSync3(dir, { recursive: true });
+  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  const payload = `${entries.map((e) => JSON.stringify(e)).join(`
+`)}
+`;
+  let fd = null;
+  try {
+    fd = openSync(tmpPath, "w");
+    writeFileSync2(fd, payload);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmpPath, filePath);
+    fsyncDirectoryBestEffort(dir);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync2(tmpPath);
+    } catch {}
+    throw err;
+  }
+}
+function fsyncDirectoryBestEffort(dir) {
+  let fd = null;
+  try {
+    fd = openSync(dir, "r");
+    fsyncSync(fd);
+  } catch {} finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+  }
+}
+
+// ../../packages/core/src/agents/rollout/claude.ts
+var _attachmentsCache = null;
+function loadClaudeAttachments() {
+  if (_attachmentsCache)
+    return _attachmentsCache;
+  const raw = readFileSync3(join4(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
+  const lines = parseJsonlText(raw);
+  if (lines.length < 2) {
+    throw new Error(`loadClaudeAttachments: expected >=2 entries in claude-attachments.jsonl, got ${lines.length}`);
+  }
+  _attachmentsCache = {
+    deferredToolsDelta: lines[0],
+    skillListing: lines[1]
+  };
+  return _attachmentsCache;
+}
+var CLAUDE_SDK_VERSION = "2.1.126";
+var CLAUDE_DEFAULT_MODEL = "claude-sonnet-5";
+var CLAUDE_DEFAULT_GIT_BRANCH = "HEAD";
+function encodeClaudeCwd(cwd) {
+  const realCwd = cwd.startsWith("/tmp/") ? cwd.replace(/^\/tmp\//, "/private/tmp/") : cwd;
+  return `-${realCwd.replaceAll(/[^a-zA-Z0-9]/g, "-").replace(/^-/, "")}`;
+}
+function writeClaudeRollout(opts) {
+  const sessionId = opts.sessionId ?? randomUUID();
+  assertUuidLike("sessionId", sessionId);
+  ensureCwdExists(opts.cwd);
+  const pairs = opts.pairs ?? extractChatPairs(opts.entries ?? []);
+  const cwdReal = opts.cwd.startsWith("/tmp/") ? opts.cwd.replace(/^\/tmp\//, "/private/tmp/") : opts.cwd;
+  const lines = [];
+  const ts = () => new Date().toISOString();
+  let lastUuid = null;
+  lines.push({ type: "queue-operation", operation: "enqueue", timestamp: ts(), sessionId });
+  lines.push({ type: "queue-operation", operation: "dequeue", timestamp: ts(), sessionId });
+  const attachments = loadClaudeAttachments();
+  for (const pair of pairs) {
+    const userUuid = randomUUID();
+    lines.push({
+      parentUuid: lastUuid,
+      isSidechain: false,
+      promptId: randomUUID(),
+      type: "user",
+      message: { role: "user", content: [{ type: "text", text: pair.userText }] },
+      uuid: userUuid,
+      timestamp: ts(),
+      permissionMode: "bypassPermissions",
+      userType: "external",
+      entrypoint: "sdk-ts",
+      cwd: cwdReal,
+      sessionId,
+      version: CLAUDE_SDK_VERSION,
+      gitBranch: CLAUDE_DEFAULT_GIT_BRANCH
+    });
+    const att1Uuid = randomUUID();
+    const att1 = clone(attachments.deferredToolsDelta);
+    att1.parentUuid = userUuid;
+    att1.uuid = att1Uuid;
+    att1.timestamp = ts();
+    att1.sessionId = sessionId;
+    att1.cwd = cwdReal;
+    lines.push(att1);
+    const att2Uuid = randomUUID();
+    const att2 = clone(attachments.skillListing);
+    att2.parentUuid = att1Uuid;
+    att2.uuid = att2Uuid;
+    att2.timestamp = ts();
+    att2.sessionId = sessionId;
+    att2.cwd = cwdReal;
+    lines.push(att2);
+    const assistantUuid = randomUUID();
+    lines.push({
+      parentUuid: att2Uuid,
+      isSidechain: false,
+      message: {
+        model: opts.model ?? CLAUDE_DEFAULT_MODEL,
+        id: `msg_${randomUUID().replace(/-/g, "").slice(0, 24)}`,
+        type: "message",
+        role: "assistant",
+        content: [{ type: "text", text: pair.assistantText }],
+        stop_reason: "end_turn",
+        stop_sequence: null,
+        stop_details: null,
+        usage: {
+          input_tokens: 0,
+          cache_creation_input_tokens: 0,
+          cache_read_input_tokens: 0,
+          output_tokens: 0,
+          server_tool_use: { web_search_requests: 0, web_fetch_requests: 0 },
+          service_tier: "standard",
+          cache_creation: { ephemeral_1h_input_tokens: 0, ephemeral_5m_input_tokens: 0 },
+          inference_geo: "",
+          iterations: [],
+          speed: "standard"
+        },
+        diagnostics: null
+      },
+      requestId: `req_${randomUUID().replace(/-/g, "").slice(0, 22)}`,
+      type: "assistant",
+      uuid: assistantUuid,
+      timestamp: ts(),
+      userType: "external",
+      entrypoint: "sdk-ts",
+      cwd: cwdReal,
+      sessionId,
+      version: CLAUDE_SDK_VERSION,
+      gitBranch: CLAUDE_DEFAULT_GIT_BRANCH
+    });
+    lastUuid = assistantUuid;
+  }
+  const projectsDir = join4(homedir3(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
+  const path = join4(projectsDir, `${sessionId}.jsonl`);
+  writeJsonlFile(path, lines);
+  logger.info({ sessionId, path, pairs: pairs.length }, "writeClaudeRollout: synthetic rollout placed");
+  return { sessionId, rolloutPath: path };
+}
+
+// ../../packages/core/src/agents/claude-registry.ts
+var ALIAS_MAP = {
+  sonnet: MODEL_SONNET,
+  opus: MODEL_OPUS,
+  fable: MODEL_FABLE
+};
+var VALID_ALIASES = new Set(Object.keys(ALIAS_MAP));
+var VALID_EFFORTS = new Set(CLAUDE_EFFORT_VALUES);
+var claudeRegistry = {
+  kind: "claude",
+  defaultModel: "sonnet",
+  defaultEffort: "high",
+  expandModelAlias(s) {
+    return ALIAS_MAP[s] ?? s;
+  },
+  validateModel(s) {
+    return VALID_ALIASES.has(s);
+  },
+  validEfforts: CLAUDE_EFFORT_VALUES,
+  validateEffort(s) {
+    return VALID_EFFORTS.has(s);
+  },
+  footerLabel(model, effort) {
+    return effort ? `${model} \xB7 ${effort}` : model;
+  },
+  writeRollout(opts) {
+    const { sessionId, rolloutPath } = writeClaudeRollout({
+      cwd: opts.cwd,
+      entries: opts.entries,
+      model: claudeRegistry.expandModelAlias(opts.model ?? claudeRegistry.defaultModel),
+      ...opts.reuseSessionId ? { sessionId: opts.reuseSessionId } : {}
+    });
+    return { sessionId, rolloutPath };
+  },
+  async forkSession({ parentSessionId, cwd, title }) {
+    const { forkSession } = await import("@anthropic-ai/claude-agent-sdk");
+    const result = await forkSession(parentSessionId, {
+      ...title ? { title } : {}
+    });
+    const projectsRoot = join5(homedir4(), ".claude", "projects");
+    const destDir = join5(projectsRoot, encodeClaudeCwd(cwd));
+    const destPath = join5(destDir, `${result.sessionId}.jsonl`);
+    if (!existsSync4(destPath)) {
+      const sourcePath = readdirSync(projectsRoot).map((d) => join5(projectsRoot, d, `${result.sessionId}.jsonl`)).find((p) => existsSync4(p));
+      if (!sourcePath) {
+        throw new Error(`claude forkSession: fork rollout ${result.sessionId}.jsonl not found under ${projectsRoot}`);
+      }
+      mkdirSync4(destDir, { recursive: true });
+      renameSync2(sourcePath, destPath);
+    }
+    return {
+      forkId: result.sessionId,
+      rolloutPath: destPath
+    };
+  },
+  async cleanupRollouts({ cwd, sessionIds }) {
+    const projectsDir = join5(homedir4(), ".claude", "projects", encodeClaudeCwd(cwd));
+    const failures = [];
+    for (const sid of sessionIds) {
+      const path = join5(projectsDir, `${sid}.jsonl`);
+      try {
+        unlinkSync3(path);
+      } catch (e) {
+        if (e?.code !== "ENOENT") {
+          logger.warn({ err: e, path }, "claude cleanupRollouts: unlink failed");
+          failures.push(e);
+        }
+      }
+    }
+    if (failures.length > 0) {
+      throw new AggregateError(failures, "claude cleanupRollouts failed");
+    }
+  }
+};
+
+// ../../packages/core/src/agents/codex-registry.ts
+import { unlinkSync as unlinkSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join9 } from "path";
+
+// ../../packages/core/src/agents/rollout/codex.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+function codexSessionsDir() {
+  return join6(process.env.CODEX_HOME || join6(homedir5(), ".codex"), "sessions");
+}
+var _shellCache = null;
+function loadCodexShell() {
+  if (_shellCache)
+    return _shellCache;
+  const raw = readFileSync4(join6(FIXTURES_DIR, "codex-shell.jsonl"), "utf8");
+  const lines = parseJsonlText(raw);
+  if (lines.length < 5) {
+    throw new Error(`loadCodexShell: expected >=5 entries in codex-shell.jsonl, got ${lines.length}`);
+  }
+  _shellCache = {
+    sessionMeta: lines[0],
+    taskStarted: lines[1],
+    developerSetup: lines[2],
+    envContext: lines[3],
+    turnContext: lines[4]
+  };
+  return _shellCache;
+}
+function uuidv7() {
+  const ts = Date.now();
+  const tsHex = ts.toString(16).padStart(12, "0");
+  const rand = randomBytes2(10);
+  rand[0] = rand[0] & 15 | 112;
+  rand[2] = rand[2] & 63 | 128;
+  return [
+    tsHex.slice(0, 8),
+    tsHex.slice(8, 12),
+    rand.slice(0, 2).toString("hex"),
+    rand.slice(2, 4).toString("hex"),
+    rand.slice(4, 10).toString("hex")
+  ].join("-");
+}
+function patchDeveloperSetup(developerSetup) {
+  const payload = developerSetup.payload;
+  if (!payload)
+    return;
+  payload.content = [
+    {
+      type: "input_text",
+      text: [
+        "<permissions instructions>",
+        "Filesystem sandboxing is disabled for this runtime turn (`danger-full-access`).",
+        "Approval policy is `never`.",
+        "</permissions instructions>"
+      ].join(`
+`)
+    }
+  ];
+}
+function patchEnvContext(envContext, cwd, currentDate, timezone) {
+  const payload = envContext.payload;
+  if (!payload)
+    return;
+  const content = payload.content;
+  if (!Array.isArray(content))
+    return;
+  for (const block of content) {
+    if (block.type === "input_text" && typeof block.text === "string") {
+      block.text = block.text.replace(/<cwd>[^<]*<\/cwd>/, `<cwd>${cwd}</cwd>`).replace(/<current_date>[^<]*<\/current_date>/, `<current_date>${currentDate}</current_date>`).replace(/<timezone>[^<]*<\/timezone>/, `<timezone>${timezone}</timezone>`);
+    }
+  }
+}
+function writeCodexRollout(opts) {
+  const threadId = opts.threadId ?? uuidv7();
+  assertUuidLike("threadId", threadId);
+  ensureCwdExists(opts.cwd);
+  const pairs = opts.pairs ?? extractChatPairs(opts.entries ?? []);
+  const now = new Date;
+  const tsIso = now.toISOString();
+  const currentDate = [
+    now.getFullYear(),
+    String(now.getMonth() + 1).padStart(2, "0"),
+    String(now.getDate()).padStart(2, "0")
+  ].join("-");
+  const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone || process.env.TZ || "UTC";
+  const shell = loadCodexShell();
+  const sessionMeta = clone(shell.sessionMeta);
+  sessionMeta.payload.id = threadId;
+  sessionMeta.payload.timestamp = tsIso;
+  sessionMeta.payload.cwd = opts.cwd;
+  sessionMeta.payload.multi_agent_version = "disabled";
+  sessionMeta.timestamp = tsIso;
+  const taskStarted = clone(shell.taskStarted);
+  taskStarted.timestamp = tsIso;
+  const developerSetup = clone(shell.developerSetup);
+  developerSetup.timestamp = tsIso;
+  patchDeveloperSetup(developerSetup);
+  const envContext = clone(shell.envContext);
+  envContext.timestamp = tsIso;
+  patchEnvContext(envContext, opts.cwd, currentDate, timezone);
+  const turnContext = clone(shell.turnContext);
+  turnContext.timestamp = tsIso;
+  const turnPayload = turnContext.payload;
+  turnPayload.cwd = opts.cwd;
+  turnPayload.current_date = currentDate;
+  turnPayload.timezone = timezone;
+  turnPayload.approval_policy = "never";
+  turnPayload.sandbox_policy = { type: "danger-full-access" };
+  turnPayload.multi_agent_version = "disabled";
+  delete turnPayload.permission_profile;
+  if (opts.model)
+    turnPayload.model = opts.model;
+  const collaborationMode = turnPayload.collaboration_mode;
+  const collaborationSettings = collaborationMode?.settings;
+  if (collaborationSettings) {
+    if (opts.model)
+      collaborationSettings.model = opts.model;
+    if (opts.effort !== undefined)
+      collaborationSettings.reasoning_effort = opts.effort;
+  }
+  const lines = [sessionMeta, taskStarted, developerSetup, envContext, turnContext];
+  for (const pair of pairs) {
+    lines.push({
+      timestamp: tsIso,
+      type: "response_item",
+      payload: {
+        type: "message",
+        role: "user",
+        content: [{ type: "input_text", text: pair.userText }]
+      }
+    });
+    lines.push({
+      timestamp: tsIso,
+      type: "event_msg",
+      payload: {
+        type: "user_message",
+        message: pair.userText,
+        images: [],
+        local_images: [],
+        text_elements: []
+      }
+    });
+    lines.push({
+      timestamp: tsIso,
+      type: "event_msg",
+      payload: {
+        type: "agent_message",
+        message: pair.assistantText,
+        phase: "final_answer",
+        memory_citation: null
+      }
+    });
+    lines.push({
+      timestamp: tsIso,
+      type: "response_item",
+      payload: {
+        type: "message",
+        role: "assistant",
+        content: [{ type: "output_text", text: pair.assistantText }],
+        phase: "final_answer"
+      }
+    });
+  }
+  lines.push({
+    timestamp: tsIso,
+    type: "event_msg",
+    payload: { type: "task_complete" }
+  });
+  const yyyy = now.getUTCFullYear();
+  const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(now.getUTCDate()).padStart(2, "0");
+  const tsStr = tsIso.replace(/[:.]/g, "-").slice(0, 19);
+  const dir = join6(codexSessionsDir(), String(yyyy), mm, dd);
+  const path = join6(dir, `rollout-${tsStr}-${threadId}.jsonl`);
+  if (opts.threadId) {
+    sweepPriorRolloutsForThread(opts.threadId);
+  }
+  writeJsonlFile(path, lines);
+  logger.info({ threadId, path, pairs: pairs.length }, "writeCodexRollout: synthetic rollout placed");
+  return { threadId, rolloutPath: path };
+}
+function sweepPriorRolloutsForThread(threadId) {
+  const sessionsDir = codexSessionsDir();
+  const buckets = candidateDateBuckets(threadId);
+  if (!buckets) {
+    sweepPriorRolloutsFullTree(threadId, sessionsDir);
+    return;
+  }
+  for (const bucket of buckets) {
+    const dir = join6(sessionsDir, bucket);
+    if (!existsSync5(dir))
+      continue;
+    try {
+      const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
+      for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
+        const fullPath = join6(dir, rel);
+        try {
+          unlinkSync4(fullPath);
+        } catch (e) {
+          if (e?.code !== "ENOENT") {
+            logger.warn({ err: e, path: fullPath }, "writeCodexRollout: prior-rollout unlink failed (continuing)");
+          }
+        }
+      }
+    } catch (e) {
+      logger.warn({ err: e, threadId, bucket }, "writeCodexRollout: prior-rollout bucket scan failed (continuing)");
+    }
+  }
+}
+function sweepPriorRolloutsFullTree(threadId, sessionsDir) {
+  try {
+    const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
+    for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
+      const fullPath = join6(sessionsDir, rel);
+      try {
+        unlinkSync4(fullPath);
+      } catch (e) {
+        if (e?.code !== "ENOENT") {
+          logger.warn({ err: e, path: fullPath }, "writeCodexRollout: prior-rollout unlink failed (continuing)");
+        }
+      }
+    }
+  } catch (e) {
+    logger.warn({ err: e, threadId }, "writeCodexRollout: full-tree prior-rollout sweep failed (continuing)");
+  }
+}
+var MAX_DAY_SPAN = 30;
+var DAY_MS = 86400000;
+var LOCAL_DATE_SKEW_DAYS = 1;
+function candidateDateBuckets(threadId) {
+  const tidMs = decodeUuidV7Timestamp(threadId);
+  if (tidMs === null)
+    return null;
+  const nowMs = Date.now();
+  const tidDay = Math.floor(tidMs / DAY_MS);
+  const todayDay = Math.floor(nowMs / DAY_MS);
+  const minDay = Math.min(tidDay, todayDay);
+  const maxDay = Math.max(tidDay, todayDay);
+  const span = maxDay - minDay;
+  if (span > MAX_DAY_SPAN)
+    return null;
+  const buckets = new Set;
+  for (let d = minDay - LOCAL_DATE_SKEW_DAYS;d <= maxDay + LOCAL_DATE_SKEW_DAYS; d++) {
+    buckets.add(formatDateBucket(new Date(d * DAY_MS)));
+  }
+  return buckets;
+}
+function decodeUuidV7Timestamp(threadId) {
+  if (typeof threadId !== "string")
+    return null;
+  const m = /^([0-9a-fA-F]{8})-([0-9a-fA-F]{4})-7[0-9a-fA-F]{3}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.exec(threadId);
+  if (!m)
+    return null;
+  const hex = `${m[1]}${m[2]}`;
+  const ms = Number.parseInt(hex, 16);
+  if (!Number.isFinite(ms))
+    return null;
+  const MIN = 1577836800000;
+  const MAX = 4102444800000;
+  if (ms < MIN || ms > MAX)
+    return null;
+  return ms;
+}
+function formatDateBucket(d) {
+  const yyyy = d.getUTCFullYear();
+  const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(d.getUTCDate()).padStart(2, "0");
+  return `${yyyy}/${mm}/${dd}`;
+}
+
+// ../../packages/core/src/storage/conversations.ts
+import {
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync5,
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync5,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { dirname as dirname5, join as join8 } from "path";
+
+// ../../packages/core/src/security/sanitize.ts
+function sanitizeTopicName(name, lowercase = false) {
+  const safe = name.replace(/[^a-zA-Z0-9\uAC00-\uD7A3_-]/g, "_") || "_";
+  return lowercase ? safe.toLowerCase() : safe;
+}
+function sanitizeFileName(name) {
+  const safe = name.replace(/[^a-zA-Z0-9._-]/g, "_") || "_";
+  if (safe === "." || safe === "..")
+    return "_";
+  return safe;
+}
+
+// ../../packages/core/src/storage/storage-host.ts
+import { mkdirSync as mkdirSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname4, join as join7, resolve as resolve3 } from "path";
+
+// ../../packages/core/src/storage/sqlite.ts
+var isBun = typeof process.versions.bun === "string";
+var Database;
+if (isBun) {
+  ({ Database } = await import("bun:sqlite"));
+} else {
+  const nodeSqliteSpecifier = ["node", "sqlite"].join(":");
+  const { DatabaseSync } = await import(nodeSqliteSpecifier);
+
+  class NodeDatabase {
+    #db;
+    constructor(path, options = {}) {
+      this.#db = options.readonly ? new DatabaseSync(path, { readOnly: true }) : new DatabaseSync(path);
+    }
+    query(sql) {
+      return this.#db.prepare(sql);
+    }
+    prepare(sql) {
+      return this.#db.prepare(sql);
+    }
+    exec(sql) {
+      this.#db.exec(sql);
+    }
+    run(sql, ...params) {
+      return this.#db.prepare(sql).run(...params);
+    }
+    transaction(fn) {
+      const run = (begin) => (...args) => {
+        this.#db.exec(begin);
+        try {
+          const result = fn(...args);
+          this.#db.exec("COMMIT");
+          return result;
+        } catch (err) {
+          this.#db.exec("ROLLBACK");
+          throw err;
+        }
+      };
+      const tx = run("BEGIN");
+      tx.deferred = run("BEGIN DEFERRED");
+      tx.immediate = run("BEGIN IMMEDIATE");
+      tx.exclusive = run("BEGIN EXCLUSIVE");
+      return tx;
+    }
+    close() {
+      this.#db.close();
+    }
+  }
+  Database = NodeDatabase;
+}
+
+// ../../packages/core/src/storage/storage-host.ts
+var configuredHost = {};
+var fallbackDatabase = null;
+var fallbackDatabasePath = null;
+var schemaInitializers = [];
+var initializedSchemas = new WeakMap;
+var initializingDatabases = new WeakSet;
+function envPath(name, fallback) {
+  const value = process.env[name]?.trim();
+  return resolve3(value || fallback);
+}
+function defaultStateDir() {
+  return envPath("NEGOTIUM_STATE_DIR", join7(homedir6(), ".negotium"));
+}
+function defaultDataDir() {
+  return envPath("NEGOTIUM_DATA_DIR", join7(defaultStateDir(), "data"));
+}
+function defaultSessionsDatabasePath() {
+  return envPath("SESSIONS_DB_PATH", join7(resolveStorageDataDir(), "sessions.db"));
+}
+function initializeDatabase(database) {
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA foreign_keys = ON");
+  database.exec("PRAGMA busy_timeout = 5000");
+  database.exec("PRAGMA wal_autocheckpoint = 1000");
+  try {
+    database.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  } catch {}
+}
+function defaultDatabase() {
+  const path = defaultSessionsDatabasePath();
+  if (fallbackDatabase && fallbackDatabasePath === path)
+    return fallbackDatabase;
+  if (fallbackDatabase)
+    fallbackDatabase.close();
+  mkdirSync5(dirname4(path), { recursive: true });
+  fallbackDatabase = new Database(path, { create: true });
+  fallbackDatabasePath = path;
+  initializeDatabase(fallbackDatabase);
+  return fallbackDatabase;
+}
+function resolveStorageDatabase() {
+  return configuredHost.database ?? defaultDatabase();
+}
+function resolveStorageDataDir() {
+  return configuredHost.dataDir ?? defaultDataDir();
+}
+function ensureStorageSchemas(database = resolveStorageDatabase()) {
+  if (initializingDatabases.has(database))
+    return;
+  let initialized = initializedSchemas.get(database);
+  if (!initialized) {
+    initialized = new Set;
+    initializedSchemas.set(database, initialized);
+  }
+  initializingDatabases.add(database);
+  try {
+    for (const entry of schemaInitializers) {
+      if (initialized.has(entry.initialize))
+        continue;
+      initialized.add(entry.initialize);
+      try {
+        entry.initialize(database);
+      } catch (error) {
+        initialized.delete(entry.initialize);
+        throw error;
+      }
+    }
+  } finally {
+    initializingDatabases.delete(database);
+  }
+}
+var internalStorageDatabase = new Proxy({}, {
+  get(_target, property) {
+    const database = resolveStorageDatabase();
+    ensureStorageSchemas(database);
+    const value = Reflect.get(database, property, database);
+    return typeof value === "function" ? value.bind(database) : value;
+  },
+  set(_target, property, value) {
+    const database = resolveStorageDatabase();
+    ensureStorageSchemas(database);
+    return Reflect.set(database, property, value, database);
+  }
+});
+
+// ../../packages/core/src/storage/conversations.ts
+function safeUserIdComponent(userId) {
+  const str = String(userId);
+  if (!str || /[/\\]|\.\./.test(str)) {
+    throw new Error(`conversations: refusing unsafe userId path component: ${str}`);
+  }
+  return str;
+}
+function conversationDir(userId) {
+  return join8(resolveStorageDataDir(), "conversations", safeUserIdComponent(userId));
+}
+function topicFilename(topicName) {
+  const t = sanitizeTopicName(topicName, true);
+  return `${t}.jsonl`;
+}
+function getConversationPath(userId, topicName) {
+  return join8(conversationDir(userId), topicFilename(topicName));
+}
+function readConversation(userId, topicName) {
+  const path = getConversationPath(userId, topicName);
+  const out = [];
+  if (!existsSync6(path))
+    return out;
+  let raw;
+  try {
+    raw = readFileSync5(path, "utf8");
+  } catch (err) {
+    logger.warn({ err, path }, "readConversation: read failed");
+    return out;
+  }
+  for (const line of raw.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch (err) {
+      logger.warn({ err, line: line.slice(0, 200) }, "readConversation: malformed JSONL line skipped");
+    }
+  }
+  return out;
+}
+
+// ../../packages/core/src/agents/codex-registry.ts
+var VALID_EFFORTS2 = new Set(CODEX_EFFORT_VALUES);
+var codexRegistry = {
+  kind: "codex",
+  defaultModel: "gpt-5.6-luna",
+  expandModelAlias(s) {
+    return s;
+  },
+  validateModel(s) {
+    return typeof s === "string" && s.length > 0;
+  },
+  validEfforts: CODEX_EFFORT_VALUES,
+  validateEffort(s) {
+    return VALID_EFFORTS2.has(s);
+  },
+  footerLabel(model, effort) {
+    return `${model} \xB7 ${effort ?? "(off)"}`;
+  },
+  writeRollout(opts) {
+    const { threadId, rolloutPath } = writeCodexRollout({
+      cwd: opts.cwd,
+      entries: opts.entries,
+      model: opts.model ?? codexRegistry.defaultModel,
+      ...opts.effort ? { effort: opts.effort } : {},
+      ...opts.reuseSessionId ? { threadId: opts.reuseSessionId } : {}
+    });
+    return { sessionId: threadId, rolloutPath };
+  },
+  async forkSession({ cwd, userId, topicName, model, effort }) {
+    const entries = readConversation(userId, topicName);
+    const { threadId, rolloutPath } = writeCodexRollout({
+      cwd,
+      entries,
+      model: model ?? codexRegistry.defaultModel,
+      ...effort ? { effort } : {}
+    });
+    return { forkId: threadId, rolloutPath };
+  },
+  async cleanupRollouts({ sessionIds }) {
+    if (sessionIds.length === 0)
+      return;
+    const sessionsDir = join9(process.env.CODEX_HOME || join9(homedir7(), ".codex"), "sessions");
+    const failures = [];
+    for (const tid of sessionIds) {
+      try {
+        const glob = new Bun.Glob(`**/rollout-*-${tid}.jsonl`);
+        for await (const rel of glob.scan({ cwd: sessionsDir, onlyFiles: true })) {
+          const path = join9(sessionsDir, rel);
+          try {
+            unlinkSync6(path);
+          } catch (e) {
+            if (e?.code !== "ENOENT") {
+              logger.warn({ err: e, path }, "codex cleanupRollouts: unlink failed");
+              failures.push(e);
+            }
+          }
+        }
+      } catch (e) {
+        logger.warn({ err: e, threadId: tid }, "codex cleanupRollouts: scan failed");
+        failures.push(e);
+      }
+    }
+    if (failures.length > 0) {
+      throw new AggregateError(failures, "codex cleanupRollouts failed");
+    }
+  }
+};
+
+// ../../packages/core/src/platform/maestro-bootstrap-env.ts
+process.env.MAESTRO_SDK_SILENT_BOOTSTRAP ??= "1";
+
+// ../../packages/core/src/agents/maestro-registry.ts
+import {
+  setConversationReader,
+  maestroRegistry as upstreamMaestroRegistry
+} from "maestro-agent-sdk";
+setConversationReader(readConversation);
+var maestroRegistry = {
+  ...upstreamMaestroRegistry,
+  defaultModel: "deepseek-pro"
+};
+
+// ../../packages/core/src/agents/registry.ts
+var REGISTRIES = {
+  claude: claudeRegistry,
+  codex: codexRegistry,
+  maestro: maestroRegistry
+};
+function getRegistry(agent) {
+  return REGISTRIES[agent];
+}
+
+// ../../packages/core/src/agents/fork.ts
+function createAgentForkHelpers(host) {
+  return {
+    async forkAgentSession(options) {
+      const { agent, ...forkOptions } = options;
+      const { forkId, rolloutPath } = await host.forkSession(agent, forkOptions);
+      return { agent, forkId, rolloutPath };
+    },
+    cleanupAgentFork(handle) {
+      try {
+        if (host.exists(handle.rolloutPath))
+          host.unlink(handle.rolloutPath);
+      } catch (error) {
+        host.warn({
+          error,
+          agent: handle.agent,
+          forkId: handle.forkId,
+          rolloutPath: handle.rolloutPath
+        }, "cleanupAgentFork: failed to remove rollout");
+      }
+    }
+  };
+}
+var defaultForkHelpers = createAgentForkHelpers({
+  forkSession: (agent, options) => getRegistry(agent).forkSession(options),
+  exists: existsSync7,
+  unlink: unlinkSync7,
+  warn: (details, message) => logger.warn(details, message)
+});
+async function forkAgentSession(opts) {
+  return defaultForkHelpers.forkAgentSession(opts);
+}
+function cleanupAgentFork(handle) {
+  defaultForkHelpers.cleanupAgentFork(handle);
+}
+// ../../packages/core/src/storage/tasks.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, renameSync as renameSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join10 } from "path";
+function safeUserIdComponent2(userId) {
+  const str = String(userId);
+  if (!str || /[/\\]|\.\./.test(str)) {
+    throw new Error(`tasks: refusing unsafe userId path component: ${str}`);
+  }
+  return str;
+}
+function safeTaskScopeKey(scopeKey) {
+  const safe = sanitizeFileName(scopeKey);
+  if (!safe || safe === "." || safe === "..") {
+    throw new Error(`tasks: refusing unsafe scope key: ${scopeKey}`);
+  }
+  return safe;
+}
+function taskScopeKey(opts) {
+  return opts.topicId?.trim() || opts.session || "default";
+}
+function getTaskFilePath(userId, scopeKey) {
+  return join10(resolveStorageDataDir(), "tasks", safeUserIdComponent2(userId), `${safeTaskScopeKey(scopeKey)}.json`);
+}
+function readTasks(userId, scopeKey) {
+  const path = getTaskFilePath(userId, scopeKey);
+  if (!existsSync8(path))
+    return [];
+  try {
+    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    return Array.isArray(parsed?.tasks) ? parsed.tasks : [];
+  } catch (e) {
+    logger.warn({ err: e, path }, "tasks: failed to read task store");
+    return [];
+  }
+}
+function taskFileMtimeNs(userId, scopeKey) {
+  try {
+    return statSync3(getTaskFilePath(userId, scopeKey), { bigint: true }).mtimeNs;
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/core/src/agents/task-events.ts
+var defaultTaskEventHost = { readTasks, taskFileMtimeNs, taskScopeKey };
+function resolveTaskEventScope(opts, host = defaultTaskEventHost) {
+  if (opts.silent)
+    return null;
+  if (!opts.userId)
+    return null;
+  if (opts.sessionType === "dm" || opts.sessionType === "ephemeral") {
+    return { userId: opts.userId, scopeKey: "dm" };
+  }
+  if (opts.sessionType === "manager") {
+    return { userId: opts.userId, scopeKey: opts.topicId ?? "general" };
+  }
+  if (!opts.session)
+    return null;
+  return {
+    userId: opts.userId,
+    scopeKey: host.taskScopeKey({ topicId: opts.topicId, session: opts.session })
+  };
+}
+async function* withTaskSnapshots(inner, scope, host = defaultTaskEventHost) {
+  let lastMtime = host.taskFileMtimeNs(scope.userId, scope.scopeKey);
+  for await (const event of inner) {
+    yield event;
+    if (event.type !== "tool_result" && event.type !== "result")
+      continue;
+    const mtime = host.taskFileMtimeNs(scope.userId, scope.scopeKey);
+    if (mtime === lastMtime)
+      continue;
+    lastMtime = mtime;
+    yield { type: "tasks", tasks: host.readTasks(scope.userId, scope.scopeKey) };
+  }
+}
+// ../../packages/core/src/security/sensitive-path.ts
+import { realpathSync } from "fs";
+import { resolve as resolve4 } from "path";
+var SENSITIVE_PATH_PATTERNS = [
+  /\/\.env(\.|$)/i,
+  /\/\.ssh\//i,
+  /\/\.aws\//i,
+  /\/\.gnupg\//i,
+  /\/\.netrc$/i,
+  /\/\.npmrc$/i,
+  /\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)(\.pub)?$/i,
+  /\.(pem|key|p12|pfx|cer|crt)$/i,
+  /\/Library\/Keychains\//i,
+  /\/vault\.db(-wal|-shm|-journal)?$/i,
+  /\/vault-master-key$/i,
+  /\/runtime-mcp-secret$/i,
+  /\/sessions\.db(-wal|-shm|-journal)?$/i
+];
+function isSensitivePath(filePath) {
+  const normalized = resolve4(filePath);
+  if (SENSITIVE_PATH_PATTERNS.some((p) => p.test(normalized)))
+    return true;
+  try {
+    const real = realpathSync(normalized);
+    if (real !== normalized)
+      return SENSITIVE_PATH_PATTERNS.some((p) => p.test(real));
+  } catch {}
+  return false;
+}
+
+// ../../packages/core/src/storage/vault.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync8 } from "fs";
+import { join as join11 } from "path";
+var vaultDb;
+function initializeVaultDatabase(database) {
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA busy_timeout = 5000");
+  database.exec(`
+  CREATE TABLE IF NOT EXISTS vault (
+    user_id     TEXT    NOT NULL,
+    key         TEXT    NOT NULL,
+    value       TEXT    NOT NULL,
+    description TEXT    NOT NULL DEFAULT '',
+    PRIMARY KEY (user_id, key)
+  )
+  `);
+  {
+    const cols = database.prepare("PRAGMA table_info(vault)").all();
+    const uid = cols.find((c) => c.name === "user_id");
+    if (uid && uid.type.toUpperCase() === "INTEGER") {
+      database.exec("BEGIN");
+      database.exec(`
+      CREATE TABLE vault_migrated (
+        user_id     TEXT    NOT NULL,
+        key         TEXT    NOT NULL,
+        value       TEXT    NOT NULL,
+        description TEXT    NOT NULL DEFAULT '',
+        PRIMARY KEY (user_id, key)
+      )
+    `);
+      database.exec("INSERT INTO vault_migrated SELECT CAST(user_id AS TEXT), key, value, description FROM vault");
+      database.exec("DROP TABLE vault");
+      database.exec("ALTER TABLE vault_migrated RENAME TO vault");
+      database.exec("COMMIT");
+    }
+  }
+}
+function openVaultDatabase(dataDir) {
+  const path = join11(dataDir, "vault.db");
+  mkdirSync8(dataDir, { recursive: true });
+  const database = new Database(path, { create: true });
+  chmodSync2(path, 384);
+  initializeVaultDatabase(database);
+  return database;
+}
+function activeVaultDatabase() {
+  if (!vaultDb)
+    vaultDb = openVaultDatabase(DATA_DIR);
+  return vaultDb;
+}
+var VAULT_VALUE_MAX_BYTES = 64 * 1024;
+function normalizeVaultKey(key) {
+  return key.trim().toUpperCase();
+}
+function vaultList(userId) {
+  return activeVaultDatabase().prepare("SELECT key, description FROM vault WHERE user_id = ? ORDER BY key").all(userId);
+}
+function valueReferencesVaultKey(userId, value) {
+  const keys = new Set(vaultList(userId).map((entry) => entry.key));
+  const visit = (candidate) => {
+    if (typeof candidate === "string") {
+      for (const match of candidate.matchAll(/\{\{([^}]+)\}\}/g)) {
+        if (keys.has(normalizeVaultKey(match[1] ?? "")))
+          return true;
+      }
+      return false;
+    }
+    if (Array.isArray(candidate))
+      return candidate.some(visit);
+    if (candidate && typeof candidate === "object") {
+      return Object.values(candidate).some(visit);
+    }
+    return false;
+  };
+  return visit(value);
+}
+
+// ../../packages/core/src/agents/vault-tool-policy.ts
+var SENSITIVE_RUNTIME_NAMES = [
+  "vault.db",
+  "vault-master-key",
+  "runtime-mcp-secret",
+  "sessions.db"
+];
+var VAULT_BROKER_REDIRECT_ERROR = "Vault placeholders must be executed through mcp__vault__vault_run (shell/CLI) or mcp__vault__vault_http_request (HTTP) so secret values cannot enter the model transcript.";
+function createVaultToolPolicy(host) {
+  function isVaultBrokerTool(toolName) {
+    return toolName.includes("vault_run") || toolName.includes("vault_http_request");
+  }
+  function referencesRuntimeSecretStorage(value) {
+    if (typeof value === "string") {
+      const lower = value.toLowerCase();
+      if (SENSITIVE_RUNTIME_NAMES.some((name) => lower.includes(name)))
+        return true;
+      return value.startsWith("/") && host.isSensitivePath(value);
+    }
+    if (Array.isArray(value))
+      return value.some(referencesRuntimeSecretStorage);
+    if (value && typeof value === "object") {
+      return Object.values(value).some(referencesRuntimeSecretStorage);
+    }
+    return false;
+  }
+  function shouldRedirectVaultTool(userId, toolName, input) {
+    return !isVaultBrokerTool(toolName) && host.valueReferencesVaultKey(userId, input);
+  }
+  return { isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool };
+}
+var defaultVaultToolPolicy = createVaultToolPolicy({ isSensitivePath, valueReferencesVaultKey });
+var isVaultBrokerTool = defaultVaultToolPolicy.isVaultBrokerTool;
+var referencesRuntimeSecretStorage = defaultVaultToolPolicy.referencesRuntimeSecretStorage;
+var shouldRedirectVaultTool = defaultVaultToolPolicy.shouldRedirectVaultTool;
+export {
+  withTaskSnapshots,
+  withCodexSpawnSerial,
+  unregisterOwnedCodexPids,
+  snapshotCodexChildren,
+  shouldRedirectVaultTool,
+  resolveTaskEventScope,
+  registerOwnedCodexPids,
+  referencesRuntimeSecretStorage,
+  killOwnedCodexTreesForShutdown,
+  killCodexTrees,
+  isVaultBrokerTool,
+  forkAgentSession,
+  findNewCodexChildren,
+  createVaultToolPolicy,
+  createCodexTreeManager,
+  createAgentForkHelpers,
+  cleanupAgentFork,
+  checkAgentAuth,
+  acquireCodexSpawnLock,
+  VAULT_BROKER_REDIRECT_ERROR
+};
+
+//# debugId=3205ED8BFB73168364756E2164756E21