negotium 0.1.19 → 0.1.21

package/dist/hosted-agent.js

@@ -854,6 +854,19 @@ function vaultListWithValues(userId) {
 function vaultList(userId) {
   return activeVaultDatabase().prepare("SELECT key, description FROM vault WHERE user_id = ? ORDER BY key").all(userId);
 }
+function vaultSubstituteDetailed(userId, text) {
+  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
+  const usedKeys = new Set;
+  const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey) => {
+    const key = normalizeVaultKey(rawKey);
+    const value = entries.get(key);
+    if (value === undefined)
+      return match;
+    usedKeys.add(key);
+    return value;
+  });
+  return { text: substituted, usedKeys: [...usedKeys] };
+}
 function valueReferencesVaultKey(userId, value) {
   const keys = new Set(vaultList(userId).map((entry) => entry.key));
   const visit = (candidate) => {
@@ -919,7 +932,6 @@ var SENSITIVE_RUNTIME_NAMES = [
   "runtime-mcp-secret",
   "sessions.db"
 ];
-var VAULT_BROKER_REDIRECT_ERROR = "Vault placeholders must be executed through mcp__vault__vault_run (shell/CLI) or mcp__vault__vault_http_request (HTTP) so secret values cannot enter the model transcript.";
 function createVaultToolPolicy(host) {
   function isVaultBrokerTool(toolName) {
     return toolName.includes("vault_run") || toolName.includes("vault_http_request");
@@ -1456,9 +1468,7 @@ var MCP_CATALOG = {
   vault: {
     ...commonRuntimeMcpPolicy("vault"),
     build({ userId, agent }) {
-      const args = [`--user-id=${userId}`];
-      if (agent === "codex")
-        args.push("--http-only=true");
+      const args = [`--user-id=${userId}`, "--list-only=true"];
       return buildStdioMcpServer(agent, VAULT_SERVER, args);
     }
   }
@@ -1680,6 +1690,7 @@ function getMcpServersForQuery(opts) {
 var defaultHost = {
   getMcpServersForQuery,
   redactVaultSecrets,
+  substituteVaultSecrets: (userId, value) => vaultSubstituteDetailed(userId, value).text,
   referencesRuntimeSecretStorage,
   shouldRedirectVaultTool,
   claudeCodeExecutablePath: () => CLAUDE_EXECUTABLE,
@@ -1721,12 +1732,12 @@ function hostedMcpServers(opts) {
 function redactHostedSecrets(userId, value) {
   return activeHost().redactVaultSecrets(userId, value);
 }
+function substituteHostedSecrets(userId, value) {
+  return activeHost().substituteVaultSecrets(userId, value);
+}
 function referencesHostedSecretStorage(value) {
   return activeHost().referencesRuntimeSecretStorage(value);
 }
-function shouldRedirectHostedVaultTool(userId, toolName, input) {
-  return activeHost().shouldRedirectVaultTool(userId, toolName, input);
-}
 function transformHostedQueryOptions(opts) {
   return activeHost().transformQueryOptions?.(opts) ?? opts;
 }
@@ -1781,6 +1792,9 @@ var CLAUDE_DEFAULT_DISALLOWED_TOOLS = [
   "TaskGet"
 ];
 var CLAUDE_NATIVE_AGENT_TOOLS = ["Task", "Agent", "TaskOutput", "TaskStop"];
+function substituteClaudeToolInput(userId, input) {
+  return deepMapStrings(input, (value) => substituteHostedSecrets(userId, value));
+}
 function buildClaudeDisallowedTools(extra = undefined) {
   return [
     ...new Set([
@@ -2019,14 +2033,14 @@ async function* claudeProvider(opts) {
                 };
               }
               const userId = opts.userId ?? "";
-              if (!shouldRedirectHostedVaultTool(userId, tool_name, tool_input)) {
+              const withVault = substituteClaudeToolInput(userId, tool_input);
+              if (JSON.stringify(withVault) === JSON.stringify(tool_input)) {
                 return { continue: true };
               }
               return {
                 hookSpecificOutput: {
                   hookEventName: "PreToolUse",
-                  permissionDecision: "deny",
-                  permissionDecisionReason: VAULT_BROKER_REDIRECT_ERROR
+                  updatedInput: withVault
                 }
               };
             }
@@ -2251,7 +2265,7 @@ import { createRequire } from "module";
 import { dirname as dirname4, join as join6 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.19";
+var NEGOTIUM_VERSION = "0.1.21";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 var NEGOTIUM_MODEL_CATALOG = "negotium-model-catalog.json";
@@ -3259,14 +3273,12 @@ function buildMaestroDisallowedTools(callerDisallowedTools = []) {
 function buildVaultHook(userId) {
   return {
     name: "vault-guard",
-    pre({ toolName, input }) {
+    pre({ input }) {
       if (referencesHostedSecretStorage(input)) {
         return { decision: "block", error: "Runtime secret storage access is not permitted" };
       }
-      if (shouldRedirectHostedVaultTool(userId, toolName, input)) {
-        return { decision: "block", error: VAULT_BROKER_REDIRECT_ERROR };
-      }
-      return { decision: "allow" };
+      const substituted = deepMapStrings(input, (value) => substituteHostedSecrets(userId, value));
+      return JSON.stringify(substituted) === JSON.stringify(input) ? { decision: "allow" } : { decision: "modify", input: substituted };
     },
     post({ output }) {
       const redacted = redactHostedSecrets(userId, output);
@@ -3403,4 +3415,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=04B2126C9241989C64756E2164756E21
+//# debugId=8285C4044AB0E6D764756E2164756E21