negotium 0.1.21 → 0.1.22

package/dist/runtime/scripts/browser-webauthn-policy.mjs

@@ -0,0 +1,37 @@
+const NO_BROWSER_START_TOOLS = new Set(["browser_status", "browser_close"]);
+
+/**
+ * Install Patchright's virtual authenticator before a page can invoke WebAuthn.
+ * This prevents Chrome's native passkey chooser from invisibly blocking DOM tools.
+ */
+export function createBrowserWebAuthnGuard() {
+  const installedContexts = new WeakSet();
+
+  async function ensureInstalled(manager) {
+    const page = await manager.getPage();
+    const context = page.context();
+    if (installedContexts.has(context)) return false;
+    await context.credentials.install();
+    installedContexts.add(context);
+    return true;
+  }
+
+  return {
+    async beforeTool(toolName, manager) {
+      if (
+        NO_BROWSER_START_TOOLS.has(toolName) ||
+        toolName === "browser_start" ||
+        toolName === "browser_passkey_install"
+      )
+        return;
+      await ensureInstalled(manager);
+    },
+    async afterTool(toolName, manager) {
+      if (toolName === "browser_start") await ensureInstalled(manager);
+      if (toolName === "browser_passkey_install") {
+        const page = await manager.getPage();
+        installedContexts.add(page.context());
+      }
+    },
+  };
+}

package/dist/runtime/scripts/mcp-patchright-http.mjs

@@ -18,6 +18,7 @@ import {
   secureBrowserToolOutput,
 } from "./browser-passkey-policy.mjs";
 import { createBrowserVaultTransforms } from "./browser-vault-transform.mjs";
+import { createBrowserWebAuthnGuard } from "./browser-webauthn-policy.mjs";
 
 function parseCli(argv = process.argv.slice(2)) {
   const options = { host: "127.0.0.1" };
@@ -64,6 +65,7 @@ const vaultTransforms = await createBrowserVaultTransforms(
   process.env.NEGOTIUM_BROWSER_VAULT_USER_ID,
 );
 const exposedTools = secureBrowserToolCatalog(tools);
+const webAuthnGuard = createBrowserWebAuthnGuard();
 
 function createMcpServer(defaultStartOptions, sharedManager, owner) {
   const server = new Server(
@@ -79,9 +81,12 @@ function createMcpServer(defaultStartOptions, sharedManager, owner) {
         toolName,
         vaultTransforms.substitute(request.params.arguments ?? {}),
       );
-      const result = await manager.runAsOwner(owner, () =>
-        handleTool(manager, toolName, toolInput),
-      );
+      const result = await manager.runAsOwner(owner, async () => {
+        await webAuthnGuard.beforeTool(toolName, manager);
+        const toolResult = await handleTool(manager, toolName, toolInput);
+        await webAuthnGuard.afterTool(toolName, manager);
+        return toolResult;
+      });
       return vaultTransforms.redact(secureBrowserToolOutput(toolName, result));
     } catch (error) {
       const message = error instanceof Error ? `${error.name}: ${error.message}` : String(error);

package/dist/runtime/src/agents/vault-tool-policy.ts

@@ -1,5 +1,4 @@
 import { isSensitivePath } from "#security/sensitive-path";
-import { valueReferencesVaultKey } from "#storage/vault";
 
 const SENSITIVE_RUNTIME_NAMES = [
   "vault.db",
@@ -9,7 +8,7 @@ const SENSITIVE_RUNTIME_NAMES = [
 ] as const;
 
 export const VAULT_BROKER_REDIRECT_ERROR =
-  "Vault placeholders must be executed through mcp__vault__vault_run (shell/CLI) or mcp__vault__vault_http_request (HTTP) so secret values cannot enter the model transcript.";
+  "Vault broker redirection is disabled; use {{KEY}} directly in normal tool inputs.";
 
 export interface VaultToolPolicyHost {
   isSensitivePath(path: string): boolean;
@@ -41,13 +40,23 @@ export function createVaultToolPolicy(host: VaultToolPolicyHost): VaultToolPolic
   }
 
   function shouldRedirectVaultTool(userId: string, toolName: string, input: unknown): boolean {
-    return !isVaultBrokerTool(toolName) && host.valueReferencesVaultKey(userId, input);
+    // Kept as a compatibility surface for embedding hosts that implemented the
+    // pre-0.1.20 broker-only policy. Normal tools now receive Vault values from
+    // the execution-time substitution hook, so redirecting a {{KEY}} call
+    // would only make browser form filling and other interactive tools fail.
+    void userId;
+    void toolName;
+    void input;
+    return false;
   }
 
   return { isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool };
 }
 
-const defaultVaultToolPolicy = createVaultToolPolicy({ isSensitivePath, valueReferencesVaultKey });
+const defaultVaultToolPolicy = createVaultToolPolicy({
+  isSensitivePath,
+  valueReferencesVaultKey: () => false,
+});
 
 export const isVaultBrokerTool = defaultVaultToolPolicy.isVaultBrokerTool;
 export const referencesRuntimeSecretStorage = defaultVaultToolPolicy.referencesRuntimeSecretStorage;

package/dist/runtime/src/platform/mcp-config.ts

@@ -459,7 +459,8 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
       // Normal turns use {{KEY}} directly in tool inputs. Keep the Vault MCP
       // surface focused on key discovery; broker tools remain available from
       // the public factory for compatibility but are no longer the default UX.
-      const args = [`--user-id=${userId}`, "--list-only=true"];
+      const args = [`--user-id=${userId}`];
+      if (agent !== "codex") args.push("--list-only=true");
       return buildStdioMcpServer(agent, VAULT_SERVER, args);
     },
   },

package/dist/runtime/src/platform/playwright/manager.ts

@@ -32,6 +32,7 @@ import {
   hasBrowserProfileTopic,
   normalizeBrowserProfileName,
 } from "#storage/browser-profiles";
+import { getRuntimeProcessLease } from "#storage/runtime-process-leases";
 
 export { PLAYWRIGHT_PORTS_DIR };
 
@@ -514,6 +515,17 @@ export function selectOrphanBrowserPids(
   return out;
 }
 
+/**
+ * The browser process table is shared across every Negotium process, while the
+ * in-memory `instances` map is not. Only the current node-daemon lease owner may
+ * compare those two views and reap untracked browsers. Otherwise an old daemon
+ * that survived shutdown can mistake the replacement daemon's browser for an
+ * orphan and kill it.
+ */
+export function isBrowserJanitorOwner(leaseOwnerPid: number | null, selfPid: number): boolean {
+  return leaseOwnerPid === selfPid;
+}
+
 /**
  * Periodic sweep that reaps orphaned browser processes the tracked-instance map
  * has lost sight of. The 30-min idle eviction only touches instances still in
@@ -522,6 +534,12 @@ export function selectOrphanBrowserPids(
  * orphans under memory pressure are exactly this failure mode.
  */
 function reapOrphanBrowsers(): void {
+  // Use an infinite stale window here intentionally: even if the active daemon
+  // briefly misses a heartbeat, the recorded owner remains the only process
+  // allowed to run this destructive cross-process sweep.
+  const daemonLease = getRuntimeProcessLease("node-daemon", Date.now(), Number.POSITIVE_INFINITY);
+  if (!isBrowserJanitorOwner(daemonLease?.pid ?? null, process.pid)) return;
+
   const profileRoot = resolve(BROWSER_PROFILES_DIR);
   let pids: string;
   try {

package/dist/runtime/src/prompts/sessions/channel-system.md

@@ -34,7 +34,7 @@ If the task looks unfamiliar, slow, or error-prone and `skill_query` is availabl
 When the user asks for HTML/CSS, dashboards, charts, tables, or interactive visual output, use the visual tool described below rather than pasting a large HTML blob into chat.
 
 ## Vault
-If vault keys are available, reference secrets in tool inputs with the documented double-brace vault placeholder syntax. The real value is substituted at tool execution time; do not ask the user to paste secrets into chat.
+Use `{{KEY}}` directly in browser tools and Claude/Maestro tool inputs. For Codex native shell or HTTP, use the Vault broker tools; never ask the user to paste secrets into chat.
 
 ## Background Bash
 For long-running shell work, prefer the background-bash MCP tools when they are available. Their results are injected back into the session; avoid polling unless you need live output.

package/dist/runtime/src/prompts/sessions/topic-system.md

@@ -33,7 +33,7 @@ When the user asks for HTML/CSS, dashboards, charts, tables, or interactive visu
 If this topic has an injected Memory section, use it for past context. For deeper recall, call `wiki_query` when available.
 
 ## Vault
-If vault keys are available, reference secrets in tool inputs with the documented double-brace vault placeholder syntax. The real value is substituted at tool execution time; do not ask the user to paste secrets into chat.
+Use `{{KEY}}` directly in browser tools and Claude/Maestro tool inputs. For Codex native shell or HTTP, use the Vault broker tools; never ask the user to paste secrets into chat.
 
 ## Background Bash
 For long-running shell work, prefer the background-bash MCP tools when they are available. Their results are injected back into the session; avoid polling unless you need live output.

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.1.21";
+export const NEGOTIUM_VERSION = "0.1.22";

package/dist/types/packages/core/src/agents/vault-tool-policy.d.ts

@@ -1,4 +1,4 @@
-export declare const VAULT_BROKER_REDIRECT_ERROR = "Vault placeholders must be executed through mcp__vault__vault_run (shell/CLI) or mcp__vault__vault_http_request (HTTP) so secret values cannot enter the model transcript.";
+export declare const VAULT_BROKER_REDIRECT_ERROR = "Vault broker redirection is disabled; use {{KEY}} directly in normal tool inputs.";
 export interface VaultToolPolicyHost {
     isSensitivePath(path: string): boolean;
     valueReferencesVaultKey(userId: string, value: unknown): boolean;

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.1.21";
+export declare const NEGOTIUM_VERSION = "0.1.22";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",