negotium 0.1.21 → 0.1.23

package/dist/main.js

@@ -1958,220 +1958,15 @@ var init_sensitive_path = __esm(() => {
   ];
 });
 
-// ../../packages/core/src/storage/vault-crypto.ts
-import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes3 } from "crypto";
-function encryptionKey(masterKey = VAULT_MASTER_KEY) {
-  return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
-}
-function aad(userId, key) {
-  return Buffer.from(`${userId}\x00${key.toUpperCase()}`, "utf8");
-}
-function isEncryptedVaultValue(value) {
-  return value.startsWith(ENVELOPE_PREFIX);
-}
-function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
-  const iv = randomBytes3(IV_BYTES);
-  const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
-  cipher.setAAD(aad(userId, key));
-  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
-}
-function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
-  if (!isEncryptedVaultValue(storedValue)) {
-    return { value: storedValue, legacyPlaintext: true };
-  }
-  const encoded = storedValue.slice(ENVELOPE_PREFIX.length);
-  const [ivPart, ciphertextPart, tagPart, ...extra] = encoded.split(".");
-  if (!ivPart || ciphertextPart === undefined || !tagPart || extra.length > 0) {
-    throw new Error("Invalid encrypted vault value");
-  }
-  const iv = Buffer.from(ivPart, "base64url");
-  const ciphertext = Buffer.from(ciphertextPart, "base64url");
-  const tag = Buffer.from(tagPart, "base64url");
-  if (iv.length !== IV_BYTES || tag.length !== 16) {
-    throw new Error("Invalid encrypted vault value");
-  }
-  const decipher = createDecipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
-  decipher.setAAD(aad(userId, key));
-  decipher.setAuthTag(tag);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  return { value: plaintext.toString("utf8"), legacyPlaintext: false };
-}
-var ENVELOPE_PREFIX = "otium-vault:v1:", IV_BYTES = 12, KEY_BYTES = 32;
-var init_vault_crypto = __esm(() => {
-  init_config();
-});
-
-// ../../packages/core/src/storage/vault.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync7 } from "fs";
-import { join as join10 } from "path";
-function initializeVaultDatabase(database) {
-  database.exec("PRAGMA journal_mode = WAL");
-  database.exec("PRAGMA busy_timeout = 5000");
-  database.exec(`
-  CREATE TABLE IF NOT EXISTS vault (
-    user_id     TEXT    NOT NULL,
-    key         TEXT    NOT NULL,
-    value       TEXT    NOT NULL,
-    description TEXT    NOT NULL DEFAULT '',
-    PRIMARY KEY (user_id, key)
-  )
-  `);
-  {
-    const cols = database.prepare("PRAGMA table_info(vault)").all();
-    const uid = cols.find((c) => c.name === "user_id");
-    if (uid && uid.type.toUpperCase() === "INTEGER") {
-      database.exec("BEGIN");
-      database.exec(`
-      CREATE TABLE vault_migrated (
-        user_id     TEXT    NOT NULL,
-        key         TEXT    NOT NULL,
-        value       TEXT    NOT NULL,
-        description TEXT    NOT NULL DEFAULT '',
-        PRIMARY KEY (user_id, key)
-      )
-    `);
-      database.exec("INSERT INTO vault_migrated SELECT CAST(user_id AS TEXT), key, value, description FROM vault");
-      database.exec("DROP TABLE vault");
-      database.exec("ALTER TABLE vault_migrated RENAME TO vault");
-      database.exec("COMMIT");
-    }
-  }
-}
-function openVaultDatabase(dataDir) {
-  const path = join10(dataDir, "vault.db");
-  mkdirSync7(dataDir, { recursive: true });
-  const database = new Database(path, { create: true });
-  chmodSync2(path, 384);
-  initializeVaultDatabase(database);
-  return database;
-}
-function activeVaultDatabase() {
-  if (!vaultDb)
-    vaultDb = openVaultDatabase(DATA_DIR);
-  return vaultDb;
-}
-function normalizeVaultKey(key) {
-  return key.trim().toUpperCase();
-}
-function validateVaultKey(key) {
-  return VAULT_KEY_PATTERN.test(normalizeVaultKey(key));
-}
-function decryptRow(userId, key, storedValue) {
-  const database = activeVaultDatabase();
-  const decoded = decryptVaultValue(userId, key, storedValue, vaultMasterKey);
-  if (decoded.legacyPlaintext) {
-    database.prepare("UPDATE vault SET value = ? WHERE user_id = ? AND key = ? AND value = ?").run(encryptVaultValue(userId, key, decoded.value, vaultMasterKey), userId, key, storedValue);
-  }
-  return decoded.value;
-}
-function vaultListWithValues(userId) {
-  const rows = activeVaultDatabase().prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key").all(userId);
-  return rows.map((row) => ({
-    key: row.key,
-    description: row.description,
-    value: decryptRow(userId, row.key, row.value)
-  }));
-}
-function vaultSet(userId, key, value, description = "") {
-  const normalizedKey = normalizeVaultKey(key);
-  activeVaultDatabase().prepare(`INSERT INTO vault (user_id, key, value, description) VALUES (?, ?, ?, ?)
-       ON CONFLICT (user_id, key) DO UPDATE
-         SET value = excluded.value, description = excluded.description`).run(userId, normalizedKey, encryptVaultValue(userId, normalizedKey, value, vaultMasterKey), description);
-}
-function vaultHasKey(userId, key) {
-  const row = activeVaultDatabase().prepare("SELECT 1 FROM vault WHERE user_id = ? AND key = ?").get(userId, normalizeVaultKey(key));
-  return row != null;
-}
-function vaultDel(userId, key) {
-  const result = activeVaultDatabase().prepare("DELETE FROM vault WHERE user_id = ? AND key = ?").run(userId, normalizeVaultKey(key));
-  return result.changes > 0;
-}
-function vaultList(userId) {
-  return activeVaultDatabase().prepare("SELECT key, description FROM vault WHERE user_id = ? ORDER BY key").all(userId);
-}
-function vaultSubstituteDetailed(userId, text) {
-  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
-  const usedKeys = new Set;
-  const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey) => {
-    const key = normalizeVaultKey(rawKey);
-    const value = entries.get(key);
-    if (value === undefined)
-      return match;
-    usedKeys.add(key);
-    return value;
-  });
-  return { text: substituted, usedKeys: [...usedKeys] };
-}
-function valueReferencesVaultKey(userId, value) {
-  const keys = new Set(vaultList(userId).map((entry) => entry.key));
-  const visit = (candidate) => {
-    if (typeof candidate === "string") {
-      for (const match of candidate.matchAll(/\{\{([^}]+)\}\}/g)) {
-        if (keys.has(normalizeVaultKey(match[1] ?? "")))
-          return true;
-      }
-      return false;
-    }
-    if (Array.isArray(candidate))
-      return candidate.some(visit);
-    if (candidate && typeof candidate === "object") {
-      return Object.values(candidate).some(visit);
-    }
-    return false;
-  };
-  return visit(value);
-}
-function encodedSecretForms(value) {
-  const forms = new Set([
-    value,
-    encodeURIComponent(value),
-    Buffer.from(value, "utf8").toString("base64"),
-    Buffer.from(value, "utf8").toString("base64url"),
-    Buffer.from(value, "utf8").toString("hex")
-  ]);
-  forms.delete("");
-  return [...forms].sort((a, b) => b.length - a.length);
+// ../../packages/core/src/agents/vault-tool-policy.ts
+function leafToolName(toolName) {
+  const parts = toolName.split("__");
+  return parts.at(-1) ?? toolName;
 }
-function redactVaultSecrets(userId, text) {
-  const candidates = vaultListWithValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
-  if (candidates.length === 0)
-    return text;
-  const candidatesByFirstCharacter = new Map;
-  for (const candidate of candidates) {
-    const first = candidate.form[0];
-    if (!first)
-      continue;
-    const bucket = candidatesByFirstCharacter.get(first) ?? [];
-    bucket.push(candidate);
-    candidatesByFirstCharacter.set(first, bucket);
-  }
-  let redacted = "";
-  let offset = 0;
-  while (offset < text.length) {
-    const match = candidatesByFirstCharacter.get(text[offset] ?? "")?.find((candidate) => text.startsWith(candidate.form, offset));
-    if (!match) {
-      redacted += text[offset];
-      offset += 1;
-      continue;
-    }
-    redacted += `[REDACTED:${match.key}]`;
-    offset += match.form.length;
-  }
-  return redacted;
+function shouldSubstituteVaultToolInput(toolName) {
+  const leaf = leafToolName(toolName);
+  return leaf.startsWith("browser_") || DIRECT_VAULT_EXECUTION_TOOLS.has(leaf);
 }
-var vaultDb, vaultMasterKey, VAULT_KEY_PATTERN, VAULT_VALUE_MIN_BYTES = 4, VAULT_VALUE_MAX_BYTES, VAULT_DESCRIPTION_MAX_LENGTH = 500;
-var init_vault = __esm(async () => {
-  init_config();
-  await init_sqlite();
-  init_vault_crypto();
-  vaultMasterKey = VAULT_MASTER_KEY;
-  VAULT_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;
-  VAULT_VALUE_MAX_BYTES = 64 * 1024;
-});
-
-// ../../packages/core/src/agents/vault-tool-policy.ts
 function createVaultToolPolicy(host) {
   function isVaultBrokerTool(toolName) {
     return toolName.includes("vault_run") || toolName.includes("vault_http_request");
@@ -2191,21 +1986,24 @@ function createVaultToolPolicy(host) {
     return false;
   }
   function shouldRedirectVaultTool(userId, toolName, input) {
-    return !isVaultBrokerTool(toolName) && host.valueReferencesVaultKey(userId, input);
+    return false;
   }
   return { isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool };
 }
-var SENSITIVE_RUNTIME_NAMES, defaultVaultToolPolicy, isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool;
-var init_vault_tool_policy = __esm(async () => {
+var SENSITIVE_RUNTIME_NAMES, DIRECT_VAULT_EXECUTION_TOOLS, defaultVaultToolPolicy, isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool;
+var init_vault_tool_policy = __esm(() => {
   init_sensitive_path();
-  await init_vault();
   SENSITIVE_RUNTIME_NAMES = [
     "vault.db",
     "vault-master-key",
     "runtime-mcp-secret",
     "sessions.db"
   ];
-  defaultVaultToolPolicy = createVaultToolPolicy({ isSensitivePath, valueReferencesVaultKey });
+  DIRECT_VAULT_EXECUTION_TOOLS = new Set(["Bash", "WebFetch"]);
+  defaultVaultToolPolicy = createVaultToolPolicy({
+    isSensitivePath,
+    valueReferencesVaultKey: () => false
+  });
   isVaultBrokerTool = defaultVaultToolPolicy.isVaultBrokerTool;
   referencesRuntimeSecretStorage = defaultVaultToolPolicy.referencesRuntimeSecretStorage;
   shouldRedirectVaultTool = defaultVaultToolPolicy.shouldRedirectVaultTool;
@@ -2366,7 +2164,7 @@ var init_context = () => {};
 
 // ../../packages/core/src/platform/background-bash/manager.ts
 import { execFileSync as execFileSync3, spawn } from "child_process";
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 function makeBgBashKey(_userId, _topic) {
   return "runtime";
 }
@@ -2383,8 +2181,8 @@ function createBackgroundBashManager(options = {}) {
   const usedPorts = new Set;
   const spawning = new Map;
   const knownContexts = new Map;
-  const runtimeCapability = options.capability ?? randomBytes4(32).toString("hex");
-  const runtimeServerId = options.serverId ?? randomBytes4(16).toString("hex");
+  const runtimeCapability = options.capability ?? randomBytes3(32).toString("hex");
+  const runtimeServerId = options.serverId ?? randomBytes3(16).toString("hex");
   const serverFile = options.serverFile ?? BACKGROUND_BASH_SERVER;
   const basePort = options.basePort ?? BG_BASH_BASE_PORT;
   const maxPort = options.maxPort ?? BG_BASH_MAX_PORT;
@@ -3074,7 +2872,9 @@ var init_mcp_config = __esm(() => {
     vault: {
       ...commonRuntimeMcpPolicy("vault"),
       build({ userId, agent }) {
-        const args = [`--user-id=${userId}`, "--list-only=true"];
+        const args = [`--user-id=${userId}`];
+        if (agent !== "codex")
+          args.push("--list-only=true");
         return buildStdioMcpServer(agent, VAULT_SERVER, args);
       }
     }
@@ -3088,6 +2888,200 @@ var init_mcp_config = __esm(() => {
   nodeMcpEntries = [];
 });
 
+// ../../packages/core/src/storage/vault-crypto.ts
+import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes4 } from "crypto";
+function encryptionKey(masterKey = VAULT_MASTER_KEY) {
+  return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
+}
+function aad(userId, key) {
+  return Buffer.from(`${userId}\x00${key.toUpperCase()}`, "utf8");
+}
+function isEncryptedVaultValue(value) {
+  return value.startsWith(ENVELOPE_PREFIX);
+}
+function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+  const iv = randomBytes4(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  cipher.setAAD(aad(userId, key));
+  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  if (!isEncryptedVaultValue(storedValue)) {
+    return { value: storedValue, legacyPlaintext: true };
+  }
+  const encoded = storedValue.slice(ENVELOPE_PREFIX.length);
+  const [ivPart, ciphertextPart, tagPart, ...extra] = encoded.split(".");
+  if (!ivPart || ciphertextPart === undefined || !tagPart || extra.length > 0) {
+    throw new Error("Invalid encrypted vault value");
+  }
+  const iv = Buffer.from(ivPart, "base64url");
+  const ciphertext = Buffer.from(ciphertextPart, "base64url");
+  const tag = Buffer.from(tagPart, "base64url");
+  if (iv.length !== IV_BYTES || tag.length !== 16) {
+    throw new Error("Invalid encrypted vault value");
+  }
+  const decipher = createDecipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  decipher.setAAD(aad(userId, key));
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return { value: plaintext.toString("utf8"), legacyPlaintext: false };
+}
+var ENVELOPE_PREFIX = "otium-vault:v1:", IV_BYTES = 12, KEY_BYTES = 32;
+var init_vault_crypto = __esm(() => {
+  init_config();
+});
+
+// ../../packages/core/src/storage/vault.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7 } from "fs";
+import { join as join10 } from "path";
+function initializeVaultDatabase(database) {
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA busy_timeout = 5000");
+  database.exec(`
+  CREATE TABLE IF NOT EXISTS vault (
+    user_id     TEXT    NOT NULL,
+    key         TEXT    NOT NULL,
+    value       TEXT    NOT NULL,
+    description TEXT    NOT NULL DEFAULT '',
+    PRIMARY KEY (user_id, key)
+  )
+  `);
+  {
+    const cols = database.prepare("PRAGMA table_info(vault)").all();
+    const uid = cols.find((c) => c.name === "user_id");
+    if (uid && uid.type.toUpperCase() === "INTEGER") {
+      database.exec("BEGIN");
+      database.exec(`
+      CREATE TABLE vault_migrated (
+        user_id     TEXT    NOT NULL,
+        key         TEXT    NOT NULL,
+        value       TEXT    NOT NULL,
+        description TEXT    NOT NULL DEFAULT '',
+        PRIMARY KEY (user_id, key)
+      )
+    `);
+      database.exec("INSERT INTO vault_migrated SELECT CAST(user_id AS TEXT), key, value, description FROM vault");
+      database.exec("DROP TABLE vault");
+      database.exec("ALTER TABLE vault_migrated RENAME TO vault");
+      database.exec("COMMIT");
+    }
+  }
+}
+function openVaultDatabase(dataDir) {
+  const path = join10(dataDir, "vault.db");
+  mkdirSync7(dataDir, { recursive: true });
+  const database = new Database(path, { create: true });
+  chmodSync2(path, 384);
+  initializeVaultDatabase(database);
+  return database;
+}
+function activeVaultDatabase() {
+  if (!vaultDb)
+    vaultDb = openVaultDatabase(DATA_DIR);
+  return vaultDb;
+}
+function normalizeVaultKey(key) {
+  return key.trim().toUpperCase();
+}
+function validateVaultKey(key) {
+  return VAULT_KEY_PATTERN.test(normalizeVaultKey(key));
+}
+function decryptRow(userId, key, storedValue) {
+  const database = activeVaultDatabase();
+  const decoded = decryptVaultValue(userId, key, storedValue, vaultMasterKey);
+  if (decoded.legacyPlaintext) {
+    database.prepare("UPDATE vault SET value = ? WHERE user_id = ? AND key = ? AND value = ?").run(encryptVaultValue(userId, key, decoded.value, vaultMasterKey), userId, key, storedValue);
+  }
+  return decoded.value;
+}
+function vaultListWithValues(userId) {
+  const rows = activeVaultDatabase().prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key").all(userId);
+  return rows.map((row) => ({
+    key: row.key,
+    description: row.description,
+    value: decryptRow(userId, row.key, row.value)
+  }));
+}
+function vaultSet(userId, key, value, description = "") {
+  const normalizedKey = normalizeVaultKey(key);
+  activeVaultDatabase().prepare(`INSERT INTO vault (user_id, key, value, description) VALUES (?, ?, ?, ?)
+       ON CONFLICT (user_id, key) DO UPDATE
+         SET value = excluded.value, description = excluded.description`).run(userId, normalizedKey, encryptVaultValue(userId, normalizedKey, value, vaultMasterKey), description);
+}
+function vaultHasKey(userId, key) {
+  const row = activeVaultDatabase().prepare("SELECT 1 FROM vault WHERE user_id = ? AND key = ?").get(userId, normalizeVaultKey(key));
+  return row != null;
+}
+function vaultDel(userId, key) {
+  const result = activeVaultDatabase().prepare("DELETE FROM vault WHERE user_id = ? AND key = ?").run(userId, normalizeVaultKey(key));
+  return result.changes > 0;
+}
+function vaultList(userId) {
+  return activeVaultDatabase().prepare("SELECT key, description FROM vault WHERE user_id = ? ORDER BY key").all(userId);
+}
+function vaultSubstituteDetailed(userId, text) {
+  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
+  const usedKeys = new Set;
+  const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey) => {
+    const key = normalizeVaultKey(rawKey);
+    const value = entries.get(key);
+    if (value === undefined)
+      return match;
+    usedKeys.add(key);
+    return value;
+  });
+  return { text: substituted, usedKeys: [...usedKeys] };
+}
+function encodedSecretForms(value) {
+  const forms = new Set([
+    value,
+    encodeURIComponent(value),
+    Buffer.from(value, "utf8").toString("base64"),
+    Buffer.from(value, "utf8").toString("base64url"),
+    Buffer.from(value, "utf8").toString("hex")
+  ]);
+  forms.delete("");
+  return [...forms].sort((a, b) => b.length - a.length);
+}
+function redactVaultSecrets(userId, text) {
+  const candidates = vaultListWithValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
+  if (candidates.length === 0)
+    return text;
+  const candidatesByFirstCharacter = new Map;
+  for (const candidate of candidates) {
+    const first = candidate.form[0];
+    if (!first)
+      continue;
+    const bucket = candidatesByFirstCharacter.get(first) ?? [];
+    bucket.push(candidate);
+    candidatesByFirstCharacter.set(first, bucket);
+  }
+  let redacted = "";
+  let offset = 0;
+  while (offset < text.length) {
+    const match = candidatesByFirstCharacter.get(text[offset] ?? "")?.find((candidate) => text.startsWith(candidate.form, offset));
+    if (!match) {
+      redacted += text[offset];
+      offset += 1;
+      continue;
+    }
+    redacted += `[REDACTED:${match.key}]`;
+    offset += match.form.length;
+  }
+  return redacted;
+}
+var vaultDb, vaultMasterKey, VAULT_KEY_PATTERN, VAULT_VALUE_MIN_BYTES = 4, VAULT_VALUE_MAX_BYTES, VAULT_DESCRIPTION_MAX_LENGTH = 500;
+var init_vault = __esm(async () => {
+  init_config();
+  await init_sqlite();
+  init_vault_crypto();
+  vaultMasterKey = VAULT_MASTER_KEY;
+  VAULT_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;
+  VAULT_VALUE_MAX_BYTES = 64 * 1024;
+});
+
 // ../../packages/core/src/agents/execution-host.ts
 import { AsyncLocalStorage } from "async_hooks";
 function activeHost() {
@@ -3119,7 +3113,7 @@ function hostedCodexAuthFilePath() {
 }
 var defaultHost, hostRegistrations, scopedHost;
 var init_execution_host = __esm(async () => {
-  await init_vault_tool_policy();
+  init_vault_tool_policy();
   init_config();
   init_mcp_config();
   await init_vault();
@@ -3235,7 +3229,9 @@ var DEFAULT_CONTEXT_WARNING_RATIO = 0.8;
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { query } from "@anthropic-ai/claude-agent-sdk";
-function substituteClaudeToolInput(userId, input) {
+function substituteClaudeToolInput(userId, toolName, input) {
+  if (!shouldSubstituteVaultToolInput(toolName))
+    return input;
   return deepMapStrings(input, (value) => substituteHostedSecrets(userId, value));
 }
 function buildClaudeDisallowedTools(extra = undefined) {
@@ -3468,7 +3464,7 @@ async function* claudeProvider(opts) {
                 };
               }
               const userId = opts.userId ?? "";
-              const withVault = substituteClaudeToolInput(userId, tool_input);
+              const withVault = substituteClaudeToolInput(userId, tool_name, tool_input);
               if (JSON.stringify(withVault) === JSON.stringify(tool_input)) {
                 return { continue: true };
               }
@@ -3685,6 +3681,7 @@ var CLAUDE_DEFAULT_DISALLOWED_TOOLS, CLAUDE_NATIVE_AGENT_TOOLS, CLAUDE_IMAGE_MAX
 var init_claude_provider = __esm(async () => {
   init_claude_registry();
   await init_execution_host();
+  init_vault_tool_policy();
   init_file_events();
   init_logger();
   CLAUDE_DEFAULT_DISALLOWED_TOOLS = [
@@ -3707,7 +3704,7 @@ var init_claude_provider = __esm(async () => {
 });
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.21";
+var NEGOTIUM_VERSION = "0.1.23";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn3 } from "child_process";
@@ -4345,10 +4342,12 @@ function buildMaestroDisallowedTools(callerDisallowedTools = []) {
 function buildVaultHook(userId) {
   return {
     name: "vault-guard",
-    pre({ input }) {
+    pre({ toolName, input }) {
       if (referencesHostedSecretStorage(input)) {
         return { decision: "block", error: "Runtime secret storage access is not permitted" };
       }
+      if (!shouldSubstituteVaultToolInput(toolName))
+        return { decision: "allow" };
       const substituted = deepMapStrings(input, (value) => substituteHostedSecrets(userId, value));
       return JSON.stringify(substituted) === JSON.stringify(input) ? { decision: "allow" } : { decision: "modify", input: substituted };
     },
@@ -4406,6 +4405,7 @@ var MAESTRO_DEFAULT_MAX_TOKENS = 32768, PROVIDER_ASK_USER_TOOL = "AskUserQuestio
 var init_maestro_provider = __esm(async () => {
   init_maestro_bootstrap_env();
   await init_execution_host();
+  init_vault_tool_policy();
   MAESTRO_NATIVE_TASK_TOOLS = [
     "TaskCreate",
     "TaskUpdate",
@@ -6697,47 +6697,186 @@ function getBrowserProfileOwner(topicId, fallbackUserId) {
 function isTopicBrowserProfileOwner(topicId, userId) {
   return getBrowserProfileOwner(topicId, "") === userId;
 }
-function getTopicBrowserProfile(topicId) {
-  const value = db.query("SELECT browser_profile FROM api_topics WHERE id = ?").get(topicId)?.browser_profile;
-  return value || DEFAULT_BROWSER_PROFILE;
+function getTopicBrowserProfile(topicId) {
+  const value = db.query("SELECT browser_profile FROM api_topics WHERE id = ?").get(topicId)?.browser_profile;
+  return value || DEFAULT_BROWSER_PROFILE;
+}
+function hasBrowserProfileTopic(topicId) {
+  return Boolean(db.query("SELECT id FROM api_topics WHERE id = ?").get(topicId));
+}
+function createBrowserProfile(ownerId, rawName) {
+  const name = normalizeBrowserProfileName(rawName);
+  if (name === DEFAULT_BROWSER_PROFILE)
+    return name;
+  db.query("INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)").run(ownerId, name, new Date().toISOString());
+  return name;
+}
+function assignTopicBrowserProfile(opts) {
+  const actualOwner = getBrowserProfileOwner(opts.topicId, "");
+  if (!actualOwner)
+    throw new Error(`Topic "${opts.topicId}" not found or has no owner.`);
+  if (actualOwner !== opts.actorUserId) {
+    throw new Error(`Only the topic owner can change its browser profile.`);
+  }
+  const profile = normalizeBrowserProfileName(opts.profile);
+  if (profile !== DEFAULT_BROWSER_PROFILE)
+    createBrowserProfile(actualOwner, profile);
+  const previous = getTopicBrowserProfile(opts.topicId);
+  const result = db.query("UPDATE api_topics SET browser_profile = ? WHERE id = ?").run(profile, opts.topicId);
+  if (Number(result.changes ?? 0) !== 1)
+    throw new Error(`Topic "${opts.topicId}" not found.`);
+  return { previous, profile };
+}
+var DEFAULT_BROWSER_PROFILE = "default";
+var init_browser_profiles = __esm(async () => {
+  await init_forum_db();
+  db.exec(`
+  CREATE TABLE IF NOT EXISTS browser_profiles (
+    owner_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    PRIMARY KEY (owner_id, name)
+  )
+`);
+});
+
+// ../../packages/core/src/storage/runtime-process-leases.ts
+function rowToLease2(row) {
+  return {
+    role: row.role,
+    ownerId: row.owner_id,
+    pid: Number(row.pid),
+    startedAt: Number(row.started_at),
+    heartbeatAt: Number(row.heartbeat_at)
+  };
+}
+function isProcessAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+}
+function removeDeadRuntimeProcessLease(role) {
+  const row = db.query("SELECT * FROM runtime_process_leases WHERE role = ?").get(role);
+  if (!row)
+    return;
+  const lease = rowToLease2(row);
+  if (isProcessAlive(lease.pid))
+    return;
+  db.query(`DELETE FROM runtime_process_leases
+     WHERE role = ? AND owner_id = ? AND pid = ? AND heartbeat_at = ?`).run(lease.role, lease.ownerId, lease.pid, lease.heartbeatAt);
+}
+function getRuntimeProcessLease(role, now = Date.now(), staleMs = PROCESS_LEASE_STALE_MS) {
+  const row = db.query("SELECT * FROM runtime_process_leases WHERE role = ?").get(role);
+  if (!row)
+    return null;
+  const lease = rowToLease2(row);
+  return now - lease.heartbeatAt <= staleMs ? lease : null;
+}
+function listRuntimeProcessLeases(rolePrefix = "", now = Date.now(), staleMs = PROCESS_LEASE_STALE_MS) {
+  const rows = rolePrefix ? db.query("SELECT * FROM runtime_process_leases WHERE role LIKE ? ORDER BY role").all(`${rolePrefix}%`) : db.query("SELECT * FROM runtime_process_leases ORDER BY role").all();
+  return rows.map(rowToLease2).filter((lease) => now - lease.heartbeatAt <= staleMs);
+}
+function heartbeatRuntimeProcessLease(role, ownerId, now = Date.now()) {
+  const result = db.query(`UPDATE runtime_process_leases
+       SET heartbeat_at = ?
+       WHERE role = ? AND owner_id = ?`).run(now, role, ownerId);
+  return Number(result.changes ?? 0) > 0;
 }
-function hasBrowserProfileTopic(topicId) {
-  return Boolean(db.query("SELECT id FROM api_topics WHERE id = ?").get(topicId));
+function releaseRuntimeProcessLease(role, ownerId) {
+  const result = db.query("DELETE FROM runtime_process_leases WHERE role = ? AND owner_id = ?").run(role, ownerId);
+  return Number(result.changes ?? 0) > 0;
 }
-function createBrowserProfile(ownerId, rawName) {
-  const name = normalizeBrowserProfileName(rawName);
-  if (name === DEFAULT_BROWSER_PROFILE)
-    return name;
-  db.query("INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)").run(ownerId, name, new Date().toISOString());
-  return name;
+function acquireRuntimeProcessLease(role, options = {}) {
+  const normalizedRole = role.trim();
+  if (!normalizedRole)
+    throw new Error("runtime process lease role must not be empty");
+  removeDeadRuntimeProcessLease(normalizedRole);
+  const ownerId = options.ownerId ?? `${RUNTIME_INSTANCE_ID}:${normalizedRole}`;
+  const pid = options.pid ?? process.pid;
+  const now = options.now ?? Date.now();
+  const staleMs = options.staleMs ?? PROCESS_LEASE_STALE_MS;
+  const result = db.query(`INSERT INTO runtime_process_leases (role, owner_id, pid, started_at, heartbeat_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(role) DO UPDATE SET
+         owner_id = excluded.owner_id,
+         pid = excluded.pid,
+         started_at = excluded.started_at,
+         heartbeat_at = excluded.heartbeat_at
+       WHERE runtime_process_leases.heartbeat_at < ?`).run(normalizedRole, ownerId, pid, now, now, now - staleMs);
+  if (Number(result.changes ?? 0) === 0)
+    return null;
+  let stopped = false;
+  const heartbeatMs = options.heartbeatMs ?? PROCESS_LEASE_HEARTBEAT_MS;
+  const timer = setInterval(() => {
+    if (stopped)
+      return;
+    if (heartbeatRuntimeProcessLease(normalizedRole, ownerId))
+      return;
+    stopped = true;
+    clearInterval(timer);
+    options.onLost?.();
+  }, heartbeatMs);
+  timer.unref?.();
+  return {
+    role: normalizedRole,
+    ownerId,
+    pid,
+    startedAt: now,
+    heartbeatAt: now,
+    stop() {
+      if (stopped)
+        return;
+      stopped = true;
+      clearInterval(timer);
+      releaseRuntimeProcessLease(normalizedRole, ownerId);
+    }
+  };
 }
-function assignTopicBrowserProfile(opts) {
-  const actualOwner = getBrowserProfileOwner(opts.topicId, "");
-  if (!actualOwner)
-    throw new Error(`Topic "${opts.topicId}" not found or has no owner.`);
-  if (actualOwner !== opts.actorUserId) {
-    throw new Error(`Only the topic owner can change its browser profile.`);
+async function waitForRuntimeProcessLease(role, options = {}) {
+  const {
+    waitMs = PROCESS_LEASE_STALE_MS + PROCESS_LEASE_HEARTBEAT_MS,
+    retryMs = 100,
+    ...acquireOptions
+  } = options;
+  const deadline = Date.now() + Math.max(0, waitMs);
+  const interval = Math.max(1, retryMs);
+  while (true) {
+    const lease = acquireRuntimeProcessLease(role, acquireOptions);
+    if (lease)
+      return lease;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+      return null;
+    await new Promise((resolve5) => setTimeout(resolve5, Math.min(interval, remaining)));
   }
-  const profile = normalizeBrowserProfileName(opts.profile);
-  if (profile !== DEFAULT_BROWSER_PROFILE)
-    createBrowserProfile(actualOwner, profile);
-  const previous = getTopicBrowserProfile(opts.topicId);
-  const result = db.query("UPDATE api_topics SET browser_profile = ? WHERE id = ?").run(profile, opts.topicId);
-  if (Number(result.changes ?? 0) !== 1)
-    throw new Error(`Topic "${opts.topicId}" not found.`);
-  return { previous, profile };
 }
-var DEFAULT_BROWSER_PROFILE = "default";
-var init_browser_profiles = __esm(async () => {
+async function waitForRequiredRuntimeProcessLease(role, options = {}) {
+  const { workloadName = role, ...leaseOptions } = options;
+  const lease = await waitForRuntimeProcessLease(role, leaseOptions);
+  if (lease)
+    return lease;
+  const current2 = getRuntimeProcessLease(role);
+  throw new Error(`${workloadName} is already running${current2 ? ` (pid ${current2.pid})` : ""}`);
+}
+var PROCESS_LEASE_STALE_MS = 5000, PROCESS_LEASE_HEARTBEAT_MS = 1000;
+var init_runtime_process_leases = __esm(async () => {
   await init_forum_db();
+  await init_runtime_leases();
   db.exec(`
-  CREATE TABLE IF NOT EXISTS browser_profiles (
-    owner_id TEXT NOT NULL,
-    name TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    PRIMARY KEY (owner_id, name)
+  CREATE TABLE IF NOT EXISTS runtime_process_leases (
+    role TEXT PRIMARY KEY,
+    owner_id TEXT NOT NULL UNIQUE,
+    pid INTEGER NOT NULL,
+    started_at INTEGER NOT NULL,
+    heartbeat_at INTEGER NOT NULL
   )
 `);
+  db.exec("CREATE INDEX IF NOT EXISTS idx_runtime_process_leases_heartbeat ON runtime_process_leases(heartbeat_at)");
 });
 
 // ../../packages/core/src/platform/playwright/manager.ts
@@ -7026,7 +7165,13 @@ function selectOrphanBrowserPids(procs, liveUserDataDirs, profileRoot, selfPid)
   }
   return out;
 }
+function isBrowserJanitorOwner(leaseOwnerPid, selfPid) {
+  return leaseOwnerPid === selfPid;
+}
 function reapOrphanBrowsers() {
+  const daemonLease = getRuntimeProcessLease("node-daemon", Date.now(), Number.POSITIVE_INFINITY);
+  if (!isBrowserJanitorOwner(daemonLease?.pid ?? null, process.pid))
+    return;
   const profileRoot = resolve5(BROWSER_PROFILES_DIR);
   let pids;
   try {
@@ -7437,6 +7582,7 @@ var init_manager2 = __esm(async () => {
   init_config();
   init_logger();
   await init_browser_profiles();
+  await init_runtime_process_leases();
   BASE_PORT = PLAYWRIGHT_BASE_PORT;
   MAX_PORT = PLAYWRIGHT_MAX_PORT;
   MAX_IDLE_MS = 2 * 60 * 60 * 1000;
@@ -15454,145 +15600,6 @@ var init_lifecycle2 = __esm(() => {
   runShutdown = defaultLifecycle.runShutdown;
 });
 
-// ../../packages/core/src/storage/runtime-process-leases.ts
-function rowToLease2(row) {
-  return {
-    role: row.role,
-    ownerId: row.owner_id,
-    pid: Number(row.pid),
-    startedAt: Number(row.started_at),
-    heartbeatAt: Number(row.heartbeat_at)
-  };
-}
-function isProcessAlive(pid) {
-  if (!Number.isSafeInteger(pid) || pid <= 0)
-    return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code !== "ESRCH";
-  }
-}
-function removeDeadRuntimeProcessLease(role) {
-  const row = db.query("SELECT * FROM runtime_process_leases WHERE role = ?").get(role);
-  if (!row)
-    return;
-  const lease = rowToLease2(row);
-  if (isProcessAlive(lease.pid))
-    return;
-  db.query(`DELETE FROM runtime_process_leases
-     WHERE role = ? AND owner_id = ? AND pid = ? AND heartbeat_at = ?`).run(lease.role, lease.ownerId, lease.pid, lease.heartbeatAt);
-}
-function getRuntimeProcessLease(role, now = Date.now(), staleMs = PROCESS_LEASE_STALE_MS) {
-  const row = db.query("SELECT * FROM runtime_process_leases WHERE role = ?").get(role);
-  if (!row)
-    return null;
-  const lease = rowToLease2(row);
-  return now - lease.heartbeatAt <= staleMs ? lease : null;
-}
-function listRuntimeProcessLeases(rolePrefix = "", now = Date.now(), staleMs = PROCESS_LEASE_STALE_MS) {
-  const rows = rolePrefix ? db.query("SELECT * FROM runtime_process_leases WHERE role LIKE ? ORDER BY role").all(`${rolePrefix}%`) : db.query("SELECT * FROM runtime_process_leases ORDER BY role").all();
-  return rows.map(rowToLease2).filter((lease) => now - lease.heartbeatAt <= staleMs);
-}
-function heartbeatRuntimeProcessLease(role, ownerId, now = Date.now()) {
-  const result = db.query(`UPDATE runtime_process_leases
-       SET heartbeat_at = ?
-       WHERE role = ? AND owner_id = ?`).run(now, role, ownerId);
-  return Number(result.changes ?? 0) > 0;
-}
-function releaseRuntimeProcessLease(role, ownerId) {
-  const result = db.query("DELETE FROM runtime_process_leases WHERE role = ? AND owner_id = ?").run(role, ownerId);
-  return Number(result.changes ?? 0) > 0;
-}
-function acquireRuntimeProcessLease(role, options = {}) {
-  const normalizedRole = role.trim();
-  if (!normalizedRole)
-    throw new Error("runtime process lease role must not be empty");
-  removeDeadRuntimeProcessLease(normalizedRole);
-  const ownerId = options.ownerId ?? `${RUNTIME_INSTANCE_ID}:${normalizedRole}`;
-  const pid = options.pid ?? process.pid;
-  const now = options.now ?? Date.now();
-  const staleMs = options.staleMs ?? PROCESS_LEASE_STALE_MS;
-  const result = db.query(`INSERT INTO runtime_process_leases (role, owner_id, pid, started_at, heartbeat_at)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT(role) DO UPDATE SET
-         owner_id = excluded.owner_id,
-         pid = excluded.pid,
-         started_at = excluded.started_at,
-         heartbeat_at = excluded.heartbeat_at
-       WHERE runtime_process_leases.heartbeat_at < ?`).run(normalizedRole, ownerId, pid, now, now, now - staleMs);
-  if (Number(result.changes ?? 0) === 0)
-    return null;
-  let stopped = false;
-  const heartbeatMs = options.heartbeatMs ?? PROCESS_LEASE_HEARTBEAT_MS;
-  const timer = setInterval(() => {
-    if (stopped)
-      return;
-    if (heartbeatRuntimeProcessLease(normalizedRole, ownerId))
-      return;
-    stopped = true;
-    clearInterval(timer);
-    options.onLost?.();
-  }, heartbeatMs);
-  timer.unref?.();
-  return {
-    role: normalizedRole,
-    ownerId,
-    pid,
-    startedAt: now,
-    heartbeatAt: now,
-    stop() {
-      if (stopped)
-        return;
-      stopped = true;
-      clearInterval(timer);
-      releaseRuntimeProcessLease(normalizedRole, ownerId);
-    }
-  };
-}
-async function waitForRuntimeProcessLease(role, options = {}) {
-  const {
-    waitMs = PROCESS_LEASE_STALE_MS + PROCESS_LEASE_HEARTBEAT_MS,
-    retryMs = 100,
-    ...acquireOptions
-  } = options;
-  const deadline = Date.now() + Math.max(0, waitMs);
-  const interval = Math.max(1, retryMs);
-  while (true) {
-    const lease = acquireRuntimeProcessLease(role, acquireOptions);
-    if (lease)
-      return lease;
-    const remaining = deadline - Date.now();
-    if (remaining <= 0)
-      return null;
-    await new Promise((resolve9) => setTimeout(resolve9, Math.min(interval, remaining)));
-  }
-}
-async function waitForRequiredRuntimeProcessLease(role, options = {}) {
-  const { workloadName = role, ...leaseOptions } = options;
-  const lease = await waitForRuntimeProcessLease(role, leaseOptions);
-  if (lease)
-    return lease;
-  const current3 = getRuntimeProcessLease(role);
-  throw new Error(`${workloadName} is already running${current3 ? ` (pid ${current3.pid})` : ""}`);
-}
-var PROCESS_LEASE_STALE_MS = 5000, PROCESS_LEASE_HEARTBEAT_MS = 1000;
-var init_runtime_process_leases = __esm(async () => {
-  await init_forum_db();
-  await init_runtime_leases();
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS runtime_process_leases (
-    role TEXT PRIMARY KEY,
-    owner_id TEXT NOT NULL UNIQUE,
-    pid INTEGER NOT NULL,
-    started_at INTEGER NOT NULL,
-    heartbeat_at INTEGER NOT NULL
-  )
-`);
-  db.exec("CREATE INDEX IF NOT EXISTS idx_runtime_process_leases_heartbeat ON runtime_process_leases(heartbeat_at)");
-});
-
 // ../../packages/core/src/platform/modules.ts
 function startNegotiumNodeModules(modules, context) {
   const seen = new Set;
@@ -20926,6 +20933,8 @@ async function runNodeDaemon(opts = {}) {
     singleton: true
   });
   await node.completed;
+  await new Promise((resolve13) => setImmediate(resolve13));
+  process.exit(0);
 }
 var init_src5 = __esm(async () => {
   await init_src();
@@ -32761,6 +32770,8 @@ async function runCanonicalNode(port) {
   });
   console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
   await node.completed;
+  await new Promise((resolve15) => setImmediate(resolve15));
+  process.exit(0);
 }
 async function stopAdapter(name) {
   const { getRuntimeProcessLease: getRuntimeProcessLease2 } = await init_src().then(() => exports_src);
@@ -32889,4 +32900,4 @@ switch (command) {
   }
 }
 
-//# debugId=C8F4C2CD3CFA25F564756E2164756E21
+//# debugId=96E61A2450BA103464756E2164756E21