negotium 0.1.21 → 0.1.23

package/dist/runtime/scripts/browser-webauthn-policy.mjs

@@ -0,0 +1,37 @@
+const NO_BROWSER_START_TOOLS = new Set(["browser_status", "browser_close"]);
+
+/**
+ * Install Patchright's virtual authenticator before a page can invoke WebAuthn.
+ * This prevents Chrome's native passkey chooser from invisibly blocking DOM tools.
+ */
+export function createBrowserWebAuthnGuard() {
+  const installedContexts = new WeakSet();
+
+  async function ensureInstalled(manager) {
+    const page = await manager.getPage();
+    const context = page.context();
+    if (installedContexts.has(context)) return false;
+    await context.credentials.install();
+    installedContexts.add(context);
+    return true;
+  }
+
+  return {
+    async beforeTool(toolName, manager) {
+      if (
+        NO_BROWSER_START_TOOLS.has(toolName) ||
+        toolName === "browser_start" ||
+        toolName === "browser_passkey_install"
+      )
+        return;
+      await ensureInstalled(manager);
+    },
+    async afterTool(toolName, manager) {
+      if (toolName === "browser_start") await ensureInstalled(manager);
+      if (toolName === "browser_passkey_install") {
+        const page = await manager.getPage();
+        installedContexts.add(page.context());
+      }
+    },
+  };
+}

package/dist/runtime/scripts/mcp-patchright-http.mjs

@@ -18,6 +18,7 @@ import {
   secureBrowserToolOutput,
 } from "./browser-passkey-policy.mjs";
 import { createBrowserVaultTransforms } from "./browser-vault-transform.mjs";
+import { createBrowserWebAuthnGuard } from "./browser-webauthn-policy.mjs";
 
 function parseCli(argv = process.argv.slice(2)) {
   const options = { host: "127.0.0.1" };
@@ -64,6 +65,7 @@ const vaultTransforms = await createBrowserVaultTransforms(
   process.env.NEGOTIUM_BROWSER_VAULT_USER_ID,
 );
 const exposedTools = secureBrowserToolCatalog(tools);
+const webAuthnGuard = createBrowserWebAuthnGuard();
 
 function createMcpServer(defaultStartOptions, sharedManager, owner) {
   const server = new Server(
@@ -79,9 +81,12 @@ function createMcpServer(defaultStartOptions, sharedManager, owner) {
         toolName,
         vaultTransforms.substitute(request.params.arguments ?? {}),
       );
-      const result = await manager.runAsOwner(owner, () =>
-        handleTool(manager, toolName, toolInput),
-      );
+      const result = await manager.runAsOwner(owner, async () => {
+        await webAuthnGuard.beforeTool(toolName, manager);
+        const toolResult = await handleTool(manager, toolName, toolInput);
+        await webAuthnGuard.afterTool(toolName, manager);
+        return toolResult;
+      });
       return vaultTransforms.redact(secureBrowserToolOutput(toolName, result));
     } catch (error) {
       const message = error instanceof Error ? `${error.name}: ${error.message}` : String(error);

package/dist/runtime/src/agents/claude-provider.ts

@@ -29,6 +29,7 @@ import {
   referencesHostedSecretStorage,
   substituteHostedSecrets,
 } from "#agents/execution-host";
+import { shouldSubstituteVaultToolInput } from "#agents/vault-tool-policy";
 import { extractFileEvents } from "#media/file-events";
 import { errMsg } from "#platform/error";
 import { logger } from "#platform/logger";
@@ -47,7 +48,12 @@ const CLAUDE_DEFAULT_DISALLOWED_TOOLS = [
 
 const CLAUDE_NATIVE_AGENT_TOOLS = ["Task", "Agent", "TaskOutput", "TaskStop"] as const;
 
-export function substituteClaudeToolInput(userId: string, input: unknown): unknown {
+export function substituteClaudeToolInput(
+  userId: string,
+  toolName: string,
+  input: unknown,
+): unknown {
+  if (!shouldSubstituteVaultToolInput(toolName)) return input;
   return deepMapStrings(input, (value) => substituteHostedSecrets(userId, value));
 }
 
@@ -434,11 +440,11 @@ export async function* claudeProvider(opts: AgentQueryOptions): AsyncGenerator<U
                 };
               }
 
-              // Resolve Vault placeholders at the last provider hook before the
-              // tool runs. The model-facing call remains {{KEY}}, while normal
-              // tools (including browser automation) receive the credential.
+              // Resolve Vault placeholders only for explicitly allowlisted
+              // transient execution tools. Messaging and persistence tools
+              // must retain {{KEY}} verbatim.
               const userId = opts.userId ?? "";
-              const withVault = substituteClaudeToolInput(userId, tool_input);
+              const withVault = substituteClaudeToolInput(userId, tool_name, tool_input);
               if (JSON.stringify(withVault) === JSON.stringify(tool_input)) {
                 return { continue: true };
               }

package/dist/runtime/src/agents/maestro-provider.ts

@@ -70,6 +70,7 @@ import {
   referencesHostedSecretStorage,
   substituteHostedSecrets,
 } from "#agents/execution-host";
+import { shouldSubstituteVaultToolInput } from "#agents/vault-tool-policy";
 import type { AgentQueryOptions, UnifiedEvent } from "#types";
 
 /**
@@ -118,11 +119,13 @@ export function buildMaestroDisallowedTools(
 function buildVaultHook(userId: string): HookRegistration {
   return {
     name: "vault-guard",
-    pre({ input }) {
+    pre({ toolName, input }) {
       if (referencesHostedSecretStorage(input)) {
         return { decision: "block", error: "Runtime secret storage access is not permitted" };
       }
 
+      if (!shouldSubstituteVaultToolInput(toolName)) return { decision: "allow" };
+
       const substituted = deepMapStrings(input, (value) => substituteHostedSecrets(userId, value));
       return JSON.stringify(substituted) === JSON.stringify(input)
         ? { decision: "allow" }

package/dist/runtime/src/agents/vault-tool-policy.ts

@@ -1,5 +1,4 @@
 import { isSensitivePath } from "#security/sensitive-path";
-import { valueReferencesVaultKey } from "#storage/vault";
 
 const SENSITIVE_RUNTIME_NAMES = [
   "vault.db",
@@ -8,8 +7,23 @@ const SENSITIVE_RUNTIME_NAMES = [
   "sessions.db",
 ] as const;
 
+// Direct substitution is deliberately default-deny. These provider-owned
+// execution tools consume credentials transiently; persistence and messaging
+// tools must keep placeholders unresolved.
+const DIRECT_VAULT_EXECUTION_TOOLS = new Set(["Bash", "WebFetch"]);
+
+function leafToolName(toolName: string): string {
+  const parts = toolName.split("__");
+  return parts.at(-1) ?? toolName;
+}
+
+export function shouldSubstituteVaultToolInput(toolName: string): boolean {
+  const leaf = leafToolName(toolName);
+  return leaf.startsWith("browser_") || DIRECT_VAULT_EXECUTION_TOOLS.has(leaf);
+}
+
 export const VAULT_BROKER_REDIRECT_ERROR =
-  "Vault placeholders must be executed through mcp__vault__vault_run (shell/CLI) or mcp__vault__vault_http_request (HTTP) so secret values cannot enter the model transcript.";
+  "Vault broker redirection is disabled; use {{KEY}} directly in normal tool inputs.";
 
 export interface VaultToolPolicyHost {
   isSensitivePath(path: string): boolean;
@@ -41,13 +55,23 @@ export function createVaultToolPolicy(host: VaultToolPolicyHost): VaultToolPolic
   }
 
   function shouldRedirectVaultTool(userId: string, toolName: string, input: unknown): boolean {
-    return !isVaultBrokerTool(toolName) && host.valueReferencesVaultKey(userId, input);
+    // Kept as a compatibility surface for embedding hosts that implemented the
+    // pre-0.1.20 broker-only policy. Normal tools now receive Vault values from
+    // the execution-time substitution hook, so redirecting a {{KEY}} call
+    // would only make browser form filling and other interactive tools fail.
+    void userId;
+    void toolName;
+    void input;
+    return false;
   }
 
   return { isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool };
 }
 
-const defaultVaultToolPolicy = createVaultToolPolicy({ isSensitivePath, valueReferencesVaultKey });
+const defaultVaultToolPolicy = createVaultToolPolicy({
+  isSensitivePath,
+  valueReferencesVaultKey: () => false,
+});
 
 export const isVaultBrokerTool = defaultVaultToolPolicy.isVaultBrokerTool;
 export const referencesRuntimeSecretStorage = defaultVaultToolPolicy.referencesRuntimeSecretStorage;

package/dist/runtime/src/platform/mcp-config.ts

@@ -459,7 +459,8 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
       // Normal turns use {{KEY}} directly in tool inputs. Keep the Vault MCP
       // surface focused on key discovery; broker tools remain available from
       // the public factory for compatibility but are no longer the default UX.
-      const args = [`--user-id=${userId}`, "--list-only=true"];
+      const args = [`--user-id=${userId}`];
+      if (agent !== "codex") args.push("--list-only=true");
       return buildStdioMcpServer(agent, VAULT_SERVER, args);
     },
   },

package/dist/runtime/src/platform/playwright/manager.ts

@@ -32,6 +32,7 @@ import {
   hasBrowserProfileTopic,
   normalizeBrowserProfileName,
 } from "#storage/browser-profiles";
+import { getRuntimeProcessLease } from "#storage/runtime-process-leases";
 
 export { PLAYWRIGHT_PORTS_DIR };
 
@@ -514,6 +515,17 @@ export function selectOrphanBrowserPids(
   return out;
 }
 
+/**
+ * The browser process table is shared across every Negotium process, while the
+ * in-memory `instances` map is not. Only the current node-daemon lease owner may
+ * compare those two views and reap untracked browsers. Otherwise an old daemon
+ * that survived shutdown can mistake the replacement daemon's browser for an
+ * orphan and kill it.
+ */
+export function isBrowserJanitorOwner(leaseOwnerPid: number | null, selfPid: number): boolean {
+  return leaseOwnerPid === selfPid;
+}
+
 /**
  * Periodic sweep that reaps orphaned browser processes the tracked-instance map
  * has lost sight of. The 30-min idle eviction only touches instances still in
@@ -522,6 +534,12 @@ export function selectOrphanBrowserPids(
  * orphans under memory pressure are exactly this failure mode.
  */
 function reapOrphanBrowsers(): void {
+  // Use an infinite stale window here intentionally: even if the active daemon
+  // briefly misses a heartbeat, the recorded owner remains the only process
+  // allowed to run this destructive cross-process sweep.
+  const daemonLease = getRuntimeProcessLease("node-daemon", Date.now(), Number.POSITIVE_INFINITY);
+  if (!isBrowserJanitorOwner(daemonLease?.pid ?? null, process.pid)) return;
+
   const profileRoot = resolve(BROWSER_PROFILES_DIR);
   let pids: string;
   try {

package/dist/runtime/src/prompts/sessions/channel-system.md

@@ -34,7 +34,7 @@ If the task looks unfamiliar, slow, or error-prone and `skill_query` is availabl
 When the user asks for HTML/CSS, dashboards, charts, tables, or interactive visual output, use the visual tool described below rather than pasting a large HTML blob into chat.
 
 ## Vault
-If vault keys are available, reference secrets in tool inputs with the documented double-brace vault placeholder syntax. The real value is substituted at tool execution time; do not ask the user to paste secrets into chat.
+Use `{{KEY}}` directly in browser tools and Claude/Maestro tool inputs. For Codex native shell or HTTP, use the Vault broker tools; never ask the user to paste secrets into chat.
 
 ## Background Bash
 For long-running shell work, prefer the background-bash MCP tools when they are available. Their results are injected back into the session; avoid polling unless you need live output.

package/dist/runtime/src/prompts/sessions/topic-system.md

@@ -33,7 +33,7 @@ When the user asks for HTML/CSS, dashboards, charts, tables, or interactive visu
 If this topic has an injected Memory section, use it for past context. For deeper recall, call `wiki_query` when available.
 
 ## Vault
-If vault keys are available, reference secrets in tool inputs with the documented double-brace vault placeholder syntax. The real value is substituted at tool execution time; do not ask the user to paste secrets into chat.
+Use `{{KEY}}` directly in browser tools and Claude/Maestro tool inputs. For Codex native shell or HTTP, use the Vault broker tools; never ask the user to paste secrets into chat.
 
 ## Background Bash
 For long-running shell work, prefer the background-bash MCP tools when they are available. Their results are injected back into the session; avoid polling unless you need live output.

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.1.21";
+export const NEGOTIUM_VERSION = "0.1.23";

package/dist/types/packages/core/src/agents/claude-provider.d.ts

@@ -1,6 +1,6 @@
 import type { Options } from "@anthropic-ai/claude-agent-sdk";
 import type { AgentQueryOptions, UnifiedEvent } from "../types";
-export declare function substituteClaudeToolInput(userId: string, input: unknown): unknown;
+export declare function substituteClaudeToolInput(userId: string, toolName: string, input: unknown): unknown;
 export declare function buildClaudeDisallowedTools(extra?: readonly string[] | undefined): string[];
 type SpawnClaudeCodeProcess = NonNullable<Options["spawnClaudeCodeProcess"]>;
 type SpawnClaudeCodeOptions = Parameters<SpawnClaudeCodeProcess>[0];

package/dist/types/packages/core/src/agents/vault-tool-policy.d.ts

@@ -1,4 +1,5 @@
-export declare const VAULT_BROKER_REDIRECT_ERROR = "Vault placeholders must be executed through mcp__vault__vault_run (shell/CLI) or mcp__vault__vault_http_request (HTTP) so secret values cannot enter the model transcript.";
+export declare function shouldSubstituteVaultToolInput(toolName: string): boolean;
+export declare const VAULT_BROKER_REDIRECT_ERROR = "Vault broker redirection is disabled; use {{KEY}} directly in normal tool inputs.";
 export interface VaultToolPolicyHost {
     isSensitivePath(path: string): boolean;
     valueReferencesVaultKey(userId: string, value: unknown): boolean;

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.1.21";
+export declare const NEGOTIUM_VERSION = "0.1.23";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",