negotium 0.1.28 → 0.1.30

package/dist/hosted-agent.js

@@ -28,8 +28,17 @@ import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/src/platform/config.ts
+import { execFileSync } from "child_process";
 import { randomBytes } from "crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  accessSync,
+  chmodSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
@@ -122,7 +131,8 @@ var CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
 var BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
 var DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
 var SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
-var CLAUDE_EXECUTABLE = resolve(HOME, ".local/bin/claude");
+var CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
+var CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
 function resolveBrowserMcpBin(envValue) {
   const override = envValue?.trim();
   if (override) {
@@ -135,10 +145,55 @@ function resolveBrowserMcpBin(envValue) {
 }
 var PATCHRIGHT_MCP_BIN = resolve(PROJECT_ROOT, "scripts/mcp-patchright-http.mjs");
 var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
+var BROWSER_RS_VERSION = "v0.1.12";
+var BROWSER_RS_MIN_SECURE_VERSION = "0.1.12";
+function versionAtLeast(actualVersion, minimumVersion) {
+  const actual = actualVersion.split(".").map(Number);
+  const minimum = minimumVersion.split(".").map(Number);
+  if (actual.some(Number.isNaN) || minimum.some(Number.isNaN))
+    return false;
+  for (let index = 0;index < minimum.length; index += 1) {
+    if ((actual[index] ?? 0) > (minimum[index] ?? 0))
+      return true;
+    if ((actual[index] ?? 0) < (minimum[index] ?? 0))
+      return false;
+  }
+  return true;
+}
+function browserRsMeetsMinimumVersion(candidate) {
+  try {
+    const output = execFileSync(candidate, ["--version"], {
+      encoding: "utf8",
+      timeout: 2000,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const match = output.match(/^browser-rs (\d+)\.(\d+)\.(\d+)$/);
+    if (!match)
+      return false;
+    return versionAtLeast(match.slice(1).join("."), BROWSER_RS_MIN_SECURE_VERSION);
+  } catch {
+    return false;
+  }
+}
+function resolveBrowserRsBin(envValue) {
+  const override = envValue?.trim();
+  if (!override && !versionAtLeast(BROWSER_RS_VERSION.replace(/^v/, ""), BROWSER_RS_MIN_SECURE_VERSION)) {
+    return;
+  }
+  const candidate = override ? resolve(override) : resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  try {
+    accessSync(candidate, constants.X_OK);
+    return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
+  } catch {
+    return;
+  }
+}
+var BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));
 var TSX_BIN = resolveDependencyBin("tsx");
 var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");
 var SESSION_COMM_SERVER = resolve(PROJECT_ROOT, "src/mcp/session-comm/server.ts");
 var TASK_SERVER = resolve(PROJECT_ROOT, "src/mcp/task-server.ts");
+var BROWSER_MCP_SSE_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/browser-sse-proxy-server.ts");
 var CANONICAL_MCP_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/canonical-proxy-server.ts");
 var WIKI_SERVER = resolve(PROJECT_ROOT, "src/mcp/wiki-server.ts");
 var TOKEN_STATS_SERVER = resolve(PROJECT_ROOT, "src/mcp/token-stats-server.ts");
@@ -780,7 +835,7 @@ function peerSessionBridgeIpcEnv() {
 }
 
 // ../../packages/core/src/platform/background-bash/manager.ts
-import { execFileSync, spawn } from "child_process";
+import { execFileSync as execFileSync2, spawn } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 
 // ../../packages/core/src/platform/delay.ts
@@ -798,7 +853,7 @@ function makeBgBashKey(_userId, _topic) {
 }
 function defaultPortPids(port) {
   try {
-    return execFileSync("lsof", ["-i", `:${port}`, "-t"], { stdio: "pipe" }).toString().trim().split(`
+    return execFileSync2("lsof", ["-i", `:${port}`, "-t"], { stdio: "pipe" }).toString().trim().split(`
 `).map((pid) => Number.parseInt(pid, 10)).filter((pid) => !Number.isNaN(pid));
   } catch {
     return [];
@@ -1049,23 +1104,23 @@ function browserOwnerForContext(ctx) {
 function playwrightTransport(port, owner, capability, agent) {
   const ownerCapability = browserOwnerCapability(capability, owner);
   if (agent === "codex") {
+    const query2 = new URLSearchParams({ owner });
     return {
-      url: `http://127.0.0.1:${port}/mcp`,
-      http_headers: { "X-Browser-Owner": owner },
+      url: `http://127.0.0.1:${port}/mcp?${query2}`,
       env_http_headers: { "X-Browser-Capability": CODEX_BROWSER_CAPABILITY_ENV }
     };
   }
+  const query = new URLSearchParams({ owner });
   if (agent === "maestro") {
-    const query = new URLSearchParams({ owner, capability: ownerCapability });
-    return {
-      type: "sse",
-      url: `http://127.0.0.1:${port}/sse?${query}`
-    };
+    return buildStdioMcpServer("maestro", BROWSER_MCP_SSE_PROXY_SERVER, [], {
+      NEGOTIUM_BROWSER_SSE_URL: `http://127.0.0.1:${port}/sse?${query}`,
+      NEGOTIUM_BROWSER_OWNER_CAPABILITY: ownerCapability
+    });
   }
   return {
     type: "sse",
-    url: `http://127.0.0.1:${port}/sse`,
-    headers: { "X-Browser-Owner": owner, "X-Browser-Capability": ownerCapability }
+    url: `http://127.0.0.1:${port}/sse?${query}`,
+    headers: { "X-Browser-Capability": ownerCapability }
   };
 }
 function longLivedHttpMcp(agent, port) {
@@ -1626,6 +1681,11 @@ function vaultListWithValues(userId) {
     value: decryptRow(userId, row.key, row.value)
   }));
 }
+function vaultGetValue(userId, key) {
+  const normalizedKey = normalizeVaultKey(key);
+  const row = activeVaultDatabase().prepare("SELECT key, value FROM vault WHERE user_id = ? AND key = ?").get(userId, normalizedKey);
+  return row ? decryptRow(userId, row.key, row.value) : undefined;
+}
 function vaultSubstituteDetailed(userId, text) {
   const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
   const usedKeys = new Set;
@@ -2139,12 +2199,6 @@ async function* claudeProvider(opts) {
         const m = message;
         if (m.subtype === "init") {
           yield { type: "session", sessionId: m.session_id };
-        } else if (m.subtype === "task_started") {
-          const t = m;
-          if (t.subagent_type && !t.skip_transcript) {
-            const desc = t.description ? ` ${t.description.slice(0, 60)}` : "";
-            yield { type: "status", content: `\u25B6 [${t.subagent_type}]${desc}` };
-          }
         } else {
           logger.debug({ subtype: m.subtype, msg: m }, "claudeProvider: system message (unhandled subtype)");
         }
@@ -2228,7 +2282,8 @@ async function* claudeProvider(opts) {
           yield {
             type: "tool_result",
             toolUseId: trBlock.tool_use_id || "",
-            content: trContent
+            content: trContent,
+            ...trBlock.is_error ? { isError: true } : {}
           };
         }
       }
@@ -2242,32 +2297,91 @@ async function* claudeProvider(opts) {
 }
 
 // ../../packages/core/src/agents/codex-provider.ts
-import { existsSync as existsSync7 } from "fs";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync7, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
+import { isAbsolute, relative, resolve as resolve5 } from "path";
 import { Codex } from "@openai/codex-sdk";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn3 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
 import {
   chmodSync as chmodSync3,
+  copyFileSync,
   existsSync as existsSync5,
+  mkdtempSync,
   readFileSync as readFileSync5,
   renameSync as renameSync3,
+  rmSync,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync4
 } from "fs";
 import { createRequire } from "module";
+import { tmpdir } from "os";
 import { dirname as dirname4, join as join6 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.28";
+var NEGOTIUM_VERSION = "0.1.30";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
-var NEGOTIUM_MODEL_CATALOG = "negotium-model-catalog.json";
 var moduleRequire = createRequire(import.meta.url);
+var codexSdkPackagePath = moduleRequire.resolve("@openai/codex-sdk/package.json");
+var codexSdkRequire = createRequire(codexSdkPackagePath);
+var bundledCodexPackagePath = codexSdkRequire.resolve("@openai/codex/package.json");
+function readPackageVersion(packageJsonPath) {
+  const parsed = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
+  if (typeof parsed.version !== "string" || !parsed.version.trim()) {
+    throw new Error(`Codex package has no valid version: ${packageJsonPath}`);
+  }
+  return parsed.version;
+}
+var BUNDLED_CODEX_VERSION = readPackageVersion(bundledCodexPackagePath);
+var SAFE_BUNDLED_CODEX_VERSION = BUNDLED_CODEX_VERSION.replace(/[^a-zA-Z0-9._-]/g, "_");
+var NEGOTIUM_MODEL_CACHE = `negotium-models-cache-${SAFE_BUNDLED_CODEX_VERSION}.json`;
+var NEGOTIUM_MODEL_CATALOG = `negotium-model-catalog-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 function codexCliScriptPath() {
-  const sdkPackagePath = moduleRequire.resolve("@openai/codex-sdk/package.json");
-  const sdkRequire = createRequire(sdkPackagePath);
-  return join6(dirname4(sdkRequire.resolve("@openai/codex/package.json")), "bin", "codex.js");
+  return join6(dirname4(bundledCodexPackagePath), "bin", "codex.js");
+}
+function parseCodexModelCache(contents, sourcePath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch (error) {
+    throw new Error(`Codex model cache is invalid JSON: ${sourcePath}`, { cause: error });
+  }
+  if (!Array.isArray(parsed.models) || parsed.models.length === 0) {
+    throw new Error(`Codex model cache has no models: ${sourcePath}`);
+  }
+  return parsed;
+}
+function readCodexModelCache(cachePath) {
+  const contents = readFileSync5(cachePath, "utf8");
+  return { contents, parsed: parseCodexModelCache(contents, cachePath) };
+}
+function readCompatibleCodexModelCache(cachePath) {
+  const cache = readCodexModelCache(cachePath);
+  if (cache.parsed.client_version !== BUNDLED_CODEX_VERSION) {
+    const found = typeof cache.parsed.client_version === "string" ? cache.parsed.client_version : "missing or invalid";
+    throw new Error(`Codex model cache version ${found} does not match Negotium's bundled Codex ${BUNDLED_CODEX_VERSION}: ${cachePath}`);
+  }
+  return cache;
+}
+function writePrivateFileAtomic(path, contents) {
+  if (existsSync5(path) && readFileSync5(path, "utf8") === contents)
+    return;
+  const tempPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    writeFileSync4(tempPath, contents, { encoding: "utf8", mode: 384 });
+    renameSync3(tempPath, path);
+    chmodSync3(path, 384);
+  } finally {
+    try {
+      unlinkSync4(tempPath);
+    } catch {}
+  }
+}
+function bundledCodexModelCachePath(authFilePath) {
+  return join6(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn3(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
@@ -2351,25 +2465,59 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
     });
   });
 }
+async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
+  const sourceHome = dirname4(authFilePath);
+  const isolatedHome = mkdtempSync(join6(tmpdir(), "negotium-codex-models-"));
+  const isolatedCachePath = join6(isolatedHome, "models_cache.json");
+  try {
+    const isolatedAuthPath = join6(isolatedHome, "auth.json");
+    copyFileSync(authFilePath, isolatedAuthPath);
+    chmodSync3(isolatedAuthPath, 384);
+    const sourceConfigPath = join6(sourceHome, "config.toml");
+    if (existsSync5(sourceConfigPath)) {
+      const isolatedConfigPath = join6(isolatedHome, "config.toml");
+      copyFileSync(sourceConfigPath, isolatedConfigPath);
+      chmodSync3(isolatedConfigPath, 384);
+    }
+    await bootstrap(isolatedHome, isolatedCachePath);
+    return readCompatibleCodexModelCache(isolatedCachePath).contents;
+  } finally {
+    rmSync(isolatedHome, { recursive: true, force: true });
+  }
+}
 async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexModelCache) {
   const codexHome = dirname4(authFilePath);
-  const cachePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE ?? join6(codexHome, "models_cache.json");
-  const hardenedCatalogPath = join6(codexHome, NEGOTIUM_MODEL_CATALOG);
-  if (existsSync5(cachePath) || existsSync5(hardenedCatalogPath))
-    return;
-  if (process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE) {
-    throw new Error(`Configured Codex model cache does not exist: ${cachePath}`);
+  const configuredCachePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE;
+  if (configuredCachePath) {
+    if (!existsSync5(configuredCachePath)) {
+      throw new Error(`Configured Codex model cache does not exist: ${configuredCachePath}`);
+    }
+    readCompatibleCodexModelCache(configuredCachePath);
+    return configuredCachePath;
   }
-  await bootstrap(codexHome, cachePath);
+  const bundledCachePath = bundledCodexModelCachePath(authFilePath);
+  const sharedCachePath = join6(codexHome, "models_cache.json");
+  if (existsSync5(sharedCachePath)) {
+    try {
+      const shared = readCompatibleCodexModelCache(sharedCachePath);
+      writePrivateFileAtomic(bundledCachePath, shared.contents);
+      return bundledCachePath;
+    } catch {}
+  }
+  if (existsSync5(bundledCachePath)) {
+    try {
+      readCompatibleCodexModelCache(bundledCachePath);
+      return bundledCachePath;
+    } catch {}
+  }
+  const refreshedContents = await bootstrapIsolatedCodexModelCache(authFilePath, bootstrap);
+  writePrivateFileAtomic(bundledCachePath, refreshedContents);
+  return bundledCachePath;
 }
-function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath) {
+function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
   const codexHome = dirname4(authFilePath);
-  const sourcePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE ?? (existsSync5(join6(codexHome, "models_cache.json")) ? join6(codexHome, "models_cache.json") : join6(codexHome, NEGOTIUM_MODEL_CATALOG));
   const outputPath = join6(codexHome, NEGOTIUM_MODEL_CATALOG);
-  const parsed = JSON.parse(readFileSync5(sourcePath, "utf8"));
-  if (!Array.isArray(parsed.models) || parsed.models.length === 0) {
-    throw new Error(`Codex model cache has no models: ${sourcePath}`);
-  }
+  const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
     if (!model || typeof model !== "object" || Array.isArray(model)) {
       throw new Error(`Codex model cache entry ${index} is invalid: ${sourcePath}`);
@@ -2378,24 +2526,12 @@ function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath) {
   });
   const contents = `${JSON.stringify({ models }, null, 2)}
 `;
-  if (existsSync5(outputPath) && readFileSync5(outputPath, "utf8") === contents) {
-    return outputPath;
-  }
-  const tempPath = `${outputPath}.${process.pid}.${Date.now()}.tmp`;
-  try {
-    writeFileSync4(tempPath, contents, { encoding: "utf8", mode: 384 });
-    renameSync3(tempPath, outputPath);
-    chmodSync3(outputPath, 384);
-  } finally {
-    try {
-      unlinkSync4(tempPath);
-    } catch {}
-  }
+  writePrivateFileAtomic(outputPath, contents);
   return outputPath;
 }
 
 // ../../packages/core/src/agents/codex-tree-kill.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 
 // ../../packages/core/src/agents/codex-tree-manager.ts
 function createCodexTreeManager(host, options = {}) {
@@ -2581,7 +2717,7 @@ function createCodexTreeManager(host, options = {}) {
 // ../../packages/core/src/agents/codex-tree-kill.ts
 function execText(command, args) {
   try {
-    return execFileSync2(command, args, {
+    return execFileSync3(command, args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -2614,12 +2750,145 @@ var killCodexTrees = manager.killTrees;
 var killOwnedCodexTreesForShutdown = manager.killOwnedTreesForShutdown;
 
 // ../../packages/core/src/agents/rollout/codex.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2, unlinkSync as unlinkSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
+import { basename, dirname as dirname5, join as join7, resolve as resolve4 } from "path";
 function codexSessionsDir() {
   return join7(process.env.CODEX_HOME || join7(homedir4(), ".codex"), "sessions");
 }
+function canonicalFilePath(path) {
+  const absolute = resolve4(path);
+  try {
+    return realpathSync2(absolute);
+  } catch {
+    try {
+      return join7(realpathSync2(dirname5(absolute)), basename(absolute));
+    } catch {
+      return absolute;
+    }
+  }
+}
+function changedPatchLines(value) {
+  const removed = [];
+  const added = [];
+  const diffPreview = [];
+  let oldLine = 0;
+  let newLine = 0;
+  let sawHunk = false;
+  for (const line of value.split(`
+`)) {
+    const hunk = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      if (sawHunk)
+        diffPreview.push("\u2026");
+      sawHunk = true;
+      oldLine = Number.parseInt(hunk[1] ?? "0", 10);
+      newLine = Number.parseInt(hunk[2] ?? "0", 10);
+      continue;
+    }
+    if (!sawHunk && (line.startsWith("--- ") || line.startsWith("+++ ")))
+      continue;
+    if (line.startsWith("\\ No newline"))
+      continue;
+    if (line.startsWith("-")) {
+      removed.push(line.slice(1));
+      diffPreview.push(`${oldLine} -${line.slice(1)}`);
+      oldLine += 1;
+      continue;
+    }
+    if (line.startsWith("+")) {
+      added.push(line.slice(1));
+      diffPreview.push(`${newLine} +${line.slice(1)}`);
+      newLine += 1;
+      continue;
+    }
+    if (line.startsWith(" ")) {
+      diffPreview.push(`${newLine}  ${line.slice(1)}`);
+      oldLine += 1;
+      newLine += 1;
+    }
+  }
+  return {
+    ...removed.length > 0 ? { before: removed.join(`
+`) } : {},
+    ...added.length > 0 ? { after: added.join(`
+`) } : {},
+    ...diffPreview.length > 0 ? { diffPreview: diffPreview.join(`
+`) } : {}
+  };
+}
+function extractLatestCodexPatchPreview(jsonl, expectedPaths, consumedCallIds = new Set, expectedCallId) {
+  const expected = expectedPaths.map(canonicalFilePath);
+  const lines = jsonl.trimEnd().split(`
+`);
+  for (let index = lines.length - 1;index >= 0; index -= 1) {
+    try {
+      const entry = JSON.parse(lines[index] ?? "");
+      if (entry.type !== "event_msg" || entry.payload?.type !== "patch_apply_end")
+        continue;
+      const callId = entry.payload.call_id;
+      const rawChanges = entry.payload.changes;
+      if (!callId || consumedCallIds.has(callId) || expectedCallId !== undefined && callId !== expectedCallId || !rawChanges) {
+        continue;
+      }
+      const entries = Object.entries(rawChanges);
+      const matched = expected.map((path) => entries.find(([candidate]) => canonicalFilePath(candidate) === path));
+      const complete = matched.filter((change) => change !== undefined);
+      if (complete.length !== expected.length)
+        continue;
+      return {
+        callId,
+        changes: complete.map(([path, change]) => {
+          if (typeof change.unified_diff === "string") {
+            return { path, ...changedPatchLines(change.unified_diff) };
+          }
+          const content = typeof change.content === "string" ? change.content.replace(/\n$/, "") : undefined;
+          return {
+            path,
+            ...change.type === "delete" && content !== undefined ? { before: content } : {},
+            ...change.type === "add" && content !== undefined ? { after: content } : {}
+          };
+        })
+      };
+    } catch {}
+  }
+  return;
+}
+function extractCodexPatchCallIds(jsonl) {
+  const callIds = [];
+  for (const line of jsonl.trimEnd().split(`
+`)) {
+    try {
+      const entry = JSON.parse(line);
+      if (entry.type === "event_msg" && entry.payload?.type === "patch_apply_end" && typeof entry.payload.call_id === "string") {
+        callIds.push(entry.payload.call_id);
+      }
+    } catch {}
+  }
+  return callIds;
+}
+function readCodexPatchCallIds(threadId) {
+  const path = latestCodexRolloutPath(threadId);
+  if (!path)
+    return [];
+  try {
+    return extractCodexPatchCallIds(readFileSync6(path, "utf8"));
+  } catch (error) {
+    logger.debug({ error, threadId }, "codex patch ids: rollout read failed");
+    return [];
+  }
+}
+function readLatestCodexPatchPreview(threadId, expectedPaths, consumedCallIds = new Set, expectedCallId) {
+  const path = latestCodexRolloutPath(threadId);
+  if (!path)
+    return;
+  try {
+    return extractLatestCodexPatchPreview(readFileSync6(path, "utf8"), expectedPaths, consumedCallIds, expectedCallId);
+  } catch (error) {
+    logger.debug({ error, threadId }, "codex patch preview: rollout read failed");
+    return;
+  }
+}
 function extractLatestCodexContextUsage(jsonl) {
   const lines = jsonl.trimEnd().split(`
 `);
@@ -2764,6 +3033,52 @@ function formatDateBucket(d) {
   return `${yyyy}/${mm}/${dd}`;
 }
 
+// ../../packages/core/src/agents/tool-format.ts
+import { diffLines as computeLineDiff } from "diff";
+function changedDiffLines(value) {
+  const lines = value.split(`
+`);
+  if (lines.at(-1) === "")
+    lines.pop();
+  return lines;
+}
+function buildNumberedDiffSummary(before, after, startLine = 1) {
+  const removed = [];
+  const added = [];
+  const preview = [];
+  let oldLine = startLine;
+  let newLine = startLine;
+  for (const part of computeLineDiff(before, after)) {
+    const lines = changedDiffLines(part.value);
+    if (part.removed) {
+      for (const line of lines) {
+        removed.push(line);
+        preview.push(`${oldLine} -${line}`);
+        oldLine += 1;
+      }
+      continue;
+    }
+    if (part.added) {
+      for (const line of lines) {
+        added.push(line);
+        preview.push(`${newLine} +${line}`);
+        newLine += 1;
+      }
+      continue;
+    }
+    oldLine += lines.length;
+    newLine += lines.length;
+  }
+  return {
+    ...removed.length > 0 ? { before: removed.join(`
+`) } : {},
+    ...added.length > 0 ? { after: added.join(`
+`) } : {},
+    ...preview.length > 0 ? { diffPreview: preview.join(`
+`) } : {}
+  };
+}
+
 // ../../packages/core/src/agents/codex-provider.ts
 function mapEffort(effort) {
   if (!effort)
@@ -2846,22 +3161,142 @@ function summarizeMcpToolCallResult(item) {
     return text.slice(0, 200);
   return JSON.stringify(item.result.structured_content ?? "").slice(0, 200);
 }
-function fileChangeEvents(item) {
+var CODEX_DIFF_FILE_LIMIT = 512 * 1024;
+var CODEX_DIFF_BASELINE_FILE_LIMIT = 200;
+var CODEX_DIFF_BASELINE_BYTE_LIMIT = 16 * 1024 * 1024;
+function canonicalPath(path) {
+  try {
+    return realpathSync3(resolve5(path));
+  } catch {
+    return resolve5(path);
+  }
+}
+function textFile(path, maxBytes = CODEX_DIFF_FILE_LIMIT) {
+  if (!existsSync7(path))
+    return null;
+  try {
+    const byteLimit = Math.min(CODEX_DIFF_FILE_LIMIT, Math.max(0, maxBytes));
+    if (statSync3(path).size > byteLimit)
+      return;
+    const content = readFileSync7(path);
+    if (content.byteLength > byteLimit || content.includes(0))
+      return;
+    return content.toString("utf8");
+  } catch {
+    return;
+  }
+}
+
+class CodexFilePreviewTracker {
+  #cwd;
+  #root;
+  #baseline = new Map;
+  #baselineAvailable = false;
+  constructor(cwd) {
+    this.#cwd = canonicalPath(cwd);
+    const root = this.#git(["rev-parse", "--show-toplevel"], this.#cwd)?.trim();
+    this.#root = root ? canonicalPath(root) : null;
+    if (!this.#root)
+      return;
+    const status = this.#git(["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+    if (status === undefined)
+      return;
+    this.#baselineAvailable = true;
+    let loadedFiles = 0;
+    let loadedBytes = 0;
+    const records = status.split("\x00");
+    for (let index = 0;index < records.length; index += 1) {
+      const record = records[index];
+      if (!record || record.length < 4)
+        continue;
+      const code = record.slice(0, 2);
+      const path = record.slice(3);
+      const remainingBytes = CODEX_DIFF_BASELINE_BYTE_LIMIT - loadedBytes;
+      const content = loadedFiles < CODEX_DIFF_BASELINE_FILE_LIMIT && remainingBytes > 0 ? textFile(resolve5(this.#root, path), remainingBytes) : undefined;
+      this.#baseline.set(path, content);
+      if (typeof content === "string") {
+        loadedFiles += 1;
+        loadedBytes += Buffer.byteLength(content);
+      }
+      if (/[RC]/.test(code))
+        index += 1;
+    }
+  }
+  preview(path, succeeded) {
+    if (!this.#root || !this.#baselineAvailable || !succeeded)
+      return {};
+    const absolute = canonicalPath(isAbsolute(path) ? path : resolve5(this.#cwd, path));
+    const relativePath = relative(this.#root, absolute);
+    if (!relativePath || relativePath.startsWith("..") || isAbsolute(relativePath))
+      return {};
+    const before = this.#baseline.has(relativePath) ? this.#baseline.get(relativePath) : this.#headFile(relativePath);
+    const after = textFile(absolute);
+    this.#baseline.set(relativePath, after);
+    if (before === undefined || after === undefined)
+      return {};
+    const diff = buildNumberedDiffSummary(before ?? "", after ?? "");
+    return {
+      ...diff.before !== undefined ? { before: diff.before } : {},
+      ...diff.after !== undefined ? { after: diff.after } : {},
+      ...diff.diffPreview !== undefined ? { diff_preview: diff.diffPreview } : {}
+    };
+  }
+  #headFile(path) {
+    const content = this.#git(["show", `HEAD:${path}`]);
+    if (content === undefined)
+      return null;
+    return Buffer.byteLength(content) > CODEX_DIFF_FILE_LIMIT || content.includes("\x00") ? undefined : content;
+  }
+  #git(args, cwd = this.#root ?? undefined) {
+    try {
+      return execFileSync4("git", ["-C", cwd ?? ".", ...args], {
+        encoding: "utf8",
+        maxBuffer: CODEX_DIFF_FILE_LIMIT * 4,
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      return;
+    }
+  }
+}
+async function fileChangeEvents(item, previews, cwd, threadId, consumedPatchCallIds) {
+  const expectedPaths = item.changes.map((change) => isAbsolute(change.path) ? change.path : resolve5(cwd, change.path));
+  let nativePreview;
+  if (threadId && item.status === "completed") {
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 20));
+    nativePreview = readLatestCodexPatchPreview(threadId, expectedPaths, consumedPatchCallIds);
+  }
+  for (const delayMs of [20, 40, 80, 120]) {
+    if (nativePreview || !threadId || item.status !== "completed")
+      break;
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, delayMs));
+    nativePreview = readLatestCodexPatchPreview(threadId, expectedPaths, consumedPatchCallIds);
+  }
+  if (nativePreview)
+    consumedPatchCallIds.add(nativePreview.callId);
   return item.changes.flatMap((change, index) => {
     const name = change.kind === "add" ? "Write" : change.kind === "delete" ? "Delete" : "Edit";
     const toolUseId = `${item.id}:${index}`;
     const success = item.status === "completed";
+    const nativeChange = nativePreview?.changes[index];
+    const fallbackPreview = previews.preview(change.path, success);
+    const preview = success && nativeChange ? {
+      ...nativeChange.before !== undefined ? { before: nativeChange.before } : {},
+      ...nativeChange.after !== undefined ? { after: nativeChange.after } : {},
+      ...nativeChange.diffPreview !== undefined ? { diff_preview: nativeChange.diffPreview } : {}
+    } : fallbackPreview;
     return [
       {
         type: "tool_use",
         name,
-        input: { file_path: change.path, change_kind: change.kind },
+        input: { file_path: change.path, change_kind: change.kind, ...preview },
         toolUseId
       },
       {
         type: "tool_result",
         toolUseId,
-        content: success ? `${change.kind} applied: ${change.path}` : `${change.kind} failed: ${change.path}`
+        content: success ? `${change.kind} applied: ${change.path}` : `${change.kind} failed: ${change.path}`,
+        ...success ? {} : { isError: true }
       }
     ];
   });
@@ -2947,6 +3382,8 @@ function prependFirstEvent(iter, firstEvent, alreadyDone) {
   };
 }
 async function* codexProvider(opts) {
+  const filePreviews = new CodexFilePreviewTracker(opts.cwd);
+  const consumedPatchCallIds = new Set(opts.sessionId ? readCodexPatchCallIds(opts.sessionId) : []);
   const codexAuthPath = hostedCodexAuthFilePath();
   if (!existsSync7(codexAuthPath)) {
     yield {
@@ -2957,8 +3394,8 @@ async function* codexProvider(opts) {
   }
   let codexModelCatalogPath;
   try {
-    await ensureCodexModelCache(codexAuthPath);
-    codexModelCatalogPath = writeCodexCatalogWithNativeMultiAgentDisabled(codexAuthPath);
+    const codexModelCachePath = await ensureCodexModelCache(codexAuthPath);
+    codexModelCatalogPath = writeCodexCatalogWithNativeMultiAgentDisabled(codexAuthPath, codexModelCachePath);
     if (opts.sessionId)
       migrateCodexRolloutNativeMultiAgentMetadata(opts.sessionId);
   } catch (err) {
@@ -3081,10 +3518,11 @@ async function* codexProvider(opts) {
               if (!item)
                 break;
               if (item.type === "command_execution") {
+                const command = String(item.command ?? "");
                 yield {
                   type: "tool_use",
                   name: "Bash",
-                  input: { command: String(item.command ?? "") },
+                  input: { command },
                   toolUseId: String(item.id ?? "")
                 };
               } else if (item.type === "mcp_tool_call") {
@@ -3130,19 +3568,24 @@ async function* codexProvider(opts) {
                 if (reasoning)
                   yield { type: "reasoning", content: reasoning };
               } else if (item.type === "mcp_tool_call") {
+                const isError = item.status === "failed" || Boolean(item.error);
                 yield {
                   type: "tool_result",
                   toolUseId: String(item.id ?? ""),
-                  content: summarizeMcpToolCallResult(item)
+                  content: summarizeMcpToolCallResult(item),
+                  ...isError ? { isError: true } : {}
                 };
               } else if (item.type === "command_execution") {
+                const isError = item.status === "failed" || typeof item.exit_code === "number" && item.exit_code !== 0;
                 yield {
                   type: "tool_result",
                   toolUseId: String(item.id ?? ""),
-                  content: String(item.aggregated_output ?? "").slice(0, 200)
+                  content: String(item.aggregated_output ?? "").slice(0, 200),
+                  ...isError ? { isError: true } : {}
                 };
               } else if (item.type === "file_change") {
-                for (const fileEvent of fileChangeEvents(item)) {
+                const fileEvents = await fileChangeEvents(item, filePreviews, opts.cwd, currentSessionId, consumedPatchCallIds);
+                for (const fileEvent of fileEvents) {
                   yield fileEvent;
                 }
               } else if (item.type === "error") {
@@ -3294,6 +3737,18 @@ function providerOwnedToolRedirect(toolName) {
   }
   return "Use the shared task MCP tools instead " + "(mcp__task__task_create / task_update / task_list / task_get / task_delete).";
 }
+function resolveMaestroApiKeyOverrides(userId) {
+  if (!userId)
+    return;
+  const deepseek = vaultGetValue(userId, "DEEPSEEK_API_KEY")?.trim();
+  const moonshot = vaultGetValue(userId, "MOONSHOT_API_KEY")?.trim();
+  if (!deepseek && !moonshot)
+    return;
+  return {
+    ...deepseek ? { deepseek } : {},
+    ...moonshot ? { moonshot } : {}
+  };
+}
 function buildProviderOwnedToolBlockHook() {
   return {
     name: "provider-owned-tool-redirect",
@@ -3320,6 +3775,7 @@ function maestroProvider(opts) {
     maxTokens: MAESTRO_DEFAULT_MAX_TOKENS,
     enableToolSearch: true,
     ...opts,
+    apiKeyOverrides: resolveMaestroApiKeyOverrides(userId),
     agent: "maestro",
     disallowedTools: buildMaestroDisallowedTools(callerDisallowedTools),
     toolHooks: [...buildMaestroToolHooks(userId), ...callerToolHooks]
@@ -3327,18 +3783,18 @@ function maestroProvider(opts) {
   return sdkMaestroProvider(sdkOpts);
 }
 // ../../packages/core/src/agents/claude-runtime-inspection.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname5, join as join8 } from "path";
+import { dirname as dirname6, join as join8 } from "path";
 var cached;
 function inspectBundledClaudeRuntime() {
   if (cached)
     return cached;
   try {
     const require2 = createRequire2(import.meta.url);
-    const sdkDir = dirname5(require2.resolve("@anthropic-ai/claude-agent-sdk"));
-    const sdkPackage = JSON.parse(readFileSync7(join8(sdkDir, "package.json"), "utf8"));
-    const manifest = JSON.parse(readFileSync7(join8(sdkDir, "manifest.json"), "utf8"));
+    const sdkDir = dirname6(require2.resolve("@anthropic-ai/claude-agent-sdk"));
+    const sdkPackage = JSON.parse(readFileSync8(join8(sdkDir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync8(join8(sdkDir, "manifest.json"), "utf8"));
     const sdkVersion = typeof sdkPackage.version === "string" ? sdkPackage.version : "";
     const claudeCodeVersion = typeof manifest.version === "string" ? manifest.version : "";
     if (!sdkVersion || !claudeCodeVersion) {
@@ -3411,4 +3867,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=D4D23FEC965FF59B64756E2164756E21
+//# debugId=46373C1AE0198E0264756E2164756E21