negotium 0.1.47 → 0.1.49

package/dist/hosted-agent.js

@@ -7,22 +7,10 @@ import {
 
 // ../../packages/core/src/agents/claude-provider.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
-// ../../packages/core/src/agents/claude-registry.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readdirSync, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
-
-// ../../packages/core/src/agents/rollout/claude.ts
-import { randomUUID } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-
 // ../../packages/core/src/agents/rollout/shared.ts
-import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -38,6 +26,7 @@ import {
   readFileSync,
   writeFileSync
 } from "fs";
+import { createRequire } from "module";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
@@ -132,20 +121,8 @@ var DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
 var SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
 var CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
 var CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
-function resolveBrowserMcpBin(envValue) {
-  const override = envValue?.trim();
-  if (override) {
-    if (!/(^|\/)(mcp-patchright|mcp-patchright-http\.mjs)$/.test(override)) {
-      throw new Error("NEGOTIUM_BROWSER_MCP_BIN must point to the authenticated mcp-patchright wrapper.");
-    }
-    return override;
-  }
-  return PATCHRIGHT_MCP_BIN;
-}
-var PATCHRIGHT_MCP_BIN = resolve(PROJECT_ROOT, "scripts/mcp-patchright-http.mjs");
-var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
-var BROWSER_RS_VERSION = "v0.1.13";
-var BROWSER_RS_MIN_SECURE_VERSION = "0.1.13";
+var BROWSER_RS_VERSION = "v0.1.16";
+var BROWSER_RS_MIN_SECURE_VERSION = "0.1.15";
 function versionAtLeast(actualVersion, minimumVersion) {
   const actual = actualVersion.split(".").map(Number);
   const minimum = minimumVersion.split(".").map(Number);
@@ -188,7 +165,15 @@ function resolveBrowserRsBin(envValue) {
   }
 }
 var BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));
+function resolveBrowserMcpBin(envValue) {
+  const override = envValue?.trim();
+  if (override)
+    return resolve(override);
+  return BROWSER_RS_BIN ?? resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+}
+var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
 var TSX_BIN = resolveDependencyBin("tsx");
+var TSX_LOADER = createRequire(import.meta.url).resolve("tsx");
 var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");
 var SESSION_COMM_SERVER = resolve(PROJECT_ROOT, "src/mcp/session-comm/server.ts");
 var TASK_SERVER = resolve(PROJECT_ROOT, "src/mcp/task-server.ts");
@@ -308,160 +293,17 @@ function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), ".codex", "auth.json");
 }
 
-// ../../packages/core/src/runtime/user-turn-envelope.ts
-function renderUserPromptBatch(prompts) {
-  if (prompts.length <= 1)
-    return prompts[0] ?? "";
-  return [
-    "[Consecutive user messages received before an assistant response]",
-    "",
-    ...prompts.map((prompt, index) => `${index + 1}. ${prompt}`)
-  ].join(`
-`);
-}
-
 // ../../packages/core/src/agents/rollout/shared.ts
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
 var trustedWorkspaceRoots = [WORKSPACE_DIR, DM_WORKSPACE_DIR, TOPIC_WORKSPACE_DIR].map((root) => resolve2(root));
 var FIXTURES_DIR = join2(__dirname2, "..", "fixtures");
-function clone(obj) {
-  return structuredClone(obj);
-}
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function assertUuidLike(label, value) {
-  if (!UUID_RE.test(value)) {
-    throw new Error(`rollout: ${label} is not a UUID-shaped string: ${value}`);
-  }
-}
-function assertCwdInWorkspace(cwd) {
-  const abs = resolve2(cwd);
-  const ok = trustedWorkspaceRoots.some((root) => abs === root || abs.startsWith(`${root}/`));
-  if (!ok) {
-    throw new Error(`rollout: cwd outside trusted workspace roots: ${cwd} (resolved=${abs})`);
-  }
-}
-function ensureCwdExists(cwd) {
-  assertCwdInWorkspace(cwd);
-  try {
-    mkdirSync2(cwd, { recursive: true });
-  } catch (err) {
-    logger.warn({ err, cwd }, "rollout: ensureCwdExists failed \u2014 caller should pre-create cwd");
-  }
-}
-function truncate(text, n) {
-  const cps = Array.from(text);
-  return cps.length > n ? `${cps.slice(0, n).join("")}\u2026` : text;
-}
-function extractChatPairs(entries, opts = { includeToolAnnotations: true }) {
-  const pairs = [];
-  let pendingUsers = [];
-  let pendingBatchSize = null;
-  let pendingBatchNextIndex = 0;
-  let pendingAssistantParts = [];
-  let toolBuffer = [];
-  const flushAssistant = () => {
-    if (pendingUsers.length === 0)
-      return;
-    const tools = opts.includeToolAnnotations && toolBuffer.length > 0 ? `
-
-${toolBuffer.join(`
-`)}` : "";
-    const assistantText = pendingAssistantParts.join("").trim() + tools;
-    if (assistantText.trim()) {
-      pairs.push({ userText: renderUserPromptBatch(pendingUsers), assistantText });
-    }
-    pendingUsers = [];
-    pendingBatchSize = null;
-    pendingBatchNextIndex = 0;
-    pendingAssistantParts = [];
-    toolBuffer = [];
-  };
-  for (const entry of entries) {
-    const ev = entry.event;
-    switch (ev.type) {
-      case "user_message": {
-        const userEvent = ev;
-        if (pendingAssistantParts.length > 0 || toolBuffer.length > 0) {
-          flushAssistant();
-        }
-        const batchSize = userEvent.consecutiveBatchSize;
-        const batchIndex = userEvent.consecutiveBatchIndex;
-        const marked = Number.isInteger(batchSize) && Number.isInteger(batchIndex) && (batchSize ?? 0) > 1 && (batchIndex ?? -1) >= 0 && (batchIndex ?? 0) < (batchSize ?? 0);
-        if (!marked) {
-          if (pendingUsers.length > 0)
-            flushAssistant();
-          pendingUsers.push(userEvent.content);
-          pendingBatchSize = null;
-          pendingBatchNextIndex = 0;
-          break;
-        }
-        if (batchIndex === 0) {
-          if (pendingUsers.length > 0)
-            flushAssistant();
-          pendingBatchSize = batchSize ?? null;
-          pendingBatchNextIndex = 0;
-        } else if (!(pendingBatchSize !== null && (batchSize ?? 0) >= pendingBatchSize && pendingBatchNextIndex === batchIndex || pendingBatchSize === null && pendingUsers.length === batchIndex)) {
-          flushAssistant();
-        }
-        pendingUsers.push(userEvent.content);
-        pendingBatchSize = batchSize ?? null;
-        pendingBatchNextIndex = (batchIndex ?? 0) + 1;
-        break;
-      }
-      case "session":
-        if (pendingAssistantParts.length > 0 || toolBuffer.length > 0) {
-          flushAssistant();
-        }
-        break;
-      case "text": {
-        if (pendingUsers.length === 0) {
-          pendingUsers = ["(continued)"];
-        }
-        pendingAssistantParts.push(ev.content);
-        break;
-      }
-      case "result": {
-        if (pendingUsers.length === 0) {
-          pendingUsers = ["(continued)"];
-        }
-        pendingAssistantParts = [ev.content];
-        flushAssistant();
-        break;
-      }
-      case "text_delta":
-        break;
-      case "tool_use": {
-        const u = ev;
-        toolBuffer.push(`<!-- Tool: ${u.name} ${truncate(JSON.stringify(u.input), 200)} -->`);
-        break;
-      }
-      case "tool_result": {
-        const u = ev;
-        toolBuffer.push(`<!-- Tool result: ${truncate(u.content, 200)} -->`);
-        break;
-      }
-      case "error": {
-        const u = ev;
-        toolBuffer.push(`[Error: ${truncate(u.content, 200)}]`);
-        break;
-      }
-      case "tool_progress":
-      case "tool_use_summary":
-      case "file":
-      case "status":
-        break;
-    }
-  }
-  flushAssistant();
-  return pairs;
-}
 
 // ../../packages/core/src/platform/jsonl.ts
 import {
   appendFileSync,
   closeSync,
   fsyncSync,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync2,
   openSync,
   readFileSync as readFileSync2,
   renameSync,
@@ -498,7 +340,7 @@ function parseJsonlText(raw) {
 var LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 function writeJsonlFile(filePath, entries) {
   const dir = dirname3(filePath);
-  mkdirSync3(dir, { recursive: true });
+  mkdirSync2(dir, { recursive: true });
   const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   const payload = `${entries.map((e) => JSON.stringify(e)).join(`
 `)}
@@ -538,122 +380,6 @@ function fsyncDirectoryBestEffort(dir) {
   }
 }
 
-// ../../packages/core/src/agents/rollout/claude.ts
-var _attachmentsCache = null;
-function loadClaudeAttachments() {
-  if (_attachmentsCache)
-    return _attachmentsCache;
-  const raw = readFileSync3(join3(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
-  const lines = parseJsonlText(raw);
-  if (lines.length < 2) {
-    throw new Error(`loadClaudeAttachments: expected >=2 entries in claude-attachments.jsonl, got ${lines.length}`);
-  }
-  _attachmentsCache = {
-    deferredToolsDelta: lines[0],
-    skillListing: lines[1]
-  };
-  return _attachmentsCache;
-}
-var CLAUDE_SDK_VERSION = "2.1.126";
-var CLAUDE_DEFAULT_MODEL = "claude-sonnet-5";
-var CLAUDE_DEFAULT_GIT_BRANCH = "HEAD";
-function encodeClaudeCwd(cwd) {
-  const realCwd = cwd.startsWith("/tmp/") ? cwd.replace(/^\/tmp\//, "/private/tmp/") : cwd;
-  return `-${realCwd.replaceAll(/[^a-zA-Z0-9]/g, "-").replace(/^-/, "")}`;
-}
-function writeClaudeRollout(opts) {
-  const sessionId = opts.sessionId ?? randomUUID();
-  assertUuidLike("sessionId", sessionId);
-  ensureCwdExists(opts.cwd);
-  const pairs = opts.pairs ?? extractChatPairs(opts.entries ?? []);
-  const cwdReal = opts.cwd.startsWith("/tmp/") ? opts.cwd.replace(/^\/tmp\//, "/private/tmp/") : opts.cwd;
-  const lines = [];
-  const ts = () => new Date().toISOString();
-  let lastUuid = null;
-  lines.push({ type: "queue-operation", operation: "enqueue", timestamp: ts(), sessionId });
-  lines.push({ type: "queue-operation", operation: "dequeue", timestamp: ts(), sessionId });
-  const attachments = loadClaudeAttachments();
-  for (const pair of pairs) {
-    const userUuid = randomUUID();
-    lines.push({
-      parentUuid: lastUuid,
-      isSidechain: false,
-      promptId: randomUUID(),
-      type: "user",
-      message: { role: "user", content: [{ type: "text", text: pair.userText }] },
-      uuid: userUuid,
-      timestamp: ts(),
-      permissionMode: "bypassPermissions",
-      userType: "external",
-      entrypoint: "sdk-ts",
-      cwd: cwdReal,
-      sessionId,
-      version: CLAUDE_SDK_VERSION,
-      gitBranch: CLAUDE_DEFAULT_GIT_BRANCH
-    });
-    const att1Uuid = randomUUID();
-    const att1 = clone(attachments.deferredToolsDelta);
-    att1.parentUuid = userUuid;
-    att1.uuid = att1Uuid;
-    att1.timestamp = ts();
-    att1.sessionId = sessionId;
-    att1.cwd = cwdReal;
-    lines.push(att1);
-    const att2Uuid = randomUUID();
-    const att2 = clone(attachments.skillListing);
-    att2.parentUuid = att1Uuid;
-    att2.uuid = att2Uuid;
-    att2.timestamp = ts();
-    att2.sessionId = sessionId;
-    att2.cwd = cwdReal;
-    lines.push(att2);
-    const assistantUuid = randomUUID();
-    lines.push({
-      parentUuid: att2Uuid,
-      isSidechain: false,
-      message: {
-        model: opts.model ?? CLAUDE_DEFAULT_MODEL,
-        id: `msg_${randomUUID().replace(/-/g, "").slice(0, 24)}`,
-        type: "message",
-        role: "assistant",
-        content: [{ type: "text", text: pair.assistantText }],
-        stop_reason: "end_turn",
-        stop_sequence: null,
-        stop_details: null,
-        usage: {
-          input_tokens: 0,
-          cache_creation_input_tokens: 0,
-          cache_read_input_tokens: 0,
-          output_tokens: 0,
-          server_tool_use: { web_search_requests: 0, web_fetch_requests: 0 },
-          service_tier: "standard",
-          cache_creation: { ephemeral_1h_input_tokens: 0, ephemeral_5m_input_tokens: 0 },
-          inference_geo: "",
-          iterations: [],
-          speed: "standard"
-        },
-        diagnostics: null
-      },
-      requestId: `req_${randomUUID().replace(/-/g, "").slice(0, 22)}`,
-      type: "assistant",
-      uuid: assistantUuid,
-      timestamp: ts(),
-      userType: "external",
-      entrypoint: "sdk-ts",
-      cwd: cwdReal,
-      sessionId,
-      version: CLAUDE_SDK_VERSION,
-      gitBranch: CLAUDE_DEFAULT_GIT_BRANCH
-    });
-    lastUuid = assistantUuid;
-  }
-  const projectsDir = join3(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
-  const path = join3(projectsDir, `${sessionId}.jsonl`);
-  writeJsonlFile(path, lines);
-  logger.info({ sessionId, path, pairs: pairs.length }, "writeClaudeRollout: synthetic rollout placed");
-  return { sessionId, rolloutPath: path };
-}
-
 // ../../packages/core/src/agents/claude-registry.ts
 var ALIAS_MAP = {
   sonnet: MODEL_SONNET,
@@ -678,54 +404,6 @@ var claudeRegistry = {
   },
   footerLabel(model, effort) {
     return effort ? `${model} \xB7 ${effort}` : model;
-  },
-  writeRollout(opts) {
-    const { sessionId, rolloutPath } = writeClaudeRollout({
-      cwd: opts.cwd,
-      entries: opts.entries,
-      model: claudeRegistry.expandModelAlias(opts.model ?? claudeRegistry.defaultModel),
-      ...opts.reuseSessionId ? { sessionId: opts.reuseSessionId } : {}
-    });
-    return { sessionId, rolloutPath };
-  },
-  async forkSession({ parentSessionId, cwd, title }) {
-    const { forkSession } = await import("@anthropic-ai/claude-agent-sdk");
-    const result = await forkSession(parentSessionId, {
-      ...title ? { title } : {}
-    });
-    const projectsRoot = join4(homedir3(), ".claude", "projects");
-    const destDir = join4(projectsRoot, encodeClaudeCwd(cwd));
-    const destPath = join4(destDir, `${result.sessionId}.jsonl`);
-    if (!existsSync3(destPath)) {
-      const sourcePath = readdirSync(projectsRoot).map((d) => join4(projectsRoot, d, `${result.sessionId}.jsonl`)).find((p) => existsSync3(p));
-      if (!sourcePath) {
-        throw new Error(`claude forkSession: fork rollout ${result.sessionId}.jsonl not found under ${projectsRoot}`);
-      }
-      mkdirSync4(destDir, { recursive: true });
-      renameSync2(sourcePath, destPath);
-    }
-    return {
-      forkId: result.sessionId,
-      rolloutPath: destPath
-    };
-  },
-  async cleanupRollouts({ cwd, sessionIds }) {
-    const projectsDir = join4(homedir3(), ".claude", "projects", encodeClaudeCwd(cwd));
-    const failures = [];
-    for (const sid of sessionIds) {
-      const path = join4(projectsDir, `${sid}.jsonl`);
-      try {
-        unlinkSync3(path);
-      } catch (e) {
-        if (e?.code !== "ENOENT") {
-          logger.warn({ err: e, path }, "claude cleanupRollouts: unlink failed");
-          failures.push(e);
-        }
-      }
-    }
-    if (failures.length > 0) {
-      throw new AggregateError(failures, "claude cleanupRollouts failed");
-    }
   }
 };
 
@@ -846,6 +524,15 @@ function issueRuntimeMcpToken(ctx) {
   });
   return `${payloadPart}.${signTokenPayload(payloadPart)}`;
 }
+function issueHostedMcpToken(surface, ctx) {
+  const payloadPart = encodeTokenPart({
+    v: 2,
+    exp: Date.now() + TOKEN_TTL_MS,
+    aud: surface,
+    ctx
+  });
+  return `${payloadPart}.${signTokenPayload(payloadPart)}`;
+}
 function buildRuntimeMcpSpec(agent, ctx) {
   const token = issueRuntimeMcpToken(ctx);
   const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}`;
@@ -858,6 +545,18 @@ function buildRuntimeMcpSpec(agent, ctx) {
     timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS
   };
 }
+function buildHostedMcpSpec(agent, surface, ctx) {
+  const token = issueHostedMcpToken(surface, ctx);
+  const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}/${surface}`;
+  const query = `token=${encodeURIComponent(token)}`;
+  if (agent === "codex")
+    return { url: `${base}/mcp?${query}` };
+  return {
+    type: "sse",
+    url: `${base}/sse?${query}`,
+    timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS
+  };
+}
 
 // ../../packages/core/src/mcp/session-comm/bridge-ipc-config.ts
 var registrations = [];
@@ -1100,7 +799,7 @@ function buildStdioMcpServer(agent, serverFile, serverArgs, env) {
   if (agent === "codex") {
     return {
       command: "node",
-      args: [TSX_BIN, serverFile, ...serverArgs],
+      args: ["--import", TSX_LOADER, serverFile, ...serverArgs],
       env: { TSX_TSCONFIG_PATH: TSCONFIG_PATH, ...env }
     };
   }
@@ -1110,6 +809,28 @@ function buildStdioMcpServer(agent, serverFile, serverArgs, env) {
     ...env ? { env } : {}
   };
 }
+function useHostedBuiltinMcp() {
+  return envText("NEGOTIUM_BUILTIN_MCP_TRANSPORT") !== "stdio";
+}
+function buildBuiltinMcpServer(surface, ctx, stdio) {
+  if (!useHostedBuiltinMcp())
+    return stdio();
+  const agent = ctx.agent ?? FALLBACK_AGENT;
+  return buildHostedMcpSpec(agent, surface, {
+    userId: ctx.userId,
+    topicTitle: ctx.session,
+    ...ctx.topicId ? { topicId: ctx.topicId } : {},
+    ...ctx.queryId ? { queryId: ctx.queryId } : {},
+    ...ctx.wikiTopicId ? { wikiTopicId: ctx.wikiTopicId } : {},
+    ...ctx.subagentParentTopicId ? { subagentParentTopicId: ctx.subagentParentTopicId } : {},
+    cwd: ctx.cwd ?? (ctx.topicId ? resolveTopicWorkspaceDir(ctx.topicId) : process.cwd()),
+    agent,
+    ...ctx.model ? { model: ctx.model } : {},
+    ...ctx.depth !== undefined ? { depth: ctx.depth } : {},
+    ...ctx.silent !== undefined ? { silent: ctx.silent } : {},
+    ...ctx.peerBridge ? { peerBridge: ctx.peerBridge } : {}
+  });
+}
 var _playwrightUnavailableNotifier;
 var _playwrightUnavailableLastNotifiedAt = new Map;
 var _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS = 5 * 60000;
@@ -1235,13 +956,14 @@ var MCP_CATALOG = {
   },
   "token-stats": {
     ...commonRuntimeMcpPolicy("token-stats"),
-    build({ userId, agent }) {
-      return buildStdioMcpServer(agent, TOKEN_STATS_SERVER, [`--user-id=${userId}`]);
+    build(ctx) {
+      return buildBuiltinMcpServer("token-stats", ctx, () => buildStdioMcpServer(ctx.agent, TOKEN_STATS_SERVER, [`--user-id=${ctx.userId}`]));
     }
   },
   task: {
     ...commonRuntimeMcpPolicy("task"),
-    build({ userId, session, topicId, queryId, agent, peerBridge }) {
+    build(ctx) {
+      const { userId, session, topicId, queryId, agent, peerBridge } = ctx;
       if (peerBridge) {
         if (!topicId || !queryId)
           return null;
@@ -1257,21 +979,22 @@ var MCP_CATALOG = {
       const args = [`--user-id=${userId}`, `--topic=${session}`];
       if (topicId)
         args.push(`--topic-id=${topicId}`);
-      return buildStdioMcpServer(agent, TASK_SERVER, args);
+      return buildBuiltinMcpServer("task", ctx, () => buildStdioMcpServer(agent, TASK_SERVER, args));
     }
   },
   "session-comm": {
     ...commonRuntimeMcpPolicy("session-comm"),
-    build({
-      userId,
-      session,
-      topicId,
-      subagentParentTopicId,
-      agent,
-      depth = 0,
-      silent,
-      peerBridge
-    }) {
+    build(ctx) {
+      const {
+        userId,
+        session,
+        topicId,
+        subagentParentTopicId,
+        agent,
+        depth = 0,
+        silent,
+        peerBridge
+      } = ctx;
       const effectiveAgent = agent ?? FALLBACK_AGENT;
       const args = [
         `--user-id=${userId}`,
@@ -1283,12 +1006,13 @@ var MCP_CATALOG = {
         ...silent ? ["--reply-only=true"] : [],
         ...peerBridge ? [`--peer-host-query-id=${peerBridge.hostQueryId}`] : []
       ];
-      return buildStdioMcpServer(effectiveAgent, SESSION_COMM_SERVER, args, peerBridge ? peerSessionBridgeIpcEnv() : undefined);
+      return buildBuiltinMcpServer("session-comm", ctx, () => buildStdioMcpServer(effectiveAgent, SESSION_COMM_SERVER, args, peerBridge ? peerSessionBridgeIpcEnv() : undefined));
     }
   },
   wiki: {
     ...commonRuntimeMcpPolicy("wiki"),
-    build({ userId, session, topicId, queryId, wikiTopicId, agent, peerBridge }) {
+    build(ctx) {
+      const { userId, session, topicId, queryId, wikiTopicId, agent, peerBridge } = ctx;
       if (peerBridge) {
         if (!topicId || !queryId)
           return null;
@@ -1306,22 +1030,23 @@ var MCP_CATALOG = {
       if (resolvedWikiTopicId)
         args.push(`--topic-id=${resolvedWikiTopicId}`);
       args.push("--surface=wiki");
-      return buildStdioMcpServer(agent, WIKI_SERVER, args);
+      return buildBuiltinMcpServer("wiki", { ...ctx, wikiTopicId: resolvedWikiTopicId }, () => buildStdioMcpServer(agent, WIKI_SERVER, args));
     }
   },
   skills: {
     ...commonRuntimeMcpPolicy("skills"),
-    build({ userId, topicId, agent }) {
+    build(ctx) {
+      const { userId, topicId, agent } = ctx;
       const args = [`--user-id=${userId}`, "--surface=skills"];
       if (topicId)
         args.push(`--topic-id=${topicId}`);
-      return buildStdioMcpServer(agent, WIKI_SERVER, args);
+      return buildBuiltinMcpServer("skills", ctx, () => buildStdioMcpServer(agent, WIKI_SERVER, args));
     }
   },
   "system-health": {
     ...commonRuntimeMcpPolicy("system-health"),
-    build({ agent }) {
-      return buildStdioMcpServer(agent, SYSTEM_HEALTH_SERVER, []);
+    build(ctx) {
+      return buildBuiltinMcpServer("system-health", ctx, () => buildStdioMcpServer(ctx.agent, SYSTEM_HEALTH_SERVER, []));
     }
   },
   "background-bash": {
@@ -1334,18 +1059,20 @@ var MCP_CATALOG = {
   },
   "agent-health": {
     ...commonRuntimeMcpPolicy("agent-health"),
-    build({ userId, agent }) {
+    build(ctx) {
+      const { userId, agent } = ctx;
       const args = [`--user-id=${userId}`];
-      return buildStdioMcpServer(agent, AGENT_HEALTH_SERVER, args);
+      return buildBuiltinMcpServer("agent-health", ctx, () => buildStdioMcpServer(agent, AGENT_HEALTH_SERVER, args));
     }
   },
   vault: {
     ...commonRuntimeMcpPolicy("vault"),
-    build({ userId, agent }) {
+    build(ctx) {
+      const { userId, agent } = ctx;
       const args = [`--user-id=${userId}`];
       if (agent !== "codex")
         args.push("--list-only=true");
-      return buildStdioMcpServer(agent, VAULT_SERVER, args);
+      return buildBuiltinMcpServer("vault", ctx, () => buildStdioMcpServer(agent, VAULT_SERVER, args));
     }
   }
 };
@@ -1572,8 +1299,8 @@ function getMcpServersForQuery(opts) {
 }
 
 // ../../packages/core/src/storage/vault.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync5 } from "fs";
-import { join as join5 } from "path";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join3 } from "path";
 
 // ../../packages/core/src/storage/sqlite.ts
 var isBun = typeof process.versions.bun === "string";
@@ -1707,8 +1434,8 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const path = join5(dataDir, "vault.db");
-  mkdirSync5(dataDir, { recursive: true });
+  const path = join3(dataDir, "vault.db");
+  mkdirSync3(dataDir, { recursive: true });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
   initializeVaultDatabase(database);
@@ -1966,7 +1693,7 @@ function buildClaudePrompt(opts) {
         source: {
           type: "base64",
           media_type: attachment.mimeType,
-          data: readFileSync4(attachment.path).toString("base64")
+          data: readFileSync3(attachment.path).toString("base64")
         }
       });
     } catch (err) {
@@ -2095,7 +1822,7 @@ function isAbortError(err) {
 }
 async function* claudeProvider(opts) {
   const claudeExecutable = hostedClaudeCodeExecutablePath();
-  if (claudeExecutable && !existsSync4(claudeExecutable)) {
+  if (claudeExecutable && !existsSync2(claudeExecutable)) {
     yield {
       type: "error",
       content: `Claude CLI not found at ${claudeExecutable}. Install Claude Code or configure the executable path.`
@@ -2366,38 +2093,38 @@ async function* claudeProvider(opts) {
 
 // ../../packages/core/src/agents/codex-provider.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
-import { dirname as dirname6, isAbsolute, join as join8, relative, resolve as resolve5 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
+import { dirname as dirname6, isAbsolute, join as join6, relative, resolve as resolve5 } from "path";
 import { Codex } from "@openai/codex-sdk";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn3 } from "child_process";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID } from "crypto";
 import {
   chmodSync as chmodSync3,
   copyFileSync,
-  existsSync as existsSync5,
+  existsSync as existsSync3,
   mkdtempSync,
-  readFileSync as readFileSync5,
-  renameSync as renameSync3,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
   rmSync,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync4
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname4, join as join4 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.47";
+var NEGOTIUM_VERSION = "0.1.49";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
-var moduleRequire = createRequire(import.meta.url);
+var moduleRequire = createRequire2(import.meta.url);
 var codexSdkPackagePath = moduleRequire.resolve("@openai/codex-sdk/package.json");
-var codexSdkRequire = createRequire(codexSdkPackagePath);
+var codexSdkRequire = createRequire2(codexSdkPackagePath);
 var bundledCodexPackagePath = codexSdkRequire.resolve("@openai/codex/package.json");
 function readPackageVersion(packageJsonPath) {
-  const parsed = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
+  const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
   if (typeof parsed.version !== "string" || !parsed.version.trim()) {
     throw new Error(`Codex package has no valid version: ${packageJsonPath}`);
   }
@@ -2408,7 +2135,7 @@ var SAFE_BUNDLED_CODEX_VERSION = BUNDLED_CODEX_VERSION.replace(/[^a-zA-Z0-9._-]/
 var NEGOTIUM_MODEL_CACHE = `negotium-models-cache-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 var NEGOTIUM_MODEL_CATALOG = `negotium-model-catalog-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 function codexCliScriptPath() {
-  return join6(dirname4(bundledCodexPackagePath), "bin", "codex.js");
+  return join4(dirname4(bundledCodexPackagePath), "bin", "codex.js");
 }
 function parseCodexModelCache(contents, sourcePath) {
   let parsed;
@@ -2423,7 +2150,7 @@ function parseCodexModelCache(contents, sourcePath) {
   return parsed;
 }
 function readCodexModelCache(cachePath) {
-  const contents = readFileSync5(cachePath, "utf8");
+  const contents = readFileSync4(cachePath, "utf8");
   return { contents, parsed: parseCodexModelCache(contents, cachePath) };
 }
 function readCompatibleCodexModelCache(cachePath) {
@@ -2435,21 +2162,21 @@ function readCompatibleCodexModelCache(cachePath) {
   return cache;
 }
 function writePrivateFileAtomic(path, contents) {
-  if (existsSync5(path) && readFileSync5(path, "utf8") === contents)
+  if (existsSync3(path) && readFileSync4(path, "utf8") === contents)
     return;
-  const tempPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try {
-    writeFileSync4(tempPath, contents, { encoding: "utf8", mode: 384 });
-    renameSync3(tempPath, path);
+    writeFileSync3(tempPath, contents, { encoding: "utf8", mode: 384 });
+    renameSync2(tempPath, path);
     chmodSync3(path, 384);
   } finally {
     try {
-      unlinkSync4(tempPath);
+      unlinkSync3(tempPath);
     } catch {}
   }
 }
 function bundledCodexModelCachePath(authFilePath) {
-  return join6(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
+  return join4(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn3(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
@@ -2472,7 +2199,7 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
       } catch {}
       if (error)
         reject(error);
-      else if (!existsSync5(cachePath))
+      else if (!existsSync3(cachePath))
         reject(new Error("Codex did not create its model cache"));
       else
         resolve4();
@@ -2535,15 +2262,15 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
 }
 async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
   const sourceHome = dirname4(authFilePath);
-  const isolatedHome = mkdtempSync(join6(tmpdir(), "negotium-codex-models-"));
-  const isolatedCachePath = join6(isolatedHome, "models_cache.json");
+  const isolatedHome = mkdtempSync(join4(tmpdir(), "negotium-codex-models-"));
+  const isolatedCachePath = join4(isolatedHome, "models_cache.json");
   try {
-    const isolatedAuthPath = join6(isolatedHome, "auth.json");
+    const isolatedAuthPath = join4(isolatedHome, "auth.json");
     copyFileSync(authFilePath, isolatedAuthPath);
     chmodSync3(isolatedAuthPath, 384);
-    const sourceConfigPath = join6(sourceHome, "config.toml");
-    if (existsSync5(sourceConfigPath)) {
-      const isolatedConfigPath = join6(isolatedHome, "config.toml");
+    const sourceConfigPath = join4(sourceHome, "config.toml");
+    if (existsSync3(sourceConfigPath)) {
+      const isolatedConfigPath = join4(isolatedHome, "config.toml");
       copyFileSync(sourceConfigPath, isolatedConfigPath);
       chmodSync3(isolatedConfigPath, 384);
     }
@@ -2557,22 +2284,22 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
   const codexHome = dirname4(authFilePath);
   const configuredCachePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE;
   if (configuredCachePath) {
-    if (!existsSync5(configuredCachePath)) {
+    if (!existsSync3(configuredCachePath)) {
       throw new Error(`Configured Codex model cache does not exist: ${configuredCachePath}`);
     }
     readCompatibleCodexModelCache(configuredCachePath);
     return configuredCachePath;
   }
   const bundledCachePath = bundledCodexModelCachePath(authFilePath);
-  const sharedCachePath = join6(codexHome, "models_cache.json");
-  if (existsSync5(sharedCachePath)) {
+  const sharedCachePath = join4(codexHome, "models_cache.json");
+  if (existsSync3(sharedCachePath)) {
     try {
       const shared = readCompatibleCodexModelCache(sharedCachePath);
       writePrivateFileAtomic(bundledCachePath, shared.contents);
       return bundledCachePath;
     } catch {}
   }
-  if (existsSync5(bundledCachePath)) {
+  if (existsSync3(bundledCachePath)) {
     try {
       readCompatibleCodexModelCache(bundledCachePath);
       return bundledCachePath;
@@ -2584,7 +2311,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
 }
 function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
   const codexHome = dirname4(authFilePath);
-  const outputPath = join6(codexHome, NEGOTIUM_MODEL_CATALOG);
+  const outputPath = join4(codexHome, NEGOTIUM_MODEL_CATALOG);
   const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
     if (!model || typeof model !== "object" || Array.isArray(model)) {
@@ -2818,11 +2545,11 @@ var killCodexTrees = manager.killTrees;
 var killOwnedCodexTreesForShutdown = manager.killOwnedTreesForShutdown;
 
 // ../../packages/core/src/agents/rollout/codex.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync5 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename, dirname as dirname5, join as join7, resolve as resolve4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename, dirname as dirname5, join as join5, resolve as resolve4 } from "path";
 function codexSessionsDir() {
-  return join7(process.env.CODEX_HOME || join7(homedir4(), ".codex"), "sessions");
+  return join5(process.env.CODEX_HOME || join5(homedir2(), ".codex"), "sessions");
 }
 function canonicalFilePath(path) {
   const absolute = resolve4(path);
@@ -2830,7 +2557,7 @@ function canonicalFilePath(path) {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join7(realpathSync2(dirname5(absolute)), basename(absolute));
+      return join5(realpathSync2(dirname5(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -2940,7 +2667,7 @@ function readCodexPatchCallIds(threadId) {
   if (!path)
     return [];
   try {
-    return extractCodexPatchCallIds(readFileSync6(path, "utf8"));
+    return extractCodexPatchCallIds(readFileSync5(path, "utf8"));
   } catch (error) {
     logger.debug({ error, threadId }, "codex patch ids: rollout read failed");
     return [];
@@ -2951,7 +2678,7 @@ function readLatestCodexPatchPreview(threadId, expectedPaths, consumedCallIds =
   if (!path)
     return;
   try {
-    return extractLatestCodexPatchPreview(readFileSync6(path, "utf8"), expectedPaths, consumedCallIds, expectedCallId);
+    return extractLatestCodexPatchPreview(readFileSync5(path, "utf8"), expectedPaths, consumedCallIds, expectedCallId);
   } catch (error) {
     logger.debug({ error, threadId }, "codex patch preview: rollout read failed");
     return;
@@ -2979,7 +2706,7 @@ function readLatestCodexContextUsage(threadId) {
   if (!path)
     return;
   try {
-    return extractLatestCodexContextUsage(readFileSync6(path, "utf8"));
+    return extractLatestCodexContextUsage(readFileSync5(path, "utf8"));
   } catch (error) {
     logger.debug({ error, threadId }, "codex context usage: rollout read failed");
     return;
@@ -2990,7 +2717,7 @@ function migrateCodexRolloutNativeMultiAgentMetadata(threadId) {
   if (!path)
     return false;
   try {
-    const entries = parseJsonlText(readFileSync6(path, "utf8"));
+    const entries = parseJsonlText(readFileSync5(path, "utf8"));
     let changed = false;
     for (const entry of entries) {
       if (entry.type !== "session_meta" && entry.type !== "turn_context")
@@ -3019,19 +2746,19 @@ function latestCodexRolloutPath(threadId) {
   try {
     if (buckets) {
       for (const bucket of buckets) {
-        const dir = join7(sessionsDir, bucket);
-        if (!existsSync6(dir))
+        const dir = join5(sessionsDir, bucket);
+        if (!existsSync4(dir))
           continue;
         const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
         for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-          candidates.push(join7(dir, rel));
+          candidates.push(join5(dir, rel));
         }
       }
     }
     if (candidates.length === 0) {
       const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-        candidates.push(join7(sessionsDir, rel));
+        candidates.push(join5(sessionsDir, rel));
       }
     }
     return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
@@ -3169,12 +2896,12 @@ function codexMcpServerName(name) {
   return CODEX_MCP_SERVER_NAME_OVERRIDES[name] ?? name;
 }
 function globalCodexMcpServerNames(authFilePath) {
-  const configPath = join8(dirname6(authFilePath), "config.toml");
-  if (!existsSync7(configPath))
+  const configPath = join6(dirname6(authFilePath), "config.toml");
+  if (!existsSync5(configPath))
     return [];
   try {
     const names = new Set;
-    for (const line of readFileSync7(configPath, "utf8").split(`
+    for (const line of readFileSync6(configPath, "utf8").split(`
 `)) {
       const match = line.match(/^\s*\[\s*mcp_servers\.((?:"(?:\\.|[^"])*")|(?:'[^']*')|[^.\]\s]+)(?:[.\]])/);
       const raw = match?.[1];
@@ -3274,13 +3001,13 @@ function canonicalPath(path) {
   }
 }
 function textFile(path, maxBytes = CODEX_DIFF_FILE_LIMIT) {
-  if (!existsSync7(path))
+  if (!existsSync5(path))
     return null;
   try {
     const byteLimit = Math.min(CODEX_DIFF_FILE_LIMIT, Math.max(0, maxBytes));
     if (statSync3(path).size > byteLimit)
       return;
-    const content = readFileSync7(path);
+    const content = readFileSync6(path);
     if (content.byteLength > byteLimit || content.includes(0))
       return;
     return content.toString("utf8");
@@ -3487,7 +3214,7 @@ async function* codexProvider(opts) {
   const filePreviews = new CodexFilePreviewTracker(opts.cwd);
   const consumedPatchCallIds = new Set(opts.sessionId ? readCodexPatchCallIds(opts.sessionId) : []);
   const codexAuthPath = hostedCodexAuthFilePath();
-  if (!existsSync7(codexAuthPath)) {
+  if (!existsSync5(codexAuthPath)) {
     yield {
       type: "error",
       content: `Codex auth file not found at ${codexAuthPath}. Run \`codex login\` to authenticate.`
@@ -3526,7 +3253,7 @@ async function* codexProvider(opts) {
     model: opts.model ?? "(sdk default)",
     effort: opts.effort ?? "(off)",
     cwd: opts.cwd,
-    cwdExists: existsSync7(opts.cwd),
+    cwdExists: existsSync5(opts.cwd),
     resume: Boolean(opts.sessionId),
     mcpServerCount: Object.keys(codexMcpServers).length
   }, "codexProvider: starting turn");
@@ -3933,18 +3660,18 @@ function maestroProvider(opts) {
   return sdkMaestroProvider(sdkOpts);
 }
 // ../../packages/core/src/agents/claude-runtime-inspection.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { createRequire as createRequire2 } from "module";
-import { dirname as dirname7, join as join9 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { createRequire as createRequire3 } from "module";
+import { dirname as dirname7, join as join7 } from "path";
 var cached;
 function inspectBundledClaudeRuntime() {
   if (cached)
     return cached;
   try {
-    const require2 = createRequire2(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const sdkDir = dirname7(require2.resolve("@anthropic-ai/claude-agent-sdk"));
-    const sdkPackage = JSON.parse(readFileSync8(join9(sdkDir, "package.json"), "utf8"));
-    const manifest = JSON.parse(readFileSync8(join9(sdkDir, "manifest.json"), "utf8"));
+    const sdkPackage = JSON.parse(readFileSync7(join7(sdkDir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync7(join7(sdkDir, "manifest.json"), "utf8"));
     const sdkVersion = typeof sdkPackage.version === "string" ? sdkPackage.version : "";
     const claudeCodeVersion = typeof manifest.version === "string" ? manifest.version : "";
     if (!sdkVersion || !claudeCodeVersion) {
@@ -4017,4 +3744,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=4F9EA6547B6C78F264756E2164756E21
+//# debugId=91493C665ED6215F64756E2164756E21