negotium 0.1.49 → 0.2.0

package/dist/runtime/src/platform/config.ts

@@ -69,10 +69,15 @@ function parsePortEnv(envValue: string | undefined, fallback: number): number {
 export const WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
 export const TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
 export const SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
-export const CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
-export const BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
-export const DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
-export const SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
+export const CRON_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "cron");
+export const BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
+export const BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
+export const BINARIES_DIR = resolve(STATE_DIR, "binaries");
+export const SECRETS_DIR = resolve(STATE_DIR, "secrets");
+// Legacy names remain public, but their durable contents now live under data.
+export const CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
+export const DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
+export const SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
 // The Claude Agent SDK ships a platform-matched Claude Code binary. Keep that
 // SDK/CLI pair together by default; only use an external executable when an
 // operator explicitly opts in. This avoids silently pairing an older SDK with
@@ -140,7 +145,7 @@ export function resolveBrowserRsBin(envValue?: string): string | undefined {
   }
   const candidate = override
     ? resolve(override)
-    : resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+    : resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
   try {
     accessSync(candidate, constants.X_OK);
     return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
@@ -155,9 +160,7 @@ export const BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_B
 export function resolveBrowserMcpBin(envValue?: string): string {
   const override = envValue?.trim();
   if (override) return resolve(override);
-  return (
-    BROWSER_RS_BIN ?? resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs")
-  );
+  return BROWSER_RS_BIN ?? resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
 }
 
 export const PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
@@ -269,7 +272,7 @@ function loadOrCreateLocalSecret(
   options: { persistEnvValue?: boolean } = {},
 ): string {
   const envValue = envText(envKey);
-  const secretFile = resolve(STATE_DIR, filename);
+  const secretFile = resolve(SECRETS_DIR, filename);
   mkdirSync(dirname(secretFile), { recursive: true });
   if (envValue) {
     if (options.persistEnvValue) {
@@ -325,6 +328,8 @@ export const hostname = process.env.HOSTNAME || "127.0.0.1";
 // Persistent state (survives restarts, long-lived)
 export const DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
 export const LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+export const UPLOADS_DIR = resolve(DATA_DIR, "uploads");
+export const VAULT_DIR = resolve(DATA_DIR, "vault");
 // SESSIONS_DB_PATH env override lets tests point the DB singleton at a temp file.
 export const SESSIONS_DB = process.env.SESSIONS_DB_PATH
   ? resolve(process.env.SESSIONS_DB_PATH)
@@ -333,7 +338,9 @@ export const DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
 export const USERS_LOG_DIR = resolve(DATA_DIR, "users");
 
 // Runtime IPC queues (transient, safe to clear on restart)
-export const RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "run");
+/** @deprecated Use the runtime layout name; NEGOTIUM_RUN_DIR remains a compatibility override. */
+export const RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "runtime");
+export const RUNTIME_DIR = RUN_DIR;
 export const PROGRESS_DIR = resolve(RUN_DIR, "progress");
 export const DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
 export const DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
@@ -344,6 +351,8 @@ export const PLAYWRIGHT_MAX_PORT = parsePortEnv(process.env.PLAYWRIGHT_MAX_PORT,
 export const PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
 mkdirSync(STATE_DIR, { recursive: true });
 mkdirSync(DATA_DIR, { recursive: true });
+mkdirSync(UPLOADS_DIR, { recursive: true });
+mkdirSync(VAULT_DIR, { recursive: true, mode: 0o700 });
 mkdirSync(LOG_DIR, { recursive: true });
 mkdirSync(PROGRESS_DIR, { recursive: true });
 mkdirSync(DM_CMD_DIR, { recursive: true });
@@ -354,10 +363,14 @@ mkdirSync(PLAYWRIGHT_PORTS_DIR, { recursive: true });
 mkdirSync(WORKSPACE_DIR, { recursive: true });
 mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
 mkdirSync(SHARED_WIKI_DIR, { recursive: true });
+mkdirSync(CRON_WORKSPACE_DIR, { recursive: true });
 mkdirSync(CONTEXTS_DIR, { recursive: true });
-mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
 mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
 mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
+mkdirSync(BROWSER_DIR, { recursive: true });
+mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
+mkdirSync(BINARIES_DIR, { recursive: true });
+mkdirSync(SECRETS_DIR, { recursive: true, mode: 0o700 });
 
 /** Stale threshold for active-query state files (crash recovery) */
 export const ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000; // 10 minutes

package/dist/runtime/src/platform/mcp-config.ts

@@ -902,7 +902,7 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
   if (opts.sessionType === "cron") {
     if (!opts.topicId) throw new Error("getMcpServersForQuery: cron sessionType requires topicId");
     return getCronMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session || "cron",
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -919,7 +919,7 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
   }
   if (opts.sessionType === "dm" || opts.sessionType === "ephemeral") {
     return getDmMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       agent: opts.agent,
       playwrightPort: opts.playwrightPort,
       playwrightCapability: opts.playwrightCapability,
@@ -927,7 +927,7 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
   }
   if (opts.sessionType === "manager") {
     return getManagerMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session,
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -944,7 +944,7 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
     });
   }
   return getForumMcpServers({
-    userId: opts.userId || "default",
+    userId: opts.userId || "local",
     session: opts.session || "default",
     topicId: opts.topicId,
     subagentParentTopicId: opts.subagentParentTopicId,

package/dist/runtime/src/platform/playwright/manager.ts

@@ -5,7 +5,6 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
-  renameSync,
   rmSync,
   unlinkSync,
   writeFileSync,
@@ -123,7 +122,7 @@ export function resolvePlaywrightTopicBinding(
 function defaultTopicBinding(userId: string, topic: string | undefined): PlaywrightProfileBinding {
   if (!topic) return managerHost.resolveNamedBinding(userId, "default");
   const ownerId = getBrowserProfileOwner(topic, userId);
-  const profile = migrateLegacyTopicProfile(ownerId, topic);
+  const profile = getTopicBrowserProfile(topic);
   return managerHost.resolveNamedBinding(ownerId, profile);
 }
 
@@ -153,12 +152,12 @@ function validateProfileBinding(binding: PlaywrightProfileBinding): PlaywrightPr
   return Object.freeze({ ...binding });
 }
 
-function defaultNamedBinding(ownerId: string, rawProfile: string): PlaywrightProfileBinding {
+function defaultNamedBinding(_ownerId: string, rawProfile: string): PlaywrightProfileBinding {
   const profile = normalizeBrowserProfileName(rawProfile);
-  const instanceKey = `profile:${encodeURIComponent(ownerId)}:${profile}`;
+  const instanceKey = `profile:${profile}`;
   return {
     instanceKey,
-    ownerId,
+    ownerId: "local",
     profile,
   };
 }
@@ -167,22 +166,6 @@ export function legacyBrowserProfileName(topic: string): string {
   return `legacy_${createHash("sha256").update(topic).digest("hex").slice(0, 12)}`;
 }
 
-function migrateLegacyTopicProfile(ownerId: string, topic: string): string {
-  const current = getTopicBrowserProfile(topic);
-  if (current !== "default" || !hasBrowserProfileTopic(topic)) return current;
-
-  const legacyDir = resolve(BROWSER_PROFILES_DIR, sanitizeTopicName(topic));
-  if (!existsSync(legacyDir)) return current;
-
-  const profile = legacyBrowserProfileName(topic);
-  const profileDir = defaultProfileDir(ownerId, profile);
-  mkdirSync(dirname(profileDir), { recursive: true });
-  if (!existsSync(profileDir)) renameSync(legacyDir, profileDir);
-  assignTopicBrowserProfile({ topicId: topic, actorUserId: ownerId, profile });
-  logger.info({ ownerId, topic, profile }, "Adopted legacy topic browser profile");
-  return profile;
-}
-
 function defaultChildEnvironment(context: PlaywrightChildEnvironmentContext): NodeJS.ProcessEnv {
   const childEnvironment: NodeJS.ProcessEnv = {};
   for (const key of [
@@ -281,6 +264,10 @@ interface InstanceKeyParts {
 }
 
 function parseInstanceKey(instanceKey: string): InstanceKeyParts {
+  const shared = /^profile:(.+)$/.exec(instanceKey);
+  if (shared && !shared[1]!.includes(":")) {
+    return { ownerId: "local", profile: normalizeBrowserProfileName(shared[1]!) };
+  }
   const match = /^profile:([^:]+):(.+)$/.exec(instanceKey);
   if (!match) return { ownerId: "legacy", profile: sanitizeTopicName(instanceKey) };
   return {
@@ -571,13 +558,8 @@ function releasePort(port: number) {
   usedPorts.delete(port);
 }
 
-function ownerDirectory(ownerId: string): string {
-  const digest = createHash("sha256").update(ownerId).digest("hex").slice(0, 16);
-  return `${sanitizeTopicName(ownerId).slice(0, 24)}_${digest}`;
-}
-
-function defaultProfileDir(ownerId: string, profile: string): string {
-  return resolve(BROWSER_PROFILES_DIR, "profiles", ownerDirectory(ownerId), profile);
+function defaultProfileDir(_ownerId: string, profile: string): string {
+  return resolve(BROWSER_PROFILES_DIR, profile);
 }
 
 /** Resolve the shared profile userDataDir for an instanceKey. */

package/dist/runtime/src/runtime/attachments.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { copyFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
-import { resolveTopicWorkspaceDir } from "#platform/config";
+import { resolveTopicWorkspaceDir, UPLOADS_DIR } from "#platform/config";
 import { logger } from "#platform/logger";
 import { resolveAttachmentByFileId, resolveUploadedFilePathByFileId } from "#runtime/file-hooks";
 import type { AgentInputAttachment } from "#types";
@@ -104,13 +104,13 @@ export interface IngestedAttachment {
 }
 
 /**
- * Store an inbound channel attachment in the topic's workspace (`uploads/`)
+ * Store an inbound channel attachment in the canonical data upload store.
  * and return the canonical prompt fragment for it. Single implementation of
  * the "download → workspace → [Attached file: …] line" intake used by every
  * channel adapter (ported from clawgram's buildPromptFromMessage convention).
  */
 export function ingestAttachment(args: IngestAttachmentArgs): IngestedAttachment {
-  const destDir = join(workspaceCwdFor(args.topicId), "uploads");
+  const destDir = join(UPLOADS_DIR, args.topicId);
   mkdirSync(destDir, { recursive: true });
   const safeName = safeAttachmentFilename(args.filename, "upload");
   // Timestamp alone collides for same-name files ingested in the same ms

package/dist/runtime/src/storage/browser-profiles.ts

@@ -55,11 +55,12 @@ export function hasBrowserProfileTopic(topicId: string): boolean {
 }
 
 export function createBrowserProfile(ownerId: string, rawName: string): string {
+  void ownerId;
   const name = normalizeBrowserProfileName(rawName);
   if (name === DEFAULT_BROWSER_PROFILE) return name;
   db.query(
     "INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)",
-  ).run(ownerId, name, new Date().toISOString());
+  ).run("local", name, new Date().toISOString());
   return name;
 }
 
@@ -84,18 +85,18 @@ export function assignTopicBrowserProfile(opts: {
 }
 
 export function listBrowserProfiles(ownerId: string): BrowserProfileRecord[] {
+  void ownerId;
   const records = db
     .query<{ name: string; created_at: string }, string>(
       "SELECT name, created_at FROM browser_profiles WHERE owner_id = ? ORDER BY name",
     )
-    .all(ownerId);
+    .all("local");
   const topics = db
-    .query<{ id: string; title: string; browser_profile: string | null }, string>(
+    .query<{ id: string; title: string; browser_profile: string | null }, []>(
       `SELECT t.id, t.title, t.browser_profile FROM api_topics t
-       WHERE t.browser_profile_owner = ?
        ORDER BY t.title`,
     )
-    .all(ownerId);
+    .all();
 
   const byName = new Map<string, BrowserProfileRecord>();
   byName.set(DEFAULT_BROWSER_PROFILE, {
@@ -120,14 +121,15 @@ export function listBrowserProfiles(ownerId: string): BrowserProfileRecord[] {
 }
 
 export function deleteBrowserProfile(ownerId: string, rawName: string): void {
+  void ownerId;
   const name = normalizeBrowserProfileName(rawName);
   if (name === DEFAULT_BROWSER_PROFILE) throw new Error("The default profile cannot be deleted.");
   const used = db
-    .query<{ count: number }, [string, string]>(
+    .query<{ count: number }, string>(
       `SELECT COUNT(*) AS count FROM api_topics t
-       WHERE t.browser_profile = ? AND t.browser_profile_owner = ?`,
+       WHERE t.browser_profile = ?`,
     )
-    .get(name, ownerId)?.count;
+    .get(name)?.count;
   if (used) throw new Error(`Profile "${name}" is assigned to ${used} topic(s).`);
-  db.query("DELETE FROM browser_profiles WHERE owner_id = ? AND name = ?").run(ownerId, name);
+  db.query("DELETE FROM browser_profiles WHERE owner_id = ? AND name = ?").run("local", name);
 }

package/dist/runtime/src/storage/conversations.ts

@@ -18,8 +18,8 @@ import type { AgentKind, UnifiedEvent } from "#types";
  * **provider-agnostic source of truth** for cross-agent portability.
  *
  * Storage layout:
- *   {DATA_DIR}/conversations/{userId}/{sanitizedTopicName}.jsonl
- *   {DATA_DIR}/conversations/{userId}/{sanitizedTopicName}.active.jsonl
+ *   {DATA_DIR}/conversations/{sanitizedTopicName}.jsonl
+ *   {DATA_DIR}/conversations/{sanitizedTopicName}.active.jsonl
  *
  * The first file is append-only and retains every yielded UnifiedEvent for
  * archive and teardown. The optional active file is a replaceable provider
@@ -44,22 +44,9 @@ export interface ConversationEntry {
   event: UnifiedEvent;
 }
 
-/**
- * Validate that a userId stringifies to a safe path component. Rejects empties,
- * slashes, and traversal sequences before they touch the filesystem. The
- * conversation log is local-only so we keep this strict but simple if a
- * caller sends something unexpected it is their bug to fix, not ours to coerce.
- */
-function safeUserIdComponent(userId: number | string): string {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`conversations: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
-
-function conversationDir(userId: number | string): string {
-  return join(resolveStorageDataDir(), "conversations", safeUserIdComponent(userId));
+/** Public userId remains in the API, but standalone storage has one flat local namespace. */
+function conversationDir(_userId: number | string): string {
+  return join(resolveStorageDataDir(), "conversations");
 }
 
 function topicFilename(topicName: string): string {

package/dist/runtime/src/storage/storage-host.ts

@@ -59,7 +59,7 @@ function defaultWorkspaceDir(): string {
 }
 
 function defaultSessionAsksDir(): string {
-  const runDir = envPath("NEGOTIUM_RUN_DIR", join(defaultStateDir(), "run"));
+  const runDir = envPath("NEGOTIUM_RUN_DIR", join(defaultStateDir(), "runtime"));
   return join(runDir, "session-asks");
 }
 

package/dist/runtime/src/storage/tasks.ts

@@ -22,14 +22,6 @@ interface TaskFileShape {
   tasks: StoredTask[];
 }
 
-function safeUserIdComponent(userId: number | string): string {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`tasks: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
-
 function safeTaskScopeKey(scopeKey: string): string {
   const safe = sanitizeFileName(scopeKey);
   if (!safe || safe === "." || safe === "..") {
@@ -43,12 +35,8 @@ export function taskScopeKey(opts: { topicId?: string; session: string }): strin
 }
 
 export function getTaskFilePath(userId: number | string, scopeKey: string): string {
-  return join(
-    resolveStorageDataDir(),
-    "tasks",
-    safeUserIdComponent(userId),
-    `${safeTaskScopeKey(scopeKey)}.json`,
-  );
+  void userId;
+  return join(resolveStorageDataDir(), "tasks", `${safeTaskScopeKey(scopeKey)}.json`);
 }
 
 export function readTasks(userId: number | string, scopeKey: string): StoredTask[] {

package/dist/runtime/src/storage/vault.ts

@@ -60,8 +60,9 @@ function initializeVaultDatabase(database: VaultDatabase): void {
 }
 
 function openVaultDatabase(dataDir: string): VaultDatabase {
-  const path = join(dataDir, "vault.db");
-  mkdirSync(dataDir, { recursive: true });
+  const vaultDir = join(dataDir, "vault");
+  const path = join(vaultDir, "vault.db");
+  mkdirSync(vaultDir, { recursive: true, mode: 0o700 });
   const database = new Database(path, { create: true });
   // Defense in depth: the database and its sidecars are owner-only, while each
   // value is also encrypted independently by vault-crypto.

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.1.49";
+export const NEGOTIUM_VERSION = "0.2.0";

package/dist/runtime-helpers.js

@@ -442,10 +442,14 @@ function parsePortEnv(envValue, fallback) {
 var WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
 var TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
 var SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
-var CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
-var BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
-var DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
-var SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
+var CRON_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "cron");
+var BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
+var BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
+var BINARIES_DIR = resolve(STATE_DIR, "binaries");
+var SECRETS_DIR = resolve(STATE_DIR, "secrets");
+var CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
+var DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
+var SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
 var CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
 var CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
 var BROWSER_RS_VERSION = "v0.1.16";
@@ -483,7 +487,7 @@ function resolveBrowserRsBin(envValue) {
   if (!override && !versionAtLeast(BROWSER_RS_VERSION.replace(/^v/, ""), BROWSER_RS_MIN_SECURE_VERSION)) {
     return;
   }
-  const candidate = override ? resolve(override) : resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  const candidate = override ? resolve(override) : resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
   try {
     accessSync(candidate, constants.X_OK);
     return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
@@ -496,7 +500,7 @@ function resolveBrowserMcpBin(envValue) {
   const override = envValue?.trim();
   if (override)
     return resolve(override);
-  return BROWSER_RS_BIN ?? resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  return BROWSER_RS_BIN ?? resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
 }
 var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
 var TSX_BIN = resolveDependencyBin("tsx");
@@ -517,7 +521,7 @@ var BG_BASH_BASE_PORT = parsePortEnv(process.env.BG_BASH_BASE_PORT, 9700);
 var BG_BASH_MAX_PORT = parsePortEnv(process.env.BG_BASH_MAX_PORT, 9799);
 function loadOrCreateLocalSecret(envKey, filename, options = {}) {
   const envValue = envText(envKey);
-  const secretFile = resolve(STATE_DIR, filename);
+  const secretFile = resolve(SECRETS_DIR, filename);
   mkdirSync2(dirname2(secretFile), { recursive: true });
   if (envValue) {
     if (options.persistEnvValue) {
@@ -557,10 +561,12 @@ var NEGOTIUM_PORT = parseInt(process.env.NEGOTIUM_PORT || "7777", 10);
 var hostname = process.env.HOSTNAME || "127.0.0.1";
 var DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
 var LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+var UPLOADS_DIR = resolve(DATA_DIR, "uploads");
+var VAULT_DIR = resolve(DATA_DIR, "vault");
 var SESSIONS_DB = process.env.SESSIONS_DB_PATH ? resolve(process.env.SESSIONS_DB_PATH) : resolve(DATA_DIR, "sessions.db");
 var DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
 var USERS_LOG_DIR = resolve(DATA_DIR, "users");
-var RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "run");
+var RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "runtime");
 var PROGRESS_DIR = resolve(RUN_DIR, "progress");
 var DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
 var DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
@@ -571,6 +577,8 @@ var PLAYWRIGHT_MAX_PORT = parsePortEnv(process.env.PLAYWRIGHT_MAX_PORT, 9499);
 var PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
 mkdirSync2(STATE_DIR, { recursive: true });
 mkdirSync2(DATA_DIR, { recursive: true });
+mkdirSync2(UPLOADS_DIR, { recursive: true });
+mkdirSync2(VAULT_DIR, { recursive: true, mode: 448 });
 mkdirSync2(LOG_DIR, { recursive: true });
 mkdirSync2(PROGRESS_DIR, { recursive: true });
 mkdirSync2(DM_CMD_DIR, { recursive: true });
@@ -581,10 +589,14 @@ mkdirSync2(PLAYWRIGHT_PORTS_DIR, { recursive: true });
 mkdirSync2(WORKSPACE_DIR, { recursive: true });
 mkdirSync2(TOPIC_WORKSPACE_DIR, { recursive: true });
 mkdirSync2(SHARED_WIKI_DIR, { recursive: true });
+mkdirSync2(CRON_WORKSPACE_DIR, { recursive: true });
 mkdirSync2(CONTEXTS_DIR, { recursive: true });
-mkdirSync2(BROWSER_PROFILES_DIR, { recursive: true });
 mkdirSync2(DM_WORKSPACE_DIR, { recursive: true });
 mkdirSync2(SESSION_WORKSPACE_DIR, { recursive: true });
+mkdirSync2(BROWSER_DIR, { recursive: true });
+mkdirSync2(BROWSER_PROFILES_DIR, { recursive: true });
+mkdirSync2(BINARIES_DIR, { recursive: true });
+mkdirSync2(SECRETS_DIR, { recursive: true, mode: 448 });
 var ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000;
 var AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, "src/prompts/agents");
 var RESOURCES_DIR = resolve(PROJECT_ROOT, "src/resources");
@@ -1102,4 +1114,4 @@ export {
   CLAUDE_EFFORT_VALUES
 };
 
-//# debugId=4EBEE90DEED3C85F64756E2164756E21
+//# debugId=0849C2E75E1422A764756E2164756E21