negotium 0.1.49 → 0.2.1

package/dist/mcp-factories.js

@@ -155,7 +155,7 @@ function resolveBrowserRsBin(envValue) {
   if (!override && !versionAtLeast(BROWSER_RS_VERSION.replace(/^v/, ""), BROWSER_RS_MIN_SECURE_VERSION)) {
     return;
   }
-  const candidate = override ? resolve(override) : resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  const candidate = override ? resolve(override) : resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
   try {
     accessSync(candidate, constants.X_OK);
     return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
@@ -167,7 +167,7 @@ function resolveBrowserMcpBin(envValue) {
   const override = envValue?.trim();
   if (override)
     return resolve(override);
-  return BROWSER_RS_BIN ?? resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  return BROWSER_RS_BIN ?? resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
 }
 function resolveBrowserProxy() {
   const raw = envText("BROWSER_PROXY_URL");
@@ -199,7 +199,7 @@ function resolveTopicWorkspaceDir(topicId) {
 }
 function loadOrCreateLocalSecret(envKey, filename, options = {}) {
   const envValue = envText(envKey);
-  const secretFile = resolve(STATE_DIR, filename);
+  const secretFile = resolve(SECRETS_DIR, filename);
   mkdirSync(dirname(secretFile), { recursive: true });
   if (envValue) {
     if (options.persistEnvValue) {
@@ -240,7 +240,7 @@ function resolveDefaultModel(agent, registryDefaultModel) {
 function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), ".codex", "auth.json");
 }
-var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CONTEXTS_DIR, BROWSER_PROFILES_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.16", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, BACKGROUND_BASH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
+var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, CONTEXTS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.16", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, BACKGROUND_BASH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
 var init_config = __esm(() => {
   init_config_helpers();
   init_logger();
@@ -252,10 +252,14 @@ var init_config = __esm(() => {
   WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
   TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
   SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
-  CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
-  BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
-  DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
-  SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
+  CRON_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "cron");
+  BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
+  BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
+  BINARIES_DIR = resolve(STATE_DIR, "binaries");
+  SECRETS_DIR = resolve(STATE_DIR, "secrets");
+  CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
+  DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
+  SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
   CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
   CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
   BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));
@@ -284,10 +288,12 @@ var init_config = __esm(() => {
   hostname = process.env.HOSTNAME || "127.0.0.1";
   DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
   LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+  UPLOADS_DIR = resolve(DATA_DIR, "uploads");
+  VAULT_DIR = resolve(DATA_DIR, "vault");
   SESSIONS_DB = process.env.SESSIONS_DB_PATH ? resolve(process.env.SESSIONS_DB_PATH) : resolve(DATA_DIR, "sessions.db");
   DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
   USERS_LOG_DIR = resolve(DATA_DIR, "users");
-  RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "run");
+  RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "runtime");
   PROGRESS_DIR = resolve(RUN_DIR, "progress");
   DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
   DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
@@ -298,6 +304,8 @@ var init_config = __esm(() => {
   PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
   mkdirSync(STATE_DIR, { recursive: true });
   mkdirSync(DATA_DIR, { recursive: true });
+  mkdirSync(UPLOADS_DIR, { recursive: true });
+  mkdirSync(VAULT_DIR, { recursive: true, mode: 448 });
   mkdirSync(LOG_DIR, { recursive: true });
   mkdirSync(PROGRESS_DIR, { recursive: true });
   mkdirSync(DM_CMD_DIR, { recursive: true });
@@ -308,10 +316,14 @@ var init_config = __esm(() => {
   mkdirSync(WORKSPACE_DIR, { recursive: true });
   mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
   mkdirSync(SHARED_WIKI_DIR, { recursive: true });
+  mkdirSync(CRON_WORKSPACE_DIR, { recursive: true });
   mkdirSync(CONTEXTS_DIR, { recursive: true });
-  mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
   mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
   mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
+  mkdirSync(BROWSER_DIR, { recursive: true });
+  mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
+  mkdirSync(BINARIES_DIR, { recursive: true });
+  mkdirSync(SECRETS_DIR, { recursive: true, mode: 448 });
   ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000;
   AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, "src/prompts/agents");
   RESOURCES_DIR = resolve(PROJECT_ROOT, "src/resources");
@@ -530,7 +542,12 @@ var init_shared = __esm(() => {
   init_config();
   init_logger();
   __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-  trustedWorkspaceRoots = [WORKSPACE_DIR, DM_WORKSPACE_DIR, TOPIC_WORKSPACE_DIR].map((root) => resolve3(root));
+  trustedWorkspaceRoots = [
+    WORKSPACE_DIR,
+    DM_WORKSPACE_DIR,
+    SESSION_WORKSPACE_DIR,
+    TOPIC_WORKSPACE_DIR
+  ].map((root) => resolve3(root));
   FIXTURES_DIR = join3(__dirname2, "..", "fixtures");
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 });
@@ -1493,7 +1510,7 @@ function defaultWorkspaceDir() {
   return envPath("NEGOTIUM_WORKSPACE_DIR", join7(defaultStateDir(), "workspace"));
 }
 function defaultSessionAsksDir() {
-  const runDir = envPath("NEGOTIUM_RUN_DIR", join7(defaultStateDir(), "run"));
+  const runDir = envPath("NEGOTIUM_RUN_DIR", join7(defaultStateDir(), "runtime"));
   return join7(runDir, "session-asks");
 }
 function defaultSessionsDatabasePath() {
@@ -1599,15 +1616,8 @@ import {
   writeFileSync as writeFileSync5
 } from "fs";
 import { dirname as dirname7, join as join8 } from "path";
-function safeUserIdComponent(userId) {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`conversations: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
-function conversationDir(userId) {
-  return join8(resolveStorageDataDir(), "conversations", safeUserIdComponent(userId));
+function conversationDir(_userId) {
+  return join8(resolveStorageDataDir(), "conversations");
 }
 function topicFilename(topicName) {
   const t = sanitizeTopicName(topicName, true);
@@ -1845,7 +1855,7 @@ function writeRollout(options) {
         version: 1,
         cwd: options.cwd,
         createdAt: existingCreatedAt(path) ?? new Date().toISOString(),
-        sdkVersion: "0.1.53"
+        sdkVersion: "0.1.54"
       }
     },
     ...messages
@@ -4199,9 +4209,9 @@ var init_transport_probe = __esm(() => {
   init_capability();
 });
 
-// ../../packages/core/src/storage/vault-crypto.ts
+// ../../packages/core/src/storage/vault-crypto-core.ts
 import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes3 } from "crypto";
-function encryptionKey(masterKey = VAULT_MASTER_KEY) {
+function encryptionKey(masterKey) {
   return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
 }
 function aad(userId, key) {
@@ -4210,7 +4220,7 @@ function aad(userId, key) {
 function isEncryptedVaultValue(value2) {
   return value2.startsWith(ENVELOPE_PREFIX);
 }
-function encryptVaultValue(userId, key, value2, masterKey = VAULT_MASTER_KEY) {
+function encryptVaultValueWithKey(userId, key, value2, masterKey) {
   const iv = randomBytes3(IV_BYTES);
   const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
   cipher.setAAD(aad(userId, key));
@@ -4218,7 +4228,7 @@ function encryptVaultValue(userId, key, value2, masterKey = VAULT_MASTER_KEY) {
   const tag = cipher.getAuthTag();
   return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
 }
-function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+function decryptVaultValueWithKey(userId, key, storedValue, masterKey) {
   if (!isEncryptedVaultValue(storedValue)) {
     return { value: storedValue, legacyPlaintext: true };
   }
@@ -4240,8 +4250,18 @@ function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KE
   return { value: plaintext.toString("utf8"), legacyPlaintext: false };
 }
 var ENVELOPE_PREFIX = "otium-vault:v1:", IV_BYTES = 12, KEY_BYTES = 32;
+var init_vault_crypto_core = () => {};
+
+// ../../packages/core/src/storage/vault-crypto.ts
+function encryptVaultValue(userId, key, value2, masterKey = VAULT_MASTER_KEY) {
+  return encryptVaultValueWithKey(userId, key, value2, masterKey);
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
+}
 var init_vault_crypto = __esm(() => {
   init_config();
+  init_vault_crypto_core();
 });
 
 // ../../packages/core/src/storage/vault.ts
@@ -4281,8 +4301,9 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const path = join12(dataDir, "vault.db");
-  mkdirSync9(dataDir, { recursive: true });
+  const vaultDir = join12(dataDir, "vault");
+  const path = join12(vaultDir, "vault.db");
+  mkdirSync9(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
   initializeVaultDatabase(database);
@@ -4635,7 +4656,7 @@ function createBrowserProfile(ownerId, rawName) {
   const name = normalizeBrowserProfileName(rawName);
   if (name === DEFAULT_BROWSER_PROFILE)
     return name;
-  db.query("INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)").run(ownerId, name, new Date().toISOString());
+  db.query("INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)").run("local", name, new Date().toISOString());
   return name;
 }
 function assignTopicBrowserProfile(opts) {
@@ -4675,7 +4696,6 @@ import {
   existsSync as existsSync11,
   mkdirSync as mkdirSync10,
   readFileSync as readFileSync9,
-  renameSync as renameSync5,
   rmSync,
   unlinkSync as unlinkSync10,
   writeFileSync as writeFileSync7
@@ -4691,7 +4711,7 @@ function defaultTopicBinding(userId, topic) {
   if (!topic)
     return managerHost.resolveNamedBinding(userId, "default");
   const ownerId = getBrowserProfileOwner(topic, userId);
-  const profile = migrateLegacyTopicProfile(ownerId, topic);
+  const profile = getTopicBrowserProfile(topic);
   return managerHost.resolveNamedBinding(ownerId, profile);
 }
 function resolvePlaywrightProfileBinding(ownerId, rawProfile) {
@@ -4703,34 +4723,15 @@ function validateProfileBinding(binding) {
   }
   return Object.freeze({ ...binding });
 }
-function defaultNamedBinding(ownerId, rawProfile) {
+function defaultNamedBinding(_ownerId, rawProfile) {
   const profile = normalizeBrowserProfileName(rawProfile);
-  const instanceKey = `profile:${encodeURIComponent(ownerId)}:${profile}`;
+  const instanceKey = `profile:${profile}`;
   return {
     instanceKey,
-    ownerId,
+    ownerId: "local",
     profile
   };
 }
-function legacyBrowserProfileName(topic) {
-  return `legacy_${createHash2("sha256").update(topic).digest("hex").slice(0, 12)}`;
-}
-function migrateLegacyTopicProfile(ownerId, topic) {
-  const current2 = getTopicBrowserProfile(topic);
-  if (current2 !== "default" || !hasBrowserProfileTopic(topic))
-    return current2;
-  const legacyDir = resolve9(BROWSER_PROFILES_DIR, sanitizeTopicName(topic));
-  if (!existsSync11(legacyDir))
-    return current2;
-  const profile = legacyBrowserProfileName(topic);
-  const profileDir = defaultProfileDir(ownerId, profile);
-  mkdirSync10(dirname8(profileDir), { recursive: true });
-  if (!existsSync11(profileDir))
-    renameSync5(legacyDir, profileDir);
-  assignTopicBrowserProfile({ topicId: topic, actorUserId: ownerId, profile });
-  logger.info({ ownerId, topic, profile }, "Adopted legacy topic browser profile");
-  return profile;
-}
 function defaultChildEnvironment(context) {
   const childEnvironment = {};
   for (const key of [
@@ -4761,6 +4762,10 @@ function defaultChildEnvironment(context) {
   return childEnvironment;
 }
 function parseInstanceKey(instanceKey) {
+  const shared = /^profile:(.+)$/.exec(instanceKey);
+  if (shared && !shared[1].includes(":")) {
+    return { ownerId: "local", profile: normalizeBrowserProfileName(shared[1]) };
+  }
   const match = /^profile:([^:]+):(.+)$/.exec(instanceKey);
   if (!match)
     return { ownerId: "legacy", profile: sanitizeTopicName(instanceKey) };
@@ -4903,12 +4908,8 @@ async function allocatePort() {
 function releasePort(port) {
   usedPorts.delete(port);
 }
-function ownerDirectory(ownerId) {
-  const digest = createHash2("sha256").update(ownerId).digest("hex").slice(0, 16);
-  return `${sanitizeTopicName(ownerId).slice(0, 24)}_${digest}`;
-}
-function defaultProfileDir(ownerId, profile) {
-  return resolve9(BROWSER_PROFILES_DIR, "profiles", ownerDirectory(ownerId), profile);
+function defaultProfileDir(_ownerId, profile) {
+  return resolve9(BROWSER_PROFILES_DIR, profile);
 }
 function resolveUserDataDir(instanceKey) {
   return managerHost.resolveInstanceDataDir(instanceKey);
@@ -5952,15 +5953,8 @@ RULES:
 - Keep the entire summary under 1500 words.`, CHARS_PER_TEXT_TOKEN = 3.5, CHARS_PER_CJK_TOKEN = 0.9;
 
 // ../../packages/core/src/storage/tasks.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync10, renameSync as renameSync6, statSync as statSync4, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync10, renameSync as renameSync5, statSync as statSync4, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname9, join as join15 } from "path";
-function safeUserIdComponent2(userId) {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`tasks: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
 function safeTaskScopeKey(scopeKey) {
   const safe = sanitizeFileName(scopeKey);
   if (!safe || safe === "." || safe === "..") {
@@ -5972,7 +5966,7 @@ function taskScopeKey(opts) {
   return opts.topicId?.trim() || opts.session || "default";
 }
 function getTaskFilePath(userId, scopeKey) {
-  return join15(resolveStorageDataDir(), "tasks", safeUserIdComponent2(userId), `${safeTaskScopeKey(scopeKey)}.json`);
+  return join15(resolveStorageDataDir(), "tasks", `${safeTaskScopeKey(scopeKey)}.json`);
 }
 function readTasks(userId, scopeKey) {
   const path = getTaskFilePath(userId, scopeKey);
@@ -5992,7 +5986,7 @@ function writeTasks(userId, scopeKey, tasks) {
   const payload = { version: 1, tasks };
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync8(tmp, JSON.stringify(payload, null, 2), "utf-8");
-  renameSync6(tmp, path);
+  renameSync5(tmp, path);
 }
 function taskFileMtimeNs(userId, scopeKey) {
   try {
@@ -6816,7 +6810,7 @@ function getMcpServersForQuery(opts) {
     if (!opts.topicId)
       throw new Error("getMcpServersForQuery: cron sessionType requires topicId");
     return getCronMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session || "cron",
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -6833,7 +6827,7 @@ function getMcpServersForQuery(opts) {
   }
   if (opts.sessionType === "dm" || opts.sessionType === "ephemeral") {
     return getDmMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       agent: opts.agent,
       playwrightPort: opts.playwrightPort,
       playwrightCapability: opts.playwrightCapability
@@ -6841,7 +6835,7 @@ function getMcpServersForQuery(opts) {
   }
   if (opts.sessionType === "manager") {
     return getManagerMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session,
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -6858,7 +6852,7 @@ function getMcpServersForQuery(opts) {
     });
   }
   return getForumMcpServers({
-    userId: opts.userId || "default",
+    userId: opts.userId || "local",
     session: opts.session || "default",
     topicId: opts.topicId,
     subagentParentTopicId: opts.subagentParentTopicId,
@@ -7693,7 +7687,7 @@ var init_claude_provider = __esm(async () => {
 });
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.49";
+var NEGOTIUM_VERSION = "0.2.1";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn6 } from "child_process";
@@ -7704,7 +7698,7 @@ import {
   existsSync as existsSync14,
   mkdtempSync,
   readFileSync as readFileSync12,
-  renameSync as renameSync7,
+  renameSync as renameSync6,
   rmSync as rmSync2,
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync9
@@ -7752,7 +7746,7 @@ function writePrivateFileAtomic(path, contents) {
   const tempPath = `${path}.${process.pid}.${randomUUID8()}.tmp`;
   try {
     writeFileSync9(tempPath, contents, { encoding: "utf8", mode: 384 });
-    renameSync7(tempPath, path);
+    renameSync6(tempPath, path);
     chmodSync4(path, 384);
   } finally {
     try {
@@ -10916,7 +10910,7 @@ var init_idle_archiver = __esm(async () => {
 });
 
 // ../../packages/core/src/agents/topic-cleanup.ts
-import { mkdirSync as mkdirSync13, renameSync as renameSync8, unlinkSync as unlinkSync12, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync13, renameSync as renameSync7, unlinkSync as unlinkSync12, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname13 } from "path";
 function collectSessionIdsByAgent(entries, extraSessions = []) {
   const out = new Map;
@@ -10987,7 +10981,7 @@ function createTopicLogMaintenance(host) {
         writeFileSync11(tempPath, retained.length > 0 ? `${retained.map((entry) => JSON.stringify(entry)).join(`
 `)}
 ` : "", { flag: "wx" });
-        renameSync8(tempPath, path);
+        renameSync7(tempPath, path);
       } catch (e) {
         try {
           unlinkSync12(tempPath);
@@ -11950,7 +11944,7 @@ var init_session_inbox_cleanup = __esm(() => {
 });
 
 // ../../packages/core/src/query/state.ts
-import { mkdirSync as mkdirSync15, renameSync as renameSync9, unlinkSync as unlinkSync15, writeFileSync as writeFileSync13 } from "fs";
+import { mkdirSync as mkdirSync15, renameSync as renameSync8, unlinkSync as unlinkSync15, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename5, join as join25 } from "path";
 function createQueryStateStore(options) {
   const sanitize = options.sanitizeTopicId ?? sanitizeId;
@@ -11972,7 +11966,7 @@ function createQueryStateStore(options) {
       const target = queryStateFile(userId, topicId);
       const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
       writeFileSync13(tmp, JSON.stringify(state));
-      renameSync9(tmp, target);
+      renameSync8(tmp, target);
     },
     clear(userId, topicId, legacyTopicName) {
       const paths = [
@@ -13154,7 +13148,7 @@ function promptWithAttachments(prompt, attachments) {
   return composeAttachmentPrompt(prompt, attachments.map(({ filename, path }) => attachmentPromptLine(filename, path)));
 }
 function ingestAttachment(args) {
-  const destDir = join27(workspaceCwdFor(args.topicId), "uploads");
+  const destDir = join27(UPLOADS_DIR, args.topicId);
   mkdirSync17(destDir, { recursive: true });
   const safeName = safeAttachmentFilename(args.filename, "upload");
   const destPath = join27(destDir, `${Date.now()}-${randomUUID13().slice(0, 8)}-${safeName}`);
@@ -19338,4 +19332,4 @@ export {
   createAgentHealthMcpServer
 };
 
-//# debugId=BC568829D61D883264756E2164756E21
+//# debugId=F5E2DADE8B532CB164756E2164756E21