negotium 0.1.49 → 0.2.1

package/dist/hosted-agent.js

@@ -115,10 +115,14 @@ function parsePortEnv(envValue, fallback) {
 var WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
 var TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
 var SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
-var CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
-var BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
-var DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
-var SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
+var CRON_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "cron");
+var BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
+var BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
+var BINARIES_DIR = resolve(STATE_DIR, "binaries");
+var SECRETS_DIR = resolve(STATE_DIR, "secrets");
+var CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
+var DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
+var SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
 var CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
 var CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
 var BROWSER_RS_VERSION = "v0.1.16";
@@ -156,7 +160,7 @@ function resolveBrowserRsBin(envValue) {
   if (!override && !versionAtLeast(BROWSER_RS_VERSION.replace(/^v/, ""), BROWSER_RS_MIN_SECURE_VERSION)) {
     return;
   }
-  const candidate = override ? resolve(override) : resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  const candidate = override ? resolve(override) : resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
   try {
     accessSync(candidate, constants.X_OK);
     return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
@@ -169,7 +173,7 @@ function resolveBrowserMcpBin(envValue) {
   const override = envValue?.trim();
   if (override)
     return resolve(override);
-  return BROWSER_RS_BIN ?? resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  return BROWSER_RS_BIN ?? resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
 }
 var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
 var TSX_BIN = resolveDependencyBin("tsx");
@@ -196,7 +200,7 @@ function resolveTopicWorkspaceDir(topicId) {
 }
 function loadOrCreateLocalSecret(envKey, filename, options = {}) {
   const envValue = envText(envKey);
-  const secretFile = resolve(STATE_DIR, filename);
+  const secretFile = resolve(SECRETS_DIR, filename);
   mkdirSync(dirname(secretFile), { recursive: true });
   if (envValue) {
     if (options.persistEnvValue) {
@@ -236,10 +240,12 @@ var NEGOTIUM_PORT = parseInt(process.env.NEGOTIUM_PORT || "7777", 10);
 var hostname = process.env.HOSTNAME || "127.0.0.1";
 var DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
 var LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+var UPLOADS_DIR = resolve(DATA_DIR, "uploads");
+var VAULT_DIR = resolve(DATA_DIR, "vault");
 var SESSIONS_DB = process.env.SESSIONS_DB_PATH ? resolve(process.env.SESSIONS_DB_PATH) : resolve(DATA_DIR, "sessions.db");
 var DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
 var USERS_LOG_DIR = resolve(DATA_DIR, "users");
-var RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "run");
+var RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "runtime");
 var PROGRESS_DIR = resolve(RUN_DIR, "progress");
 var DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
 var DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
@@ -250,6 +256,8 @@ var PLAYWRIGHT_MAX_PORT = parsePortEnv(process.env.PLAYWRIGHT_MAX_PORT, 9499);
 var PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
 mkdirSync(STATE_DIR, { recursive: true });
 mkdirSync(DATA_DIR, { recursive: true });
+mkdirSync(UPLOADS_DIR, { recursive: true });
+mkdirSync(VAULT_DIR, { recursive: true, mode: 448 });
 mkdirSync(LOG_DIR, { recursive: true });
 mkdirSync(PROGRESS_DIR, { recursive: true });
 mkdirSync(DM_CMD_DIR, { recursive: true });
@@ -260,10 +268,14 @@ mkdirSync(PLAYWRIGHT_PORTS_DIR, { recursive: true });
 mkdirSync(WORKSPACE_DIR, { recursive: true });
 mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
 mkdirSync(SHARED_WIKI_DIR, { recursive: true });
+mkdirSync(CRON_WORKSPACE_DIR, { recursive: true });
 mkdirSync(CONTEXTS_DIR, { recursive: true });
-mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
 mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
 mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
+mkdirSync(BROWSER_DIR, { recursive: true });
+mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
+mkdirSync(BINARIES_DIR, { recursive: true });
+mkdirSync(SECRETS_DIR, { recursive: true, mode: 448 });
 var ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000;
 var AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, "src/prompts/agents");
 var RESOURCES_DIR = resolve(PROJECT_ROOT, "src/resources");
@@ -295,7 +307,12 @@ function codexAuthFilePath() {
 
 // ../../packages/core/src/agents/rollout/shared.ts
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
-var trustedWorkspaceRoots = [WORKSPACE_DIR, DM_WORKSPACE_DIR, TOPIC_WORKSPACE_DIR].map((root) => resolve2(root));
+var trustedWorkspaceRoots = [
+  WORKSPACE_DIR,
+  DM_WORKSPACE_DIR,
+  SESSION_WORKSPACE_DIR,
+  TOPIC_WORKSPACE_DIR
+].map((root) => resolve2(root));
 var FIXTURES_DIR = join2(__dirname2, "..", "fixtures");
 
 // ../../packages/core/src/platform/jsonl.ts
@@ -1232,7 +1249,7 @@ function getMcpServersForQuery(opts) {
     if (!opts.topicId)
       throw new Error("getMcpServersForQuery: cron sessionType requires topicId");
     return getCronMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session || "cron",
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -1249,7 +1266,7 @@ function getMcpServersForQuery(opts) {
   }
   if (opts.sessionType === "dm" || opts.sessionType === "ephemeral") {
     return getDmMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       agent: opts.agent,
       playwrightPort: opts.playwrightPort,
       playwrightCapability: opts.playwrightCapability
@@ -1257,7 +1274,7 @@ function getMcpServersForQuery(opts) {
   }
   if (opts.sessionType === "manager") {
     return getManagerMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session,
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -1274,7 +1291,7 @@ function getMcpServersForQuery(opts) {
     });
   }
   return getForumMcpServers({
-    userId: opts.userId || "default",
+    userId: opts.userId || "local",
     session: opts.session || "default",
     topicId: opts.topicId,
     subagentParentTopicId: opts.subagentParentTopicId,
@@ -1353,12 +1370,12 @@ if (isBun) {
   Database = NodeDatabase;
 }
 
-// ../../packages/core/src/storage/vault-crypto.ts
+// ../../packages/core/src/storage/vault-crypto-core.ts
 import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes3 } from "crypto";
 var ENVELOPE_PREFIX = "otium-vault:v1:";
 var IV_BYTES = 12;
 var KEY_BYTES = 32;
-function encryptionKey(masterKey = VAULT_MASTER_KEY) {
+function encryptionKey(masterKey) {
   return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
 }
 function aad(userId, key) {
@@ -1367,7 +1384,7 @@ function aad(userId, key) {
 function isEncryptedVaultValue(value) {
   return value.startsWith(ENVELOPE_PREFIX);
 }
-function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+function encryptVaultValueWithKey(userId, key, value, masterKey) {
   const iv = randomBytes3(IV_BYTES);
   const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
   cipher.setAAD(aad(userId, key));
@@ -1375,7 +1392,7 @@ function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
   const tag = cipher.getAuthTag();
   return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
 }
-function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+function decryptVaultValueWithKey(userId, key, storedValue, masterKey) {
   if (!isEncryptedVaultValue(storedValue)) {
     return { value: storedValue, legacyPlaintext: true };
   }
@@ -1397,6 +1414,14 @@ function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KE
   return { value: plaintext.toString("utf8"), legacyPlaintext: false };
 }
 
+// ../../packages/core/src/storage/vault-crypto.ts
+function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+  return encryptVaultValueWithKey(userId, key, value, masterKey);
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
+}
+
 // ../../packages/core/src/storage/vault.ts
 var vaultDb;
 var vaultMasterKey = VAULT_MASTER_KEY;
@@ -1434,8 +1459,9 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const path = join3(dataDir, "vault.db");
-  mkdirSync3(dataDir, { recursive: true });
+  const vaultDir = join3(dataDir, "vault");
+  const path = join3(vaultDir, "vault.db");
+  mkdirSync3(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
   initializeVaultDatabase(database);
@@ -2116,7 +2142,7 @@ import { tmpdir } from "os";
 import { dirname as dirname4, join as join4 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.49";
+var NEGOTIUM_VERSION = "0.2.1";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 var moduleRequire = createRequire2(import.meta.url);
@@ -3744,4 +3770,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=91493C665ED6215F64756E2164756E21
+//# debugId=D004E4F61C8499C064756E2164756E21