negotium 0.1.7 → 0.1.8

package/dist/runtime/src/storage/vault.ts

@@ -0,0 +1,225 @@
+import { chmodSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { DATA_DIR } from "#platform/config";
+import { Database } from "#storage/sqlite";
+import { decryptVaultValue, encryptVaultValue } from "#storage/vault-crypto";
+
+const VAULT_DB_PATH = join(DATA_DIR, "vault.db");
+mkdirSync(DATA_DIR, { recursive: true });
+
+const vaultDb = new Database(VAULT_DB_PATH, { create: true });
+// Defense in depth: the database and its sidecars are owner-only, while each
+// value is also encrypted independently by vault-crypto.
+chmodSync(VAULT_DB_PATH, 0o600);
+vaultDb.exec("PRAGMA journal_mode = WAL");
+vaultDb.exec("PRAGMA busy_timeout = 5000");
+vaultDb.exec(`
+  CREATE TABLE IF NOT EXISTS vault (
+    user_id     TEXT    NOT NULL,
+    key         TEXT    NOT NULL,
+    value       TEXT    NOT NULL,
+    description TEXT    NOT NULL DEFAULT '',
+    PRIMARY KEY (user_id, key)
+  )
+`);
+
+// Migrate legacy schema where user_id was INTEGER (Telegram numeric ids only).
+// The Otium API authenticates with string user ids ("otium-user-…"), so user_id
+// is now TEXT for every channel. Rebuild + CAST existing rows so old Telegram
+// secrets survive; idempotent (no-op once user_id is already TEXT).
+{
+  const cols = vaultDb.prepare("PRAGMA table_info(vault)").all() as {
+    name: string;
+    type: string;
+  }[];
+  const uid = cols.find((c) => c.name === "user_id");
+  if (uid && uid.type.toUpperCase() === "INTEGER") {
+    vaultDb.exec("BEGIN");
+    vaultDb.exec(`
+      CREATE TABLE vault_migrated (
+        user_id     TEXT    NOT NULL,
+        key         TEXT    NOT NULL,
+        value       TEXT    NOT NULL,
+        description TEXT    NOT NULL DEFAULT '',
+        PRIMARY KEY (user_id, key)
+      )
+    `);
+    vaultDb.exec(
+      "INSERT INTO vault_migrated SELECT CAST(user_id AS TEXT), key, value, description FROM vault",
+    );
+    vaultDb.exec("DROP TABLE vault");
+    vaultDb.exec("ALTER TABLE vault_migrated RENAME TO vault");
+    vaultDb.exec("COMMIT");
+  }
+}
+
+export interface VaultEntry {
+  key: string;
+  description: string;
+}
+
+export interface VaultEntryWithValue extends VaultEntry {
+  value: string;
+}
+
+export const VAULT_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;
+export const VAULT_VALUE_MIN_BYTES = 4;
+export const VAULT_VALUE_MAX_BYTES = 64 * 1024;
+export const VAULT_DESCRIPTION_MAX_LENGTH = 500;
+
+export function normalizeVaultKey(key: string): string {
+  return key.trim().toUpperCase();
+}
+
+export function validateVaultKey(key: string): boolean {
+  return VAULT_KEY_PATTERN.test(normalizeVaultKey(key));
+}
+
+function decryptRow(userId: string, key: string, storedValue: string): string {
+  const decoded = decryptVaultValue(userId, key, storedValue);
+  if (decoded.legacyPlaintext) {
+    vaultDb
+      .prepare("UPDATE vault SET value = ? WHERE user_id = ? AND key = ? AND value = ?")
+      .run(encryptVaultValue(userId, key, decoded.value), userId, key, storedValue);
+  }
+  return decoded.value;
+}
+
+export function vaultListWithValues(userId: string): VaultEntryWithValue[] {
+  const rows = vaultDb
+    .prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key")
+    .all(userId) as VaultEntryWithValue[];
+  return rows.map((row) => ({
+    key: row.key,
+    description: row.description,
+    value: decryptRow(userId, row.key, row.value),
+  }));
+}
+
+export function vaultSet(userId: string, key: string, value: string, description = ""): void {
+  const normalizedKey = normalizeVaultKey(key);
+  vaultDb
+    .prepare(
+      `INSERT INTO vault (user_id, key, value, description) VALUES (?, ?, ?, ?)
+       ON CONFLICT (user_id, key) DO UPDATE
+         SET value = excluded.value, description = excluded.description`,
+    )
+    .run(userId, normalizedKey, encryptVaultValue(userId, normalizedKey, value), description);
+}
+
+export function vaultHasKey(userId: string, key: string): boolean {
+  const row = vaultDb
+    .prepare("SELECT 1 FROM vault WHERE user_id = ? AND key = ?")
+    .get(userId, normalizeVaultKey(key));
+  return row != null;
+}
+
+export function vaultDel(userId: string, key: string): boolean {
+  const result = vaultDb
+    .prepare("DELETE FROM vault WHERE user_id = ? AND key = ?")
+    .run(userId, normalizeVaultKey(key)) as { changes: number };
+  return result.changes > 0;
+}
+
+export function vaultDeleteAllForUser(userId: string): number {
+  const result = vaultDb.prepare("DELETE FROM vault WHERE user_id = ?").run(userId) as {
+    changes: number;
+  };
+  return result.changes;
+}
+
+export function vaultList(userId: string): VaultEntry[] {
+  return vaultDb
+    .prepare("SELECT key, description FROM vault WHERE user_id = ? ORDER BY key")
+    .all(userId) as VaultEntry[];
+}
+
+export function vaultGetValue(userId: string, key: string): string | undefined {
+  const normalizedKey = normalizeVaultKey(key);
+  const row = vaultDb
+    .prepare("SELECT key, value FROM vault WHERE user_id = ? AND key = ?")
+    .get(userId, normalizedKey) as { key: string; value: string } | undefined;
+  return row ? decryptRow(userId, row.key, row.value) : undefined;
+}
+
+export interface VaultSubstitutionResult {
+  text: string;
+  usedKeys: string[];
+}
+
+/** Replace {{KEY}} placeholders and report which credentials were consumed. */
+export function vaultSubstituteDetailed(userId: string, text: string): VaultSubstitutionResult {
+  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
+  const usedKeys = new Set<string>();
+  const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey: string) => {
+    const key = normalizeVaultKey(rawKey);
+    const value = entries.get(key);
+    if (value === undefined) return match;
+    usedKeys.add(key);
+    return value;
+  });
+  return { text: substituted, usedKeys: [...usedKeys] };
+}
+
+/** Detect real {{KEY}} references without decrypting any Vault values. */
+export function valueReferencesVaultKey(userId: string, value: unknown): boolean {
+  const keys = new Set(vaultList(userId).map((entry) => entry.key));
+  const visit = (candidate: unknown): boolean => {
+    if (typeof candidate === "string") {
+      for (const match of candidate.matchAll(/\{\{([^}]+)\}\}/g)) {
+        if (keys.has(normalizeVaultKey(match[1] ?? ""))) return true;
+      }
+      return false;
+    }
+    if (Array.isArray(candidate)) return candidate.some(visit);
+    if (candidate && typeof candidate === "object") {
+      return Object.values(candidate as Record<string, unknown>).some(visit);
+    }
+    return false;
+  };
+  return visit(value);
+}
+
+function encodedSecretForms(value: string): string[] {
+  const forms = new Set<string>([
+    value,
+    encodeURIComponent(value),
+    Buffer.from(value, "utf8").toString("base64"),
+    Buffer.from(value, "utf8").toString("base64url"),
+    Buffer.from(value, "utf8").toString("hex"),
+  ]);
+  forms.delete("");
+  return [...forms].sort((a, b) => b.length - a.length);
+}
+
+/** Scrub raw and common encoded forms before tool output reaches a model. */
+export function redactVaultSecrets(userId: string, text: string): string {
+  const candidates = vaultListWithValues(userId)
+    .flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key })))
+    .sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
+  if (candidates.length === 0) return text;
+  const candidatesByFirstCharacter = new Map<string, typeof candidates>();
+  for (const candidate of candidates) {
+    const first = candidate.form[0];
+    if (!first) continue;
+    const bucket = candidatesByFirstCharacter.get(first) ?? [];
+    bucket.push(candidate);
+    candidatesByFirstCharacter.set(first, bucket);
+  }
+
+  let redacted = "";
+  let offset = 0;
+  while (offset < text.length) {
+    const match = candidatesByFirstCharacter
+      .get(text[offset] ?? "")
+      ?.find((candidate) => text.startsWith(candidate.form, offset));
+    if (!match) {
+      redacted += text[offset];
+      offset += 1;
+      continue;
+    }
+    redacted += `[REDACTED:${match.key}]`;
+    offset += match.form.length;
+  }
+  return redacted;
+}

package/dist/runtime/src/storage/wiki-summary-names.ts

@@ -0,0 +1,33 @@
+const WIKI_SUMMARY_DATE_PREFIX = /^\d{4}-\d{2}-\d{2}-/;
+
+export function wikiSummarySlug(value: string): string {
+  return value.replaceAll(/[^a-zA-Z0-9가-힣_-]+/g, "-").slice(0, 120) || "_";
+}
+
+export function isEphemeralWikiTopicId(topicId: string | undefined): boolean {
+  return topicId?.startsWith("__") ?? false;
+}
+
+export function wikiSummaryStorageSlug(rawTopic: string, topicId?: string): string {
+  return topicId && !isEphemeralWikiTopicId(topicId)
+    ? wikiSummarySlug(topicId)
+    : wikiSummarySlug(rawTopic);
+}
+
+export function wikiBriefStorageKey(rawTopic: string, topicId?: string): string {
+  return topicId && !isEphemeralWikiTopicId(topicId) ? topicId : rawTopic;
+}
+
+export function wikiSummaryFilename(date: string, rawTopic: string, topicId?: string): string {
+  return `${date}-${wikiSummaryStorageSlug(rawTopic, topicId)}.md`;
+}
+
+export function isTopicSummaryFile(
+  filename: string,
+  topicId: string,
+  legacyTopicTitle?: string,
+): boolean {
+  if (!WIKI_SUMMARY_DATE_PREFIX.test(filename)) return false;
+  if (filename.endsWith(`-${wikiSummarySlug(topicId)}.md`)) return true;
+  return legacyTopicTitle ? filename.endsWith(`-${wikiSummarySlug(legacyTopicTitle)}.md`) : false;
+}

package/dist/runtime/src/storage/wiki.ts

@@ -0,0 +1,85 @@
+import { existsSync, readdirSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { SHARED_WIKI_DIR, WORKSPACE_DIR } from "#platform/config";
+import { sanitizeTopicName } from "#security/sanitize";
+
+export function getWikiDir(_userId: number, workspaceDir = WORKSPACE_DIR): string {
+  return join(workspaceDir, "wiki");
+}
+
+/**
+ * Shared wiki root. Otium keeps one workspace wiki for every topic and member;
+ * filesystem wiki state is not partitioned by user.
+ */
+export function getSharedWikiDir(workspaceDir = WORKSPACE_DIR): string {
+  return workspaceDir === WORKSPACE_DIR ? SHARED_WIKI_DIR : join(workspaceDir, "wiki");
+}
+
+/** Find the most recent wiki/summaries/ file for a given topic. */
+function findLatestSummaryFile(wikiDir: string, safeTopic: string): string | null {
+  const summariesDir = join(wikiDir, "summaries");
+  if (!existsSync(summariesDir)) return null;
+  const files = readdirSync(summariesDir)
+    .filter(
+      (f) =>
+        f.endsWith(".md") &&
+        f.match(new RegExp(`^\\d{4}-\\d{2}-\\d{2}-${safeTopic}(\\.md|-\\d+\\.md)$`)) &&
+        !f.endsWith("-sent-files.md"),
+    )
+    .sort()
+    .reverse();
+  return files.length > 0 ? join(summariesDir, files[0]) : null;
+}
+
+/** Return wiki/topic/<name>.md brief path and latest summary file for system prompt injection.
+ *  Falls back to forkOrigin's brief when the topic's own brief doesn't exist yet.
+ *  Returns empty memoryFiles if neither brief exists. */
+export function getTopicMemoryFilePaths(
+  _userId: number,
+  topicName: string,
+  forkOrigin?: string,
+  workspaceDir = WORKSPACE_DIR,
+): {
+  memoryDir: string;
+  memoryFiles: string[];
+  latestSummaryFile?: string;
+  hasArchive?: boolean;
+} {
+  const wikiDir = getSharedWikiDir(workspaceDir);
+
+  const resolveBrief = (name: string) => {
+    const safe = sanitizeTopicName(name, true);
+    const brief = join(wikiDir, "topic", `${safe}.md`);
+    const latestSummary = findLatestSummaryFile(wikiDir, safe);
+    return { brief, latestSummary };
+  };
+
+  const archiveDir = join(wikiDir, "archive");
+  const archiveExistsFor = (name: string) => {
+    const safe = sanitizeTopicName(name);
+    return (
+      existsSync(archiveDir) &&
+      readdirSync(archiveDir).some((f) => f.endsWith(".jsonl") && f.startsWith(`${safe}_`))
+    );
+  };
+
+  const sourceTopic = forkOrigin ?? topicName;
+  const hasArchive =
+    archiveExistsFor(sourceTopic) || (forkOrigin ? archiveExistsFor(topicName) : false);
+  const target = resolveBrief(sourceTopic);
+  if (existsSync(target.brief)) {
+    return {
+      memoryDir: dirname(target.brief),
+      memoryFiles: [basename(target.brief)],
+      ...(target.latestSummary ? { latestSummaryFile: target.latestSummary } : {}),
+      ...(hasArchive ? { hasArchive: true } : {}),
+    };
+  }
+
+  return {
+    memoryDir: join(wikiDir, "topic"),
+    memoryFiles: [],
+    ...(target.latestSummary ? { latestSummaryFile: target.latestSummary } : {}),
+    ...(hasArchive ? { hasArchive: true } : {}),
+  };
+}

package/dist/runtime/src/topics/create.ts

@@ -0,0 +1,123 @@
+/**
+ * Programmatic topic registration — the host-agnostic core of otium's
+ * `POST /topics` route. Every surface (negotium MCP `register_topic`, CLI,
+ * channel adapters) creates topics through this one function so validation
+ * and defaults never fork.
+ */
+
+import { randomUUID } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import { resolveModelForAgent } from "#agents/model-catalog";
+import { getRegistry } from "#agents/registry";
+import { WsHub } from "#bus";
+import { FALLBACK_AGENT, resolveTopicWorkspaceDir } from "#platform/config";
+import { RESERVED_TOPIC_NAMES } from "#platform/constants";
+import { logger } from "#platform/logger";
+import {
+  findTopicTitleConflict,
+  normalizeTopicKind,
+  normalizeTopicState,
+  upsertTopic,
+} from "#storage/api-topics";
+import { type AgentKind, type EffortLevel, isAgentKind } from "#types";
+import type { TopicAccessMode, TopicDto } from "#types/api";
+
+// Agent rooms default to the node-level FALLBACK_AGENT (env), not a hardcoded
+// backend — a node without DeepSeek auth can still default to claude/codex.
+const DEFAULT_AGENT_ROOM_AGENT: AgentKind = FALLBACK_AGENT;
+
+export class TopicValidationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "TopicValidationError";
+  }
+}
+
+export interface RegisterTopicOptions {
+  title: string;
+  userId: string;
+  /** "agent" (AI room, default) or "channel" (human room, AI optional). */
+  kind?: TopicDto["kind"];
+  /** AI backend for the room. Defaults to maestro for agent rooms. */
+  agent?: AgentKind | "none";
+  model?: string;
+  effort?: EffortLevel;
+  description?: string;
+  /** Local topics default to private; Otium publication must be explicit. */
+  accessMode?: TopicAccessMode;
+}
+
+/**
+ * Create a topic owned by `userId`. Throws {@link TopicValidationError} on
+ * invalid input (reserved/conflicting title, bad agent/model combination).
+ */
+export function registerTopic(opts: RegisterTopicOptions): TopicDto {
+  const title = opts.title?.trim();
+  if (!title) throw new TopicValidationError("title is required");
+  if (RESERVED_TOPIC_NAMES.has(title.toLowerCase())) {
+    throw new TopicValidationError(`"${title}" is a reserved name`);
+  }
+
+  const requestedKind = normalizeTopicKind(opts.kind) ?? "agent";
+  if (requestedKind === "manager") {
+    throw new TopicValidationError("Manager rooms are system-managed");
+  }
+  const conflict = findTopicTitleConflict(title, requestedKind);
+  if (conflict) {
+    throw new TopicValidationError(`A topic named "${title}" already exists`);
+  }
+
+  const rawAgent = opts.agent;
+  if (requestedKind === "agent" && rawAgent === "none") {
+    throw new TopicValidationError("Agent rooms must have an AI agent");
+  }
+  if (rawAgent && rawAgent !== "none" && !isAgentKind(rawAgent)) {
+    throw new TopicValidationError(`Unknown agent '${rawAgent}'`);
+  }
+  const requestedAgent: AgentKind | undefined =
+    rawAgent === "none" || (requestedKind === "channel" && rawAgent === undefined)
+      ? undefined
+      : ((rawAgent as AgentKind | undefined) ?? DEFAULT_AGENT_ROOM_AGENT);
+
+  const { kind, aiMode, agent } = normalizeTopicState({
+    kind: requestedKind,
+    agent: requestedAgent,
+  });
+
+  // Derive per-mode model/effort defaults from the chosen agent's registry.
+  const registry = getRegistry(agent ?? "maestro");
+  if (agent && opts.model && !registry.validateModel(opts.model)) {
+    throw new TopicValidationError(`model '${opts.model}' is not valid for agent '${agent}'`);
+  }
+  if (agent && opts.effort && !registry.validateEffort(opts.effort)) {
+    throw new TopicValidationError(`effort '${opts.effort}' is not valid for agent '${agent}'`);
+  }
+  const defaultModel = resolveModelForAgent(agent ?? "maestro", opts.model, registry);
+  const defaultEffort = opts.effort ?? registry.defaultEffort;
+
+  const now = new Date().toISOString();
+  const topic: TopicDto = {
+    id: randomUUID(),
+    title,
+    kind,
+    description: opts.description,
+    agent,
+    defaultModel,
+    defaultEffort: defaultEffort ?? "medium",
+    aiMode,
+    participants: [{ userId: opts.userId, role: "owner" }],
+    accessMode: opts.accessMode ?? "private",
+    createdAt: now,
+    lastMessageAt: now,
+  };
+
+  upsertTopic(topic);
+  try {
+    mkdirSync(resolveTopicWorkspaceDir(topic.id), { recursive: true });
+  } catch (err) {
+    logger.warn({ err, topicId: topic.id }, "registerTopic: workspace dir create failed");
+  }
+  WsHub.get().broadcastTopicCreated(topic);
+  logger.info({ topicId: topic.id, title, kind, agent }, "topic registered");
+  return topic;
+}