negotium 0.1.8 → 0.1.9

package/dist/runtime/src/types.ts

@@ -180,6 +180,8 @@ export interface AgentQueryOptions {
   wikiTopicId?: string;
   /** Whether self-config MCP may enqueue an automatic continue turn after set_* changes. */
   autoContinue?: boolean;
+  /** Expose Otium-only visual panel tools for this turn. Default-deny. */
+  visualTools?: boolean;
   abortController?: AbortController;
   model?: string;
   /** Provider-side hard budget when the selected SDK supports one. */

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.1.8";
+export const NEGOTIUM_VERSION = "0.1.9";

package/package.json

@@ -1,12 +1,24 @@
 {
   "name": "negotium",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",
   "bin": {
     "negotium": "dist/main.js"
   },
+  "exports": {
+    "./hosted-agent": {
+      "types": "./dist/runtime/src/agents/hosted-agent.ts",
+      "import": "./dist/hosted-agent.js",
+      "default": "./dist/hosted-agent.js"
+    },
+    "./canonical-mcp-bridge": {
+      "types": "./dist/runtime/src/mcp/canonical-bridge-config.ts",
+      "import": "./dist/canonical-mcp-bridge.js",
+      "default": "./dist/canonical-mcp-bridge.js"
+    }
+  },
   "files": [
     "dist",
     "README.md",

package/dist/chunk-6cpn7ht2.js

@@ -1,287 +0,0 @@
-// @bun
-import {
-  DATA_DIR,
-  logger
-} from "./chunk-k9z47mab.js";
-import"./chunk-hwy3n31w.js";
-
-// ../../packages/core/src/storage/conversations.ts
-import {
-  existsSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname2, join } from "path";
-
-// ../../packages/core/src/platform/jsonl.ts
-import {
-  appendFileSync,
-  closeSync,
-  fsyncSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync as unlinkSync2,
-  writeFileSync
-} from "fs";
-import { dirname } from "path";
-
-// ../../packages/core/src/platform/file-utils.ts
-import { unlinkSync } from "fs";
-function safeUnlink(path, warnLabel) {
-  try {
-    unlinkSync(path);
-  } catch (e) {
-    if (e?.code === "ENOENT")
-      return;
-    if (warnLabel)
-      logger.warn({ err: e, path }, warnLabel);
-  }
-}
-
-// ../../packages/core/src/platform/jsonl.ts
-function readJsonlLines(filePath) {
-  return readFileSync(filePath, "utf-8").trim().split(`
-`).filter(Boolean);
-}
-function parseJsonlText(raw) {
-  return raw.trim().split(`
-`).filter(Boolean).map((line) => JSON.parse(line));
-}
-var LOCK_SUFFIX = ".lock";
-var LOCK_RETRY_MS = 5;
-var LOCK_TIMEOUT_MS = 1500;
-var LOCK_STALE_MS = 5000;
-var LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
-function sleepForAppendLock(ms) {
-  Atomics.wait(LOCK_SLEEP, 0, 0, ms);
-}
-function tryAcquireAppendLock(lockPath) {
-  try {
-    closeSync(openSync(lockPath, "wx"));
-    return true;
-  } catch (e) {
-    if (e.code !== "EEXIST")
-      throw e;
-    return false;
-  }
-}
-function isStaleLock(lockPath) {
-  try {
-    return Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS;
-  } catch {
-    return false;
-  }
-}
-function appendJsonlEntry(filePath, entry) {
-  appendJsonlLine(filePath, `${JSON.stringify(entry)}
-`);
-}
-function appendJsonlLine(filePath, line) {
-  mkdirSync(dirname(filePath), { recursive: true });
-  const lockPath = `${filePath}${LOCK_SUFFIX}`;
-  const payload = line.endsWith(`
-`) ? line : `${line}
-`;
-  let acquired = tryAcquireAppendLock(lockPath);
-  if (!acquired && isStaleLock(lockPath)) {
-    safeUnlink(lockPath);
-    acquired = tryAcquireAppendLock(lockPath);
-  }
-  if (!acquired) {
-    const start = Date.now();
-    while (!acquired && Date.now() - start < LOCK_TIMEOUT_MS) {
-      sleepForAppendLock(LOCK_RETRY_MS);
-      acquired = tryAcquireAppendLock(lockPath);
-      if (!acquired && isStaleLock(lockPath)) {
-        safeUnlink(lockPath);
-        acquired = tryAcquireAppendLock(lockPath);
-      }
-    }
-  }
-  if (!acquired) {
-    appendFileSync(filePath, payload);
-    return;
-  }
-  try {
-    appendFileSync(filePath, payload);
-  } finally {
-    safeUnlink(lockPath);
-  }
-}
-function writeJsonlFile(filePath, entries) {
-  const dir = dirname(filePath);
-  mkdirSync(dir, { recursive: true });
-  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  const payload = `${entries.map((e) => JSON.stringify(e)).join(`
-`)}
-`;
-  let fd = null;
-  try {
-    fd = openSync(tmpPath, "w");
-    writeFileSync(fd, payload);
-    fsyncSync(fd);
-    closeSync(fd);
-    fd = null;
-    renameSync(tmpPath, filePath);
-    fsyncDirectoryBestEffort(dir);
-  } catch (err) {
-    if (fd !== null) {
-      try {
-        closeSync(fd);
-      } catch {}
-    }
-    try {
-      unlinkSync2(tmpPath);
-    } catch {}
-    throw err;
-  }
-}
-function fsyncDirectoryBestEffort(dir) {
-  let fd = null;
-  try {
-    fd = openSync(dir, "r");
-    fsyncSync(fd);
-  } catch {} finally {
-    if (fd !== null) {
-      try {
-        closeSync(fd);
-      } catch {}
-    }
-  }
-}
-
-// ../../packages/core/src/security/sanitize.ts
-function sanitizeTopicName(name, lowercase = false) {
-  const safe = name.replace(/[^a-zA-Z0-9\uAC00-\uD7A3_-]/g, "_") || "_";
-  return lowercase ? safe.toLowerCase() : safe;
-}
-function sanitizeFileName(name) {
-  const safe = name.replace(/[^a-zA-Z0-9._-]/g, "_") || "_";
-  if (safe === "." || safe === "..")
-    return "_";
-  return safe;
-}
-
-// ../../packages/core/src/storage/conversations.ts
-function safeUserIdComponent(userId) {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`conversations: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
-function conversationDir(userId) {
-  return join(DATA_DIR, "conversations", safeUserIdComponent(userId));
-}
-function topicFilename(topicName) {
-  const t = sanitizeTopicName(topicName, true);
-  return `${t}.jsonl`;
-}
-function getConversationPath(userId, topicName) {
-  return join(conversationDir(userId), topicFilename(topicName));
-}
-function appendConversationEvent(userId, topicName, agent, event) {
-  try {
-    appendConversationEventStrict(userId, topicName, agent, event);
-  } catch (err) {
-    logger.warn({ err, userId, topicName, eventType: event.type }, "appendConversationEvent: write failed");
-  }
-}
-function appendConversationEventStrict(userId, topicName, agent, event) {
-  const path = getConversationPath(userId, topicName);
-  const entry = {
-    ts: new Date().toISOString(),
-    agent,
-    event
-  };
-  mkdirSync2(dirname2(path), { recursive: true });
-  appendJsonlLine(path, JSON.stringify(entry));
-}
-function readConversation(userId, topicName) {
-  const path = getConversationPath(userId, topicName);
-  const out = [];
-  if (!existsSync(path))
-    return out;
-  let raw;
-  try {
-    raw = readFileSync2(path, "utf8");
-  } catch (err) {
-    logger.warn({ err, path }, "readConversation: read failed");
-    return out;
-  }
-  for (const line of raw.split(`
-`)) {
-    if (!line.trim())
-      continue;
-    try {
-      out.push(JSON.parse(line));
-    } catch (err) {
-      logger.warn({ err, line: line.slice(0, 200) }, "readConversation: malformed JSONL line skipped");
-    }
-  }
-  return out;
-}
-function replaceConversationStrict(userId, topicName, entries) {
-  const path = getConversationPath(userId, topicName);
-  const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
-  mkdirSync2(dirname2(path), { recursive: true });
-  try {
-    writeFileSync2(tempPath, entries.length > 0 ? `${entries.map((entry) => JSON.stringify(entry)).join(`
-`)}
-` : "", { flag: "wx" });
-    renameSync2(tempPath, path);
-  } catch (error) {
-    try {
-      unlinkSync3(tempPath);
-    } catch {}
-    throw error;
-  }
-}
-function cloneConversationLog(opts) {
-  const { userId, srcTopic, dstTopic } = opts;
-  const dstPath = getConversationPath(userId, dstTopic);
-  if (existsSync(dstPath) && readFileSync2(dstPath, "utf8").trim().length > 0) {
-    logger.warn({ userId, srcTopic, dstTopic, dstPath }, "cloneConversationLog: dst already non-empty \u2014 refusing to overwrite");
-    return { copied: false, entries: 0 };
-  }
-  const entries = readConversation(userId, srcTopic);
-  if (entries.length === 0) {
-    return { copied: false, entries: 0 };
-  }
-  const body = `${entries.map((e) => JSON.stringify(e)).join(`
-`)}
-`;
-  mkdirSync2(dirname2(dstPath), { recursive: true });
-  writeFileSync2(dstPath, body);
-  return { copied: true, entries: entries.length };
-}
-function findLastSessionIdForAgent(entries, agent) {
-  for (let i = entries.length - 1;i >= 0; i--) {
-    const entry = entries[i];
-    if (entry.agent !== agent)
-      continue;
-    if (entry.event.type === "session") {
-      return entry.event.sessionId;
-    }
-  }
-  return null;
-}
-export {
-  replaceConversationStrict,
-  readConversation,
-  getConversationPath,
-  findLastSessionIdForAgent,
-  cloneConversationLog,
-  appendConversationEventStrict,
-  appendConversationEvent
-};
-
-export { readJsonlLines, parseJsonlText, appendJsonlEntry, writeJsonlFile, sanitizeTopicName, sanitizeFileName, getConversationPath, appendConversationEvent, appendConversationEventStrict, readConversation, replaceConversationStrict, cloneConversationLog, findLastSessionIdForAgent };
-
-//# debugId=6EF8231950893DB664756E2164756E21

package/dist/chunk-6cpn7ht2.js.map

@@ -1,13 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../packages/core/src/storage/conversations.ts", "../../../packages/core/src/platform/jsonl.ts", "../../../packages/core/src/platform/file-utils.ts", "../../../packages/core/src/security/sanitize.ts"],
-  "sourcesContent": [
-    "import {\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { DATA_DIR } from \"#platform/config\";\nimport { appendJsonlLine } from \"#platform/jsonl\";\nimport { logger } from \"#platform/logger\";\nimport { sanitizeTopicName } from \"#security/sanitize\";\nimport type { AgentKind, UnifiedEvent } from \"#types\";\n\n/**\n * Per-topic conversation log (UnifiedEvent stream) used as the\n * **provider-agnostic source of truth** for cross-agent portability.\n *\n * Storage layout:\n *   {DATA_DIR}/conversations/{userId}/{sanitizedTopicName}.jsonl\n *\n * Each line is a `ConversationEntry` JSON object. Append-only: every yielded\n * UnifiedEvent during a `runAgent()` turn is captured here by the recording\n * wrapper, so on agent switch we can rebuild a synthetic native rollout for\n * the target SDK and preserve the conversation across providers.\n *\n * The Claude/Codex SDK rollouts (~/.claude/projects/, ~/.codex/sessions/) are\n * intentionally treated as opaque side-effects of the SDKs only this file\n * is canonical.\n */\nexport interface ConversationEntry {\n  ts: string;\n  /**\n   * Agent that produced this event, frozen at write time. A topic that has\n   * been switched (via `set_agent`) will have a mixed-agent log: earlier\n   * entries keep the agent that originally generated them. Replay code\n   * (rollout-codec `extractChatPairs`) intentionally ignores this field —\n   * the cross-agent rollout's whole point is to feed past dialogue, no\n   * matter who produced it, into the *new* SDK as if it were native.\n   */\n  agent: AgentKind;\n  event: UnifiedEvent;\n}\n\n/**\n * Validate that a userId stringifies to a safe path component. Rejects empties,\n * slashes, and traversal sequences before they touch the filesystem. The\n * conversation log is local-only so we keep this strict but simple if a\n * caller sends something unexpected it is their bug to fix, not ours to coerce.\n */\nfunction safeUserIdComponent(userId: number | string): string {\n  const str = String(userId);\n  if (!str || /[/\\\\]|\\.\\./.test(str)) {\n    throw new Error(`conversations: refusing unsafe userId path component: ${str}`);\n  }\n  return str;\n}\n\nfunction conversationDir(userId: number | string): string {\n  return join(DATA_DIR, \"conversations\", safeUserIdComponent(userId));\n}\n\nfunction topicFilename(topicName: string): string {\n  const t = sanitizeTopicName(topicName, true);\n  return `${t}.jsonl`;\n}\n\n/** Compute the absolute path for a given user/topic conversation log. */\nexport function getConversationPath(userId: number | string, topicName: string): string {\n  return join(conversationDir(userId), topicFilename(topicName));\n}\n\n/**\n * Append a single UnifiedEvent for the given topic. Creates the parent\n * directory and the file as needed. Best-effort: I/O failures are logged but\n * never throw, since recording must not break the live stream to Telegram.\n *\n * **Concurrency note (review item M2, revised):** within the bot process the\n * single-threaded event loop already serializes writes — but this module is\n * NOT single-process: the self-config MCP server (a separate stdio process,\n * via `topic-agent-switch`) and provider bridge helpers append to the same\n * topic logs.\n * Cross-process interleaving on macOS is real for lines beyond PIPE_BUF\n * (512B), and a torn line is silently dropped by `readConversation` —\n * corrupting the canonical source for cross-agent rollout reconstruction.\n * Writes therefore go through `appendJsonlLine` (sidecar `.lock` via O_EXCL,\n * stale-lock reclaim, unlocked-append fallback on timeout — interleave is\n * accepted over dropping the entry).\n *\n * The append stays SYNCHRONOUS on purpose: a previous attempt at a\n * Promise-chained per-topic queue made writes async (durability gap before a\n * synchronous `readConversation`) and broke `set_agent` in the bridge tests.\n */\nexport function appendConversationEvent(\n  userId: number | string,\n  topicName: string,\n  agent: AgentKind,\n  event: UnifiedEvent,\n): void {\n  try {\n    appendConversationEventStrict(userId, topicName, agent, event);\n  } catch (err) {\n    logger.warn(\n      { err, userId, topicName, eventType: event.type },\n      \"appendConversationEvent: write failed\",\n    );\n  }\n}\n\n/**\n * Strict variant for state transitions where the conversation log is a manifest\n * rather than telemetry. Throws on I/O failure so callers can avoid committing\n * DB state that points at an unmanifested SDK session.\n */\nexport function appendConversationEventStrict(\n  userId: number | string,\n  topicName: string,\n  agent: AgentKind,\n  event: UnifiedEvent,\n): void {\n  const path = getConversationPath(userId, topicName);\n  const entry: ConversationEntry = {\n    ts: new Date().toISOString(),\n    agent,\n    event,\n  };\n  mkdirSync(dirname(path), { recursive: true });\n  appendJsonlLine(path, JSON.stringify(entry));\n}\n\n/**\n * Read all entries for a topic in chronological order. Returns an empty array\n * if the file does not exist. Malformed lines are skipped with a warning so a\n * single corrupted entry does not poison the whole conversation.\n *\n * NOTE(perf): reads the whole file each call. Topics in the kilobyte range\n * are fine; if a single topic ever grows into multi-megabyte territory,\n * consider a streaming reader (`readline`/`Bun.file().stream()`) and a\n * size-bounded tail.\n */\nexport function readConversation(userId: number | string, topicName: string): ConversationEntry[] {\n  const path = getConversationPath(userId, topicName);\n  const out: ConversationEntry[] = [];\n  if (!existsSync(path)) return out;\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf8\");\n  } catch (err) {\n    logger.warn({ err, path }, \"readConversation: read failed\");\n    return out;\n  }\n  for (const line of raw.split(\"\\n\")) {\n    if (!line.trim()) continue;\n    try {\n      out.push(JSON.parse(line) as ConversationEntry);\n    } catch (err) {\n      logger.warn(\n        { err, line: line.slice(0, 200) },\n        \"readConversation: malformed JSONL line skipped\",\n      );\n    }\n  }\n  return out;\n}\n\n/** Atomically replace a provider-neutral topic log with an explicit event set. */\nexport function replaceConversationStrict(\n  userId: number | string,\n  topicName: string,\n  entries: ConversationEntry[],\n): void {\n  const path = getConversationPath(userId, topicName);\n  const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;\n  mkdirSync(dirname(path), { recursive: true });\n  try {\n    writeFileSync(\n      tempPath,\n      entries.length > 0 ? `${entries.map((entry) => JSON.stringify(entry)).join(\"\\n\")}\\n` : \"\",\n      { flag: \"wx\" },\n    );\n    renameSync(tempPath, path);\n  } catch (error) {\n    try {\n      unlinkSync(tempPath);\n    } catch {}\n    throw error;\n  }\n}\n\n/**\n * Copy the unified conversation log of `srcTopic` into the file path that\n * `dstTopic` will read from. Used by `/fork` so a forked child topic inherits\n * the parent's full cross-agent history, not just the agent's native SDK\n * rollout. `/spawn` intentionally does not call this; it starts with no\n * conversation history. Without this copy, a fork followed immediately by\n * `/agent <other>` would feed the empty child log to `switchTopicAgent` and\n * the new agent would start from zero — see the bug report from 2026-05-24.\n *\n * Semantics:\n *   - Reads the parent via `readConversation`, matching the history an in-place\n *     `set_agent` on the parent would have seen.\n *   - Writes a single file at the child's canonical path.\n *   - Refuses to overwrite a non-empty destination (returns `{copied:false}`).\n *     `/fork`'s only caller runs this immediately after topic creation when\n *     the dst file is guaranteed empty, so a non-empty dst means a programmer\n *     error somewhere upstream — fail loud rather than silently merging.\n *   - On any I/O error: throws. The caller (`createChildTopic`) already has\n *     a rollback path that wraps this call.\n */\nexport function cloneConversationLog(opts: {\n  userId: number | string;\n  srcTopic: string;\n  dstTopic: string;\n}): { copied: boolean; entries: number } {\n  const { userId, srcTopic, dstTopic } = opts;\n  const dstPath = getConversationPath(userId, dstTopic);\n  if (existsSync(dstPath) && readFileSync(dstPath, \"utf8\").trim().length > 0) {\n    logger.warn(\n      { userId, srcTopic, dstTopic, dstPath },\n      \"cloneConversationLog: dst already non-empty — refusing to overwrite\",\n    );\n    return { copied: false, entries: 0 };\n  }\n  const entries = readConversation(userId, srcTopic);\n  if (entries.length === 0) {\n    return { copied: false, entries: 0 };\n  }\n  const body = `${entries.map((e) => JSON.stringify(e)).join(\"\\n\")}\\n`;\n  mkdirSync(dirname(dstPath), { recursive: true });\n  writeFileSync(dstPath, body);\n  return { copied: true, entries: entries.length };\n}\n\n/**\n * Walk the unified log backwards and return the most recent SDK-emitted\n * session id for the given agent — or null if that agent has never run on\n * this topic.\n *\n * Used by `set_agent` to round-trip the SAME native rollout file across\n * agent switches: when the user does claude → codex → claude, we reuse\n * the original claude sessionId so the synthetic rollout lands at the\n * same path the SDK already manages, preserving prompt-cache continuity\n * and avoiding orphan `~/.claude/projects/<dir>/<id>.jsonl` files.\n *\n * Behavior:\n *   - First-ever switch to an agent (no prior session events) → null,\n *     caller falls back to a fresh randomUUID/uuidv7. Same as before.\n *   - Roundtrip switch (prior session exists) → that sessionId.\n *\n * `session` events are emitted on every turn by claude-/codex-provider and\n * captured into the unified log by runAgent's append wrapper. The most\n * recent one for the target agent is by definition the current SDK-side\n * resume key for that agent.\n */\nexport function findLastSessionIdForAgent(\n  entries: ConversationEntry[],\n  agent: AgentKind,\n): string | null {\n  for (let i = entries.length - 1; i >= 0; i--) {\n    const entry = entries[i];\n    if (entry.agent !== agent) continue;\n    if (entry.event.type === \"session\") {\n      return entry.event.sessionId;\n    }\n  }\n  return null;\n}\n",
-    "import {\n  appendFileSync,\n  closeSync,\n  fsyncSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { safeUnlink } from \"#platform/file-utils\";\n\nexport function readJsonlLines(filePath: string): string[] {\n  return readFileSync(filePath, \"utf-8\").trim().split(\"\\n\").filter(Boolean);\n}\n\n/**\n * Parse a JSONL string (one JSON value per line) into an array of `T`.\n * Throws on malformed lines — use when a corrupt fixture/log should fail\n * loudly rather than silently drop entries (paired with `readJsonlLines`'\n * resilient counterpart for live data streams).\n */\nexport function parseJsonlText<T = unknown>(raw: string): T[] {\n  return raw\n    .trim()\n    .split(\"\\n\")\n    .filter(Boolean)\n    .map((line) => JSON.parse(line) as T);\n}\n\n/**\n * Read and JSON-parse a file. Returns null if the file is missing or contains\n * invalid JSON. Use when a missing/corrupt file should fall through to a\n * default rather than throw.\n */\nexport function readJsonFile<T = unknown>(filePath: string): T | null {\n  try {\n    return JSON.parse(readFileSync(filePath, \"utf-8\")) as T;\n  } catch {\n    return null;\n  }\n}\n\n// --- Cross-process append lock ---\n// POSIX `O_APPEND` is only atomic when the write payload fits in PIPE_BUF\n// (Linux 4096, macOS 512). MCP servers and the bot run as separate\n// processes that all `appendFileSync` to shared inbox/outbox files; a long\n// `tell_session` prompt or large `ask_session` reply is comfortably above\n// PIPE_BUF, and a concurrent append from another process can interleave at\n// the byte level — the result fails JSON parse and the entire entry is\n// silently dropped by `parseOutboxLine`.\n//\n// Mitigation: a sidecar `<filePath>.lock` created with `O_EXCL` serializes\n// every append at the OS level. Lock is held for the duration of one\n// `appendFileSync`, so the contention window is microseconds. Stale locks\n// (process crashed mid-write) are detected via mtime and forcibly removed\n// after `LOCK_STALE_MS`. As a last resort, after `LOCK_TIMEOUT_MS` of\n// retries, the lock is bypassed — the entry survives but may interleave;\n// preferable to dropping it entirely.\nconst LOCK_SUFFIX = \".lock\";\nconst LOCK_RETRY_MS = 5;\nconst LOCK_TIMEOUT_MS = 1500;\nconst LOCK_STALE_MS = 5000;\nconst LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));\n\n/** Synchronous, non-spinning sleep supported by both Bun and Node MCP workers. */\nfunction sleepForAppendLock(ms: number): void {\n  Atomics.wait(LOCK_SLEEP, 0, 0, ms);\n}\n\nfunction tryAcquireAppendLock(lockPath: string): boolean {\n  try {\n    closeSync(openSync(lockPath, \"wx\")); // O_CREAT | O_EXCL — atomic\n    return true;\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"EEXIST\") throw e;\n    return false;\n  }\n}\n\nfunction isStaleLock(lockPath: string): boolean {\n  try {\n    return Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Append a JSON-encoded entry + newline to a JSONL file. Ensures the parent\n * directory exists and serializes concurrent multi-process appends through a\n * sidecar lock so payloads larger than PIPE_BUF do not interleave.\n *\n * The drainer side (`outbox/file-ops.ts`) claims the file via atomic rename\n * and handles recovery of leftover `.processing` files from crashes.\n */\nexport function appendJsonlEntry(filePath: string, entry: unknown): void {\n  appendJsonlLine(filePath, `${JSON.stringify(entry)}\\n`);\n}\n\n/**\n * Append an already-serialized JSONL line (must end with \"\\n\") under the\n * same cross-process append lock as `appendJsonlEntry`. Use when you\n * want to write back a raw line **exactly** — e.g. flusher tail-writeback\n * preserving lines that current parser can't decode, so a future parser\n * release still sees them.\n */\nexport function appendJsonlLine(filePath: string, line: string): void {\n  mkdirSync(dirname(filePath), { recursive: true });\n  const lockPath = `${filePath}${LOCK_SUFFIX}`;\n  const payload = line.endsWith(\"\\n\") ? line : `${line}\\n`;\n\n  let acquired = tryAcquireAppendLock(lockPath);\n  // Pre-check: if the existing lock is already stale (writer crashed before\n  // unlinking), reclaim it before sleeping. Saves the entire retry budget\n  // for the common stale-leftover case.\n  if (!acquired && isStaleLock(lockPath)) {\n    safeUnlink(lockPath);\n    acquired = tryAcquireAppendLock(lockPath);\n  }\n  if (!acquired) {\n    const start = Date.now();\n    while (!acquired && Date.now() - start < LOCK_TIMEOUT_MS) {\n      // Codex launches built-in stdio MCPs under Node+tsx while the runtime\n      // itself uses Bun. Atomics.wait gives both processes a blocking sleep\n      // without a CPU-spinning fallback or a Bun-only global.\n      sleepForAppendLock(LOCK_RETRY_MS);\n      acquired = tryAcquireAppendLock(lockPath);\n      // Recheck staleness inside the loop so a writer that crashes mid-wait\n      // doesn't leave us spinning the whole timeout.\n      if (!acquired && isStaleLock(lockPath)) {\n        safeUnlink(lockPath);\n        acquired = tryAcquireAppendLock(lockPath);\n      }\n    }\n  }\n\n  if (!acquired) {\n    // Best-effort fallback: append unlocked. Worst case the line interleaves\n    // with another writer and one of them is dropped at parse time — still\n    // better than dropping the entry on the floor here.\n    appendFileSync(filePath, payload);\n    return;\n  }\n\n  try {\n    appendFileSync(filePath, payload);\n  } finally {\n    safeUnlink(lockPath);\n  }\n}\n\n/** Overwrite a JSONL file with the given entries. Trailing newline included. */\nexport function writeJsonlFile(filePath: string, entries: readonly unknown[]): void {\n  const dir = dirname(filePath);\n  mkdirSync(dir, { recursive: true });\n  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random()\n    .toString(16)\n    .slice(2)}`;\n  const payload = `${entries.map((e) => JSON.stringify(e)).join(\"\\n\")}\\n`;\n  let fd: number | null = null;\n  try {\n    fd = openSync(tmpPath, \"w\");\n    writeFileSync(fd, payload);\n    fsyncSync(fd);\n    closeSync(fd);\n    fd = null;\n    renameSync(tmpPath, filePath);\n    fsyncDirectoryBestEffort(dir);\n  } catch (err) {\n    if (fd !== null) {\n      try {\n        closeSync(fd);\n      } catch {}\n    }\n    try {\n      unlinkSync(tmpPath);\n    } catch {}\n    throw err;\n  }\n}\n\nfunction fsyncDirectoryBestEffort(dir: string): void {\n  let fd: number | null = null;\n  try {\n    fd = openSync(dir, \"r\");\n    fsyncSync(fd);\n  } catch {\n    // Directory fsync is not portable across every runtime/filesystem. The\n    // file fsync + rename above is the important integrity boundary; this is\n    // best-effort durability for the directory entry.\n  } finally {\n    if (fd !== null) {\n      try {\n        closeSync(fd);\n      } catch {}\n    }\n  }\n}\n",
-    "import { unlinkSync } from \"node:fs\";\nimport { logger } from \"#platform/logger\";\n\n/**\n * Best-effort unlink. ENOENT is always swallowed (the file is already gone).\n * Other errors are silent unless `warnLabel` is provided, in which case they\n * are logged at warn level with `{ err, path }` context.\n */\nexport function safeUnlink(path: string, warnLabel?: string): void {\n  try {\n    unlinkSync(path);\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException)?.code === \"ENOENT\") return;\n    if (warnLabel) logger.warn({ err: e, path }, warnLabel);\n  }\n}\n",
-    "/** Sanitize a topic/session name for use in file paths.\n *  Replaces non-alphanumeric characters (excluding Korean) with underscores.\n *  Empty input (or input consisting only of disallowed chars) returns \"_\" so\n *  callers always get a non-empty single path component.\n *  @param name  The raw topic or session name.\n *  @param lowercase  Whether to lowercase the result (default: false).\n *                    Use true for wiki paths; leave false for log file paths.\n */\nexport function sanitizeTopicName(name: string, lowercase = false): string {\n  const safe = name.replace(/[^a-zA-Z0-9가-힣_-]/g, \"_\") || \"_\";\n  return lowercase ? safe.toLowerCase() : safe;\n}\n\n/** Sanitize a file name for use in file paths. Allows dots.\n *  Pure-dot results (\".\", \"..\") are replaced with \"_\" to block path-traversal\n *  when the sanitized value is used as a standalone path component.\n */\nexport function sanitizeFileName(name: string): string {\n  const safe = name.replace(/[^a-zA-Z0-9._-]/g, \"_\") || \"_\";\n  if (safe === \".\" || safe === \"..\") return \"_\";\n  return safe;\n}\n\n/** Sanitize an arbitrary ID (no Korean, no dots) for use in file paths. */\nexport function sanitizeId(id: string): string {\n  return id.replace(/[^a-zA-Z0-9_-]/g, \"_\") || \"_\";\n}\n"
-  ],
-  "mappings": ";;;;;;;;AAAA;AAAA;AAAA,eAEE;AAAA,kBACA;AAAA,gBACA;AAAA,gBACA;AAAA,mBACA;AAAA;AAEF,oBAAS;;;ACRT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBASE;AAAA;AAAA;AAGF;;;ACZA;AAQO,SAAS,UAAU,CAAC,MAAc,WAA0B;AAAA,EACjE,IAAI;AAAA,IACF,WAAW,IAAI;AAAA,IACf,OAAO,GAAG;AAAA,IACV,IAAK,GAA6B,SAAS;AAAA,MAAU;AAAA,IACrD,IAAI;AAAA,MAAW,OAAO,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS;AAAA;AAAA;;;ADEnD,SAAS,cAAc,CAAC,UAA4B;AAAA,EACzD,OAAO,aAAa,UAAU,OAAO,EAAE,KAAK,EAAE,MAAM;AAAA,CAAI,EAAE,OAAO,OAAO;AAAA;AASnE,SAAS,cAA2B,CAAC,KAAkB;AAAA,EAC5D,OAAO,IACJ,KAAK,EACL,MAAM;AAAA,CAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,CAAM;AAAA;AAgCxC,IAAM,cAAc;AACpB,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AACtB,IAAM,aAAa,IAAI,WAAW,IAAI,kBAAkB,WAAW,iBAAiB,CAAC;AAGrF,SAAS,kBAAkB,CAAC,IAAkB;AAAA,EAC5C,QAAQ,KAAK,YAAY,GAAG,GAAG,EAAE;AAAA;AAGnC,SAAS,oBAAoB,CAAC,UAA2B;AAAA,EACvD,IAAI;AAAA,IACF,UAAU,SAAS,UAAU,IAAI,CAAC;AAAA,IAClC,OAAO;AAAA,IACP,OAAO,GAAG;AAAA,IACV,IAAK,EAA4B,SAAS;AAAA,MAAU,MAAM;AAAA,IAC1D,OAAO;AAAA;AAAA;AAIX,SAAS,WAAW,CAAC,UAA2B;AAAA,EAC9C,IAAI;AAAA,IACF,OAAO,KAAK,IAAI,IAAI,SAAS,QAAQ,EAAE,UAAU;AAAA,IACjD,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAYJ,SAAS,gBAAgB,CAAC,UAAkB,OAAsB;AAAA,EACvE,gBAAgB,UAAU,GAAG,KAAK,UAAU,KAAK;AAAA,CAAK;AAAA;AAUjD,SAAS,eAAe,CAAC,UAAkB,MAAoB;AAAA,EACpE,UAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAChD,MAAM,WAAW,GAAG,WAAW;AAAA,EAC/B,MAAM,UAAU,KAAK,SAAS;AAAA,CAAI,IAAI,OAAO,GAAG;AAAA;AAAA,EAEhD,IAAI,WAAW,qBAAqB,QAAQ;AAAA,EAI5C,KAAK,YAAY,YAAY,QAAQ,GAAG;AAAA,IACtC,WAAW,QAAQ;AAAA,IACnB,WAAW,qBAAqB,QAAQ;AAAA,EAC1C;AAAA,EACA,KAAK,UAAU;AAAA,IACb,MAAM,QAAQ,KAAK,IAAI;AAAA,IACvB,QAAQ,YAAY,KAAK,IAAI,IAAI,QAAQ,iBAAiB;AAAA,MAIxD,mBAAmB,aAAa;AAAA,MAChC,WAAW,qBAAqB,QAAQ;AAAA,MAGxC,KAAK,YAAY,YAAY,QAAQ,GAAG;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,WAAW,qBAAqB,QAAQ;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,KAAK,UAAU;AAAA,IAIb,eAAe,UAAU,OAAO;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,IAAI;AAAA,IACF,eAAe,UAAU,OAAO;AAAA,YAChC;AAAA,IACA,WAAW,QAAQ;AAAA;AAAA;AAKhB,SAAS,cAAc,CAAC,UAAkB,SAAmC;AAAA,EAClF,MAAM,MAAM,QAAQ,QAAQ;AAAA,EAC5B,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EAClC,MAAM,UAAU,GAAG,gBAAgB,QAAQ,OAAO,KAAK,IAAI,KAAK,KAAK,OAAO,EACzE,SAAS,EAAE,EACX,MAAM,CAAC;AAAA,EACV,MAAM,UAAU,GAAG,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;AAAA,EAClE,IAAI,KAAoB;AAAA,EACxB,IAAI;AAAA,IACF,KAAK,SAAS,SAAS,GAAG;AAAA,IAC1B,cAAc,IAAI,OAAO;AAAA,IACzB,UAAU,EAAE;AAAA,IACZ,UAAU,EAAE;AAAA,IACZ,KAAK;AAAA,IACL,WAAW,SAAS,QAAQ;AAAA,IAC5B,yBAAyB,GAAG;AAAA,IAC5B,OAAO,KAAK;AAAA,IACZ,IAAI,OAAO,MAAM;AAAA,MACf,IAAI;AAAA,QACF,UAAU,EAAE;AAAA,QACZ,MAAM;AAAA,IACV;AAAA,IACA,IAAI;AAAA,MACF,YAAW,OAAO;AAAA,MAClB,MAAM;AAAA,IACR,MAAM;AAAA;AAAA;AAIV,SAAS,wBAAwB,CAAC,KAAmB;AAAA,EACnD,IAAI,KAAoB;AAAA,EACxB,IAAI;AAAA,IACF,KAAK,SAAS,KAAK,GAAG;AAAA,IACtB,UAAU,EAAE;AAAA,IACZ,MAAM,WAIN;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,MACf,IAAI;AAAA,QACF,UAAU,EAAE;AAAA,QACZ,MAAM;AAAA,IACV;AAAA;AAAA;;;AE/LG,SAAS,iBAAiB,CAAC,MAAc,YAAY,OAAe;AAAA,EACzE,MAAM,OAAO,KAAK,QAAQ,gCAAqB,GAAG,KAAK;AAAA,EACvD,OAAO,YAAY,KAAK,YAAY,IAAI;AAAA;AAOnC,SAAS,gBAAgB,CAAC,MAAsB;AAAA,EACrD,MAAM,OAAO,KAAK,QAAQ,oBAAoB,GAAG,KAAK;AAAA,EACtD,IAAI,SAAS,OAAO,SAAS;AAAA,IAAM,OAAO;AAAA,EAC1C,OAAO;AAAA;;;AH+BT,SAAS,mBAAmB,CAAC,QAAiC;AAAA,EAC5D,MAAM,MAAM,OAAO,MAAM;AAAA,EACzB,KAAK,OAAO,aAAa,KAAK,GAAG,GAAG;AAAA,IAClC,MAAM,IAAI,MAAM,yDAAyD,KAAK;AAAA,EAChF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CAAC,QAAiC;AAAA,EACxD,OAAO,KAAK,UAAU,iBAAiB,oBAAoB,MAAM,CAAC;AAAA;AAGpE,SAAS,aAAa,CAAC,WAA2B;AAAA,EAChD,MAAM,IAAI,kBAAkB,WAAW,IAAI;AAAA,EAC3C,OAAO,GAAG;AAAA;AAIL,SAAS,mBAAmB,CAAC,QAAyB,WAA2B;AAAA,EACtF,OAAO,KAAK,gBAAgB,MAAM,GAAG,cAAc,SAAS,CAAC;AAAA;AAwBxD,SAAS,uBAAuB,CACrC,QACA,WACA,OACA,OACM;AAAA,EACN,IAAI;AAAA,IACF,8BAA8B,QAAQ,WAAW,OAAO,KAAK;AAAA,IAC7D,OAAO,KAAK;AAAA,IACZ,OAAO,KACL,EAAE,KAAK,QAAQ,WAAW,WAAW,MAAM,KAAK,GAChD,uCACF;AAAA;AAAA;AASG,SAAS,6BAA6B,CAC3C,QACA,WACA,OACA,OACM;AAAA,EACN,MAAM,OAAO,oBAAoB,QAAQ,SAAS;AAAA,EAClD,MAAM,QAA2B;AAAA,IAC/B,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AAAA,EACA,WAAU,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5C,gBAAgB,MAAM,KAAK,UAAU,KAAK,CAAC;AAAA;AAatC,SAAS,gBAAgB,CAAC,QAAyB,WAAwC;AAAA,EAChG,MAAM,OAAO,oBAAoB,QAAQ,SAAS;AAAA,EAClD,MAAM,MAA2B,CAAC;AAAA,EAClC,KAAK,WAAW,IAAI;AAAA,IAAG,OAAO;AAAA,EAC9B,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,cAAa,MAAM,MAAM;AAAA,IAC/B,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK,EAAE,KAAK,KAAK,GAAG,+BAA+B;AAAA,IAC1D,OAAO;AAAA;AAAA,EAET,WAAW,QAAQ,IAAI,MAAM;AAAA,CAAI,GAAG;AAAA,IAClC,KAAK,KAAK,KAAK;AAAA,MAAG;AAAA,IAClB,IAAI;AAAA,MACF,IAAI,KAAK,KAAK,MAAM,IAAI,CAAsB;AAAA,MAC9C,OAAO,KAAK;AAAA,MACZ,OAAO,KACL,EAAE,KAAK,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,GAChC,gDACF;AAAA;AAAA,EAEJ;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,yBAAyB,CACvC,QACA,WACA,SACM;AAAA,EACN,MAAM,OAAO,oBAAoB,QAAQ,SAAS;AAAA,EAClD,MAAM,WAAW,GAAG,QAAQ,QAAQ,OAAO,KAAK,IAAI;AAAA,EACpD,WAAU,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5C,IAAI;AAAA,IACF,eACE,UACA,QAAQ,SAAS,IAAI,GAAG,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU,KAAK,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,IAAQ,IACvF,EAAE,MAAM,KAAK,CACf;AAAA,IACA,YAAW,UAAU,IAAI;AAAA,IACzB,OAAO,OAAO;AAAA,IACd,IAAI;AAAA,MACF,YAAW,QAAQ;AAAA,MACnB,MAAM;AAAA,IACR,MAAM;AAAA;AAAA;AAwBH,SAAS,oBAAoB,CAAC,MAII;AAAA,EACvC,QAAQ,QAAQ,UAAU,aAAa;AAAA,EACvC,MAAM,UAAU,oBAAoB,QAAQ,QAAQ;AAAA,EACpD,IAAI,WAAW,OAAO,KAAK,cAAa,SAAS,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG;AAAA,IAC1E,OAAO,KACL,EAAE,QAAQ,UAAU,UAAU,QAAQ,GACtC,0EACF;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO,SAAS,EAAE;AAAA,EACrC;AAAA,EACA,MAAM,UAAU,iBAAiB,QAAQ,QAAQ;AAAA,EACjD,IAAI,QAAQ,WAAW,GAAG;AAAA,IACxB,OAAO,EAAE,QAAQ,OAAO,SAAS,EAAE;AAAA,EACrC;AAAA,EACA,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;AAAA,EAC/D,WAAU,SAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAC/C,eAAc,SAAS,IAAI;AAAA,EAC3B,OAAO,EAAE,QAAQ,MAAM,SAAS,QAAQ,OAAO;AAAA;AAwB1C,SAAS,yBAAyB,CACvC,SACA,OACe;AAAA,EACf,SAAS,IAAI,QAAQ,SAAS,EAAG,KAAK,GAAG,KAAK;AAAA,IAC5C,MAAM,QAAQ,QAAQ;AAAA,IACtB,IAAI,MAAM,UAAU;AAAA,MAAO;AAAA,IAC3B,IAAI,MAAM,MAAM,SAAS,WAAW;AAAA,MAClC,OAAO,MAAM,MAAM;AAAA,IACrB;AAAA,EACF;AAAA,EACA,OAAO;AAAA;",
-  "debugId": "6EF8231950893DB664756E2164756E21",
-  "names": []
-}