negotium 0.18.2 → 0.19.0

package/dist/registry.js

@@ -132,7 +132,7 @@ var codexRegistryOperations = {
     return { sessionId: threadId, rolloutPath };
   },
   async forkSession({ parentSessionId }) {
-    const { forkCodexSession } = await import("./chunk-44ajn328.js");
+    const { forkCodexSession } = await import("./chunk-4bzehg8t.js");
     return await forkCodexSession(parentSessionId);
   },
   async cleanupRollouts({ sessionIds }) {

package/dist/runtime/src/agents/codex-native-multi-agent.ts

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { type ChildProcess, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
   chmodSync,
@@ -111,7 +111,7 @@ async function bootstrapCodexModelCache(codexHome: string, cachePath: string): P
     windowsHide: true,
   });
 
-  await new Promise<void>((resolve, reject) => {
+  const refreshed = new Promise<void>((resolve, reject) => {
     let settled = false;
     let stdoutBuffer = "";
     let stderr = "";
@@ -192,6 +192,48 @@ async function bootstrapCodexModelCache(codexHome: string, cachePath: string): P
       },
     });
   });
+
+  try {
+    await refreshed;
+  } finally {
+    // `child.kill()` only signals. The caller deletes CODEX_HOME right after we
+    // return, and Windows cannot delete a directory the child still holds open
+    // (EBUSY), so wait for the process to actually exit first.
+    await waitForChildExit(child, CODEX_BOOTSTRAP_EXIT_WAIT_MS);
+  }
+}
+
+const CODEX_BOOTSTRAP_EXIT_WAIT_MS = 3_000;
+
+function waitForChildExit(child: ChildProcess, timeoutMs: number): Promise<void> {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, timeoutMs);
+    timer.unref?.();
+    child.once("exit", () => {
+      clearTimeout(timer);
+      resolve();
+    });
+  });
+}
+
+/**
+ * Remove the temporary CODEX_HOME. On Windows a just-exited child (or an
+ * antivirus scan of the files it wrote) can keep the directory busy for a
+ * moment, so retry, and never let cleanup of a throwaway directory fail a turn
+ * whose result was already read. POSIX keeps the original behaviour: unlinking
+ * open files works there, and a genuine failure still surfaces.
+ */
+function removeIsolatedCodexHome(dir: string): void {
+  if (process.platform !== "win32") {
+    rmSync(dir, { recursive: true, force: true });
+    return;
+  }
+  try {
+    rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  } catch {
+    // Best effort: the OS temp cleaner will reclaim it.
+  }
 }
 
 async function bootstrapIsolatedCodexModelCache(
@@ -219,7 +261,7 @@ async function bootstrapIsolatedCodexModelCache(
     await bootstrap(isolatedHome, isolatedCachePath);
     return readCompatibleCodexModelCache(isolatedCachePath).contents;
   } finally {
-    rmSync(isolatedHome, { recursive: true, force: true });
+    removeIsolatedCodexHome(isolatedHome);
   }
 }
 

package/dist/runtime/src/agents/codex-vault-hook-bridge.ts

@@ -1,12 +1,13 @@
 import { randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
-import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdtemp, rm, writeFile } from "node:fs/promises";
 import type { Socket } from "node:net";
 import { createServer } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { codexCliScriptPath } from "#agents/codex-native-multi-agent";
+import { ensureCodexWindowsWrapperExe } from "#agents/codex-windows-wrapper";
 import { deepMapStrings } from "#agents/deep-map";
 import { referencesHostedSecretStorage, substituteHostedSecrets } from "#agents/execution-host";
 import { shouldSubstituteVaultToolInput } from "#agents/vault-tool-policy";
@@ -104,38 +105,36 @@ export interface CodexVaultHookBridge {
 }
 
 /**
- * Why this bridge has no Windows implementation yet.
+ * Why the Windows wrapper is an `.exe`, not a script.
  *
  * The hook only runs if codex is invoked with `--dangerously-bypass-hook-trust`
- * — an argv-only flag with no config-file or environment equivalent — and the
+ * -- an argv-only flag with no config-file or environment equivalent -- and the
  * SDK builds its own argv, so the flag can only be injected by a wrapper
  * standing in for the codex executable. On POSIX that wrapper is the
- * `#!/bin/sh` script below. Windows cannot use one: `@openai/codex-sdk` spawns
- * `codexPathOverride` through `child_process.spawn` with no `shell` option, and
- * Node refuses to spawn a `.cmd`/`.bat` that way (EINVAL), so only a real
- * executable would do.
+ * `#!/bin/sh` script above. Windows cannot use a script: `@openai/codex-sdk`
+ * spawns `codexPathOverride` through `child_process.spawn` with no `shell`
+ * option, and Node refuses to spawn a `.cmd`/`.bat` that way (EINVAL). So on
+ * Windows the wrapper is a small compiled executable (see
+ * `codex-windows-wrapper.ts`) that reads a private per-bridge config file.
  *
- * Failing here rather than handing back an unspawnable wrapper keeps the
- * security posture identical to macOS: `codexProvider` treats a bridge failure
- * as fatal for the turn, so a Codex turn never runs with the Vault
- * substitution and sensitive-storage denial silently absent. The alternative —
- * dropping the wrapper and letting the turn proceed — would leave those two
- * protections off while everything downstream assumed they were on.
+ * A bridge failure is still fatal for the turn (`codexProvider`), so a Codex
+ * turn never runs with the Vault substitution and sensitive-storage denial
+ * silently absent.
  */
-const WINDOWS_BRIDGE_UNSUPPORTED =
-  "Codex Vault hooks are not available on Windows: the hook-trust bypass can only be passed " +
-  "through a wrapper executable, and the Codex SDK spawns the override without a shell, so a " +
-  ".cmd wrapper cannot run. Use the Claude or Maestro backend on this host.";
+const IS_WINDOWS = process.platform === "win32";
+
+function windowsQuote(value: string): string {
+  return `"${value.replaceAll('"', '\\"')}"`;
+}
 
 export async function createCodexVaultHookBridge(userId: string): Promise<CodexVaultHookBridge> {
-  if (process.platform === "win32") throw new Error(WINDOWS_BRIDGE_UNSUPPORTED);
   const root = await mkdtemp(join(tmpdir(), "negotium-codex-vault-"));
   await chmod(root, 0o700);
   // Windows listens on a named pipe instead; the digest in `ipcEndpoint` is
   // taken over this whole path, so the per-bridge mkdtemp above still supplies
   // the uniqueness that the constant basename does not.
   const socketPath = ipcEndpoint(join(root, "hook.sock"));
-  const wrapperPath = join(root, "codex-with-hooks");
+  const wrapperPath = join(root, IS_WINDOWS ? "codex-with-hooks.exe" : "codex-with-hooks");
   const token = randomBytes(32).toString("hex");
   const connections = new Set<Socket>();
   const server = createServer((socket) => {
@@ -187,14 +186,28 @@ export async function createCodexVaultHookBridge(userId: string): Promise<CodexV
       });
     });
     restrictIpcEndpoint(socketPath);
-    await writeFile(wrapperPath, privateCodexWrapper(codexCliScriptPath(), socketPath, token), {
-      mode: 0o700,
-    });
+    if (IS_WINDOWS) {
+      const { BINARIES_DIR } = await import("#platform/config");
+      const cached = await ensureCodexWindowsWrapperExe(join(BINARIES_DIR, "codex-hook-wrapper"));
+      await copyFile(cached, wrapperPath);
+      // Same private per-bridge dir as the POSIX wrapper; the exe reads this
+      // file (runtime, codex script, hook socket, hook token, one per line).
+      await writeFile(
+        join(root, "codex-with-hooks.cfg"),
+        [process.execPath, codexCliScriptPath(), socketPath, token].join("\n"),
+        { encoding: "utf8", mode: 0o600 },
+      );
+    } else {
+      await writeFile(wrapperPath, privateCodexWrapper(codexCliScriptPath(), socketPath, token), {
+        mode: 0o700,
+      });
+    }
 
     // Keep the capability out of the process list and reviewed hook command.
     // The private wrapper explicitly authorizes this runtime-owned hook for
     // headless Codex turns.
-    const command = [shellQuote(process.execPath), shellQuote(hookClientPath())].join(" ");
+    const quote = IS_WINDOWS ? windowsQuote : shellQuote;
+    const command = [quote(process.execPath), quote(hookClientPath())].join(" ");
     return {
       codexPathOverride: wrapperPath,
       environment: { [HOOK_SOCKET_ENV]: socketPath, [HOOK_TOKEN_ENV]: token },

package/dist/runtime/src/agents/codex-windows-wrapper.ts

@@ -0,0 +1,174 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * The Windows stand-in for the POSIX `#!/bin/sh` codex wrapper.
+ *
+ * `@openai/codex-sdk` spawns `codexPathOverride` with no `shell`, and Node
+ * refuses to spawn a `.cmd`/`.bat` that way (EINVAL), so the wrapper has to be
+ * a real executable. It is a ~40-line C# program compiled once with the
+ * `csc.exe` that ships with every Windows (.NET Framework 4), cached by source
+ * hash, and copied next to a per-bridge config file for each bridge.
+ *
+ * It is a plain console exe (`Process.Start` with inherited stdio). A GUI-subsystem
+ * variant that hides the child via CreateProcess(CREATE_NO_WINDOW) was tried and
+ * rejected: antivirus flagged it as malware. The SDK spawns this without
+ * windowsHide, so a console window may briefly appear per Codex turn.
+ *
+ * Behaviour mirrors the sh wrapper: read the private config (runtime, codex
+ * script, hook socket, hook token), export the socket/token to the child, run
+ * `<runtime> <codex script> [exec --dangerously-bypass-hook-trust] <args...>`
+ * with inherited stdio, and return the child's exit code. Unlike `exec` on
+ * POSIX there is a second process here, so the child is placed in a job object
+ * with kill-on-close: when the SDK terminates the wrapper on abort the whole
+ * codex tree goes with it instead of being orphaned.
+ */
+export const CODEX_WINDOWS_WRAPPER_SOURCE = String.raw`
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+
+static class CodexHookWrapper {
+  [StructLayout(LayoutKind.Sequential)]
+  struct IO_COUNTERS { public ulong a, b, c, d, e, f; }
+  [StructLayout(LayoutKind.Sequential)]
+  struct BASIC {
+    public long PerProcessUserTimeLimit, PerJobUserTimeLimit;
+    public uint LimitFlags;
+    public UIntPtr MinimumWorkingSetSize, MaximumWorkingSetSize;
+    public uint ActiveProcessLimit;
+    public UIntPtr Affinity;
+    public uint PriorityClass, SchedulingClass;
+  }
+  [StructLayout(LayoutKind.Sequential)]
+  struct EXTENDED {
+    public BASIC Basic;
+    public IO_COUNTERS Io;
+    public UIntPtr ProcessMemoryLimit, JobMemoryLimit, PeakProcessMemoryUsed, PeakJobMemoryUsed;
+  }
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
+  static extern IntPtr CreateJobObject(IntPtr attrs, string name);
+  [DllImport("kernel32.dll")]
+  static extern bool SetInformationJobObject(IntPtr job, int cls, IntPtr info, uint len);
+  [DllImport("kernel32.dll")]
+  static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+
+  static string Quote(string a) {
+    if (a.Length > 0 && a.IndexOfAny(new[] { ' ', '\t', '\n', '\v', '"' }) < 0) return a;
+    var sb = new StringBuilder("\"");
+    int bs = 0;
+    foreach (char c in a) {
+      if (c == '\\') { bs++; }
+      else if (c == '"') { sb.Append('\\', bs * 2 + 1); sb.Append('"'); bs = 0; }
+      else { sb.Append('\\', bs); bs = 0; sb.Append(c); }
+    }
+    sb.Append('\\', bs * 2);
+    sb.Append('"');
+    return sb.ToString();
+  }
+
+  static IntPtr KillOnCloseJob() {
+    IntPtr job = CreateJobObject(IntPtr.Zero, null);
+    if (job == IntPtr.Zero) return IntPtr.Zero;
+    var info = new EXTENDED();
+    info.Basic.LimitFlags = 0x2000; // JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+    int size = Marshal.SizeOf(typeof(EXTENDED));
+    IntPtr mem = Marshal.AllocHGlobal(size);
+    try {
+      Marshal.StructureToPtr(info, mem, false);
+      if (!SetInformationJobObject(job, 9, mem, (uint)size)) return IntPtr.Zero;
+    } finally { Marshal.FreeHGlobal(mem); }
+    return job;
+  }
+
+  static int Main(string[] args) {
+    string self = Process.GetCurrentProcess().MainModule.FileName;
+    string[] cfg = File.ReadAllLines(Path.ChangeExtension(self, ".cfg"), Encoding.UTF8);
+    if (cfg.Length < 4) { Console.Error.WriteLine("codex hook wrapper: bad config"); return 70; }
+    var sb = new StringBuilder(Quote(cfg[1]));
+    int i = 0;
+    if (args.Length > 0 && args[0] == "exec") {
+      sb.Append(" exec --dangerously-bypass-hook-trust");
+      i = 1;
+    }
+    for (; i < args.Length; i++) sb.Append(' ').Append(Quote(args[i]));
+
+    // No CreateNoWindow: with it the child stops inheriting our stdio handles.
+    var psi = new ProcessStartInfo(cfg[0], sb.ToString());
+    psi.UseShellExecute = false;
+    psi.EnvironmentVariables["NEGOTIUM_CODEX_VAULT_HOOK_SOCKET"] = cfg[2];
+    psi.EnvironmentVariables["NEGOTIUM_CODEX_VAULT_HOOK_TOKEN"] = cfg[3];
+    IntPtr job = KillOnCloseJob();
+    using (Process p = Process.Start(psi)) {
+      if (job != IntPtr.Zero) AssignProcessToJobObject(job, p.Handle);
+      p.WaitForExit();
+      return p.ExitCode;
+    }
+  }
+}
+`;
+
+function cscPath(): string {
+  const windir = process.env.WINDIR ?? process.env.SystemRoot ?? "C:\\Windows";
+  for (const framework of ["Framework64", "Framework"]) {
+    const candidate = join(windir, "Microsoft.NET", framework, "v4.0.30319", "csc.exe");
+    if (existsSync(candidate)) return candidate;
+  }
+  throw new Error(
+    "csc.exe (.NET Framework 4) was not found, so the Codex hook wrapper cannot be built",
+  );
+}
+
+/**
+ * Path to the compiled wrapper, building it on first use. The cache key is the
+ * source hash, so a changed wrapper is rebuilt and old copies are just ignored.
+ * Compilation writes to a temp name and renames, so concurrent turns never see
+ * a half-written exe.
+ */
+export async function ensureCodexWindowsWrapperExe(cacheDir: string): Promise<string> {
+  const digest = createHash("sha256")
+    .update(CODEX_WINDOWS_WRAPPER_SOURCE)
+    .digest("hex")
+    .slice(0, 12);
+  const exePath = join(cacheDir, `codex-hook-wrapper-${digest}.exe`);
+  if (existsSync(exePath)) return exePath;
+
+  await mkdir(cacheDir, { recursive: true });
+  const stamp = randomUUID();
+  const sourcePath = join(cacheDir, `wrapper-${stamp}.cs`);
+  const tempExe = join(cacheDir, `wrapper-${stamp}.exe`);
+  try {
+    await writeFile(sourcePath, CODEX_WINDOWS_WRAPPER_SOURCE, "utf8");
+    await execFileAsync(
+      cscPath(),
+      ["/nologo", "/target:exe", "/optimize+", `/out:${tempExe}`, sourcePath],
+      { windowsHide: true, timeout: 60_000 },
+    );
+    try {
+      await rename(tempExe, exePath);
+    } catch (error) {
+      // Another turn finished the same build first; its exe is equivalent.
+      if (!existsSync(exePath)) throw error;
+    }
+    return exePath;
+  } catch (error) {
+    const detail =
+      error && typeof error === "object" && "stdout" in error
+        ? String((error as { stdout?: unknown }).stdout ?? "").trim()
+        : "";
+    throw new Error(
+      `Failed to build the Codex hook wrapper: ${error instanceof Error ? error.message : String(error)}${detail ? `\n${detail}` : ""}`,
+    );
+  } finally {
+    await rm(sourcePath, { force: true });
+    await rm(tempExe, { force: true });
+  }
+}

package/dist/runtime/src/prompts/sessions/_shared-tools.md

@@ -17,3 +17,22 @@ Use a tool only when it is actually available; otherwise say so instead of prete
 - Scheduled tasks: manage with `cron-manager` tools; scripts must already exist (`cron_list_scripts`). Jobs in one topic share a Cron conversation, so `cron_reset` clears the topic's whole Cron context, not one job.
 - Heavy work (large files, video encode, big crawls, browser automation): check `get_system_health` first and back off under resource pressure.
 - Computer Use: if unavailable, check `get_mcp_config` for optional `cua-rs`; MCP changes apply next session.
+
+## Browser
+Reading pages:
+- Escalate in this order: `browser_snapshot` (interactive elements only) → full snapshot → wait briefly and re-snapshot if the page is still changing → screenshot as a last resort. Never make a screenshot the first move.
+- Never truncate a snapshot. Refs are invalidated by every new snapshot, so re-snapshot after each action, and never mix a ref into a CSS selector.
+
+Acting:
+- Click and navigation tools already wait for the page to settle, so do not add a habitual wait right after them. Wait only when a fresh snapshot shows the page is still changing.
+- Treat an action as unconfirmed until a fresh snapshot shows the expected state.
+- When the next step does not depend on the new page state, batch the steps into one `browser_evaluate` call.
+- Do not guess URLs except for well-known destinations; follow links instead.
+
+When something fails:
+- Dismiss popups and cookie banners first. If a click fails as obscured, inspect what actually covers the target before retrying.
+- If the same approach fails 2-3 times, switch to a different path rather than retrying with another selector.
+- If the page state is unexpected, suspect a missed or wrong-target action before inferring site-specific rules.
+
+Coordinate input:
+- Use `browser_pointer`, `browser_wheel`, and `browser_drag` only for things the accessibility tree cannot expose (canvases, drag handles, maps), and return to ref-based actions immediately afterward.

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.18.2";
+export const NEGOTIUM_VERSION = "0.19.0";

package/dist/types/packages/core/src/agents/codex-windows-wrapper.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The Windows stand-in for the POSIX `#!/bin/sh` codex wrapper.
+ *
+ * `@openai/codex-sdk` spawns `codexPathOverride` with no `shell`, and Node
+ * refuses to spawn a `.cmd`/`.bat` that way (EINVAL), so the wrapper has to be
+ * a real executable. It is a ~40-line C# program compiled once with the
+ * `csc.exe` that ships with every Windows (.NET Framework 4), cached by source
+ * hash, and copied next to a per-bridge config file for each bridge.
+ *
+ * It is a plain console exe (`Process.Start` with inherited stdio). A GUI-subsystem
+ * variant that hides the child via CreateProcess(CREATE_NO_WINDOW) was tried and
+ * rejected: antivirus flagged it as malware. The SDK spawns this without
+ * windowsHide, so a console window may briefly appear per Codex turn.
+ *
+ * Behaviour mirrors the sh wrapper: read the private config (runtime, codex
+ * script, hook socket, hook token), export the socket/token to the child, run
+ * `<runtime> <codex script> [exec --dangerously-bypass-hook-trust] <args...>`
+ * with inherited stdio, and return the child's exit code. Unlike `exec` on
+ * POSIX there is a second process here, so the child is placed in a job object
+ * with kill-on-close: when the SDK terminates the wrapper on abort the whole
+ * codex tree goes with it instead of being orphaned.
+ */
+export declare const CODEX_WINDOWS_WRAPPER_SOURCE: string;
+/**
+ * Path to the compiled wrapper, building it on first use. The cache key is the
+ * source hash, so a changed wrapper is rebuilt and old copies are just ignored.
+ * Compilation writes to a temp name and renames, so concurrent turns never see
+ * a half-written exe.
+ */
+export declare function ensureCodexWindowsWrapperExe(cacheDir: string): Promise<string>;

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.18.2";
+export declare const NEGOTIUM_VERSION = "0.19.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium",
-  "version": "0.18.2",
+  "version": "0.19.0",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",

package/dist/chunk-44ajn328.js.map

@@ -1,12 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../packages/core/src/agents/codex-app-server.ts", "../../../packages/core/src/agents/codex-native-multi-agent.ts", "../../../packages/core/src/version.ts"],
-  "sourcesContent": [
-    "import { type ChildProcessWithoutNullStreams, spawn } from \"node:child_process\";\nimport { codexCliScriptPath } from \"#agents/codex-native-multi-agent\";\nimport { hostedCodexHomePath } from \"#agents/execution-host\";\nimport { latestCodexRolloutPath } from \"#agents/rollout/codex\";\nimport { NEGOTIUM_VERSION } from \"#version\";\n\ninterface CodexAppServerForkResult {\n  forkId: string;\n  rolloutPath: string;\n}\n\ninterface CodexAppServerForkHost {\n  spawnServer(): ChildProcessWithoutNullStreams;\n  findRolloutPath(threadId: string): string | undefined;\n  timeoutMs: number;\n}\n\ntype JsonRpcResponse = {\n  id?: number;\n  result?: { thread?: { id?: unknown } };\n  error?: { message?: unknown };\n};\n\nexport function createCodexAppServerForker(host: CodexAppServerForkHost) {\n  return async (parentThreadId: string): Promise<CodexAppServerForkResult> => {\n    const child = host.spawnServer();\n\n    return await new Promise<CodexAppServerForkResult>((resolve, reject) => {\n      let settled = false;\n      let stdoutBuffer = \"\";\n      let stderr = \"\";\n      const timer = setTimeout(\n        () => finish(new Error(\"Codex thread fork timed out\")),\n        host.timeoutMs,\n      );\n\n      const finish = (error?: Error, result?: CodexAppServerForkResult) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timer);\n        try {\n          child.stdin.end();\n          child.kill();\n        } catch {\n          // The app server may already have exited after stdin closed.\n        }\n        if (error) reject(error);\n        else if (result) resolve(result);\n        else reject(new Error(\"Codex thread fork returned no result\"));\n      };\n\n      const send = (message: Record<string, unknown>) => {\n        child.stdin.write(`${JSON.stringify(message)}\\n`);\n      };\n\n      child.stderr.on(\"data\", (chunk) => {\n        if (stderr.length < 8_192) stderr += String(chunk);\n      });\n      child.on(\"error\", (error) => finish(error));\n      child.on(\"exit\", (code, signal) => {\n        if (settled) return;\n        const detail = signal ? `signal ${signal}` : `code ${code ?? 1}`;\n        finish(\n          new Error(\n            `Codex app server exited with ${detail}${stderr.trim() ? `: ${stderr.trim()}` : \"\"}`,\n          ),\n        );\n      });\n      child.stdout.on(\"data\", (chunk) => {\n        stdoutBuffer += String(chunk);\n        for (;;) {\n          const newline = stdoutBuffer.indexOf(\"\\n\");\n          if (newline < 0) break;\n          const line = stdoutBuffer.slice(0, newline);\n          stdoutBuffer = stdoutBuffer.slice(newline + 1);\n          let message: JsonRpcResponse;\n          try {\n            message = JSON.parse(line) as JsonRpcResponse;\n          } catch {\n            continue;\n          }\n\n          if (message.id === 1) {\n            if (message.error) {\n              finish(new Error(String(message.error.message || \"Codex initialization failed\")));\n              return;\n            }\n            send({ method: \"initialized\" });\n            send({ id: 2, method: \"thread/fork\", params: { threadId: parentThreadId } });\n            continue;\n          }\n          if (message.id !== 2) continue;\n          if (message.error) {\n            finish(new Error(String(message.error.message || \"Codex thread fork failed\")));\n            return;\n          }\n          const forkId = message.result?.thread?.id;\n          if (typeof forkId !== \"string\" || !forkId) {\n            finish(new Error(\"Codex thread fork returned no thread id\"));\n            return;\n          }\n          const rolloutPath = host.findRolloutPath(forkId);\n          if (!rolloutPath) {\n            finish(new Error(`Codex thread fork rollout was not found for ${forkId}`));\n            return;\n          }\n          finish(undefined, { forkId, rolloutPath });\n          return;\n        }\n      });\n\n      send({\n        id: 1,\n        method: \"initialize\",\n        params: {\n          clientInfo: { name: \"negotium\", version: NEGOTIUM_VERSION },\n        },\n      });\n    });\n  };\n}\n\nconst forkCodexThread = createCodexAppServerForker({\n  spawnServer() {\n    return spawn(process.execPath, [codexCliScriptPath(), \"app-server\", \"--stdio\"], {\n      env: { ...process.env, CODEX_HOME: hostedCodexHomePath() },\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      // Background stdio server — no console window on Windows. Ignored on POSIX.\n      windowsHide: true,\n    });\n  },\n  findRolloutPath: latestCodexRolloutPath,\n  timeoutMs: 15_000,\n});\n\nexport async function forkCodexSession(parentThreadId: string): Promise<CodexAppServerForkResult> {\n  return await forkCodexThread(parentThreadId);\n}\n",
-    "import { spawn } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  mkdtempSync,\n  readFileSync,\n  renameSync,\n  rmSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { NEGOTIUM_VERSION } from \"#version\";\n\ntype CodexModel = Record<string, unknown>;\ntype CodexModelCache = {\n  client_version?: unknown;\n  models?: unknown;\n};\n\nconst moduleRequire = createRequire(import.meta.url);\nconst codexSdkPackagePath = moduleRequire.resolve(\"@openai/codex-sdk/package.json\");\nconst codexSdkRequire = createRequire(codexSdkPackagePath);\nconst bundledCodexPackagePath = codexSdkRequire.resolve(\"@openai/codex/package.json\");\n\nfunction readPackageVersion(packageJsonPath: string): string {\n  const parsed = JSON.parse(readFileSync(packageJsonPath, \"utf8\")) as { version?: unknown };\n  if (typeof parsed.version !== \"string\" || !parsed.version.trim()) {\n    throw new Error(`Codex package has no valid version: ${packageJsonPath}`);\n  }\n  return parsed.version;\n}\n\nexport const BUNDLED_CODEX_VERSION = readPackageVersion(bundledCodexPackagePath);\nconst SAFE_BUNDLED_CODEX_VERSION = BUNDLED_CODEX_VERSION.replace(/[^a-zA-Z0-9._-]/g, \"_\");\nconst NEGOTIUM_MODEL_CACHE = `negotium-models-cache-${SAFE_BUNDLED_CODEX_VERSION}.json`;\nconst NEGOTIUM_MODEL_CATALOG = `negotium-model-catalog-${SAFE_BUNDLED_CODEX_VERSION}.json`;\n\nexport function codexCliScriptPath(): string {\n  return join(dirname(bundledCodexPackagePath), \"bin\", \"codex.js\");\n}\n\nfunction parseCodexModelCache(contents: string, sourcePath: string): CodexModelCache {\n  let parsed: CodexModelCache;\n  try {\n    parsed = JSON.parse(contents) as CodexModelCache;\n  } catch (error) {\n    throw new Error(`Codex model cache is invalid JSON: ${sourcePath}`, { cause: error });\n  }\n  if (!Array.isArray(parsed.models) || parsed.models.length === 0) {\n    throw new Error(`Codex model cache has no models: ${sourcePath}`);\n  }\n  return parsed;\n}\n\nfunction readCodexModelCache(cachePath: string): {\n  contents: string;\n  parsed: CodexModelCache;\n} {\n  const contents = readFileSync(cachePath, \"utf8\");\n  return { contents, parsed: parseCodexModelCache(contents, cachePath) };\n}\n\nfunction readCompatibleCodexModelCache(cachePath: string): {\n  contents: string;\n  parsed: CodexModelCache;\n} {\n  const cache = readCodexModelCache(cachePath);\n  if (cache.parsed.client_version !== BUNDLED_CODEX_VERSION) {\n    const found =\n      typeof cache.parsed.client_version === \"string\"\n        ? cache.parsed.client_version\n        : \"missing or invalid\";\n    throw new Error(\n      `Codex model cache version ${found} does not match Negotium's bundled Codex ${BUNDLED_CODEX_VERSION}: ${cachePath}`,\n    );\n  }\n  return cache;\n}\n\nfunction writePrivateFileAtomic(path: string, contents: string): void {\n  if (existsSync(path) && readFileSync(path, \"utf8\") === contents) return;\n\n  const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;\n  try {\n    writeFileSync(tempPath, contents, { encoding: \"utf8\", mode: 0o600 });\n    renameSync(tempPath, path);\n    chmodSync(path, 0o600);\n  } finally {\n    try {\n      unlinkSync(tempPath);\n    } catch {\n      // renameSync normally consumed the temporary file.\n    }\n  }\n}\n\nexport function bundledCodexModelCachePath(authFilePath: string): string {\n  return join(dirname(authFilePath), NEGOTIUM_MODEL_CACHE);\n}\n\nasync function bootstrapCodexModelCache(codexHome: string, cachePath: string): Promise<void> {\n  const child = spawn(process.execPath, [codexCliScriptPath(), \"app-server\", \"--stdio\"], {\n    env: { ...process.env, CODEX_HOME: codexHome },\n    stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    // Background stdio server — no console window on Windows. Ignored on POSIX.\n    windowsHide: true,\n  });\n\n  await new Promise<void>((resolve, reject) => {\n    let settled = false;\n    let stdoutBuffer = \"\";\n    let stderr = \"\";\n    const timer = setTimeout(\n      () => finish(new Error(\"timed out while refreshing the Codex model catalog\")),\n      15_000,\n    );\n\n    const finish = (error?: Error) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      try {\n        child.stdin.end();\n        child.kill();\n      } catch {\n        // The app server may already have exited after stdin closed.\n      }\n      if (error) reject(error);\n      else if (!existsSync(cachePath)) reject(new Error(\"Codex did not create its model cache\"));\n      else resolve();\n    };\n\n    const send = (message: Record<string, unknown>) => {\n      child.stdin.write(`${JSON.stringify(message)}\\n`);\n    };\n\n    child.stderr.on(\"data\", (chunk) => {\n      if (stderr.length < 4_096) stderr += String(chunk);\n    });\n    child.on(\"error\", (error) => finish(error));\n    child.on(\"exit\", (code, signal) => {\n      if (!settled) {\n        finish(\n          new Error(\n            `Codex model catalog refresh exited with ${signal ? `signal ${signal}` : `code ${code ?? 1}`}${stderr.trim() ? `: ${stderr.trim()}` : \"\"}`,\n          ),\n        );\n      }\n    });\n    child.stdout.on(\"data\", (chunk) => {\n      stdoutBuffer += String(chunk);\n      for (;;) {\n        const newline = stdoutBuffer.indexOf(\"\\n\");\n        if (newline < 0) break;\n        const line = stdoutBuffer.slice(0, newline);\n        stdoutBuffer = stdoutBuffer.slice(newline + 1);\n        let message: { id?: number; error?: { message?: string } };\n        try {\n          message = JSON.parse(line) as typeof message;\n        } catch {\n          continue;\n        }\n        if (message.id === 1) {\n          if (message.error) {\n            finish(new Error(message.error.message || \"Codex initialization failed\"));\n            return;\n          }\n          send({ method: \"initialized\" });\n          send({ id: 2, method: \"model/list\", params: { includeHidden: true } });\n        } else if (message.id === 2) {\n          if (message.error) {\n            finish(new Error(message.error.message || \"Codex model listing failed\"));\n          } else {\n            finish();\n          }\n          return;\n        }\n      }\n    });\n\n    send({\n      id: 1,\n      method: \"initialize\",\n      params: {\n        clientInfo: { name: \"negotium\", version: NEGOTIUM_VERSION },\n        capabilities: { experimentalApi: true },\n      },\n    });\n  });\n}\n\nasync function bootstrapIsolatedCodexModelCache(\n  authFilePath: string,\n  bootstrap: (codexHome: string, cachePath: string) => Promise<void>,\n): Promise<string> {\n  const sourceHome = dirname(authFilePath);\n  const isolatedHome = mkdtempSync(join(tmpdir(), \"negotium-codex-models-\"));\n  const isolatedCachePath = join(isolatedHome, \"models_cache.json\");\n\n  try {\n    const isolatedAuthPath = join(isolatedHome, \"auth.json\");\n    copyFileSync(authFilePath, isolatedAuthPath);\n    chmodSync(isolatedAuthPath, 0o600);\n\n    // Preserve custom provider configuration while keeping the bundled CLI's\n    // cache write completely outside the user's shared CODEX_HOME.\n    const sourceConfigPath = join(sourceHome, \"config.toml\");\n    if (existsSync(sourceConfigPath)) {\n      const isolatedConfigPath = join(isolatedHome, \"config.toml\");\n      copyFileSync(sourceConfigPath, isolatedConfigPath);\n      chmodSync(isolatedConfigPath, 0o600);\n    }\n\n    await bootstrap(isolatedHome, isolatedCachePath);\n    return readCompatibleCodexModelCache(isolatedCachePath).contents;\n  } finally {\n    rmSync(isolatedHome, { recursive: true, force: true });\n  }\n}\n\nexport async function ensureCodexModelCache(\n  authFilePath: string,\n  bootstrap: (codexHome: string, cachePath: string) => Promise<void> = bootstrapCodexModelCache,\n): Promise<string> {\n  const codexHome = dirname(authFilePath);\n  const configuredCachePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE;\n  if (configuredCachePath) {\n    if (!existsSync(configuredCachePath)) {\n      throw new Error(`Configured Codex model cache does not exist: ${configuredCachePath}`);\n    }\n    readCompatibleCodexModelCache(configuredCachePath);\n    return configuredCachePath;\n  }\n\n  // The global Codex CLI owns models_cache.json and may update it to a schema\n  // newer than the SDK bundled by Negotium. Snapshot a cache generated for our\n  // exact bundled version so later global CLI updates cannot break turns.\n  const bundledCachePath = bundledCodexModelCachePath(authFilePath);\n  const sharedCachePath = join(codexHome, \"models_cache.json\");\n  if (existsSync(sharedCachePath)) {\n    try {\n      const shared = readCompatibleCodexModelCache(sharedCachePath);\n      // Keep model metadata fresh while the global CLI remains compatible.\n      writePrivateFileAtomic(bundledCachePath, shared.contents);\n      return bundledCachePath;\n    } catch {\n      // A compatible private snapshot is safer than failing because another\n      // process briefly exposed an incomplete shared-cache write.\n    }\n  }\n\n  if (existsSync(bundledCachePath)) {\n    try {\n      readCompatibleCodexModelCache(bundledCachePath);\n      return bundledCachePath;\n    } catch {\n      // Re-bootstrap below instead of passing a corrupt or version-mismatched\n      // private snapshot into this SDK version.\n    }\n  }\n\n  const refreshedContents = await bootstrapIsolatedCodexModelCache(authFilePath, bootstrap);\n  writePrivateFileAtomic(bundledCachePath, refreshedContents);\n  return bundledCachePath;\n}\n\n/**\n * Codex can resolve model metadata before `features.multi_agent=false`, so a\n * model-advertised v1/v2 value may still register native collaboration tools.\n * Feed Codex an authoritative copy of its own catalog with only that field\n * disabled. Runtime MCP delegation remains available independently.\n */\nexport function writeCodexCatalogWithNativeMultiAgentDisabled(\n  authFilePath: string,\n  sourcePath: string,\n): string {\n  const codexHome = dirname(authFilePath);\n  const outputPath = join(codexHome, NEGOTIUM_MODEL_CATALOG);\n\n  const parsed = readCodexModelCache(sourcePath).parsed;\n\n  const models = (parsed.models as unknown[]).map((model, index): CodexModel => {\n    if (!model || typeof model !== \"object\" || Array.isArray(model)) {\n      throw new Error(`Codex model cache entry ${index} is invalid: ${sourcePath}`);\n    }\n    return { ...(model as CodexModel), multi_agent_version: \"disabled\" };\n  });\n  const contents = `${JSON.stringify({ models }, null, 2)}\\n`;\n  writePrivateFileAtomic(outputPath, contents);\n  return outputPath;\n}\n",
-    "export const NEGOTIUM_VERSION = \"0.18.2\";\n"
-  ],
-  "mappings": ";;;;;;;AAAA;;;ACEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA;AAEA;;;ACfO,IAAM,mBAAmB;;;ADwBhC,IAAM,gBAAgB,cAAc,YAAY,GAAG;AACnD,IAAM,sBAAsB,cAAc,QAAQ,gCAAgC;AAClF,IAAM,kBAAkB,cAAc,mBAAmB;AACzD,IAAM,0BAA0B,gBAAgB,QAAQ,4BAA4B;AAEpF,SAAS,kBAAkB,CAAC,iBAAiC;AAAA,EAC3D,MAAM,SAAS,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAAC;AAAA,EAC/D,IAAI,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChE,MAAM,IAAI,MAAM,uCAAuC,iBAAiB;AAAA,EAC1E;AAAA,EACA,OAAO,OAAO;AAAA;AAGT,IAAM,wBAAwB,mBAAmB,uBAAuB;AAC/E,IAAM,6BAA6B,sBAAsB,QAAQ,oBAAoB,GAAG;AACxF,IAAM,uBAAuB,yBAAyB;AACtD,IAAM,yBAAyB,0BAA0B;AAElD,SAAS,kBAAkB,GAAW;AAAA,EAC3C,OAAO,KAAK,QAAQ,uBAAuB,GAAG,OAAO,UAAU;AAAA;;;ADpB1D,SAAS,0BAA0B,CAAC,MAA8B;AAAA,EACvE,OAAO,OAAO,mBAA8D;AAAA,IAC1E,MAAM,QAAQ,KAAK,YAAY;AAAA,IAE/B,OAAO,MAAM,IAAI,QAAkC,CAAC,SAAS,WAAW;AAAA,MACtE,IAAI,UAAU;AAAA,MACd,IAAI,eAAe;AAAA,MACnB,IAAI,SAAS;AAAA,MACb,MAAM,QAAQ,WACZ,MAAM,OAAO,IAAI,MAAM,6BAA6B,CAAC,GACrD,KAAK,SACP;AAAA,MAEA,MAAM,SAAS,CAAC,OAAe,WAAsC;AAAA,QACnE,IAAI;AAAA,UAAS;AAAA,QACb,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,QAClB,IAAI;AAAA,UACF,MAAM,MAAM,IAAI;AAAA,UAChB,MAAM,KAAK;AAAA,UACX,MAAM;AAAA,QAGR,IAAI;AAAA,UAAO,OAAO,KAAK;AAAA,QAClB,SAAI;AAAA,UAAQ,QAAQ,MAAM;AAAA,QAC1B;AAAA,iBAAO,IAAI,MAAM,sCAAsC,CAAC;AAAA;AAAA,MAG/D,MAAM,OAAO,CAAC,YAAqC;AAAA,QACjD,MAAM,MAAM,MAAM,GAAG,KAAK,UAAU,OAAO;AAAA,CAAK;AAAA;AAAA,MAGlD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU;AAAA,QACjC,IAAI,OAAO,SAAS;AAAA,UAAO,UAAU,OAAO,KAAK;AAAA,OAClD;AAAA,MACD,MAAM,GAAG,SAAS,CAAC,UAAU,OAAO,KAAK,CAAC;AAAA,MAC1C,MAAM,GAAG,QAAQ,CAAC,MAAM,WAAW;AAAA,QACjC,IAAI;AAAA,UAAS;AAAA,QACb,MAAM,SAAS,SAAS,UAAU,WAAW,QAAQ,QAAQ;AAAA,QAC7D,OACE,IAAI,MACF,gCAAgC,SAAS,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,IAClF,CACF;AAAA,OACD;AAAA,MACD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU;AAAA,QACjC,gBAAgB,OAAO,KAAK;AAAA,QAC5B,UAAS;AAAA,UACP,MAAM,UAAU,aAAa,QAAQ;AAAA,CAAI;AAAA,UACzC,IAAI,UAAU;AAAA,YAAG;AAAA,UACjB,MAAM,OAAO,aAAa,MAAM,GAAG,OAAO;AAAA,UAC1C,eAAe,aAAa,MAAM,UAAU,CAAC;AAAA,UAC7C,IAAI;AAAA,UACJ,IAAI;AAAA,YACF,UAAU,KAAK,MAAM,IAAI;AAAA,YACzB,MAAM;AAAA,YACN;AAAA;AAAA,UAGF,IAAI,QAAQ,OAAO,GAAG;AAAA,YACpB,IAAI,QAAQ,OAAO;AAAA,cACjB,OAAO,IAAI,MAAM,OAAO,QAAQ,MAAM,WAAW,6BAA6B,CAAC,CAAC;AAAA,cAChF;AAAA,YACF;AAAA,YACA,KAAK,EAAE,QAAQ,cAAc,CAAC;AAAA,YAC9B,KAAK,EAAE,IAAI,GAAG,QAAQ,eAAe,QAAQ,EAAE,UAAU,eAAe,EAAE,CAAC;AAAA,YAC3E;AAAA,UACF;AAAA,UACA,IAAI,QAAQ,OAAO;AAAA,YAAG;AAAA,UACtB,IAAI,QAAQ,OAAO;AAAA,YACjB,OAAO,IAAI,MAAM,OAAO,QAAQ,MAAM,WAAW,0BAA0B,CAAC,CAAC;AAAA,YAC7E;AAAA,UACF;AAAA,UACA,MAAM,SAAS,QAAQ,QAAQ,QAAQ;AAAA,UACvC,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ;AAAA,YACzC,OAAO,IAAI,MAAM,yCAAyC,CAAC;AAAA,YAC3D;AAAA,UACF;AAAA,UACA,MAAM,cAAc,KAAK,gBAAgB,MAAM;AAAA,UAC/C,IAAI,CAAC,aAAa;AAAA,YAChB,OAAO,IAAI,MAAM,+CAA+C,QAAQ,CAAC;AAAA,YACzE;AAAA,UACF;AAAA,UACA,OAAO,WAAW,EAAE,QAAQ,YAAY,CAAC;AAAA,UACzC;AAAA,QACF;AAAA,OACD;AAAA,MAED,KAAK;AAAA,QACH,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN,YAAY,EAAE,MAAM,YAAY,SAAS,iBAAiB;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,KACF;AAAA;AAAA;AAIL,IAAM,kBAAkB,2BAA2B;AAAA,EACjD,WAAW,GAAG;AAAA,IACZ,OAAO,MAAM,QAAQ,UAAU,CAAC,mBAAmB,GAAG,cAAc,SAAS,GAAG;AAAA,MAC9E,KAAK,KAAK,QAAQ,KAAK,YAAY,oBAAoB,EAAE;AAAA,MACzD,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAE9B,aAAa;AAAA,IACf,CAAC;AAAA;AAAA,EAEH,iBAAiB;AAAA,EACjB,WAAW;AACb,CAAC;AAED,eAAsB,gBAAgB,CAAC,gBAA2D;AAAA,EAChG,OAAO,MAAM,gBAAgB,cAAc;AAAA;",
-  "debugId": "BEFB3E8C582938DC64756E2164756E21",
-  "names": []
-}