negotium 0.2.0 → 0.2.2

package/dist/runtime/cron/mcp-server.ts

@@ -8,7 +8,7 @@ import {
   getTopic,
   getTopicByNameForUser,
   isAgentKind,
-} from "@negotium/core";
+} from "../src/index.ts";
 import { z } from "zod";
 import {
   CRON_CONTEXT_RETAIN_TURNS,

package/dist/runtime/src/migration/single-user.ts

@@ -15,7 +15,7 @@ import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { sanitizeTopicName } from "#security/sanitize";
 import { Database } from "#storage/sqlite";
-import { decryptVaultValue, encryptVaultValue } from "#storage/vault-crypto";
+import { decryptVaultValueWithKey, encryptVaultValueWithKey } from "#storage/vault-crypto-core";
 
 export const CANONICAL_LOCAL_USER_ID = "local";
 export const SINGLE_USER_MIGRATION_ID = "negotium-0.2.0-single-user";
@@ -40,7 +40,9 @@ interface MoveOperation {
   source: string;
   staged: string;
   destination?: string;
-  state: "pending" | "staged" | "placed";
+  destinationStaged?: string;
+  collision?: "keep-destination" | "replace-destination" | "merge-jsonl" | "merge-tasks";
+  state: "pending" | "staged" | "source-staged" | "destination-staged" | "placed";
 }
 
 interface MigrationJournal {
@@ -70,7 +72,9 @@ function assertNoActiveNode(stateDir: string): void {
     const infoPath = join(stateDir, runtimeName, "node-daemon.json");
     if (!existsSync(infoPath)) continue;
     try {
-      const value = JSON.parse(readFileSync(infoPath, "utf8")) as { pid?: number };
+      const value = JSON.parse(readFileSync(infoPath, "utf8")) as {
+        pid?: number;
+      };
       if (typeof value.pid === "number" && processIsAlive(value.pid)) {
         throw new Error(`Refusing migration while Negotium pid ${value.pid} is active.`);
       }
@@ -121,17 +125,60 @@ function addDirectoryContents(
   }
 }
 
-function assertNoCollisions(operations: MoveOperation[]): void {
+function pathWithin(path: string, root: string): boolean {
+  return path === root || path.startsWith(`${root}/`);
+}
+
+function collisionPolicy(
+  operation: MoveOperation,
+  stateDir: string,
+): NonNullable<MoveOperation["collision"]> | undefined {
+  const destination = operation.destination;
+  if (!destination || !existsSync(destination)) return undefined;
+  if (pathWithin(destination, join(stateDir, "runtime"))) return "keep-destination";
+  if (pathWithin(destination, join(stateDir, "binaries"))) return "keep-destination";
+  if (pathWithin(destination, join(stateDir, "secrets"))) return "replace-destination";
+  if (destination === join(stateDir, "data", "vault", "vault.db")) {
+    return "replace-destination";
+  }
+  if (pathWithin(destination, join(stateDir, "browser", "profiles"))) {
+    return "replace-destination";
+  }
+  if (
+    pathWithin(destination, join(stateDir, "data", "conversations")) &&
+    destination.endsWith(".jsonl")
+  ) {
+    return "merge-jsonl";
+  }
+  if (pathWithin(destination, join(stateDir, "data", "tasks")) && destination.endsWith(".json")) {
+    return "merge-tasks";
+  }
+  if (
+    statSync(operation.source).isFile() &&
+    statSync(destination).isFile() &&
+    readFileSync(operation.source).equals(readFileSync(destination))
+  ) {
+    return "keep-destination";
+  }
+  throw new Error(`Migration collision at ${destination}.`);
+}
+
+function configureCollisions(
+  operations: MoveOperation[],
+  stateDir: string,
+  stagingRoot: string,
+): void {
   const destinations = new Set<string>();
   for (const operation of operations) {
     if (!operation.destination) continue;
-    if (existsSync(operation.destination)) {
-      throw new Error(`Migration collision at ${operation.destination}.`);
-    }
     if (destinations.has(operation.destination)) {
       throw new Error(`Multiple legacy paths target ${operation.destination}.`);
     }
     destinations.add(operation.destination);
+    operation.collision = collisionPolicy(operation, stateDir);
+    if (operation.collision && operation.collision !== "keep-destination") {
+      operation.destinationStaged = join(stagingRoot, randomUUID());
+    }
   }
 }
 
@@ -141,16 +188,115 @@ function writeJournal(path: string, journal: MigrationJournal): void {
 
 function rollbackFilesystem(journal: MigrationJournal, journalPath: string): void {
   for (const operation of [...journal.operations].reverse()) {
-    const current = operation.state === "placed" ? operation.destination : operation.staged;
-    if (!current || !existsSync(current) || existsSync(operation.source)) continue;
-    mkdirSync(dirname(operation.source), { recursive: true });
-    renameSync(current, operation.source);
+    if (operation.state === "placed") {
+      if (operation.collision === "keep-destination" || !operation.destination) {
+        if (existsSync(operation.staged) && !existsSync(operation.source)) {
+          mkdirSync(dirname(operation.source), { recursive: true });
+          renameSync(operation.staged, operation.source);
+        }
+      } else if (operation.destination && existsSync(operation.destination)) {
+        if (operation.collision === "merge-jsonl" || operation.collision === "merge-tasks") {
+          rmSync(operation.destination, { recursive: true, force: true });
+          if (existsSync(operation.staged) && !existsSync(operation.source)) {
+            mkdirSync(dirname(operation.source), { recursive: true });
+            renameSync(operation.staged, operation.source);
+          }
+        } else if (!existsSync(operation.source)) {
+          mkdirSync(dirname(operation.source), { recursive: true });
+          renameSync(operation.destination, operation.source);
+        }
+      }
+    } else if (existsSync(operation.staged) && !existsSync(operation.source)) {
+      mkdirSync(dirname(operation.source), { recursive: true });
+      renameSync(operation.staged, operation.source);
+    }
+    if (
+      operation.destination &&
+      operation.destinationStaged &&
+      existsSync(operation.destinationStaged) &&
+      !existsSync(operation.destination)
+    ) {
+      mkdirSync(dirname(operation.destination), { recursive: true });
+      renameSync(operation.destinationStaged, operation.destination);
+    }
     operation.state = "pending";
   }
   journal.phase = "filesystem";
   writeJournal(journalPath, journal);
 }
 
+function mergedJsonl(source: string, destination: string): string {
+  const lines = new Set<string>();
+  for (const path of [source, destination]) {
+    for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
+      if (line) lines.add(line);
+    }
+  }
+  return lines.size > 0 ? `${[...lines].join("\n")}\n` : "";
+}
+
+interface TaskFileShape {
+  version: 1;
+  tasks: Array<{ id: string; blockedBy?: string[]; [key: string]: unknown }>;
+}
+
+function readTaskFile(path: string): TaskFileShape {
+  const parsed = JSON.parse(readFileSync(path, "utf8")) as Partial<TaskFileShape>;
+  if (parsed.version !== 1 || !Array.isArray(parsed.tasks)) {
+    throw new Error(`Invalid task file during migration: ${path}`);
+  }
+  return parsed as TaskFileShape;
+}
+
+function mergedTasks(source: string, destination: string): string {
+  const legacy = readTaskFile(source).tasks;
+  const current = readTaskFile(destination).tasks;
+  const merged = legacy.map((task) => ({ ...task }));
+  const usedIds = new Set(merged.map((task) => String(task.id)));
+  let nextId = Math.max(0, ...[...usedIds].map(Number).filter(Number.isInteger)) + 1;
+  const remapped = new Map<string, string>();
+
+  for (const task of current) {
+    const originalId = String(task.id);
+    const exact = merged.find(
+      (candidate) =>
+        candidate.id === originalId && JSON.stringify(candidate) === JSON.stringify(task),
+    );
+    if (exact) {
+      remapped.set(originalId, originalId);
+      continue;
+    }
+    const id = usedIds.has(originalId) ? String(nextId++) : originalId;
+    usedIds.add(id);
+    remapped.set(originalId, id);
+    merged.push({ ...task, id });
+  }
+  for (const task of merged.slice(legacy.length)) {
+    if (task.blockedBy) task.blockedBy = task.blockedBy.map((id) => remapped.get(id) ?? id);
+  }
+  return `${JSON.stringify({ version: 1, tasks: merged }, null, 2)}\n`;
+}
+
+function placeOperation(operation: MoveOperation): void {
+  if (!operation.destination || operation.collision === "keep-destination") return;
+  mkdirSync(dirname(operation.destination), { recursive: true });
+  if (operation.collision === "merge-jsonl") {
+    writeFileSync(
+      operation.destination,
+      mergedJsonl(operation.staged, operation.destinationStaged!),
+    );
+    return;
+  }
+  if (operation.collision === "merge-tasks") {
+    writeFileSync(
+      operation.destination,
+      mergedTasks(operation.staged, operation.destinationStaged!),
+    );
+    return;
+  }
+  renameSync(operation.staged, operation.destination);
+}
+
 function tablesWithColumn(database: InstanceType<typeof Database>, columnName: string): string[] {
   const tables = database
     .query<{ name: string }, []>(
@@ -239,11 +385,11 @@ function migrateDatabase(
           )
           .all(source);
         for (const row of rows) {
-          const plaintext = decryptVaultValue(source, row.key, row.value, masterKey).value;
+          const plaintext = decryptVaultValueWithKey(source, row.key, row.value, masterKey).value;
           database
             .query("UPDATE vault SET value = ? WHERE user_id = ? AND key = ?")
             .run(
-              encryptVaultValue(CANONICAL_LOCAL_USER_ID, row.key, plaintext, masterKey),
+              encryptVaultValueWithKey(CANONICAL_LOCAL_USER_ID, row.key, plaintext, masterKey),
               source,
               row.key,
             );
@@ -512,7 +658,7 @@ export function migrateSingleUserState(
         state: "pending",
       });
     }
-    assertNoCollisions(operations);
+    configureCollisions(operations, stateDir, stagingRoot);
     journal = {
       id: SINGLE_USER_MIGRATION_ID,
       sourcePrincipal: source,
@@ -529,30 +675,57 @@ export function migrateSingleUserState(
   try {
     for (const operation of journal.operations) {
       // Reconcile a crash between rename(2) and the following journal write.
+      if (operation.state === "staged") operation.state = "source-staged";
+      if (operation.state === "pending" && !existsSync(operation.source)) {
+        if (existsSync(operation.staged)) operation.state = "source-staged";
+        else if (operation.destination && existsSync(operation.destination)) {
+          operation.state = "placed";
+        }
+      }
+      if (operation.state === "pending") {
+        mkdirSync(dirname(operation.staged), { recursive: true });
+        renameSync(operation.source, operation.staged);
+        operation.state = "source-staged";
+        writeJournal(journalPath, journal);
+      }
       if (
-        operation.state === "pending" &&
-        !existsSync(operation.source) &&
-        existsSync(operation.staged)
+        operation.state === "source-staged" &&
+        operation.collision === "replace-destination" &&
+        operation.destination &&
+        operation.destinationStaged &&
+        !existsSync(operation.staged) &&
+        existsSync(operation.destination) &&
+        existsSync(operation.destinationStaged)
       ) {
-        operation.state = "staged";
+        operation.state = "placed";
+        writeJournal(journalPath, journal);
       }
       if (
-        operation.state === "staged" &&
+        operation.state === "destination-staged" &&
+        operation.collision !== "merge-jsonl" &&
+        operation.collision !== "merge-tasks" &&
+        operation.collision !== "keep-destination" &&
         operation.destination &&
         !existsSync(operation.staged) &&
         existsSync(operation.destination)
       ) {
         operation.state = "placed";
+        writeJournal(journalPath, journal);
       }
-      if (operation.state === "pending") {
-        mkdirSync(dirname(operation.staged), { recursive: true });
-        renameSync(operation.source, operation.staged);
-        operation.state = "staged";
+      if (operation.state === "source-staged") {
+        if (operation.destination && operation.destinationStaged) {
+          if (existsSync(operation.destination) && !existsSync(operation.destinationStaged)) {
+            renameSync(operation.destination, operation.destinationStaged);
+          }
+          if (!existsSync(operation.destinationStaged)) {
+            throw new Error(`Missing collision backup for ${operation.destination}.`);
+          }
+        }
+        operation.state = "destination-staged";
         writeJournal(journalPath, journal);
       }
-      if (operation.state === "staged" && operation.destination) {
-        mkdirSync(dirname(operation.destination), { recursive: true });
-        renameSync(operation.staged, operation.destination);
+      if (operation.state === "destination-staged") {
+        placeOperation(operation);
         operation.state = "placed";
         writeJournal(journalPath, journal);
       }
@@ -598,10 +771,21 @@ export function migrateSingleUserState(
       migratedTables,
     };
     for (const store of ["conversations", "tasks", "users"]) {
-      rmSync(join(stateDir, "data", store, source), { recursive: true, force: true });
+      rmSync(join(stateDir, "data", store, source), {
+        recursive: true,
+        force: true,
+      });
     }
-    rmSync(join(stateDir, "workspace", "browser-profiles"), { recursive: true, force: true });
-    writeFileSync(markerPath, `${JSON.stringify(marker, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    rmSync(join(stateDir, "run"), { recursive: true, force: true });
+    rmSync(join(stateDir, "bin"), { recursive: true, force: true });
+    rmSync(join(stateDir, "workspace", "browser-profiles"), {
+      recursive: true,
+      force: true,
+    });
+    writeFileSync(markerPath, `${JSON.stringify(marker, null, 2)}\n`, {
+      mode: 0o600,
+      flag: "wx",
+    });
     journal.phase = "complete";
     rmSync(stagingRoot, { recursive: true, force: true });
     return {

package/dist/runtime/src/storage/vault-crypto-core.ts

@@ -0,0 +1,65 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+
+const ENVELOPE_PREFIX = "otium-vault:v1:";
+const IV_BYTES = 12;
+const KEY_BYTES = 32;
+
+function encryptionKey(masterKey: string): Buffer {
+  return createHash("sha256")
+    .update("otium-vault-value-v1\0", "utf8")
+    .update(masterKey, "utf8")
+    .digest()
+    .subarray(0, KEY_BYTES);
+}
+
+function aad(userId: string, key: string): Buffer {
+  return Buffer.from(`${userId}\0${key.toUpperCase()}`, "utf8");
+}
+
+export function isEncryptedVaultValue(value: string): boolean {
+  return value.startsWith(ENVELOPE_PREFIX);
+}
+
+export function encryptVaultValueWithKey(
+  userId: string,
+  key: string,
+  value: string,
+  masterKey: string,
+): string {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  cipher.setAAD(aad(userId, key));
+  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+}
+
+export function decryptVaultValueWithKey(
+  userId: string,
+  key: string,
+  storedValue: string,
+  masterKey: string,
+): { value: string; legacyPlaintext: boolean } {
+  if (!isEncryptedVaultValue(storedValue)) {
+    return { value: storedValue, legacyPlaintext: true };
+  }
+
+  const encoded = storedValue.slice(ENVELOPE_PREFIX.length);
+  const [ivPart, ciphertextPart, tagPart, ...extra] = encoded.split(".");
+  if (!ivPart || ciphertextPart === undefined || !tagPart || extra.length > 0) {
+    throw new Error("Invalid encrypted vault value");
+  }
+
+  const iv = Buffer.from(ivPart, "base64url");
+  const ciphertext = Buffer.from(ciphertextPart, "base64url");
+  const tag = Buffer.from(tagPart, "base64url");
+  if (iv.length !== IV_BYTES || tag.length !== 16) {
+    throw new Error("Invalid encrypted vault value");
+  }
+
+  const decipher = createDecipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  decipher.setAAD(aad(userId, key));
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return { value: plaintext.toString("utf8"), legacyPlaintext: false };
+}

package/dist/runtime/src/storage/vault-crypto.ts

@@ -1,25 +1,11 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { VAULT_MASTER_KEY } from "#platform/config";
+import {
+  decryptVaultValueWithKey,
+  encryptVaultValueWithKey,
+  isEncryptedVaultValue,
+} from "#storage/vault-crypto-core";
 
-const ENVELOPE_PREFIX = "otium-vault:v1:";
-const IV_BYTES = 12;
-const KEY_BYTES = 32;
-
-function encryptionKey(masterKey = VAULT_MASTER_KEY): Buffer {
-  return createHash("sha256")
-    .update("otium-vault-value-v1\0", "utf8")
-    .update(masterKey, "utf8")
-    .digest()
-    .subarray(0, KEY_BYTES);
-}
-
-function aad(userId: string, key: string): Buffer {
-  return Buffer.from(`${userId}\0${key.toUpperCase()}`, "utf8");
-}
-
-export function isEncryptedVaultValue(value: string): boolean {
-  return value.startsWith(ENVELOPE_PREFIX);
-}
+export { isEncryptedVaultValue };
 
 /** Encrypt one vault row. The user/key binding prevents ciphertext row swapping. */
 export function encryptVaultValue(
@@ -28,12 +14,7 @@ export function encryptVaultValue(
   value: string,
   masterKey = VAULT_MASTER_KEY,
 ): string {
-  const iv = randomBytes(IV_BYTES);
-  const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
-  cipher.setAAD(aad(userId, key));
-  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+  return encryptVaultValueWithKey(userId, key, value, masterKey);
 }
 
 /**
@@ -46,26 +27,5 @@ export function decryptVaultValue(
   storedValue: string,
   masterKey = VAULT_MASTER_KEY,
 ): { value: string; legacyPlaintext: boolean } {
-  if (!isEncryptedVaultValue(storedValue)) {
-    return { value: storedValue, legacyPlaintext: true };
-  }
-
-  const encoded = storedValue.slice(ENVELOPE_PREFIX.length);
-  const [ivPart, ciphertextPart, tagPart, ...extra] = encoded.split(".");
-  if (!ivPart || ciphertextPart === undefined || !tagPart || extra.length > 0) {
-    throw new Error("Invalid encrypted vault value");
-  }
-
-  const iv = Buffer.from(ivPart, "base64url");
-  const ciphertext = Buffer.from(ciphertextPart, "base64url");
-  const tag = Buffer.from(tagPart, "base64url");
-  if (iv.length !== IV_BYTES || tag.length !== 16) {
-    throw new Error("Invalid encrypted vault value");
-  }
-
-  const decipher = createDecipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
-  decipher.setAAD(aad(userId, key));
-  decipher.setAuthTag(tag);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  return { value: plaintext.toString("utf8"), legacyPlaintext: false };
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
 }

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.2.0";
+export const NEGOTIUM_VERSION = "0.2.2";

package/dist/types/packages/core/src/storage/vault-crypto-core.d.ts

@@ -0,0 +1,6 @@
+export declare function isEncryptedVaultValue(value: string): boolean;
+export declare function encryptVaultValueWithKey(userId: string, key: string, value: string, masterKey: string): string;
+export declare function decryptVaultValueWithKey(userId: string, key: string, storedValue: string, masterKey: string): {
+    value: string;
+    legacyPlaintext: boolean;
+};

package/dist/types/packages/core/src/storage/vault-crypto.d.ts

@@ -1,4 +1,5 @@
-export declare function isEncryptedVaultValue(value: string): boolean;
+import { isEncryptedVaultValue } from "./vault-crypto-core";
+export { isEncryptedVaultValue };
 /** Encrypt one vault row. The user/key binding prevents ciphertext row swapping. */
 export declare function encryptVaultValue(userId: string, key: string, value: string, masterKey?: string): string;
 /**

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.2.0";
+export declare const NEGOTIUM_VERSION = "0.2.2";

package/dist/vault.js

@@ -329,12 +329,12 @@ if (isBun) {
   Database = NodeDatabase;
 }
 
-// ../../packages/core/src/storage/vault-crypto.ts
+// ../../packages/core/src/storage/vault-crypto-core.ts
 import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes2 } from "crypto";
 var ENVELOPE_PREFIX = "otium-vault:v1:";
 var IV_BYTES = 12;
 var KEY_BYTES = 32;
-function encryptionKey(masterKey = VAULT_MASTER_KEY) {
+function encryptionKey(masterKey) {
   return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
 }
 function aad(userId, key) {
@@ -343,7 +343,7 @@ function aad(userId, key) {
 function isEncryptedVaultValue(value) {
   return value.startsWith(ENVELOPE_PREFIX);
 }
-function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+function encryptVaultValueWithKey(userId, key, value, masterKey) {
   const iv = randomBytes2(IV_BYTES);
   const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
   cipher.setAAD(aad(userId, key));
@@ -351,7 +351,7 @@ function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
   const tag = cipher.getAuthTag();
   return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
 }
-function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+function decryptVaultValueWithKey(userId, key, storedValue, masterKey) {
   if (!isEncryptedVaultValue(storedValue)) {
     return { value: storedValue, legacyPlaintext: true };
   }
@@ -373,6 +373,14 @@ function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KE
   return { value: plaintext.toString("utf8"), legacyPlaintext: false };
 }
 
+// ../../packages/core/src/storage/vault-crypto.ts
+function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+  return encryptVaultValueWithKey(userId, key, value, masterKey);
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
+}
+
 // ../../packages/core/src/storage/vault.ts
 var vaultDb;
 var vaultMasterKey = VAULT_MASTER_KEY;
@@ -591,4 +599,4 @@ export {
   VAULT_DESCRIPTION_MAX_LENGTH
 };
 
-//# debugId=FB4F08028E1EE42864756E2164756E21
+//# debugId=D6C5CDDC478A1CCC64756E2164756E21