negotium 0.2.19 → 0.2.20

package/dist/main.js

@@ -152,7 +152,7 @@ function browserRsMeetsMinimumVersion(candidate) {
   try {
     const output = execFileSync(candidate, ["--version"], {
       encoding: "utf8",
-      timeout: 2000,
+      timeout: BROWSER_RS_VERSION_PROBE_TIMEOUT_MS,
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
     const match = output.match(/^browser-rs (\d+)\.(\d+)\.(\d+)$/);
@@ -263,7 +263,7 @@ function resolveDefaultModel(agent, registryDefaultModel) {
 function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
 }
-var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.19", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", SNIPPETS_API_URL, BROWSER_RS_BIN, BASH_RS_VERSION = "v0.1.5", BASH_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, BASHRS_SPILL_ROOT, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
+var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.19", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_VERSION_PROBE_TIMEOUT_MS = 15000, SNIPPETS_API_URL, BROWSER_RS_BIN, BASH_RS_VERSION = "v0.1.5", BASH_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, BASHRS_SPILL_ROOT, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
 var init_config = __esm(() => {
   init_config_helpers();
   init_logger();
@@ -421,6 +421,225 @@ var init_sqlite = __esm(async () => {
   }
 });
 
+// ../../packages/core/src/storage/storage-host.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+function storageState() {
+  const holder = globalThis;
+  const existing = holder[STORAGE_HOST_STATE];
+  if (existing)
+    return existing;
+  const created = {
+    configuredHost: {},
+    fallbackDatabase: null,
+    fallbackDatabasePath: null,
+    frames: [],
+    schemaInitializers: [],
+    initializedSchemas: new WeakMap,
+    initializingDatabases: new WeakSet
+  };
+  Object.defineProperty(holder, STORAGE_HOST_STATE, {
+    value: created,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return created;
+}
+function envPath(name, fallback) {
+  const value = process.env[name]?.trim();
+  return resolve2(value || fallback);
+}
+function defaultStateDir() {
+  return envPath("NEGOTIUM_STATE_DIR", join2(homedir2(), ".negotium"));
+}
+function defaultDataDir() {
+  return envPath("NEGOTIUM_DATA_DIR", join2(defaultStateDir(), "data"));
+}
+function defaultLogDir() {
+  return envPath("NEGOTIUM_LOG_DIR", join2(defaultStateDir(), "logs"));
+}
+function defaultWorkspaceDir() {
+  return envPath("NEGOTIUM_WORKSPACE_DIR", join2(defaultStateDir(), "workspace"));
+}
+function defaultSessionAsksDir() {
+  const runDir = envPath("NEGOTIUM_RUN_DIR", join2(defaultStateDir(), "runtime"));
+  return join2(runDir, "session-asks");
+}
+function defaultSessionsDatabasePath() {
+  return envPath("SESSIONS_DB_PATH", join2(resolveStorageDataDir(), "sessions.db"));
+}
+function isSqliteBusy(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /database is (?:locked|busy)|SQLITE_(?:BUSY|LOCKED)/i.test(message);
+}
+function execWithBusyRetry(database, sql, timeoutMs = SQLITE_INIT_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    try {
+      database.exec(sql);
+      return;
+    } catch (error) {
+      if (!isSqliteBusy(error) || Date.now() >= deadline)
+        throw error;
+      Atomics.wait(SQLITE_INIT_SLEEP, 0, 0, Math.min(SQLITE_INIT_RETRY_MS, deadline - Date.now()));
+    }
+  }
+}
+function initializeDatabase(database) {
+  database.exec("PRAGMA busy_timeout = 5000");
+  execWithBusyRetry(database, "PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA foreign_keys = ON");
+  database.exec("PRAGMA wal_autocheckpoint = 1000");
+  try {
+    database.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  } catch {}
+}
+function defaultDatabase() {
+  const path = defaultSessionsDatabasePath();
+  const state = storageState();
+  if (state.fallbackDatabase && state.fallbackDatabasePath === path)
+    return state.fallbackDatabase;
+  if (state.fallbackDatabase)
+    state.fallbackDatabase.close();
+  mkdirSync2(dirname2(path), { recursive: true });
+  state.fallbackDatabase = new Database(path, { create: true });
+  state.fallbackDatabasePath = path;
+  initializeDatabase(state.fallbackDatabase);
+  return state.fallbackDatabase;
+}
+function resolveStorageDatabase() {
+  return storageState().configuredHost.database ?? defaultDatabase();
+}
+function resolveStorageDataDir() {
+  return storageState().configuredHost.dataDir ?? defaultDataDir();
+}
+function resolveStorageLogDir() {
+  return storageState().configuredHost.logDir ?? defaultLogDir();
+}
+function resolveStorageSessionAsksDir() {
+  return storageState().configuredHost.sessionAsksDir ?? defaultSessionAsksDir();
+}
+function resolveStorageWorkspaceDir() {
+  return storageState().configuredHost.workspaceDir ?? defaultWorkspaceDir();
+}
+function resolveStorageSharedWikiDir() {
+  return storageState().configuredHost.sharedWikiDir ?? join2(resolveStorageWorkspaceDir(), "wiki");
+}
+function resolveStorageUsersLogDir() {
+  return storageState().configuredHost.usersLogDir ?? join2(resolveStorageDataDir(), "users");
+}
+function normalizeStorageHostPatch(options) {
+  const patch = {};
+  if (options.database !== undefined) {
+    options.database.exec("PRAGMA foreign_keys = ON");
+    patch.database = options.database;
+  }
+  for (const key of STORAGE_PATH_KEYS) {
+    const value = options[key];
+    if (value === undefined)
+      continue;
+    if (!value.trim())
+      throw new TypeError(`${key} must not be empty`);
+    patch[key] = resolve2(value);
+  }
+  return Object.freeze(patch);
+}
+function refreshConfiguredHost() {
+  const state = storageState();
+  state.configuredHost = Object.freeze(Object.assign({}, ...state.frames.filter((frame) => frame.active).map((frame) => frame.patch)));
+}
+function configureStorageHost(options) {
+  const frame = { active: true, patch: normalizeStorageHostPatch(options) };
+  storageState().frames.push(frame);
+  refreshConfiguredHost();
+  return () => {
+    if (!frame.active)
+      return;
+    frame.active = false;
+    const frames = storageState().frames;
+    const index = frames.indexOf(frame);
+    if (index >= 0)
+      frames.splice(index, 1);
+    refreshConfiguredHost();
+  };
+}
+function resetStorageHost() {
+  const frames = storageState().frames;
+  for (const frame of frames)
+    frame.active = false;
+  frames.length = 0;
+  refreshConfiguredHost();
+}
+function closeStorageDatabase() {
+  const state = storageState();
+  if (!state.fallbackDatabase)
+    return;
+  state.fallbackDatabase.close();
+  state.fallbackDatabase = null;
+  state.fallbackDatabasePath = null;
+}
+function registerStorageSchemaInitializer(initialize, priority = 100) {
+  const initializers = storageState().schemaInitializers;
+  initializers.push({ initialize, priority });
+  initializers.sort((a, b) => a.priority - b.priority);
+}
+function ensureStorageSchemas(database = resolveStorageDatabase()) {
+  const state = storageState();
+  if (state.initializingDatabases.has(database))
+    return;
+  let initialized = state.initializedSchemas.get(database);
+  if (!initialized) {
+    initialized = new Set;
+    state.initializedSchemas.set(database, initialized);
+  }
+  state.initializingDatabases.add(database);
+  try {
+    for (const entry of state.schemaInitializers) {
+      if (initialized.has(entry.initialize))
+        continue;
+      initialized.add(entry.initialize);
+      try {
+        entry.initialize(database);
+      } catch (error) {
+        initialized.delete(entry.initialize);
+        throw error;
+      }
+    }
+  } finally {
+    state.initializingDatabases.delete(database);
+  }
+}
+var STORAGE_HOST_STATE, SQLITE_INIT_RETRY_MS = 25, SQLITE_INIT_TIMEOUT_MS = 5000, SQLITE_INIT_SLEEP, STORAGE_PATH_KEYS, internalStorageDatabase, storageDatabase;
+var init_storage_host = __esm(async () => {
+  await init_sqlite();
+  STORAGE_HOST_STATE = Symbol.for("negotium.storage-host.state.v1");
+  SQLITE_INIT_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  STORAGE_PATH_KEYS = [
+    "dataDir",
+    "logDir",
+    "sessionAsksDir",
+    "workspaceDir",
+    "sharedWikiDir",
+    "usersLogDir"
+  ];
+  internalStorageDatabase = new Proxy({}, {
+    get(_target, property) {
+      const database = resolveStorageDatabase();
+      ensureStorageSchemas(database);
+      const value = Reflect.get(database, property, database);
+      return typeof value === "function" ? value.bind(database) : value;
+    },
+    set(_target, property, value) {
+      const database = resolveStorageDatabase();
+      ensureStorageSchemas(database);
+      return Reflect.set(database, property, value, database);
+    }
+  });
+  storageDatabase = internalStorageDatabase;
+});
+
 // ../../packages/core/src/storage/vault-crypto-core.ts
 import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes2 } from "crypto";
 function encryptionKey(masterKey) {
@@ -477,8 +696,8 @@ var init_vault_crypto = __esm(() => {
 });
 
 // ../../packages/core/src/storage/vault.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join2 } from "path";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join3 } from "path";
 function initializeVaultDatabase(database) {
   database.exec("PRAGMA journal_mode = WAL");
   database.exec("PRAGMA busy_timeout = 5000");
@@ -513,17 +732,18 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const vaultDir = join2(dataDir, "vault");
-  const path = join2(vaultDir, "vault.db");
-  mkdirSync2(vaultDir, { recursive: true, mode: 448 });
+  const vaultDir = join3(dataDir, "vault");
+  const path = join3(vaultDir, "vault.db");
+  mkdirSync3(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
   initializeVaultDatabase(database);
   return database;
 }
 function activeVaultDatabase() {
-  if (!vaultDb)
-    vaultDb = openVaultDatabase(DATA_DIR);
+  if (!vaultDb) {
+    vaultDb = openVaultDatabase(resolveStorageDataDir());
+  }
   return vaultDb;
 }
 function configureVaultStorage(options) {
@@ -532,7 +752,7 @@ function configureVaultStorage(options) {
   }
   const previousDb = vaultDb;
   const previousMasterKey = vaultMasterKey;
-  const configuredDb = options.database ?? openVaultDatabase(options.dataDir ?? DATA_DIR);
+  const configuredDb = options.database ?? openVaultDatabase(options.dataDir ?? resolveStorageDataDir());
   if (options.database)
     initializeVaultDatabase(configuredDb);
   vaultDb = configuredDb;
@@ -687,7 +907,10 @@ var vaultDb, vaultMasterKey, VAULT_KEY_PATTERN, VAULT_VALUE_MIN_BYTES = 4, VAULT
 var init_vault = __esm(async () => {
   init_config();
   init_vault_crypto();
-  await init_sqlite();
+  await __promiseAll([
+    init_sqlite(),
+    init_storage_host()
+  ]);
   vaultMasterKey = VAULT_MASTER_KEY;
   VAULT_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;
   VAULT_VALUE_MAX_BYTES = 64 * 1024;
@@ -701,8 +924,8 @@ __export(exports_auth_check, {
 });
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir2, platform } from "os";
-import { join as join3 } from "path";
+import { homedir as homedir3, platform } from "os";
+import { join as join4 } from "path";
 function hasMaestroCredential(host, key, userId) {
   if (userId && host.getVaultValue(userId, key)?.trim())
     return true;
@@ -722,7 +945,7 @@ function checkAgentAuth(agent, host = defaultAgentAuthHost, userId) {
     case "claude": {
       if (host.environment.ANTHROPIC_API_KEY)
         return { ok: true };
-      const path = join3(host.homeDirectory(), ".claude", ".credentials.json");
+      const path = join4(host.homeDirectory(), ".claude", ".credentials.json");
       if (host.operatingSystem() === "darwin") {
         if (host.hasMacOsCredential("Claude Code-credentials") || host.exists(path)) {
           return { ok: true };
@@ -775,7 +998,7 @@ var init_auth_check = __esm(async () => {
     codexAuthFilePath,
     exists: existsSync2,
     environment: process.env,
-    homeDirectory: homedir2,
+    homeDirectory: homedir3,
     operatingSystem: platform,
     hasMacOsCredential(service) {
       try {
@@ -842,12 +1065,12 @@ function createCodexTreeManager(host, options = {}) {
     const previous = spawnChain;
     let release;
     let released = false;
-    spawnChain = new Promise((resolve2) => {
+    spawnChain = new Promise((resolve3) => {
       release = () => {
         if (released)
           return;
         released = true;
-        resolve2();
+        resolve3();
       };
     });
     await previous;
@@ -954,7 +1177,7 @@ function createCodexTreeManager(host, options = {}) {
       return;
     const deadline = Date.now() + Math.max(0, graceMs);
     while (Date.now() < deadline && hasSurvivors(plan.targets)) {
-      await new Promise((resolve2) => setTimeout(resolve2, Math.min(100, Math.max(1, deadline - Date.now()))));
+      await new Promise((resolve3) => setTimeout(resolve3, Math.min(100, Math.max(1, deadline - Date.now()))));
     }
     killStragglers(plan);
   }
@@ -1102,8 +1325,8 @@ function renderUserTurnBatch(messages) {
 }
 
 // ../../packages/core/src/agents/rollout/shared.ts
-import { mkdirSync as mkdirSync3 } from "fs";
-import { resolve as resolve2 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+import { resolve as resolve3 } from "path";
 function clone(obj) {
   return structuredClone(obj);
 }
@@ -1113,7 +1336,7 @@ function assertUuidLike(label, value) {
   }
 }
 function assertCwdInWorkspace(cwd) {
-  const abs = resolve2(cwd);
+  const abs = resolve3(cwd);
   const ok = trustedWorkspaceRoots.some((root) => abs === root || abs.startsWith(`${root}/`));
   if (!ok) {
     throw new Error(`rollout: cwd outside trusted workspace roots: ${cwd} (resolved=${abs})`);
@@ -1122,7 +1345,7 @@ function assertCwdInWorkspace(cwd) {
 function ensureCwdExists(cwd) {
   assertCwdInWorkspace(cwd);
   try {
-    mkdirSync3(cwd, { recursive: true });
+    mkdirSync4(cwd, { recursive: true });
   } catch (err) {
     logger.warn({ err, cwd }, "rollout: ensureCwdExists failed \u2014 caller should pre-create cwd");
   }
@@ -1243,8 +1466,8 @@ var init_shared = __esm(() => {
     DM_WORKSPACE_DIR,
     SESSION_WORKSPACE_DIR,
     TOPIC_WORKSPACE_DIR
-  ].map((root) => resolve2(root));
-  FIXTURES_DIR = resolve2(PROJECT_ROOT, "src", "agents", "fixtures");
+  ].map((root) => resolve3(root));
+  FIXTURES_DIR = resolve3(PROJECT_ROOT, "src", "agents", "fixtures");
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 });
 
@@ -1279,7 +1502,7 @@ import {
   appendFileSync,
   closeSync,
   fsyncSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   openSync,
   readFileSync as readFileSync2,
   renameSync,
@@ -1287,7 +1510,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3 } from "path";
 function readJsonlLines(filePath) {
   return readFileSync2(filePath, "utf-8").trim().split(`
 `).filter(Boolean);
@@ -1335,7 +1558,7 @@ function appendJsonlEntry(filePath, entry) {
 `);
 }
 function appendJsonlLine(filePath, line) {
-  mkdirSync4(dirname2(filePath), { recursive: true });
+  mkdirSync5(dirname3(filePath), { recursive: true });
   const lockPath = `${filePath}${LOCK_SUFFIX}`;
   const payload = line.endsWith(`
 `) ? line : `${line}
@@ -1366,8 +1589,8 @@ function appendJsonlLine(filePath, line) {
   }
 }
 function writeJsonlFile(filePath, entries) {
-  const dir = dirname2(filePath);
-  mkdirSync4(dir, { recursive: true });
+  const dir = dirname3(filePath);
+  mkdirSync5(dir, { recursive: true });
   const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   const payload = `${entries.map((e) => JSON.stringify(e)).join(`
 `)}
@@ -1425,12 +1648,12 @@ var init_jsonl = __esm(() => {
 // ../../packages/core/src/agents/rollout/claude.ts
 import { randomUUID } from "crypto";
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
 function loadClaudeAttachments() {
   if (_attachmentsCache)
     return _attachmentsCache;
-  const raw = readFileSync3(join4(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
+  const raw = readFileSync3(join5(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
   const lines = parseJsonlText(raw);
   if (lines.length < 2) {
     throw new Error(`loadClaudeAttachments: expected >=2 entries in claude-attachments.jsonl, got ${lines.length}`);
@@ -1531,8 +1754,8 @@ function writeClaudeRollout(opts) {
     });
     lastUuid = assistantUuid;
   }
-  const projectsDir = join4(homedir3(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
-  const path = join4(projectsDir, `${sessionId}.jsonl`);
+  const projectsDir = join5(homedir4(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
+  const path = join5(projectsDir, `${sessionId}.jsonl`);
   writeJsonlFile(path, lines);
   logger.info({ sessionId, path, pairs: pairs.length }, "writeClaudeRollout: synthetic rollout placed");
   return { sessionId, rolloutPath: path };
@@ -1545,9 +1768,9 @@ var init_claude = __esm(() => {
 });
 
 // ../../packages/core/src/agents/claude-registry.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readdirSync, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readdirSync, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 var ALIAS_MAP, VALID_ALIASES, VALID_EFFORTS, claudeRegistry, claudeRegistryOperations;
 var init_claude_registry = __esm(() => {
   init_claude();
@@ -1594,15 +1817,15 @@ var init_claude_registry = __esm(() => {
       const result = await forkSession(parentSessionId, {
         ...title ? { title } : {}
       });
-      const projectsRoot = join5(homedir4(), ".claude", "projects");
-      const destDir = join5(projectsRoot, encodeClaudeCwd(cwd));
-      const destPath = join5(destDir, `${result.sessionId}.jsonl`);
+      const projectsRoot = join6(homedir5(), ".claude", "projects");
+      const destDir = join6(projectsRoot, encodeClaudeCwd(cwd));
+      const destPath = join6(destDir, `${result.sessionId}.jsonl`);
       if (!existsSync4(destPath)) {
-        const sourcePath = readdirSync(projectsRoot).map((d) => join5(projectsRoot, d, `${result.sessionId}.jsonl`)).find((p) => existsSync4(p));
+        const sourcePath = readdirSync(projectsRoot).map((d) => join6(projectsRoot, d, `${result.sessionId}.jsonl`)).find((p) => existsSync4(p));
         if (!sourcePath) {
           throw new Error(`claude forkSession: fork rollout ${result.sessionId}.jsonl not found under ${projectsRoot}`);
         }
-        mkdirSync5(destDir, { recursive: true });
+        mkdirSync6(destDir, { recursive: true });
         renameSync2(sourcePath, destPath);
       }
       return {
@@ -1611,10 +1834,10 @@ var init_claude_registry = __esm(() => {
       };
     },
     async cleanupRollouts({ cwd, sessionIds }) {
-      const projectsDir = join5(homedir4(), ".claude", "projects", encodeClaudeCwd(cwd));
+      const projectsDir = join6(homedir5(), ".claude", "projects", encodeClaudeCwd(cwd));
       const failures = [];
       for (const sid of sessionIds) {
-        const path = join5(projectsDir, `${sid}.jsonl`);
+        const path = join6(projectsDir, `${sid}.jsonl`);
         try {
           unlinkSync3(path);
         } catch (e) {
@@ -1636,7 +1859,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.2.19";
+var NEGOTIUM_VERSION = "0.2.20";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn } from "child_process";
@@ -1654,7 +1877,7 @@ import {
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join6 } from "path";
+import { dirname as dirname4, join as join7 } from "path";
 function readPackageVersion(packageJsonPath) {
   const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
   if (typeof parsed.version !== "string" || !parsed.version.trim()) {
@@ -1663,7 +1886,7 @@ function readPackageVersion(packageJsonPath) {
   return parsed.version;
 }
 function codexCliScriptPath() {
-  return join6(dirname3(bundledCodexPackagePath), "bin", "codex.js");
+  return join7(dirname4(bundledCodexPackagePath), "bin", "codex.js");
 }
 function parseCodexModelCache(contents, sourcePath) {
   let parsed;
@@ -1704,14 +1927,14 @@ function writePrivateFileAtomic(path, contents) {
   }
 }
 function bundledCodexModelCachePath(authFilePath) {
-  return join6(dirname3(authFilePath), NEGOTIUM_MODEL_CACHE);
+  return join7(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
     env: { ...process.env, CODEX_HOME: codexHome },
     stdio: ["pipe", "pipe", "pipe"]
   });
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve4, reject) => {
     let settled = false;
     let stdoutBuffer = "";
     let stderr = "";
@@ -1730,7 +1953,7 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
       else if (!existsSync5(cachePath))
         reject(new Error("Codex did not create its model cache"));
       else
-        resolve3();
+        resolve4();
     };
     const send = (message) => {
       child.stdin.write(`${JSON.stringify(message)}
@@ -1789,16 +2012,16 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
   });
 }
 async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
-  const sourceHome = dirname3(authFilePath);
-  const isolatedHome = mkdtempSync(join6(tmpdir(), "negotium-codex-models-"));
-  const isolatedCachePath = join6(isolatedHome, "models_cache.json");
+  const sourceHome = dirname4(authFilePath);
+  const isolatedHome = mkdtempSync(join7(tmpdir(), "negotium-codex-models-"));
+  const isolatedCachePath = join7(isolatedHome, "models_cache.json");
   try {
-    const isolatedAuthPath = join6(isolatedHome, "auth.json");
+    const isolatedAuthPath = join7(isolatedHome, "auth.json");
     copyFileSync(authFilePath, isolatedAuthPath);
     chmodSync3(isolatedAuthPath, 384);
-    const sourceConfigPath = join6(sourceHome, "config.toml");
+    const sourceConfigPath = join7(sourceHome, "config.toml");
     if (existsSync5(sourceConfigPath)) {
-      const isolatedConfigPath = join6(isolatedHome, "config.toml");
+      const isolatedConfigPath = join7(isolatedHome, "config.toml");
       copyFileSync(sourceConfigPath, isolatedConfigPath);
       chmodSync3(isolatedConfigPath, 384);
     }
@@ -1809,7 +2032,7 @@ async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
   }
 }
 async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexModelCache) {
-  const codexHome = dirname3(authFilePath);
+  const codexHome = dirname4(authFilePath);
   const configuredCachePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE;
   if (configuredCachePath) {
     if (!existsSync5(configuredCachePath)) {
@@ -1819,7 +2042,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
     return configuredCachePath;
   }
   const bundledCachePath = bundledCodexModelCachePath(authFilePath);
-  const sharedCachePath = join6(codexHome, "models_cache.json");
+  const sharedCachePath = join7(codexHome, "models_cache.json");
   if (existsSync5(sharedCachePath)) {
     try {
       const shared = readCompatibleCodexModelCache(sharedCachePath);
@@ -1838,8 +2061,8 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
   return bundledCachePath;
 }
 function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
-  const codexHome = dirname3(authFilePath);
-  const outputPath = join6(codexHome, NEGOTIUM_MODEL_CATALOG);
+  const codexHome = dirname4(authFilePath);
+  const outputPath = join7(codexHome, NEGOTIUM_MODEL_CATALOG);
   const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
     if (!model || typeof model !== "object" || Array.isArray(model)) {
@@ -1866,9 +2089,9 @@ var init_codex_native_multi_agent = __esm(() => {
 
 // ../../packages/core/src/security/sensitive-path.ts
 import { realpathSync } from "fs";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 function isSensitivePath(filePath) {
-  const normalized = resolve3(filePath);
+  const normalized = resolve4(filePath);
   if (SENSITIVE_PATH_PATTERNS.some((p) => p.test(normalized)))
     return true;
   try {
@@ -2388,12 +2611,12 @@ function createBackgroundBashManager(options = {}) {
     usedPorts.clear();
     knownContexts.clear();
     const deadline = now() + 3000;
-    await Promise.all(entries.map((instance) => new Promise((resolve4) => {
+    await Promise.all(entries.map((instance) => new Promise((resolve5) => {
       if (instance.process.exitCode !== null || instance.process.killed)
-        return resolve4();
-      instance.process.once("exit", resolve4);
-      instance.process.once("error", resolve4);
-      const timer = setTimeout(resolve4, Math.max(0, deadline - now()));
+        return resolve5();
+      instance.process.once("exit", resolve5);
+      instance.process.once("error", resolve5);
+      const timer = setTimeout(resolve5, Math.max(0, deadline - now()));
       timer.unref?.();
     })));
   }
@@ -3006,7 +3229,7 @@ var init_mcp_config = __esm(() => {
 
 // ../../packages/core/src/agents/execution-host.ts
 import { AsyncLocalStorage } from "async_hooks";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 function activeHost() {
   const scoped = scopedHost.getStore();
   if (scoped)
@@ -3041,7 +3264,7 @@ function hostedCodexAuthFilePath() {
   return activeHost().codexAuthFilePath();
 }
 function hostedCodexHomePath() {
-  return dirname4(hostedCodexAuthFilePath());
+  return dirname5(hostedCodexAuthFilePath());
 }
 var defaultHost, hostRegistrations, scopedHost;
 var init_execution_host = __esm(async () => {
@@ -3065,14 +3288,14 @@ var init_execution_host = __esm(async () => {
 // ../../packages/core/src/agents/rollout/codex.ts
 import { randomBytes as randomBytes4 } from "crypto";
 import { existsSync as existsSync6, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync5 } from "fs";
-import { basename, dirname as dirname5, join as join7, resolve as resolve4 } from "path";
+import { basename, dirname as dirname6, join as join8, resolve as resolve5 } from "path";
 function codexSessionsDir() {
-  return join7(hostedCodexHomePath(), "sessions");
+  return join8(hostedCodexHomePath(), "sessions");
 }
 function loadCodexShell() {
   if (_shellCache)
     return _shellCache;
-  const raw = readFileSync5(join7(FIXTURES_DIR, "codex-shell.jsonl"), "utf8");
+  const raw = readFileSync5(join8(FIXTURES_DIR, "codex-shell.jsonl"), "utf8");
   const lines = parseJsonlText(raw);
   if (lines.length < 5) {
     throw new Error(`loadCodexShell: expected >=5 entries in codex-shell.jsonl, got ${lines.length}`);
@@ -3139,16 +3362,16 @@ function codexRolloutPath(threadId, fallback) {
   const hh = String(createdAt.getHours()).padStart(2, "0");
   const min = String(createdAt.getMinutes()).padStart(2, "0");
   const ss = String(createdAt.getSeconds()).padStart(2, "0");
-  const dir = join7(codexSessionsDir(), yyyy, mm, dd);
-  return join7(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
+  const dir = join8(codexSessionsDir(), yyyy, mm, dd);
+  return join8(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
 }
 function canonicalFilePath(path) {
-  const absolute = resolve4(path);
+  const absolute = resolve5(path);
   try {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join7(realpathSync2(dirname5(absolute)), basename(absolute));
+      return join8(realpathSync2(dirname6(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -3378,19 +3601,19 @@ function latestCodexRolloutPath(threadId) {
   try {
     if (buckets) {
       for (const bucket of buckets) {
-        const dir = join7(sessionsDir, bucket);
+        const dir = join8(sessionsDir, bucket);
         if (!existsSync6(dir))
           continue;
         const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
         for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-          candidates.push(join7(dir, rel));
+          candidates.push(join8(dir, rel));
         }
       }
     }
     if (candidates.length === 0) {
       const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-        candidates.push(join7(sessionsDir, rel));
+        candidates.push(join8(sessionsDir, rel));
       }
     }
     return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
@@ -3511,13 +3734,13 @@ function sweepPriorRolloutsForThread(threadId) {
     return;
   }
   for (const bucket of buckets) {
-    const dir = join7(sessionsDir, bucket);
+    const dir = join8(sessionsDir, bucket);
     if (!existsSync6(dir))
       continue;
     try {
       const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-        const fullPath = join7(dir, rel);
+        const fullPath = join8(dir, rel);
         try {
           unlinkSync5(fullPath);
         } catch (e) {
@@ -3535,7 +3758,7 @@ function sweepPriorRolloutsFullTree(threadId, sessionsDir) {
   try {
     const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
     for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-      const fullPath = join7(sessionsDir, rel);
+      const fullPath = join8(sessionsDir, rel);
       try {
         unlinkSync5(fullPath);
       } catch (e) {
@@ -3601,7 +3824,7 @@ import { spawn as spawn3 } from "child_process";
 function createCodexAppServerForker(host) {
   return async (parentThreadId) => {
     const child = host.spawnServer();
-    return await new Promise((resolve5, reject) => {
+    return await new Promise((resolve6, reject) => {
       let settled = false;
       let stdoutBuffer = "";
       let stderr = "";
@@ -3618,7 +3841,7 @@ function createCodexAppServerForker(host) {
         if (error)
           reject(error);
         else if (result)
-          resolve5(result);
+          resolve6(result);
         else
           reject(new Error("Codex thread fork returned no result"));
       };
@@ -3715,7 +3938,7 @@ var init_codex_app_server = __esm(async () => {
 
 // ../../packages/core/src/agents/codex-registry.ts
 import { existsSync as existsSync7, unlinkSync as unlinkSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var VALID_EFFORTS2, codexRegistry, codexRegistryOperations;
 var init_codex_registry = __esm(async () => {
   init_logger();
@@ -3760,7 +3983,7 @@ var init_codex_registry = __esm(async () => {
     async cleanupRollouts({ sessionIds }) {
       if (sessionIds.length === 0)
         return;
-      const sessionsDir = join8(hostedCodexHomePath(), "sessions");
+      const sessionsDir = join9(hostedCodexHomePath(), "sessions");
       if (!existsSync7(sessionsDir))
         return;
       const failures = [];
@@ -3768,7 +3991,7 @@ var init_codex_registry = __esm(async () => {
         try {
           const glob = new Bun.Glob(`**/rollout-*-${tid}.jsonl`);
           for await (const rel of glob.scan({ cwd: sessionsDir, onlyFiles: true })) {
-            const path = join8(sessionsDir, rel);
+            const path = join9(sessionsDir, rel);
             try {
               unlinkSync6(path);
             } catch (e) {
@@ -3792,17 +4015,17 @@ var init_codex_registry = __esm(async () => {
 
 // ../../packages/core/src/agents/maestro-registry.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join9, resolve as resolve5 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join10, resolve as resolve6 } from "path";
 function maestroSessionsDir() {
-  return join9(process.env.MAESTRO_DATA_DIR ? resolve5(process.env.MAESTRO_DATA_DIR) : join9(homedir5(), ".maestro"), "sessions");
+  return join10(process.env.MAESTRO_DATA_DIR ? resolve6(process.env.MAESTRO_DATA_DIR) : join10(homedir6(), ".maestro"), "sessions");
 }
 function maestroSessionPath(sessionId) {
-  return join9(maestroSessionsDir(), `${sessionId}.jsonl`);
+  return join10(maestroSessionsDir(), `${sessionId}.jsonl`);
 }
 function maestroActiveSessionPath(sessionId) {
-  return join9(maestroSessionsDir(), `${sessionId}.active.jsonl`);
+  return join10(maestroSessionsDir(), `${sessionId}.active.jsonl`);
 }
 function existingCreatedAt(path) {
   if (!existsSync8(path))
@@ -3824,7 +4047,7 @@ function writeRollout(options) {
   assertUuidLike("sessionId", sessionId);
   ensureCwdExists(options.cwd);
   const path = maestroSessionPath(sessionId);
-  mkdirSync6(maestroSessionsDir(), { recursive: true });
+  mkdirSync7(maestroSessionsDir(), { recursive: true });
   const messages = extractChatPairs(options.entries).flatMap((pair) => [
     { role: "user", content: nonEmptyTurnText(pair.userText) },
     { role: "assistant", content: nonEmptyTurnText(pair.assistantText) }
@@ -4026,200 +4249,6 @@ function sanitizeId(id) {
   return id.replace(/[^a-zA-Z0-9_-]/g, "_") || "_";
 }
 
-// ../../packages/core/src/storage/storage-host.ts
-import { mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join10, resolve as resolve6 } from "path";
-function envPath(name, fallback) {
-  const value = process.env[name]?.trim();
-  return resolve6(value || fallback);
-}
-function defaultStateDir() {
-  return envPath("NEGOTIUM_STATE_DIR", join10(homedir6(), ".negotium"));
-}
-function defaultDataDir() {
-  return envPath("NEGOTIUM_DATA_DIR", join10(defaultStateDir(), "data"));
-}
-function defaultLogDir() {
-  return envPath("NEGOTIUM_LOG_DIR", join10(defaultStateDir(), "logs"));
-}
-function defaultWorkspaceDir() {
-  return envPath("NEGOTIUM_WORKSPACE_DIR", join10(defaultStateDir(), "workspace"));
-}
-function defaultSessionAsksDir() {
-  const runDir = envPath("NEGOTIUM_RUN_DIR", join10(defaultStateDir(), "runtime"));
-  return join10(runDir, "session-asks");
-}
-function defaultSessionsDatabasePath() {
-  return envPath("SESSIONS_DB_PATH", join10(resolveStorageDataDir(), "sessions.db"));
-}
-function isSqliteBusy(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return /database is (?:locked|busy)|SQLITE_(?:BUSY|LOCKED)/i.test(message);
-}
-function execWithBusyRetry(database, sql, timeoutMs = SQLITE_INIT_TIMEOUT_MS) {
-  const deadline = Date.now() + timeoutMs;
-  while (true) {
-    try {
-      database.exec(sql);
-      return;
-    } catch (error) {
-      if (!isSqliteBusy(error) || Date.now() >= deadline)
-        throw error;
-      Atomics.wait(SQLITE_INIT_SLEEP, 0, 0, Math.min(SQLITE_INIT_RETRY_MS, deadline - Date.now()));
-    }
-  }
-}
-function initializeDatabase(database) {
-  database.exec("PRAGMA busy_timeout = 5000");
-  execWithBusyRetry(database, "PRAGMA journal_mode = WAL");
-  database.exec("PRAGMA foreign_keys = ON");
-  database.exec("PRAGMA wal_autocheckpoint = 1000");
-  try {
-    database.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-  } catch {}
-}
-function defaultDatabase() {
-  const path = defaultSessionsDatabasePath();
-  if (fallbackDatabase && fallbackDatabasePath === path)
-    return fallbackDatabase;
-  if (fallbackDatabase)
-    fallbackDatabase.close();
-  mkdirSync7(dirname6(path), { recursive: true });
-  fallbackDatabase = new Database(path, { create: true });
-  fallbackDatabasePath = path;
-  initializeDatabase(fallbackDatabase);
-  return fallbackDatabase;
-}
-function resolveStorageDatabase() {
-  return configuredHost.database ?? defaultDatabase();
-}
-function resolveStorageDataDir() {
-  return configuredHost.dataDir ?? defaultDataDir();
-}
-function resolveStorageLogDir() {
-  return configuredHost.logDir ?? defaultLogDir();
-}
-function resolveStorageSessionAsksDir() {
-  return configuredHost.sessionAsksDir ?? defaultSessionAsksDir();
-}
-function resolveStorageWorkspaceDir() {
-  return configuredHost.workspaceDir ?? defaultWorkspaceDir();
-}
-function resolveStorageSharedWikiDir() {
-  return configuredHost.sharedWikiDir ?? join10(resolveStorageWorkspaceDir(), "wiki");
-}
-function resolveStorageUsersLogDir() {
-  return configuredHost.usersLogDir ?? join10(resolveStorageDataDir(), "users");
-}
-function normalizeStorageHostPatch(options) {
-  const patch = {};
-  if (options.database !== undefined) {
-    options.database.exec("PRAGMA foreign_keys = ON");
-    patch.database = options.database;
-  }
-  for (const key of STORAGE_PATH_KEYS) {
-    const value = options[key];
-    if (value === undefined)
-      continue;
-    if (!value.trim())
-      throw new TypeError(`${key} must not be empty`);
-    patch[key] = resolve6(value);
-  }
-  return Object.freeze(patch);
-}
-function refreshConfiguredHost() {
-  configuredHost = Object.freeze(Object.assign({}, ...storageHostFrames.filter((frame) => frame.active).map((frame) => frame.patch)));
-}
-function configureStorageHost(options) {
-  const frame = { active: true, patch: normalizeStorageHostPatch(options) };
-  storageHostFrames.push(frame);
-  refreshConfiguredHost();
-  return () => {
-    if (!frame.active)
-      return;
-    frame.active = false;
-    const index = storageHostFrames.indexOf(frame);
-    if (index >= 0)
-      storageHostFrames.splice(index, 1);
-    refreshConfiguredHost();
-  };
-}
-function resetStorageHost() {
-  for (const frame of storageHostFrames)
-    frame.active = false;
-  storageHostFrames.length = 0;
-  refreshConfiguredHost();
-}
-function closeStorageDatabase() {
-  if (!fallbackDatabase)
-    return;
-  fallbackDatabase.close();
-  fallbackDatabase = null;
-  fallbackDatabasePath = null;
-}
-function registerStorageSchemaInitializer(initialize, priority = 100) {
-  schemaInitializers.push({ initialize, priority });
-  schemaInitializers.sort((a, b) => a.priority - b.priority);
-}
-function ensureStorageSchemas(database = resolveStorageDatabase()) {
-  if (initializingDatabases.has(database))
-    return;
-  let initialized = initializedSchemas.get(database);
-  if (!initialized) {
-    initialized = new Set;
-    initializedSchemas.set(database, initialized);
-  }
-  initializingDatabases.add(database);
-  try {
-    for (const entry of schemaInitializers) {
-      if (initialized.has(entry.initialize))
-        continue;
-      initialized.add(entry.initialize);
-      try {
-        entry.initialize(database);
-      } catch (error) {
-        initialized.delete(entry.initialize);
-        throw error;
-      }
-    }
-  } finally {
-    initializingDatabases.delete(database);
-  }
-}
-var configuredHost, fallbackDatabase = null, fallbackDatabasePath = null, storageHostFrames, schemaInitializers, initializedSchemas, initializingDatabases, SQLITE_INIT_RETRY_MS = 25, SQLITE_INIT_TIMEOUT_MS = 5000, SQLITE_INIT_SLEEP, STORAGE_PATH_KEYS, internalStorageDatabase, storageDatabase;
-var init_storage_host = __esm(async () => {
-  await init_sqlite();
-  configuredHost = {};
-  storageHostFrames = [];
-  schemaInitializers = [];
-  initializedSchemas = new WeakMap;
-  initializingDatabases = new WeakSet;
-  SQLITE_INIT_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
-  STORAGE_PATH_KEYS = [
-    "dataDir",
-    "logDir",
-    "sessionAsksDir",
-    "workspaceDir",
-    "sharedWikiDir",
-    "usersLogDir"
-  ];
-  internalStorageDatabase = new Proxy({}, {
-    get(_target, property) {
-      const database = resolveStorageDatabase();
-      ensureStorageSchemas(database);
-      const value = Reflect.get(database, property, database);
-      return typeof value === "function" ? value.bind(database) : value;
-    },
-    set(_target, property, value) {
-      const database = resolveStorageDatabase();
-      ensureStorageSchemas(database);
-      return Reflect.set(database, property, value, database);
-    }
-  });
-  storageDatabase = internalStorageDatabase;
-});
-
 // ../../packages/core/src/storage/tasks.ts
 var exports_tasks = {};
 __export(exports_tasks, {
@@ -6745,7 +6774,10 @@ function listRecentRuntimeEventsForTopic(topicId, limit = 300) {
 }
 var RUNTIME_EVENT_TYPES, types;
 var init_runtime_events = __esm(async () => {
-  await init_forum_db();
+  await __promiseAll([
+    init_forum_db(),
+    init_storage_host()
+  ]);
   RUNTIME_EVENT_TYPES = [
     "message",
     "message-updated",
@@ -6754,26 +6786,28 @@ var init_runtime_events = __esm(async () => {
     "topic-updated",
     "topic-deleted"
   ];
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS runtime_events (
-    seq INTEGER PRIMARY KEY AUTOINCREMENT,
-    source_id TEXT NOT NULL,
-    event_type TEXT NOT NULL CHECK (
-      event_type IN (
-        'message',
-        'message-updated',
-        'ai-status',
-        'topic-created',
-        'topic-updated',
-        'topic-deleted'
-      )
-    ),
-    topic_id TEXT NOT NULL,
-    payload_json TEXT NOT NULL,
-    created_at TEXT NOT NULL
-  )
-`);
-  db.exec("CREATE INDEX IF NOT EXISTS idx_runtime_events_topic_seq ON runtime_events(topic_id, seq)");
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS runtime_events (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      source_id TEXT NOT NULL,
+      event_type TEXT NOT NULL CHECK (
+        event_type IN (
+          'message',
+          'message-updated',
+          'ai-status',
+          'topic-created',
+          'topic-updated',
+          'topic-deleted'
+        )
+      ),
+      topic_id TEXT NOT NULL,
+      payload_json TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    )
+  `);
+    database.exec("CREATE INDEX IF NOT EXISTS idx_runtime_events_topic_seq ON runtime_events(topic_id, seq)");
+  });
   types = new Set(RUNTIME_EVENT_TYPES);
 });
 
@@ -6934,18 +6968,19 @@ class SqliteRuntimeBus {
   }
 }
 function runtimeBus() {
+  if (!current)
+    current = new SqliteRuntimeBus;
   return current;
 }
 function setRuntimeBus(bus) {
   current = bus;
 }
-var current, WsHub;
+var current = null, WsHub;
 var init_bus = __esm(async () => {
   await init_runtime_events();
-  current = new SqliteRuntimeBus;
   WsHub = {
     get() {
-      return current;
+      return runtimeBus();
     }
   };
 });
@@ -7479,6 +7514,7 @@ var exports_api_topics = {};
 __export(exports_api_topics, {
   upsertTopic: () => upsertTopic,
   setTopicSessionId: () => setTopicSessionId,
+  setTopicAccessModes: () => setTopicAccessModes,
   setApiTopicAgent: () => setApiTopicAgent,
   revokeSubagentTellTarget: () => revokeSubagentTellTarget,
   reparentTopicChildren: () => reparentTopicChildren,
@@ -7945,6 +7981,16 @@ function upsertTopic(t) {
     }
   })();
 }
+function setTopicAccessModes(topicIds, accessMode) {
+  if (topicIds.length === 0)
+    return;
+  const normalized = normalizeTopicAccessMode(accessMode);
+  db.transaction(() => {
+    const update = db.query("UPDATE api_topics SET access_mode = ? WHERE id = ?");
+    for (const topicId of topicIds)
+      update.run(normalized, topicId);
+  })();
+}
 function listTopics() {
   const rows = db.query("SELECT * FROM api_topics ORDER BY last_message_at DESC").all();
   const participants = getAllTopicParticipants();
@@ -9525,32 +9571,35 @@ var init_self_schedules = __esm(async () => {
   await __promiseAll([
     init_forum_db(),
     init_runtime_leases(),
-    init_runtime_topic_state()
+    init_runtime_topic_state(),
+    init_storage_host()
   ]);
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS runtime_self_schedules (
-    id TEXT PRIMARY KEY,
-    topic_id TEXT NOT NULL,
-    user_id TEXT NOT NULL,
-    message TEXT NOT NULL,
-    deliver_at INTEGER NOT NULL,
-    created_at INTEGER NOT NULL,
-    updated_at INTEGER NOT NULL,
-    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'running')),
-    claimed_by TEXT,
-    claimed_at INTEGER,
-    running_query_id TEXT
-  )
-`);
-  db.exec(`
-  CREATE UNIQUE INDEX IF NOT EXISTS idx_runtime_self_schedules_one_pending
-  ON runtime_self_schedules(topic_id)
-  WHERE status = 'pending'
-`);
-  db.exec(`
-  CREATE INDEX IF NOT EXISTS idx_runtime_self_schedules_due
-  ON runtime_self_schedules(status, deliver_at)
-`);
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS runtime_self_schedules (
+      id TEXT PRIMARY KEY,
+      topic_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      message TEXT NOT NULL,
+      deliver_at INTEGER NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'running')),
+      claimed_by TEXT,
+      claimed_at INTEGER,
+      running_query_id TEXT
+    )
+  `);
+    database.exec(`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_runtime_self_schedules_one_pending
+    ON runtime_self_schedules(topic_id)
+    WHERE status = 'pending'
+  `);
+    database.exec(`
+    CREATE INDEX IF NOT EXISTS idx_runtime_self_schedules_due
+    ON runtime_self_schedules(status, deliver_at)
+  `);
+  });
 });
 
 // ../../packages/core/src/topics/links.ts
@@ -10240,15 +10289,20 @@ function deleteBrowserProfile(ownerId, rawName) {
 }
 var DEFAULT_BROWSER_PROFILE = "default";
 var init_browser_profiles = __esm(async () => {
-  await init_forum_db();
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS browser_profiles (
-    owner_id TEXT NOT NULL,
-    name TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    PRIMARY KEY (owner_id, name)
-  )
-`);
+  await __promiseAll([
+    init_forum_db(),
+    init_storage_host()
+  ]);
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS browser_profiles (
+      owner_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (owner_id, name)
+    )
+  `);
+  });
 });
 
 // ../../packages/core/src/platform/playwright/manager.ts
@@ -11977,9 +12031,9 @@ function formatArchiverBytes(bytes) {
 function formatArchiverTool(name, input) {
   const params = Object.entries(input).map(([key, value]) => {
     const rendered = typeof value === "string" ? value : JSON.stringify(value);
-    return `${key}: ${sessionText(rendered ?? "")}`;
+    return `${key}: ${summarizeDisplayText(sessionText(rendered ?? ""))}`;
   }).join(", ");
-  return `${name}${params ? `(${params})` : ""}`;
+  return summarizeDisplayText(`${name}${params ? `(${params})` : ""}`);
 }
 function createArchiverRuntime(host) {
   const activeSessions = new Map;
@@ -12289,6 +12343,7 @@ function listActiveMemoryArchiverSessions(userId) {
 }
 var MAX_BRIEF_ENTRIES = 8, defaultArchiverRuntime;
 var init_archiver = __esm(async () => {
+  init_tool_format();
   init_config();
   init_logger();
   init_builders();
@@ -13096,7 +13151,7 @@ function detailedToolStep(payload) {
   const label = compactToolLabel(String(payload.label ?? name));
   if (shortName === "ask_session" || shortName === "tell_session") {
     const target = typeof input.to === "string" && input.to.trim() ? input.to.trim() : "session";
-    const msg = typeof input.message === "string" ? text(input.message) : "";
+    const msg = typeof input.message === "string" ? summarizeDisplayText(text(input.message)) : "";
     const action = shortName === "ask_session" ? "Ask" : "Tell";
     return `${action} ${target}${msg ? ` \u2014 ${msg}` : ""}`;
   }
@@ -13122,22 +13177,22 @@ function detailedToolStep(payload) {
     return `${action} file`;
   }
   if (shortName === "grep" || shortName === "glob") {
-    const pattern = typeof input.pattern === "string" ? input.pattern : "";
+    const pattern = typeof input.pattern === "string" ? summarizeDisplayText(text(input.pattern)) : "";
     const action = shortName === "grep" ? "Grep" : "Glob";
     if (pattern)
-      return `${action} '${text(pattern)}'${path ? ` in ${path}` : ""}`;
+      return `${action} '${pattern}'${path ? ` in ${path}` : ""}`;
     if (path)
       return `${action} ${path}`;
   }
   if (shortName === "bash") {
-    const cmd = typeof input.command === "string" ? text(input.command) : "";
+    const cmd = typeof input.command === "string" ? summarizeDisplayText(text(input.command)) : "";
     return cmd ? `Bash: ${cmd}` : "Bash";
   }
   if (shortName === "webfetch" || shortName === "url_fetch") {
-    const url = typeof input.url === "string" ? text(input.url) : "";
+    const url = typeof input.url === "string" ? summarizeDisplayText(text(input.url)) : "";
     return url ? `Fetch ${url}` : "WebFetch";
   }
-  return label;
+  return summarizeDisplayText(label);
 }
 function backgroundSessionProgress(topicId, queryId) {
   let status = "Running";
@@ -13165,7 +13220,7 @@ function backgroundSessionProgress(topicId, queryId) {
       step = text(payload.content);
     else if (kind === "tool_output") {
       const toolName = toolNames.get(text(payload.toolUseId)) ?? "Tool";
-      step = payload.isError ? `${toolName} failed: ${text(payload.content) || "unknown error"}` : `${toolName} result \xB7 ${byteSize(payload.content)}`;
+      step = payload.isError ? `${toolName} failed: ${summarizeDisplayText(text(payload.content)) || "unknown error"}` : `${toolName} result \xB7 ${byteSize(payload.content)}`;
     } else if (kind === "ai_done") {
       const usage = payload.usage && typeof payload.usage === "object" ? payload.usage : undefined;
       const input = typeof usage?.input === "number" ? usage.input.toLocaleString() : "";
@@ -13230,6 +13285,7 @@ function listBackgroundSessionsForUser(userId) {
 }
 var providers, transientSessions;
 var init_background_sessions = __esm(async () => {
+  init_tool_format();
   init_background_session_policy();
   await __promiseAll([
     init_archiver(),
@@ -13535,10 +13591,11 @@ var init_runtime_turn_requests = __esm(async () => {
   await __promiseAll([
     init_forum_db(),
     init_runtime_leases(),
-    init_runtime_topic_state()
+    init_runtime_topic_state(),
+    init_storage_host()
   ]);
   REQUEST_CLAIM_STALE_MS = TURN_LEASE_STALE_MS;
-  ensureRuntimeUserTurnRequestsSchema(db);
+  registerStorageSchemaInitializer((database) => ensureRuntimeUserTurnRequestsSchema(database));
 });
 
 // ../../packages/core/src/topics/session.ts
@@ -15800,19 +15857,22 @@ var pendingAsks, MAX_ASK_AGE_MS;
 var init_ask_callbacks = __esm(async () => {
   await __promiseAll([
     init_forum_db(),
-    init_session_asks()
+    init_session_asks(),
+    init_storage_host()
   ]);
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS remote_ask_callbacks (
-    target_query_id TEXT PRIMARY KEY,
-    request_id TEXT NOT NULL,
-    node_name TEXT NOT NULL,
-    node_cell_id TEXT NOT NULL,
-    topic_id TEXT NOT NULL,
-    user_id TEXT NOT NULL,
-    created_at INTEGER NOT NULL
-  )
-`);
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS remote_ask_callbacks (
+      target_query_id TEXT PRIMARY KEY,
+      request_id TEXT NOT NULL,
+      node_name TEXT NOT NULL,
+      node_cell_id TEXT NOT NULL,
+      topic_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    )
+  `);
+  });
   pendingAsks = new Map;
   MAX_ASK_AGE_MS = PENDING_ASK_TTL_MS;
 });
@@ -16034,30 +16094,35 @@ paint();document.body.appendChild(b)}
 if(document.readyState==="loading")document.addEventListener("DOMContentLoaded",init);else init()})();
 </script>`;
 var init_visual_store = __esm(async () => {
-  await init_forum_db();
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS api_topic_visuals (
-    id         INTEGER PRIMARY KEY AUTOINCREMENT,
-    topic_id   TEXT    NOT NULL,
-    html       TEXT    NOT NULL,
-    title      TEXT,
-    created_at INTEGER NOT NULL,
-    kind       TEXT    NOT NULL DEFAULT 'html',
-    source     TEXT,
-    file_id    TEXT,
-    mime_type  TEXT,
-    media_token TEXT
-  );
-  CREATE INDEX IF NOT EXISTS idx_api_topic_visuals_topic
-    ON api_topic_visuals(topic_id, created_at DESC);
-
-  CREATE TABLE IF NOT EXISTS api_topic_visual_views (
-    topic_id  TEXT NOT NULL,
-    user_id   TEXT NOT NULL,
-    visual_id INTEGER NOT NULL,
-    PRIMARY KEY (topic_id, user_id)
-  );
-`);
+  await __promiseAll([
+    init_forum_db(),
+    init_storage_host()
+  ]);
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS api_topic_visuals (
+      id         INTEGER PRIMARY KEY AUTOINCREMENT,
+      topic_id   TEXT    NOT NULL,
+      html       TEXT    NOT NULL,
+      title      TEXT,
+      created_at INTEGER NOT NULL,
+      kind       TEXT    NOT NULL DEFAULT 'html',
+      source     TEXT,
+      file_id    TEXT,
+      mime_type  TEXT,
+      media_token TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_api_topic_visuals_topic
+      ON api_topic_visuals(topic_id, created_at DESC);
+  
+    CREATE TABLE IF NOT EXISTS api_topic_visual_views (
+      topic_id  TEXT NOT NULL,
+      user_id   TEXT NOT NULL,
+      visual_id INTEGER NOT NULL,
+      PRIMARY KEY (topic_id, user_id)
+    );
+  `);
+  });
   for (const statement of [
     "ALTER TABLE api_topic_visuals ADD COLUMN kind TEXT NOT NULL DEFAULT 'html'",
     "ALTER TABLE api_topic_visuals ADD COLUMN source TEXT",
@@ -20168,20 +20233,26 @@ function recordRuntimeGatewaySubmission(submission) {
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(submission.clientMessageId, submission.requestId, submission.topicId, submission.messageId, submission.userId, submission.createdAt, submission.ackCursor, submission.messageCursor, submission.payloadHash ?? null);
 }
 var init_runtime_gateway_submissions = __esm(async () => {
-  await init_forum_db();
-  db.exec(`
-  CREATE TABLE IF NOT EXISTS runtime_gateway_submissions (
-    client_message_id TEXT PRIMARY KEY,
-    request_id TEXT NOT NULL UNIQUE,
-    topic_id TEXT NOT NULL,
-    message_id TEXT NOT NULL,
-    user_id TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    ack_cursor INTEGER NOT NULL DEFAULT 0,
-    message_cursor INTEGER NOT NULL DEFAULT 0,
-    payload_hash TEXT
-  )
-`);
+  await __promiseAll([
+    init_forum_db(),
+    init_storage_host()
+  ]);
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS runtime_gateway_submissions (
+      client_message_id TEXT PRIMARY KEY,
+      request_id TEXT NOT NULL UNIQUE,
+      topic_id TEXT NOT NULL,
+      message_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      ack_cursor INTEGER NOT NULL DEFAULT 0,
+      message_cursor INTEGER NOT NULL DEFAULT 0,
+      payload_hash TEXT
+    )
+  `);
+    database.exec("CREATE INDEX IF NOT EXISTS idx_runtime_gateway_submissions_topic ON runtime_gateway_submissions(topic_id)");
+  });
   try {
     db.exec("ALTER TABLE runtime_gateway_submissions ADD COLUMN ack_cursor INTEGER NOT NULL DEFAULT 0");
   } catch {}
@@ -20191,7 +20262,6 @@ var init_runtime_gateway_submissions = __esm(async () => {
   try {
     db.exec("ALTER TABLE runtime_gateway_submissions ADD COLUMN message_cursor INTEGER NOT NULL DEFAULT 0");
   } catch {}
-  db.exec("CREATE INDEX IF NOT EXISTS idx_runtime_gateway_submissions_topic ON runtime_gateway_submissions(topic_id)");
 });
 
 // ../../packages/core/src/application/submit-runtime-gateway-turn.ts
@@ -20364,6 +20434,33 @@ var init_submit_user_message = __esm(async () => {
 });
 
 // ../../packages/core/src/application/switch-topic-access-mode.ts
+function collectSubagentDescendants(rootTopicId) {
+  const all = listTopics();
+  const childrenByParent = new Map;
+  for (const topic of all) {
+    if (!topic.isSubagent || !topic.parentTopicId)
+      continue;
+    const siblings = childrenByParent.get(topic.parentTopicId);
+    if (siblings)
+      siblings.push(topic);
+    else
+      childrenByParent.set(topic.parentTopicId, [topic]);
+  }
+  const descendants = [];
+  const seen = new Set([rootTopicId]);
+  const queue = [rootTopicId];
+  while (queue.length > 0) {
+    const parentId = queue.shift();
+    for (const child of childrenByParent.get(parentId) ?? []) {
+      if (seen.has(child.id))
+        continue;
+      seen.add(child.id);
+      descendants.push(child);
+      queue.push(child.id);
+    }
+  }
+  return descendants;
+}
 function switchTopicAccessMode(params) {
   const topic = getTopic(params.topicId);
   if (!topic)
@@ -20371,13 +20468,32 @@ function switchTopicAccessMode(params) {
   const owner = topic.participants.some((participant) => participant.userId === params.userId && participant.role === "owner");
   if (!owner)
     return { ok: false, error: "Only topic owners can change privacy" };
-  topic.accessMode = params.accessMode;
-  upsertTopic(topic);
-  WsHub.get().broadcastTopicUpdated(topic.id);
+  if (topic.isSubagent) {
+    return {
+      ok: false,
+      error: "Subagent rooms inherit privacy from their parent topic"
+    };
+  }
+  const descendants = collectSubagentDescendants(topic.id);
+  const changed = [topic, ...descendants].filter((candidate) => (candidate.accessMode ?? "private") !== params.accessMode);
+  if (changed.length === 0) {
+    return {
+      ok: true,
+      accessMode: params.accessMode,
+      text: params.accessMode === "shared" ? `"${topic.title}" is already public to the connected Otium Hub.` : `"${topic.title}" is already private to this worker.`,
+      topicIds: []
+    };
+  }
+  setTopicAccessModes(changed.map((candidate) => candidate.id), params.accessMode);
+  for (const candidate of changed)
+    WsHub.get().broadcastTopicUpdated(candidate.id);
+  const subagentCount = changed.filter((candidate) => candidate.id !== topic.id).length;
+  const suffix = subagentCount > 0 ? ` (${subagentCount} subagent room${subagentCount === 1 ? "" : "s"} updated)` : "";
   return {
     ok: true,
     accessMode: params.accessMode,
-    text: params.accessMode === "shared" ? `"${topic.title}" is public to the connected Otium Hub.` : `"${topic.title}" is private to this worker.`
+    topicIds: changed.map((candidate) => candidate.id),
+    text: (params.accessMode === "shared" ? `"${topic.title}" is public to the connected Otium Hub.` : `"${topic.title}" is private to this worker.`) + suffix
   };
 }
 var init_switch_topic_access_mode = __esm(async () => {
@@ -27509,6 +27625,7 @@ __export(exports_storage_public, {
   setTopicAgentAndSession: () => setTopicAgentAndSession,
   setTopicAgentAndClearSession: () => setTopicAgentAndClearSession,
   setTopicAgent: () => setTopicAgent,
+  setTopicAccessModes: () => setTopicAccessModes,
   setSessionForTopic: () => setSessionForTopic,
   setLastShownConfig: () => setLastShownConfig,
   setGlobalAiName: () => setGlobalAiName,
@@ -32474,7 +32591,7 @@ function setTopics(state, topics, preferredTitle) {
     activeTopicId: nextActive,
     scrollOffset: nextActive === state.activeTopicId ? state.scrollOffset : 0,
     askChoiceIndex: nextActive === state.activeTopicId ? state.askChoiceIndex : 0,
-    topicPickerIndex: state.overlay === "topics" ? pickedTopicIndex : Math.max(0, orderedTopics.findIndex((topic) => topic.id === nextActive)),
+    topicPickerIndex: state.overlay === "topics" || state.overlay === "confirm-share" ? pickedTopicIndex : Math.max(0, orderedTopics.findIndex((topic) => topic.id === nextActive)),
     topicPickerBackgroundId: state.topicPickerBackgroundId
   });
 }
@@ -34136,14 +34253,16 @@ function subagentTreePrefix(topic, topics, rootTopicId) {
 function topicPickerHints(topicPickerRoot) {
   const exit = topicPickerRoot ? "Esc/Ctrl-C exit" : "Esc close \xB7 Ctrl-C exit; work continues";
   const shortExit = topicPickerRoot ? "Esc/Ctrl-C exit" : "Esc close";
-  return [
+  const candidates = [
+    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 Ctrl-P public/private \xB7 ${exit}`,
+    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 Ctrl-P public/private \xB7 ${shortExit}`,
     `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 ${exit}`,
-    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 ${shortExit}`,
-    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N/D \xB7 ${shortExit}`,
-    "\u2191\u2193 \xB7 Enter \xB7 type to filter \xB7 Ctrl-N/D",
-    "type to filter \xB7 Ctrl-N/D",
-    "Ctrl-N/D"
+    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N/D/P \xB7 ${shortExit}`,
+    "\u2191\u2193 \xB7 Enter \xB7 type to filter \xB7 Ctrl-N/D/P",
+    "type to filter \xB7 Ctrl-N/D/P",
+    "Ctrl-N/D/P"
   ];
+  return [...new Set(candidates)].sort((a, b) => displayWidth(b) - displayWidth(a));
 }
 function topicOverlayCursor(state, width, bodyHeight) {
   if (state.overlay !== "topics")
@@ -34499,6 +34618,34 @@ function conversationLines(state, width, height, animationFrame = 0, nowMs = ter
       line("  Press y to delete or n to cancel.", { fg: theme.amber })
     ].slice(0, height);
   }
+  if (state.overlay === "confirm-share") {
+    const topic = state.topics.find((candidate) => candidate.id === state.pendingShareTopicId);
+    const subagents = (() => {
+      if (!topic)
+        return 0;
+      const reached = new Set([topic.id]);
+      for (;; ) {
+        const next = state.topics.filter((candidate) => candidate.isSubagent && !reached.has(candidate.id) && candidate.parentTopicId !== undefined && reached.has(candidate.parentTopicId));
+        if (next.length === 0)
+          break;
+        for (const candidate of next)
+          reached.add(candidate.id);
+      }
+      return reached.size - 1;
+    })();
+    const scope = subagents > 0 ? `  Its ${subagents} subagent room${subagents === 1 ? "" : "s"} become public too.` : "  Subagent rooms spawned from it will be public too.";
+    return [
+      line(""),
+      line(`  Make \u201C${topic?.title ?? "this topic"}\u201D public?`, {
+        fg: theme.amber,
+        bold: true
+      }),
+      line(""),
+      line("  The transcript becomes visible to the connected Otium Hub."),
+      line(scope),
+      line("  Press y to publish or n to cancel.", { fg: theme.amber })
+    ].slice(0, height);
+  }
   const all = conversationContentLines(state, width, animationFrame, nowMs, includeTasks);
   const { contentHeight, maxOffset, offset } = conversationViewport(all.length, height, state.scrollOffset);
   const end = all.length - offset;
@@ -34766,6 +34913,9 @@ function footerHintText(state) {
     }
     return state.topicPickerRoot ? ["Esc/Ctrl-C exit  ", "Esc exit  "] : ["Esc close \xB7 Ctrl-C exit; work continues  ", "Esc close \xB7 Ctrl-C exit  ", "Esc  "];
   }
+  if (state.overlay === "confirm-share") {
+    return ["Y make public \xB7 N cancel  ", "Y/N  "];
+  }
   if (state.overlay === "background-session") {
     return [
       "wheel/PgUp/PgDn scroll \xB7 Esc back \xB7 read-only  ",
@@ -37722,6 +37872,16 @@ class TerminalApp {
       }
       return;
     }
+    if (this.#state.overlay === "confirm-share") {
+      const key = chunk.toLowerCase();
+      if (CONFIRM_KEYS.has(key))
+        this.#confirmTopicShare();
+      else if (CANCEL_KEYS.has(key) || chunk === "\x1B") {
+        this.#state = { ...this.#state, overlay: "topics", pendingShareTopicId: undefined };
+        this.#queueRender();
+      }
+      return;
+    }
     if (this.#state.overlay === "background-session") {
       if (chunk === "\x1B") {
         this.#state = { ...this.#state, overlay: "topics" };
@@ -38030,6 +38190,22 @@ class TerminalApp {
       this.#queueRender();
       return;
     }
+    if (chunk === TOGGLE_ACCESS_MODE_KEY) {
+      const topic = pickedTopic(this.#state);
+      if (topic) {
+        this.#requestAccessModeToggle(topic);
+        return;
+      }
+      if (!this.#state.topicPickerBackgroundId)
+        return;
+      this.#state = {
+        ...this.#state,
+        notice: "Background sessions are read-only",
+        noticeLevel: "warn"
+      };
+      this.#queueRender();
+      return;
+    }
     if (FILTER_BACKSPACE_KEYS.has(chunk)) {
       if (this.#state.topicFilter.length === 0)
         return;
@@ -38472,6 +38648,65 @@ class TerminalApp {
     };
     this.#queueRender();
   }
+  async#requestAccessModeToggle(topic) {
+    if (topic.kind !== "agent") {
+      this.#state = {
+        ...this.#state,
+        notice: `${topic.kind === "manager" ? "Manager" : "Channel"} topics cannot be published`,
+        noticeLevel: "warn"
+      };
+      this.#queueRender();
+      return;
+    }
+    if (topic.isSubagent) {
+      this.#state = {
+        ...this.#state,
+        notice: "Subagent rooms inherit privacy from their parent topic",
+        noticeLevel: "warn"
+      };
+      this.#queueRender();
+      return;
+    }
+    if (topic.accessMode === "shared") {
+      await this.#applyAccessMode(topic, "private");
+      return;
+    }
+    this.#state = {
+      ...this.#state,
+      overlay: "confirm-share",
+      pendingShareTopicId: topic.id
+    };
+    this.#queueRender();
+  }
+  async#confirmTopicShare() {
+    const topic = this.#state.topics.find((candidate) => candidate.id === this.#state.pendingShareTopicId);
+    this.#state = { ...this.#state, overlay: "topics", pendingShareTopicId: undefined };
+    if (!topic) {
+      this.#state = {
+        ...this.#state,
+        notice: "That topic no longer exists",
+        noticeLevel: "warn"
+      };
+      this.#queueRender();
+      return;
+    }
+    await this.#applyAccessMode(topic, "shared");
+  }
+  async#applyAccessMode(topic, accessMode) {
+    this.#state = { ...this.#state, overlay: "topics" };
+    try {
+      const notice = await this.#client.setAccessMode(topic, accessMode);
+      await this.#refreshTopics();
+      this.#state = { ...this.#state, notice, noticeLevel: "success" };
+    } catch (error2) {
+      this.#state = {
+        ...this.#state,
+        notice: error2 instanceof Error ? error2.message : String(error2),
+        noticeLevel: "error"
+      };
+    }
+    this.#queueRender();
+  }
   #requestTopicDelete(topic) {
     if (!topic)
       return;
@@ -38750,6 +38985,7 @@ class TerminalApp {
         ...this.#state,
         overlay: null,
         pendingDeleteTopicId: undefined,
+        pendingShareTopicId: undefined,
         creatingTopic: false,
         notice: "Input cleared",
         noticeLevel: "info"
@@ -38812,7 +39048,7 @@ class TerminalApp {
       await this.#client.stop();
   }
 }
-var KITTY_KEYBOARD_PUSH = "\x1B[>1u", KITTY_KEYBOARD_POP = "\x1B[<u", CANVAS_RGB, ENTER_ALT_SCREEN, EXIT_ALT_SCREEN, ABORT_ENTER_ALT_SCREEN, NEW_TOPIC_KEY = "\x0E", DELETE_TOPIC_KEY = "\x04", FILTER_BACKSPACE_KEYS, CONFIRM_KEYS, CANCEL_KEYS, INPUT_CARRY_FLUSH_MS = 15;
+var KITTY_KEYBOARD_PUSH = "\x1B[>1u", KITTY_KEYBOARD_POP = "\x1B[<u", CANVAS_RGB, ENTER_ALT_SCREEN, EXIT_ALT_SCREEN, ABORT_ENTER_ALT_SCREEN, NEW_TOPIC_KEY = "\x0E", DELETE_TOPIC_KEY = "\x04", TOGGLE_ACCESS_MODE_KEY = "\x10", FILTER_BACKSPACE_KEYS, CONFIRM_KEYS, CANCEL_KEYS, INPUT_CARRY_FLUSH_MS = 15;
 var init_app = __esm(async () => {
   init_color_depth();
   init_commands();
@@ -44460,8 +44696,13 @@ function shareOtiumTopic(options) {
   if (!owned.ok)
     return owned;
   if (!isTopicShared(owned.topic)) {
-    upsertTopic({ ...owned.topic, accessMode: "shared" });
-    WsHub.get().broadcastTopicUpdated(owned.topic.id);
+    const switched = switchTopicAccessMode({
+      topicId: options.localTopicId,
+      userId: options.userId,
+      accessMode: "shared"
+    });
+    if (!switched.ok)
+      return { ok: false, error: switched.error, status: 409 };
   }
   return bindOtiumTopic(options);
 }
@@ -44471,8 +44712,13 @@ function setOtiumTopicPrivate(options) {
     return owned;
   const removedBindings = unbindSharedPeerSessionsForLocalTopic(options.localTopicId);
   if (isTopicShared(owned.topic)) {
-    upsertTopic({ ...owned.topic, accessMode: "private" });
-    WsHub.get().broadcastTopicUpdated(owned.topic.id);
+    const switched = switchTopicAccessMode({
+      topicId: options.localTopicId,
+      userId: options.userId,
+      accessMode: "private"
+    });
+    if (!switched.ok)
+      return { ok: false, error: switched.error, status: 409 };
   }
   return { ok: true, localTopicId: options.localTopicId, removedBindings };
 }
@@ -46915,4 +47161,4 @@ switch (command) {
   }
 }
 
-//# debugId=1F2F931DB2BD421464756E2164756E21
+//# debugId=69B455239128A0A264756E2164756E21