negotium 0.2.2 → 0.2.4

package/dist/hosted-agent.js

@@ -11,8 +11,7 @@ import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
 // ../../packages/core/src/agents/rollout/shared.ts
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { resolve as resolve2 } from "path";
 
 // ../../packages/core/src/platform/config.ts
 import { execFileSync } from "child_process";
@@ -302,18 +301,17 @@ var PDFTOTEXT_BIN = envText("PDFTOTEXT_BIN") ?? "pdftotext";
 var _envMaxTellDepth = Number.parseInt(process.env.MAX_TELL_DEPTH ?? "", 10);
 var MAX_TELL_DEPTH = Number.isInteger(_envMaxTellDepth) && _envMaxTellDepth > 0 ? _envMaxTellDepth : 20;
 function codexAuthFilePath() {
-  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), ".codex", "auth.json");
+  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
 }
 
 // ../../packages/core/src/agents/rollout/shared.ts
-var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
 var trustedWorkspaceRoots = [
   WORKSPACE_DIR,
   DM_WORKSPACE_DIR,
   SESSION_WORKSPACE_DIR,
   TOPIC_WORKSPACE_DIR
 ].map((root) => resolve2(root));
-var FIXTURES_DIR = join2(__dirname2, "..", "fixtures");
+var FIXTURES_DIR = resolve2(PROJECT_ROOT, "src", "agents", "fixtures");
 
 // ../../packages/core/src/platform/jsonl.ts
 import {
@@ -328,7 +326,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname2 } from "path";
 
 // ../../packages/core/src/platform/file-utils.ts
 import { unlinkSync } from "fs";
@@ -356,7 +354,7 @@ function parseJsonlText(raw) {
 }
 var LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 function writeJsonlFile(filePath, entries) {
-  const dir = dirname3(filePath);
+  const dir = dirname2(filePath);
   mkdirSync2(dir, { recursive: true });
   const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   const payload = `${entries.map((e) => JSON.stringify(e)).join(`
@@ -442,6 +440,7 @@ function deepMapStrings(value, fn) {
 
 // ../../packages/core/src/agents/execution-host.ts
 import { AsyncLocalStorage } from "async_hooks";
+import { dirname as dirname3 } from "path";
 
 // ../../packages/core/src/security/sensitive-path.ts
 import { realpathSync } from "fs";
@@ -1317,7 +1316,7 @@ function getMcpServersForQuery(opts) {
 
 // ../../packages/core/src/storage/vault.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 
 // ../../packages/core/src/storage/sqlite.ts
 var isBun = typeof process.versions.bun === "string";
@@ -1459,8 +1458,8 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const vaultDir = join3(dataDir, "vault");
-  const path = join3(vaultDir, "vault.db");
+  const vaultDir = join2(dataDir, "vault");
+  const path = join2(vaultDir, "vault.db");
   mkdirSync3(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
@@ -1484,13 +1483,19 @@ function decryptRow(userId, key, storedValue) {
   }
   return decoded.value;
 }
-function vaultListWithValues(userId) {
+function vaultListDecryptableValues(userId) {
   const rows = activeVaultDatabase().prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key").all(userId);
-  return rows.map((row) => ({
-    key: row.key,
-    description: row.description,
-    value: decryptRow(userId, row.key, row.value)
-  }));
+  const entries = [];
+  for (const row of rows) {
+    try {
+      entries.push({
+        key: row.key,
+        description: row.description,
+        value: decryptRow(userId, row.key, row.value)
+      });
+    } catch {}
+  }
+  return entries;
 }
 function vaultGetValue(userId, key) {
   const normalizedKey = normalizeVaultKey(key);
@@ -1498,10 +1503,12 @@ function vaultGetValue(userId, key) {
   return row ? decryptRow(userId, row.key, row.value) : undefined;
 }
 function vaultSubstituteDetailed(userId, text) {
-  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
+  const entries = new Map;
   const usedKeys = new Set;
   const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey) => {
     const key = normalizeVaultKey(rawKey);
+    if (!entries.has(key))
+      entries.set(key, vaultGetValue(userId, key));
     const value = entries.get(key);
     if (value === undefined)
       return match;
@@ -1522,7 +1529,7 @@ function encodedSecretForms(value) {
   return [...forms].sort((a, b) => b.length - a.length);
 }
 function redactVaultSecrets(userId, text) {
-  const candidates = vaultListWithValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
+  const candidates = vaultListDecryptableValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
   if (candidates.length === 0)
     return text;
   const candidatesByFirstCharacter = new Map;
@@ -1616,6 +1623,9 @@ function hostedClaudeCodeExecutablePath() {
 function hostedCodexAuthFilePath() {
   return activeHost().codexAuthFilePath();
 }
+function hostedCodexHomePath() {
+  return dirname3(hostedCodexAuthFilePath());
+}
 
 // ../../packages/core/src/media/file-events.ts
 function* extractFileEvents(text, source) {
@@ -2120,7 +2130,8 @@ async function* claudeProvider(opts) {
 // ../../packages/core/src/agents/codex-provider.ts
 import { execFileSync as execFileSync4 } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
-import { dirname as dirname6, isAbsolute, join as join6, relative, resolve as resolve5 } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname6, isAbsolute, join as join5, relative, resolve as resolve5 } from "path";
 import { Codex } from "@openai/codex-sdk";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
@@ -2139,10 +2150,10 @@ import {
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join4 } from "path";
+import { dirname as dirname4, join as join3 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.2.2";
+var NEGOTIUM_VERSION = "0.2.4";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 var moduleRequire = createRequire2(import.meta.url);
@@ -2161,7 +2172,7 @@ var SAFE_BUNDLED_CODEX_VERSION = BUNDLED_CODEX_VERSION.replace(/[^a-zA-Z0-9._-]/
 var NEGOTIUM_MODEL_CACHE = `negotium-models-cache-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 var NEGOTIUM_MODEL_CATALOG = `negotium-model-catalog-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 function codexCliScriptPath() {
-  return join4(dirname4(bundledCodexPackagePath), "bin", "codex.js");
+  return join3(dirname4(bundledCodexPackagePath), "bin", "codex.js");
 }
 function parseCodexModelCache(contents, sourcePath) {
   let parsed;
@@ -2202,7 +2213,7 @@ function writePrivateFileAtomic(path, contents) {
   }
 }
 function bundledCodexModelCachePath(authFilePath) {
-  return join4(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
+  return join3(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn3(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
@@ -2288,15 +2299,15 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
 }
 async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
   const sourceHome = dirname4(authFilePath);
-  const isolatedHome = mkdtempSync(join4(tmpdir(), "negotium-codex-models-"));
-  const isolatedCachePath = join4(isolatedHome, "models_cache.json");
+  const isolatedHome = mkdtempSync(join3(tmpdir(), "negotium-codex-models-"));
+  const isolatedCachePath = join3(isolatedHome, "models_cache.json");
   try {
-    const isolatedAuthPath = join4(isolatedHome, "auth.json");
+    const isolatedAuthPath = join3(isolatedHome, "auth.json");
     copyFileSync(authFilePath, isolatedAuthPath);
     chmodSync3(isolatedAuthPath, 384);
-    const sourceConfigPath = join4(sourceHome, "config.toml");
+    const sourceConfigPath = join3(sourceHome, "config.toml");
     if (existsSync3(sourceConfigPath)) {
-      const isolatedConfigPath = join4(isolatedHome, "config.toml");
+      const isolatedConfigPath = join3(isolatedHome, "config.toml");
       copyFileSync(sourceConfigPath, isolatedConfigPath);
       chmodSync3(isolatedConfigPath, 384);
     }
@@ -2317,7 +2328,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
     return configuredCachePath;
   }
   const bundledCachePath = bundledCodexModelCachePath(authFilePath);
-  const sharedCachePath = join4(codexHome, "models_cache.json");
+  const sharedCachePath = join3(codexHome, "models_cache.json");
   if (existsSync3(sharedCachePath)) {
     try {
       const shared = readCompatibleCodexModelCache(sharedCachePath);
@@ -2337,7 +2348,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
 }
 function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
   const codexHome = dirname4(authFilePath);
-  const outputPath = join4(codexHome, NEGOTIUM_MODEL_CATALOG);
+  const outputPath = join3(codexHome, NEGOTIUM_MODEL_CATALOG);
   const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
     if (!model || typeof model !== "object" || Array.isArray(model)) {
@@ -2572,10 +2583,9 @@ var killOwnedCodexTreesForShutdown = manager.killOwnedTreesForShutdown;
 
 // ../../packages/core/src/agents/rollout/codex.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { basename, dirname as dirname5, join as join5, resolve as resolve4 } from "path";
+import { basename, dirname as dirname5, join as join4, resolve as resolve4 } from "path";
 function codexSessionsDir() {
-  return join5(process.env.CODEX_HOME || join5(homedir2(), ".codex"), "sessions");
+  return join4(hostedCodexHomePath(), "sessions");
 }
 function canonicalFilePath(path) {
   const absolute = resolve4(path);
@@ -2583,7 +2593,7 @@ function canonicalFilePath(path) {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join5(realpathSync2(dirname5(absolute)), basename(absolute));
+      return join4(realpathSync2(dirname5(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -2772,19 +2782,19 @@ function latestCodexRolloutPath(threadId) {
   try {
     if (buckets) {
       for (const bucket of buckets) {
-        const dir = join5(sessionsDir, bucket);
+        const dir = join4(sessionsDir, bucket);
         if (!existsSync4(dir))
           continue;
         const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
         for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-          candidates.push(join5(dir, rel));
+          candidates.push(join4(dir, rel));
         }
       }
     }
     if (candidates.length === 0) {
       const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-        candidates.push(join5(sessionsDir, rel));
+        candidates.push(join4(sessionsDir, rel));
       }
     }
     return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
@@ -2922,7 +2932,7 @@ function codexMcpServerName(name) {
   return CODEX_MCP_SERVER_NAME_OVERRIDES[name] ?? name;
 }
 function globalCodexMcpServerNames(authFilePath) {
-  const configPath = join6(dirname6(authFilePath), "config.toml");
+  const configPath = join5(dirname6(authFilePath), "config.toml");
   if (!existsSync5(configPath))
     return [];
   try {
@@ -3283,13 +3293,15 @@ async function* codexProvider(opts) {
     resume: Boolean(opts.sessionId),
     mcpServerCount: Object.keys(codexMcpServers).length
   }, "codexProvider: starting turn");
+  const hostedCodexHome = hostedCodexHomePath();
+  const inheritedCodexHome = process.env.CODEX_HOME || join5(homedir2(), ".codex");
+  const codexEnvironment = scopedBrowserCapability || resolve5(hostedCodexHome) !== resolve5(inheritedCodexHome) ? {
+    ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
+    CODEX_HOME: hostedCodexHome,
+    ...scopedBrowserCapability ? { [CODEX_BROWSER_CAPABILITY_ENV]: scopedBrowserCapability } : {}
+  } : undefined;
   const codex = new Codex({
-    ...scopedBrowserCapability ? {
-      env: {
-        ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
-        [CODEX_BROWSER_CAPABILITY_ENV]: scopedBrowserCapability
-      }
-    } : {},
+    ...codexEnvironment ? { env: codexEnvironment } : {},
     config: {
       features: { multi_agent: false, multi_agent_v2: false, enable_fanout: false },
       model_catalog_json: codexModelCatalogPath,
@@ -3688,7 +3700,7 @@ function maestroProvider(opts) {
 // ../../packages/core/src/agents/claude-runtime-inspection.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname7, join as join7 } from "path";
+import { dirname as dirname7, join as join6 } from "path";
 var cached;
 function inspectBundledClaudeRuntime() {
   if (cached)
@@ -3696,8 +3708,8 @@ function inspectBundledClaudeRuntime() {
   try {
     const require2 = createRequire3(import.meta.url);
     const sdkDir = dirname7(require2.resolve("@anthropic-ai/claude-agent-sdk"));
-    const sdkPackage = JSON.parse(readFileSync7(join7(sdkDir, "package.json"), "utf8"));
-    const manifest = JSON.parse(readFileSync7(join7(sdkDir, "manifest.json"), "utf8"));
+    const sdkPackage = JSON.parse(readFileSync7(join6(sdkDir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync7(join6(sdkDir, "manifest.json"), "utf8"));
     const sdkVersion = typeof sdkPackage.version === "string" ? sdkPackage.version : "";
     const claudeCodeVersion = typeof manifest.version === "string" ? manifest.version : "";
     if (!sdkVersion || !claudeCodeVersion) {
@@ -3770,4 +3782,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=08D785C200DBAF5664756E2164756E21
+//# debugId=03F870923DEBEFF364756E2164756E21