negotium 0.2.3 → 0.2.4

package/dist/hosted-agent.js

@@ -301,7 +301,7 @@ var PDFTOTEXT_BIN = envText("PDFTOTEXT_BIN") ?? "pdftotext";
 var _envMaxTellDepth = Number.parseInt(process.env.MAX_TELL_DEPTH ?? "", 10);
 var MAX_TELL_DEPTH = Number.isInteger(_envMaxTellDepth) && _envMaxTellDepth > 0 ? _envMaxTellDepth : 20;
 function codexAuthFilePath() {
-  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), ".codex", "auth.json");
+  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
 }
 
 // ../../packages/core/src/agents/rollout/shared.ts
@@ -440,6 +440,7 @@ function deepMapStrings(value, fn) {
 
 // ../../packages/core/src/agents/execution-host.ts
 import { AsyncLocalStorage } from "async_hooks";
+import { dirname as dirname3 } from "path";
 
 // ../../packages/core/src/security/sensitive-path.ts
 import { realpathSync } from "fs";
@@ -1482,13 +1483,19 @@ function decryptRow(userId, key, storedValue) {
   }
   return decoded.value;
 }
-function vaultListWithValues(userId) {
+function vaultListDecryptableValues(userId) {
   const rows = activeVaultDatabase().prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key").all(userId);
-  return rows.map((row) => ({
-    key: row.key,
-    description: row.description,
-    value: decryptRow(userId, row.key, row.value)
-  }));
+  const entries = [];
+  for (const row of rows) {
+    try {
+      entries.push({
+        key: row.key,
+        description: row.description,
+        value: decryptRow(userId, row.key, row.value)
+      });
+    } catch {}
+  }
+  return entries;
 }
 function vaultGetValue(userId, key) {
   const normalizedKey = normalizeVaultKey(key);
@@ -1496,10 +1503,12 @@ function vaultGetValue(userId, key) {
   return row ? decryptRow(userId, row.key, row.value) : undefined;
 }
 function vaultSubstituteDetailed(userId, text) {
-  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
+  const entries = new Map;
   const usedKeys = new Set;
   const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey) => {
     const key = normalizeVaultKey(rawKey);
+    if (!entries.has(key))
+      entries.set(key, vaultGetValue(userId, key));
     const value = entries.get(key);
     if (value === undefined)
       return match;
@@ -1520,7 +1529,7 @@ function encodedSecretForms(value) {
   return [...forms].sort((a, b) => b.length - a.length);
 }
 function redactVaultSecrets(userId, text) {
-  const candidates = vaultListWithValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
+  const candidates = vaultListDecryptableValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
   if (candidates.length === 0)
     return text;
   const candidatesByFirstCharacter = new Map;
@@ -1614,6 +1623,9 @@ function hostedClaudeCodeExecutablePath() {
 function hostedCodexAuthFilePath() {
   return activeHost().codexAuthFilePath();
 }
+function hostedCodexHomePath() {
+  return dirname3(hostedCodexAuthFilePath());
+}
 
 // ../../packages/core/src/media/file-events.ts
 function* extractFileEvents(text, source) {
@@ -2118,7 +2130,8 @@ async function* claudeProvider(opts) {
 // ../../packages/core/src/agents/codex-provider.ts
 import { execFileSync as execFileSync4 } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
-import { dirname as dirname5, isAbsolute, join as join5, relative, resolve as resolve5 } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname6, isAbsolute, join as join5, relative, resolve as resolve5 } from "path";
 import { Codex } from "@openai/codex-sdk";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
@@ -2137,10 +2150,10 @@ import {
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname4, join as join3 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.2.3";
+var NEGOTIUM_VERSION = "0.2.4";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 var moduleRequire = createRequire2(import.meta.url);
@@ -2159,7 +2172,7 @@ var SAFE_BUNDLED_CODEX_VERSION = BUNDLED_CODEX_VERSION.replace(/[^a-zA-Z0-9._-]/
 var NEGOTIUM_MODEL_CACHE = `negotium-models-cache-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 var NEGOTIUM_MODEL_CATALOG = `negotium-model-catalog-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 function codexCliScriptPath() {
-  return join3(dirname3(bundledCodexPackagePath), "bin", "codex.js");
+  return join3(dirname4(bundledCodexPackagePath), "bin", "codex.js");
 }
 function parseCodexModelCache(contents, sourcePath) {
   let parsed;
@@ -2200,7 +2213,7 @@ function writePrivateFileAtomic(path, contents) {
   }
 }
 function bundledCodexModelCachePath(authFilePath) {
-  return join3(dirname3(authFilePath), NEGOTIUM_MODEL_CACHE);
+  return join3(dirname4(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn3(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
@@ -2285,7 +2298,7 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
   });
 }
 async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
-  const sourceHome = dirname3(authFilePath);
+  const sourceHome = dirname4(authFilePath);
   const isolatedHome = mkdtempSync(join3(tmpdir(), "negotium-codex-models-"));
   const isolatedCachePath = join3(isolatedHome, "models_cache.json");
   try {
@@ -2305,7 +2318,7 @@ async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
   }
 }
 async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexModelCache) {
-  const codexHome = dirname3(authFilePath);
+  const codexHome = dirname4(authFilePath);
   const configuredCachePath = process.env.NEGOTIUM_CODEX_MODELS_CACHE_FILE;
   if (configuredCachePath) {
     if (!existsSync3(configuredCachePath)) {
@@ -2334,7 +2347,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
   return bundledCachePath;
 }
 function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
-  const codexHome = dirname3(authFilePath);
+  const codexHome = dirname4(authFilePath);
   const outputPath = join3(codexHome, NEGOTIUM_MODEL_CATALOG);
   const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
@@ -2570,10 +2583,9 @@ var killOwnedCodexTreesForShutdown = manager.killOwnedTreesForShutdown;
 
 // ../../packages/core/src/agents/rollout/codex.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { basename, dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+import { basename, dirname as dirname5, join as join4, resolve as resolve4 } from "path";
 function codexSessionsDir() {
-  return join4(process.env.CODEX_HOME || join4(homedir2(), ".codex"), "sessions");
+  return join4(hostedCodexHomePath(), "sessions");
 }
 function canonicalFilePath(path) {
   const absolute = resolve4(path);
@@ -2581,7 +2593,7 @@ function canonicalFilePath(path) {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join4(realpathSync2(dirname4(absolute)), basename(absolute));
+      return join4(realpathSync2(dirname5(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -2920,7 +2932,7 @@ function codexMcpServerName(name) {
   return CODEX_MCP_SERVER_NAME_OVERRIDES[name] ?? name;
 }
 function globalCodexMcpServerNames(authFilePath) {
-  const configPath = join5(dirname5(authFilePath), "config.toml");
+  const configPath = join5(dirname6(authFilePath), "config.toml");
   if (!existsSync5(configPath))
     return [];
   try {
@@ -3281,13 +3293,15 @@ async function* codexProvider(opts) {
     resume: Boolean(opts.sessionId),
     mcpServerCount: Object.keys(codexMcpServers).length
   }, "codexProvider: starting turn");
+  const hostedCodexHome = hostedCodexHomePath();
+  const inheritedCodexHome = process.env.CODEX_HOME || join5(homedir2(), ".codex");
+  const codexEnvironment = scopedBrowserCapability || resolve5(hostedCodexHome) !== resolve5(inheritedCodexHome) ? {
+    ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
+    CODEX_HOME: hostedCodexHome,
+    ...scopedBrowserCapability ? { [CODEX_BROWSER_CAPABILITY_ENV]: scopedBrowserCapability } : {}
+  } : undefined;
   const codex = new Codex({
-    ...scopedBrowserCapability ? {
-      env: {
-        ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
-        [CODEX_BROWSER_CAPABILITY_ENV]: scopedBrowserCapability
-      }
-    } : {},
+    ...codexEnvironment ? { env: codexEnvironment } : {},
     config: {
       features: { multi_agent: false, multi_agent_v2: false, enable_fanout: false },
       model_catalog_json: codexModelCatalogPath,
@@ -3686,14 +3700,14 @@ function maestroProvider(opts) {
 // ../../packages/core/src/agents/claude-runtime-inspection.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname6, join as join6 } from "path";
+import { dirname as dirname7, join as join6 } from "path";
 var cached;
 function inspectBundledClaudeRuntime() {
   if (cached)
     return cached;
   try {
     const require2 = createRequire3(import.meta.url);
-    const sdkDir = dirname6(require2.resolve("@anthropic-ai/claude-agent-sdk"));
+    const sdkDir = dirname7(require2.resolve("@anthropic-ai/claude-agent-sdk"));
     const sdkPackage = JSON.parse(readFileSync7(join6(sdkDir, "package.json"), "utf8"));
     const manifest = JSON.parse(readFileSync7(join6(sdkDir, "manifest.json"), "utf8"));
     const sdkVersion = typeof sdkPackage.version === "string" ? sdkPackage.version : "";
@@ -3768,4 +3782,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=1CBD65157B0A833464756E2164756E21
+//# debugId=03F870923DEBEFF364756E2164756E21