negotium 0.2.3 → 0.2.5

package/dist/runtime/src/storage/runtime-turn-requests.ts

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import {
   flattenUserTurnAttachments,
   legacyUserTurnEnvelope,
-  renderUserPromptBatch,
+  renderUserTurnBatch,
   type UserTurnEnvelope,
 } from "#runtime/user-turn-envelope";
 import { db } from "#storage/forum-db";
@@ -31,10 +31,14 @@ export interface RuntimeUserTurnExecution {
   bridgeSessionFromHistory?: boolean;
   peerBridge?: PeerRuntimeBridgeContext;
   from?: string;
+  /** Vault namespace for this turn, independent from the local execution principal. */
+  vaultUserId?: string;
   /** Newly accepted user texts not yet recorded in the unified conversation log. */
   conversationPrompts?: string[];
   /** Number of leading userMessages already present in the unified conversation log. */
   loggedUserMessageCount?: number;
+  /** Native session whose provider output proves it accepted this request's user turn. */
+  providerSessionId?: string;
   /** Request ids whose ordered messages were folded into this replacement. */
   supersededRequestIds?: string[];
 }
@@ -175,7 +179,11 @@ function rowToRequest(row: RuntimeUserTurnRequestRow): RuntimeUserTurnRequest {
               (Array.isArray((item as UserTurnEnvelope).attachments) &&
                 (item as UserTurnEnvelope).attachments?.every(
                   (attachment) => typeof attachment === "string",
-                ))),
+                ))) &&
+            ((item as UserTurnEnvelope).actorUserId === undefined ||
+              typeof (item as UserTurnEnvelope).actorUserId === "string") &&
+            ((item as UserTurnEnvelope).actorLabel === undefined ||
+              typeof (item as UserTurnEnvelope).actorLabel === "string"),
         )
       ) {
         userMessages = parsed as UserTurnEnvelope[];
@@ -285,6 +293,8 @@ export function mergeRuntimeUserTurnRequest(input: {
   execution: RuntimeUserTurnExecution;
   topicEpoch: number;
   alreadyIncludedRequestIds?: string[];
+  /** Requests already committed to the provider's native session; keep their lineage, not prompts. */
+  omitRequestIds?: string[];
 }): { requestId: string; supersededRequestIds: string[] } {
   const now = Date.now();
   return db
@@ -295,14 +305,23 @@ export function mergeRuntimeUserTurnRequest(input: {
         )
         .all(input.topicId);
       const previous = rows.map(rowToRequest);
+      const omittedRequestIds = new Set([
+        ...(input.omitRequestIds ?? []),
+        ...previous
+          .filter((request) => Boolean(request.execution?.providerSessionId))
+          .map((request) => request.requestId),
+      ]);
+      const carried = previous.filter((request) => !omittedRequestIds.has(request.requestId));
       const alreadyIncludedRequestIds = new Set(input.alreadyIncludedRequestIds ?? []);
-      const alreadyIncludedMessages = previous
+      const alreadyIncludedMessages = carried
         .filter((request) => alreadyIncludedRequestIds.has(request.requestId))
         .flatMap((request) => request.userMessages);
       const includedPrefixMatches = alreadyIncludedMessages.every((message, index) => {
         const candidate = input.userMessages[index];
         return (
           candidate?.prompt === message.prompt &&
+          candidate.actorUserId === message.actorUserId &&
+          candidate.actorLabel === message.actorLabel &&
           JSON.stringify(candidate.attachments ?? []) === JSON.stringify(message.attachments ?? [])
         );
       });
@@ -310,7 +329,7 @@ export function mergeRuntimeUserTurnRequest(input: {
         ? alreadyIncludedMessages.length
         : 0;
       const userMessages = [
-        ...previous.flatMap((request) => request.userMessages),
+        ...carried.flatMap((request) => request.userMessages),
         ...input.userMessages.slice(alreadyIncludedMessageCount),
       ];
       const incomingLoggedCount = Math.min(
@@ -318,7 +337,7 @@ export function mergeRuntimeUserTurnRequest(input: {
         input.userMessages.length,
       );
       const loggedUserMessageCount =
-        previous.reduce((count, request) => count + loggedMessageCount(request), 0) +
+        carried.reduce((count, request) => count + loggedMessageCount(request), 0) +
         Math.max(0, incomingLoggedCount - alreadyIncludedMessageCount);
       const execution: RuntimeUserTurnExecution = {
         ...input.execution,
@@ -335,7 +354,7 @@ export function mergeRuntimeUserTurnRequest(input: {
           .slice(loggedUserMessageCount)
           .map((message) => message.prompt),
       };
-      const sessionBase = previous.find(
+      const sessionBase = carried.find(
         (request) => request.execution?.sessionIdSpecified,
       )?.execution;
       if (sessionBase?.sessionIdSpecified) {
@@ -355,7 +374,7 @@ export function mergeRuntimeUserTurnRequest(input: {
         input.requestId,
         input.topicId,
         input.userId,
-        renderUserPromptBatch(userMessages.map((message) => message.prompt)),
+        renderUserTurnBatch(userMessages),
         JSON.stringify(userMessages),
         attachments?.length ? JSON.stringify(attachments) : null,
         input.allowAutoContinue ? 1 : 0,
@@ -371,6 +390,46 @@ export function mergeRuntimeUserTurnRequest(input: {
     .immediate();
 }
 
+/**
+ * Record that provider output proves the native session contains this durable
+ * turn. A session-id event alone is insufficient: some providers publish it
+ * before appending the user prompt. This marker lets a different runtime
+ * process omit only a demonstrably committed prompt when it merges a steering
+ * message after preemption.
+ *
+ * Match only the exact request id. A late session event from a superseded turn
+ * must not mark its replacement (whose prompts have not reached the provider).
+ */
+export function markRuntimeUserTurnProviderSessionObserved(
+  topicId: string,
+  requestId: string,
+  sessionId: string,
+): boolean {
+  return db
+    .transaction(() => {
+      const row = db
+        .query<RuntimeUserTurnRequestRow, [string, string]>(
+          "SELECT * FROM runtime_user_turn_requests WHERE topic_id = ? AND request_id = ?",
+        )
+        .get(topicId, requestId);
+      if (!row) return false;
+      const request = rowToRequest(row);
+      const execution: RuntimeUserTurnExecution = {
+        ...request.execution,
+        providerSessionId: sessionId,
+      };
+      const result = db
+        .query(
+          `UPDATE runtime_user_turn_requests
+           SET execution_json = ?
+           WHERE topic_id = ? AND request_id = ?`,
+        )
+        .run(JSON.stringify(execution), topicId, requestId);
+      return result.changes === 1;
+    })
+    .immediate();
+}
+
 export function markRuntimeUserTurnMessagesLogged(
   topicId: string,
   requestId: string,
@@ -392,6 +451,8 @@ export function markRuntimeUserTurnMessagesLogged(
           const candidate = request.userMessages[index];
           return (
             candidate?.prompt === message.prompt &&
+            candidate.actorUserId === message.actorUserId &&
+            candidate.actorLabel === message.actorLabel &&
             JSON.stringify(candidate.attachments ?? []) ===
               JSON.stringify(message.attachments ?? [])
           );

package/dist/runtime/src/storage/storage-host.ts

@@ -67,16 +67,42 @@ function defaultSessionsDatabasePath(): string {
   return envPath("SESSIONS_DB_PATH", join(resolveStorageDataDir(), "sessions.db"));
 }
 
-function initializeDatabase(database: InternalStorageDatabase): void {
+const SQLITE_INIT_RETRY_MS = 25;
+const SQLITE_INIT_TIMEOUT_MS = 5_000;
+const SQLITE_INIT_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+
+function isSqliteBusy(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return /database is (?:locked|busy)|SQLITE_(?:BUSY|LOCKED)/i.test(message);
+}
+
+function execWithBusyRetry(
+  database: InternalStorageDatabase,
+  sql: string,
+  timeoutMs = SQLITE_INIT_TIMEOUT_MS,
+): void {
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    try {
+      database.exec(sql);
+      return;
+    } catch (error) {
+      if (!isSqliteBusy(error) || Date.now() >= deadline) throw error;
+      Atomics.wait(SQLITE_INIT_SLEEP, 0, 0, Math.min(SQLITE_INIT_RETRY_MS, deadline - Date.now()));
+    }
+  }
+}
+
+export function initializeDatabase(database: InternalStorageDatabase): void {
   // busy_timeout FIRST. Switching to WAL needs a brief exclusive lock, so when
   // two processes open the same database at the same moment — the node daemon
   // and an adapter, or two MCP servers — one of them hits SQLITE_BUSY. With the
   // timeout configured afterwards there was no retry budget in effect for the
-  // statement that needed it most, and the loser died with "database is locked"
-  // during startup. Measured with four processes racing one fresh file: 60/100
-  // opens failed in the old order, 0/100 with the timeout set first.
+  // statement that needed it most. Older Bun releases can still surface
+  // SQLITE_BUSY immediately for journal_mode, so keep a bounded host-level
+  // retry around that one exclusive transition as well.
   database.exec("PRAGMA busy_timeout = 5000");
-  database.exec("PRAGMA journal_mode = WAL");
+  execWithBusyRetry(database, "PRAGMA journal_mode = WAL");
   database.exec("PRAGMA foreign_keys = ON");
   database.exec("PRAGMA wal_autocheckpoint = 1000");
   try {

package/dist/runtime/src/storage/vault.ts

@@ -143,6 +143,33 @@ export function vaultListWithValues(userId: string): VaultEntryWithValue[] {
   }));
 }
 
+/**
+ * Return only rows that can still be authenticated with the active master key.
+ *
+ * This is intentionally limited to redaction indexes: one damaged credential
+ * must not disable unrelated tools, while direct access to that credential
+ * continues to fail closed through vaultGetValue().
+ */
+export function vaultListDecryptableValues(userId: string): VaultEntryWithValue[] {
+  const rows = activeVaultDatabase()
+    .prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key")
+    .all(userId) as VaultEntryWithValue[];
+  const entries: VaultEntryWithValue[] = [];
+  for (const row of rows) {
+    try {
+      entries.push({
+        key: row.key,
+        description: row.description,
+        value: decryptRow(userId, row.key, row.value),
+      });
+    } catch {
+      // A value that cannot be authenticated cannot be exposed by substitution,
+      // so there is no plaintext form available to add to the redaction index.
+    }
+  }
+  return entries;
+}
+
 export function vaultSet(userId: string, key: string, value: string, description = ""): void {
   const normalizedKey = normalizeVaultKey(key);
   activeVaultDatabase()
@@ -203,10 +230,11 @@ export interface VaultSubstitutionResult {
 
 /** Replace {{KEY}} placeholders and report which credentials were consumed. */
 export function vaultSubstituteDetailed(userId: string, text: string): VaultSubstitutionResult {
-  const entries = new Map(vaultListWithValues(userId).map((entry) => [entry.key, entry.value]));
+  const entries = new Map<string, string | undefined>();
   const usedKeys = new Set<string>();
   const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey: string) => {
     const key = normalizeVaultKey(rawKey);
+    if (!entries.has(key)) entries.set(key, vaultGetValue(userId, key));
     const value = entries.get(key);
     if (value === undefined) return match;
     usedKeys.add(key);
@@ -248,7 +276,7 @@ function encodedSecretForms(value: string): string[] {
 
 /** Scrub raw and common encoded forms before tool output reaches a model. */
 export function redactVaultSecrets(userId: string, text: string): string {
-  const candidates = vaultListWithValues(userId)
+  const candidates = vaultListDecryptableValues(userId)
     .flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key })))
     .sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
   if (candidates.length === 0) return text;

package/dist/runtime/src/topics/derive.ts

@@ -9,7 +9,7 @@
 
 import { createHash, randomUUID } from "node:crypto";
 import { mkdirSync, rmSync, unlinkSync } from "node:fs";
-import { cleanupAgentFork, type ForkHandle } from "#agents/fork";
+import { cleanupAgentFork, type ForkHandle, forkAgentSession } from "#agents/fork";
 import { resolveCompactionExecution, resolveModelForAgent } from "#agents/model-catalog";
 import { getRegistry, getRegistryOperations } from "#agents/registry";
 import { WsHub } from "#bus";
@@ -26,6 +26,7 @@ import { getApiTopicConfig, setApiTopicConfig } from "#storage/api-topic-config"
 import {
   findTopicTitleConflict,
   getTopic,
+  getTopicSessionId,
   inferTopicKind,
   isTopicVisible,
   listTopics,
@@ -312,6 +313,11 @@ async function createDerivedTopicImpl(
         (subagent?.agent ? undefined : sourceConfig?.model) ??
         derived.defaultModel;
       const rolloutModel = resolveModelForAgent(agent, requestedRolloutModel, registry);
+      const sourceRolloutModel = resolveModelForAgent(
+        agent,
+        sourceConfig?.model ?? topic.defaultModel,
+        registry,
+      );
       const requestedRolloutEffort = subagent?.agent
         ? registry.defaultEffort
         : (sourceConfig?.effort ?? derived.defaultEffort);
@@ -323,7 +329,37 @@ async function createDerivedTopicImpl(
 
       if (copyHistory) {
         if (!forkSnapshot) throw new Error("fork snapshot was not captured");
-        const compactionRequired = shouldCompactForkEntries(forkSnapshot.entries);
+        const parentSessionId = getTopicSessionId(sourceTopicId);
+        const cachePreservingNativeFork =
+          (agent === "codex" || agent === "maestro") && sourceRolloutModel === rolloutModel;
+        if (cachePreservingNativeFork && parentSessionId) {
+          try {
+            rollbackHandle = await forkAgentSession({
+              agent,
+              parentSessionId,
+              cwd,
+              userId,
+              topicName: topic.title,
+              title,
+              model: rolloutModel,
+              ...(rolloutEffort ? { effort: rolloutEffort } : {}),
+            });
+            sessionId = rollbackHandle.forkId;
+            logger.info(
+              { sourceTopicId, derivedTopicId: derived.id, parentSessionId, sessionId },
+              "createDerivedTopic: native provider fork materialized",
+            );
+          } catch (error) {
+            logger.warn(
+              { err: error, sourceTopicId, derivedTopicId: derived.id, parentSessionId },
+              "createDerivedTopic: native provider fork failed; using snapshot fallback",
+            );
+          }
+        }
+        // Successful native forks retain the exact provider prefix. Once that
+        // path is unavailable, cache continuity is already lost; keep a small
+        // snapshot verbatim and compact only an oversized fallback.
+        const compactionRequired = !sessionId && shouldCompactForkEntries(forkSnapshot.entries);
         if (compactionRequired) {
           try {
             compactedForkEntries = await createCompactedRolloutEntries(

package/dist/runtime/src/topics/lifecycle.ts

@@ -9,7 +9,10 @@ import { rmSync } from "node:fs";
 import { runArchiverTurn } from "#agents/archiver";
 import { cancelIdleArchiveForTopic } from "#agents/idle-archiver";
 import { cancelSubagentWatchForDeletedTopic } from "#agents/mcp-tools/spawn-subagent";
-import { MIN_MEMORY_ARCHIVE_EXCHANGES } from "#agents/memory-archive-policy";
+import {
+  MIN_MEMORY_ARCHIVE_EXCHANGES,
+  meetsMemoryArchiveExchangeThreshold,
+} from "#agents/memory-archive-policy";
 import { type PurgeSessionRef, purgeTopicLogs } from "#agents/topic-cleanup";
 import { WsHub } from "#bus";
 import { killBgBash } from "#platform/background-bash/manager";
@@ -238,7 +241,14 @@ async function deleteTopicCascadeImpl(
       }
     }
 
-    if (archived && archived.exchangeCount >= MIN_MEMORY_ARCHIVE_EXCHANGES) {
+    if (
+      archived &&
+      meetsMemoryArchiveExchangeThreshold(
+        archived.exchangeCount,
+        MIN_MEMORY_ARCHIVE_EXCHANGES,
+        topic,
+      )
+    ) {
       try {
         const memoryTopic = getTopicMemoryOrigin(topicId) ?? topic;
         runArchiverTurn({

package/dist/runtime/src/types.ts

@@ -176,6 +176,8 @@ export interface AgentQueryOptions {
   cwd: string;
   systemPrompt: string;
   userId?: string;
+  /** Credential namespace when it differs from the execution principal. */
+  vaultUserId?: string;
   session?: string;
   playwrightPort?: number;
   playwrightCapability?: string;

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.2.3";
+export const NEGOTIUM_VERSION = "0.2.5";

package/dist/runtime-helpers.js

@@ -447,7 +447,6 @@ var BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
 var BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
 var BINARIES_DIR = resolve(STATE_DIR, "binaries");
 var SECRETS_DIR = resolve(STATE_DIR, "secrets");
-var CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
 var DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
 var SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
 var CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
@@ -590,7 +589,6 @@ mkdirSync2(WORKSPACE_DIR, { recursive: true });
 mkdirSync2(TOPIC_WORKSPACE_DIR, { recursive: true });
 mkdirSync2(SHARED_WIKI_DIR, { recursive: true });
 mkdirSync2(CRON_WORKSPACE_DIR, { recursive: true });
-mkdirSync2(CONTEXTS_DIR, { recursive: true });
 mkdirSync2(DM_WORKSPACE_DIR, { recursive: true });
 mkdirSync2(SESSION_WORKSPACE_DIR, { recursive: true });
 mkdirSync2(BROWSER_DIR, { recursive: true });
@@ -695,9 +693,29 @@ function defaultDataDir() {
 function defaultSessionsDatabasePath() {
   return envPath("SESSIONS_DB_PATH", join2(resolveStorageDataDir(), "sessions.db"));
 }
+var SQLITE_INIT_RETRY_MS = 25;
+var SQLITE_INIT_TIMEOUT_MS = 5000;
+var SQLITE_INIT_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function isSqliteBusy(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /database is (?:locked|busy)|SQLITE_(?:BUSY|LOCKED)/i.test(message);
+}
+function execWithBusyRetry(database, sql, timeoutMs = SQLITE_INIT_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    try {
+      database.exec(sql);
+      return;
+    } catch (error) {
+      if (!isSqliteBusy(error) || Date.now() >= deadline)
+        throw error;
+      Atomics.wait(SQLITE_INIT_SLEEP, 0, 0, Math.min(SQLITE_INIT_RETRY_MS, deadline - Date.now()));
+    }
+  }
+}
 function initializeDatabase(database) {
   database.exec("PRAGMA busy_timeout = 5000");
-  database.exec("PRAGMA journal_mode = WAL");
+  execWithBusyRetry(database, "PRAGMA journal_mode = WAL");
   database.exec("PRAGMA foreign_keys = ON");
   database.exec("PRAGMA wal_autocheckpoint = 1000");
   try {
@@ -1114,4 +1132,4 @@ export {
   CLAUDE_EFFORT_VALUES
 };
 
-//# debugId=0849C2E75E1422A764756E2164756E21
+//# debugId=38CF47A0C3C063A564756E2164756E21