negotium 0.2.3 → 0.2.5

package/dist/chunk-qmbcbhyy.js

@@ -0,0 +1,2407 @@
+// @bun
+var __require = import.meta.require;
+
+// ../../packages/core/src/agents/rollout/shared.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+
+// ../../packages/core/src/platform/config.ts
+import { execFileSync } from "child_process";
+import { randomBytes } from "crypto";
+import {
+  accessSync,
+  chmodSync,
+  constants,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
+import { createRequire } from "module";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+
+// ../../packages/core/src/platform/config-helpers.ts
+function readEnvText(env, key) {
+  const value = env[key]?.trim();
+  return value || undefined;
+}
+function parseRuntimePort(value, fallback) {
+  if (!value)
+    return fallback;
+  const port = Number.parseInt(value, 10);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : fallback;
+}
+function safeRuntimePathSegment(value, fallback, maxLength = 160) {
+  const cleaned = value.trim().replace(/[^A-Za-z0-9._-]/g, "_").replace(/^_+|_+$/g, "").slice(0, maxLength);
+  return cleaned || fallback;
+}
+
+// ../../packages/core/src/platform/logger.ts
+import pino from "pino";
+function createStdioLogger(options = {}) {
+  const development = options.development ?? true;
+  return pino({
+    level: options.level ?? process.env.LOG_LEVEL ?? "info",
+    transport: development ? {
+      target: "pino-pretty",
+      options: {
+        colorize: true,
+        translateTime: "SYS:yyyy-mm-dd HH:MM:ss",
+        destination: 2
+      }
+    } : undefined
+  }, pino.destination(2));
+}
+var logger = createStdioLogger();
+
+// ../../packages/core/src/types.ts
+var SUPPORTED_AGENTS = ["maestro", "claude", "codex"];
+function isAgentKind(value) {
+  return typeof value === "string" && SUPPORTED_AGENTS.includes(value);
+}
+var CLAUDE_EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"];
+var CODEX_EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"];
+var MAESTRO_EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"];
+
+// ../../packages/core/src/platform/config.ts
+function envText(envKey) {
+  return readEnvText(process.env, envKey);
+}
+function resolveAgentEnv(envKey, fallback, legacyEnvKey) {
+  const value = envText(envKey) ?? (legacyEnvKey ? envText(legacyEnvKey) : undefined);
+  return isAgentKind(value) ? value : fallback;
+}
+var HOME = homedir();
+function resolveProjectRoot() {
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const packagedRuntime = resolve(moduleDir, "runtime");
+  if (existsSync(resolve(packagedRuntime, "src")))
+    return packagedRuntime;
+  return resolve(moduleDir, "../..");
+}
+var PROJECT_ROOT = resolveProjectRoot();
+function resolveDependencyBin(name) {
+  let dir = PROJECT_ROOT;
+  while (true) {
+    const candidate = resolve(dir, "node_modules", ".bin", name);
+    if (existsSync(candidate))
+      return candidate;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return candidate;
+    dir = parent;
+  }
+}
+var STATE_DIR_ENV = envText("NEGOTIUM_STATE_DIR");
+var STATE_DIR = STATE_DIR_ENV ? resolve(STATE_DIR_ENV) : resolve(HOME, ".negotium");
+function resolveLocalStateDir(envKey, stateName) {
+  const envValue = envText(envKey);
+  if (envValue)
+    return resolve(envValue);
+  return resolve(STATE_DIR, stateName);
+}
+function parsePortEnv(envValue, fallback) {
+  return parseRuntimePort(envValue, fallback);
+}
+var WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
+var TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
+var SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
+var CRON_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "cron");
+var BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
+var BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
+var BINARIES_DIR = resolve(STATE_DIR, "binaries");
+var SECRETS_DIR = resolve(STATE_DIR, "secrets");
+var DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
+var SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
+var CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
+var CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
+var BROWSER_RS_VERSION = "v0.1.16";
+var BROWSER_RS_MIN_SECURE_VERSION = "0.1.15";
+function versionAtLeast(actualVersion, minimumVersion) {
+  const actual = actualVersion.split(".").map(Number);
+  const minimum = minimumVersion.split(".").map(Number);
+  if (actual.some(Number.isNaN) || minimum.some(Number.isNaN))
+    return false;
+  for (let index = 0;index < minimum.length; index += 1) {
+    if ((actual[index] ?? 0) > (minimum[index] ?? 0))
+      return true;
+    if ((actual[index] ?? 0) < (minimum[index] ?? 0))
+      return false;
+  }
+  return true;
+}
+function browserRsMeetsMinimumVersion(candidate) {
+  try {
+    const output = execFileSync(candidate, ["--version"], {
+      encoding: "utf8",
+      timeout: 2000,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const match = output.match(/^browser-rs (\d+)\.(\d+)\.(\d+)$/);
+    if (!match)
+      return false;
+    return versionAtLeast(match.slice(1).join("."), BROWSER_RS_MIN_SECURE_VERSION);
+  } catch {
+    return false;
+  }
+}
+function resolveBrowserRsBin(envValue) {
+  const override = envValue?.trim();
+  if (!override && !versionAtLeast(BROWSER_RS_VERSION.replace(/^v/, ""), BROWSER_RS_MIN_SECURE_VERSION)) {
+    return;
+  }
+  const candidate = override ? resolve(override) : resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  try {
+    accessSync(candidate, constants.X_OK);
+    return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
+  } catch {
+    return;
+  }
+}
+var BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));
+function resolveBrowserMcpBin(envValue) {
+  const override = envValue?.trim();
+  if (override)
+    return resolve(override);
+  return BROWSER_RS_BIN ?? resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+}
+var PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
+var TSX_BIN = resolveDependencyBin("tsx");
+var TSX_LOADER = createRequire(import.meta.url).resolve("tsx");
+var TSCONFIG_PATH = resolve(PROJECT_ROOT, "tsconfig.json");
+var SESSION_COMM_SERVER = resolve(PROJECT_ROOT, "src/mcp/session-comm/server.ts");
+var TASK_SERVER = resolve(PROJECT_ROOT, "src/mcp/task-server.ts");
+var BROWSER_MCP_SSE_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/browser-sse-proxy-server.ts");
+var CANONICAL_MCP_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/canonical-proxy-server.ts");
+var WIKI_SERVER = resolve(PROJECT_ROOT, "src/mcp/wiki-server.ts");
+var TOKEN_STATS_SERVER = resolve(PROJECT_ROOT, "src/mcp/token-stats-server.ts");
+var COMPACTION_LOG_SERVER = resolve(PROJECT_ROOT, "src/mcp/compaction-log-server.ts");
+var SYSTEM_HEALTH_SERVER = resolve(PROJECT_ROOT, "src/mcp/system-health-server.ts");
+var AGENT_HEALTH_SERVER = resolve(PROJECT_ROOT, "src/mcp/agent-health-server.ts");
+var BACKGROUND_BASH_SERVER = resolve(PROJECT_ROOT, "src/mcp/background-bash-server.ts");
+var VAULT_SERVER = resolve(PROJECT_ROOT, "src/mcp/vault-server.ts");
+var BG_BASH_BASE_PORT = parsePortEnv(process.env.BG_BASH_BASE_PORT, 9700);
+var BG_BASH_MAX_PORT = parsePortEnv(process.env.BG_BASH_MAX_PORT, 9799);
+function safeWorkspaceSegment(value, fallback) {
+  return safeRuntimePathSegment(value, fallback);
+}
+function resolveTopicWorkspaceDir(topicId) {
+  return join(TOPIC_WORKSPACE_DIR, safeWorkspaceSegment(topicId, "topic"));
+}
+function loadOrCreateLocalSecret(envKey, filename, options = {}) {
+  const envValue = envText(envKey);
+  const secretFile = resolve(SECRETS_DIR, filename);
+  mkdirSync(dirname(secretFile), { recursive: true });
+  if (envValue) {
+    if (options.persistEnvValue) {
+      writeFileSync(secretFile, `${envValue}
+`, { mode: 384 });
+      chmodSync(secretFile, 384);
+    }
+    return envValue;
+  }
+  if (existsSync(secretFile)) {
+    const stored = readFileSync(secretFile, "utf-8").trim();
+    if (stored) {
+      chmodSync(secretFile, 384);
+      return stored;
+    }
+  }
+  const secret = randomBytes(32).toString("base64url");
+  try {
+    writeFileSync(secretFile, `${secret}
+`, { mode: 384, flag: "wx" });
+    return secret;
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    const stored = readFileSync(secretFile, "utf-8").trim();
+    if (!stored)
+      throw new Error(`Secret file exists but is empty: ${secretFile}`);
+    chmodSync(secretFile, 384);
+    return stored;
+  }
+}
+var RUNTIME_MCP_SECRET = loadOrCreateLocalSecret("RUNTIME_MCP_SECRET", "runtime-mcp-secret");
+var NODE_CONTROL_TOKEN = loadOrCreateLocalSecret("NEGOTIUM_CONTROL_TOKEN", "node-control-token");
+var VAULT_MASTER_KEY = loadOrCreateLocalSecret("NEGOTIUM_VAULT_MASTER_KEY", "vault-master-key", { persistEnvValue: true });
+delete process.env.NEGOTIUM_VAULT_MASTER_KEY;
+var NEGOTIUM_PORT = parseInt(process.env.NEGOTIUM_PORT || "7777", 10);
+var hostname = process.env.HOSTNAME || "127.0.0.1";
+var DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
+var LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+var UPLOADS_DIR = resolve(DATA_DIR, "uploads");
+var VAULT_DIR = resolve(DATA_DIR, "vault");
+var SESSIONS_DB = process.env.SESSIONS_DB_PATH ? resolve(process.env.SESSIONS_DB_PATH) : resolve(DATA_DIR, "sessions.db");
+var DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
+var USERS_LOG_DIR = resolve(DATA_DIR, "users");
+var RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "runtime");
+var PROGRESS_DIR = resolve(RUN_DIR, "progress");
+var DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
+var DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
+var SESSION_INBOX_DIR = resolve(RUN_DIR, "session-inbox");
+var SESSION_ASKS_DIR = resolve(RUN_DIR, "session-asks");
+var PLAYWRIGHT_BASE_PORT = parsePortEnv(process.env.PLAYWRIGHT_BASE_PORT, 9100);
+var PLAYWRIGHT_MAX_PORT = parsePortEnv(process.env.PLAYWRIGHT_MAX_PORT, 9499);
+var PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
+mkdirSync(STATE_DIR, { recursive: true });
+mkdirSync(DATA_DIR, { recursive: true });
+mkdirSync(UPLOADS_DIR, { recursive: true });
+mkdirSync(VAULT_DIR, { recursive: true, mode: 448 });
+mkdirSync(LOG_DIR, { recursive: true });
+mkdirSync(PROGRESS_DIR, { recursive: true });
+mkdirSync(DM_CMD_DIR, { recursive: true });
+mkdirSync(DM_RESP_DIR, { recursive: true });
+mkdirSync(SESSION_INBOX_DIR, { recursive: true });
+mkdirSync(SESSION_ASKS_DIR, { recursive: true });
+mkdirSync(PLAYWRIGHT_PORTS_DIR, { recursive: true });
+mkdirSync(WORKSPACE_DIR, { recursive: true });
+mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
+mkdirSync(SHARED_WIKI_DIR, { recursive: true });
+mkdirSync(CRON_WORKSPACE_DIR, { recursive: true });
+mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
+mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
+mkdirSync(BROWSER_DIR, { recursive: true });
+mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
+mkdirSync(BINARIES_DIR, { recursive: true });
+mkdirSync(SECRETS_DIR, { recursive: true, mode: 448 });
+var ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000;
+var AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, "src/prompts/agents");
+var RESOURCES_DIR = resolve(PROJECT_ROOT, "src/resources");
+var MODEL_SONNET = "claude-sonnet-5";
+var MODEL_OPUS = "claude-opus-5";
+var MODEL_FABLE = "claude-fable-5";
+var FALLBACK_AGENT = resolveAgentEnv("FALLBACK_AGENT", "maestro", "DEFAULT_AGENT");
+var SESSION_AGENT = resolveAgentEnv("SESSION_AGENT", FALLBACK_AGENT);
+var GATEWAY_AGENT = resolveAgentEnv("GATEWAY_AGENT", FALLBACK_AGENT);
+var FALLBACK_MODEL = envText("FALLBACK_MODEL") ?? envText("DEFAULT_MODEL");
+function resolveModelEnv(envKey, agentConst) {
+  return envText(envKey) ?? (agentConst === FALLBACK_AGENT ? FALLBACK_MODEL : undefined);
+}
+var SESSION_MODEL = resolveModelEnv("SESSION_MODEL", SESSION_AGENT);
+var GATEWAY_MODEL = resolveModelEnv("GATEWAY_MODEL", GATEWAY_AGENT);
+var FFMPEG_BIN = envText("FFMPEG_BIN");
+var FFPROBE_BIN = envText("FFPROBE_BIN");
+var PYTHON_BIN = envText("PYTHON_BIN") ?? "python3";
+var FASTER_WHISPER_WRAPPER = envText("FASTER_WHISPER_WRAPPER") ?? resolve(PROJECT_ROOT, "scripts/faster-whisper-wrapper.py");
+var WHISPER_MODEL = envText("WHISPER_MODEL_FILE") ?? "turbo";
+var TESSERACT_BIN = envText("TESSERACT_BIN") ?? "tesseract";
+var PDFTOTEXT_BIN = envText("PDFTOTEXT_BIN") ?? "pdftotext";
+var _envMaxTellDepth = Number.parseInt(process.env.MAX_TELL_DEPTH ?? "", 10);
+var MAX_TELL_DEPTH = Number.isInteger(_envMaxTellDepth) && _envMaxTellDepth > 0 ? _envMaxTellDepth : 20;
+function codexAuthFilePath() {
+  return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
+}
+
+// ../../packages/core/src/runtime/user-turn-envelope.ts
+function renderUserPromptBatch(prompts) {
+  if (prompts.length <= 1)
+    return prompts[0] ?? "";
+  return [
+    "[Consecutive user messages received before an assistant response]",
+    "",
+    ...prompts.map((prompt, index) => `${index + 1}. ${prompt}`)
+  ].join(`
+`);
+}
+
+// ../../packages/core/src/agents/rollout/shared.ts
+var trustedWorkspaceRoots = [
+  WORKSPACE_DIR,
+  DM_WORKSPACE_DIR,
+  SESSION_WORKSPACE_DIR,
+  TOPIC_WORKSPACE_DIR
+].map((root) => resolve2(root));
+function configureRolloutHost(options) {
+  if (!options.workspaceRoots && !options.fixturesDir) {
+    throw new Error("configureRolloutHost requires workspaceRoots or fixturesDir");
+  }
+  if (options.workspaceRoots?.length === 0) {
+    throw new Error("configureRolloutHost requires at least one workspace root");
+  }
+  const previousRoots = trustedWorkspaceRoots;
+  const previousFixturesDir = FIXTURES_DIR;
+  if (options.workspaceRoots) {
+    trustedWorkspaceRoots = options.workspaceRoots.map((root) => resolve2(root));
+  }
+  if (options.fixturesDir)
+    FIXTURES_DIR = resolve2(options.fixturesDir);
+  let disposed = false;
+  return () => {
+    if (disposed)
+      return;
+    disposed = true;
+    trustedWorkspaceRoots = previousRoots;
+    FIXTURES_DIR = previousFixturesDir;
+  };
+}
+var FIXTURES_DIR = resolve2(PROJECT_ROOT, "src", "agents", "fixtures");
+function clone(obj) {
+  return structuredClone(obj);
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function assertUuidLike(label, value) {
+  if (!UUID_RE.test(value)) {
+    throw new Error(`rollout: ${label} is not a UUID-shaped string: ${value}`);
+  }
+}
+function assertCwdInWorkspace(cwd) {
+  const abs = resolve2(cwd);
+  const ok = trustedWorkspaceRoots.some((root) => abs === root || abs.startsWith(`${root}/`));
+  if (!ok) {
+    throw new Error(`rollout: cwd outside trusted workspace roots: ${cwd} (resolved=${abs})`);
+  }
+}
+function ensureCwdExists(cwd) {
+  assertCwdInWorkspace(cwd);
+  try {
+    mkdirSync2(cwd, { recursive: true });
+  } catch (err) {
+    logger.warn({ err, cwd }, "rollout: ensureCwdExists failed \u2014 caller should pre-create cwd");
+  }
+}
+function truncate(text, n) {
+  const cps = Array.from(text);
+  return cps.length > n ? `${cps.slice(0, n).join("")}\u2026` : text;
+}
+function extractChatPairs(entries, opts = { includeToolAnnotations: true }) {
+  const pairs = [];
+  let pendingUsers = [];
+  let pendingBatchSize = null;
+  let pendingBatchNextIndex = 0;
+  let pendingAssistantParts = [];
+  let toolBuffer = [];
+  const flushAssistant = () => {
+    if (pendingUsers.length === 0)
+      return;
+    const tools = opts.includeToolAnnotations && toolBuffer.length > 0 ? `
+
+${toolBuffer.join(`
+`)}` : "";
+    const assistantText = pendingAssistantParts.join("").trim() + tools;
+    if (assistantText.trim()) {
+      pairs.push({ userText: renderUserPromptBatch(pendingUsers), assistantText });
+    }
+    pendingUsers = [];
+    pendingBatchSize = null;
+    pendingBatchNextIndex = 0;
+    pendingAssistantParts = [];
+    toolBuffer = [];
+  };
+  for (const entry of entries) {
+    const ev = entry.event;
+    switch (ev.type) {
+      case "user_message": {
+        const userEvent = ev;
+        if (pendingAssistantParts.length > 0 || toolBuffer.length > 0) {
+          flushAssistant();
+        }
+        const batchSize = userEvent.consecutiveBatchSize;
+        const batchIndex = userEvent.consecutiveBatchIndex;
+        const marked = Number.isInteger(batchSize) && Number.isInteger(batchIndex) && (batchSize ?? 0) > 1 && (batchIndex ?? -1) >= 0 && (batchIndex ?? 0) < (batchSize ?? 0);
+        if (!marked) {
+          if (pendingUsers.length > 0)
+            flushAssistant();
+          pendingUsers.push(userEvent.content);
+          pendingBatchSize = null;
+          pendingBatchNextIndex = 0;
+          break;
+        }
+        if (batchIndex === 0) {
+          if (pendingUsers.length > 0)
+            flushAssistant();
+          pendingBatchSize = batchSize ?? null;
+          pendingBatchNextIndex = 0;
+        } else if (!(pendingBatchSize !== null && (batchSize ?? 0) >= pendingBatchSize && pendingBatchNextIndex === batchIndex || pendingBatchSize === null && pendingUsers.length === batchIndex)) {
+          flushAssistant();
+        }
+        pendingUsers.push(userEvent.content);
+        pendingBatchSize = batchSize ?? null;
+        pendingBatchNextIndex = (batchIndex ?? 0) + 1;
+        break;
+      }
+      case "session":
+        if (pendingAssistantParts.length > 0 || toolBuffer.length > 0) {
+          flushAssistant();
+        }
+        break;
+      case "text": {
+        if (pendingUsers.length === 0) {
+          pendingUsers = ["(continued)"];
+        }
+        pendingAssistantParts.push(ev.content);
+        break;
+      }
+      case "result": {
+        if (pendingUsers.length === 0) {
+          pendingUsers = ["(continued)"];
+        }
+        pendingAssistantParts = [ev.content];
+        flushAssistant();
+        break;
+      }
+      case "text_delta":
+        break;
+      case "tool_use": {
+        const u = ev;
+        toolBuffer.push(`<!-- Tool: ${u.name} ${truncate(JSON.stringify(u.input), 200)} -->`);
+        break;
+      }
+      case "tool_result": {
+        const u = ev;
+        toolBuffer.push(`<!-- Tool result: ${truncate(u.content, 200)} -->`);
+        break;
+      }
+      case "error": {
+        const u = ev;
+        toolBuffer.push(`[Error: ${truncate(u.content, 200)}]`);
+        break;
+      }
+      case "tool_progress":
+      case "tool_use_summary":
+      case "file":
+      case "status":
+        break;
+    }
+  }
+  flushAssistant();
+  return pairs;
+}
+
+// ../../packages/core/src/agents/rollout/claude.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// ../../packages/core/src/platform/jsonl.ts
+import {
+  appendFileSync,
+  closeSync,
+  fsyncSync,
+  mkdirSync as mkdirSync3,
+  openSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  statSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname2 } from "path";
+
+// ../../packages/core/src/platform/file-utils.ts
+import { unlinkSync } from "fs";
+function createSafeUnlink(host) {
+  return (path, warnLabel) => {
+    try {
+      host.unlink(path);
+    } catch (e) {
+      if (e?.code === "ENOENT")
+        return;
+      if (warnLabel)
+        host.warn({ err: e, path }, warnLabel);
+    }
+  };
+}
+var defaultSafeUnlink = createSafeUnlink({
+  unlink: unlinkSync,
+  warn: (context, message) => logger.warn(context, message)
+});
+
+// ../../packages/core/src/platform/jsonl.ts
+function parseJsonlText(raw) {
+  return raw.trim().split(`
+`).filter(Boolean).map((line) => JSON.parse(line));
+}
+var LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function writeJsonlFile(filePath, entries) {
+  const dir = dirname2(filePath);
+  mkdirSync3(dir, { recursive: true });
+  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  const payload = `${entries.map((e) => JSON.stringify(e)).join(`
+`)}
+`;
+  let fd = null;
+  try {
+    fd = openSync(tmpPath, "w");
+    writeFileSync2(fd, payload);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmpPath, filePath);
+    fsyncDirectoryBestEffort(dir);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync2(tmpPath);
+    } catch {}
+    throw err;
+  }
+}
+function fsyncDirectoryBestEffort(dir) {
+  let fd = null;
+  try {
+    fd = openSync(dir, "r");
+    fsyncSync(fd);
+  } catch {} finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+  }
+}
+
+// ../../packages/core/src/agents/rollout/claude.ts
+var _attachmentsCache = null;
+function loadClaudeAttachments() {
+  if (_attachmentsCache)
+    return _attachmentsCache;
+  const raw = readFileSync3(join2(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
+  const lines = parseJsonlText(raw);
+  if (lines.length < 2) {
+    throw new Error(`loadClaudeAttachments: expected >=2 entries in claude-attachments.jsonl, got ${lines.length}`);
+  }
+  _attachmentsCache = {
+    deferredToolsDelta: lines[0],
+    skillListing: lines[1]
+  };
+  return _attachmentsCache;
+}
+var CLAUDE_SDK_VERSION = "2.1.126";
+var CLAUDE_DEFAULT_MODEL = "claude-sonnet-5";
+var CLAUDE_DEFAULT_GIT_BRANCH = "HEAD";
+function encodeClaudeCwd(cwd) {
+  const realCwd = cwd.startsWith("/tmp/") ? cwd.replace(/^\/tmp\//, "/private/tmp/") : cwd;
+  return `-${realCwd.replaceAll(/[^a-zA-Z0-9]/g, "-").replace(/^-/, "")}`;
+}
+function writeClaudeRollout(opts) {
+  const sessionId = opts.sessionId ?? randomUUID();
+  assertUuidLike("sessionId", sessionId);
+  ensureCwdExists(opts.cwd);
+  const pairs = opts.pairs ?? extractChatPairs(opts.entries ?? []);
+  const cwdReal = opts.cwd.startsWith("/tmp/") ? opts.cwd.replace(/^\/tmp\//, "/private/tmp/") : opts.cwd;
+  const lines = [];
+  const ts = () => new Date().toISOString();
+  let lastUuid = null;
+  lines.push({ type: "queue-operation", operation: "enqueue", timestamp: ts(), sessionId });
+  lines.push({ type: "queue-operation", operation: "dequeue", timestamp: ts(), sessionId });
+  const attachments = loadClaudeAttachments();
+  for (const pair of pairs) {
+    const userUuid = randomUUID();
+    lines.push({
+      parentUuid: lastUuid,
+      isSidechain: false,
+      promptId: randomUUID(),
+      type: "user",
+      message: { role: "user", content: [{ type: "text", text: pair.userText }] },
+      uuid: userUuid,
+      timestamp: ts(),
+      permissionMode: "bypassPermissions",
+      userType: "external",
+      entrypoint: "sdk-ts",
+      cwd: cwdReal,
+      sessionId,
+      version: CLAUDE_SDK_VERSION,
+      gitBranch: CLAUDE_DEFAULT_GIT_BRANCH
+    });
+    const att1Uuid = randomUUID();
+    const att1 = clone(attachments.deferredToolsDelta);
+    att1.parentUuid = userUuid;
+    att1.uuid = att1Uuid;
+    att1.timestamp = ts();
+    att1.sessionId = sessionId;
+    att1.cwd = cwdReal;
+    lines.push(att1);
+    const att2Uuid = randomUUID();
+    const att2 = clone(attachments.skillListing);
+    att2.parentUuid = att1Uuid;
+    att2.uuid = att2Uuid;
+    att2.timestamp = ts();
+    att2.sessionId = sessionId;
+    att2.cwd = cwdReal;
+    lines.push(att2);
+    const assistantUuid = randomUUID();
+    lines.push({
+      parentUuid: att2Uuid,
+      isSidechain: false,
+      message: {
+        model: opts.model ?? CLAUDE_DEFAULT_MODEL,
+        id: `msg_${randomUUID().replace(/-/g, "").slice(0, 24)}`,
+        type: "message",
+        role: "assistant",
+        content: [{ type: "text", text: pair.assistantText }],
+        stop_reason: "end_turn",
+        stop_sequence: null,
+        stop_details: null,
+        usage: {
+          input_tokens: 0,
+          cache_creation_input_tokens: 0,
+          cache_read_input_tokens: 0,
+          output_tokens: 0,
+          server_tool_use: { web_search_requests: 0, web_fetch_requests: 0 },
+          service_tier: "standard",
+          cache_creation: { ephemeral_1h_input_tokens: 0, ephemeral_5m_input_tokens: 0 },
+          inference_geo: "",
+          iterations: [],
+          speed: "standard"
+        },
+        diagnostics: null
+      },
+      requestId: `req_${randomUUID().replace(/-/g, "").slice(0, 22)}`,
+      type: "assistant",
+      uuid: assistantUuid,
+      timestamp: ts(),
+      userType: "external",
+      entrypoint: "sdk-ts",
+      cwd: cwdReal,
+      sessionId,
+      version: CLAUDE_SDK_VERSION,
+      gitBranch: CLAUDE_DEFAULT_GIT_BRANCH
+    });
+    lastUuid = assistantUuid;
+  }
+  const projectsDir = join2(homedir2(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
+  const path = join2(projectsDir, `${sessionId}.jsonl`);
+  writeJsonlFile(path, lines);
+  logger.info({ sessionId, path, pairs: pairs.length }, "writeClaudeRollout: synthetic rollout placed");
+  return { sessionId, rolloutPath: path };
+}
+function repairPoisonedRollout(sessionId, cwd) {
+  try {
+    const path = join2(homedir2(), ".claude", "projects", encodeClaudeCwd(cwd), `${sessionId}.jsonl`);
+    if (!existsSync2(path))
+      return false;
+    const lines = readFileSync3(path, "utf8").split(`
+`).filter((l) => l.trim());
+    let poisonedAssistantIdx = -1;
+    for (let i = lines.length - 1;i >= 0; i--) {
+      const entry = parseClaudeRolloutLine(lines[i]);
+      if (entry && isPoisonedAssistantEntry(entry)) {
+        poisonedAssistantIdx = i;
+        break;
+      }
+    }
+    if (poisonedAssistantIdx < 0) {
+      logger.warn({ sessionId, path }, "repairPoisonedRollout: no poisoned assistant entry found");
+      return false;
+    }
+    let turnStartIdx = -1;
+    for (let i = poisonedAssistantIdx - 1;i >= 0; i--) {
+      const entry = parseClaudeRolloutLine(lines[i]);
+      if (entry?.type === "user") {
+        turnStartIdx = i;
+        break;
+      }
+    }
+    if (turnStartIdx < 0) {
+      logger.warn({ sessionId, path, poisonedAssistantIdx }, "repairPoisonedRollout: poisoned assistant has no preceding user entry");
+      return false;
+    }
+    const kept = lines.slice(0, turnStartIdx);
+    writeFileSync3(path, kept.length ? `${kept.join(`
+`)}
+` : "");
+    logger.warn({
+      sessionId,
+      path,
+      poisonedAssistantIdx,
+      turnStartIdx,
+      droppedEntries: lines.length - turnStartIdx,
+      keptEntries: kept.length
+    }, "repairPoisonedRollout: truncated turn removed from rollout JSONL");
+    return true;
+  } catch (err) {
+    logger.warn({ err, sessionId, cwd }, "repairPoisonedRollout: I/O error");
+    return false;
+  }
+}
+function parseClaudeRolloutLine(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    return null;
+  }
+}
+function isPoisonedAssistantEntry(entry) {
+  if (entry.type !== "assistant")
+    return false;
+  if (entry.message?.stop_reason !== "max_tokens")
+    return false;
+  const content = entry.message.content;
+  if (!Array.isArray(content))
+    return false;
+  return content.some((block) => {
+    if (!block || typeof block !== "object")
+      return false;
+    const type = block.type;
+    return type === "thinking" || type === "redacted_thinking";
+  });
+}
+
+// ../../packages/core/src/agents/rollout/codex.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync3 } from "fs";
+import { basename, dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+
+// ../../packages/core/src/agents/execution-host.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { dirname as dirname3 } from "path";
+
+// ../../packages/core/src/security/sensitive-path.ts
+import { realpathSync } from "fs";
+import { resolve as resolve3 } from "path";
+var SENSITIVE_PATH_PATTERNS = [
+  /\/\.env(\.|$)/i,
+  /\/\.ssh\//i,
+  /\/\.aws\//i,
+  /\/\.gnupg\//i,
+  /\/\.netrc$/i,
+  /\/\.npmrc$/i,
+  /\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)(\.pub)?$/i,
+  /\.(pem|key|p12|pfx|cer|crt)$/i,
+  /\/Library\/Keychains\//i,
+  /\/vault\.db(-wal|-shm|-journal)?$/i,
+  /\/vault-master-key$/i,
+  /\/runtime-mcp-secret$/i,
+  /\/sessions\.db(-wal|-shm|-journal)?$/i
+];
+function isSensitivePath(filePath) {
+  const normalized = resolve3(filePath);
+  if (SENSITIVE_PATH_PATTERNS.some((p) => p.test(normalized)))
+    return true;
+  try {
+    const real = realpathSync(normalized);
+    if (real !== normalized)
+      return SENSITIVE_PATH_PATTERNS.some((p) => p.test(real));
+  } catch {}
+  return false;
+}
+
+// ../../packages/core/src/agents/vault-tool-policy.ts
+var SENSITIVE_RUNTIME_NAMES = [
+  "vault.db",
+  "vault-master-key",
+  "runtime-mcp-secret",
+  "sessions.db"
+];
+var DIRECT_VAULT_EXECUTION_TOOLS = new Set(["Bash", "WebFetch"]);
+function createVaultToolPolicy(host) {
+  function isVaultBrokerTool(toolName) {
+    return toolName.includes("vault_run") || toolName.includes("vault_http_request");
+  }
+  function referencesRuntimeSecretStorage(value) {
+    if (typeof value === "string") {
+      const lower = value.toLowerCase();
+      if (SENSITIVE_RUNTIME_NAMES.some((name) => lower.includes(name)))
+        return true;
+      return value.startsWith("/") && host.isSensitivePath(value);
+    }
+    if (Array.isArray(value))
+      return value.some(referencesRuntimeSecretStorage);
+    if (value && typeof value === "object") {
+      return Object.values(value).some(referencesRuntimeSecretStorage);
+    }
+    return false;
+  }
+  function shouldRedirectVaultTool(userId, toolName, input) {
+    return false;
+  }
+  return { isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool };
+}
+var defaultVaultToolPolicy = createVaultToolPolicy({
+  isSensitivePath,
+  valueReferencesVaultKey: () => false
+});
+var isVaultBrokerTool = defaultVaultToolPolicy.isVaultBrokerTool;
+var referencesRuntimeSecretStorage = defaultVaultToolPolicy.referencesRuntimeSecretStorage;
+var shouldRedirectVaultTool = defaultVaultToolPolicy.shouldRedirectVaultTool;
+
+// ../../packages/core/src/mcp/canonical-bridge-config.ts
+var registrations = [];
+var turnLeases = new Map;
+function turnKey(scope) {
+  return JSON.stringify([
+    scope.userId,
+    scope.topicId,
+    scope.queryId,
+    scope.peerBridge.hubCellId,
+    scope.peerBridge.hostTopicId,
+    scope.peerBridge.hostQueryId
+  ]);
+}
+function canonicalMcpBridgeEnv(scope) {
+  const lease = registrations.at(-1)?.provider(scope);
+  if (!lease)
+    return;
+  const key = turnKey(scope);
+  const leases = turnLeases.get(key) ?? new Set;
+  leases.add(lease.revoke);
+  turnLeases.set(key, leases);
+  return lease.env;
+}
+
+// ../../packages/core/src/mcp/runtime-spec.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var RUNTIME_MCP_KEY = "runtime";
+var RUNTIME_MCP_BASE_PATH = "/mcp/runtime";
+var TOKEN_TTL_MS = 4 * 60 * 60 * 1000;
+var CLAUDE_MCP_TOOL_TIMEOUT_MS = 600000;
+var runtimePort = NEGOTIUM_PORT;
+function encodeTokenPart(value) {
+  return Buffer.from(JSON.stringify(value), "utf-8").toString("base64url");
+}
+function signTokenPayload(payloadPart) {
+  return createHmac("sha256", RUNTIME_MCP_SECRET).update(payloadPart).digest("base64url");
+}
+function issueRuntimeMcpToken(ctx) {
+  const payloadPart = encodeTokenPart({
+    v: 1,
+    exp: Date.now() + TOKEN_TTL_MS,
+    ctx
+  });
+  return `${payloadPart}.${signTokenPayload(payloadPart)}`;
+}
+function issueHostedMcpToken(surface, ctx) {
+  const payloadPart = encodeTokenPart({
+    v: 2,
+    exp: Date.now() + TOKEN_TTL_MS,
+    aud: surface,
+    ctx
+  });
+  return `${payloadPart}.${signTokenPayload(payloadPart)}`;
+}
+function buildRuntimeMcpSpec(agent, ctx) {
+  const token = issueRuntimeMcpToken(ctx);
+  const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}`;
+  const query = `token=${encodeURIComponent(token)}`;
+  if (agent === "codex")
+    return { url: `${base}/mcp?${query}` };
+  return {
+    type: "sse",
+    url: `${base}/sse?${query}`,
+    timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS
+  };
+}
+function buildHostedMcpSpec(agent, surface, ctx) {
+  const token = issueHostedMcpToken(surface, ctx);
+  const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}/${surface}`;
+  const query = `token=${encodeURIComponent(token)}`;
+  if (agent === "codex")
+    return { url: `${base}/mcp?${query}` };
+  return {
+    type: "sse",
+    url: `${base}/sse?${query}`,
+    timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS
+  };
+}
+
+// ../../packages/core/src/mcp/session-comm/bridge-ipc-config.ts
+var registrations2 = [];
+function peerSessionBridgeIpcEnv() {
+  const active = registrations2.at(-1)?.config;
+  if (!active)
+    return;
+  return {
+    NEGOTIUM_PEER_SESSION_BRIDGE_URL: active.url,
+    NEGOTIUM_PEER_SESSION_BRIDGE_TOKEN: active.token
+  };
+}
+
+// ../../packages/core/src/platform/background-bash/manager.ts
+import { execFileSync as execFileSync2, spawn } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+
+// ../../packages/core/src/platform/delay.ts
+var delay = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// ../../packages/core/src/platform/background-bash/context.ts
+import { createHmac as createHmac2 } from "crypto";
+function deriveBgBashContextCapability(runtimeCapability, userId, topic) {
+  return createHmac2("sha256", runtimeCapability).update(`${userId}\x00${topic}`).digest("hex");
+}
+
+// ../../packages/core/src/platform/background-bash/manager.ts
+function makeBgBashKey(_userId, _topic) {
+  return "runtime";
+}
+function defaultPortPids(port) {
+  try {
+    return execFileSync2("lsof", ["-i", `:${port}`, "-t"], { stdio: "pipe" }).toString().trim().split(`
+`).map((pid) => Number.parseInt(pid, 10)).filter((pid) => !Number.isNaN(pid));
+  } catch {
+    return [];
+  }
+}
+function createBackgroundBashManager(options = {}) {
+  const instances = new Map;
+  const usedPorts = new Set;
+  const spawning = new Map;
+  const knownContexts = new Map;
+  const runtimeCapability = options.capability ?? randomBytes2(32).toString("hex");
+  const runtimeServerId = options.serverId ?? randomBytes2(16).toString("hex");
+  const serverFile = options.serverFile ?? BACKGROUND_BASH_SERVER;
+  const basePort = options.basePort ?? BG_BASH_BASE_PORT;
+  const maxPort = options.maxPort ?? BG_BASH_MAX_PORT;
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const now = options.now ?? Date.now;
+  const wait = options.delay ?? delay;
+  const portPids = options.portPids ?? defaultPortPids;
+  const spawnImpl = options.spawn ?? ((command, args, spawnOptions) => spawn(command, [...args], spawnOptions));
+  function contextKey(userId, topic) {
+    return `${userId}\x00${topic}`;
+  }
+  function contextCapability(userId, topic) {
+    return deriveBgBashContextCapability(runtimeCapability, userId, topic);
+  }
+  async function allocatePort(excludedPorts = new Set) {
+    for (let port = basePort;port <= maxPort; port++) {
+      if (usedPorts.has(port) || excludedPorts.has(port))
+        continue;
+      usedPorts.add(port);
+      if (portPids(port).length > 0) {
+        usedPorts.delete(port);
+        continue;
+      }
+      return port;
+    }
+    throw new Error(`No available ports for background-bash (range ${basePort}-${maxPort}, ${instances.size} active)`);
+  }
+  async function isHealthy(port) {
+    try {
+      const response = await fetchImpl(`http://127.0.0.1:${port}/health`, {
+        signal: AbortSignal.timeout(2000)
+      });
+      return response.ok && await response.text() === runtimeServerId;
+    } catch {
+      return false;
+    }
+  }
+  function killRuntime() {
+    const key = "runtime";
+    const instance = instances.get(key);
+    if (!instance)
+      return;
+    try {
+      instance.process.kill("SIGTERM");
+    } catch {}
+    usedPorts.delete(instance.port);
+    instances.delete(key);
+    logger.info({ key, port: instance.port }, "background-bash server killed");
+  }
+  async function spawnServer(key, reservedPort, excludedPorts = new Set) {
+    const port = reservedPort ?? await allocatePort(excludedPorts);
+    const process2 = spawnImpl("bun", ["run", serverFile, `--port=${port}`], {
+      stdio: "ignore",
+      detached: false,
+      env: {
+        ...options.env ?? globalThis.process.env,
+        NEGOTIUM_BG_BASH_CAPABILITY: runtimeCapability,
+        NEGOTIUM_BG_BASH_SERVER_ID: runtimeServerId
+      }
+    });
+    process2.once("error", (error) => {
+      logger.error({ err: error, key }, "background-bash server error");
+      if (instances.get(key)?.process === process2) {
+        usedPorts.delete(port);
+        instances.delete(key);
+      }
+    });
+    process2.once("exit", (code) => {
+      logger.info({ key, code }, "background-bash server exited");
+      if (instances.get(key)?.process === process2) {
+        usedPorts.delete(port);
+        instances.delete(key);
+      }
+    });
+    const timestamp = now();
+    instances.set(key, { process: process2, port, startedAt: timestamp, lastUsedAt: timestamp });
+    const started = now();
+    while (now() - started < 8000) {
+      if (process2.exitCode !== null) {
+        const nextExcluded = new Set(excludedPorts);
+        nextExcluded.add(port);
+        return spawnServer(key, undefined, nextExcluded);
+      }
+      if (await isHealthy(port))
+        return port;
+      await wait(200);
+    }
+    killRuntime();
+    throw new Error(`background-bash server failed health check after spawn on port ${port}`);
+  }
+  async function ensure(userId, topic) {
+    const key = makeBgBashKey(userId, topic);
+    knownContexts.set(contextKey(userId, topic), { userId, topic });
+    const inProgress = spawning.get(key);
+    if (inProgress)
+      return inProgress;
+    const promise = (async () => {
+      const existing = instances.get(key);
+      if (existing && !existing.process.killed && existing.process.exitCode === null) {
+        if (await isHealthy(existing.port)) {
+          existing.lastUsedAt = now();
+          return existing.port;
+        }
+        killRuntime();
+      } else if (existing) {
+        usedPorts.delete(existing.port);
+        instances.delete(key);
+      }
+      return spawnServer(key);
+    })().finally(() => spawning.delete(key));
+    spawning.set(key, promise);
+    return promise;
+  }
+  function clear(userId, topic) {
+    knownContexts.delete(contextKey(userId, topic));
+    const instance = instances.get("runtime");
+    if (!instance)
+      return;
+    const query = new URLSearchParams({
+      user: userId,
+      topic,
+      capability: contextCapability(userId, topic)
+    });
+    fetchImpl(`http://127.0.0.1:${instance.port}/contexts?${query}`, {
+      method: "DELETE"
+    }).catch(() => {});
+  }
+  function clearUser(userId) {
+    for (const context of [...knownContexts.values()]) {
+      if (context.userId === userId)
+        clear(context.userId, context.topic);
+    }
+  }
+  async function killAll() {
+    const entries = [...instances.values()];
+    for (const instance of entries) {
+      try {
+        instance.process.kill("SIGTERM");
+      } catch {}
+    }
+    instances.clear();
+    usedPorts.clear();
+    knownContexts.clear();
+    const deadline = now() + 3000;
+    await Promise.all(entries.map((instance) => new Promise((resolve4) => {
+      if (instance.process.exitCode !== null || instance.process.killed)
+        return resolve4();
+      instance.process.once("exit", resolve4);
+      instance.process.once("error", resolve4);
+      const timer = setTimeout(resolve4, Math.max(0, deadline - now()));
+      timer.unref?.();
+    })));
+  }
+  return { contextCapability, ensure, clear, clearUser, killAll };
+}
+var defaultManager = createBackgroundBashManager();
+var bgBashContextCapability = defaultManager.contextCapability;
+var ensureBgBash = defaultManager.ensure;
+var killBgBash = defaultManager.clear;
+var killBgBashForUser = defaultManager.clearUser;
+var killAllBgBash = defaultManager.killAll;
+
+// ../../packages/core/src/platform/mcp-catalog-policy.ts
+var COMMON_RUNTIME_MCP_POLICY = {
+  playwright: { scopes: ["dm", "forum", "fork", "cron"], forumRequired: true },
+  runtime: { scopes: ["forum", "manager", "fork", "cron"], forumRequired: true },
+  "token-stats": { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+  task: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+  "session-comm": { scopes: ["forum", "fork", "manager"], forumRequired: true },
+  wiki: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+  skills: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+  "system-health": { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+  "background-bash": { scopes: ["forum"], forumRequired: true },
+  "agent-health": { scopes: ["forum", "manager", "cron"], forumRequired: true },
+  vault: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true }
+};
+function classifyForumMcpServers(catalog) {
+  const all = Object.entries(catalog).filter(([, entry]) => entry.scopes.includes("forum")).map(([name]) => name);
+  const required = Object.entries(catalog).filter(([, entry]) => entry.scopes.includes("forum") && entry.forumRequired).map(([name]) => name);
+  const requiredSet = new Set(required);
+  return { all, required, optional: all.filter((name) => !requiredSet.has(name)) };
+}
+function commonRuntimeMcpPolicy(name) {
+  return COMMON_RUNTIME_MCP_POLICY[name];
+}
+
+// ../../packages/core/src/platform/playwright/capability.ts
+import { createHmac as createHmac3 } from "crypto";
+function browserOwnerCapability(capability, owner) {
+  return createHmac3("sha256", capability).update(owner).digest("hex");
+}
+
+// ../../packages/core/src/platform/mcp-config.ts
+function buildStdioMcpServer(agent, serverFile, serverArgs, env) {
+  if (agent === "codex") {
+    return {
+      command: "node",
+      args: ["--import", TSX_LOADER, serverFile, ...serverArgs],
+      env: { TSX_TSCONFIG_PATH: TSCONFIG_PATH, ...env }
+    };
+  }
+  return {
+    command: "bun",
+    args: ["run", serverFile, ...serverArgs],
+    ...env ? { env } : {}
+  };
+}
+function useHostedBuiltinMcp() {
+  return envText("NEGOTIUM_BUILTIN_MCP_TRANSPORT") !== "stdio";
+}
+function buildBuiltinMcpServer(surface, ctx, stdio) {
+  if (!useHostedBuiltinMcp())
+    return stdio();
+  const agent = ctx.agent ?? FALLBACK_AGENT;
+  return buildHostedMcpSpec(agent, surface, {
+    userId: ctx.userId,
+    topicTitle: ctx.session,
+    ...ctx.topicId ? { topicId: ctx.topicId } : {},
+    ...ctx.queryId ? { queryId: ctx.queryId } : {},
+    ...ctx.wikiTopicId ? { wikiTopicId: ctx.wikiTopicId } : {},
+    ...ctx.subagentParentTopicId ? { subagentParentTopicId: ctx.subagentParentTopicId } : {},
+    cwd: ctx.cwd ?? (ctx.topicId ? resolveTopicWorkspaceDir(ctx.topicId) : process.cwd()),
+    agent,
+    ...ctx.model ? { model: ctx.model } : {},
+    ...ctx.depth !== undefined ? { depth: ctx.depth } : {},
+    ...ctx.silent !== undefined ? { silent: ctx.silent } : {},
+    ...ctx.peerBridge ? { peerBridge: ctx.peerBridge } : {}
+  });
+}
+var _playwrightUnavailableNotifier;
+var _playwrightUnavailableLastNotifiedAt = new Map;
+var _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS = 5 * 60000;
+var _playwrightUnavailableThisTurn = new Set;
+function _playwrightUnavailableKey(userId, topic) {
+  return `${userId}:${topic ?? ""}`;
+}
+function _markPlaywrightUnavailable(ctx) {
+  _playwrightUnavailableThisTurn.add(_playwrightUnavailableKey(ctx.userId, ctx.topic));
+  if (!_playwrightUnavailableNotifier)
+    return;
+  const key = _playwrightUnavailableKey(ctx.userId, ctx.topic);
+  const now = Date.now();
+  const last = _playwrightUnavailableLastNotifiedAt.get(key) ?? 0;
+  if (now - last < _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS)
+    return;
+  _playwrightUnavailableLastNotifiedAt.set(key, now);
+  try {
+    _playwrightUnavailableNotifier(ctx);
+  } catch (err) {
+    logger.warn({ err }, "playwright unavailable notifier threw");
+  }
+}
+var CODEX_BROWSER_CAPABILITY_ENV = "NEGOTIUM_BROWSER_CAPABILITY";
+function browserOwnerForContext(ctx) {
+  if (ctx.topicId)
+    return `topic:${ctx.topicId}`;
+  if (ctx.userId && ctx.session)
+    return `user:${ctx.userId}:${ctx.session}`;
+  return;
+}
+function playwrightTransport(port, owner, capability, agent) {
+  const ownerCapability = browserOwnerCapability(capability, owner);
+  if (agent === "codex") {
+    const query2 = new URLSearchParams({ owner });
+    return {
+      url: `http://127.0.0.1:${port}/mcp?${query2}`,
+      env_http_headers: { "X-Browser-Capability": CODEX_BROWSER_CAPABILITY_ENV }
+    };
+  }
+  const query = new URLSearchParams({ owner });
+  if (agent === "maestro") {
+    return buildStdioMcpServer("maestro", BROWSER_MCP_SSE_PROXY_SERVER, [], {
+      NEGOTIUM_BROWSER_SSE_URL: `http://127.0.0.1:${port}/sse?${query}`,
+      NEGOTIUM_BROWSER_OWNER_CAPABILITY: ownerCapability
+    });
+  }
+  return {
+    type: "sse",
+    url: `http://127.0.0.1:${port}/sse?${query}`,
+    headers: { "X-Browser-Capability": ownerCapability }
+  };
+}
+function longLivedHttpMcp(agent, port) {
+  return agent === "codex" ? { url: `http://127.0.0.1:${port}/mcp` } : { type: "sse", url: `http://127.0.0.1:${port}/sse` };
+}
+function backgroundBashTransport(agent, port, userId, topic) {
+  const capability = bgBashContextCapability(userId, topic);
+  const headers = {
+    "X-Background-Bash-User": userId,
+    "X-Background-Bash-Topic": topic,
+    "X-Background-Bash-Capability": capability
+  };
+  if (agent === "codex")
+    return { url: `http://127.0.0.1:${port}/mcp`, http_headers: headers };
+  if (agent === "maestro") {
+    const query = new URLSearchParams({ user: userId, topic, capability });
+    return { type: "sse", url: `http://127.0.0.1:${port}/sse?${query}` };
+  }
+  return { type: "sse", url: `http://127.0.0.1:${port}/sse`, headers };
+}
+var MCP_CATALOG = {
+  playwright: {
+    ...commonRuntimeMcpPolicy("playwright"),
+    build({ userId, session, topicId, playwrightPort, playwrightCapability, agent }) {
+      if (playwrightPort && playwrightCapability) {
+        const owner = browserOwnerForContext({ userId, session, topicId });
+        if (!owner)
+          return null;
+        return playwrightTransport(playwrightPort, owner, playwrightCapability, agent);
+      }
+      _markPlaywrightUnavailable({
+        userId,
+        topic: session,
+        agent
+      });
+      return null;
+    }
+  },
+  [RUNTIME_MCP_KEY]: {
+    ...commonRuntimeMcpPolicy("runtime"),
+    build({
+      userId,
+      session,
+      topicId,
+      queryId,
+      agent,
+      cwd,
+      model,
+      currentUserPrompt,
+      autoContinue,
+      visualTools,
+      fileDeliveryTools,
+      peerBridge
+    }) {
+      if (!topicId || !agent)
+        return null;
+      return buildRuntimeMcpSpec(agent, {
+        userId,
+        topicId,
+        topicTitle: session,
+        queryId,
+        cwd: cwd ?? resolveTopicWorkspaceDir(topicId),
+        agent,
+        model,
+        currentUserPrompt,
+        autoContinue,
+        visualTools,
+        fileDeliveryTools,
+        peerBridge
+      });
+    }
+  },
+  "token-stats": {
+    ...commonRuntimeMcpPolicy("token-stats"),
+    build(ctx) {
+      return buildBuiltinMcpServer("token-stats", ctx, () => buildStdioMcpServer(ctx.agent, TOKEN_STATS_SERVER, [`--user-id=${ctx.userId}`]));
+    }
+  },
+  task: {
+    ...commonRuntimeMcpPolicy("task"),
+    build(ctx) {
+      const { userId, session, topicId, queryId, agent, peerBridge } = ctx;
+      if (peerBridge) {
+        if (!topicId || !queryId)
+          return null;
+        const env = canonicalMcpBridgeEnv({
+          surface: "task",
+          userId,
+          topicId,
+          queryId,
+          peerBridge
+        });
+        return env ? buildStdioMcpServer(agent, CANONICAL_MCP_PROXY_SERVER, ["--surface=task"], env) : null;
+      }
+      const args = [`--user-id=${userId}`, `--topic=${session}`];
+      if (topicId)
+        args.push(`--topic-id=${topicId}`);
+      return buildBuiltinMcpServer("task", ctx, () => buildStdioMcpServer(agent, TASK_SERVER, args));
+    }
+  },
+  "session-comm": {
+    ...commonRuntimeMcpPolicy("session-comm"),
+    build(ctx) {
+      const {
+        userId,
+        session,
+        topicId,
+        subagentParentTopicId,
+        agent,
+        depth = 0,
+        silent,
+        peerBridge
+      } = ctx;
+      const effectiveAgent = agent ?? FALLBACK_AGENT;
+      const args = [
+        `--user-id=${userId}`,
+        `--topic=${session}`,
+        ...topicId ? [`--topic-id=${topicId}`] : [],
+        ...subagentParentTopicId ? [`--subagent-parent-topic-id=${subagentParentTopicId}`] : [],
+        `--depth=${depth}`,
+        `--agent=${effectiveAgent}`,
+        ...silent ? ["--reply-only=true"] : [],
+        ...peerBridge ? [`--peer-host-query-id=${peerBridge.hostQueryId}`] : []
+      ];
+      return buildBuiltinMcpServer("session-comm", ctx, () => buildStdioMcpServer(effectiveAgent, SESSION_COMM_SERVER, args, peerBridge ? peerSessionBridgeIpcEnv() : undefined));
+    }
+  },
+  wiki: {
+    ...commonRuntimeMcpPolicy("wiki"),
+    build(ctx) {
+      const { userId, session, topicId, queryId, wikiTopicId, agent, peerBridge } = ctx;
+      if (peerBridge) {
+        if (!topicId || !queryId)
+          return null;
+        const env = canonicalMcpBridgeEnv({
+          surface: "wiki",
+          userId,
+          topicId,
+          queryId,
+          peerBridge
+        });
+        return env ? buildStdioMcpServer(agent, CANONICAL_MCP_PROXY_SERVER, ["--surface=wiki"], env) : null;
+      }
+      const args = [`--user-id=${userId}`];
+      const resolvedWikiTopicId = wikiTopicId ?? topicId ?? (session !== "dm" ? session : undefined);
+      if (resolvedWikiTopicId)
+        args.push(`--topic-id=${resolvedWikiTopicId}`);
+      args.push("--surface=wiki");
+      return buildBuiltinMcpServer("wiki", { ...ctx, wikiTopicId: resolvedWikiTopicId }, () => buildStdioMcpServer(agent, WIKI_SERVER, args));
+    }
+  },
+  skills: {
+    ...commonRuntimeMcpPolicy("skills"),
+    build(ctx) {
+      const { userId, topicId, agent } = ctx;
+      const args = [`--user-id=${userId}`, "--surface=skills"];
+      if (topicId)
+        args.push(`--topic-id=${topicId}`);
+      return buildBuiltinMcpServer("skills", ctx, () => buildStdioMcpServer(agent, WIKI_SERVER, args));
+    }
+  },
+  "system-health": {
+    ...commonRuntimeMcpPolicy("system-health"),
+    build(ctx) {
+      return buildBuiltinMcpServer("system-health", ctx, () => buildStdioMcpServer(ctx.agent, SYSTEM_HEALTH_SERVER, []));
+    }
+  },
+  "background-bash": {
+    ...commonRuntimeMcpPolicy("background-bash"),
+    build({ agent, bgBashPort, userId, topicId }) {
+      if (bgBashPort === undefined || !topicId)
+        return null;
+      return backgroundBashTransport(agent, bgBashPort, userId, topicId);
+    }
+  },
+  "agent-health": {
+    ...commonRuntimeMcpPolicy("agent-health"),
+    build(ctx) {
+      const { userId, agent } = ctx;
+      const args = [`--user-id=${userId}`];
+      return buildBuiltinMcpServer("agent-health", ctx, () => buildStdioMcpServer(agent, AGENT_HEALTH_SERVER, args));
+    }
+  },
+  vault: {
+    ...commonRuntimeMcpPolicy("vault"),
+    build(ctx) {
+      const { userId, vaultUserId, agent } = ctx;
+      const args = [`--user-id=${vaultUserId ?? userId}`];
+      if (agent !== "codex")
+        args.push("--list-only=true");
+      return buildBuiltinMcpServer("vault", { ...ctx, userId: vaultUserId ?? userId }, () => buildStdioMcpServer(agent, VAULT_SERVER, args));
+    }
+  }
+};
+var allForumMcpServerNames = [];
+var requiredForumMcpServers = [];
+var REQUIRED_FORUM_MCP_SERVERS = requiredForumMcpServers;
+var optionalForumMcpServers = [];
+function refreshForumCatalogViews() {
+  const { all, required, optional } = classifyForumMcpServers(MCP_CATALOG);
+  allForumMcpServerNames.splice(0, allForumMcpServerNames.length, ...all);
+  requiredForumMcpServers.splice(0, requiredForumMcpServers.length, ...required);
+  optionalForumMcpServers.splice(0, optionalForumMcpServers.length, ...optional);
+}
+refreshForumCatalogViews();
+var nodeMcpEntries = [];
+function buildNodeMcpSpecs(agent, filter) {
+  const out = {};
+  for (const entry of nodeMcpEntries) {
+    if (!filter(entry.key))
+      continue;
+    out[entry.key] = entry.kind === "http" ? longLivedHttpMcp(agent, entry.port) : {
+      command: entry.command,
+      args: entry.args ?? [],
+      ...entry.env ? { env: entry.env } : {}
+    };
+  }
+  return out;
+}
+function buildScope(scope, ctx, filter = () => true) {
+  const out = {};
+  for (const [name, entry] of Object.entries(MCP_CATALOG)) {
+    if (!entry.scopes.includes(scope))
+      continue;
+    if (!filter(name))
+      continue;
+    const spec = entry.build(ctx);
+    if (spec === null)
+      continue;
+    out[name] = spec;
+  }
+  if (scope !== "cron") {
+    Object.assign(out, buildNodeMcpSpecs(ctx.agent, filter));
+  }
+  return out;
+}
+function getDmMcpServers(opts) {
+  return buildScope("dm", {
+    userId: opts.userId,
+    session: "dm",
+    agent: opts.agent,
+    playwrightPort: opts.playwrightPort,
+    playwrightCapability: opts.playwrightCapability
+  });
+}
+function getManagerMcpServers(opts) {
+  if (!opts.topicId) {
+    throw new Error("getManagerMcpServers: private General topicId is required");
+  }
+  const topicId = opts.topicId;
+  return buildScope("manager", {
+    userId: opts.userId,
+    session: opts.session ?? "General",
+    topicId,
+    queryId: opts.queryId,
+    wikiTopicId: opts.wikiTopicId ?? topicId,
+    agent: opts.agent,
+    cwd: opts.cwd,
+    model: opts.model,
+    currentUserPrompt: opts.currentUserPrompt,
+    playwrightPort: opts.playwrightPort,
+    playwrightCapability: opts.playwrightCapability,
+    autoContinue: opts.autoContinue,
+    visualTools: opts.visualTools,
+    fileDeliveryTools: opts.fileDeliveryTools
+  });
+}
+function getForumMcpServers(opts) {
+  const {
+    userId,
+    vaultUserId,
+    session,
+    topicId,
+    subagentParentTopicId,
+    queryId,
+    wikiTopicId,
+    agent,
+    cwd,
+    model,
+    currentUserPrompt,
+    playwrightPort,
+    playwrightCapability,
+    depth = 0,
+    enabled = null,
+    extra = {},
+    silent = false,
+    bgBashPort,
+    autoContinue,
+    visualTools,
+    fileDeliveryTools,
+    peerBridge
+  } = opts;
+  const filter = (name) => {
+    if (silent && name === "task")
+      return false;
+    if (enabled === null)
+      return true;
+    return enabled.includes(name) || REQUIRED_FORUM_MCP_SERVERS.includes(name);
+  };
+  const base = buildScope("forum", {
+    userId,
+    vaultUserId,
+    session,
+    topicId,
+    subagentParentTopicId,
+    queryId,
+    wikiTopicId,
+    agent,
+    cwd,
+    model,
+    currentUserPrompt,
+    depth,
+    playwrightPort,
+    playwrightCapability,
+    bgBashPort,
+    autoContinue,
+    visualTools,
+    fileDeliveryTools,
+    silent,
+    peerBridge
+  }, filter);
+  return { ...base, ...extra };
+}
+function getCronMcpServers(opts) {
+  return buildScope("cron", {
+    userId: opts.userId,
+    session: opts.session,
+    topicId: opts.topicId,
+    queryId: opts.queryId,
+    wikiTopicId: opts.wikiTopicId ?? opts.topicId,
+    agent: opts.agent,
+    cwd: opts.cwd,
+    model: opts.model,
+    currentUserPrompt: opts.currentUserPrompt,
+    playwrightPort: opts.playwrightPort,
+    playwrightCapability: opts.playwrightCapability,
+    autoContinue: false,
+    visualTools: opts.visualTools,
+    fileDeliveryTools: opts.fileDeliveryTools
+  });
+}
+function getMcpServersForQuery(opts) {
+  if (opts.toolPolicy === "none")
+    return {};
+  if (opts.toolPolicy === "compaction-log") {
+    const compactLog = opts.mcpExtra?.compact_log;
+    return compactLog ? { compact_log: compactLog } : {};
+  }
+  if (opts.sessionType === "cron") {
+    if (!opts.topicId)
+      throw new Error("getMcpServersForQuery: cron sessionType requires topicId");
+    return getCronMcpServers({
+      userId: opts.userId || "local",
+      session: opts.session || "cron",
+      topicId: opts.topicId,
+      queryId: opts.queryId,
+      wikiTopicId: opts.wikiTopicId,
+      agent: opts.agent,
+      cwd: opts.cwd,
+      model: opts.model,
+      currentUserPrompt: opts.prompt,
+      playwrightPort: opts.playwrightPort,
+      playwrightCapability: opts.playwrightCapability,
+      visualTools: opts.visualTools,
+      fileDeliveryTools: opts.fileDeliveryTools
+    });
+  }
+  if (opts.sessionType === "dm" || opts.sessionType === "ephemeral") {
+    return getDmMcpServers({
+      userId: opts.userId || "local",
+      agent: opts.agent,
+      playwrightPort: opts.playwrightPort,
+      playwrightCapability: opts.playwrightCapability
+    });
+  }
+  if (opts.sessionType === "manager") {
+    return getManagerMcpServers({
+      userId: opts.userId || "local",
+      session: opts.session,
+      topicId: opts.topicId,
+      queryId: opts.queryId,
+      wikiTopicId: opts.wikiTopicId,
+      agent: opts.agent,
+      cwd: opts.cwd,
+      model: opts.model,
+      currentUserPrompt: opts.prompt,
+      playwrightPort: opts.playwrightPort,
+      playwrightCapability: opts.playwrightCapability,
+      autoContinue: opts.autoContinue,
+      visualTools: opts.visualTools,
+      fileDeliveryTools: opts.fileDeliveryTools
+    });
+  }
+  return getForumMcpServers({
+    userId: opts.userId || "local",
+    vaultUserId: opts.vaultUserId,
+    session: opts.session || "default",
+    topicId: opts.topicId,
+    subagentParentTopicId: opts.subagentParentTopicId,
+    queryId: opts.queryId,
+    wikiTopicId: opts.wikiTopicId,
+    agent: opts.agent,
+    cwd: opts.cwd,
+    model: opts.model,
+    currentUserPrompt: opts.prompt,
+    playwrightPort: opts.playwrightPort,
+    playwrightCapability: opts.playwrightCapability,
+    bgBashPort: opts.bgBashPort,
+    autoContinue: opts.autoContinue,
+    visualTools: opts.visualTools,
+    fileDeliveryTools: opts.fileDeliveryTools,
+    depth: opts.depth,
+    enabled: opts.mcpEnabled,
+    extra: opts.mcpExtra,
+    silent: opts.silent,
+    peerBridge: opts.peerBridge
+  });
+}
+
+// ../../packages/core/src/storage/vault.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4 } from "fs";
+import { join as join3 } from "path";
+
+// ../../packages/core/src/storage/sqlite.ts
+var isBun = typeof process.versions.bun === "string";
+var Database;
+if (isBun) {
+  ({ Database } = await import("bun:sqlite"));
+} else {
+  const nodeSqliteSpecifier = ["node", "sqlite"].join(":");
+  const { DatabaseSync } = await import(nodeSqliteSpecifier);
+
+  class NodeDatabase {
+    #db;
+    constructor(path, options = {}) {
+      this.#db = options.readonly ? new DatabaseSync(path, { readOnly: true }) : new DatabaseSync(path);
+    }
+    query(sql) {
+      return this.#db.prepare(sql);
+    }
+    prepare(sql) {
+      return this.#db.prepare(sql);
+    }
+    exec(sql) {
+      this.#db.exec(sql);
+    }
+    run(sql, ...params) {
+      return this.#db.prepare(sql).run(...params);
+    }
+    transaction(fn) {
+      const run = (begin) => (...args) => {
+        this.#db.exec(begin);
+        try {
+          const result = fn(...args);
+          this.#db.exec("COMMIT");
+          return result;
+        } catch (err) {
+          this.#db.exec("ROLLBACK");
+          throw err;
+        }
+      };
+      const tx = run("BEGIN");
+      tx.deferred = run("BEGIN DEFERRED");
+      tx.immediate = run("BEGIN IMMEDIATE");
+      tx.exclusive = run("BEGIN EXCLUSIVE");
+      return tx;
+    }
+    close() {
+      this.#db.close();
+    }
+  }
+  Database = NodeDatabase;
+}
+
+// ../../packages/core/src/storage/vault-crypto-core.ts
+import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes3 } from "crypto";
+var ENVELOPE_PREFIX = "otium-vault:v1:";
+var IV_BYTES = 12;
+var KEY_BYTES = 32;
+function encryptionKey(masterKey) {
+  return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
+}
+function aad(userId, key) {
+  return Buffer.from(`${userId}\x00${key.toUpperCase()}`, "utf8");
+}
+function isEncryptedVaultValue(value) {
+  return value.startsWith(ENVELOPE_PREFIX);
+}
+function encryptVaultValueWithKey(userId, key, value, masterKey) {
+  const iv = randomBytes3(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  cipher.setAAD(aad(userId, key));
+  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+}
+function decryptVaultValueWithKey(userId, key, storedValue, masterKey) {
+  if (!isEncryptedVaultValue(storedValue)) {
+    return { value: storedValue, legacyPlaintext: true };
+  }
+  const encoded = storedValue.slice(ENVELOPE_PREFIX.length);
+  const [ivPart, ciphertextPart, tagPart, ...extra] = encoded.split(".");
+  if (!ivPart || ciphertextPart === undefined || !tagPart || extra.length > 0) {
+    throw new Error("Invalid encrypted vault value");
+  }
+  const iv = Buffer.from(ivPart, "base64url");
+  const ciphertext = Buffer.from(ciphertextPart, "base64url");
+  const tag = Buffer.from(tagPart, "base64url");
+  if (iv.length !== IV_BYTES || tag.length !== 16) {
+    throw new Error("Invalid encrypted vault value");
+  }
+  const decipher = createDecipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  decipher.setAAD(aad(userId, key));
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return { value: plaintext.toString("utf8"), legacyPlaintext: false };
+}
+
+// ../../packages/core/src/storage/vault-crypto.ts
+function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+  return encryptVaultValueWithKey(userId, key, value, masterKey);
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
+}
+
+// ../../packages/core/src/storage/vault.ts
+var vaultDb;
+var vaultMasterKey = VAULT_MASTER_KEY;
+function initializeVaultDatabase(database) {
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA busy_timeout = 5000");
+  database.exec(`
+  CREATE TABLE IF NOT EXISTS vault (
+    user_id     TEXT    NOT NULL,
+    key         TEXT    NOT NULL,
+    value       TEXT    NOT NULL,
+    description TEXT    NOT NULL DEFAULT '',
+    PRIMARY KEY (user_id, key)
+  )
+  `);
+  {
+    const cols = database.prepare("PRAGMA table_info(vault)").all();
+    const uid = cols.find((c) => c.name === "user_id");
+    if (uid && uid.type.toUpperCase() === "INTEGER") {
+      database.exec("BEGIN");
+      database.exec(`
+      CREATE TABLE vault_migrated (
+        user_id     TEXT    NOT NULL,
+        key         TEXT    NOT NULL,
+        value       TEXT    NOT NULL,
+        description TEXT    NOT NULL DEFAULT '',
+        PRIMARY KEY (user_id, key)
+      )
+    `);
+      database.exec("INSERT INTO vault_migrated SELECT CAST(user_id AS TEXT), key, value, description FROM vault");
+      database.exec("DROP TABLE vault");
+      database.exec("ALTER TABLE vault_migrated RENAME TO vault");
+      database.exec("COMMIT");
+    }
+  }
+}
+function openVaultDatabase(dataDir) {
+  const vaultDir = join3(dataDir, "vault");
+  const path = join3(vaultDir, "vault.db");
+  mkdirSync4(vaultDir, { recursive: true, mode: 448 });
+  const database = new Database(path, { create: true });
+  chmodSync2(path, 384);
+  initializeVaultDatabase(database);
+  return database;
+}
+function activeVaultDatabase() {
+  if (!vaultDb)
+    vaultDb = openVaultDatabase(DATA_DIR);
+  return vaultDb;
+}
+var VAULT_VALUE_MAX_BYTES = 64 * 1024;
+function normalizeVaultKey(key) {
+  return key.trim().toUpperCase();
+}
+function decryptRow(userId, key, storedValue) {
+  const database = activeVaultDatabase();
+  const decoded = decryptVaultValue(userId, key, storedValue, vaultMasterKey);
+  if (decoded.legacyPlaintext) {
+    database.prepare("UPDATE vault SET value = ? WHERE user_id = ? AND key = ? AND value = ?").run(encryptVaultValue(userId, key, decoded.value, vaultMasterKey), userId, key, storedValue);
+  }
+  return decoded.value;
+}
+function vaultListDecryptableValues(userId) {
+  const rows = activeVaultDatabase().prepare("SELECT key, description, value FROM vault WHERE user_id = ? ORDER BY key").all(userId);
+  const entries = [];
+  for (const row of rows) {
+    try {
+      entries.push({
+        key: row.key,
+        description: row.description,
+        value: decryptRow(userId, row.key, row.value)
+      });
+    } catch {}
+  }
+  return entries;
+}
+function vaultGetValue(userId, key) {
+  const normalizedKey = normalizeVaultKey(key);
+  const row = activeVaultDatabase().prepare("SELECT key, value FROM vault WHERE user_id = ? AND key = ?").get(userId, normalizedKey);
+  return row ? decryptRow(userId, row.key, row.value) : undefined;
+}
+function vaultSubstituteDetailed(userId, text) {
+  const entries = new Map;
+  const usedKeys = new Set;
+  const substituted = text.replace(/\{\{([^}]+)\}\}/g, (match, rawKey) => {
+    const key = normalizeVaultKey(rawKey);
+    if (!entries.has(key))
+      entries.set(key, vaultGetValue(userId, key));
+    const value = entries.get(key);
+    if (value === undefined)
+      return match;
+    usedKeys.add(key);
+    return value;
+  });
+  return { text: substituted, usedKeys: [...usedKeys] };
+}
+function encodedSecretForms(value) {
+  const forms = new Set([
+    value,
+    encodeURIComponent(value),
+    Buffer.from(value, "utf8").toString("base64"),
+    Buffer.from(value, "utf8").toString("base64url"),
+    Buffer.from(value, "utf8").toString("hex")
+  ]);
+  forms.delete("");
+  return [...forms].sort((a, b) => b.length - a.length);
+}
+function redactVaultSecrets(userId, text) {
+  const candidates = vaultListDecryptableValues(userId).flatMap((entry) => encodedSecretForms(entry.value).map((form) => ({ form, key: entry.key }))).sort((a, b) => b.form.length - a.form.length || a.key.localeCompare(b.key));
+  if (candidates.length === 0)
+    return text;
+  const candidatesByFirstCharacter = new Map;
+  for (const candidate of candidates) {
+    const first = candidate.form[0];
+    if (!first)
+      continue;
+    const bucket = candidatesByFirstCharacter.get(first) ?? [];
+    bucket.push(candidate);
+    candidatesByFirstCharacter.set(first, bucket);
+  }
+  let redacted = "";
+  let offset = 0;
+  while (offset < text.length) {
+    const match = candidatesByFirstCharacter.get(text[offset] ?? "")?.find((candidate) => text.startsWith(candidate.form, offset));
+    if (!match) {
+      redacted += text[offset];
+      offset += 1;
+      continue;
+    }
+    redacted += `[REDACTED:${match.key}]`;
+    offset += match.form.length;
+  }
+  return redacted;
+}
+
+// ../../packages/core/src/agents/execution-host.ts
+var defaultHost = {
+  getMcpServersForQuery,
+  redactVaultSecrets,
+  substituteVaultSecrets: (userId, value) => vaultSubstituteDetailed(userId, value).text,
+  referencesRuntimeSecretStorage,
+  shouldRedirectVaultTool,
+  claudeCodeExecutablePath: () => CLAUDE_EXECUTABLE,
+  codexAuthFilePath
+};
+var hostRegistrations = [];
+var scopedHost = new AsyncLocalStorage;
+function activeHost() {
+  const scoped = scopedHost.getStore();
+  if (scoped)
+    return scoped;
+  const host = { ...defaultHost };
+  for (const registration of hostRegistrations)
+    Object.assign(host, registration.overrides);
+  return host;
+}
+function hostedCodexAuthFilePath() {
+  return activeHost().codexAuthFilePath();
+}
+function hostedCodexHomePath() {
+  return dirname3(hostedCodexAuthFilePath());
+}
+
+// ../../packages/core/src/agents/rollout/codex.ts
+function codexSessionsDir() {
+  return join4(hostedCodexHomePath(), "sessions");
+}
+var _shellCache = null;
+function loadCodexShell() {
+  if (_shellCache)
+    return _shellCache;
+  const raw = readFileSync4(join4(FIXTURES_DIR, "codex-shell.jsonl"), "utf8");
+  const lines = parseJsonlText(raw);
+  if (lines.length < 5) {
+    throw new Error(`loadCodexShell: expected >=5 entries in codex-shell.jsonl, got ${lines.length}`);
+  }
+  _shellCache = {
+    sessionMeta: lines[0],
+    taskStarted: lines[1],
+    developerSetup: lines[2],
+    envContext: lines[3],
+    turnContext: lines[4]
+  };
+  return _shellCache;
+}
+function uuidv7() {
+  const ts = Date.now();
+  const tsHex = ts.toString(16).padStart(12, "0");
+  const rand = randomBytes4(10);
+  rand[0] = rand[0] & 15 | 112;
+  rand[2] = rand[2] & 63 | 128;
+  return [
+    tsHex.slice(0, 8),
+    tsHex.slice(8, 12),
+    rand.slice(0, 2).toString("hex"),
+    rand.slice(2, 4).toString("hex"),
+    rand.slice(4, 10).toString("hex")
+  ].join("-");
+}
+function patchDeveloperSetup(developerSetup) {
+  const payload = developerSetup.payload;
+  if (!payload)
+    return;
+  payload.content = [
+    {
+      type: "input_text",
+      text: [
+        "<permissions instructions>",
+        "Filesystem sandboxing is disabled for this runtime turn (`danger-full-access`).",
+        "Approval policy is `never`.",
+        "</permissions instructions>"
+      ].join(`
+`)
+    }
+  ];
+}
+function patchEnvContext(envContext, cwd, currentDate, timezone) {
+  const payload = envContext.payload;
+  if (!payload)
+    return;
+  const content = payload.content;
+  if (!Array.isArray(content))
+    return;
+  for (const block of content) {
+    if (block.type === "input_text" && typeof block.text === "string") {
+      block.text = block.text.replace(/<cwd>[^<]*<\/cwd>/, `<cwd>${cwd}</cwd>`).replace(/<current_date>[^<]*<\/current_date>/, `<current_date>${currentDate}</current_date>`).replace(/<timezone>[^<]*<\/timezone>/, `<timezone>${timezone}</timezone>`);
+    }
+  }
+}
+function codexRolloutPath(threadId, fallback) {
+  const threadCreatedAt = decodeUuidV7Timestamp(threadId);
+  const createdAt = threadCreatedAt === null ? fallback : new Date(threadCreatedAt);
+  const yyyy = String(createdAt.getFullYear());
+  const mm = String(createdAt.getMonth() + 1).padStart(2, "0");
+  const dd = String(createdAt.getDate()).padStart(2, "0");
+  const hh = String(createdAt.getHours()).padStart(2, "0");
+  const min = String(createdAt.getMinutes()).padStart(2, "0");
+  const ss = String(createdAt.getSeconds()).padStart(2, "0");
+  const dir = join4(codexSessionsDir(), yyyy, mm, dd);
+  return join4(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
+}
+function canonicalFilePath(path) {
+  const absolute = resolve4(path);
+  try {
+    return realpathSync2(absolute);
+  } catch {
+    try {
+      return join4(realpathSync2(dirname4(absolute)), basename(absolute));
+    } catch {
+      return absolute;
+    }
+  }
+}
+function changedPatchLines(value) {
+  const removed = [];
+  const added = [];
+  const diffPreview = [];
+  let oldLine = 0;
+  let newLine = 0;
+  let sawHunk = false;
+  for (const line of value.split(`
+`)) {
+    const hunk = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      if (sawHunk)
+        diffPreview.push("\u2026");
+      sawHunk = true;
+      oldLine = Number.parseInt(hunk[1] ?? "0", 10);
+      newLine = Number.parseInt(hunk[2] ?? "0", 10);
+      continue;
+    }
+    if (!sawHunk && (line.startsWith("--- ") || line.startsWith("+++ ")))
+      continue;
+    if (line.startsWith("\\ No newline"))
+      continue;
+    if (line.startsWith("-")) {
+      removed.push(line.slice(1));
+      diffPreview.push(`${oldLine} -${line.slice(1)}`);
+      oldLine += 1;
+      continue;
+    }
+    if (line.startsWith("+")) {
+      added.push(line.slice(1));
+      diffPreview.push(`${newLine} +${line.slice(1)}`);
+      newLine += 1;
+      continue;
+    }
+    if (line.startsWith(" ")) {
+      diffPreview.push(`${newLine}  ${line.slice(1)}`);
+      oldLine += 1;
+      newLine += 1;
+    }
+  }
+  return {
+    ...removed.length > 0 ? { before: removed.join(`
+`) } : {},
+    ...added.length > 0 ? { after: added.join(`
+`) } : {},
+    ...diffPreview.length > 0 ? { diffPreview: diffPreview.join(`
+`) } : {}
+  };
+}
+function extractLatestCodexPatchPreview(jsonl, expectedPaths, consumedCallIds = new Set, expectedCallId) {
+  const expected = expectedPaths.map(canonicalFilePath);
+  const lines = jsonl.trimEnd().split(`
+`);
+  for (let index = lines.length - 1;index >= 0; index -= 1) {
+    try {
+      const entry = JSON.parse(lines[index] ?? "");
+      if (entry.type !== "event_msg" || entry.payload?.type !== "patch_apply_end")
+        continue;
+      const callId = entry.payload.call_id;
+      const rawChanges = entry.payload.changes;
+      if (!callId || consumedCallIds.has(callId) || expectedCallId !== undefined && callId !== expectedCallId || !rawChanges) {
+        continue;
+      }
+      const entries = Object.entries(rawChanges);
+      const matched = expected.map((path) => entries.find(([candidate]) => canonicalFilePath(candidate) === path));
+      const complete = matched.filter((change) => change !== undefined);
+      if (complete.length !== expected.length)
+        continue;
+      return {
+        callId,
+        changes: complete.map(([path, change]) => {
+          if (typeof change.unified_diff === "string") {
+            return { path, ...changedPatchLines(change.unified_diff) };
+          }
+          const content = typeof change.content === "string" ? change.content.replace(/\n$/, "") : undefined;
+          return {
+            path,
+            ...change.type === "delete" && content !== undefined ? { before: content } : {},
+            ...change.type === "add" && content !== undefined ? { after: content } : {}
+          };
+        })
+      };
+    } catch {}
+  }
+  return;
+}
+function extractCodexPatchCallIds(jsonl) {
+  const callIds = [];
+  for (const line of jsonl.trimEnd().split(`
+`)) {
+    try {
+      const entry = JSON.parse(line);
+      if (entry.type === "event_msg" && entry.payload?.type === "patch_apply_end" && typeof entry.payload.call_id === "string") {
+        callIds.push(entry.payload.call_id);
+      }
+    } catch {}
+  }
+  return callIds;
+}
+function readCodexPatchCallIds(threadId) {
+  const path = latestCodexRolloutPath(threadId);
+  if (!path)
+    return [];
+  try {
+    return extractCodexPatchCallIds(readFileSync4(path, "utf8"));
+  } catch (error) {
+    logger.debug({ error, threadId }, "codex patch ids: rollout read failed");
+    return [];
+  }
+}
+function readLatestCodexPatchPreview(threadId, expectedPaths, consumedCallIds = new Set, expectedCallId) {
+  const path = latestCodexRolloutPath(threadId);
+  if (!path)
+    return;
+  try {
+    return extractLatestCodexPatchPreview(readFileSync4(path, "utf8"), expectedPaths, consumedCallIds, expectedCallId);
+  } catch (error) {
+    logger.debug({ error, threadId }, "codex patch preview: rollout read failed");
+    return;
+  }
+}
+function extractLatestCodexContextUsage(jsonl) {
+  const lines = jsonl.trimEnd().split(`
+`);
+  for (let index = lines.length - 1;index >= 0; index -= 1) {
+    try {
+      const entry = JSON.parse(lines[index] ?? "");
+      if (entry.type !== "event_msg" || entry.payload?.type !== "token_count")
+        continue;
+      const contextTokens = entry.payload.info?.last_token_usage?.total_tokens;
+      const contextWindow = entry.payload.info?.model_context_window;
+      if (typeof contextTokens === "number" && Number.isFinite(contextTokens) && contextTokens >= 0 && typeof contextWindow === "number" && Number.isFinite(contextWindow) && contextWindow > 0) {
+        return { contextTokens, contextWindow };
+      }
+    } catch {}
+  }
+  return;
+}
+function readLatestCodexContextUsage(threadId) {
+  const path = latestCodexRolloutPath(threadId);
+  if (!path)
+    return;
+  try {
+    return extractLatestCodexContextUsage(readFileSync4(path, "utf8"));
+  } catch (error) {
+    logger.debug({ error, threadId }, "codex context usage: rollout read failed");
+    return;
+  }
+}
+function migrateCodexRolloutNativeMultiAgentMetadata(threadId) {
+  const path = latestCodexRolloutPath(threadId);
+  if (!path)
+    return false;
+  try {
+    const entries = parseJsonlText(readFileSync4(path, "utf8"));
+    let changed = false;
+    for (const entry of entries) {
+      if (entry.type !== "session_meta" && entry.type !== "turn_context")
+        continue;
+      if (!entry.payload)
+        entry.payload = {};
+      if (entry.payload.multi_agent_version !== "disabled") {
+        entry.payload.multi_agent_version = "disabled";
+        changed = true;
+      }
+    }
+    if (changed) {
+      writeJsonlFile(path, entries);
+      logger.info({ threadId, path }, "codex rollout native multi-agent metadata disabled");
+    }
+    return changed;
+  } catch (error) {
+    logger.error({ error, threadId, path }, "codex rollout native multi-agent migration failed");
+    throw new Error(`Failed to migrate Codex rollout '${threadId}'`, { cause: error });
+  }
+}
+function latestCodexRolloutPath(threadId) {
+  const sessionsDir = codexSessionsDir();
+  const candidates = [];
+  const buckets = candidateDateBuckets(threadId);
+  try {
+    if (buckets) {
+      for (const bucket of buckets) {
+        const dir = join4(sessionsDir, bucket);
+        if (!existsSync3(dir))
+          continue;
+        const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
+        for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
+          candidates.push(join4(dir, rel));
+        }
+      }
+    }
+    if (candidates.length === 0) {
+      const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
+      for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
+        candidates.push(join4(sessionsDir, rel));
+      }
+    }
+    return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
+  } catch (error) {
+    logger.debug({ error, threadId }, "codex rollout lookup failed");
+    return;
+  }
+}
+function writeCodexRollout(opts) {
+  const threadId = opts.threadId ?? uuidv7();
+  assertUuidLike("threadId", threadId);
+  ensureCwdExists(opts.cwd);
+  const pairs = opts.pairs ?? extractChatPairs(opts.entries ?? []);
+  const now = new Date;
+  const tsIso = now.toISOString();
+  const currentDate = [
+    now.getFullYear(),
+    String(now.getMonth() + 1).padStart(2, "0"),
+    String(now.getDate()).padStart(2, "0")
+  ].join("-");
+  const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone || process.env.TZ || "UTC";
+  const shell = loadCodexShell();
+  const sessionMeta = clone(shell.sessionMeta);
+  sessionMeta.payload.id = threadId;
+  sessionMeta.payload.timestamp = tsIso;
+  sessionMeta.payload.cwd = opts.cwd;
+  sessionMeta.payload.multi_agent_version = "disabled";
+  sessionMeta.timestamp = tsIso;
+  const taskStarted = clone(shell.taskStarted);
+  taskStarted.timestamp = tsIso;
+  const developerSetup = clone(shell.developerSetup);
+  developerSetup.timestamp = tsIso;
+  patchDeveloperSetup(developerSetup);
+  const envContext = clone(shell.envContext);
+  envContext.timestamp = tsIso;
+  patchEnvContext(envContext, opts.cwd, currentDate, timezone);
+  const turnContext = clone(shell.turnContext);
+  turnContext.timestamp = tsIso;
+  const turnPayload = turnContext.payload;
+  turnPayload.cwd = opts.cwd;
+  turnPayload.current_date = currentDate;
+  turnPayload.timezone = timezone;
+  turnPayload.approval_policy = "never";
+  turnPayload.sandbox_policy = { type: "danger-full-access" };
+  turnPayload.multi_agent_version = "disabled";
+  delete turnPayload.permission_profile;
+  if (opts.model)
+    turnPayload.model = opts.model;
+  const collaborationMode = turnPayload.collaboration_mode;
+  const collaborationSettings = collaborationMode?.settings;
+  if (collaborationSettings) {
+    if (opts.model)
+      collaborationSettings.model = opts.model;
+    if (opts.effort !== undefined)
+      collaborationSettings.reasoning_effort = opts.effort;
+  }
+  const lines = [sessionMeta, taskStarted, developerSetup, envContext, turnContext];
+  for (const pair of pairs) {
+    lines.push({
+      timestamp: tsIso,
+      type: "response_item",
+      payload: {
+        type: "message",
+        role: "user",
+        content: [{ type: "input_text", text: pair.userText }]
+      }
+    });
+    lines.push({
+      timestamp: tsIso,
+      type: "event_msg",
+      payload: {
+        type: "user_message",
+        message: pair.userText,
+        images: [],
+        local_images: [],
+        text_elements: []
+      }
+    });
+    lines.push({
+      timestamp: tsIso,
+      type: "event_msg",
+      payload: {
+        type: "agent_message",
+        message: pair.assistantText,
+        phase: "final_answer",
+        memory_citation: null
+      }
+    });
+    lines.push({
+      timestamp: tsIso,
+      type: "response_item",
+      payload: {
+        type: "message",
+        role: "assistant",
+        content: [{ type: "output_text", text: pair.assistantText }],
+        phase: "final_answer"
+      }
+    });
+  }
+  lines.push({
+    timestamp: tsIso,
+    type: "event_msg",
+    payload: { type: "task_complete" }
+  });
+  const path = codexRolloutPath(threadId, now);
+  if (opts.threadId) {
+    sweepPriorRolloutsForThread(opts.threadId);
+  }
+  writeJsonlFile(path, lines);
+  logger.info({ threadId, path, pairs: pairs.length }, "writeCodexRollout: synthetic rollout placed");
+  return { threadId, rolloutPath: path };
+}
+function sweepPriorRolloutsForThread(threadId) {
+  const sessionsDir = codexSessionsDir();
+  const buckets = candidateDateBuckets(threadId);
+  if (!buckets) {
+    sweepPriorRolloutsFullTree(threadId, sessionsDir);
+    return;
+  }
+  for (const bucket of buckets) {
+    const dir = join4(sessionsDir, bucket);
+    if (!existsSync3(dir))
+      continue;
+    try {
+      const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
+      for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
+        const fullPath = join4(dir, rel);
+        try {
+          unlinkSync3(fullPath);
+        } catch (e) {
+          if (e?.code !== "ENOENT") {
+            logger.warn({ err: e, path: fullPath }, "writeCodexRollout: prior-rollout unlink failed (continuing)");
+          }
+        }
+      }
+    } catch (e) {
+      logger.warn({ err: e, threadId, bucket }, "writeCodexRollout: prior-rollout bucket scan failed (continuing)");
+    }
+  }
+}
+function sweepPriorRolloutsFullTree(threadId, sessionsDir) {
+  try {
+    const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
+    for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
+      const fullPath = join4(sessionsDir, rel);
+      try {
+        unlinkSync3(fullPath);
+      } catch (e) {
+        if (e?.code !== "ENOENT") {
+          logger.warn({ err: e, path: fullPath }, "writeCodexRollout: prior-rollout unlink failed (continuing)");
+        }
+      }
+    }
+  } catch (e) {
+    logger.warn({ err: e, threadId }, "writeCodexRollout: full-tree prior-rollout sweep failed (continuing)");
+  }
+}
+var MAX_DAY_SPAN = 30;
+var DAY_MS = 86400000;
+var LOCAL_DATE_SKEW_DAYS = 1;
+function candidateDateBuckets(threadId) {
+  const tidMs = decodeUuidV7Timestamp(threadId);
+  if (tidMs === null)
+    return null;
+  const nowMs = Date.now();
+  const tidDay = Math.floor(tidMs / DAY_MS);
+  const todayDay = Math.floor(nowMs / DAY_MS);
+  const minDay = Math.min(tidDay, todayDay);
+  const maxDay = Math.max(tidDay, todayDay);
+  const span = maxDay - minDay;
+  if (span > MAX_DAY_SPAN)
+    return null;
+  const buckets = new Set;
+  for (let d = minDay - LOCAL_DATE_SKEW_DAYS;d <= maxDay + LOCAL_DATE_SKEW_DAYS; d++) {
+    buckets.add(formatDateBucket(new Date(d * DAY_MS)));
+  }
+  return buckets;
+}
+function decodeUuidV7Timestamp(threadId) {
+  if (typeof threadId !== "string")
+    return null;
+  const m = /^([0-9a-fA-F]{8})-([0-9a-fA-F]{4})-7[0-9a-fA-F]{3}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.exec(threadId);
+  if (!m)
+    return null;
+  const hex = `${m[1]}${m[2]}`;
+  const ms = Number.parseInt(hex, 16);
+  if (!Number.isFinite(ms))
+    return null;
+  const MIN = 1577836800000;
+  const MAX = 4102444800000;
+  if (ms < MIN || ms > MAX)
+    return null;
+  return ms;
+}
+function formatDateBucket(d) {
+  const yyyy = d.getUTCFullYear();
+  const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(d.getUTCDate()).padStart(2, "0");
+  return `${yyyy}/${mm}/${dd}`;
+}
+
+export { __require, logger, CLAUDE_EFFORT_VALUES, CODEX_EFFORT_VALUES, MAESTRO_EFFORT_VALUES, MODEL_SONNET, MODEL_OPUS, MODEL_FABLE, configureRolloutHost, assertUuidLike, ensureCwdExists, extractChatPairs, encodeClaudeCwd, writeClaudeRollout, repairPoisonedRollout, hostedCodexHomePath, extractLatestCodexPatchPreview, extractCodexPatchCallIds, readCodexPatchCallIds, readLatestCodexPatchPreview, extractLatestCodexContextUsage, readLatestCodexContextUsage, migrateCodexRolloutNativeMultiAgentMetadata, latestCodexRolloutPath, writeCodexRollout, decodeUuidV7Timestamp };
+
+//# debugId=3E746F752A616D9C64756E2164756E21