negotium 0.2.4 → 0.2.5

package/dist/runtime/src/agents/api-topic-agent-switch.ts

@@ -13,7 +13,7 @@ import {
 import type { AgentKind, EffortLevel } from "#types";
 
 export type ApiTopicSwitchOutcome =
-  | { kind: "fresh"; agent: AgentKind; reason: "no-history" | "bridge-failed" }
+  | { kind: "fresh"; agent: AgentKind; reason: "no-history" }
   | { kind: "bridged"; agent: AgentKind; bridgedSessionId: string; rolloutPath: string };
 
 export type ApiTopicSwitchResult =
@@ -119,18 +119,12 @@ export function switchApiTopicAgent(opts: SwitchApiTopicAgentOptions): ApiTopicS
         from: opts.fromAgent,
         to: opts.agent,
       },
-      "api-topic switch: rollout encoding failed — falling back to fresh session",
+      "api-topic switch: rollout encoding failed — preserving current agent session",
     );
-    try {
-      commitApiTopicSwitch(opts, null);
-    } catch (commitErr) {
-      logger.warn(
-        { err: commitErr, topicId: opts.topicId, agent: opts.agent },
-        "api-topic switch fallback commit failed",
-      );
-      return { ok: false, error: `failed to set agent for "${opts.topicTitle}"` };
-    }
-    return { ok: true, outcome: { kind: "fresh", agent: opts.agent, reason: "bridge-failed" } };
+    return {
+      ok: false,
+      error: `failed to preserve conversation while switching agent for "${opts.topicTitle}"`,
+    };
   }
 
   try {

package/dist/runtime/src/agents/claude-provider.ts

@@ -450,7 +450,7 @@ export async function* claudeProvider(opts: AgentQueryOptions): AsyncGenerator<U
               // Resolve Vault placeholders only for explicitly allowlisted
               // transient execution tools. Messaging and persistence tools
               // must retain {{KEY}} verbatim.
-              const userId = opts.userId ?? "";
+              const userId = opts.vaultUserId ?? opts.userId ?? "";
               const withVault = substituteClaudeToolInput(userId, tool_name, tool_input);
               if (JSON.stringify(withVault) === JSON.stringify(tool_input)) {
                 return { continue: true };
@@ -470,7 +470,7 @@ export async function* claudeProvider(opts: AgentQueryOptions): AsyncGenerator<U
           hooks: [
             async (input: HookInput) => {
               const { tool_response } = input as PostToolUseHookInput;
-              const userId = opts.userId ?? "";
+              const userId = opts.vaultUserId ?? opts.userId ?? "";
               const redacted = deepMapStrings(tool_response, (value) =>
                 redactHostedSecrets(userId, value),
               );

package/dist/runtime/src/agents/codex-provider.ts

@@ -774,6 +774,7 @@ export async function* codexProvider(opts: AgentQueryOptions): AsyncGenerator<Un
         } catch (err) {
           if (err instanceof Error && err.name === "AbortError") throw err;
           if (!currentSessionId || !isMissingCodexRolloutError(err)) throw err;
+          if (opts.userId && opts.session) throw err;
           logger.warn(
             { staleSessionId: currentSessionId, err: errMsg(err) },
             "codexProvider: stale/missing rollout, restarting fresh thread",

package/dist/runtime/src/agents/index.ts

@@ -129,18 +129,17 @@ export async function resolveSessionFileMissing(
 
 /**
  * Rebuild a missing SDK session file from the unified conversation log, or
- * fall back to a fresh session. Returns true when the session file is confirmed
- * to exist (either pre-existing or successfully rebuilt), false when the agent
- * should start a fresh session (no entries, rebuild failed, etc.).
+ * report whether the session is ready, genuinely has no history, or could not
+ * be repaired. Repair failures must not silently discard conversation context.
  */
 async function maybeRebuildSession(
   opts: AgentQueryOptions & { userId: string; session: string },
-): Promise<boolean> {
-  if (!opts.sessionId) return true; // fresh session, nothing to rebuild
+): Promise<"ready" | "fresh" | "failed"> {
+  if (!opts.sessionId) return "ready"; // fresh session, nothing to rebuild
 
   try {
     const missing = await resolveSessionFileMissing(opts.agent, opts.sessionId, opts.cwd);
-    if (!missing) return true; // file still on disk
+    if (!missing) return "ready"; // file still on disk
 
     logger.info(
       { agent: opts.agent, sessionId: opts.sessionId, topic: opts.session },
@@ -153,7 +152,7 @@ async function maybeRebuildSession(
         { agent: opts.agent, sessionId: opts.sessionId },
         "no unified log entries to rebuild — starting fresh session",
       );
-      return false;
+      return "fresh";
     }
 
     const operations = getRegistryOperations(opts.agent);
@@ -168,13 +167,13 @@ async function maybeRebuildSession(
       { agent: opts.agent, sessionId: result.sessionId, rolloutPath: result.rolloutPath },
       "session rebuilt from unified log",
     );
-    return true;
+    return "ready";
   } catch (err) {
     logger.warn(
       { err, agent: opts.agent, sessionId: opts.sessionId },
-      "session rebuild failed — starting fresh session",
+      "session rebuild failed — preserving resume key",
     );
-    return false;
+    return "failed";
   }
 }
 
@@ -183,11 +182,17 @@ export async function* runAgent(opts: AgentQueryOptions): AsyncGenerator<Unified
   const dispatchOpts: AgentQueryOptions = { ...opts };
 
   if (hasSessionRepairContext(dispatchOpts)) {
-    const ok = await maybeRebuildSession(dispatchOpts);
-    if (!ok) {
-      // Rebuild failed / no entries → clear sessionId so the agent starts
-      // a fresh session instead of trying to resume a non-existent one.
+    const repair = await maybeRebuildSession(dispatchOpts);
+    if (repair === "fresh") {
+      // No unified history exists, so a new provider session is intentional.
       dispatchOpts.sessionId = undefined;
+    } else if (repair === "failed") {
+      yield {
+        type: "error",
+        content:
+          "Provider session could not be rebuilt from conversation history; the existing session was preserved for retry.",
+      };
+      return;
     }
   }
 

package/dist/runtime/src/agents/maestro-provider.ts

@@ -242,7 +242,7 @@ export function maestroProvider(opts: AgentQueryOptions): AsyncGenerator<Unified
   if (opts.agent !== undefined && opts.agent !== "maestro") {
     throw new Error(`maestroProvider: unexpected agent "${opts.agent}", expected "maestro"`);
   }
-  const userId = opts.userId ?? "";
+  const userId = opts.vaultUserId ?? opts.userId ?? "";
   // The SDK deliberately ships with an empty MCP resolver. Keep this wiring in
   // the provider adapter rather than every host bootstrap so a new Negotium
   // channel cannot accidentally run Maestro with zero runtime/wiki/task MCPs.

package/dist/runtime/src/agents/rollout/codex.ts

@@ -157,6 +157,19 @@ export interface CodexPatchPreview {
   changes: CodexPatchChangePreview[];
 }
 
+function codexRolloutPath(threadId: string, fallback: Date): string {
+  const threadCreatedAt = decodeUuidV7Timestamp(threadId);
+  const createdAt = threadCreatedAt === null ? fallback : new Date(threadCreatedAt);
+  const yyyy = String(createdAt.getFullYear());
+  const mm = String(createdAt.getMonth() + 1).padStart(2, "0");
+  const dd = String(createdAt.getDate()).padStart(2, "0");
+  const hh = String(createdAt.getHours()).padStart(2, "0");
+  const min = String(createdAt.getMinutes()).padStart(2, "0");
+  const ss = String(createdAt.getSeconds()).padStart(2, "0");
+  const dir = join(codexSessionsDir(), yyyy, mm, dd);
+  return join(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
+}
+
 function canonicalFilePath(path: string): string {
   const absolute = resolve(path);
   try {
@@ -564,22 +577,17 @@ export function writeCodexRollout(opts: CodexRolloutOptions): CodexRolloutResult
     payload: { type: "task_complete" },
   });
 
-  const yyyy = now.getUTCFullYear();
-  const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
-  const dd = String(now.getUTCDate()).padStart(2, "0");
-  const tsStr = tsIso.replace(/[:.]/g, "-").slice(0, 19);
-  const dir = join(codexSessionsDir(), String(yyyy), mm, dd);
-  const path = join(dir, `rollout-${tsStr}-${threadId}.jsonl`);
+  // Codex indexes a thread by the local wall-clock timestamp encoded in its
+  // UUIDv7 creation time. A cross-agent round-trip may rewrite the rollout
+  // much later, but the path must remain the original canonical path or
+  // `thread/resume` rejects it as missing and the provider starts fresh.
+  const path = codexRolloutPath(threadId, now);
 
   // Round-trip cleanup: when the caller reused a threadId (claude→codex→...
   // or maestro→codex→... cycles via `findLastSessionIdForAgent`), the SDK's
-  // original rollout for that threadId still sits at its ORIGINAL-date
-  // directory (`~/.codex/sessions/<orig-yyyy>/<orig-mm>/<orig-dd>/...`).
-  // Writing today's synthetic rollout next to it leaves two jsonls sharing
-  // the same threadId — `codex resume <tid>` globs `~/.codex/sessions/**`
-  // and the SDK has no spec for which match it picks, so behavior becomes
-  // environment-/codex-version-dependent. Sweep every prior file for this
-  // threadId BEFORE writing the new one so resume always reads our synth.
+  // original rollout for that threadId still sits at its canonical path.
+  // Sweep every prior file for this threadId BEFORE replacing that path so
+  // legacy writers cannot leave ambiguous duplicates behind.
   //
   // Synchronous on purpose: writeCodexRollout's signature is sync (called
   // inside set_agent's DB transaction), and an async sweep would race with
@@ -672,11 +680,10 @@ function sweepPriorRolloutsFullTree(threadId: string, sessionsDir: string): void
 }
 
 /**
- * UUIDv7 ids encode their creation time in the first 48 bits. `writeCodexRollout`
- * buckets new files at `<yyyy>/<mm>/<dd>/` keyed off the WRITE time, so a
- * thread's rollouts can only live between (threadId's birth date) and
- * (today's date) — typically a 0-2 day span. We enumerate every day in that
- * inclusive range so a Mon-bridge / Tue-rebridge picks up both.
+ * UUIDv7 ids encode their creation time in the first 48 bits. Current writers
+ * always use that canonical birth-date bucket, but older writers used the
+ * rewrite date during cross-agent bridges. Enumerate the inclusive range from
+ * birth date to today so cleanup also removes those legacy misplaced files.
  *
  * Returns null when:
  *   - threadId isn't a parseable UUIDv7 (atypical fixture / future format)

package/dist/runtime/src/agents/self-config-core.ts

@@ -89,7 +89,7 @@ export type SelfConfigAgentSwitchResult =
   | {
       ok: true;
       outcome:
-        | { kind: "fresh"; agent: AgentKind; reason: "no-history" | "bridge-failed" }
+        | { kind: "fresh"; agent: AgentKind; reason: "no-history" }
         | {
             kind: "bridged";
             agent: AgentKind;
@@ -386,9 +386,7 @@ export function createSelfConfigCore(
     const sessionNote =
       switched.outcome.kind === "bridged"
         ? ` Conversation history was bridged into a ${agent} session (${switched.outcome.bridgedSessionId}).`
-        : switched.outcome.reason === "bridge-failed"
-          ? " Conversation history bridge failed; the next turn starts fresh."
-          : " No prior conversation history was found; the next turn starts fresh.";
+        : " No prior conversation history was found; the next turn starts fresh.";
     return ok(
       `Agent for this topic set to '${agent}'. Model/effort reset to '${agent}' defaults.${sessionNote}`,
     );

package/dist/runtime/src/agents/topic-agent-switch.ts

@@ -39,7 +39,7 @@ export type SwitchAgentOutcome =
   | {
       kind: "fresh";
       agent: AgentKind;
-      reason: "no-history" | "bridge-failed";
+      reason: "no-history";
     }
   | {
       kind: "bridged";
@@ -128,17 +128,11 @@ export function switchTopicAgent(
   } catch (err) {
     logger.warn(
       { err, userId, topicName, from: oldAgent, to: agent },
-      "switchTopicAgent: rollout encoding failed — falling back to fresh session",
+      "switchTopicAgent: rollout encoding failed — preserving current agent session",
     );
-    const changed = setTopicAgentAndClearSession({
-      userId,
-      topicName,
-      agent,
-    });
-    if (!changed) return { ok: false, error: `failed to set agent for "${topicName}"` };
     return {
-      ok: true,
-      outcome: { kind: "fresh", agent, reason: "bridge-failed" },
+      ok: false,
+      error: `failed to preserve conversation while switching agent for "${topicName}"`,
     };
   }
 

package/dist/runtime/src/application/submit-runtime-gateway-turn.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { appendApiMessage, getApiMessage } from "#storage/api-messages";
 import { getTopicSessionId } from "#storage/api-topics";
 import { db } from "#storage/forum-db";
@@ -8,12 +8,20 @@ import {
   type RuntimeGatewaySubmission,
   recordRuntimeGatewaySubmission,
 } from "#storage/runtime-gateway-submissions";
-import { enqueueRuntimeUserTurnRequest } from "#storage/runtime-turn-requests";
+import { requestRuntimeTurnAbort } from "#storage/runtime-leases";
+import { getRuntimeTopicEpoch } from "#storage/runtime-topic-state";
+import { mergeRuntimeUserTurnRequest } from "#storage/runtime-turn-requests";
 import type { MessageDto, TopicDto } from "#types/api";
 
 export interface SubmitRuntimeGatewayTurnParams {
   topic: TopicDto;
+  /** Canonical execution principal, normally `local`. */
   userId: string;
+  /** Authenticated upstream author retained independently from execution. */
+  actorUserId?: string;
+  actorLabel?: string;
+  /** Topic owner's credential namespace. */
+  vaultUserId?: string;
   text: string;
   clientMessageId: string;
   requestId?: string;
@@ -25,9 +33,30 @@ export interface SubmitRuntimeGatewayTurnResult extends RuntimeGatewaySubmission
   deduplicated: boolean;
 }
 
-function duplicateResult(submission: RuntimeGatewaySubmission): SubmitRuntimeGatewayTurnResult {
+function duplicateResult(
+  submission: RuntimeGatewaySubmission,
+  params: SubmitRuntimeGatewayTurnParams,
+  requestId: string,
+  actorUserId: string,
+  payloadHash: string,
+): SubmitRuntimeGatewayTurnResult {
   const message = getApiMessage(submission.topicId, submission.messageId);
   if (!message) throw new Error("gateway submission references a missing canonical message");
+  if (submission.payloadHash && submission.payloadHash !== payloadHash) {
+    throw new RuntimeGatewayIdempotencyConflictError();
+  }
+  if (
+    (!submission.payloadHash &&
+      (message.authorName !== params.actorLabel ||
+        message.authorId !== actorUserId ||
+        message.text !== params.text)) ||
+    submission.clientMessageId !== params.clientMessageId ||
+    submission.requestId !== requestId ||
+    submission.topicId !== params.topic.id ||
+    submission.userId !== params.userId
+  ) {
+    throw new RuntimeGatewayIdempotencyConflictError();
+  }
   return {
     ...submission,
     message,
@@ -35,6 +64,28 @@ function duplicateResult(submission: RuntimeGatewaySubmission): SubmitRuntimeGat
   };
 }
 
+function gatewayPayloadHash(
+  params: SubmitRuntimeGatewayTurnParams,
+  requestId: string,
+  actorUserId: string,
+): string {
+  return createHash("sha256")
+    .update(
+      JSON.stringify([
+        params.topic.id,
+        params.userId,
+        actorUserId,
+        params.actorLabel ?? null,
+        params.vaultUserId ?? null,
+        params.text,
+        params.clientMessageId,
+        requestId,
+        params.allowAutoContinue ?? true,
+      ]),
+    )
+    .digest("hex");
+}
+
 /**
  * Durable ingress for an authenticated external gateway. It deliberately
  * reuses the canonical message table and existing durable turn worker rather
@@ -45,8 +96,7 @@ function duplicateResult(submission: RuntimeGatewaySubmission): SubmitRuntimeGat
  *
  * A distinct type rather than a plain `Error` because the control plane maps
  * this to 409, and it must not be confused with a *missing* `clientMessageId`,
- * which is a malformed request (400). Matching on message text conflated the
- * two.
+ * which is a malformed request (400).
  */
 export class RuntimeGatewayIdempotencyConflictError extends Error {
   constructor(message = "clientMessageId or requestId is already bound to another turn") {
@@ -59,24 +109,19 @@ export function submitRuntimeGatewayTurn(
   params: SubmitRuntimeGatewayTurnParams,
 ): SubmitRuntimeGatewayTurnResult {
   const requestId = params.requestId ?? params.clientMessageId;
+  const actorUserId = params.actorUserId ?? params.userId;
+  const payloadHash = gatewayPayloadHash(params, requestId, actorUserId);
   const existing = findRuntimeGatewaySubmission(params.clientMessageId, requestId);
   if (existing) {
-    if (
-      existing.clientMessageId !== params.clientMessageId ||
-      existing.requestId !== requestId ||
-      existing.topicId !== params.topic.id ||
-      existing.userId !== params.userId
-    ) {
-      throw new RuntimeGatewayIdempotencyConflictError();
-    }
-    return duplicateResult(existing);
+    return duplicateResult(existing, params, requestId, actorUserId, payloadHash);
   }
 
   const createdAt = new Date().toISOString();
   const message: MessageDto = {
     id: randomUUID(),
     topicId: params.topic.id,
-    authorId: params.userId,
+    authorId: actorUserId,
+    authorName: params.actorLabel,
     sourceAdapter: "runtime-gateway",
     sourceMessageId: params.clientMessageId,
     text: params.text,
@@ -91,23 +136,31 @@ export function submitRuntimeGatewayTurn(
     createdAt,
     ackCursor: 0,
     messageCursor: 0,
+    payloadHash,
   };
 
   try {
     db.transaction(() => {
       appendApiMessage(message, { notify: false });
-      enqueueRuntimeUserTurnRequest({
+      mergeRuntimeUserTurnRequest({
         topicId: params.topic.id,
         userId: params.userId,
-        prompt: params.text,
+        userMessages: [
+          {
+            prompt: params.text,
+            actorUserId,
+            ...(params.actorLabel ? { actorLabel: params.actorLabel } : {}),
+          },
+        ],
         allowAutoContinue: params.allowAutoContinue ?? true,
         requestId,
-        supersedeExisting: false,
+        topicEpoch: getRuntimeTopicEpoch(params.topic.id),
         execution: {
           sessionId: getTopicSessionId(params.topic.id),
           sessionIdSpecified: true,
           conversationPrompts: [params.text],
           loggedUserMessageCount: 0,
+          vaultUserId: params.vaultUserId,
         },
       });
       const acceptedEvent = appendRuntimeEvent("runtime-gateway-ingress", {
@@ -131,9 +184,14 @@ export function submitRuntimeGatewayTurn(
     })();
   } catch {
     const raced = findRuntimeGatewaySubmission(params.clientMessageId, requestId);
-    if (raced) return duplicateResult(raced);
+    if (raced) return duplicateResult(raced, params, requestId, actorUserId, payloadHash);
     throw new Error("failed to persist gateway turn idempotency record");
   }
 
+  // A new human message steers the active topic turn. The durable replacement
+  // is committed first; the provider observes this abort on its next lease
+  // heartbeat and the worker resumes the merged batch after unwind.
+  requestRuntimeTurnAbort(params.topic.id, "internal");
+
   return { ...submission, message, deduplicated: false };
 }

package/dist/runtime/src/application/switch-topic-model.ts

@@ -1,11 +1,10 @@
 import { switchApiTopicAgent } from "#agents/api-topic-agent-switch";
 import { checkAgentModelAuth } from "#agents/auth-check";
-import { resolveModelForAgent, selectableModel } from "#agents/model-catalog";
-import { getRegistry } from "#agents/registry";
+import { selectableModel } from "#agents/model-catalog";
 import { WsHub } from "#bus";
 import { resolveTopicWorkspaceDir } from "#platform/config";
 import { getApiTopicConfig, setApiTopicConfig } from "#storage/api-topic-config";
-import { clearTopicSessionId, getTopic } from "#storage/api-topics";
+import { getTopic } from "#storage/api-topics";
 
 export type SwitchTopicModelResult =
   | { ok: true; model: string; text: string }
@@ -63,14 +62,12 @@ export function switchTopicModel(params: SwitchTopicModelParams): SwitchTopicMod
     });
     if (!switched.ok) return { ok: false, error: switched.error };
   } else {
-    const registry = getRegistry(currentAgent);
-    const previousModel = resolveModelForAgent(
-      currentAgent,
-      currentConfig.model ?? topic.defaultModel,
-      registry,
-    );
     setApiTopicConfig(topic.id, nextConfig);
-    if (previousModel !== target.model) clearTopicSessionId(topic.id, "user-model-switch");
+    // A provider session is not owned by one model. Codex, Claude, and Maestro
+    // all accept the selected model when resuming, so keep the durable resume
+    // key and let the next turn continue the same rollout with the new model.
+    // Clearing it here silently discarded native tool/history structure and
+    // made an ordinary model change look like `/new`.
   }
 
   WsHub.get().broadcastTopicUpdated(topic.id);

package/dist/runtime/src/index.ts

@@ -176,6 +176,10 @@ export { FROM_AUTO_CONTINUE } from "#platform/constants";
 export { errMsg } from "#platform/error";
 export { appendJsonlEntry } from "#platform/jsonl";
 export { onShutdown, runShutdown } from "#platform/lifecycle";
+export {
+  DEFAULT_DAEMON_LOG_ROTATE_BYTES,
+  rotateOversizedLog,
+} from "#platform/log-rotation";
 export { logger } from "#platform/logger";
 export type {
   NodeMcpEntry,

package/dist/runtime/src/mcp/wiki-server.ts

@@ -439,23 +439,28 @@ function wikiLastConversation(args: Record<string, unknown>): CallToolResult {
 
   const name = slugify(topicNameFrom(rawTopic));
 
-  // Try per-topic archive dir first, then flat file
+  // Try per-topic archive dir first, then flat file. This is a read path —
+  // it must never create directories on lookup (that previously left an
+  // empty `wiki/archive/<topic>/` behind for every topic name ever queried,
+  // even when nothing was ever archived under the per-topic layout).
   const archiveDir = resolve(runtime().archiveDir, name);
-  ensureDir(archiveDir);
 
   try {
     // List archive files sorted by name (which should be date-sorted)
-    let files = readdirSync(archiveDir)
-      .filter((f) => f.endsWith(".jsonl"))
-      .sort()
-      .reverse();
+    let files = existsSync(archiveDir)
+      ? readdirSync(archiveDir)
+          .filter((f) => f.endsWith(".jsonl"))
+          .sort()
+          .reverse()
+      : [];
     if (files.length === 0) {
       // Try flat archive
-      ensureDir(runtime().archiveDir);
-      files = readdirSync(runtime().archiveDir)
-        .filter((f) => f.startsWith(name) && f.endsWith(".jsonl"))
-        .sort()
-        .reverse();
+      files = existsSync(runtime().archiveDir)
+        ? readdirSync(runtime().archiveDir)
+            .filter((f) => f.startsWith(name) && f.endsWith(".jsonl"))
+            .sort()
+            .reverse()
+        : [];
     }
     if (files.length === 0) {
       return {
@@ -467,7 +472,9 @@ function wikiLastConversation(args: Record<string, unknown>): CallToolResult {
     const actualPath = files[0].includes("/")
       ? files[0]
       : resolve(
-          readdirSync(archiveDir).includes(files[0]) ? archiveDir : runtime().archiveDir,
+          existsSync(archiveDir) && readdirSync(archiveDir).includes(files[0])
+            ? archiveDir
+            : runtime().archiveDir,
           files[0],
         );
 

package/dist/runtime/src/platform/config.ts

@@ -75,7 +75,6 @@ export const BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
 export const BINARIES_DIR = resolve(STATE_DIR, "binaries");
 export const SECRETS_DIR = resolve(STATE_DIR, "secrets");
 // Legacy names remain public, but their durable contents now live under data.
-export const CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
 export const DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
 export const SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
 // The Claude Agent SDK ships a platform-matched Claude Code binary. Keep that
@@ -364,7 +363,6 @@ mkdirSync(WORKSPACE_DIR, { recursive: true });
 mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
 mkdirSync(SHARED_WIKI_DIR, { recursive: true });
 mkdirSync(CRON_WORKSPACE_DIR, { recursive: true });
-mkdirSync(CONTEXTS_DIR, { recursive: true });
 mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
 mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
 mkdirSync(BROWSER_DIR, { recursive: true });

package/dist/runtime/src/platform/log-rotation.ts

@@ -0,0 +1,45 @@
+/**
+ * Size-based rotation for daemon stderr logs.
+ *
+ * Negotium adapters (`negotium-terminal`, `negotium-telegram`, `negotium-otium`)
+ * each spawn the node daemon with its stderr redirected straight to
+ * `<LOG_DIR>/node-daemon.log`. That file is opened once at spawn time and
+ * accumulates for the daemon's whole lifetime with no cap, so long-running
+ * hosts eventually carry an unbounded log file.
+ *
+ * True in-place rotation (SIGHUP-style reopen) would require the daemon to
+ * cooperate by reopening its own stderr fd, which Bun does not expose. The
+ * practical fix instead rotates *before* spawn: every time a CLI is about to
+ * start the daemon, check the previous log's size and, if it crossed the
+ * threshold, rename it aside with a timestamp so the new spawn starts a
+ * fresh, empty file.
+ */
+
+import { existsSync, renameSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/** Rotate once the log exceeds this size (bytes) at the next daemon start. */
+export const DEFAULT_DAEMON_LOG_ROTATE_BYTES = 20 * 1024 * 1024; // 20MB
+
+/**
+ * If `logPath` exists and is at least `maxBytes`, rename it aside with an
+ * ISO-ish timestamp suffix so a fresh file can be created at `logPath`.
+ * No-op (and never throws) when the file is missing, under the threshold, or
+ * the rename fails for any reason — log rotation must never block startup.
+ */
+export function rotateOversizedLog(
+  logPath: string,
+  maxBytes: number = DEFAULT_DAEMON_LOG_ROTATE_BYTES,
+): void {
+  try {
+    if (!existsSync(logPath)) return;
+    const { size } = statSync(logPath);
+    if (size < maxBytes) return;
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const dir = join(logPath, "..");
+    const base = logPath.slice(dir.length + 1);
+    renameSync(logPath, join(dir, `${base}.${stamp}`));
+  } catch {
+    // Best-effort: a failed rotation should never prevent the daemon from starting.
+  }
+}

package/dist/runtime/src/platform/mcp-config.ts

@@ -207,6 +207,8 @@ export function consumePlaywrightUnavailable(userId: string, topic: string | und
 
 export interface RuntimeMcpBuildContext {
   userId: string;
+  /** Vault namespace when credentials belong to a different principal. */
+  vaultUserId?: string;
   /** "dm" for DM scope, topic/session name for forum/fork. */
   session: string;
   /** REST/WS topic id when known. Prefer for authorization/scope checks. */
@@ -527,13 +529,13 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
   vault: {
     ...commonRuntimeMcpPolicy("vault"),
     build(ctx) {
-      const { userId, agent } = ctx;
+      const { userId, vaultUserId, agent } = ctx;
       // Normal turns use {{KEY}} directly in tool inputs. Keep the Vault MCP
       // surface focused on key discovery; broker tools remain available from
       // the public factory for compatibility but are no longer the default UX.
-      const args = [`--user-id=${userId}`];
+      const args = [`--user-id=${vaultUserId ?? userId}`];
       if (agent !== "codex") args.push("--list-only=true");
-      return buildBuiltinMcpServer("vault", ctx, () =>
+      return buildBuiltinMcpServer("vault", { ...ctx, userId: vaultUserId ?? userId }, () =>
         buildStdioMcpServer(agent, VAULT_SERVER, args),
       );
     },
@@ -767,6 +769,7 @@ export function getManagerMcpServers(opts: {
  */
 export function getForumMcpServers(opts: {
   userId: string;
+  vaultUserId?: string;
   session: string;
   topicId?: string;
   subagentParentTopicId?: string;
@@ -790,6 +793,7 @@ export function getForumMcpServers(opts: {
 }) {
   const {
     userId,
+    vaultUserId,
     session,
     topicId,
     subagentParentTopicId,
@@ -824,6 +828,7 @@ export function getForumMcpServers(opts: {
     "forum",
     {
       userId,
+      vaultUserId,
       session,
       topicId,
       subagentParentTopicId,
@@ -945,6 +950,7 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
   }
   return getForumMcpServers({
     userId: opts.userId || "local",
+    vaultUserId: opts.vaultUserId,
     session: opts.session || "default",
     topicId: opts.topicId,
     subagentParentTopicId: opts.subagentParentTopicId,